21 Commits

Include renames

Author	SHA1	Message	Date
mudler-agentandEttore Di Giacinto	4899d28e8a	feat(chats): server-side chats with steering, sub-agents and compaction (#12918) ... * Find the Sandbox guest image in the executable, not its build info The Sandbox smoke checked that the packaged executable carries the guest image by looking for -X main.guestImage in go version -m. The package is built with -trimpath, and with -trimpath Go leaves -ldflags out of the build info, so the check failed on every gvisor run, although the image was linked in. Look for the reference in the executable instead: the value of SANDBOX_GUEST_IMAGE when it is set, any digest reference otherwise. package.sh had the same check for an executable built elsewhere; it now looks for its own reference the same way. Assisted-by: Claude:claude-opus-5-5 * Answer a network card the limit refuses with one precise reason A card that waited while the administrator's limit went down was refused on the first click with 400, and every later click was a bare 409, so a stale card looked like a conflict loop. A refused card now answers 400 egress_above_ceiling every time, the same answer sent twice is one answer (204), and another answer to an answered card is 409 already_answered. The chat view marks a card the limit cannot admit with above_ceiling. When the limit is off, or below the chat's preset, the note of the turn and the block line of the proxy now say that the server's setting blocks the network and no approval changes it, so the model reports it instead of waiting or retrying. Assisted-by: Claude:claude-sonnet-5-5 * Explain a blocked Sandbox network instead of offering dead buttons A card the limit cannot admit shows why network access is off or limited, and who can change it, with a link to Settings > Tools > Sandbox network for administrators. The buttons of a card disable while an answer is sent, and a failed answer reads the card again. The Network row says why its choices are capped. Settings opens a group from ?group=. Strings are translated in all nine locales and the chat and add-on docs describe the new behaviour. Assisted-by: Claude:claude-sonnet-5-5 * Add an always-allowed hosts list to the Sandbox network The extra registries setting only widens the package registries, so a one-off host needs the approval card in every chat. The new admin setting chats_egress_allowed_hosts lists exact hosts (optionally host:port to pin a port) that a chat reaches whenever its effective preset is registries or all. The list sits in the same decision as the presets: the ceiling still caps it, the ports setting still applies, and a private, loopback, link-local or metadata address still needs the private switch and an administrator's rule or answer. Each use is audited with the reason allowed_host. Hosts are validated like the extra registries (lower case, punycode, no scheme, path or pattern, at most 64) and an IP literal is refused unless the private switch is on. get_chat_egress and the chat egress view return the list; no MCP tool writes it, as for the extra registries. Assisted-by: Claude:claude-sonnet-5-5 * Let users delete from the Trash for good A delete only set a tombstone, so the Trash grew without end and nothing could free the space of a deleted file. The workspace stores gain a Purger: it erases the deleted nodes of some change sets, or of a whole folder, with their journal rows, the change sets that nothing is left in, and the blobs that no row refers to. Both stores implement it and pass the same contract specs. A blob is removed after a grace period, and only if it is still unused then, so an upload of the same bytes in flight keeps them. DELETE /api/chats/files/trash empties the user's Trash and DELETE /api/chats/files/trash/{rev} deletes one entry. Both are scoped to the caller's home. The Trash listing now gives files, folders and bytes per entry and for the whole Trash. The file tools of a chat cannot reach any of this. Assisted-by: Claude:claude-sonnet-5-5 * Add Empty Trash and Delete permanently to the Files page The Trash tab shows what it holds, with an Empty Trash button that is off while the Trash is empty and a Delete permanently button on each item. Both ask in the page first and say how many files and folders and how much space they remove. Texts are translated in all nine locales. Assisted-by: Claude:claude-sonnet-5-5 * Fall back to Brave Search and Bing when DuckDuckGo asks for a captcha DuckDuckGo answers some servers with HTTP 202 and a bot check (the "anomaly" page) instead of results. The parser read that page as "no results it could read", so web_search failed for every query. The keyless search is now a chain: DuckDuckGo, then the result page of Brave Search, then the result page of Bing. Each page has its own tolerant parser (title, URL, snippet; Bing's /ck/a links and DDG's uddg links are unwrapped) with saved fixtures. A bot check is a typed error (ErrChallenged), and a 403 or 429 is ErrBlocked. Both wrap ErrProvider. A Fallback with a cool-down skips a challenged or blocked provider for a few minutes, so each search does not wait for it first; when every provider is cooling down, all are asked again. Fallback.SearchAttempts and TestEach report what each provider did (ok, no_results, challenged, blocked, timeout, error, skipped). The error a model reads now lists what was tried and what each provider did, then where an administrator fixes it. safehttp keeps the status code of an answer (Response.StatusCode) and of a refusal (StatusError, still ErrStatus for errors.Is). Assisted-by: Claude:claude-opus-5-5 * Use the keyless search chain in the chats and test each provider The built-in web_search now searches with DuckDuckGo, Brave Search and Bing in turn when no SearXNG instance is set. A new runtime setting, chats_web_search_providers, sets the order (searxng, duckduckgo, brave_html, bing_html) and leaves a provider out. Empty keeps the old choice: SearXNG alone when an instance is set, so its queries do not reach the public engines unless the administrator lists them. POST /api/chats/admin/web/test asks every provider of the order and returns what each did in "providers" (ok, no_results, challenged, blocked, timeout or error, with the reason), next to the first answer. Settings > Tools has a Test search on the web_search row that shows it, and the provider list is checked on the page and by the server. The cool-down of a challenged provider is kept per frontend, like the cache and the limits; web.md says why. Docs: web.md (providers, chain, bot checks, privacy, how to fix it with SearXNG or the Web add-on) and runtime-settings.md. Strings in the nine locales. Swagger regenerated. Assisted-by: Claude:claude-opus-5-5 * Try the mirror library alone in the reinstall recovery spec The spec adds a second library with the same URL and expects an install from it to keep the retained data apart. Since two enabled libraries that list one add-on are a conflict, the reinstall from the original library then failed with library_conflict, and the install from the mirror failed for that reason instead of the trusted identity. Switch the original library off while the mirror is tried, check that the mirror is refused for its identity and not for a conflict, then switch the mirror off and the original on for the reinstall. Assisted-by: Claude:claude-opus-5-5 * Pause a chat turn at the step limit and offer Continue A chat turn ran at most 10 rounds of tool calls, the default of the harness, because nothing set a limit. A multi-step task (read some files, run commands, write a result) stopped half way, and the person saw an answer that looked final. The limit is now the runtime setting chats_max_iterations (1 to 500, default 40, Settings > Tools); a model's agent.max_iterations still wins. When the tool loop reaches it, the harness sends a paused event with the limit, and the turn ends with last_turn "paused". A paused turn counts as finished: waiting messages start the next turn and a sub-agent reports back. The status line says "Paused, after 40 steps" and has a Continue button, which sends a message that asks the model to go on. A claim that found no waiting message released the chat as "done", which hid a pause. It now keeps the status the chat had. Assisted-by: Claude:claude-opus-5-5 * Edit the always-allowed Sandbox hosts in Settings > Tools Add a list editor for chats_egress_allowed_hosts next to the extra package registries: the hosts are tags with a remove button, an input adds one on Enter, comma or Add (a pasted list adds them all), and the reason an entry is refused shows under the input, with the count out of 64. The same checks stop Apply on a bad entry, and the server still has the last word. The chat's Network panel lists the hosts read only and the row says how many an administrator always allows while the chat's network is on. The help text of both settings now says how they differ. Strings are translated in all nine locales. Assisted-by: Claude:claude-sonnet-5-5 * Document the always-allowed Sandbox hosts Describe chats_egress_allowed_hosts in the runtime settings page, the network section of the add-ons page (including the allowed_host audit reason and how the list differs from extra registries) and the chats page. Assisted-by: Claude:claude-sonnet-5-5 * Let a chat edit, pause and delete the person's triggers A chat could propose a trigger and list them, but not change one: the Triggers page and the API could. list_triggers now gives each trigger a stable ref (not its id) and shows the prompt of one trigger only when asked. update_trigger and delete_trigger store a change record in the trigger table: an edit or a delete waits for Apply or Delete on a card, a pause or a resume applies at once with a receipt. An applied change can be undone for a day; a delete restores the trigger with its id. Change records are rows in the database, so every frontend shows and answers the same card. The new routes under /api/chats/triggers/changes serve the card and are gated by the triggers feature. Assisted-by: Claude:claude-opus-5-5 * Show the trigger changes a chat asks for as cards An edit lists each changed field before and after with Apply and Dismiss, a delete shows the trigger and its last run with Delete and Keep, and an applied change is a receipt with Undo. The cards sit below the message text like the proposal card, and read their state from the server so a reload shows the same answer. Assisted-by: Claude:claude-opus-5-5 * Add a Test search button to the web tools settings POST /api/chats/admin/web/test existed, but no page called it and the docs showed only curl. The web_search row of Settings > Tools now has a Test search button. It runs one search with the applied settings and shows the provider with its first results, or the error a chat would read. Assisted-by: Claude:claude-opus-5-5 * Describe undo per tool call in the chats docs The docs said the checkpoint line of a turn carries the change set of the turn. A turn checkpoint is taken only by a chat with a VM sandbox, which the service never sets up, so that rev is always 0. What ships is one change set per file tool call, with a files_change card on its tool line. The docs now say so and how to undo a whole turn. Grouping a turn's changes into one change set in the file store is left for later: it touches the file store's revisions and the undo of shared folders. Assisted-by: Claude:claude-opus-5-5 * Mount the skill folders read-only for the built-in bash The built-in pdf skill ships scripts, but the commands saw only the home and the shared folders, so the model could read the scripts and not run them. The built-in bash now mounts the three skill layers read-only, at the names the file tools already use: shared-skills, shared-builtin-skills and shared-addon-skills. A shared folder named skills moves to "shared-skills 2", so the two never collide. A read-only mount with subfolders made every command report its folders as changes the mount refused, because the host backend lists every folder of its work tree. A folder alone is no change: both stores now refuse only files, whiteouts and opaque folders there. The Sandbox add-on mounts only the home; the docs say to copy a script there first. Assisted-by: Claude:claude-opus-5-5 * Find the add-on that runs commands by what it shadows The chats knew the add-on that runs commands from a per-process cache, filled with the Sandbox's own tool name the first time a chat listed its tools. Another add-on that replaces bash did not count, so skills that need commands showed as unavailable. The admin network view read the same cache: after a restart it said no Sandbox serves until someone chatted, each frontend of a cluster could answer differently, and a removed add-on stayed listed. The tool that runs commands is now the one that shadows bash, as the spec asks. sandboxRunTool and the cache are gone. The stand-in of an add-on that cannot work carries the built-in tools it replaces, and the admin view asks the add-on host which add-on serves bash now: the pinned one or the oldest running install, and none when the pinned one is stopped. Assisted-by: Claude:claude-opus-5-5 * Show international host names in punycode in the network checks The card-spoofing defence of the sandbox network asks for host names in their ASCII form, but CheckHost passed Unicode names through. A look-alike name reached the consent card as text that reads like the real site. CheckHost now converts an international name with the IDNA lookup profile and refuses one with no valid ASCII form. The conversion runs before the address checks, so full-width digits that spell a loopback address are refused as loopback. Assisted-by: Claude:claude-opus-5-5 * Keep the seeded Studio and Talk pins until the add-ons are installed The upgrade pins Studio and Talk for existing accounts, but both are add-ons that an administrator installs later. The sweep marked a pin whose add-on is not installed as missing and deleted it after 30 days, so an administrator who installed Studio late found the seeded pins gone. The sweep now records the first time a seeded add-on is present, in the table of seed runs or the pins file. A seeded pin keeps no clock until then, and a mark that an older sweep set is cleared. After the first install the pin follows the retention rule as before. Assisted-by: Claude:claude-opus-5-5 * Fix two small labels of the Skills and Backends pages On the Skills page, the skill of an add-on that is not chosen said "Replaced by <add-on>", the label of a built-in skill that an add-on serves. It now says "Not active: <add-on> provides it", as the add-on skills spec asks. On the Backends page, Clear filters on an empty Installed search left the library filter set, so the list stayed empty. It now clears the library filter too. Assisted-by: Claude:claude-opus-5-5 * Tell the model when no network card can appear Each turn told the model that a blocked host asks the user. No card appears when the ceiling is off or no wider than the chat's preset, in an unattended run or in a sub-agent, so the model waited for an answer that could not come. The line now says that a blocked host is refused and nothing asks the user in those cases, so the model names the host it needs in its answer. Assisted-by: Claude:claude-opus-5-5 * Translate six Backends and preview labels in every locale check, reinstallBackend, deleteBackend and filterLabel of the Backends page and the label and failed text of the file preview showed in English in the eight other locales. They now have translations, and the i18n baseline goes down to match. Also fix a comment of the home composer that still named the removed Canvas chip. Assisted-by: Claude:claude-opus-5-5 * List the admin routes that have no assistant tool, with the reason The admin oversight routes of saved agents, triggers and connectors had no MCP tool and no recorded reason, and the other deliberate skips lived only in code comments. coverage_test.go now keeps them in adminRoutesWithoutTool with a reason each, and a spec checks that no route there is also wrapped by a tool. The contributor checklist names the map. The tool catalog of the assistant docs said it matched the real one but missed most tools added since. It now lists every tool, read-only and mutating, and the actions that stay in the web interface. Assisted-by: Claude:claude-opus-5-5 * Close the doc and registry gaps of the chats and add-ons - /api/agent/* answers 404 with the chats_off reason when the chats are off, as /api/chats/* and /api/workspace/* do. - The add-ons docs get an upgrade section: Studio and Talk are add-ons, nothing is preinstalled, and users need the addons feature, which the upgrade does not grant. It says how an administrator installs them (also from a private library) and grants the feature, and carries a paragraph for the release notes. - The migration page no longer lists fork, edit, the chat settings and the token counters as removed. - Runtime settings document chats_vision_model, chats_transcription_model and the skill keys of chats_tool_providers. - The docs show POST /api/chats/files/folders, GET /api/chats/files/history and the allow route of a connector sender. - The in-tree specs get amendments where the shipped design differs. - A route test of the tagged suite still set the removed Runs field. Assisted-by: Claude:claude-opus-5-5 * Look for the kit empty state in the backends regression spec The Backends page now draws the shared EmptyState of the kit (ui-empty), not the old dk-empty block, so the regression spec of the gallery suite found no empty state after a search with no match. Check the kit's no-results form and its title. Assisted-by: Claude:claude-opus-5-5 * Ignore a features request that outlives its page in the add-on stubs stubAddonRoutes answers /api/features by fetching the real flags and turning add-ons on. A spec that ends while the page polls, like the one that checks that a viewer without the feature never reads the list, left that fetch in flight, and Playwright failed the spec with "route.fetch: Target page, context or browser has been closed" after its checks had passed. Abort the request when the fetch fails because the page is gone. Assisted-by: Claude:claude-opus-5-5 * Bring the gallery-ui case inventory up to date The suite lists the node unit cases of addons.test.mjs and the Playwright specs of addons-gallery.spec.js. The inventory missed the unit cases added since it was written, and one spec was renamed when the legacy switch came in ("hub: the Add-ons tab appears only for an account that holds the feature" is now "hub: under the legacy switch the Add-ons tab appears ..."). The list comes from a local run of both parts against the UI test server. Assisted-by: Claude:claude-opus-5-5 * Read spreadsheets, documents and slides in read_document read_document said "file.xlsx has no text layer; it may be a scan" for workbooks that some Python libraries write. Their workbook gives the sheet as an absolute part name (/xl/worksheets/sheet1.xml) and the cells as inline strings. The text extractor of the harness joined "xl/" with that name, found no sheet, and returned no text; the tool then took any empty result for a scanned PDF. The new package core/services/studio/extract has one entry point, Extract(ctx, name, data), that returns the text and the structure it read, for read_document now and for a file indexer later. Office files go through the files preview reader, which resolves both kinds of part names and reads inline strings: - a workbook comes sheet by sheet, rows as tab-separated lines, up to 2000 rows and 50 columns a sheet, with a note for a cut sheet; - a Word document gives headings, list items, paragraphs and tables; - a presentation gives each slide with its title, text and notes. PDF and EPUB keep the harness extractor. Only a PDF with no text is reported as a probable scan; an empty Office file is reported as empty. The preview reader now keeps a Word table as one block with its rows, and the preview pane draws it as a table. Assisted-by: Claude:claude-opus-5-5 * Add the missing explorer, library and tools translations Eight locales had no explorer.json, library.json or tools.json. The browser asks the server for every namespace of the language it shows, so an Italian page that used the library answered 404 for /locales/it/library.json on every load and fell back to English. The 24 files now exist, translated, with every key of English. The locale gate counted a missing file as missing keys, which the baseline allowed. It now fails on a missing namespace file whatever the baseline says, and the baseline is 24 entries shorter. Assisted-by: Claude:claude-opus-5-5 * Back off while the add-on service is unavailable A page that followed an add-on upgrade read the operation every two seconds, up to 300 times. While the add-on service restarted, each read waited for its timeout and answered 503, so the log of one session had 48 failed dispatches in a row, and the page only showed the upgrade as running. The Sandbox state of a chat's Tools menu read once and, on a 503, said nothing more. The reads of an operation now back off while the service does not answer: 2, 4, 8, then up to 30 seconds. The upgrade entry says that it waits for the add-on service and when it checks again, in Activity and in the details, which also get a Check now button. The Tools menu says that the Sandbox is starting and reads its state again with the same back-off, kept for the page, so opening another chat does not ask again before the wait is over. Assisted-by: Claude:claude-opus-5-5 * Start a chat with its switches and list them before it exists The composer of a new chat could not show the Tools and Skills menus, because the lists and the switches belong to a chat. A chat started from Home therefore always began with every tool and skill on. - POST /api/chats takes switches: the add-ons, MCP servers and connectors, built-in groups and skills that are off, and the opt-in groups that are on. They are checked as the PUT endpoints check them and stored with the new record, so the chat never exists without them; a bad entry refuses the request and creates nothing. The SQL store now writes these lists on create too. - GET /api/chats/draft/tools and /api/chats/draft/addons list what a chat on a model, with a saved agent, could use, every switch in its default state. They refuse what create refuses: an unknown or forbidden model, an agent without the agents feature, another user's agent. Document both in the chats page and regenerate the swagger. Assisted-by: Claude:claude-opus-5-5 * Give Home the composer of the chat page Home drew a smaller message box than the chat page: no files, no agent, no Tools or Skills menus, no paste to attach, no rich model list, and its text was lost on a reload. A chat started there could not be set up before its first message. Move the composer wiring out of the chat page into one place that both pages use: - useChatComposer holds the draft (text and files), the model and the saved agent of a new chat, the chat models, the switches and what attaching and pasting do. - ChatComposer draws the model list (fit, vision, memory bar), the agent picker, the Tools and Skills menus, the attach buttons, dictation, the add-on slot and the vision notice over HomeComposer. - useChatSwitches has a draft mode: before the chat exists it lists from the draft endpoints, a switch changes only the screen, and the choices go with the create request. They outlive a change of model or agent. Home now creates the chat with the model, the agent and the drafted switches, sends the first message with its files and opens the chat. When the message cannot go, the new chat is removed and the text and files stay on Home. Its text is kept in the browser across a reload. Home also gets the shortcuts row, the notices of the chat page and the line that says whether the model is loaded. Its own slash actions, widgets, examples and first-run steps stay. The empty chat page gets the same draft menus. On a phone the chips of both wrap to a second row, and the Tools and agent menus open as a sheet from the bottom, as the skills picker does. Assisted-by: Claude:claude-opus-5-5 * Move add-on settings to the add-on's own page The settings.sections slot drew every add-on's settings at the end of the global Settings page, and the Sandbox and Web sections were unstyled: the add-on UIs used class names the host does not define (btn, btn-primary) and bare inputs, the SDK offered no form primitives, its muted token named a property that does not exist, and the slot root was an inline-flex span that laid a form out in a row. An add-on's settings sections now render on the Settings tab of its details on the Add-ons page (/app/addons?detail=<id>&view=settings), narrowed to that add-on, for administrators only. An add-on page gets a host Settings link to that tab. The Settings page no longer draws the slot: an Add-ons group, shown when an add-on has settings, lists those add-ons with a link each. The old #ad-section-<addon>-<id> anchor redirects to the tab once the apps list is read. Server settings of an add-on's feature stay on the Settings page; the tab shows them under "Server settings for this add-on", with a read-only summary of the Sandbox network and links to ?group=tools#settings-egress and #settings-builtin-tools. The SDK gets a settings kit in sdk.ui (Section, Field, Select, TextInput, Switch, Choice, StatusChip, Callout, List/ListRow, Code, Actions, Table, ExternalLink), drawn with host classes and tokens, and more theme tokens. The Sandbox and Web sections are rebuilt with it: backend rows with a status chip and the raw reason collapsed in a code block, a backend choice with one line per option, and the AppArmor and user-namespace hint (with a docs link) only for the gVisor "exit status 128 ... cannot read client sync file" failure. The Settings page showed "Changed, default 30, Reset" next to a 0 for the audit retention, and the same for the Sandbox network limit, preset and ports: the server stores 0 or an empty value for a setting never set. Those fields now read that value as their default, and the retention input has its unit and bounds. Assisted-by: Claude:claude-opus-5-5 * Adapt the add-on runtime specs to the new navigation Three specs of the esm-ui suite still assumed the old shell: - the Add-ons tab that lists the pages add-ons declare is part of the legacy layout, so the navigation spec found no hub subnav; it now sets the legacy switch on the server's flags for that page; - the sidebar has no "Chat" link any more, so the unsaved-edits spec could not leave the page; it leaves through Home in the primary navigation; - the shell keeps a notification stream open, so the network never goes idle and the spec for a member without the feature waited out its timeout; it waits for the server's switches, the account and the shell instead. Assisted-by: Claude:claude-opus-5-5 * Name the legacy Add-ons tab unit case as the esm unit tests do The esm-ui inventory listed "unit: registry: the Add-ons tab lists page links only when the registry has usable add-ons", but the unit test is named "the legacy Add-ons tab lists ...", so the suite could never match its inventory. Use the name the test prints. Assisted-by: Claude:claude-opus-5-5 * Say on the Collections page when the embedding model is missing At startup the server opened a collection and its first embedding call got 404 from POST /embeddings. The collections embed through this server's own API with collections_embedding_model, the default granite-embedding-107m-multilingual, and that model was not installed. Nothing told the user: uploads and searches just failed. GET /api/collections now also returns embedding_model and embedding_model_installed (a loaded configuration of that name, or a model file of that name). When it is missing, the Collections page says "No embedding model installed", names the model, and gives an administrator a button that opens the Models page with a search for it. Assisted-by: Claude:claude-opus-5-5 * Report modified times and the upload limit in folder listings The Files page could not sort by date or show when a file changed: a folder listing had no time. It also learned the upload limit only after it had sent the whole file. The default server body limit is 15 MB, lower than the 256 MiB a workspace file may have, so a large upload failed late and without a clear reason. Each listed entry now has "modified", the time of the change set of its revision. Both workspace stores fill it in List: the JSON store from its in-memory change sets, the database store with one query per batch of revisions. The listing also has "max_file_size", the smaller of the workspace limit and the server body limit, so a client can refuse a larger file before it sends any byte. The store contract suite checks the new time against the history, and the route tests check both fields. Assisted-by: Claude:claude-opus-5-5 * Add a sortable file list with thumbnails for the Files page The building blocks of the new file browser, used by the page in a later change: - fileBrowser.js: the kind of an entry from its extension, the order (folders first, natural and case-insensitive names, then size, modified time or type), the filter of a folder, dates in words with the full date for a tooltip, the Shift range, the arrow moves of a list and of a grid, type-to-find, names that do not clash, why a name cannot be used, the name of a pasted screenshot and the view settings read back from storage. - FileList: a grid with sortable column headers or a grid of tiles with image thumbnails, a check box per row, a row menu, inline rename with the reason a name is refused, rows that can be dragged onto folders, and the keyboard: arrows, Shift, Space, Enter, F2, Delete, Ctrl+A, Escape, Backspace and typing a name. - MoveDialog: a folder picker that walks the tree and refuses a move into the moving folder itself. - ActionMenu can open at a point with no trigger (a right click), and its trigger can take another icon and class (a split button). - fileSize also writes gigabytes. Assisted-by: Claude:claude-opus-5-5 * Add an upload queue with progress, cancel and retry An upload of the Files page was one fetch per file in a loop: nothing showed while it ran, one failure stopped the rest, and leaving the page lost it. - uploadQueue.js keeps every upload outside React: queued, sending with the bytes sent and a smoothed rate, done, failed with a reason and whether Try again can help, or canceled. Two files go at once. It lives for the whole app, so opening another folder or page does not stop an upload. - filesApi.uploadWithProgress sends the same PUT with XMLHttpRequest, which reports upload progress and can be aborted. The server already streams the body into the store; nothing changes there. - useUploads reads the queue and asks before the tab closes while a file is on its way. - UploadTray shows the queue at the bottom of the page: the total and the time left, each file with its progress, speed and time left, Cancel, Try again with the reason, and a done state that fades out. A live region tells a screen reader when uploads start, fail and end. - ConflictDialog asks what to do when an upload has the name of a file in the folder: replace it, keep both, or skip it. - dropFiles.js reads dropped folders with their paths. Assisted-by: Claude:claude-opus-5-5 * Rebuild the Files page as a file browser The Files page was a list of links: the store's byte order, the same icon for every file, three icon buttons on every row, no progress on an upload, no selection, and on a phone a preview that opened below the whole list. Browsing: a breadcrumb that folds a deep path, sortable columns (name, modified, type, size) with folders first, a list or a grid of thumbnails, both kept per user in the browser, a filter of the open folder with a search of every file on Enter, type icons, human sizes, dates in words with the full date on hover, and Back and Forward between folders. Uploads go through the upload queue and its tray: the Upload button or its folder menu, drops of files and folders anywhere on the page or onto a folder row or crumb, and paste. A clash asks to replace, keep both or skip; a file over the server limit is refused before it is sent. Selection and actions: click, Ctrl and Shift, check boxes, a selection bar (Download, Move to, Move to Trash; at the bottom of the screen on a phone), a row menu and a right click, inline rename and new folder or file, drag to move, the keyboard, and a toast with Undo for a delete, a move and a rename. States: a skeleton on the first load, an error with Try again, empty states that say how files get here, and a no-match state. The preview uses the side pane: docked on a wide screen, a sheet on a phone, with the same actions as the row menu. Trash, History and the Managed by LocalAI group stay as they were. Every new string is in the nine languages. The page uses design tokens only (seven raw font sizes fewer). The specs cover sorting, the filter, the views, selection and bulk actions, the keyboard, the menu, rename checks, drag to move, drops, paste, clashes, the size limit, upload progress, cancel and retry against the real server, and the error states. Assisted-by: Claude:claude-opus-5-5 * Fix two specs that fail on the integration branch The Describe spec of the egress package checked that the no-card line does not contain "asks the user", but that line says "nothing asks the user". It now checks for the sentence that promises a card. The context meter spec gave the chat a 4k context window. The tool schemas of the chat now take 3k of it, so the turn stopped before the model request. The spec uses a 16k window. Assisted-by: Claude:claude-opus-5-5 * Translate the always-allowed hosts note of the chat network row The three egress keys of the always-allowed hosts were only in English, so the locale check failed for every chats namespace. The workspace namespaces now miss two keys fewer, so their baseline goes down too. Assisted-by: Claude:claude-opus-5-5 * Bring the contracts and host-slots case inventories up to date The contracts suite has eight new specs for the check of a tool that shadows a built-in. The host-slots suite runs the unit case of the file preview slot, which the inventory did not list. Assisted-by: Claude:claude-opus-5-5 * Add the design of the file text index The search of the chats' files reads only small UTF-8 text files, so a PDF or an Office file is found by name only. The design extracts the text when a file is written, keeps it in LocalAI's own store keyed by node and hash, checks access at query time and runs one indexer per cluster under an advisory lock. Assisted-by: Claude:claude-opus-5-5 * Give extracted documents their pages, sheets and slides Extract now says where each page, sheet and slide starts in the text, so a search hit can name its page or sheet. A PDF page starts with a "## Page N" line, as sheets and slides already start with a heading. A PDF also stops at a page limit (200 by default) and at the text limit, which it ignored before, and a panic of the reader is an error. The test fixtures move to extracttest, with a real text PDF and a workbook with shared strings, so other packages can build the same documents. Assisted-by: Claude:claude-opus-5-5 * Add a store for the text of workspace documents textindex keeps one entry per workspace node: the text read from a PDF or Office file, the hash it was read from, its pages or sheets and its status (pending, ready, failed, skipped), plus the cursor of the indexer in the workspace journal. The GORM store keeps a lower-cased copy of the text, so SQL and the Go matcher agree on every script, and searches it with FTS5 and the trigram tokenizer on SQLite or a pg_trgm index on PostgreSQL. Without them it scans the column. The JSON store keeps the metadata in memory and each text in its own file, and scans the texts. One contract suite runs on JSON, SQLite and PostgreSQL. Assisted-by: Claude:claude-opus-5-5 * Index the text of new and changed workspace documents The indexer tails the workspace journal from a cursor kept in the text store. A write of a PDF, Word, Excel or PowerPoint file marks it pending (the same hash only follows the path), a delete removes the entry and a move rewrites the paths below a folder. Then it reads the pending files two at a time, with a timeout, a size cap, a page cap and a text cap, and stores ready, failed or skipped. A panic of the reader fails the file, not the pass. The same content is read once. The first pass starts at revision 0, which indexes the files that were there before, in bounded steps that resume from the cursor. Enqueue marks an upload pending at once and Forget drops the entries of nodes a purge erased. In a cluster each pass runs under a new advisory lock, so one frontend reads. Assisted-by: Claude:claude-opus-5-5 * Search and read the text of documents in the chats' files search_files and GET /api/chats/files/search now also search the text index: after the name and text-file hits come lines of PDF, Word, Excel and PowerPoint files, as path (page 3, line 40): text, with the sheet or slide where a document has them. Each entry is shown only when the caller may read its file now and the file still has the content the text came from. Documents keep up to a third of the hits. When files below the path are still pending, the answer says so instead of "Nothing found.", and the REST result has indexing. read_file returns the text of a PDF or Office file with the usual offset and limit, from the index when it matches the file and read on the spot otherwise. An upload and a write of a chat tool queue the file at once, and emptying the Trash drops the entries of the purged files. Assisted-by: Claude:claude-opus-5-5 * Start the file text index with the files and add its settings With files on, the server opens the text store next to the workspace index (the auth database, or a folder under the data path) and starts the indexer. A chat worker searches the index but runs no indexer. chats_index_files (default on) switches the reading off and chats_index_max_text_bytes (2 MiB by default, 64 KiB to 16 MiB) caps the text kept for one document. Both apply at the next pass, and both are rows of Settings > Tools. Assisted-by: Claude:claude-opus-5-5 * Show the page, sheet or slide of a document hit on the Files page Search all files now lists hits inside PDF and Office files with their page, sheet or slide instead of a line number of the extracted text, and says how many documents are still being indexed. The strings are in all nine locales. Assisted-by: Claude:claude-opus-5-5 * Test finding an uploaded PDF by its words through the routes The PDF has a generated name and is uploaded with the REST upload. The search route first reports it as being indexed, then finds it on its page after a pass of the indexer, and so does the search_files tool of a chat. Another user finds nothing. Assisted-by: Claude:claude-opus-5-5 * Document the search inside documents The chats page says what the index reads, where the text is kept, who finds it, which search engine each database uses, the two settings, the backfill and the single-runner mode in a cluster, and how search_files and read_file answer for documents. The API instructions and the PDF skill say the same in short. Assisted-by: Claude:claude-opus-5-5 * Test the indexer on the JSON workspace store A server without a database keeps the workspace and the text in JSON files. The indexer follows the uploads, a folder move and a delete in that journal as it does in the database one. Assisted-by: Claude:claude-opus-5-5 * Read all of a long document with read_file The index keeps the first chats_index_max_text_bytes of a document, so read_file used to stop where the index stopped. It now uses the index only when it holds the whole text, and reads the document again (up to 16 MiB of text) when the index cut it. Assisted-by: Claude:claude-opus-5-5 * Start bash in the user's home The Sandbox's bash and the built-in bash started in /workspace, the folder that holds the mounts, so a model that ran a script by a relative path failed and a file it saved there was lost. A call now starts in /workspace/home, the folder of the user's files: a relative path is the same file the file tools see. The tool descriptions and the commands block of every turn say where a call starts and that only what is saved there is kept. The built-in bash says that the /workspace paths do not exist on the host and that a shared folder is next to the home. Assisted-by: Claude:claude-opus-5-5 * Name files in tool results by the path the model uses write_file, edit_file and search_files named a file of the home by its path in the home ("/scripts/build.py") while the model had written /workspace/home/scripts/build.py, and a model took the two spellings for two files. The results now give the path the model uses, and move_file says where it moved the file to. The cards and the change notes keep the path in the home. Assisted-by: Claude:claude-opus-5-5 * Name the paths a command's commit did not save The result of a bash call ended with "N file(s) changed in your files meanwhile; the sandbox's version was kept as a copy" for every path the commit refused, also for a file written outside the user's files, where no copy is kept. It now has one line a path, with the path as the guest sees it, the reason, and the path of the copy when the store kept one, so the model and the user can act on it. The host returns the paths and the copy to the Sandbox add-on relative to the user's files, as its mounts are. Assisted-by: Claude:claude-opus-5-5 * Show the files a command saved under its step A document that a script wrote with bash reached the user's files, but the chat showed nothing: only the file tools put a file on their step, and the Sandbox committed for no chat, so the chat's file list, the chips under the answer and the preview pane never saw the file. The host now commits a Sandbox call for the chat that ran it (the action resource of the request names the chat). After each bash call, of the Sandbox or of this machine, the chat reads the change sets of the chat that the call made from the shared store and puts the files on the step's card, next to the card that says who served the call (session.SetToolFiles; files with path, change set and op on the card's new files field). The step lists them as chips that open the preview pane, the chat's clients are told that its files changed, and the files reach the file list, so the answer gets its chips and the pane opens on the newest one, as for write_file. Assisted-by: Claude:claude-opus-5-5 * Keep JSON out of the answer of a trigger run The workspace skill told the model to put the widget data shape and a source marker in a trigger prompt. Some proposals then asked the run to print that JSON, and every run ended its chat with a stray line of it. The skill now says source and note live inside the data file and are never the answer, and that a prompt must not ask for JSON. The runner appends one closing instruction to the first message of every trigger run: finish with one short plain sentence. The propose_trigger and update_trigger descriptions say the prompt must stand alone and must not ask for JSON. Connector chats are talks with people and do not get the line. Assisted-by: Claude:claude-sonnet-5-5 * Read the images of a page as base64 for its frame The bridge of a page reads UTF-8 text only, so the UI could not put a png or a jpg of the page's folder into the page. A read of the page file routes with encoding=base64 now returns an image as base64 with its media type. Only the extensions of an image are read this way (png, jpg, gif, webp, avif, bmp, ico, svg); any other file is 415, so this is no way to read an arbitrary binary file. The path checks, the 1 MiB limit, the viewer's rights and, for a shared page, the consent check are the same as for a text read. Assisted-by: Claude:claude-opus-5-5 * Let a page use the files next to it A page runs from a srcdoc with no network, so fetch('news.json'), <script src="app.js">, <link rel="stylesheet" href="style.css">, <img src="logo.png"> and import './x.js' all failed without a word. Models that split a page into files, or load its data with fetch, made pages that showed nothing. Before the frame loads, the UI now reads the files that the page names with relative URLs, with the same calls as the bridge, and puts them in: classic scripts in place (deferred ones at the end of the body), style sheets as <style> with their @import and url(), images as data: URLs, and ES modules as blob: URLs behind an import map, so cycles and import() work. A page with modules gets blob: in script-src; no other part of the policy changes. Inside the frame, fetch and XMLHttpRequest read relative URLs with files.read and answer with a real Response (200, 404 for a missing file, 413, 415); any other URL rejects with "network is off in pages; put the data in a file next to the page". Every path is resolved inside the page's folder: .., %2e%2e, absolute paths, backslashes and protocol-relative URLs are refused, and the query and the fragment are dropped. The files go in only after a shared page is allowed, with the viewer's rights. The files that go in are at most 4 MiB, images 2 MiB; a script or style sheet that does not load shows a notice in the page. A change of one of these files reloads the page, as a change of index.html does. The skills, the docs and the shared pages fixture say and test the same. Assisted-by: Claude:claude-opus-5-5 * Return tool descriptions from an MCP connector test A connection test listed only the tool names. A person who adds a server cannot tell from a name such as "query" what the tool does or whether to keep the connector on. The test response now also has tool_details: each tool with the description its server gives, in the order of tools. tools is unchanged, so existing clients keep working. Assisted-by: Claude:claude-opus-5-5 * Add jq, ripgrep, sqlite3 and archive tools to the Sandbox guest The guest user cannot install packages and apt is blocked by the proxy, so any tool the model needs has to be in the image. Add jq, ripgrep, sqlite3, zip, unzip, file and tree to the final stage. A new check-tools.sh runs in the existing build step and fails the build when one of these programs, Poppler, git or curl is missing or does not start. The list is one constant, GuestTools, in the shared sandbox package. The Commands block of the prompt of an isolated chat names it. The tool description (capped at 400 characters, already full) and the turn note (cut at 400 characters) have no room for it. Tests keep the Dockerfile, the check script and the Sandbox documentation in line with the constant. Assisted-by: Claude:claude-sonnet-5-5 * Keep the helper files of a chat in its work folder A chat asked for a Word document left a 19 KB build script at the top of the user's home, next to the user's own files. Chats like it leave scripts, intermediate data, logs and drafts at the top level or in folders such as scripts/, and nothing tells them apart from what the user asked for. Each chat now has a work folder, Chats/<chat folder>/work/ in the user's home, next to its attachments. The chat takes the name of its folder at its first turn (checked against the folders and the other recent chats of the user, so two chats with one title get two names) and makes the folder only when it is used: before a bash command runs, or when a file is saved there. The prompt of every turn names the folder and says what goes in it: scripts, helper code, intermediate data, logs and drafts go there; the deliverable goes where the user said or at the top of the home; no new top-level folders for scripts; a run-once command needs no file. A sub-agent is told its parent's folder. The descriptions of bash (the Sandbox's, within its 400 characters, and the built-in one) and of write_file end with one short hint, and the built-in office, apps and workspace skills say the same in one line. The steering is soft. When write_file, move_file or a command leaves a helper file outside the work folder, the result gets one line that suggests moving it, at most once a turn of a chat. One function (workspace/workfiles) decides the kind of a file: working for anything in a chat's work folder, or for a script, a log or a temporary file by its extension or a folder named scripts, tmp or scratch; deliverable for everything else, and always for pages, the LocalAI folder, the shared folders and the files the user attached. The chat's file list (kind), the files of a command's card (files[].kind) and the card of a file tool (file_kind) carry it, so the interface only renders it. The runtime setting chats_work_folder (on by default) turns the steering off. Assisted-by: Claude:claude-opus-5-5 * Stop telling the model that the Sandbox has npm The guest image has no Node, so the network hints named a tool that does not exist. Assisted-by: Claude:claude-sonnet-5-5 * Update the Sandbox description test after dropping npm Assisted-by: Claude:claude-sonnet-5-5 * Open the links of a page after the person confirms them A page runs in a frame without allow-popups or top navigation, so a click on <a href="https://..."> did nothing, and a link to #id loaded LocalAI's own address in the frame, since a srcdoc resolves it against the parent. A news page had only dead links. The bridge of the frame now takes the clicks on links (also with a modifier, the middle button or Enter) and window.open(), and sends link.open(url) to the host. The host lets through only an http or https address without a user name or password, at most 2048 characters; javascript:, data:, file:, blob:, //host and links to other files of the page are refused with a message in the console. A bar above the page shows the site in large type, the whole address, and Open and Cancel. A host in punycode also says how it reads, since it may imitate another site. Open is a click in the app, so the new tab is not blocked and opens with noopener and noreferrer. A page asks at most 5 links at once, then one every 3 seconds. A link to #id scrolls the page. The sandbox, the policy of the frame and the consent of shared pages do not change; a shared page asks the same way. Assisted-by: Claude:claude-opus-5-5 * Let the items of a Home widget link A list widget showed each item as plain text, so a digest of articles or a list of pages could not take the person anywhere. An item now has an optional url. An http or https address without a user name opens in a new tab with noopener and noreferrer, and its tooltip names the site; a path of the app (/app/pages, /app/chats, /app/files and the other screens a person reads) opens inside LocalAI. The label is the link, with a focus ring, an underline on hover and focus, and an icon for an address outside the app. The widget-data schema checks the url, and the server adds an error in words that names the item and the rule, so a trigger run that writes a bad link learns why. The skill and the docs show the field. Assisted-by: Claude:claude-opus-5-5 * Attach any file in a chat with one button The chat had three attach buttons (image, audio, file) that all add to the same list, and the file button's dialog filtered on */*, which some file dialogs read as a type filter that greys out archives such as .zip. A chat now shows one Attach file button whose dialog has no type filter. Composers without anyFile keep the three buttons. Assisted-by: Claude:claude-opus-5-5 * Accept both Node behaviours for a broken punycode label in the link test Node 22 refuses the address, Node 24 parses it. Both mean the page never opens it unwarned. Assisted-by: Claude:claude-sonnet-5-5 * Show a chat's working files apart from what it made The Files pane, the steps and the preview treated a helper script like the document the user asked for: a 19 KB build script was listed next to the document, got a chip under the answer, and the preview opened on whichever file was newest. The interface now renders the kind the server puts on each file. The pane lists what the chat made first and folds the working files into one quiet heading under the rest, "Working files · 2", with a line that says what they are; opening it shows their rows, which preview like any file. A working file opened from a step unfolds the group. The preview that opens by itself after a turn picks the newest file that is not a working file, and the chips under the answer name only those files. A step that saved working files lists them as one line, "Also saved 2 working files", that opens to their chips, and the file of a write_file step that is a working file is a quieter chip. The files the user attached are unchanged. Assisted-by: Claude:claude-opus-5-5 * Add a search field and a segmented filter to the UI kit The Agents views each drew their own toolbar: a search box capped at 320 px on the agents list, round chip filters on the triggers history, and a bare checkbox on the tasks page. Add-ons already had the look the product wants (a search that fills the row and a segmented tray), but only as add-on classes. SearchField and Segmented are that toolbar as two small primitives with ui-* classes and token values only. Segmented buttons carry their id in data-filter, so specs can press them. The README shows how to use them. Assisted-by: Claude:claude-opus-5-5 * Draw an agent task run as a history row with its output The jobs of an agent task were table rows that opened to bare <pre> blocks: no copy, parameters printed as k=v, the traces in a raw <details>, and "by manual" in the server's words. RunItem is one run of a history list: a toggle, the state chip, what it was and what happened, when and for how long, small actions, and the details that open under it. OutputBlock draws an answer or an error in mono with a Copy button. JobRow and JobDetail use them for a job: the values it ran with as labelled chips, the answer or error, the steps, the webhook outcome and a link to the chat that holds the run. Times show as words with the full date as a tooltip. The agent task helpers gain the pure rules the page needs: the jobs of a task, the run filters (waiting and running count as in progress), the on/off filter and search of the task list, the field errors of a save, how a job started, and the API call that runs a task by name. Assisted-by: Claude:claude-opus-5-5 * Create, edit and run agent tasks in a side sheet The task form opened as bare fields above the list, with a checkbox for On and a Save button that was only disabled when a field was missing. Run with parameters was a second inline form in the same place. TaskSheet is a side sheet with three labelled groups (about, who runs it, what it does), help under each field, the parameters the prompt asks for as chips while you type, and an On switch. Save checks the required fields, says next to each one what is missing, and moves the focus to the first. RunSheet asks for each value the prompt names and shows the prompt as the task will receive it. Assisted-by: Claude:claude-opus-5-5 * Show the details of an agent task in a pane with tabs A task had no details view: its prompt, its runs and the way to run it over the API were only in the lede of the page. TaskPane is the kit's side pane with three tabs. Overview shows who runs the task, the values it asks for, the prompt and a curl call that runs it by name, with Copy. Runs lists its jobs. Settings holds the On switch, the webhook count and Delete. Run and Edit stay in the footer. The tabs move with the arrow keys, Home and End. Assisted-by: Claude:claude-opus-5-5 * Rebuild the agent tasks page from the shared list pieces The tasks page looked unstyled next to Add-ons and the agents list: two raw tables under uppercase eyebrows, a bare checkbox for All users, forms that opened above the list, three text buttons on every row, and on a phone a table that broke names one syllable per line. The page now uses the same pieces as the polished pages. The header has one line and New task. A toolbar holds the search, an All/On/Off filter and, for an administrator, an All users switch. Each task is an agent row: a tile, the name, two lines of description, who runs it and what it asks for, the last run's state and time with the run strip, an On switch, Run and a menu. A task with no parameters runs at once. The name opens the details pane; New task, Edit and Run open the sheets. The run history is grouped by day, with a state filter, a task filter and Show more. A job is deleted after an in-page question. With no tasks the page explains what one is, with an example; a failed load shows the error with Try again. On a phone the controls grow to 44 px and the filters scroll sideways. New strings, and the task strings that existed only in English, are in all nine locales; the strings the page no longer uses are gone. A new stubbed spec covers the list, filters, sheets, pane and history, and the real-server spec follows the new controls. The docs describe the page. Assisted-by: Claude:claude-opus-5-5 * Rebuild the MCP connectors page on the Add-ons patterns The page read as a form: every connector was a row of raw controls (a checkbox, a Test button, red Delete text), the add form pushed the list down, a test result vanished on reload, and the frame was narrower than the pages next to it in the sidebar. The page now uses the same blocks as Add-ons and Files: - Full page width and the shared PageHeader with a one-sentence purpose and "Add connector". - The Add-ons toolbar (search and a state filter with counts) from four connectors, and the Add-ons rows: a monogram tile, a state chip (Connected, Needs sign-in, Can't connect, Not tested, Off), one line with the tools or the reason, a meta line, the kit Switch and a menu. - Details in the shared SidePane: the switch, the last test, the tools with their descriptions and a search, the connection with the query of the address hidden, and what is saved. - Add and edit in the shared SideSheet: kind first, grouped fields with inline checks, masked secrets with show and hide, then "Save and test", the result with the tools, and Turn on. Escape and Cancel ask before they drop typed changes. - An empty state that says what a connector is for. The last test of each connector is kept in this browser with a hash of what it tested, never the address or a secret, so the page shows the last known state after a reload. Strings are in all nine locales. Assisted-by: Claude:claude-opus-5-5 * Document the MCP connectors page and its states The MCP servers section now describes the add sheet (kind, checks, masked secrets, Save and test, Turn on), the states a connector shows, where the last test is kept, the search and the filter, and the details pane. The test example shows tool_details. Assisted-by: Claude:claude-opus-5-5 * Render a preloaded page without its loading placeholder A page that was preloaded still showed the route's loading placeholder when it opened: React.lazy suspends once on its first render even when the chunk is already in memory, and React keeps a fallback on screen for at least 300 ms once it shows one. Opening a chat from Home showed a blank page for that time. The page loader now remembers the module once it has loaded and hands it to React.lazy as a thenable that resolves at once, so a preloaded page renders in the same commit. A preload of a segment now warms every page registered under it: /app/chats is the chat page, its connectors and its conversion page, and before only the last one registered was preloaded. Assisted-by: Claude:claude-opus-5-5 * Move the composer from Home into the new chat in one gesture Sending the first message on Home was a hard cut. The page stood still while the chat was created, then showed a blank placeholder, the empty "new chat" screen with its composer in the middle, an empty thread with the composer at the bottom, and only then the message, while the sidebar folded and moved the whole column. Focus was lost. Now Send fades the rest of Home and keeps the composer in place while the message goes. When the send has answered, a view transition moves the composer to the dock of the chat, lifts the text out of it into the message, moves the attached files with it and folds the sidebar in place; the model's indicator comes in after the message has landed and the empty composer has the focus. The chat page draws the message from what Home already knows (a small hand-off store: the chat record, the text and the files, with the local copy of an image for its thumbnail) and keeps the same row when the server's transcript replaces it, so nothing is drawn twice or animates again. What is sent to the server does not change. A browser without view transitions gets a FLIP slide of the composer and the message (Web Animations, transform and opacity only). Less motion gets a short cross-fade, or an instant switch. A send that fails brings Home back, shakes the composer and keeps the draft; a second Enter while one send is in flight sends nothing. The draft is cleared when Home closes, so the box never shows its placeholder on the way. Focus mode folds the sidebar in a layout effect, so the fold happens in the frame the conversation appears. One motion token is added, --dur-glide (360 ms), for a part that travels to its place on the next page. Assisted-by: Claude:claude-opus-5-5 * Draw the triggers as rows and their history like the task runs The triggers page used a table with a switch column next to the agents card list, folded its list behind Hide, filtered the history with round chips, and on a phone cut each history row at the right edge. Each trigger is now an agent row: a clock or folder tile, the name, the schedule in the server's words, the agent or model and when it runs next, the last run's state and time with the run strip, an On switch, Run now and a menu. The week sentence sits under the Run history title. The history uses the segmented filter and the same run rows and day headings as the agent tasks, with Show more after 30 runs; an open run shows its reason with Copy. On a trigger page the prompt comes before the runs, in the body face, the On switch is the kit switch, and the runs stop at 10 with Show more. Assisted-by: Claude:claude-opus-5-5 * Use the shared search and the full width on the agents list The agents list stopped its search at 320 px and used the content width, while the Triggers and Tasks views next to it use the full width, so the title and the view tabs moved when you switched views. The list now uses SearchField, which fills the toolbar row as on Add-ons, and the full page width like its sibling views. Assisted-by: Claude:claude-opus-5-5 * Polish the agent task sheets and pane after a visual review Screenshots of every state showed a few rough edges: - The name placeholder looked like a filled-in value next to the error "Give the task a name". The name field has no placeholder now, and the prompt placeholder starts with "For example:". - A task run by an agent showed the agent id until the agents were read. It says "Agent" until then. - A run opened in the details pane also opened in the history, and the two copies shared an element id. The pane keeps its own open runs and ids. - A failed run in the pane drew its meta line in red; the title carries the error colour there now. - A group title that is not a legend had a double gap under it, and the kebab menus were under 44 px on a phone. Assisted-by: Claude:claude-opus-5-5 * Cover the code files of a shared page in its consent The consent to a shared page was kept against the hash of index.html and page.json. The UI also puts the scripts, style sheets and modules next to the page into it before it runs, so the author could change app.js after a viewer allowed the page and run new code without asking again. The server now finds the same files as the UI's inliner: every script src, stylesheet link, relative CSS @import and module import of the folder, followed through the module graph. Their content hashes go into the hash of the page, and a file the page names that is missing counts too, so adding it later also asks again. Data files and images stay out, so saving data does not ask again. The files are listed as code_files. What a file names is kept per content hash in a small per-frontend cache, which only saves reads. Two more checks close the gaps around it. A frame of an older version that reads a changed file of code gets 409, so a script edited while the page is open never runs under the old consent. The UI puts no text file into a shared page that is not in code_files, so if the server and the UI ever disagree, the file fails to load instead of running outside the consent. The trust sheet names the files of code when only one of them changed. Assisted-by: Claude:claude-opus-5-5 * Let a page be a tile on Home in its compact mode Home widgets could show a list, a number or the last chats, but not one of the pages a person or the assistant built. A page can now be a tile. A page opts in with a widget block in page.json: a size (small, medium or large, the height of the tile) and an optional short title. A widget of type page in LocalAI/home.json names the page, and a folder id for a page of a shared folder. The server takes at most three page widgets and says why in words, and refuses a name that is not a page name. The tile runs the page in the same sandbox and bridge as the full view. The page reads localai.page.mode ("widget" in a tile, "page" otherwise) and localai.page.size, and <html> carries data-mode and data-size, so the page decides how its tile looks instead of being shrunk. The tile reserves the height of its size, builds its frame only once it scrolls into view, tells the page through a new visibility event when it goes out of sight or the tab is hidden, takes the frame down far off screen, and keeps at most three frames alive. It has a title bar with Open page and a refresh button, a skeleton while it loads, Retry on an error, and the link question of the full view. A page that is gone or has no widget block shows a calm line with a link to Customise Home; a shared page that the viewer has not allowed shows Allow this page, which opens the same trust sheet. Customise Home lists the pages with a widget block, with the size of their tile. The task board starter has a compact view, the skills tell the assistant how to put a page on Home, and the docs describe it. Assisted-by: Claude:claude-opus-5-5 * Give the Files upload its own size limit The Files page upload was capped by the general --upload-limit (15 MB by default), although a workspace file can be 256 MiB. Make 0 the default of --upload-limit, meaning not set. When it is not set, the general routes keep the 15 MB limit and the Files upload route skips it, so the workspace file size is its limit. When the operator sets a value, it applies to the Files upload too, lower or higher (a file never exceeds the workspace size). The max_file_size of a folder listing reports the limit in force. Assisted-by: Claude:claude-sonnet-5-5 * Refuse writes of code files from a page A page loads its own scripts, modules and styles, so a page that could overwrite app.js or style.css would run new code on its next load. The page bridge now writes data files only. The server refuses a write whose final segment has a code or document extension (js, mjs, cjs, css, html, htm, svg, xml, xhtml, wasm), is named index, or is page.json, with 403 and a clear message. The check applies to the page routes only; the Files page and the assistant's file tools keep full write access. The judgement lives in pages.IsCodeFile and is mirrored by isCodeFile in the web host, which refuses early with the error code forbidden. Both run one table of cases, covering case, double extensions, trailing dots and spaces, percent-encoding, backslashes and lookalike dots. Assisted-by: Claude:claude-sonnet-5-5 * Make the trigger tools a built-in group a chat can switch off propose_trigger, list_triggers, update_trigger and delete_trigger were added to every chat a person starts, with no switch. They are now four entries of the built-in tool registry in one group, triggers, so the Tools menu, the tools panel, the draft list and the builtins switch endpoint handle them like the web group. The group is on by default. A trigger or connector run and a sub-agent still never get them. The panel lists the group as not usable, with a reason, for those chats, for a user without the triggers feature, and not at all when the server runs no triggers. The group has no runtime setting, so the registry gets an Unlisted flag and Settings > Tools skips it. The panel now builds every grouped tool to learn whether it is usable, not only the opt-in ones. Assisted-by: Claude:claude-sonnet-5-5 * Show the Triggers group in the chat Tools menu The menu rows come from the groups the server lists, so the row needs only its label in the nine locales. A Playwright spec covers the row, its switch request, Select all and Disable all, and the disabled row with its reason. Assisted-by: Claude:claude-sonnet-5-5 * Talk about settings, not the files behind them The settings cards, the shortcuts row, Home and the change notes in a chat named the files that hold a person's settings: "Defined in LocalAI/shortcuts.json", "Layout is in LocalAI/home.json", "Saved LocalAI/persona.json". A person changes their shortcuts or their Home, not a file, and the Files page still shows the files to whoever looks. The "Stored in", "Defined in" and "Layout is in" lines are gone; the history line keeps Versions, Revert and the Invalid badge. The notes say what changed ("Saved your shortcuts.", "Created the page Task board."), the errors name the setting or the widget instead of a path, and the Source view says "The settings as text" instead of JSON and schema. A failed save now says what happened in one plain sentence and keeps the server's own words under a collapsed Details. The drafts that "Edit with the assistant" puts in the composer no longer carry the path; the built-in workspace skill already maps shortcuts and Home to their files. All nine locales are translated; only the changed keys moved, and four keys that nothing reads any more are removed. Assisted-by: Claude:claude-opus-5-5 * Drop internal names from the skills, add-ons and tasks copy Other pages used words that only make sense to someone who knows how LocalAI is built: - Skills said "a folder with a SKILL.md" and "the file workspace". It now says what a skill is for, and that skills need Files. - The add-on notes blamed "the owner", the internal name of the server that runs add-ons. They now say what happened to the action, or that the add-on service is not available; a private library names a credential "an administrator configured on this server". - The Tasks header listed an API route, and the first-run wizard spoke of a "host bash fallback". The memory line of Settings no longer mentions "the resources endpoint". All locales that have these keys are translated. The skill delete dialog, the unused skills intro and the Tasks header exist only in English and change only there. Assisted-by: Claude:claude-opus-5-5 * Fail the unit tests when UI copy names implementation details A new test reads every string of every locale and fails when one names a settings or data file (.json, .yaml, LocalAI/), an API route or HTTP method, a setting key (chats_*), an environment variable, a format word (JSON, YAML, schema) or a path shown as code. Plain words such as "schema" and "endpoint" are checked in English only, since other languages use them for other things. Operator pages may still name the model configuration, the metrics route or a startup setting that the docs name. Those keys are listed in ui-copy-allowlist.json, each with the audience and the reason. The list only shrinks: an entry whose string no longer needs it, or whose key is gone, fails too. Assisted-by: Claude:claude-opus-5-5 * Name the triggers group in the chat tools routes The routes that list and switch the built-in groups of a chat said only "a name such as web". They now name all three: web, triggers and saved_agents, with the tools of each. Assisted-by: Claude:claude-opus-5-5 * Make the built-in skills answer in plain words The skills told the model to report file names, folders and formats after a change. Add one rule near the top of localai-workspace and localai-apps: do the work with files, but say what changed, and name a file only when the user did or asks. Replace the example replies that carried paths, keep every path that says where to write, and pin the rule with a test. Assisted-by: Claude:claude-sonnet-5-5 * Apply the Go 1.26 modernizers to the latest Studio code go fix suggested slices.Contains, strings.SplitSeq and range-over-int on lines added since the first pass. ParseSearchProviders had the same hand-written membership loop, so it uses slices.Contains too. Only lines that the branch added since then are changed. Assisted-by: Claude:claude-opus-5-5 * Share the blob wait and the counting of the two workspace purges The JSON and GORM stores each had the 2-minute default for the blob grace, the same switch that reads the BlobGrace option, and the same loop that counts files, folders and bytes per revision. They now call blob.Grace and PurgeResult.Add, both with specs. The SQL and the in-memory walk that pick the nodes stay in each store. Assisted-by: Claude:claude-opus-5-5 * Read the upper layer of a sandbox in one place for both stores The JSON and GORM workspace stores had the same readUpper, place, joinRel, depth and sortedKeys, with the same upperSet types. They move to workspace/internal/upperset, which has its own specs. The commit algorithm that applies the set to the nodes stays in each store; it needs a storage interface first. Assisted-by: Claude:claude-opus-5-5 * Let chat attachments use the 1 GiB message limit The docs promise 1 GiB for a message with attachments, but the general body limit (15 MB by default) ran first, because only the Files upload skipped it. Skip it also for a multipart POST to the messages route when the operator set no --upload-limit. A JSON message keeps the general limit, and an explicit --upload-limit still wins. A message that goes over the 1 GiB limit now gets 413, not 400. Assisted-by: Claude:claude-opus-5-5 * Name the read_file tool in the skills index header A weaker model read a built-in skill with the wrong path and then tried the Sandbox, which cannot see skill folders. The header now says which tool reads a skill and that the shown path is the one to use, before it mentions where the user's own skills go. Assisted-by: Claude:claude-sonnet-5-5 * Tell the model that skill folders are not in the Sandbox The Commands block of an isolated chat now says that skills are read with read_file. The Sandbox tool description and the per-turn note are at their size caps, so the sentence goes in the system prompt. Assisted-by: Claude:claude-sonnet-5-5 * Point read_document at read_file for text files read_document reads PDF, Word, Excel, PowerPoint and EPUB files. For a Markdown or text file it said only that the file is not a document it can read. The error now names read_file. Assisted-by: Claude:claude-sonnet-5-5 * Tidy the text index stores and the indexer pool The two stores wrote the default limits 20 and 100 as numbers in five places; they are now named constants, so the stores cannot drift. The JSON store checks a missing file with errors.Is. The indexer starts its readers with wg.Go and keeps the first error inline, which drops the cmpErr helper. Assisted-by: Claude:claude-opus-5-5 * Refuse the server's public address in the Sandbox proxy web_fetch refuses the addresses of the server: its interfaces, loopback and the host of the external base URL. The Sandbox proxy runs in the add-on process and listed only the interfaces of its own machine. Under "All public sites", an always-allowed host or an Allow card, a command could reach the LocalAI API through the public name or address of the server, a NAT address or a proxy in front of it. The host now keeps one list for both. The application builds it once, gives it to web_fetch, and sends it as CIDR strings in the new self field of every egress.check allow. The proxy keeps the last list it got and refuses it on each dial, besides its own interfaces, also for an allow it cached. safehttp gets the codec and a join of deny lists, so both sides read the list the same way. Assisted-by: Claude:claude-opus-5-5 * Check the TLS server name on every port of the Sandbox proxy The proxy checked the ClientHello only on CONNECT to port 443. An always-allowed host pinned to another port, or any port added to chats_egress_ports, was a raw tunnel: a command could open TLS to another tenant of the same front through it. The docs said the server name must still match. On other ports the proxy still waits for nothing, since the protocol may be anything and the server may speak first. But when the first bytes from the guest are a TLS handshake record, it reads the whole ClientHello and passes it on only when the server name is the CONNECT host; otherwise it closes the tunnel and audits the reason sni. Assisted-by: Claude:claude-opus-5-5 * Say what sent each notification The inbox only knew whether a notification was about a run or needed attention, so a trigger that was switched off and a connector that was switched off looked the same. Each notification now carries a source: trigger, connector or system (the conversion of old data). The list endpoint returns it, and items stored before have none. Assisted-by: Claude:claude-opus-5-5 * Say where a skill is when a read of it fails When read_file, read_document or list_files fail with not found for a path that names a skill of the chat (a wrong skills folder, or just <name>/SKILL.md), the error now gives the skill's real path and says to read it with read_file. The skills come from the chat's own resolver, so every layer, add-on and per-user switch is respected, and nothing is looked up unless a read fails. Assisted-by: Claude:claude-sonnet-5-5 * Keep the last valid Sandbox network lists when a value is bad The settings endpoint refuses a bad chats_egress_allowed_hosts with the reason, and the runtime settings file keeps the value in force. A bad value that reached the configuration another way was dropped with no log line: the always-allowed hosts and the extra registries became empty, and a bad port list fell back to 80 and 443, which can widen a narrower list. Each of the three lists now keeps the last value that parsed, logs a bad value once, and uses the default only when the process never saw a valid one. The parse runs again only when the value changes, not on every egress.check. Assisted-by: Claude:claude-opus-5-5 * Use the keyless chain of the built-in search in the Web add-on The add-on replaces the built-in web_search, but its keyless provider was DuckDuckGo alone. DuckDuckGo often answers data-center addresses with a bot check, so installing the add-on without a key made search worse than the built-in, which falls back to the Brave Search and Bing result pages. The keyless entry of the add-on's order (saved name duckduckgo) is now the built-in chain from pkg/web/search: DuckDuckGo, then the Brave Search page, then the Bing page, with the same cool-down. The status tool reports the providers in their cool-down, and the Settings tab shows them with the reason. Test the providers gives one row for each page of the chain. Assisted-by: Claude:claude-opus-5-5 * Fix the GitHub hosts in the Q1 row of the egress design The Q1 row still listed raw.githubusercontent.com on the registries list. The owner decision below it and registries.json exclude it, since it serves any user content, and add release-assets.githubusercontent.com. The row now says the same. Assisted-by: Claude:claude-opus-5-5 * Keep one private-address rule for the network cards A card asked whether its host is a private IP literal by calling egress.Admits with a made-up ceiling, which re-derived the rule that egress already has. egress.PrivateLiteral is now exported (with a spec) and the card uses it. The two String methods of an allowed host write host:port with net.JoinHostPort, which brackets an IPv6 literal the same way the hand-written code did. Assisted-by: Claude:claude-opus-5-5 * Read a unique constraint violation in one place The jobs and triggers stores had the same isUniqueViolation, and the saved agents store had the same test inline before it looked for the name index. They now call dberr.IsUniqueViolation, which has specs for the SQLite and PostgreSQL error texts. The workspace store keeps its own stricter match. Assisted-by: Claude:claude-opus-5-5 * Ask before a Home widget link opens another site A list widget turned an http or https item into a plain link to a new tab. Its data file is written by trigger runs and the assistant, which read web text, so a planted link opened with one click, and only a tooltip showed the host. A link of a page asks first. An external item link now opens the confirmation bar of page links in the widget: the site, the full address, the punycode warning, and Open or Cancel. A link inside the app still navigates directly. The bar takes a label, so the widget says that it wants to open the link. Assisted-by: Claude:claude-opus-5-5 * Prune the audit of the commands run on this machine The audit of the built-in bash had no retention: the database table grew without bound in a cluster, with commands of up to 4 KiB each. The Sandbox network audit had chats_egress_audit_days and a daily prune under an advisory lock. Both audits record what the commands of the chats did, so the host command audit now uses the same retention and is pruned in the same daily pass: one frontend of a cluster, under the same lock; a standalone process alone. The GORM and file stores get Prune. No new setting. Assisted-by: Claude:claude-opus-5-5 * Save the Studio JSON stores with atomicfile.WriteJSON Seven stores (agents, connectors, jobs, MCP connections, notifications, push subscriptions and triggers) encoded their state and then called atomicfile.Write with the same four lines. atomicfile.WriteJSON does both and has specs. The load side stays in each store, since the error messages differ. Assisted-by: Claude:claude-opus-5-5 * Build the result page walkers of the keyless search on one walk hasChallenge and firstByClass each had their own recursive walk that stopped at the first match. They are now predicates passed to firstElement, which already did that walk. The order of the walk and the element tested first are the same. Assisted-by: Claude:claude-opus-5-5 * Expire network cards that a dead frontend left pending Pending network cards expired only on the turn-end path of the process that ran the turn. When that frontend died, its cards stayed pending in the chat record, counted toward the cap of three, and gave the next turn's connections cards-full blocks. The UI showed them as waiting. A card now names the turn that asked it. One rule, shared with the command card in a later change, says whether a card still has a waiter: its turn holds the chat and its wait has not run out. A card that fails it reads as expired, takes no place under the cap, and is expired in the record when the next card is asked, when the next turn starts, or when the reaper ends the dead turn. Assisted-by: Claude:claude-opus-5-5 * Reuse ChooseProvider for the expected add-on of a tool shadowers.expected repeated ChooseProvider line for line: the pinned add-on when it is installed, else the oldest install. It now calls it. commandFiles kept an order field and sorted the nodes of a map by it; it now appends each node to a list when it first sees it, which gives the same order without the sort. Assisted-by: Claude:claude-opus-5-5 * Do not print a nil error when a key or entry is missing Three checks joined "the read failed" and "the read found nothing" in one branch, so the second case wrote "<nil>" into the message: the VAPID keys of push notifications, the sealing key of connectors and a rendered catalog entry. Each case now has its own message. The message of a failed read does not change. Assisted-by: Claude:claude-opus-5-5 * Check the close errors and rename the tool variables golangci-lint failed on the new studio code. Five deferred Close calls and one Fprintf into a hash dropped their error, and two locals named t made forbidigo read `t.Run` as a testing call. Discard the errors explicitly and name the locals tool. Assisted-by: Claude:claude-opus-5-5 * Make the file text index forget purged files and say its limits Three gaps of the text index of documents: - A purge dropped the index entries of what it erased in a goroutine that only logged its errors, and the purge had already erased the journal rows. A crash or a store error left the text in the database for good. Each pass of the indexer now also checks a batch of entries (200 every 30 s, round all of them) and deletes those whose node is gone, so what a failed Forget leaves is removed. - A document search stopped at 20000 files or 64 MiB of text without a word, and the "still being indexed" count stopped at 50. The search now sets Limited (search_files says "results limited", the REST answer has "limited", the Files page shows a note), and the count is the number of pending entries below the path. - read_file extracted a long document again for every page, up to 50 MiB and 60 s each time. The first read keeps the whole text in the index store by content hash (a new documents table, or files in the JSON store), and the next pages come from it. The text goes away with the last entry of that content, on delete and on purge. Search reads the text without its folded copy, which only the database needs. Assisted-by: Claude:claude-opus-5-5 * Stop the PDF reader when the extraction gives up The PDF and EPUB reader runs in a goroutine, and the call returns after 60 seconds when it is slow. The goroutine went on reading every page, since its context ended only with the caller's. It now gets a context that ends when the call returns, so it stops at the next page. What the call returns does not change. Assisted-by: Claude:claude-opus-5-5 * Compare the code files of a shared page as the store does The guard that refuses new code to a frame of an older version compared the name it reads with the names of the page's code exactly. The workspace folds case, so an old frame that read Index.html or JS/App.js got the new code with no 409. Compare names in the store's form (workspace.FoldName), as the write check already does, and test the case variants. Assisted-by: Claude:claude-opus-5-5 * Expire the command card of a turn that is over The card of the built-in bash was cleared only by a defer in the call that asked. When that frontend died, the card stayed in the chat record. The chat hid it only while no turn ran, so the next turn showed it again, and an answer to it reached no one but still got 204. The card now names its turn and when it was asked, and follows the same rule as the network cards: it waits only while that turn holds the chat and its five minutes have not run out. GET /api/chats/{id} shows only such a card. The next turn and the reaper clear a card left behind, and the waiting call clears only its own card, so it never removes a newer one. An answer to a card with nobody waiting is 410 consent_expired, and the chat shows the card as not answered, with no buttons. The store gets UpdateHostConsent, an atomic change of the card. Assisted-by: Claude:claude-opus-5-5 * Answer a trigger change once across frontends ApplyChange, UndoChange and DismissChange checked the outcome of the change record under a mutex of one process, then wrote the store. Two frontends could both see a pending change and both apply it, or both undo it. Add Store.SetOutcome, a conditional update of the outcome (only from the outcome it names), to the GORM and JSON stores and to the store suite. The three answers now claim the record with it before they write, give the outcome back when the change itself fails, and answer ErrProposalAnswered (409) when another request won. A test runs the two answers on two frontends at the moment between the read and the write, for an edit, its undo, and a delete. Assisted-by: Claude:claude-opus-5-5 * Add the shadowers spec to the tables-tools inventory The tool adapter gained a spec that lists the add-ons that replace a built-in in any state. The tables-tools suite runs every spec of that package, so verify.sh found one case more than the inventory holds. Assisted-by: Claude:claude-opus-5-5 * Offer Clear filters when the backend Catalog shows nothing The Installed view had a Clear filters button in its no-results state; the Catalog view did not, although the spec asks for it in both. Move the button to one place and show it in the Catalog when a search, a type filter or a library filter leaves no row. Add Playwright specs for both views, which the earlier Installed fix lacked. Assisted-by: Claude:claude-opus-5-5 * Give the chat settings without an assistant tool their reason chats_max_iterations, chats_work_folder, chats_index_files and chats_index_max_text_bytes had no MCP tool and no entry in adminRoutesWithoutTool, and the older chats_saved_agents, chats_suggestions, chats_vision_model and chats_transcription_model were unlisted too. Add each with the reason it stays a person's choice in Settings: they apply to every user's chats, and the step limit is one a model must not raise for itself. Assisted-by: Claude:claude-opus-5-5 * Remove the stray allowed-hosts keys from the chats inbox locales allowedHosts, allowedHostsOff and allowedHostsNote sat twice in eight locales: under egress, where English has them and the UI reads them, and again under inbox, where nothing reads them. In de and ko the two copies had drifted apart. Delete the inbox copies and keep the egress ones. Assisted-by: Claude:claude-opus-5-5 * Bring three design specs in line with what shipped - web tools and shadowing: the status still said phase 2 waits; both phases shipped. Note that the Web add-on's keyless entry is now the built-in keyless chain. - Home front door: Home now creates the chat and sends the first message itself, with a short-lived hand-off to the chat page, and its composer takes attachments. Both were described the old way or as out of scope. - chat footer: the meter bar is 96 px with the tokens left, and a phone keeps the bar and the tokens left, not the percentage only. Assisted-by: Claude:claude-opus-5-5 * Store the command card's answer and read it back every two seconds The answer to the command card of the built-in bash went only as a bus message. When the message was lost, the call waited the full five minutes and ended as not answered, although the person had clicked. The network card stores its answer first and re-reads the card every two seconds. The command card now does the same, through one shared pair of helpers: listenConsent subscribes before the card is stored, and waitConsent wakes on the bus message or every two seconds and reads the record, which holds the truth. The network card uses the same helpers. HostExecDecide writes the decision to the card atomically before it sends the message: the same answer twice is 204, the other answer 409 already_answered, and an answered card is no longer shown as waiting. Assisted-by: Claude:claude-opus-5-5 * Load skills by name with a load_skill tool A weaker model failed to read a skill at the path the index showed. The chat now has a built-in load_skill tool that takes a skill's name and returns the instructions of its SKILL.md, without the frontmatter. The tool reads the same resolved skill set as the index: the nearest skill of each name, the chat's switches, the add-ons the chat can use now and the grants of its agent. It reads through the user's rights. When the skill's folder holds other files, the answer starts with the base directory and names up to 20 of them for read_file; a chat without read_file gets the instructions only. A skill that needs commands, in a chat that cannot run them, is refused with the reason. An unknown name is an error that gives near names first and then every name the chat has. Every chat with at least one skill gets the tool, and a sub-agent gets it with its parent's tools. It has no switch and Settings > Tools does not list it. The index of skills now lists names and descriptions only and tells the model to call load_skill. The Sandbox sentence and the error for a wrong skill path now point at load_skill too. Assisted-by: Claude:claude-opus-5-5 * Tell the built-in skills to load other skills by name localai-apps told the model to read the localai-workspace skill, and writing-skills said a description is what the agent sees before it opens the file. Both now speak of loading a skill with load_skill. localai-workspace keeps the path of its schemas folder and says to read it with read_file, since those files are not a skill. A test checks that no built-in skill sends the model to another skill by "read" or by the path of its SKILL.md. Assisted-by: Claude:claude-opus-5-5 * Document load_skill and the skills index The chats page now says that the prompt lists skills by name and description, that load_skill returns a skill's instructions and names the files of its folder, what it refuses and who gets it. It no longer says the model reads a skill by its path. The add-ons page says how a chat loads an add-on's skill, and the saved agents page says that the skills grant limits load_skill too. Assisted-by: Claude:claude-opus-5-5 * Add the proposal action spec to the tables-acceptance inventory The spec that an editor cannot confirm a schema change as a write ran in the suite but was never in the inventory, so the evidence manifest check failed. CI did not reach that check before, because the burst spec failed first. Assisted-by: Claude:claude-opus-5-5 * Give a chat a goal that it works toward by itself A chat can now hold one goal. While it is active, every turn's prompt names it, the model gets goal_done and goal_blocked, and when a turn ends by itself the frontend that ran it starts the next one with "Continue toward the goal". The person's waiting messages still go first, and a turn they start does not count as an automatic one. The goal pauses when the person presses Stop, when a turn fails or is cut short, and when the automatic turns or the model steps reach their limits. Resume gives it fresh budgets. A sub-agent, and a chat that a trigger, a connector, a job or a page started, has no goal and no goal tools. The goal lives with the chat record in the store (UpdateGoal on the JSON and GORM stores, with contract tests and a column migration), so every frontend reads the same one. The next turn goes through the same turn claim as any other, so only one frontend continues it; a reaped turn, or a JSON store that reloads after a crash, leaves the goal paused instead of continued twice. The transcript keeps goal lines (set, replaced, continue, paused, resumed, done, blocked, cleared) as their own role, so an automatic message never reads as typed by the person. Assisted-by: Claude:claude-opus-5-5 * Add a store for the loops of the chats A loop repeats a prompt in one chat, at an interval or when the model asks for the next run. The new loops package keeps the loops, the daily budget of runs of each owner, and which chats confirmed a loop once. JSON and GORM stores share one contract suite. Add checks the limits per chat and per owner in the same step as the insert, and TakeRun never hands out the last run of a day twice, also across frontends. A user message that a loop sent now carries a loop mark (loop ID, run number, self-paced or not). Both chat stores keep it. The model reads a short line before the prompt that says the message repeats by itself, and, for a self-paced loop, how to ask for the next run. Assisted-by: Claude:claude-opus-5-5 * Add the file preview slot specs to the host-slots inventory The file preview slot came with two Go specs in the host-slots package. verify.sh found them in the run but not in the inventory. Assisted-by: Claude:claude-opus-5-5 * Check the Settings page and the add-ons with the UI copy guard The guard read the locale files only. The Settings page keeps its English labels and descriptions in settingsSchema.js, and several add-ons carry their own English bundle, so neither was checked. The guard now also reads the label, description and note of every setting and the label and hint of every group, and the English bundles of the add-ons (an en.js module or an English JSON file). The allow-list takes settings:<key>.<what> and addon:<id>:<key> entries, each with its reason; the operator ones (the SearXNG JSON format, the fine-tuning file types, the API route of a voice, the schema of the Databases add-on) are listed. What it found in the voice library is fixed in plain words: "model YAML is not modified" and "Existing model YAML is not changed" now say that the models' settings are not changed, in the voice add-on, the Studio add-on and the host locales that have the strings (en, fr, pt-BR). The two host allow-list entries for them go. Assisted-by: Claude:claude-opus-5-5 * Add the update digest specs to the updates inventory Two checker specs pin that an update names its candidate digest and that a stale cached notice stays readable. The updates suite runs the whole checker package, so the inventory needs both. Assisted-by: Claude:claude-opus-5-5 * Draw the Add-ons search and state filter with the kit pieces The Add-ons page had its own copy of the search box and the segmented filter (ad-search, ad-seg), the same shapes and styles as the kit's SearchField and Segmented that the Agents pages use. Use the kit pieces and drop the copy; the narrow-screen rules now target the kit classes inside the toolbar. The search keeps its test id. Assisted-by: Claude:claude-opus-5-5 * Add the limits of a chat goal to the runtime settings chats_goal_max_turns (1 to 200, default 20) is the most turns a chat with a goal starts by itself, and chats_goal_max_steps (1 to 10000, default 400) the most model steps of all the turns of one goal, before the goal pauses. Both are read when a turn ends, so they apply without a restart. They sit in Settings > Tools next to the step limit of one turn, and the settings page documents them. Assisted-by: Claude:claude-opus-5-5 * Add the goal routes of a chat to the API GET, PUT and DELETE /api/chats/{id}/goal read, set and clear a chat's goal, and POST /api/chats/{id}/goal/resume resumes a paused or blocked one. They belong to the chat's owner like the other chat routes and take the chats feature. A chat view carries the goal with the limits that apply now, the transcript gives goal lines with goal_event and goal_turn, and the event stream has a goal event so that other tabs read the chat again. The routes are in the route feature registry, the swagger file and the chats entry of /api/instructions. They manage the person's own chat, not the server, so they have no MCP tool, as the other chat routes. The chats page documents goals, their states and limits, and how several frontends share them. Assisted-by: Claude:claude-opus-5-5 * Redesign the notification inbox The inbox panel was a plain list: every row had the same weight, a failed run looked like a finished one, the panel ran off the screen on a phone, and a failed load showed nothing. The panel now has a header with the unread count, a menu for Clear read and Clear all, Mark all read, and an All / Unread / Failed filter. Items are grouped under Today, Yesterday and Earlier. Each item shows what sent it (trigger, connector or LocalAI) with a tinted icon, the title, two lines of text or the reason of a failure, and when it happened, with the exact time on hover. A click marks it read and opens its chat; a connector that was switched off opens the connectors page. Mark read and Delete show on hover or focus, and stay in view on a touch screen. The panel has a loading skeleton, an error with Try again, an empty state that says what shows up here, and a caught-up state. A new notification slides in, is highlighted for a few seconds and is announced once. The badge stops at 99+. Focus moves into the panel when it opens; the arrow keys, Home, End and Delete work on the items, and Esc returns focus to the button. On a phone the panel is a sheet over the bottom of the screen with 44 px targets. Assisted-by: Claude:claude-opus-5-5 * Explain the reads of the text index and the provider requests to gosec gosec flagged three new lines. The text index reads files from the directory the host gave it, with names it listed there. A search provider sends its request to the endpoint fixed at construction, never to a URL from a tool call. Mark the lines with the reason. Assisted-by: Claude:claude-opus-5-5 * Keep the add-on details open when Escape closes a dialog Escape in the restore dialog of the recovery panel also closed the details pane around it. The pane handles Escape in React, and the dialog listens on the document, so the pane ran first and saw no preventDefault. The pane now registers as a modal layer and closes only when it is the top layer, as the side panes do. Assisted-by: Claude:claude-opus-5-5 * Add skill and agent messages, compact and clear to the chats API A message can now carry a skill of the chat or one of the user's saved agents. The server checks the name against the chat's resolved skill set (switches, the agent's grants, shadowing, add-ons) or the saved agents the chat may call, and refuses an unknown one with a 400 that lists what the chat has. A skill message gives the model the text of the skill's SKILL.md before the user's words, for that turn only; an agent message asks the model to start the agent with spawn_agent. The transcript keeps the words and the command (Entry.Invoked), not the instructions. A regenerate or an edit runs the command again. Such a message does not wait for a running turn: it answers 409. POST /api/chats/{id}/compact runs the summary the loop makes when the context fills up, through a new optional session.Compactor that the loop harness implements with its own history compaction. The compacted state is saved for the next turn and a "compacted" line with the sizes goes in the transcript. POST /api/chats/{id}/clear writes a "cleared" line and drops the saved state. The model then sees nothing above the line: the rebuilt state and the transcript summary start after the last such line, so a fork from above it keeps what the model saw there. Export, import and the Markdown export carry both lines. Both calls take the turn claim, so no frontend starts a turn on the chat meanwhile; messages sent during them start a turn after. No MCP tool: they act on one chat of the caller and are not admin calls. Assisted-by: Claude:claude-opus-5-5 * Give each network card spec its own settings A check that a card spec starts can still wait on its card when the next spec begins. It read the settings through a closure over a variable that the next BeforeEach replaced, which the race detector reported. Each service now reads the settings holder it was built with, under a lock, and the specs change the settings through it. Assisted-by: Claude:claude-opus-5-5 * Show the effective audit retention in the settings snapshot The settings snapshot returned 0 for chats_egress_audit_days while the setting was unset. Any page that saves the whole snapshot back, such as the Traces settings strip, then posted 0 and the server rejected it with "Invalid chats_egress_audit_days", so saving tracing settings failed on a fresh install. Report the retention that applies (30 days by default), the same way chats_max_iterations does. Assisted-by: Claude:claude-sonnet-5-5 * Run the Sandbox smoke test in a short scratch folder The smoke test step was reached for the first time and both isolated backends refused to start: their state folder under the checkout's cache made the socket paths 126 and 132 bytes, over the 107 a unix socket allows. Point SANDBOX_SMOKE_WORK at /tmp/sandbox-smoke, which leaves room for the sockets. Assisted-by: Claude:claude-opus-5-5 * Use paths from the home folder in the Sandbox command specs bash now starts in the user's home folder, so the end-to-end specs that read and wrote home/<name> found nothing. Use names relative to the home folder, as the Sandbox specs already do. Assisted-by: Claude:claude-opus-5-5 * Show the goal of a chat on the chat page A bar above the composer shows the goal with its state: Pause (which stops the running turn and so pauses the goal) while it works, Resume when it paused or needs the person, and Clear. A second line says why it paused, what the model needs, or what it did. The status line shows "Goal · turn 3 of 20" while the goal is active, and the Continue button of a paused turn stays away then, since the next turn starts by itself. The transcript shows the goal lines as quiet rows: set, replaced, continuing (with its turn), paused with the reason in plain words, resumed, reached with the summary, blocked and cleared. A goal event, also from another tab, reads the chat again, and a hidden live region says each change to a screen reader once. The strings are in all nine locales. Unit tests cover the helpers and the thread rows; a Playwright spec covers the bar, the progress, the lines, Pause, Resume, Clear and the event. Assisted-by: Claude:claude-opus-5-5 * Run the loops of the chats The loop host fires the loops that are due. A run sends the prompt to the chat as a new message only when the chat is idle: a busy chat skips the run, and an interval loop moves to its next slot instead of piling missed runs up. A self-paced loop gets two tools while it is active: schedule_next (clamped to the minimum interval and one day) and loop_done. A run in which the model calls neither ends the loop with a note. A loop ends after its run limit, pauses after three failed runs in a row, and waits for the next UTC day when the owner's daily budget of runs is used up. One frontend fires the loops, the holder of a new advisory lock. A run is claimed in the store first, and the turn claim keeps one turn per chat, so a short overlap of two leaders starts no run twice. A new leader finishes the runs the old one watched. Deleting a chat removes its loops; a due loop whose chat is gone removes itself. Five runtime settings bound the loops: chats_loop_min_interval, chats_loop_max_runs, chats_loop_max_per_chat, chats_loop_max_per_user and chats_loop_daily_runs. Assisted-by: Claude:claude-opus-5-5 * Add the loops API of the chats GET, POST and DELETE /api/chats/{id}/loops list, start and stop the loops of a chat; PUT and DELETE /api/chats/{id}/loops/{loopId} pause, resume, confirm or stop one. GET /api/chats/{id} carries the loops, the transcript marks the user lines a loop sent with loop {id, run}, and a loops event tells every open tab that the list changed. The routes are gated by the chats feature and documented in the swagger spec and the API instructions. They act on the caller's own chats only, so they get no assistant tool. The chats page gets a loop section, with when to use a loop and when a trigger, and the cluster behaviour; the runtime settings page lists the five loop settings. Assisted-by: Claude:claude-opus-5-5 * Show the loops of a chat above the message box Each loop of the open chat shows as one line over the message box, such as "Loop · every 5 min · run 4 · next at 09:20", with Pause or Resume and Stop. A loop that paused itself or ended says why; an ended one has Dismiss. The first loop of a chat shows a card instead: "Run this every 5 minutes until you stop it?" with Start and Cancel. The server keeps the pending loop, so a reload shows the card again. A message that a loop sent carries a small "Loop run 4" label. The page reads the loops again on the loops event, so every open tab follows. The answer to /loop list is ready for the slash command. The strings are in all nine locales. Assisted-by: Claude:claude-opus-5-5 * Build the chat slash menu on one command registry The slash commands of Home and of a chat now come from one registry, src/utils/slashCommands.js. A command has a kind (navigate, insert or server), the surfaces that offer it, a needs check and, optionally, an argument provider: args(query, ctx) returns the items the menu lists when the box holds "/cmd <query>". Every existing command and test id stays; the registry adds: - one command per skill of the chat or the draft (/review), marked built-in, add-on, shared or yours, and /skill <name>, which also reaches a skill named like a command; - /agent <name> <task>, which lists the saved agents, or offers to turn them on for the chat when they are off; - /model and /models with a model name, which switch at once; - /compact and /clear, which show their progress in the status line and leave a marker in the thread; the context meter drops; - /attach and /attach clear, /help (a card that lists the commands) and /about (a card with the model, its state, the tools, skills, where commands run and the context size). Tab completes a command or an argument, Enter runs it, and the first row whose name starts with what was typed is selected first. A message typed as a skill or agent command is sent with its marker, not as text; the transcript shows the words and a chip. Home offers the same set without the commands that need a thread. The words are in all nine locales. The registry has unit tests, and a Playwright spec covers the menu, the completion, the marker, the chip, compact, clear and the cards with the routes stubbed. The docs page gains a slash commands section. Assisted-by: Claude:claude-opus-5-5 * Add the /goal command to the chat /goal shows a card with the goal, its state, the automatic turns and steps it used out of the limits, and when it was set. /goal <text> sets a new goal at once, replacing the one the chat had without a question, and the goal bar says what it replaced. /goal clear and /goal resume act on the goal; typing "/goal " lists resume and clear for the goal the chat has. None of these is sent as a message. In a new chat, /goal <text> creates the chat first. The command sits in the Context group of the shared command registry, on the chat surface only, and not in a chat that a trigger or another run started. A skill named goal is reached through /skill. Unit tests cover the parser and the menu items; the Playwright spec covers the card, setting, replacing, resuming and clearing from the box. Assisted-by: Claude:claude-opus-5-5 * Add /loop to the chat /loop [interval] <prompt> starts a loop in the chat; /loop list shows the loops of the chat with the code that /loop stop takes, and /loop stop [id] stops one or all. The command is in the slash registry: after "/loop " the menu offers list and stop, and after "stop " the loops of the chat. A loop prompt that invokes a skill (/review the diff, or /skill review the diff) runs as the person's skill command would: the model gets the skill's text, and the transcript shows the words, the skill's chip and the loop label. The server checks the skill when the loop starts and at each run; any other command is refused with the reason. Assisted-by: Claude:claude-opus-5-5 * List the loop settings on the Settings page The five limits of the loops of the chats show under Tools with the other chat settings: the shortest interval, the runs per loop, the loops per chat and per user, and the loop runs per day. All apply at once. Assisted-by: Claude:claude-opus-5-5 * Clear a sent Home draft when the page goes away too Home clears the draft of a sent message when it closes, so the text stays visible while the composer moves into the new chat. While the chat page still loads, a reload or a closed tab could come first, and the sent text came back on Home. Leaving the page now clears it too. Assisted-by: Claude:claude-opus-5-5 * Check the close error of a previewed file golangci-lint (errcheck) flagged the deferred Close of the file the preview endpoint reads. Discard its error explicitly, as the other studio file handlers do. Assisted-by: Claude:claude-opus-5-5 * Explain the document read of the text index to gosec gosec reported the read of a stored document text as a file inclusion through a variable. The path is the configured index directory joined with a hash that documentPath refuses when it holds a path separator or a dot, so it cannot leave the documents folder. Assisted-by: Claude:claude-opus-5-5 * Build the darwin/arm64 add-on packages on macos-15 GitHub retires the macos-14 runner image on 2026-11-02 and runs scheduled brownouts until then: every darwin/arm64 package job failed at once with the brownout notice. macos-15 is the Apple Silicon image that replaces it. Assisted-by: Claude:claude-opus-5-5 * Expect the chat's own load_skill tool in the agent prompt spec The spec that keeps the agent engine's text out of the prompt also required that no load_skill tool or mention reach the model. Chats now offer their own load_skill tool and the skills index tells the model to call it, so the spec failed. Keep the checks on the engine's own skill and command text, and check that the chat's tool is offered. Assisted-by: Claude:claude-opus-5-5 * Read the user's scripted tool call in the mock model The chat prompt now names the chat's work folder, and the folder name comes from the chat title, which holds a cut copy of the user message. The mock model read the first ADDON_TOOL_CALL marker, the cut one in the system prompt, and called the tool with broken arguments over and over. Read the last marker, the one of the user message. Assisted-by: Claude:claude-opus-5-5 * Keep the phone targets of the inbox at 44 pixels in every build On a phone the inbox close button and the item actions must be 44 pixels wide. Their rule had the same weight as the kit's .dk-btn min-width, so the order of the stylesheets decided. The single-chunk coverage build puts the kit later and the close button shrank to 28 pixels. Scope both rules to their container so they win in any order. Assisted-by: Claude:claude-opus-5-5 * Let the about-you spec accept the sidebar's own seen date When the user has pages, the sidebar writes the date of its New label under seen.new in user.json. In the whole suite other specs make pages first, so the saved record held that date as well and the exact comparison failed. Check that the uploaded seen record is kept. Assisted-by: Claude:claude-opus-5-5 * Give the typed-while-working chat spec time for two turns The spec waits up to 30 seconds for each step, but two turns of the mock model with its tool steps take about 28 seconds on their own, so the default 30 second test limit cut it under load. Set its limit to 90 seconds. Assisted-by: Claude:claude-opus-5-5 * Scope the foundation spec's state query to the sheet header The details pane now repeats the observed state under Health, so a role query for "State: Off" inside the add-on sheet matched two elements and failed in strict mode. The administrator-manages spec, and the two specs after it, did not run. Query the chip in the header (.ad-pane__meta), which is the state the administrator sees next to the add-on's name, through one helper used for all three assertions. Assisted-by: Claude:claude-sonnet-5-5 * Wait for the page to read each apps answer in the registry polling spec The spec moved the page clock as soon as the stand-in saw a request. The registry sets its next timer only after it reads the answer, so on a slow runner the clock could pass the due time of a timer that did not exist yet, and the next read never came. With the CPU throttled ten times, the old spec failed in 3 of 3 runs. The spec now counts the answers the page has read and lets queued work finish before it moves the clock. It pauses the clock before it leaves the page, and it tries the pause again when a slow machine passed the target time. The assertions do not change: one read at once, one read per interval and no faster, and no read after the disable. Assisted-by: Claude:claude-opus-5-5 * Close the egress test listener only after it accepts The dial helper of the egress proxy specs closed its listener when it returned, while the goroutine that accepts the connection could still be waiting to run. On a loaded runner the listener sometimes closed first. The kernel then reset the connection that was still in the accept queue, the spec's write consumed the reset error, which the spec ignores, and the next read saw EOF. The spec failed with "unexpected EOF" before the proxy got the request. Wait for Accept to return before the listener closes, then start the proxy handler on the accepted connection. Assisted-by: Claude:claude-opus-5-5 * Run host commands in a shell that reads no startup file The host backend promises a fixed environment, but bash -lc reads /etc/profile and the user's dotfiles. On macOS path_helper rewrote PATH there, so the command did not get the fixed PATH. Turn the login shell into 'bash --noprofile --norc -c' in the host backend only, and make the test assert the exact fixed PATH. Assisted-by: Claude:claude-sonnet-5-5 * Answer the command card in the platform turns and 400 a bad answer The tool-list spec of the platform suite timed out: without accounts the one person is an administrator, so the chat has the built-in bash in ask mode. The tool list is sorted and bash is first, and the mock model calls the first tool, so every turn waited five minutes for a yes on the command card. The turn helper now refuses each card it sees, as a person who clicks deny, and the turn goes on to its step limit. bash stays in the checked list. An administrator who posts a consent with no card id or an unknown decision got 403 "only an administrator can allow commands". That is a bad request, not a refusal: it now answers 400, as the swagger already says, and the route check for administrators passes. Assisted-by: Claude:claude-opus-5-5 * Let a chat switch off its shell, file, media, collection and sub-agent tools The Tools menu of a chat switched only three groups of built-in tools: web, saved_agents and triggers. A person could not keep a chat away from the shell, the files, the helper models, the collections or the sub-agents. Add five groups to the registry of built-in tools, all on until the chat switches them off: - shell: bash, whoever serves it. The Sandbox add-on's bash and the built-in bash on this machine both go, and the add-on list reports commands switched_off. The row stays listed when nothing can run commands, not usable, with the reason. - files: the file tools and read_document. - media: describe_image and transcribe_audio. - collections: list_collections and search_collection, usable only for a user with the collections feature. - subagents: spawn_agent. list_agents and /agent follow it. The registry gets two flags. External marks a tool that its own code builds for the turn (with the wrappers it needs); the registry lists it in its group and Hidden tells the builder what the chat switched off. Covers makes a group's switch also hide the add-on tool that replaces the built-in one. PUT .../builtins, the panel, the draft list and the fallbacks use the existing group code. A sub-agent follows the switches of its parent chat. The turn prompt is built from the final tool list: no file tool names, no skill writing hint, no work folder and no rules pointer when the chat cannot use files, no describe_image when the helper is off, and a commands block that says the person switched commands off. Assisted-by: Claude:claude-opus-5-5 * Queue the edited chat message after the first step starts The spec queued its message as soon as the chat showed a busy state. The turn is busy before its first model request starts, and that request takes every message that waits. With the chat's tools and skills, the first request now starts a few hundred milliseconds after the turn, so the message went with it, and the edit got 409 "already delivered" (5 of 6 local runs). Wait until the answer streams, as the Stop spec does: the request is running then, and the queued message waits for the next step. Assisted-by: Claude:claude-opus-5-5 * Give the reload chat spec a turn that outlasts the reload The spec reloaded the page during a 3 second turn and expected the page to show the turn still running. A reload of the coverage build on a busy runner takes 4 to 5 seconds (measured with a 6x CPU throttle), so the turn had ended before the page could show it. With the 30 second turn the page always showed it running, so the resumed state works and only the window was short. Add MOCK_LONG_STREAM_MEDIUM to the mock model, a turn of about 10 seconds, and use it in the spec with a 60 second limit. Assisted-by: Claude:claude-opus-5-5 * Wait for the chat page after the Home hand-off in the specs Send on Home changes the address inside a view transition, and the chat page mounts about 35 ms later. Specs that waited only for the address acted on Home in between: - The title spec pressed Ctrl+K at once, because the server names a chat after its first message as it arrives, so the title poll ends at once too. The key reached the page before the chat page listened, and the menu did not open (3 of 3 presses at 0 ms failed, all at 300 ms and later passed). - The Back spec went back before the chat page was drawn. Home was never closed, so its draft of the sent message stayed in the box. startChat now waits for the chat page, the title spec for the title in the chat header, and the Back spec for the chat page before Back. Assisted-by: Claude:claude-opus-5-5 * Accept a resolved user.json conflict in the quiet page specs The sidebar notes in the seen record of user.json the first day it labels Pages as new, and saves it from the version it read. All specs share the test server's one user, so tabs of other workers save the same record at the same time: one gets 409 and useSeen reads the file again and saves once more. Three tabs that open /app/files at once give 200, 409, 200. The quiet check of the shell pages counted the 409 as a problem. Ignore a 409 on PUT /api/chats/wellknown/user in that check. Assisted-by: Claude:claude-opus-5-5 * Check only the spec's own items in the Trash after the reload After Empty Trash and a reload, the spec expected the whole Trash to be empty. The Trash belongs to the test server's one user, and specs of other workers move files to it meanwhile, so CI saw "In the Trash: 3 files, 356 B." after the reload. The checks right after Empty Trash stay. After the reload, check that the server's Trash, the Trash tab and Files do not hold the spec's items, once each list has loaded. Assisted-by: Claude:claude-opus-5-5 * Show the new tool groups in the chat Tools menu The Tools menu lists the groups of built-in tools that the server sends. The five new ones need words and an order, and the shell row needs to say who runs the commands. Name the groups in all nine locales (Run commands, Your files, Images and audio, Collections, Sub-agents) and order the rows by what they reach: the shell and the files first, the triggers last. The shell row carries a chip with the provider (Sandbox or This machine) and a line under it that says the commands run isolated, or a warning when they run on this machine. When nothing can run commands the row is disabled with the words of the commands notice. A switched-off sub-agents group also turns /agent off in the composer. The specs cover the rows, the off and on requests, the bulk actions, the provider chip, the disabled reasons, the draft on Home and a real server round trip. Assisted-by: Claude:claude-opus-5-5 * Document the groups of built-in tools a chat can switch off The Tools menu section described only the web, triggers and saved agents groups. List every group with its tools, say which groups the server may leave out and why a row can be not usable, how Run commands covers both providers, what the model is told when a group is off, and that a sub-agent follows its parent's switches. Assisted-by: Claude:claude-opus-5-5 * Fix the host command consent spec for the 400 contract The consent route answers 400 for a body without a card id or with a decision other than once or deny, whoever asks. The spec still expected 403 for always from an administrator. Cover the malformed answers for an administrator and a user, each in their own chat, keep another user's chat at 404, and say it in the chats guide. Assisted-by: Claude:claude-sonnet-5-5 * Find the web tool group by name in the route spec The tools panel lists the shell group before the web group, so the spec that read the first entry compared the wrong group. Look the group up by name, which does not depend on the registry order. Assisted-by: Claude:claude-sonnet-5-5 * Give Skills its own sidebar item Skills work in every chat, but the sidebar filed the page under Agents and only agent skill chips linked to it. Add a Skills item right after Memory, show it in the legacy list too, and stop lighting up Agents on the skills pages. Assisted-by: Claude:claude-sonnet-5-5 * Add Manage skills to the skills picker and a /skills command The picker now ends with a Manage skills link, and /skills opens the Skills page from the composer on Home and in a chat. The picker keeps the height of its status line, so a refused change does not move the rows. Words are added in all nine locales. Assisted-by: Claude:claude-sonnet-5-5 * Say on the Skills page that every chat can use skills The page subtitle named only agents as users of skills. Say that all chats use them, translate it, and document where to manage skills: the sidebar item, the picker link and /skills. Assisted-by: Claude:claude-sonnet-5-5 * Keep Home on screen while its widgets load their strings A Home widget reads the pages strings, and i18next loads a namespace the first time a component asks for it, by suspending. Home had no Suspense boundary of its own, so the route's boundary hid all of Home (display: none) and showed the route fallback until the strings came. A widget shows only after home.json is read, so this happened after the composer was already drawn. Focus given to the composer in that window went nowhere, and a key typed then was lost. The slash menu spec failed in CI this way when another spec had written widgets to the shared home.json: the box was empty and the body had the focus. With widgets in home.json the composer was hidden right after it appeared on 5 of 5 loads, and the spec failed 1 or 2 times in 5. The examples and the widgets now have their own boundary with no fallback, so only they wait. A new spec holds the pages strings while it types in the composer; it fails without the change (the composer never takes the focus) and passes with it. Assisted-by: Claude:claude-opus-5-5 * Send the stubbed file change after the Files page read the folder The change feed spec answered the first stream request with the change at once. The app shell (the appearance sync) opens the shared stream when the app starts, before the Files page chunk has loaded, so on a slow runner the change reached a tab where nobody watched the folder yet and was dropped. The page then never read the folder again, and the spec failed on all three CI attempts. A CPU throttle of 8 makes it fail 3 of 3 times locally. On a real server the page's own first read would already show such a change. The stub now holds the change until the page has read the folder; the page subscribes in the same commit as that read, so the change arrives with a subscriber in place. The resume check is kept. Assisted-by: Claude:claude-opus-5-5 * Give the oversized 3D input as a sparse file, not a buffer The spec built a 32 MiB buffer and passed it to setInputFiles. Playwright sends a buffer to the browser over the protocol: that step alone took 5.5 s on an idle machine, and on the loaded CI runner the test hit the 30 s timeout on all three attempts. It now writes a sparse file of the same size to the test output folder and passes its path, which the local browser opens as is. The page still checks the size before it reads the file, so the toast and the no-request assertion are unchanged. The step takes milliseconds. Assisted-by: Claude:claude-opus-5-5 * Check the tool line, not the tool name, in the tool call journey The spec looked for /list_files/ in the transcript. The user's own message holds that name, so the check could pass before any tool ran. Once the model's call streamed, a second element matched, and the strict locator failed (2 matches on the first attempt, 5 on the retry). It now waits for the activity line that the tool run adds ("Listed /"), which only shows after the tool ran. Assisted-by: Claude:claude-opus-5-5 * Measure the proposal card and its neighbours in one frame The layout spec read the boxes of the message text, the card and the message actions with three boundingBox calls. They are viewport positions taken in three frames, and the transcript scrolls to its end while the card fills in. On the phone the actions were read after a scroll and came out 156 px above the bottom of the card. The three boxes now come from one page.evaluate, so they are read in the same frame. The order assertions are unchanged. Assisted-by: Claude:claude-opus-5-5 * Read the page fixture time when the page is served The task board fixture of the discovery and Pages specs set its change time once, when the file loaded. A worker loads it once and keeps running specs, so a spec that ran two minutes later read "Changed 2 minutes ago by the assistant" where it expects "just now". The change time is now a getter, read when the fixture is serialized into a response. Assisted-by: Claude:claude-opus-5-5 * Check a background process without /proc in the host test The alive helper read /proc/<pid>/stat, which macOS does not have, so it reported every process as dead and the spec failed there with "did not survive the suspend". Use signal 0 for existence and ps (or /proc where present) to tell a zombie from a live process. Assisted-by: Claude:claude-sonnet-5-5 * Keep the composer switch menus at their own height The base rule of the dropdown menu caps it at 320px and lets it scroll. The switch menus set their own height with a rule of the same weight in a lazy sheet, so which one won depended on the order the sheets loaded in. When the base rule won, the picker showed a few rows, and a click on a row at the edge of the list scrolled the list by a few pixels. Double the class on the switch menu rules so they win in any order, and add a test that loads the base rule last. Assisted-by: Claude:claude-sonnet-5-5 * Show what applies in the chat Network switch The Network row highlighted the choice stored with the chat, so a chat that asked for All public sites under an administrator limit of Off showed All highlighted although it was disabled and not in effect. Highlight the effective choice, the lower of the chat's choice and the limit, which the server already computes. When the chat asks for more than the limit, say so in one line instead of highlighting it. Add a line that the limit is set by the administrator, and tell the host network line that limits need the Sandbox add-on. Assisted-by: Claude:claude-sonnet-5-5 * Design the host components that add-ons reference The host UI names the Sandbox and the Web add-ons to place their server settings, and the chat's Network row links to the global Settings page. Describe a closed registry of host components that an add-on references by ID in its manifest, entitled by the existing host operation grants and tool shadows, so the controls live on the add-on's own page and a second add-on can reuse them with no host change. Assisted-by: Claude:claude-opus-5-5 * Let an add-on ask for host controls in its manifest An add-on had no way to say that a host-owned control belongs on its page, so the host UI placed those controls by add-on name. Add ui.controls, a list of IDs from a closed registry of host controls: network-policy (the network of the commands an add-on runs) and tool-providers (the rows of the built-in tools it replaces). The host decides which controls it draws: EntitledControls keeps a control only when the add-on holds its host operation grant and replaces its built-in tool. The field is optional, so every existing manifest stays valid. Assisted-by: Claude:claude-opus-5-5 * List the host controls an add-on is entitled to The apps list now carries ui.controls with the host controls the manifest declares and the host setting entitles the add-on to: the manager passes each add-on's host operation grants to the list. GET /api/chats/{id}/egress gains addon, the add-on that runs the chat's commands when it has the network-policy control, so the chat can draw its Network row from that add-on and link to its settings. applies and applies_reason keep their meaning: the policy holds with or without the control. The model and the 400 error no longer send an administrator to Settings > Tools for the limit. Assisted-by: Claude:claude-opus-5-5 * Draw the host controls on the add-on's own page The host UI placed the Sandbox network and the tool rows by add-on name (SERVER_SETTINGS), showed a read-only summary on the add-on's Settings tab, and linked the chat's Network row to the global Settings page. Add a registry of host controls keyed by the IDs of the contract. The Settings tab of an add-on draws, below its own sections, the controls the apps list gives it, in one form with the pending bar of the Settings page: network-policy reuses the network section and its setting rows, tool-providers the rows of the built-in tools the add-on replaces. The chat draws its Network row only when the server names an add-on with network-policy, and the administrator link opens that add-on's tab. The row itself is unchanged. The Settings page keeps the settings of features that exist without an add-on, points to the add-on where one serves them, and no longer lists the network settings. Its old address opens the add-on's tab. Assisted-by: Claude:claude-opus-5-5 * Ask for the host controls in the Sandbox and Web manifests The Sandbox asks for network-policy and tool-providers, so the network of its commands and the bash row are drawn on its own Settings tab and its chats get the Network row. The Web add-on asks for tool-providers only: it holds no egress grant. The manifest tests check that the default grants entitle each add-on to what it asks for. The proxy's refusal now sends the model to the Sandbox Settings tab instead of Settings > Tools. Assisted-by: Claude:claude-opus-5-5 * Keep the button of the network pointer row at its size The row used the wide layout of the tool rows, so its Open settings button stretched across the page. Use the plain setting row, which puts the button on the right like the other controls. Assisted-by: Claude:claude-opus-5-5 * Fix the add-on contract inventory and the apps Swagger fixture The contracts case inventory missed the six host control specs, so verify.sh rejected the Ginkgo report. List them. The Swagger spec test never saw `controls` in the emitted UIView JSON because its fixture left the omitempty field empty. Set it there. Assisted-by: Claude:claude-sonnet-5-5 * Add the host controls spec to the apps inventory The apps suite ran one more spec than scripts/addons/suites.json listed, so verify.sh rejected the apps report as an inventory mismatch. List the new spec in the report inventory and in the suite's aggregate case list. Every other Ginkgo suite was re-run and matches its inventory. Assisted-by: Claude:claude-sonnet-5-5 --------- Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-11-01 12:08:23 +01:00
Stefan Walcz	95034f1147	feat(ui): offer model MCP servers to non-admin chat users (#12660) ... The chat page derived MCP availability from GET /api/models/config-json/:name, which is admin-only. With auth enabled a regular user holding the `mcp` feature (default ON) therefore never saw the MCP Servers/Prompts/Resources tabs, although every endpoint behind them (/v1/mcp/servers|prompts|resources/:model) is gated only by that feature. /api/models/capabilities, which the chat already loads for its model picker and which honours the per-user model allowlist, now reports `mcp: true` for models whose config declares remote or stdio MCP servers (never when MCP is disabled on the instance). For non-admins the chat combines that flag with hasFeature('mcp') and clears a stale MCP selection otherwise. Admins keep the config-json path unchanged; the model info panel and automatic context size stay admin-only on purpose, since they need the full model config. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>	2026-10-19 23:43:47 +02:00
3 people	e715af1def	feat(llama-cpp): add slot prompt-cache save and restore API (#12730) ... * feat(llama-cpp): add slot prompt-cache save and restore API Add POST /v1/slots/save and POST /v1/slots/restore. They write one llama.cpp slot's prompt cache (KV state) to a file and load it back, so a client can warm a long system prompt in a few hundred milliseconds instead of re-running prefill. Refs #12685. The new SlotCache gRPC call posts the same slot save and restore tasks the llama-server /slots endpoint uses. It is off unless the model sets the new slot_save_path option, so existing models are not affected. The /slots monitoring endpoint is not needed here: the backend has no HTTP server. The file name comes from the caller, so it is checked twice, in Go and again in the backend. It must be one path component: no empty name, "/", "\", "..", NUL, control characters or absolute path. The resolved path, with symbolic links followed, must be a direct child of slot_save_path. The routes are admin only because they write files on the backend host. Assisted-by: Claude:claude-sonnet-5-5 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(llama-cpp): answer 501 when a backend lacks slot cache A backend that does not implement the SlotCache rpc returns gRPC UNIMPLEMENTED. The API passed that text through, so the client saw "unknown method SlotCache". Map the status to a typed error in core/backend and return 501 with a fixed message instead. Every other error path is unchanged. Make the SlotCache comments in backend.proto backend-neutral: slot is the backend's state slot, filename must stay inside the save directory, and an empty model_identity means the backend does not check it. Only comments change, no field or name. Add tests that the identity sent is the configured model, and for the error mapping. Assisted-by: Claude:claude-sonnet-5-5 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(llama-cpp): issue slot cache IDs on the server The slot save and restore API let the client pick the file name. Restore could load any file in slot_save_path, and the symlink check ran before llama.cpp opened the file. The backend now issues the name. A save returns a random 128-bit ID (32 lowercase hex characters, read from /dev/urandom) and never overwrites an existing file. Files live in a 0700 directory per model, named from the SHA-256 of the model identity, with a manifest.json that records each save. The manifest is written atomically and a corrupt one stops both save and restore. A restore takes the ID, finds it in the manifest, refuses an entry of another model, builds the path from the entry and checks with lstat that it is a plain file of the recorded size. The directory mode is the main defence against another local user, since llama.cpp still opens the path itself. Each model keeps at most 32 saves and the oldest is deleted first. A file over 8 GiB is deleted after the save, because llama.cpp does not report the size before it writes. Responses carry no host path. The HTTP bodies change: save takes {model, slot}, restore takes {model, slot, id}, and an unknown ID returns 404. In the proto, SlotCacheRequest.filename and SlotCacheResponse.filename become id. SlotCache no longer calls checkModelIdentity, which reads a field this request does not have. Assisted-by: Claude:claude-sonnet-5-5 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(llama-cpp): copy slot_cache files in prepare.sh grpc-server.cpp includes slot_cache.h, but prepare.sh copies the helper headers into llama.cpp/tools/grpc-server/ one by one and skipped it. The llama-cpp, turboquant and bonsai builds share this step, so they all failed with "slot_cache.h: No such file or directory". Copy slot_cache.h and slot_cache_test.cpp, which CMakeLists.txt builds when LLAMA_GRPC_BUILD_TESTS is on. Assisted-by: Claude:claude-sonnet-5-5 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore(deps): bump LocalAGI to pick up the scheduler start/stop fix LocalAGI's scheduler could hit a nil pointer in run when Start and Stop raced. That made the core/services/agentpool tests panic at random and turned tests-linux red. Move to mudler/LocalAGI@7aa0c8fea0, the merge of mudler/LocalAGI#519 ("make Start and Stop safe to call concurrently"). The new module version also adds a few indirect requirements to go.mod and go.sum. Assisted-by: Claude:claude-sonnet-5-5 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@users.noreply.github.com>	2026-10-17 18:23:02 +02:00
localai-org-maint-botandlocalai-org-maint-bot	f02d5244da	fix(agents): warn about unowned data with auth (#12669) ... Warn before the standalone pool starts root agents with user auth enabled. Count root agents, collections, skills, and configured skill repositories. Document the auth transition, bootstrap rules, and agent key behavior. Addresses the warning and documentation step of #12665. Admin visibility and data migration remain separate work. Assisted-by: Codex:GPT-6 Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>	2026-10-13 17:58:56 +02:00
3 people	4d7bdc6ff2	feat(ui): redesign the web UI around a shared kit and a calm palette (#12526) ... * build(ui): vendor the shared UI kit snapshot at 0.2.0 The restyle needs the kit's tokens, motion layer and component classes. Take a pinned snapshot instead of depending on the kit at build time, and keep a lock file with the version and per-file checksums so a later update shows exactly what changed. The product theme stays outside the vendored directory. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add the ink and teal theme and bridge the old variables Define the product colours as the shared UI kit's roles, for light and dark, in theme-localai.css. The kit's contrast check passes on every pair. theme.css keeps the existing --color-* and --shadow-* names but now points each at a role, so App.css and the pages get the new palette without edits. Radii move to the kit scale. index.html now sets data-theme before first paint with the same rule as ThemeContext (stored choice, otherwise dark), because the contract layout of the theme file no longer defaults to dark by itself. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): restyle the shared chrome with the UI kit grammar Adjust the shared classes so every page picks up the same interaction language without per-page edits: - Sidebar sits on the canvas and the current row lifts onto a card. Section labels are tracked uppercase, the badge is a soft pill, and the phone drawer leaves the tab order when closed. - Buttons are flat: hover swaps the surface, press scales to .97, focus is a 2px ring with a 2px offset, danger is a tinted wash. - Inputs use the card surface and the control edge; switches, tabs, filter chips, badges and cards follow the same rules. Cards no longer lift on hover; only linked or button cards react. - Menus and popovers scale in from the trigger corner with 40px items. Dialogs get a veil fade and a spring settle. Toasts become pills at the bottom centre. - The page transition is a 250 ms fade with a 6px rise. It fills backwards so a finished animation no longer leaves a transform that confined dialog veils to the main column. The focus-ring test now checks the outline instead of a box shadow, and new specs cover the theme roles, the first-paint theme and the sidebar lift. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): move leftover hard-coded colours onto the theme roles The YAML editor restated the old blue palette in JavaScript, and a few pages kept literal blues, indigo and violet tints, or fallbacks that only applied because a variable was never defined. Point them at the theme variables so they follow light and dark and the new palette. The status badges in the account pages built their tint by appending "22" to a variable, which is not valid once the variable is defined, so they had no background. Use the wash roles instead. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): raise the type scale and control size toward the kit Body and list text moves to 15px and the rest of the scale follows the kit's 12/13/15/17/21/32/44 steps. Page titles, section headings and stat values are bold with tighter tracking; titles are 32px. Buttons, inputs, selects, tabs and nav rows are 40px high with the 12px radius, compact controls 32px. Tabs become a segmented control. The sidebar widens to 240px (64px collapsed) and nav rows get more room. Identifiers and counts in the split views use the mono face, and the stat grid becomes separate inset tiles. The Geist stack stays: it is bundled, and the thin look came from the size, weight and negative tracking, not the face. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): separate cards, panes and floating surfaces from the canvas Cards, the Models and Installed split panes, the composers and the confirm dialog use a stronger card edge, the rest shadow and the 20px radius, so they read as layers in dark as well as light. Menus and popovers move to a float surface (the hover tone in dark) with the float shadow. The selected rail row gets an accent wash and a 3px accent edge. The send buttons are a clear accent when there is something to send and a quiet inset when not; the Home button carries data-empty for that, since submitting an empty box does nothing. The assistant card becomes an accent wash with a square icon. New surfaces spec checks the pane edge, the selected row, both send buttons and the popover in both themes. The voice library empty-state spec now waits for the layout to settle before comparing two boxes. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): tidy the sidebar header and mark the current row with a dot The header gives the configured horizontal logo a fixed width and centres it in a 72px band, lined up with the nav icons. The collapsed rail shows the configured icon logo centred, and its nav rows become 40px tiles centred in the 64px rail. The current row gets the kit's accent dot, hidden in the rail. The theme, language and account controls stay in the sidebar footer: the app has no global search or command palette to put in a top bar, so a bar would only hold controls that already have a place. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): centre the avatar in the collapsed sidebar rail The collapsed avatar link was set to "flex: 0", which gives it a zero flex basis; with min-width: 0 the link shrank to its padding and the icon overflowed from the link's left edge, about 14px right of the icon column. Use "flex: 0 0 auto" in the collapsed and tablet rail. The footer controls now share the nav icon column in the expanded sidebar too (6px footer padding, 40px control boxes), and the tablet rail gets the same footer padding and hidden language code as the collapsed one. New spec measures the centre x of the nav icons, mark, avatar, language, theme and collapse icons in the collapsed, expanded and tablet states, in both themes, and asserts they agree within 1px. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): size the console and settings rails and stack settings on phones The Operate console rail, the Settings section rail and the account tab bar still used 13px text and the old underline tabs. They now use the 15px nav size, 40px rows and the segmented tab control. Form row labels are 15px with 13px hints. On a phone the Settings section rail sat beside the form and squeezed every row into a few characters. Below 720px the rail stacks above the content as a scrolling row and form rows wrap their control below the label. The save button no longer carries the icon font class, which drew a missing glyph before its label. The language menu is wide enough to keep Bahasa Indonesia on one line. Assisted-by: Claude Code:claude-sonnet-5-5 * build(ui): update the vendored UI kit snapshot to 0.3.0 Take the 0.3.0 snapshot: the sprite now carries the full outline icon set, and the new icons/fa-map.json maps Font Awesome names to icon ids. The map lets the app move off Font Awesome in the following commits. The lock file is regenerated with the new checksums. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add an Icon component backed by the kit sprite Icon draws an inline svg that points into the kit's outline sprite. The sprite is inlined into the page once, so the references resolve under any base path and in the embedded build without a request. Icons size with the font (1em), take currentColor, hide from assistive tech unless given a title, and spin on request. An unknown id draws a neutral circle. FaIcon and iconFromFa resolve Font Awesome names through the kit's map, for names that arrive at run time. iconHtml does the same for markup built as a string. The GitHub and Apple marks are small local glyphs, as the kit ships no brand marks. Assisted-by: Claude Code:claude-sonnet-5-5 * refactor(ui): draw shared components and helpers with Icon Replace the Font Awesome elements in the shared components and in the utility modules with the Icon component. Lookup tables now hold kit icon ids instead of class strings. Code-block copy buttons and artifact cards, which build HTML strings, use iconHtml and a sanitizer-safe slot. Assisted-by: Claude Code:claude-sonnet-5-5 * refactor(ui): draw model, backend and account pages with Icon Replace the Font Awesome elements on the home, models, backends, import, settings, login, account and users pages with the Icon component. Assisted-by: Claude Code:claude-sonnet-5-5 * refactor(ui): draw chat, studio and recognition pages with Icon Replace the Font Awesome elements on the chat, media generation, talk and face and voice pages with the Icon component. The talk status table keeps its spin and pulse states as Icon props. The connected and error states now use a dotted circle and an alert circle, so they differ from the idle ring by shape as well as by colour. Assisted-by: Claude Code:claude-sonnet-5-5 * refactor(ui): draw agent, node and operate pages with Icon Replace the Font Awesome elements on the agents, skills, collections, jobs, fine-tune, quantize, nodes, swarm, usage, traces and activity pages with the Icon component. Two class strings on layout elements held leftover button and icon classes from an earlier merge; they are cleaned up so the elements keep only their own classes. Assisted-by: Claude Code:claude-sonnet-5-5 * style(ui): size and align icons for the svg component Icon rules that targeted the font element now target the svg: the descendant "i" selectors in App.css and auth.css become ".lai-icon". The svg is 1.2em with a 2 unit line so it matches the visual size of the old glyphs at the 12 to 16px sizes the app uses, sits on the text baseline, and follows the context font size. Large empty-state marks get a lighter line. Menu icons get a 16px box and the readiness badge icons keep their 20px circle with padding. Add the pulse used by the talk status. Assisted-by: Claude Code:claude-sonnet-5-5 * build(ui): remove Font Awesome No source file references the icon font any more. Drop the package and its stylesheet import. The build no longer ships the solid, regular and brand font files. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): keep focus traps off the svg use references The dialog and drawer focus traps collect focusable elements with a "[href]" selector. An icon's use element carries an href, so it became the first "focusable" element and Tab at the end of the dialog stopped there instead of wrapping to the first button. Match "a[href]" instead. Assisted-by: Claude Code:claude-sonnet-5-5 * style(ui): keep icon sizes overridable and set the line width per svg Give the icon base rule zero specificity so a rule that sizes one icon (nav column, menu box, avatar, language switcher) wins whatever its order in the file. The sprite symbols fix their own line width; the inlined copy drops it so the width set on each svg applies, as the --lai-stroke custom property, and large marks can use a lighter line. Pin the avatar and the language globe to the boxes the sidebar alignment spec expects. Import the map as JSON with an import attribute so Node can load it in the spec. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): select icons by the svg markup and cover the sprite Specs that found icons by their Font Awesome class now select the svg by its data-icon. The dead-icon audit checks that every svg resolves to a sprite symbol and has a size. The class hygiene spec fails on any remaining Font Awesome class. A new spec checks every mapped icon id has a symbol, that the sprite is inlined once, that an icon paints at the root and under a forwarded path prefix, and that Font Awesome names map as documented. Assisted-by: Claude Code:claude-sonnet-5-5 * build(ui): update the vendored UI kit snapshot to 0.4.0 Take the 0.4.0 snapshot: hub tabs with count and attention badges, the six chart series tokens and the grid colour in the theme contract, and sample themes on a calmer palette. The kit headers are renamed and the lock file is regenerated with the new checksums, as for the earlier snapshots. Assisted-by: Claude Code:claude-sonnet-5-5 * style(ui): switch the theme to the calm palette Rewrite the LocalAI theme on the calm palette: a muted teal accent on a near-neutral green-grey canvas, desaturated status colours, no glow and no coloured shadows. The theme fills every role of the shared UI kit's 0.4.0 theme contract for light and dark, including the six chart series and the grid line. The bridge in theme.css keeps the old --color-* names working, adds the dark surface ladder (card, raised, float) and a strong edge, and points the fixed data hues at the chart series. Two values differ from the first sketch. The dark text on the accent fill is #021512 instead of #04201d: it reads 5.58:1 on the fill at rest and 6.4:1 on the hover fill, against 5.08:1 at rest for the lighter value. The light control edge is #6b7d7a. The kit's contrast script passes for all text pairs (4.5:1), control and focus pairs (3:1) and series colours (3:1). Leftovers that no longer fit the palette are fixed: the usage chart takes the six series colours in order, the audio and animation canvases fall back to the new accent, the face box loses its glow, and two gradient fills are now flat. The theme tests expect the new canvas colours. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): replace the console rail with hub tab bars Build and Operate no longer open a second navigation rail beside the page. Each is a hub: one row of the kit's hub tabs above the page, with count and attention badges that scroll sideways on a phone. Every URL and route stays as it was, plus a new /app/build landing page that lists the Build tools with a line each. Build tabs: Overview, Agents, Skills, Memory, Jobs, Fine-Tune, Quantize, Import, Voices (recognition and library) and Faces. Operate tabs: Status, This machine, Swarm (distributed mode only), Runtime (backends, activity, failover), Traffic (usage, traces, middleware) and Settings (settings, users), plus the API link. A tab that holds several pages shows a second row of links, and a sub-page such as a node detail keeps its tab highlighted. The feature and admin gates decide which tabs are drawn, and badges show only values the Operate summary already has. The sidebar lists Build and Operate under a Workspace label next to the Create group. The voice library moves under Build and the model import page gains the Build tab bar. The old rail styles, the rail signals and the console config are removed, and the Operate overview docs describe the tab bar. The specs that drove the rail now drive the tabs, and a new spec covers the tab for each route, gating, badges and the phone layout. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Home as a calm console Home now opens on one command bar: the model chip shows which models are warm, the MCP chip and attach buttons sit beside it, and Send is a solid button with an Enter glyph. Typing "/" opens a grouped, keyboard-driven action list built on the kit command list; every action has a destination in the product. Memory use folds into a one-line strip that opens into the loaded models, with Stop per model and Stop all. It opens by itself while a model is being staged and after a failure, and shows nodes and aggregate memory in a cluster. The list of resident models carries no per-model size because the API reports none. "Jump back in" lists the conversations stored in the browser, one card per day, with j and k to move, Enter to resume and delete with an undo toast. First run keeps the install steps and the recommended models. The assistant prompt is a dismissible line, the library links are one quiet row and the API section is collapsed. Chat accepts an empty new-chat hand-off for /new. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Home console Update the Home specs for the new structure and add specs for the slash menu, the model chip, the memory strip (expand, stop, staging, failure, cluster), the resume list (grouping, j/k, Enter, delete with undo), first run, the send hand-off, a non-admin user and the phone layout. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add the fit, disk and cleanup helpers for the models page Pure functions and hooks that the rebuilt Models page reads, with node tests for the rules. modelLedger turns an estimate and the memory budget into one of three verdicts (fits, spills to CPU, over) with the headroom in bytes, and reads the models disk from the resources reading. The disk counts as low under 10 percent or under 20 GB free, and is absent when the server reports none or runs as a cluster controller. cleanupPlan ranks installed models from what the API reports: loaded, pinned, or named by an agent, a task, a failover chain or an alias keeps a model protected; another installed build of the same gallery model is a duplicate; disabled models rank above idle ones. The API records no last use or use count, so none is used. When a lookup fails, nothing is called safe. useModelRemoval holds a removal in the browser for an undo window and sends the existing delete call only when the window ends. Leaving the page drops the batch without deleting anything. The undo toast takes optional labels so other pages can reuse it. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Models as a ledger with a disk strip and cleanup review Explore is one dense table. Each row carries the size, a solid memory bar and the headroom in words ("3.7 free", "+1.5 on CPU", "0.9 over"), worked out from the estimate at the chosen context length. Capability chips show the server's count for each facet, search keeps its meaning and "/" jumps to it, and a density switch (also "d") picks comfortable or compact rows. Selection is a surface step and a check, never a rail. Arrow keys move, Enter installs and Esc closes the inspector, which keeps the fit summary, VRAM by context chart, variants, files, links, tags and licence. A failed install shows its error in the row with a Retry that dismisses the old failure first. A failed or empty listing says which it is, and a host with no GPU is measured against memory and says so. Installed uses the same table with state filters that carry counts, a state per row, Load or Stop on the row, the row menu and the sort by size. Sizes come from the files the gallery lists, so a model it does not know shows a dash. A strip in the header shows the free space on the models disk. It turns amber under 10 percent or under 20 GB free, hides when the server reports no disk or runs as a cluster controller, and opens the cleanup review. Explore says how much an install leaves free. The review ranks installed models as Safe to remove, Probably safe and Your call from real facts only, lists protected models with the reason, and says plainly that usage history is not recorded. A sticky bar shows what a choice frees. Confirming runs a dry run that checks again and lists what will go. Removal waits 30 seconds with an undo; nothing is deleted before that, and leaving the page deletes nothing. The old rail, filter band and popover styles are removed. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Models ledger, Installed table and cleanup review Update the Models, lifecycle, cluster fit, height, search focus and surfaces specs for the table and inspector, keeping what each one checks. New specs, on a shared 41-model gallery stub with three machine profiles: the fit bar and headroom words for a 24 GB card, an 8 GB laptop and a host with no GPU; facet counts, search, "/" and Escape; selection, arrow keys, Enter to install, density; the disk strip when normal, low and hidden; and the states (loading, empty, offline, install failed, phone). Installed covers filters with counts, row actions, the row menu, sizes and sort. The cleanup specs cover grouping, protected models, the honest-data note, the effect bar, the dry run, the undo window, a failed delete, leaving the page, and the phone sheet. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add the placement helpers and the estimate hooks The Placement section and the model page need the same few rules, so they sit in plain functions that can be read and tested alone. placement.js holds what gpu_layers, tensor_split and main_gpu mean (unset asks for every layer and the llama.cpp engine trims it, zero is CPU only, 99999999 is the value LocalAI itself writes for all layers), the device list taken from the resources reading, the split by free memory, the part of an estimate that grows with context (read from two lengths, since that term is linear), the fit states with their limit (95 percent of free memory, and the leftover has to fit in system memory too), and a bisection for the largest layer count whose estimate fits. The estimate returns one total and no layer count, so the search runs over 1 to 256 and stops at the first count that no longer changes it. modelWalk.js keeps the order of the list a model page was opened from, in memory and in session storage, for the previous and next buttons. usePlacementEstimate reads /api/models/vram-estimate for a choice, again at twice the context, and with every layer, and keeps readings for the session. useModelPage reads a gallery entry by name, an estimate by context size (from the model's own files when the gallery does not list it), the builds and the loaded models. usePlacementConfig edits the four placement keys of an installed model and saves only what changed. useModelActions is the Load, Stop, disable, pin and remove logic of the Installed table, shared with the model page. MemoryBar is one solid bar with a tick at the capacity of its pool; over capacity it grows past the tick and the tick turns red. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add the Placement section to the model editor Run this model on: CPU only (gpu_layers: 0), Auto (the key stays unset) or Custom. Custom takes a number, has an All layers button that writes 99999999, and shows a slider only when the estimate reports the model's layer count, which it does not today. Context size has presets and a number field because the KV cache follows it. With two or more GPUs there is a split (written as percentages, with a button that takes them from the free memory of each card) and a main GPU. A bar per GPU and one for system memory show what other programs use, the model's weights and working memory, and the part that grows with context, with the room left or how far over it is. Under them a verdict in plain words: Fits in GPU, Spills to CPU, Too many layers for the GPU, Runs on CPU only, No GPU found, Not enough memory. It says "slower" and never a multiplier, because the estimate has none. Fit it for me asks the estimate for the largest layer count that fits the free GPU memory and says what it set, with Undo; it is hidden when the estimate is unavailable or the host has no GPU. Loading shows skeletons, an unavailable estimate shows a note with Retry, and a server that schedules onto other machines shows no bars, because its device list is the controller's. The editor shows the section for an installed model, with a link in its section rail. Auto sends null for the key, since a patch only merges, and a null read back opens as Auto. The docs describe the section and what each mode writes. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): open a model on its own page A model has an address, /app/models/<name>, for an installed model and a gallery entry alike. Open it from the arrow at the end of a row, a double click, "o" on the selected row, the inspector's Open details button, or a tap on a phone. The title block holds the main action: Install with a chevron that chooses the build, or Load and Stop with a menu (disable, pin, edit configuration, logs, delete with a confirm). A strip answers whether it fits, what it does and what installing leaves free. Tabs: Overview (about, a memory bar, state, the pages it opens in, and the agents, tasks, chains and aliases that name it); Fit and memory (verdict, context sizes, the bar split into weights and context, and memory by context against the limit, with a data table); Variants and files (builds with size and fit, install any, the files of the chosen build). For an installed model also Usage and history, which says what the API does not record instead of drawing an empty chart, Configuration, which is the Placement section with the file it writes and a link to the full editor, and Logs, the backend log viewer without its page. Keys 1 to 6 switch tabs, [ ] and j k walk the list the page was opened from, Esc or Backspace go back. The list stays mounted behind the page, so Back finds its view, search, filters, selection and scroll as they were, and focus returns to the row's arrow. The page covers loading, an unknown name with the closest matches, the gallery being out of reach, an install in progress with Cancel, and a failed install with Retry. The docs describe the page and its keys. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the model page and the Placement section New specs for the model page: reaching it from Explore, Installed, a double click, "o", a pasted link and a phone tap; the walker and Back with the search, a filter, the selection, the Installed view and the scroll kept, and no second read of the gallery; the title block, the answer strip, tabs by click, keys and arrows; Fit and memory, builds and files with the install call each one makes; an installed model's actions, used-by, the honest usage tab, configuration and logs; loading, an unknown name, offline, an install in flight and a failed one; and the phone. New specs for Placement: every mode and the keys it writes, the slider only when a layer count exists, the context presets, the bars and every verdict, two GPUs, no GPU, a cluster, an unread machine, a loading and an unavailable estimate, Fit it for me and Undo, and the section in the model editor with its save. The phone tap on a row now opens the page, so the two phone specs that expected the inspector as the page check the page and keep the inspector check for a window between a phone and a desk. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): link Studio results and open workspaces from a prompt Each workspace now records the result it was made from (parentId and an edge kind such as take, animate or to-3d) and reads a prompt, model, size, count and source from the query string, so one page can hand work to another. A source result is fetched from the server's own output file and becomes the start image, the picture for 3D, or the audio file. A note on the page says when the source loaded or could not be loaded. Diarization had no history; it now keeps the file name, the model and a speaker count, never the recording. Prompts are cut at 2000 characters when stored. The pure helpers (type suggestion, grouping, lineage layout, favourites, clearing) have node tests. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild the Studio front page as a composer with your work The front page is a prompt box with a chip per type, a type suggestion from the words, starters, and the options each workspace accepts. Generate opens the workspace with those filled in. A type with no model is a dashed chip that shows a gallery model, its size, memory need and an Install button only when picked; the typed words stay while it installs. Under it, Your work lists results from every workspace as a masonry with filters, counts, favourites and a Clear history action. Results made from each other stack into a project tile and open as a lineage board with a dock for running a new take or branching to the next step; steps the destination cannot start from yet are disabled with the reason. The docs describe the page, what is stored in the browser, and the query parameters a workspace accepts. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Studio composer, your work and the lineage view Specs for the type suggestion, the keys, hand-off to each workspace, the install path for a missing model, the masonry filters, favourites and clearing, stacking, the lineage board, new take and branch, steps that are disabled with a reason, and the phone layout. Existing Studio specs move from lanes to chips with the same intent. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add the shared Studio workspace frame and move Images onto it The seven Studio workspaces get one layout: a row of type tabs, a compose card (optional sources as chips, a prompt with starters, a model chip, the essential options as chips, an Advanced fold that names what is inside, the memory the model needs, and one action with the reason when it cannot run), a run area, and a strip of recent results of the type. The run area shows a job card with the time that has passed and an indeterminate bar, because these endpoints report no phase or percentage; a failure with what the server said and one action; or the result with a toolbar: Favourite (the list the front page keeps), Download, Use in (the hand-off targets, disabled with the reason when a destination cannot start from the result), Re-run with edits (the take's values go back in the form, changed fields are outlined and listed) and Lineage. A type with no model shows the install note from the front page. Images is the first workspace on the frame. It keeps its size, count, steps, seed, negative prompt, source image and reference images, and its history writes, including the parent link and edge of a hand-off run. useMediaHistory.addEntry now returns the id of the entry it stored. The docs describe the workspace page. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): move Video onto the workspace frame Video keeps its size list, duration, frame rate, steps, seed, CFG scale, frame count, negative prompt, start and end image and avatar audio. The start and end image are source chips, the avatar audio opens the recording and paste input from a chip, and the rest sit in the Advanced fold. A start image from a hand-off shows as a chip with its picture. Results play in the video player with the shared toolbar. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): move TTS onto the workspace frame TTS keeps the saved-voice picker for cloning models, the typed voice for the others, the voice library deep link, and the delivery instructions, which now sit in the Advanced fold. The result is the waveform player with the words under it. The stored entry also keeps the voice id so Re-run with edits can select the same saved voice. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): move Sound onto the workspace frame Sound keeps its Simple and Advanced modes and every field of both: the description, instrumental, vocal language, caption, lyrics, BPM, duration, key, language, time signature and think mode. The mode switch, instrumental and duration are in the compose card, the rest in a More options fold. The stored entry keeps all of the fields, so Re-run with edits restores the form as it was. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): move Transform onto the workspace frame Transform keeps its audio and reference inputs with upload and record, the echo test, the key=value parameters (now in the Advanced fold), the input and output spectra and the three waveform players. The audio that was chosen shows before the run, waiting to be transformed. Re-run with edits puts back the model and parameters and fetches the audio and reference the server kept for that run. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): move 3D onto the workspace frame 3D keeps the picture input with paste and webcam, the animation operations a model declares, quality and background, the shape and material steps, guidance and seed, the GLB and animation viewers, the remesh control and the download. A 3D result now has a title from the motion prompt when it has no label, so the strip and the front page name animation results by what was asked. Re-run with edits is shown disabled with the reason, because only a small thumbnail of the picture is kept. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): move Diarization onto the workspace frame Diarization keeps its model and recording inputs, the option to prepare speakers to remember, the clean-speech previews, naming and remembering a speaker, and the history entry with only the file name, model and counts. The result now shows a timeline with one lane per speaker, the talk time of each speaker, and the segments with their start time and text. RTTM, SRT (only when the run has text) and JSON are built in the browser from the result. The helpers for talk time, axis ticks and the two text formats have node tests. Assisted-by: Claude Code:claude-sonnet-5-5 * refactor(ui): remove the styles and lists the old workspace layout used Nothing renders the two-column workbench, the control column, the old history lists, the generation progress tiles, the TTS voice picker or the result echo any more. The inline-style baseline drops with them. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the workspace frame and one run per type Specs for the type tabs, the compose card and its reason when Generate cannot run, starters, the Advanced fold, the job card with no invented progress, a failed run and its one action, the install note, the strip with its favourites filter, Use in with its disabled steps, Lineage, the parent link, Re-run with edits and its list of changes, deleting and clearing, and the hand-off note. One run through each of Video, TTS, Sound, Transform, 3D and Diarization, the phone layout of all seven, and reduced motion. Existing Studio specs move from the old control column to the compose card with the same intent. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild the chat thread with raised user turns, prose replies and one-line activity Your messages are raised blocks on the right at a 760 px measure and the model's replies are plain prose under its name and a warm or not loaded dot. Reasoning, tool calls and their results fold into one quiet line that opens inline into steps. Code blocks carry a Copy button and a Canvas button that opens that block in the canvas, image attachments are thumbnails that open in the lightbox, and files are chips. Per-message actions show on hover, on focus and on the last turn, and a turn takes focus so the arrow keys and C, E, R and B work. A failed reply keeps the text written so far and shows the reason with one Retry action. The Agent chat page keeps the older rules: the new styles are scoped to the chat page and use their own class names. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): use the Home command bar as the Chat composer Chat now ends in the same object as Home: the model chip, the MCP chip, a Canvas chip, the message box with attach buttons, a solid Send and the hint line, with the slash menu on the kit command list. The slash menu lists what Chat can do today (switch model, new chat, conversations, manage mode, canvas, find, settings, export, clear). While a reply is streaming Send becomes Stop, which Esc also presses, and Up in an empty box edits your last message. Attached images show as thumbnails and a line under the bar carries the speed and the token count. HomeComposer takes optional props for this (extra chips, its own slash list, Stop, paste, a stricter Enter); Home passes none of them. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): open conversations from a Ctrl K menu with day groups, undo and a slim header The conversations list opens as a centred menu on Ctrl or Cmd K. It groups chats by day like the Home resume list, shows the model that answered and the time, searches names and message text, and moves with the arrow keys. Enter opens a chat, F2 renames it and Delete removes it. Removing a chat hides the row and shows the kit undo toast; the chat is deleted for good only when the undo time ends. Rename, duplicate, copy and export are on each row, as before. The header is one slim bar: the Chats button, the chat name (click to rename), a context meter when the context size is known, settings and a More menu with rename, duplicate, copy, export, model info, keyboard shortcuts and clear. A dialog lists the shortcuts the page answers to. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): show loaded state, capabilities and fit in the Chat model switcher The model chip in Chat opens the same list as Home, grouped as Loaded now and Installed. Each row says warm or not loaded and marks models that understand images. When the list opens, the page reads the host memory once and asks the server to estimate each listed model at the chat's context size (up to twelve, three at a time), then shows what the model needs and whether it fits: free memory, how much would run on the CPU, or how far over the machine it is. A model with no estimate shows no fit text, and no load time is shown because the API does not report one. A memory bar closes the list. The picker takes the model list from the page when it has one, and useModels can skip its own request. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): move chat settings into a sheet and add find in chat, jump to latest and a wider canvas Settings open as a kit sheet: the system prompt, temperature, top P and top K (each says "model default" until it is changed and has a Reset), the context size with quick sizes and a note that it only drives the meter, Manage mode and Focus mode, the model info for admins with its Edit config button, and Clear conversation behind a confirmation. The old slide-out drawer and the model info panel are gone. Ctrl or Cmd Shift F (or the search button, or /find) opens a search bar over the thread. It marks matches in the messages already on the page, shows "n of m" and steps with Enter and Shift+Enter. Nothing is sent to the server. Jump to latest is a pill above the composer. Esc stops a reply, then closes the search, then closes the canvas. The canvas panel gets the kit look: tabs, a Code and Preview switch, Copy and Download, a full-page layout on narrow windows, and translated labels. The Agent chat page shares it and gets the same look. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add the empty, no-model, loading and phone states to Chat An empty chat opens with the composer under one line, starters to try, whether the model is loaded, and the Jump back in list: the same rows as Home, read from the chats the page holds. With no chat model installed, an install card offers the starter models for this hardware, the gallery and import, and the composer stays so the text is not lost. While a reply waits for a model, a load card shows what the page knows: the phase the server names, the node, the bytes and the time left when the server reports them, and a progress bar. A model that is just not loaded yet gets a plain note, with no invented phases or estimates. The foot warns when the context is nearly full. On a phone the header drops its labels, the model list and the settings open as sheets from the bottom, per-message actions stay in view and the canvas takes the whole page. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Talk as a calm voice page over what the connection really does Talk is one stage and one transcript. The stage has the pipeline chip, the voice and language chips, an outline orb that follows the real microphone and playback levels, a heading and a sentence for the current state, and the controls. The transcript lists You, Reply, Tool and Result lines and can be copied. Session settings (instructions, voice, language, tools, Manage mode and the pipeline's parts) open in a sheet. The states are the ones the code reaches: no pipeline model, idle, connecting, listening, thinking (also while a tool runs), speaking, an interrupted reply (the server cancelled it; a note marks the cut), a blocked microphone, a link that failed during a session, and any other error with its reason and a link to the traces. Push to talk and hands-free are not on the page, so they are not shown. Diagnostics keep their waveform, spectrum and stats, drawn in theme colours. The page text moves into the talk namespace, and the old Talk and visualizer styles and the inline-style count go down with the rebuild. Assisted-by: Claude Code:claude-sonnet-5-5 * refactor(ui): remove the chat styles and strings the rebuilt page replaced The settings drawer, the model info panel, the bubble avatars, the conversation menu popover, the context bar, the recent strip, the staging bar, the file badges and the focus-mode rules have no user now. Their rules, the Chat page's focus class and seven unused empty-state strings are removed. The Agent chat page keeps the shared message, sidebar and input rules it still renders with. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the rebuilt Chat and Talk pages Add a Chat page under features (thread, message actions and keys, the message box and its slash actions, the model list with loaded state and fit, conversations on Ctrl K, settings, find, canvas and the empty, no-model and loading states) and a Talk section to the realtime API page with the states the page shows. Manage mode now turns on from the chat settings or /assistant, and the client MCP steps point at the MCP chip. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): settle the rough edges of the new Chat and Talk pages The undo toast sat under the conversations menu, so the Undo button could not be pressed while the menu was open; the menu, the sheets and the fullscreen canvas now stay below the toast layer. Esc in a rename box saved the text through the blur that follows it; it now cancels. The image viewer closed on Esc only when the page did not re-render on the same key, so its key listener is registered once and reads the latest handlers. Keys on a focused message no longer type their letter into the editor they open, "/" from outside a text field starts a command as it does on Home, and Esc leaves the page's own dialogs alone. Code in the canvas is highlighted for languages that have no preview. The conversations menu drops its key hints on a phone so Clear all stays in view. Talk hides Test tone while connecting and calls a server error "Something went wrong", since the call can still be open. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the rebuilt Chat and Talk pages Specs for the thread layout and the activity fold, code blocks, image thumbnails and the viewer, per-message actions and their keys, a failed reply with its one Retry, Stop and Esc while streaming, the composer and every slash action, the conversations menu (groups, search, resume, rename, delete with undo that ends by itself, one chat left), the model switcher with loaded state, vision and fit text from stubbed estimates, the settings sheet, the canvas panel, find in chat, Jump to latest, the empty, no-model and loading states, the phone layout and reduced motion. Talk is driven over a fake WebRTC link through idle, connecting, listening, thinking, speaking, interrupted, blocked, lost, error and no pipeline, its settings sheet and its phone layout. Node tests cover the message text helpers and the conversation grouping. The existing chat specs move to the new structure with the same intent: the transcript spec now describes the raised turn and the prose reply, and the render smoke accepts Talk's own header. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): keep a bounded run log for agents in the browser The server keeps no run history for an agent, so a run is one task and the events until the agent answers, written to browser storage while the page watches the stream: up to 50 runs per agent, task, step and answer text only. Stored chats from the earlier agent chat page read as runs with stable ids. A run still marked running five minutes after its last event reads as stopped. Helpers read an agent's config into chips, build the list of changed fields against the saved config, hide secret values and offer starting points. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild the Agents area around runs The Agents page shows what needs a look (work in flight, a run that failed in the last day), then each agent with its model, attached memory and skills, and a strip of its last 14 runs. An agent has its own page: model, tools, memory, skills, instructions, a task box and its runs. A run has an address, shows the thread while it works (steps folded into one line, the tool in use, the answer as it arrives) and settles into a report about a second and a half after the agent answers: task, outcome, follow-ups, evidence and steps, with wide tables opening wider on demand. A failure says in plain words what happened and offers Run again. Create and edit fold into sections with a ready mark and a one-line summary, start from a template or an optional model-written draft, and open a preview sheet with the config as saved and the changes against the saved agent. Status becomes a quiet panel in the same language, and the old chat link opens the agent page. There is no Stop, approval, steer, version or dry-run control, because the agent API has no call behind them. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Agents launcher, agent page, runs and editor Specs for the Now strip and run strip, search and the empty state, the agent page, starting a run, the live thread, settling into the report, the run address across a reload and for a run from another browser, follow-ups with their history, failures, the folding editor with ready marks, templates, the preview sheet with hidden secrets and changes, the status page, and the phone, 1440 and 2560 layouts. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe runs and the new agent create flow Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add helpers for tasks, schedules and job outcomes Reads a cron expression the way the server does (five fields or an @ shortcut), checks it, and puts the common shapes in words. The next run is left out on purpose, because the schedule follows the server clock, which the browser cannot read. Also groups jobs by day, sums the last seven days, and gives each job one outcome line from its result or error. A rerun call starts a new job with the same parameters and media. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild the Jobs area around runs The Jobs page opens with one sentence about the last seven days, then the tasks (model, schedule in words, last 14 jobs, enabled switch, Run now) and a run history grouped by day. Each row has an outcome sentence and opens to the error or the start of the result with one next action. Deleting a task waits 30 seconds with an undo button. A task opens as a page with its recent runs, its prompt with the gaps marked and its schedule. The task form folds into sections, takes a schedule as a preset or a checked cron expression, warns about prompt gaps the schedule does not fill, and has a preview sheet. A job opens as a document: task, outcome, delivery and the recorded steps; a failed job says what happened and offers Run again. Run now now sends attached media through the job call, which is the only one that takes it. "Clear History" only ever cancelled running jobs, so it is now called Stop running jobs. Webhook headers of a saved task show as JSON instead of [object Object]. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Jobs page, task pages and job pages Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the Jobs page and the task form Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add helpers that say who uses a skill or a collection An agent loads a skill when skills are on and the skill is in its selection (an empty selection means every skill). It reads the one collection that carries its own name, when its knowledge base is on. The helpers derive that from the saved agent configs, build the config that adds or removes a skill or a collection, and estimate tokens as characters divided by four. Removing the last selected skill switches skills off, because an empty selection would mean every skill. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Skills and Memory as one library Skills and collections sit in a list with an open item beside it. Each row says who uses it, read from the saved agent configs, or says it is not used yet. Chat reads neither, so it is never named. An item opens in a pane with a Used by strip (names link to the agent, a small x removes it, with undo) and an Add to menu that shows what the addition costs. A collection can be added only to the agent that carries its name. The Memory pane searches the collection alone and shows ranked passages with scores, lists web sources with their refresh interval and the files, shows the server message when an upload fails, and names the endpoints and where files stay. The Simulate a message sheet runs a collection search and shows an agent's skills with a token estimate. It runs no model. The collection details route now opens the same page. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): show use and cost in the agent form pickers Each skill in the agent form says which other agents use it and what it adds to every message, with a total for the selection. The memory section names the collection the agent reads. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Skills and Memory libraries Specs for the used-by lines (including an agent that uses every skill), the filters, search, add to agent, remove with undo, the last-skill case, an unreadable agent list, the empty states, git repositories, the Memory question box, sources, uploads that fail, the Simulate sheet with the parts the API can run, the agent form hints and the phone layout. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the Skills and Memory libraries Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add helpers for the Operate status page and backend rows Pure functions for the parts that need rules. They work out the memory pool the page measures (GPU memory, system memory, or the workers of a cluster that are answering), which pools are too full, the headline and the four ledger rows, the geometry of the capacity chart, and what removing a backend would leave without a runtime (models name their backend, and a meta backend names the concrete one it points at). A second set says what a backend row states: installing, queued, removing, failed, update available, current or absent. LocalAI keeps no memory history, so the chart reads a bounded buffer of readings the page took itself and says so. A reading with no total is dropped rather than drawn as zero. Two hooks are shared by the pages that need them. One retries a failed operation after moving the failure into the record. The other holds a cancel for an undo window, because the server cannot take a cancel back. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Operate Status, This machine, Backends, Activity and Logs Status opens with one sentence ("2 things need you", or "Everything is running") and four rows: Needs you, Capacity, Running now and Recent failures. A row with a problem opens by itself and holds the button that deals with it: Update a backend, Retry or Dismiss a failed operation, Unload a model. A quiet row stays one line. A new installation gets a first-run screen, a cluster sums the memory of the workers that are answering, and a page still waiting for an answer says so. The chart under the rows is drawn from readings the page took while it was open and is labelled that way, because LocalAI keeps no memory history. This machine leads with GPU memory as one bar, then host memory split by running model, then VRAM, RAM, CPU and disk with a bar each. The running models become a kit table with the same menu and stop dialog. Backends is one list with Installed and Catalog views. A row says what the backend is doing (a progress bar with Cancel, Queued, Failed with Retry, Update 1.2.0, Current), carries the one button that matters, and opens in place. Removing a backend names the models and the meta backends that would stop working. Check for updates, Update all, From URL and a first-run recommendation for llama-cpp are in the header. Activity keeps its three sections as quiet rows. Cancel waits eight seconds with an undo toast, because the server cannot take a cancel back; a cancelled install can be started again from the record. Logs gets a process list, a picker, stream and text filters, Follow and Times switches, and a Clear with an undo window. Not shown, because the API has no data for them: GPU temperature and power, a size per backend, an earlier version to roll back to, a dependency lookup beyond the models and meta backends that name a backend, and models that failed to load. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover Operate Status, This machine, Backends, Activity and Logs New specs for the Status headline and ledger (healthy, needs attention, one thing, a full memory pool alone, loading, first run, cluster), its actions (Update, Retry, Dismiss, Unload with its dialog), the capacity chart built from readings taken while the page is open and bounded, the phone layout, no coloured edge on a row, and reduced motion. The Backends specs cover the two views, install progress with Cancel and its undo window, Retry on a failed install, Update, Update all, Check for updates, removal with the models and meta backends it would break, Install from URL, the first-run recommendation, a cluster, and a phone. Activity gains cancel with undo, Cancel now, a second cancel, leaving the page, progress, and starting a cancelled install again. Logs covers the stream and text filters, Follow, Times, Export, Clear with undo, the process picker and list. This machine covers the GPU strip, several GPUs, no GPU and Add a machine. Existing specs keep their intent and follow the new structure: rows open in place instead of in a pane, Update replaces Upgrade, the notice spec now pins that an update is a row state and not a banner or a rail, and a cancel waits for its undo window. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the rebuilt Operate Status, Backends and Activity pages Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add helpers for the Swarm pages Pure functions for what the pages work out from the cluster API: a node's state in words, which nodes a placement rule may use, what a rule would ask for, what a drain or a lost node would leave without service, the nodes a bulk backend update reaches, and the join commands for a worker, a peer instance and a memory shard. Hooks read the roster, the loaded replicas and the rules. Everything runs in the browser from data the page already holds, and says when it cannot see free memory or disk. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild the Swarm hub: nodes, node page, placement rules, failover Nodes is a sortable table with comfortable and compact rows, a Needs attention filter by reason, a map of the cluster that is not drawn on a phone, the running models, and a bulk backend update for the nodes that drifted. A node is a page: state, vitals, a drain preview computed from the loaded replicas and the rules, tabs for models, backends, logs and capacity and labels, and Remove that asks for the node's name. Placement rules are written as sentences, show where each model is loaded now, and edit in a side sheet with a preview of the nodes a draft could use. Deleting a rule waits a few seconds so it can be taken back. Failover keeps its chains, adds what the router does when a worker stops answering and a per-node preview of what would stop. Add a node covers a registered worker, a peer instance and a memory shard, with a command to copy and a live line that says when the machine arrived. P2P keeps its page in the same vocabulary, and the node logs page follows the local logs page. Previews are labelled as worked out in the browser. Per-GPU readings and node events are not drawn because the API does not return them. Failover moves to Swarm when distributed mode is on. Legacy fleet components and their styles are removed. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Swarm hub New specs for adding a node (each join method, the command, copy, waiting and found, approve, a single install, P2P, a phone), placement rules (sentences, where models are loaded, the preview matrix, the sheet and its preview, delete with undo) and failover on a cluster. Node detail covers its tabs, the drain preview and its dialog, resume, remove with the typed name, a node that stopped answering, and unload. The nodes specs follow the new structure and keep their intent: the table, filters, grouping, pagination, bulk actions, the map, and running models with stop, logs and the loading, error and empty states. The scheduling, failover, P2P, hub and smoke specs follow the renames. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the rebuilt Swarm pages Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): add helpers for the Traffic pages Pure functions for what the pages work out from the usage ledger, the trace summary, the trace buffers and the resources reading: the shared time window, grouping, sorting and filtering of usage rows, chart series and axes that start at zero, the overview figures, per-model statistics, the state of a trace and the words for a failure, the backend operations that ran during a request, CSV export, the Prometheus metric list and scrape config, and a bounded buffer of host readings. A figure whose source cannot say is null, never zero. The trace summary call takes the window in hours, and a helper reads /metrics with its status. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild the Traffic hub: overview, usage, models, host, traces, middleware Traffic opens on an overview: five figures (requests, failed, p95, tokens in and out) and three charts, each naming its source. A second row of links reaches Usage, Models, GPU and host, Traces, Middleware and Prometheus, and one time window is shared by the first three. Usage groups by model, user or API key, filters, sorts, opens a row on its own chart, exports the rows it holds as CSV or JSON in the browser, and keeps the opt-in cost estimate and the quota forecast. A user who is not an admin sees only their own numbers. Models joins the ledger, the backend-operation buffer and the loaded models. GPU and host shows the current reading and two charts of readings taken since the page opened. Traces gets filters, a settings strip and an explained off state. An API request is a page: the error LocalAI recorded, a timeline with the backend operations that ran meanwhile, and bodies that stay closed until revealed. Middleware draws the pipeline as five steps and shows the rules of the selected step. Prometheus documents /metrics, checks it against the server and gives a scrape config to copy. Alerts is not built: LocalAI has no alert rules. Per-model latency percentiles, GPU utilisation and compare with the previous period are not drawn because the API does not return them. Legacy usage, trace and middleware styles and the usage source components are removed. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Traffic hub New specs for the overview (figures, charts with a data table and arrow key readout, failed and first-run and tracing-off states, the shared window, a phone), usage (group by, filters, sort, export, cost, quotas, a non-admin, empty and loading), models, GPU and host (snapshot, the since-opened labelling, a cluster), the traces list, a trace page (the real error, the timeline, reveal, no headers, a trace that left the buffer), Prometheus and the Middleware pipeline, with shared fixtures. The usage, traces, middleware, hub and smoke specs follow the new structure and keep their intent. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the Traffic hub Add an operations page for the Traffic tab: which record each page reads, what it leaves out and why, the trace page and its reveal, the GPU and host readings kept since the page opened, and the Prometheus endpoint. Link it from the operations index, the tracing page and the middleware page. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): let metric names wrap in the Prometheus table on a phone The long metric names pushed the type and "on this server" columns out of view. Names now wrap inside the table. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Settings with groups by intent, search, a pending bar and history The fifteen sections become eight groups by intent: memory and models, speed and defaults, backends and galleries, access and security, debugging and traces, agents and responses, swarm and sharing, look and feel. Search covers names, descriptions, keys and the old section name, and says where a result used to be. Edits wait in a bar with Discard, Show diff and Apply. The diff lists old and new values and the checks the browser can make: durations parse the way Go parses them, a GPU memory budget is one the server accepts, a gallery box holds JSON, and warnings repeat what the handler and the field text say. Apply sends only the changed keys. Undo saves the previous values again; it is a new save, not a rollback. History lists the changes applied from this browser, since LocalAI keeps no settings log, and Revert stages the old value. A value is marked as changed only where the built-in default is known from the CLI defaults. A row says "Applies now" or "Needs restart" only where the handler or the docs say so. Three things were wrong before and are fixed with the rebuild: the gallery boxes and the shared API keys box were sent under names the server ignores, the "Enable CSRF Protection" switch showed the disable flag the wrong way round, and every save restarted peer-to-peer networking because every field was sent. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Users and keys, Account, sign-in, invite and the 404 page Users and keys is a tabbed page under the Settings tab: people, invites and API keys. The people table filters by state and role, sorts, approves or disables (disabling offers an undo that sets the status back), and opens a side sheet for one person's features, model allow-list and limits. Role, password reset and delete sit in the row menu; delete asks for the name. Invites choose a lifetime of 1, 7 or 30 days and show the link once. API keys can be created with a lifetime, are shown once in full, can be paused, and are revoked after a ten second undo window in which nothing is sent. LocalAI lists keys only to their owner, so the tab shows the signed-in person's own keys and says so. Account has Profile, Security, API keys and Usage. Usage shows the last 30 days, tokens by model and the limits an admin set. The Security tab now shows for a GitHub or SSO account and says the password is not theirs to change. Sign-in asks for one field per step and draws a provider button only for a provider /api/auth/status lists. It has the notice for a sign-up that waits for approval, the first-admin screen, the key-only screen and the invite page. An address outside the app now gets the 404 page too, which names the address and lists the places the sidebar lists, with the same gates. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover Settings, Users and keys, Account, sign-in and the 404 page Settings: groups, search by name, key and old section, the changed marker only where a default is known, apply hints, the pending bar and diff, the checks, apply sending only changed keys, undo as a second save, discard, history, the CSRF inversion and the gallery and API key wire forms, and the phone layout. Users and keys: the table, filters, sort, approve, disable with undo, the row menu, the access sheet, invites, key creation with a one-time reveal, the ten second revoke with undo and with a page leave, and the non-admin redirect. Account, each sign-in variant (error, pending, first admin, key-only, invite, provider buttons) and the 404 page have specs too. Fixtures are shared with the screenshot scripts. Existing specs follow the new structure. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the rebuilt Settings, Users and keys, Account and sign-in pages Runtime settings: the eight groups and where each old section went, search, the pending bar, the diff and its checks, apply, undo, the history, and which settings show a default or an apply note and why. Authentication: the sign-in screen variants, the Account tabs, key lifetimes, the one-time key reveal, the revoke undo window, and the fact that keys are listed only to their owner. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): let the Settings undo toast stand alone and read back a generated P2P token The saved message and the undo toast sat on the same spot at the bottom of the page. The undo toast now carries the saved message. A new P2P token is made by the server when the page sends 0. The page reads it back after the save so the field shows the token and not the placeholder. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): fit the users table, API keys and Account figures on a phone On a phone the users table dropped its Role and Status columns off the screen edge with the row actions. The role and state now sit under the name, so the actions stay in view. API key rows no longer put the key icon on a line of its own, and the three Account figures keep one row. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the phone users table, reduced motion and the empty Account state Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): drop the apply note from three settings the save handler does not mention Size-aware eviction, automatic backend upgrades and development backends said Applies now, but nothing in the handler or the docs says when they take effect. A row now carries a note only where the code or the docs say so. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild Voices and Faces as one identity family Voices is one page with three tabs: Speakers (voiceprints for recognising who is speaking), Speech voices (the text-to-speech reference library, kept apart because it is a different store) and From a recording (a link into the diarization workspace). Faces uses the same layout. Who is this and Same person? give the answer in a sentence with the real distance and cut-off, a word for how far inside the cut-off it sits, and a distance scale with the cut-off drawn on it. The cut-off slider re-reads the answer in the browser; the identify call sends the cut-off, and verify uses the threshold the model returns. The old confidence percentage is gone because it is not a probability. The server has no list call, so the people list stays in the browser and the page says so. After a search that asked for more people than it got back, a saved person the server did not return is marked, and people the server returned that the browser does not know are listed. Nothing is claimed from a short or cut-off search. Enrolling is a sheet: sample, name, labels, permission. A copy of the sample in the browser is opt-in, and an administrator can also keep the recording as a speech voice in the same step. Removing a person waits ten seconds behind an Undo toast and sends nothing before then. Errors say what happened (no face found, model missing, call failed), a blocked or missing microphone is explained, and a missing model or a missing permission renders a page that says what turns the feature on instead of a redirect. Analyze, detect and raw embedding move under More tools, with attribute guesses off by default. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Voices and Faces pages Specs for who is this (match, no match, working, failed, missing model), the cut-off slider, same person, a blocked, allowed and insecure microphone, the registry notes and the not-on-the-server marks, the enrol sheet and its opt-in copy, delete with undo on a fake clock, the disabled and no-permission states, the phone layout, reduced motion and Faces. Existing library and diarization specs follow the new structure and keep their intent. Node tests cover the distance words, scale layout, stored list and error mapping. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the Voices and Faces pages Add a WebUI section to the voice and face recognition pages: the two tools, the cut-off, what the people list is and why it can be stale, the undo window, and what is stored where. Point the Voice Library and Fish Audio notes at Build, Voices, Speech voices. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): rebuild the Build landing, Fine-tune, Quantize, Import and Explorer The Build landing says what each tool is for and what it needs from the machine: the installed backend, the GPU memory, RAM and disk the server reports, and a job that is running or the newest one when it failed. A tool that cannot run says why and what enables it. Fine-tune and Quantize share one page: set up, a check list that is redrawn as the form changes, a run view with progress, stages and a log, and a result with real next steps (export, import, chat, Models). The checks state only what the server reports. A job needs no estimate the server cannot make, so none is invented. Stop on a fine-tuning job asks whether to keep a checkpoint, a failed job shows the server's message, and a memory failure offers two changes that are applied to a copy of the setup. Import is a guided flow: source, review, import, done. The server returns no preview before an import starts, so the review reads the spelling of the source, prints the request the form will send and runs the checks that can be made early. The estimate that arrives when the import starts is set against free memory and disk. The ambiguity picker and the Write YAML tab stay. Explorer shows what GET /networks returns and lists a swarm with POST /network/add, with a join sheet that carries the token and commands. Build tools the account may not use say so instead of redirecting. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the Build landing, the tool pages, Import and Explorer Specs for the landing (a tool ready, missing a backend, with no GPU, a running or failed job, a feature switched off, a member without admin, phone, reduced motion), the shared tool pattern for Fine-tune and Quantize (set up, live checks, start request, running with progress, chart and log, the stop choice, failure with the server message, finish with next steps, earlier jobs, the account-disabled page, phone), Import (source detection, review, checks, ambiguity, running with the estimate against free memory, done, Write YAML, phone) and Explorer (list, join, list a swarm, empty, not an explorer, retry, phone). Existing specs follow the new structure and keep their intent. Node tests cover the machine facts, tool status, checks, log lines, source detection, the import request and the join commands. Assisted-by: Claude Code:claude-sonnet-5-5 * docs: describe the Build tool pages, the import flow and the Explorer Fine-tuning and quantization now describe the set up, check, run and result steps and what the check list can and cannot say. The import section explains the review step and why the size and memory appear only after the import starts. The distributed page describes the Explorer list, the join sheet and what listing a swarm publishes. Assisted-by: Claude Code:claude-sonnet-5-5 * feat(ui): turn the hardware recommendations into a "Best for this machine" shelf The shelf in the Models inspector put five columns into a 400 px pane, so long model ids wrapped letter by letter underneath the size and the memory figures. Each row now stacks the tag, the id and the size and memory facts beside one Install button, and the id wraps inside its own column. Once a model is installed the shelf narrows to the best fit and keeps the others behind a "N more that fit" toggle. Specs cover the ranking, the layout, the narrowing and the install request against a gallery fixture that carries the 4K estimate the shelf sizes against. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): quiet the Studio tab markers and say their state in words The type tabs drew a saturated green dot for every modality that has a model. The dot now uses a text colour, filled when a model is installed and hollow when none is, and each tab carries "(model installed)" or "(no model installed)" as hidden text so the state is not only a colour. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): stack the model editor empty state and drop its section hues "No fields configured" sat in a flex row, so the icon, the title and the text ran together. It now uses the stacked empty-state layout. The section icons took a different status colour each (amber, red, green); they now share one quiet colour, with the accent on the current section. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): keep the Home memory sentence whole on a phone and drop side rails On a 390 px screen the memory strip clipped "2 models loaded" to make room for the figure. The sentence now takes the first line and the figure and device wrap under it. The sweep also removed coloured left rails from the editor section rail, the skill editor list, the install strip and the audio transform notice (now an outlined note), plus unused chat rules that carried rails and two glow animations that nothing referenced. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): line up hub pages, list the model templates, and stop clipped text Medium-width pages inside Build and Operate were centred while the tab bar above them was flush left, so the title started 60 px right of the first tab. They now start at the bar's edge. Add Model offered nine templates as a grid of identical cards with chip clouds and inline styles. It is now one list of rows, each with the field names it fills in on a single muted line. Two clipped strings are fixed: the Studio voice field cut its placeholder mid-word, and the phone job list ended the schedule line in an ellipsis. The recommendation shelf also separates size and memory with a dot, and the docs describe the shelf. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): keep the hidden Studio tab state inside its tab The hidden state text added to each type tab was absolutely positioned against the page, so on a phone it sat outside the scrolling tab row and widened the page by hundreds of pixels. The tab is now the containing block. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): cover the on-disk sizes on the Installed table, model page and cleanup sheet The fixtures stub GET /api/models/storage. The default report is empty, so existing specs keep the gallery estimates. makeStorage() builds a report from files and the models that use them, the way the server does, and storageSpec() is a models directory with shared and missing files. New specs cover the Size column and its shared line, the fallback when the call fails or the user is not an admin, the files list on the model page, a missing file, the bytes a removal frees with shared files, and the cleanup findings. Node tests cover the storage helpers and the batch arithmetic. Assisted-by: Claude Code:claude-sonnet-5-5 * test(ui): wait for the page before pressing keys and ticking the clock Two specs failed in loaded full runs and passed alone. The Alt+1 to Alt+7 spec pressed a key before the composer had armed its key handler. The capacity chart spec advanced the fake clock before the poller had mounted, so it counted fewer readings than it expected. Both now wait for the page to mount. The key spec retries a press that lands during a re-render, and the clock spec advances in small steps and polls for the row count. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): hide the Installed footer when the storage report is empty An empty report from the storage call made the footer read "0.0 GB on disk" next to sizes taken from the gallery estimate. An empty report says nothing about the disk, so the footer now shows only the model count. A spec covers it. Assisted-by: Claude Code:claude-sonnet-5-5 * fix(ui): keep Explore pane actions inside the pane The inspector actions sat in a non-wrapping flex row beside the title, so the buttons ran past the pane edge once it got narrow. The row now takes its own line and wraps. The primary action (Install, Retry, Open) comes first. Manage installation becomes a ghost button, and Open details moves to the end of the row, so one action stands out and the others are quiet. No action or test id is removed. Add a spec that checks, in light and dark at several widths and with a pane forced to 320 px, that every action stays inside the pane box and that the pane keeps its inner padding. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * refactor(ui): drop the type chips from the Studio composer The Studio tabs and the composer's type chips listed the same seven modes, so the page said the same thing twice. Keep the tabs as the one place to switch modes. The composer now shows the type it will open as a small label in its header. The type suggestion from the typed words stays as the quiet hint line under the prompt, and Alt+1 to Alt+7 still pick a type. The composer root carries data-type, data-types and data-missing so tests can read the state. Specs pick a type through a shared Alt+digit helper and read a missing model from the tab dot instead of a chip. Remove the unused chip locale strings and CSS. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * refactor(ui): remove the section crumb above page titles Page headers drew a small uppercase crumb with a short rule before it above the title. On the hub pages it repeated the hub name, so Build sat above a heading that also said Build. PageHeader now renders only the title, the supporting line and the actions. Drop the eyebrow prop, the route-derived section name, its CSS and the unused section helper, and remove the explicit eyebrow props from the pages that passed one. Pages stay reachable through the sidebar and the hub tab bar. Add a spec that checks several pages show their title with nothing ahead of it in the header. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * refactor(ui): remove left accent rails from tiles, rows and quotes Several surfaces marked state with a coloured strip on the left edge. Replace each one with a cue that is not a rail: - Stat cards lose the strip; the icon and value still carry the colour. - The highlighted card is a raised surface with a firmer edge. - The selected rail row is an accent wash with a hairline outline. - The status stripe on rail items is a small status dot. - The active failover row is a tinted row. - Quotes in markdown and chat prose are italic instead of barred. - The variant detail panel has a full hairline border. Add a spec that walks the main routes in light and dark and fails on a left border thicker than 1px, a sideways inset shadow, a narrow absolute strip in ::before or ::after, or a narrow tall child pinned to a left edge. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-08 22:03:07 +02:00
mudler-agentandEttore Di Giacinto	690f3994b0	feat(auth): let users pause and resume their API keys (#12521) ... A key can now be paused until the owner resumes it, or until a given time. A paused key is rejected by validation before last_used is updated, and a pause time that has passed lifts the pause by itself. Existing keys stay active. PATCH /api/auth/api-keys/:id takes {"disabled": bool, "paused_until": RFC 3339 string or null}. Only the key owner can change it, and a paused_until in the past is rejected. The key list returns the pause fields. The Account page gets a Pause and Resume button for each key and a Paused badge that shows the resume time. Assisted-by: Claude Code:claude-sonnet-5-5 Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-10-06 18:25:21 +02:00
Leoy	aeac5e86dc	fix(auth): bypass API-key auth for CORS preflight (OPTIONS) requests (#11113) ... * fix(auth): bypass API-key auth for CORS preflight (OPTIONS) requests When API-key auth is enabled, a browser making a cross-origin API call first sends an OPTIONS CORS preflight, which cannot carry credentials by HTTP spec. The auth middleware is registered (app.go:324) before the CORS middleware (app.go:337-347), so the preflight hit auth first and returned 401 before the CORS middleware could answer it, blocking the actual call. Bypass auth for OPTIONS so the request reaches the CORS middleware, which answers the preflight with 200 + headers. Real API requests (GET/POST/etc.) still require auth. Regression test added (red on master, green on branch). Refs #4576 Signed-off-by: supermario_leo <leo.stack@outlook.com> * fix(auth): exempt CORS preflights via publicRouteRegistry instead of middleware bypass Route the global OPTIONS exemption through publicRouteRegistry (OPTIONS on every path, replacing the OPTIONS-under-/api/auth/ rule it subsumes) instead of a hardcoded method check inside Middleware, so "which requests skip auth" has one mechanism. Preflights now flow through the same authenticate-then-public-rules path as other public routes, which also lets a credentialed OPTIONS request keep its user context. Update the route-coverage allowlist and the near-prefix lookalike table for the new semantics (OPTIONS is public on every path by design; near-prefix privacy stays pinned by the non-OPTIONS entries), and fix the authentication docs' exempt-route enumeration, which still described OPTIONS as an /api/auth/-only exemption. Signed-off-by: supermario_leo <leo.stack@outlook.com> --------- Signed-off-by: supermario_leo <leo.stack@outlook.com>	2026-09-11 17:57:09 +02:00
mudler's LocalAI [bot]andEttore Di Giacinto	0ab632b6bd	fix(auth): protect HTTP routes by default (#11602) ... * fix(auth): default to protected HTTP routes Use a method-aware registry for the small anonymous bootstrap surface. Unknown routes now require credentials instead of inheriting fail-open path classification. Keep node self-service routes behind their registration-token middleware. Global auth no longer rejects valid worker credentials first. Assisted-by: Codex:gpt-5 * docs(auth): document public HTTP surface Assisted-by: Codex:gpt-5 * test(auth): align route coverage with default denial Assisted-by: Codex:gpt-5 --------- Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-08-19 20:49:19 +02:00
mudler's LocalAI [bot]andEttore Di Giacinto	0aaff91ebd	feat(ui): unify model and backend lifecycle (#11548) ... * feat(ui): add installed model lifecycle Models now owns catalog exploration and installed runtime controls under one canonical route. URL-owned state keeps lifecycle context recoverable through links and browser history. Assisted-by: Codex:gpt-5 Playwright * feat(ui): add installed backend lifecycle Backends split discovery from backend-binary management. The canonical page now keeps both lifecycle views under one URL-backed shell while it preserves target-node placement. Assisted-by: Codex:gpt-5 Playwright * fix(ui): repair lifecycle state updates Installed models lost distributed refreshes and kept a deleted selection. Backend searches also stopped tracking URL changes, while batch upgrades stopped after their first error. Preserve background refreshes and finish each requested batch action. Drive catalog results from URL-backed state without losing full metadata. Assisted-by: Codex:gpt-5 [Playwright] * feat(ui): make resource pages canonical Replace Host navigation with canonical Models and Backends lifecycle routes, preserve legacy management URLs, and surface shared host capacity on the Operate overview. Assisted-by: Codex:gpt-5 [Playwright] * feat(ui): complete canonical resource lifecycle Finish the responsive list-to-detail behavior, remove the retired Host implementation, and keep Explore focused on discovery while Installed owns destructive actions. Update regression coverage, localization, documentation, and development binding for the canonical resource pages. Assisted-by: Codex:gpt-5 [Playwright] * docs(ui): record the UI design context Record the approved users, brand character, and design principles so future interface work uses the same product direction. Index the context from the repository's agent instructions. Assisted-by: Codex:gpt-5 --------- Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-08-16 11:57:31 +02:00
localai-org-maint-botandlocalai-org-maint-bot	fd4ec083b9	feat(downloads): add resume-safe pause action (#11222) ... Give gallery operations distinct pause and cancel paths. Pause preserves partial download data so reinstalling the same model or backend resumes through HTTP Range, while cancel keeps its destructive semantics. Surface the action in the Activity UI and document the API behavior. Assisted-by: Codex:gpt-5 Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>	2026-08-03 15:25:23 +02:00
mudler's LocalAI [bot]andEttore Di Giacinto	58ea2f5d79	feat(ui): give Operate and Studio a front door, and fix two layout regressions (#11305) ... * feat(ui): give Operate a front door and fold six rail groups into four Opening Operate ran firstVisiblePath() and landed on Backends, because Backends happens to be written first in operateConsole.groups. The section that should answer "is anything wrong" opened on a package manager, and nothing was reported until you visited it. Adds /app/operate. Its one irreplaceable block is "Needs attention", which is empty when nothing is wrong and says so in a line rather than rendering a reassuring green panel. It collects stale backends, failed operations and unhealthy nodes. Everything else on the page is a summary you could already assemble by visiting four others. The rail regroups from six headings to four: Inference and Activity were both "the runtime right now", Access and System were both administration. No destination is removed and no gate changes, so isConsoleItemVisible and consolePaths are untouched. Overview leads the first group, which is what makes firstVisiblePath() return it without knowing it exists. Rail entries now carry a signal beside the label. This does not replace the sidebar badge and is not built as if it does: the badge stays on the always-visible sidebar entry for the reason recorded in Sidebar.jsx, that the rail exists only on Operate routes and can be collapsed. The signals are orientation while inside Operate, so they are aria-hidden and nothing urgent depends on them alone. OperateSummaryContext polls once for the whole console, following OperationsContext, which exists because per-consumer setInterval against one endpoint was the defect it fixed. It is mounted by ConsoleLayout for the Operate console only, so "poll only while in Operate" needs no route check. Built on usePolling, so it pauses on a hidden tab. Operations are read from OperationsContext rather than polled a second time, and each source degrades to no-signal on its own so one dead endpoint cannot blank the rest. It reads the cached GET /api/backends/upgrades and never the POST that forces a real registry check. Traces and Usage get no signal yet: /api/traces returns the list, so a count would mean fetching every trace to render one number. A counts endpoint is the honest fix and is scoped separately. Full e2e suite green (369 passed, 4 skipped), including a render-smoke entry for the new route. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): open Studio on what this machine can actually make Studio was a tab strip over six generators that opened on Images, which was never a decision, only the first entry in BASE_TABS. Nothing said which modalities this installation could run, so the way to learn that video had no model was to pick the tab and find an empty select. Adds an overview tab and makes it the fallback. Explicit tabs still win, so existing deep links keep working; anything unrecognised or gated now lands on the overview rather than Images. Each tab carries a dot: filled when an installed model advertises that modality, hollow when nothing serves it. That is the feature in one detail, turning the strip from navigation into a report of what the machine can do before anything is clicked. The dot is aria-hidden because the overview states the same facts in words and the dots change as models load. Two kinds of unavailable, which had to stop looking alike: - switched off, via a permission: no tab and no lane, unchanged - available with no model: a lane, and a route to installing one Studio now owns one MODALITIES table so the tab strip and the overview cannot disagree about what exists, and calls useModels() once, unfiltered, grouping in the browser. useModels(capability) fetches the whole list and filters locally, so a hook per modality would have been six identical requests to /api/models/capabilities on every mount. There is a test for that. Recent outputs read every localStorage store through a new readAllMediaHistory(), which avoids mounting five hooks that carry save timers the overview has no use for. 3D is read separately through use3DHistory rather than folded in: its entries are GLB blobs in IndexedDB, so they cannot come from the same synchronous read. Typical cost is the median of this machine's own history, not a guess, and renders as a dash when there is nothing to go on. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * fix(ui): stop the stat cards and the console rail breaking on small screens Two unrelated causes behind one report that /app/manage looks wrong when the window is narrow. The stat cards were being laid out by the wrong rule at every width. Two different components both claimed `.stat-grid`: the dashboard card strip that holds .stat-card children, and the detail-pane StatGrid the split views introduced further down App.css. Being later, the second won every shared property, so the cards got its 120px columns and its 1px hairline gap in place of their own 180px columns and spacing-md. Four cards were packed onto a row that fits two, labels wrapped to three lines and clipped, and the icon crowded the value. Renamed the strip to `.stat-cards`, after the children it actually holds, which also removes the mismatch of a `.stat-grid` container full of `.stat-card`s. The split-view component keeps `.stat-grid` and its BEM parts. The expanded console rail had no bounded height. Thirteen destinations stacked in one column is taller than a phone, so opening the menu pushed the page's own heading past the fold: the menu replaced the page rather than annotating it. Capped at 55vh with internal scrolling below 768px, so the content behind stays reachable. Both are asserted on behaviour rather than markup: no stat-card label may be clipped, the card gap must not be the detail pane's hairline, and expanding the rail must leave the page heading on screen. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): retemper the palette to localai.io and add the lane primitive The token half of the style transfer, plus the shared list idiom the two overviews had each grown their own copy of. theme.css moves from Nord to the website's palette, variable names preserved so every consumer moves with it: ground #13171f -> #0d1117, accent frost cyan #88c0d0 -> action blue #4f8cff, success sage -> mint #56d6a4, warning -> the amber #f1b95d the site spends only on the thing asking for a decision. Eyebrows go mint. Dividers become an opaque #29384a hairline rather than alpha over a varying surface, which is what makes stacked surfaces read crisply on the site. Light is derived, not inverted. The site ships one theme and never had to answer this, but the app does: blue darkens to #2f62d8, mint to #0d8b60 and amber to #8a5d0b, all clearing 4.5:1 on a cool paper ground, where the dark-mode values sit near 2:1. Same three roles, different values. Three files restate the palette because CSS variables cannot reach them: cmTheme.js (the whole CodeMirror theme), VoiceVisualizer and WaveformPlayer (canvas). Left alone they would have quietly kept the app half-Nord. The `.lane` primitive replaces the near-identical row CSS that OperateOverview and StudioOverview had each written: a full-bleed row on a hairline that insets on hover, with no card and no shadow. Callers supply only the column template. Both pages now use it, along with `.lane-head` for section rhythm and a `.page-pad` container for top-level pages outside a console shell — without which Studio sat flush against the sidebar with its eyebrow clipped. Studio's tab strip wraps rather than running off the edge at narrow widths. Full e2e suite: 386 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): put Home's resident models on lanes and give the footer one line Home's status line was three chips saying a thing was true. It now reports figures: how many models are resident, how many nodes are healthy, what share of memory is in use, set in tabular monospace so the digits line up. A chip answers whether; a figure answers how much, which is what someone opening the page at a glance is after. Resident models move from status chips to lanes, with the id set in a new `.lane__name--id` because an id is something you might type or paste and the UI face makes it read as a label. /api/system-information carries only the id, so there is deliberately no backend or memory column: inventing one would mean a server change this does not make. The footer was three centred rows and cost the bottom sixth of every page for chrome. It is one line now, version left and links right, wrapping to centred when the viewport is too narrow to hold both. Every link it had, it keeps. Full e2e suite: 392 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * fix(ui): correct three contrast failures and stop a guaranteed-404 poll A contrast audit of the new palette found three values below WCAG AA, one of which the previous commit message claimed was fine: - White on the #4f8cff button is 3.22:1, which is large-text only. The website does exactly this, but a button label in an app is not large text, so the label goes to dark ink at 5.88:1. Light mode keeps white, which is 5.44:1 on its darker blue. - Light-mode success was 4.08:1 on paper, not the 4.5 claimed. Darkened to #0a734f, 5.56:1. - Nord red was already 4.28:1 on raised surfaces, a pre-existing miss carried over unexamined. Lifted to #c96f78, 5.02:1. Lanes gain the two states they were missing: a 44px target on coarse pointers, matching what EntityRail already does so the two list idioms feel the same under a thumb, and a reduced-motion variant that keeps the background feedback while dropping the hover inset, which is a position change. The Operate summary no longer asks for /api/nodes on a single-node install. The cluster API answers 503 when distributed mode is off, so it was a guaranteed miss every fifteen seconds; it is now gated on useDistributedMode, the same condition the rail already uses for the Nodes entry. Full e2e suite: 392 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * fix(ui): restore the gap between overview blocks, and stop claiming zero nodes Two defects a design review surfaced. `.lane-head:first-child { margin-top: 0 }` was meant to stop the first block on a page carrying a top margin. But every <section> makes its lane-head a first child, so the reset applied to all of them and the gap between blocks vanished: "Sections" sat flush against the attention row above it. The header supplies its own bottom margin, so a uniform top margin is correct everywhere. The Cluster summary read "0 nodes" on a single-node install, which looks like a fault when the cluster API is simply switched off. It now says "Single node". Full e2e suite: 392 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): open dark by default, and stop clipping the collapsed sidebar footer Dark is the identity rather than a preference: localai.io ships one theme and it is this one, so an install should look like LocalAI before anyone has chosen anything. The OS setting no longer selects light on first load. The toggle still does, and a stored choice wins forever after, which the tests assert both ways. The collapsed sidebar footer stacked its controls but kept the expanded row's inline padding, so their edges were clipped against the 51px rail. Full e2e suite: 394 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(api): count traces server-side and give the Operate overview real totals The overview's headline block had no source. /api/traces returns the trace list, so "37 errors in 24h" meant fetching every buffered exchange to count it in the browser — waste that grows with the buffer, to produce three integers. Adds GET /api/traces/summary: totals, failures, p95 and a bucketed series for sparklines, over a window that defaults to 24 hours and is capped at a week. Deliberate calls, each with a spec: - A 4xx is the caller getting it wrong, not the installation being unhealthy, so only 5xx and transport errors count as failures. - p95 is a nearest-rank percentile rather than the slowest request, which is what a max would report and what makes latency panels lie. - Buckets are oldest-first so a sparkline reads left to right, and the slice is never nil: nil serialises as null and breaks .map() on the other side, which is a silent runtime error rather than an empty chart. - Exchanges outside the window are not counted at all. The route is registered before /api/traces/:id so "summary" is not captured as a trace ID. On the client, Traces and Usage gain the rail signals they were shipped without, the Observability section summary now states counts instead of listing its destinations, and an installation that has served nothing says so rather than showing three zeroes dressed as telemetry. Sparkline is a bare stroke with an emphasised endpoint and no axes: the figure above it already states the value, so its only job is the shape. Go: 185 middleware specs pass. Full e2e suite: 396 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * fix(ui): stop the memory chart calling a trade-off an error The VRAM-by-context chart rendered any build over the limit in error red, and escalated the verdict to the error tone as soon as two context sizes crossed it. But an over-limit build still installs — #11288 keeps a test on exactly that — so red overstates what is happening. A model that fits at 32k and not 64k is a trade-off, not a fault. Over-limit bars and the limit line now use the warning tone, which is the constraint colour used everywhere else in this branch: know what you are doing, not you may not. The error tone is reserved for "fits nowhere", where the model genuinely cannot run on this host. Full e2e suite: 397 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): give the new surfaces orchestrated motion Uses the reveal system already in the codebase rather than adding a library: pageReveal, .reveal-stagger and staggerStyle() were built for exactly this, and anime.js would be ~17KB duplicating four lines of CSS for list reveals. The overview's headline figures, attention rows and section lanes stagger in, as do Studio's modality lanes and recent outputs, so a page assembles in the order it is read instead of appearing all at once. Two additions beyond stagger. Rail signals transition on opacity when a poll lands, so a number changing reads as an update rather than a jump cut, and it stays on the compositor so it cannot reflow the rail. The attention block animates its left edge in — the one thing on the page that should announce itself, and on the border rather than the text so nothing moves under a reader. Both are dropped entirely under prefers-reduced-motion, alongside the lane hover inset already handled. Full e2e suite: 397 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): put the generators on a hairline field stack and record the request The workbench treatment from the mocks, applied where it costs least: both changes land on shared surfaces, so all six generators get them at once rather than drifting apart page by page. The control column stops being a shadowed card of boxed groups and becomes a hairline field stack — the panel is the page's left half, not an object floating on it — with uppercase micro-labels matching the eyebrow treatment used elsewhere. Because .media-controls is shared, Images, Video, 3D, Speech, Sound and Audio FX all move together. RequestPanel shows the request the form actually built, with a copy-as-curl. LocalAI is API-first and Studio is the best place in the app to teach its own endpoints: the form stops being a black box, and a result worth keeping can be reproduced from a shell without reverse-engineering which fields the page sent. It records what was sent rather than what the form currently holds, and renders nothing until a request has been made — a panel describing a request nobody made is a tutorial, not a record. Wired into Images and Speech. Full e2e suite: 401 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): make Chat a transcript instead of a bubble thread Rounded, filled, asymmetric bubbles fight a system built on hairlines, and they carry the speaker in shape and side rather than in words. The assistant side had already given up its bubble; this finishes the job. Both roles now run full width down one column, separated by a rule, each with a mono role label. The user turn keeps a left edge in the action tone so the two are still told apart at a glance, without a fill or a corner radius. The avatars go: the accent and the label carry the speaker, so the glyph was decoration once neither side had a bubble. Saying who is speaking in words rather than in geometry is also what survives being read aloud, printed, or looked at by someone who cannot pick the sides apart by colour. Full e2e suite: 404 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * feat(ui): dress the API reference in LocalAI's palette The Swagger page was the last surface still shipping in someone else's colours, which is conspicuous now that everything it links from is dark. Swagger UI has no theming hook, so rather than fork it we serve our own index ahead of the library's wildcard and restate the palette over its stylesheet. The library's own bundle and assets are still what load, so a swagger-ui upgrade cannot silently break the page — this is a skin, not a fork. Two things needed real care. Swagger tints the entire operation row per method via .opblock.opblock-post and friends, so the palette had to match that specificity rather than reach for !important; the method now lives on one edge instead of washing across the row, because a page where every row is a status colour has no status colour left. And the filled method chip put white on pale green, which was the least readable thing on the page — it is an outlined mono chip now, carrying the method in its border and text. Palette values are copied from theme.css rather than referenced: this page is served by Go and never sees the app's CSS. The comment says so, and says to keep them in step. Go: routes and middleware suites pass. Full e2e suite: 405 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] * fix(ui): make tall split-view pages reachable, repair the Agents header, scale titles Three things found by actually using the app rather than measuring it. **Host was unusable.** The shell above a split view is overflow:hidden so the document cannot grow, which left anything taller than the viewport simply unreachable — and Host stacks a resources card, four stat cards and a tab bar above its split, so the bottom of the pane fell off at every window height with nothing to scroll. Every sweep I ran for this was horizontal, which is why it kept coming back clean. The page now scrolls inside the pinned shell. The pane keeps its own scroller: letting it grow instead pushes the document taller and stretches the rail to match, which is the regression e2e/discover-height.spec.js exists to catch, and which the first version of this fix duly caused. **The Agents header controls were unstyled** — "Create Agent" was rendering with the browser's default chrome. The markup had been mangled at some point: six unrelated classes merged into one string on the link, and the label and button left with none at all and empty icons. Repaired, with the inline flex replaced by a shared .header-actions class. **Page titles take the editorial scale from the site**: larger, tracked at -0.04em, on a line height near 1, so a two-word title reads as a statement rather than a label. The typeface is unchanged — DESIGN.md keeps the existing type system — so the whole difference is scale, tracking and leading, which is where the site gets its voice from. This was the biggest reason the running app still did not look like the mocks. Full e2e suite: 404 passed, 4 skipped. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude Code:claude-opus-5[1m] [Read] [Edit] [Bash] --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-08-03 00:16:08 +02:00
mudler's LocalAI [bot]andEttore Di Giacinto	74b7ea2829	feat(ui): replace the gallery and inventory tables with a rail and a detail pane (#11288) ... * feat(ui): rename the Install Models nav entry to Discover "Install Models" named the action rather than the destination, and it was the only multi-word entry in a rail of one-word ones (Home, Chat, Studio, Talk, Build, Operate). A bare "Models" was the obvious fix but it collides with the installed-models view under Host, which is a different page for a different job. "Discover" keeps the rhythm and says what the page is for. The icon moves from a download arrow to a compass for the same reason: the page is browsed before it is installed from. Translated in all seven locales rather than left to fall back, so a locale switch does not leave the entry in English. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * feat(ui): replace the gallery table with a rail and a detail pane The eight-column table was not the real problem; the click-to-expand row underneath it was. Variants, files and a VRAM estimate never fitted inside a <tr>, so they were pushed into a drawer that could hold one model at a time, could not be linked to, and had no room to say anything useful. The gallery is now a rail to scan and a pane that answers. The pane has two states and no third: with nothing selected it is the discovery page, and with a model selected it is that model's detail. Selection lives in the URL, so a model is linkable and Back steps out of the detail instead of off the page. The rail groups by capability while browsing and flattens to results the moment a term is typed. That is a rule rather than a toggle: once someone has said what they are looking for, the buckets are between them and the answer, and making the user choose would be handing them our problem. The detail pane plots VRAM against context length with the host's own limit drawn across it. This is new information, not a restyle. A single number invites "so will it run?", and the honest answer is usually "yes, up to a 32k context", which is a shape rather than a number. The estimates were already fetched for every context size, so it costs no new request. Backends that take no context length say so instead of being given a meaningless chart, and a host with no GPU gets no chart at all rather than bars with nothing to compare against. The split-button variant menu goes with the actions column. The pane lists every build with its backend, quantization, size, fit and a details disclosure, each installable, which is what the dropdown was a cramped substitute for. Its tests move onto that list; the three contracts it alone carried (fetch-once caching, the loading state, an unfit build staying installable) are backfilled against the pane. RecommendedModels moves inside the pane, where it has the width to argue for a model instead of listing one, and keeps its own dismissal and collapse. Rail entries carry no description. Two lines is the budget and the second is better spent on whether the thing will run; the stripped-Markdown contract moves to the pane's lede, tooltip included. e2e: 123 passing across models-gallery, navigation, recommended-panel, model-artifact-operation, operations-strip and page-render-smoke. Inline styles in Models.jsx drop from 82 to 41. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * refactor(ui): extract the split view into shared components Discover shipped its rail, pane and detail header as private functions inside Models.jsx. Backends and Host have the same defect and want the same shape, so leaving them there guarantees three rails that drift. SplitView, EntityRail, DetailHeader and StatGrid now live under components/split/. EntityRail is deliberately data-driven: a surface maps its own entity onto { id, name, icon, meta, stripe, groupId } and keeps its vocabulary to itself, which is what stops the rail learning about models, backends and loaded state all at once. The CSS moves with it. What was .discover__rail is .entity-rail, .discover__ pane is .split-view__pane and so on, because a class named after one page is a lie on the next two. Only what is genuinely Discover's stays behind the old prefix: the shelves, the hero and the VRAM-by-context chart. Two additions the shared rail needs and Discover did not: a state stripe, for surfaces read by condition before they are read by name, and an empty label. Discover passes neither. No behaviour change. e2e 100 passing across models-gallery, navigation and models-recommended-panel. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * feat(ui): put the backend gallery on the split view Same defect as the model gallery, so the same shape: a seven-column table over a click-to-expand row that was the only place the repository, licence, tags and links could go. The rail groups backends by the use case they serve, sharing Discover's taxonomy on purpose: a backend is the runtime a use case needs, so "vision" ought to mean the same thing one level down. It flattens on a query for the same reason it does on Discover. The zero state is the one real departure. A backend's fitness is not free memory, it is the accelerator and platform it was built for, so the pane leads with what this host is, then what is not installed yet, then whether anything installed has gone stale. The table listed 37 runtimes and left "which of these can even run here" entirely to the reader. Distribution moves into the pane, which is the one thing a row could never carry: which nodes hold a copy and which do not, with the install-on-more control next to it rather than squeezed against a chip. The distributed and target-node action logic is unchanged, including the guard that keeps a hardware-specific build off the fan-out path. The split-button popover loses its per-row anchoring because there are no rows; one pane, one anchor. Selection lives in ?backend=, preserving the ?target= scope rather than clobbering it. e2e: 139 passing across models-gallery, navigation, backends-management, models-recommended-panel, nodes-per-node-backend-actions, page-render-smoke, operations-strip and model-artifact-operation. The backends spec gains six split-view tests; its three description-cell tests move onto the pane lede. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * feat(ui): put the Host inventory on the split view The last of the three surfaces, and the one that is not a catalog. Both tabs had the same click-to-expand row, so the shell transfers; what does not transfer is the zero state, because there is nothing to discover in your own inventory. With nothing selected the pane reports what is happening: how many models are loaded, what failed, what has an update, and which models are holding VRAM right now. Every number was already on the page. None of them had been assembled into one statement, so "what is going on" was a question the tabs could not answer however long you looked at them. The rail buckets by state rather than capability - Running, Idle, Disabled for models; Update available, Installed for backends - which is the opposite of the galleries and deliberately so: nobody opens Host wondering which of their models does vision. Entries carry a state stripe for the same reason. Load and Stop are promoted out of the kebab, because that is what an operator came for; the rest stays behind the menu rather than diluting it. Adopted, pinned and alias badges follow the model into the pane: they are facts about the thing, not about its state, and the rail line is spent on state. Deliberately NOT done: folding the two tabs into one rail, as the mock had it. It costs five URL parameters, the manage-tab localStorage key and the stat-card shortcuts, all of which are live deep-links today. The tabs stay as the group selector; merging them is a follow-up with its own migration. e2e: full suite 355 passing. New host-split-view spec; alias-template, manage-logs-link, manage-action-menu-position and model-editor-back-nav move off `.table` and the row kebab onto the rail and the pane. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * polish(ui): accessibility and consistency pass over the three split views Findings from a pass over what the previous four commits actually shipped, rather than what they were supposed to. The rail was not a listbox. ARIA lets a listbox contain options and groups, and nothing else, but each group's collapse control is a button that has to sit inside the scroller with the entries it folds. It is now a labelled group of buttons, which is the honest description; selection is announced with aria-current and the arrow keys are unaffected. Every entry was its own tab stop, so tabbing past a forty-entry rail to reach the pane took forty keystrokes. Roving tabindex makes the rail one stop, and arrowing now moves focus with the selection instead of leaving it behind on an entry Tab can no longer reach. The rail rounds its corners with overflow:hidden, which was clipping the focus ring off the first and last entries entirely. Inset outlines fix it. A 30px row is fine under a mouse and too small under a thumb, so coarse pointers get a 44px target without costing density on a desktop. One slot said three different things: "9 models loaded" on Discover, "12 loaded" on Backends, "3 of 9" on Host. All three lists are a page of a larger set, so all three now say so the same way. Also removed: an emptyLabel prop on EntityRail that nothing passed, its dead CSS rule, and MODELS_COLSPAN and ResourceRowDesc, which died with the tables. e2e: full suite 355 passing. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * fix(ui): correct three defects only a real gallery exposed Running the branch against a live instance with 1,595 models and 1,017 backends, rather than against mocked fixtures, surfaced three things the e2e suite could not. Grouping did nothing. The rails matched on the use-case keys the filter chips send (`chat`, `tts`, `transcript`), but those are a server-side vocabulary the handler maps onto entries. What entries actually carry is free-form and inconsistent: models come back tagged `llm`, `gguf`, `vision`, `coding`, and backends `LLM`, `text-to-text`, `audio-transcription`. Nothing matched, so every model landed in "Everything else" and the feature was decorative. Grouping now lives in utils/entityGroups.js, shared by both galleries, matching case-insensitively against the vocabulary the API really uses, with the entry's backend as a fallback signal - a backend named `whisper` is a speech backend whatever its tags say. Order is specific before general and that is load-bearing: a vision model is tagged `llm` too, so testing text first would swallow it. The zero state claimed GPU memory on a machine with no GPU. The resources endpoint reports system RAM in the same field when gpu_count is 0, so the hero read "84.4 GB of GPU memory" next to the recommendations panel correctly saying "No GPU detected". The number was never wrong, only its label; it now says system memory unless a GPU is actually present. The page title still said "Install Models" under a nav entry saying Discover. Also: the keyboard test named the model it expected to arrive at, which made it a hostage of the grouping table and broke the moment the buckets were fixed. It now asserts that the selection moves and returns. e2e: full suite 355 passing. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * fix(ui): the filters and the rail were fighting over the same job Four things you find odd on Discover, and they turn out to be one mistake seen from four sides. The rail grouped the current page. The listing is paginated at nine rows, so those bucket headers described nine entries out of 1,595, and turning a page reshuffled the sections under the reader. The structure was never stable because it was computed over the wrong set. The chips were redundant for the same reason, seen from the other side. They send tag= and filter all 1,595 server-side. The rail grouped nine of them client-side by the same axis. Two controls for one job, and the weaker one was the one this branch added, so it goes. Grouping stays only on Host, where the list is complete, local, and bucketed by state rather than capability. The search bar felt odd because it sat in a full-width band while the thing it narrowed was a 290px rail below and to the left. The whole band now lives in the rail column: search, backend, use cases, refinements, then the list it narrows. One column to say what you want, one to show what you got. Nineteen chips do not fit at that width, so they fold into a disclosure that states the selection. A disclosure and not a popover, deliberately: picking use cases is multi-select and interleaves with the backend select and the toggles below, and a popover dismisses itself the moment you touch either. The header held two counts and two buttons at arm's length from all of it. The counts were the third statement of the same number on one screen, after the rail's "9 of 1,247" and the pane's own headline, so they go. The buttons move into the pane's zero state, which is the surface that answers "what do I do here". Also: the two first-run empty states wore .loading-center, which is display:flex in the default row direction because it exists to centre one spinner. With four children that put the icon, the heading, the sentence and the buttons on a single line with no gap. They are now a proper full-height empty state. e2e: full suite 353 passing. Grouping tests are replaced by ones asserting the rail stays flat; chip tests open the disclosure first; two filter-layout tests that asserted the old three-band arrangement now assert the column. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * polish(ui): make Discover a full-height view, group the chips, name the refinements Four things, all of them the same complaint: the page read as a document with controls scattered on it rather than as one view. The header is fused. A title block with its own padding, a subtitle and two counts made the split view look like an attachment to a document that happened to sit below it. It is now a slim bar carrying the title, the count and the two page-level actions, and the split fills the rest of the window. Rail and pane scroll independently, so the filters and the pane's headline stay put while a long list moves under them. The chips group. Nineteen in a flat row is a lot to scan even behind a disclosure, and they already belong to the four families the rest of the UI speaks, so they are bucketed by those. "All" sits on its own above them without a heading, because it is a reset rather than a use case. The refinements stop looking dumped. When the band became a column they were three controls left where they landed; they now read as a named section with one control per row. The zero state suggests again. It had decayed into a "Browsing / 9 of 1,247 / select a model" line that restated the count for the third time on one screen. It now offers the four use cases as tiles that set the filter, which is the shelf idea from the mock without inventing curation or paying for a second fetch. Two bugs found by looking at it rather than at the tests: the disclosure was clamped to 190px, which cut it off partway through its third section so two of the five never appeared at all; and the creation actions rendered twice, once in the new bar and once in the pane hero a few pixels away. e2e: full suite 353 passing. The chip-row test now holds its contract across the per-family rows rather than a single one, and additionally asserts every family is present and non-empty. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * fix(ui): pin the split view's height so a long detail scrolls the pane Selecting a model with a long description grew the whole page and dragged the rail down with it, which is the opposite of what "full height" was supposed to buy. The flex chain was right and the ceiling was missing. .app-layout and .main-content are min-height:100dvh, which is a floor: flex distributes free space but nothing caps growth, so a pane taller than the viewport expanded the column, the document scrolled, and the rail stretched to match. height:100% on the pane then resolved against an auto-height parent and did nothing. The chat route already solves this by pinning .main-content to 100dvh. The same treatment now applies to any route containing a .page--app, selected with :has() so the shell does not have to learn which pages happen to be split views. Below the stacking breakpoint the pin is lifted, because two stacked halves in two short scrollers is worse than a page that scrolls. Measured on a live instance: document height stays at the viewport across selection (950px either side) and the pane overflows internally instead. Adds discover-height.spec.js, which asserts the page height and the rail height are unchanged by selection and that the pane is the thing that scrolls. The existing specs could not have caught this: they mock short descriptions, and the bug only appears when the pane has more content than the viewport holds. e2e: full suite 355 passing. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * feat(ui): give Backends and Host the full-height view, and fix the Update button Backends now matches Discover: the header fuses into a slim bar carrying the title, the count and the page-level actions, the filters move into the rail column where they narrow the rail and nothing else, and the split fills the window. Its seven chips fit at rail width, so unlike Discover's nineteen they need no disclosure. Host gets the bar and the height; its resource monitor, summary cards and tabs stay above the split, because those are read once while the rail and the pane are worked in. Two things the height change surfaced. The console layout is a flex row with align-items:flex-start, so its body sizes to content. Right for the pages it was built for, wrong for a split view, which needs a ceiling to scroll inside: without it the Backends rail ran past the viewport and over the footer. Pinned with :has() so only split-view routes are affected. The filters vanished when nothing matched. Both galleries swapped the whole shell for an empty state, which took the search box and the chips with it, so the page said "try adjusting your search or filters" while offering neither. The shell now stays and the empty state moves into the pane. Also fixes the Update control on Host, which had no className at all and rendered as bare text, next to a status span that had picked up btn classes and two copies of `fas` and so rendered as a button you cannot press. They have swapped appearances back. e2e: full suite 355 passing. The render-smoke selector learns .view-bar__title, since the pages it checks no longer all use PageHeader. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * fix(ui): keep the view mounted while searching, and bring rail grouping back Searching replaced the whole view with a loader. The search box lives in the rail column, so every debounced refetch unmounted the field being typed into and dropped its focus with it. The list, the filters and the pane went too. The shell now stays and the rail says it is busy: a sweep bar under its header and the stale list dimmed, so the eye knows the answer is being replaced without losing its place. A cold start still gets the skeleton, because there is nothing to keep. The condition for that is "nothing has loaded yet", not "the list is empty". Those differ exactly when someone is editing a query that matched nothing, and getting it wrong there would unmount the view on the keystroke after a no-results search - the worst possible moment. Grouping comes back on both galleries. It was removed because nine rows could not fill five buckets, so a page turn rebuilt the rail's whole structure. That was a symptom of the page size rather than of grouping: the rail now asks for 30 rows instead of 9 (Backends 60 instead of 21), which is enough for the sections to read as structure and turns five times fewer pages. The order of the sections is fixed, so what changes between pages is membership, not arrangement. Grouped while browsing, flat while searching, as before: once a term is typed the buckets stand between the reader and the answer. Also gives GalleryLoader a class and a testid instead of six inline style declarations on a bare div, which is why nothing could select it. e2e: full suite 359 passing, including a new spec asserting the search box keeps its focus and its value across a refetch, and that a cold start still shows the skeleton. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * perf(gallery): stop invalidating the VRAM estimate caches on every request Searching or turning a page felt slow. It was not the search and not the listing: /api/models answers in 3-9ms. It was the VRAM estimate, which the gallery asks for once per row, and which took ~2.3s every single time however often the same model was asked about. pkg/vram already caches what makes that expensive - the remote content-length probes, the GGUF metadata reads and the HF repo sizes. Those caches key on a gallery generation counter, and AvailableGalleryModelsCached triggered a background refresh on every call, with each refresh bumping the counter. One page view is one listing request plus thirty estimate requests, each of which re-read the gallery and started another refresh, so the generation moved constantly and every cache entry was stale before it could ever be read. The caches were dead in production. Three changes, each doing one thing: A refresh interval. The cached list is still served immediately; this only decides how often re-fetching from upstream is worth starting. Five minutes, as a package variable so tests can drive it without waiting. A generation bump only when the gallery actually changed. An unchanged gallery re-fetched on schedule must not throw away work that is still valid, which is the difference between an estimate costing nothing and costing a network round trip. A separate "loaded" flag. The cache engaged on `cached != nil`, so a gallery that legitimately holds nothing read as never-loaded and took the blocking path on every call, bumping the generation each time. Found by the test for the interval, which could not pass while this was true. Measured against a live instance with 1,595 models: one estimate, repeated 2.3s -> 2ms a page of 30, in parallel 10s -> 0.04s A first, genuinely unseen model still costs its remote probe. That is inherent; what changed is that it is now paid once per model per gallery version rather than once per request. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * perf(gallery): warm VRAM estimates at startup, and stop the UI waiting on them Two halves of the same complaint: the gallery stalls on VRAM estimation. Server side, the estimates are now warmed in the background at startup. Estimating an entry nobody has asked about costs a remote probe of its weight files, and the gallery needs one per row, so the first visitor was paying for the whole page. The warm-up walks the gallery in the order the UI lists it, so the first page is ready before anyone reaches it. It is bounded and it never blocks: 300 entries at 4 at a time by default, on its own goroutine, stopping with the server's context. Warming the whole gallery would be thousands of probes on every boot, which is rude to the upstream and slow to finish; warming nothing leaves the first page paying two seconds a row. Anything past the limit still warms itself on first view. LOCALAI_VRAM_WARM_LIMIT=0 turns it off for an air-gapped host, LOCALAI_VRAM_WARM_CONCURRENCY=1 slows it for a metered link. Client side, the page no longer waits on estimates it does not need yet. It fired one request per row at once; a browser allows about six connections per host, so thirty estimates took every slot and the request behind a click - the variant list, an install - queued behind work nobody asked for. That is the freeze: the list was already usable, and the UI was busy fetching sizes. Four at a time leaves room for the interactive request to overtake, and a row whose estimate is still in flight says "sizing…" rather than leaving a blank where a number will appear. buildEstimateInput moves to core/gallery as EstimateInput, since the handler and the warmer both need it. Measured against 1,595 models, from a cold boot: page 1, 30 estimates in parallel 10s -> 0.04s full warm-up (299 of 300 entries) 3m, in the background Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] * chore: untrack data/.local_user_id and ignore the runtime data dir `local-ai run` writes its instance state under ./data when started from the repo root, which is exactly what a contributor testing a build does. The identity file ended up committed on this branch by a `git add -A` while verifying the gallery changes against a live instance. Anchored, so it matches the runtime directory at the repo root and not a `data` directory nested inside some package. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-5 [Claude Code] --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-08-02 19:28:36 +02:00
Adiraandlocalai-org-maint-bot	ef724a3c9d	feat(api): add /v1/detokenize endpoint (#9620) ... * feat(api): add /v1/detokenize endpoint Closes #1649. Mirror of the existing /v1/tokenize path, requested by @benniekiss in the issue thread for "complete API workflow" use cases that need to turn token IDs back into text without local processing. - Add Detokenize gRPC RPC with DetokenizeRequest{tokens} / DetokenizeResponse{content} messages. - Implement in the llama.cpp backend using common_token_to_piece, the same primitive TokenizeString already uses internally. - Other backends inherit the default Unimplemented from base.Base, in line with how Detect, Rerank, etc. are gated per-backend. - Wire up the Go gRPC interface, server, client, and in-process embed wrapper alongside their TokenizeString counterparts. - Add the schema types, ModelDetokenize wrapper, HTTP handler, route registration, RouteFeatureRegistry entry (gated by FeatureTokenize so no new feature flag is needed), and the discovery map entry under ai_functions. - Regenerated swagger reflects the new endpoint and types. - Update authentication.md to list /v1/detokenize alongside /v1/tokenize. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Adira Denis Muhando <dennisadira@gmail.com> * test(e2e): add mock backend tests for /v1/detokenize Add Detokenize to the mock gRPC backend and wire up two e2e tests in the MockBackend suite: one that posts known token IDs and asserts a non-empty content response, and a round-trip that tokenizes first then detokenizes the returned IDs. Addresses reviewer feedback on #9620. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Adira Denis Muhando <dennisadira@gmail.com> * fix(kokoros): implement detokenize in the Rust backend service The Detokenize RPC added in this PR grows the tonic-generated Backend trait. Unlike the other languages there is nothing to inherit a default from — Rust trait impls must list every method — so backend/rust/kokoros failed to compile: error[E0046]: not all trait items implemented, missing: `detokenize` --> src/service.rs:72:1 72 | impl Backend for KokorosService { Go backends pick up the Unimplemented default from base.Base, and the generated C++/Python servicer bases default to UNIMPLEMENTED, which is why the Rust backend was the only one that broke. kokoros is the sole Rust crate in the tree, so this is the full extent of the fallout. Return Status::unimplemented("Not supported"), matching how this same file already gates tokenize_string and ~20 other unsupported RPCs. Fixes the tests-kokoros and backend-jobs-singlearch-4 (-cpu-kokoros) failures on the previous head. Assisted-by: Claude:claude-opus-5 cargo Signed-off-by: Adira Denis Muhando <dennisadira@gmail.com> --------- Signed-off-by: Adira Denis Muhando <dennisadira@gmail.com> Co-authored-by: localai-org-maint-bot <bot-opensource@localaisrl.com>	2026-07-30 16:01:47 +02:00
mudler's LocalAI [bot]andEttore Di Giacinto	0f7186f214	feat(ui): replace the stacked operations bar with a one-line strip and an Activity page (#11163) ... * feat(ui): record finished gallery operations in a bounded history ring The operations panel drops an operation the moment it succeeds, so a user who steps away cannot tell whether an install finished, failed or was never started. OpCache now keeps the last 50 terminal operations, recorded from the point where an op leaves the cache. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * test(ui): pin the history ring's dedupe, outcome order and start stamp Review of the history ring found four gaps. The dedupe guard and the bounded seen set were unreachable through the exported API and so had no coverage; an in-package spec file now drives opHistory directly. The outcome switch claimed an ordering was load bearing that nothing pinned, so an errored op that never reached Processed now has a spec. Two behaviour fixes come with it. StartedAt was the zero time for ops recovered from the store or replicated from a peer, since neither path stamps a start time, which would have rendered as a two-millennia duration; it now falls back to the finish time. Reusing a cache key with a fresh job ID orphaned the previous stamp, so Set and SetBackend now drop it. The comment on the outcome switch described a state the code cannot be in: CancelOperation sets Cancelled and Processed synchronously before the handler removes the entry, so status.Cancelled already covers the cancel endpoint. The !Processed clause stays for the dismiss endpoint firing on an in-flight op, and the comments now say so. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): record operations that end on a peer replica The NATS end event is the only signal a replica gets for an install another replica ran. Record from applyEnd too, deduped by job ID so the originating replica does not record its own broadcast twice. Three start-stamp defects in the same path go with it. applyEnd now drops the stamp unconditionally, since recordTerminal only cleans up on the path where it found a cache key and an end event can overtake the local Set. applyStart drops the stamp of the job whose cache key it replaces, which a peer-driven retry previously stranded. And recordTerminal reads the stamp once instead of testing Exists and then reading, so a concurrent record for the same job can no longer delete the stamp between the two and let the zero time overwrite the finish-time fallback, which the Activity page would render as a two-millennia run. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): do not guess the outcome of a peer operation with no local status A replica that restarts mid-operation hydrates its OpCache keys from PostgreSQL, but gallery statuses are in-memory only and come back empty. The end broadcast then landed on recordTerminal's nil-status branch, which reads a missing status as queued-and-removed and filed a successful install as cancelled. That reading is right locally and wrong on the peer path, where a missing status means the outcome was never held here. recordTerminal now takes the source of the terminal event and records nothing when the peer path finds no status, restoring what the replica did before the end event started recording. The local path is unchanged. Also move the ApplyEndForTest seam to the conventional export_test.go, and stop the dedupe spec from claiming to guard the ring's seen set: the local delete removes the status keys, so the broadcast that follows returns before reaching it. An in-package spec that calls recordTerminal twice does the pinning. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(api): add GET and DELETE /api/operations/history Admin gated like the rest of the operations API. The live /api/operations payload is unchanged so the one second poll stays small. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): expose operation history through OperationsContext Fetched on demand and when the live list shrinks, never on the one second poll interval. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): detect operation departure by identity and ignore committing ops in the ETA gate Refetching history on a shrinking live count missed a completion that coincided with a start, which is the common case during a batch install. Track the live job IDs instead, so any departure triggers the refetch regardless of how the count moved. An operation that has finished downloading stays live at currentBytes == totalBytes for the whole commit and install phase and can never produce an estimate, so counting it in the all-or-nothing gate blanked every other operation's time remaining for as long as it lasted. Only operations still moving bytes get a vote. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): let only downloading operations gate the time remaining estimate Verifying pins an operation flat below its total for the whole sha256 pass: the AfterDownload hook reports completedBytes plus the finished file against a total summed over every file, then hashes synchronously without emitting progress. Files download sequentially, so a 15 shard model enters that window 14 times, and a byte comparison cannot see it because the counter is genuinely below the total throughout. Gating on phase closes resolving, verifying, committing and persisting in one predicate, so a quiet neighbour no longer blanks every other operation's estimate for minutes at a time. The byte clauses stay: a producer can report downloading with bytes already at the total. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): collapse the operations bar to a single line Four concurrent installs used to take four rows above every page. The strip now shows one operation, failure first, with a counter linking to Activity. The close button hides the strip and no longer cancels an install. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): keep the operations strip from widening the page and from muting a failure A long install error made the strip report a 1600px minimum width, which sized main-content to fit and gave every page under it a horizontal scrollbar. Inline-size containment plus shrinkable detail and bytes cells keep it inside the viewport. Hiding is no longer able to swallow the hidden job's own failure, a completed removal or staging says so instead of claiming an install, a cancelling operation renders as cancelling, and the live region no longer covers the per-second percentage. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): shrink main-content instead of containing the strip, and expose progress min-width on .main-content is what actually lets a long install error shrink, and unlike inline-size containment it has no browser support floor and no latent collapse if the strip ever lands in a shrink-to-fit context. It matches what .app-layout-chat .main-content already does, and it clears pre-existing horizontal overflow on narrow viewports as a side effect. The progress track is now a labelled progressbar, so assistive tech can read the value on demand rather than losing it to the aria-hidden that stopped the live region re-announcing every poll. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): add the live operation card for the Activity page Carries the detail the one-line strip has to drop: phase, bytes, the per-node breakdown for cluster installs, and a labelled Cancel button. Cancelling is destructive, so it gets a labelled button rather than a glyph. A cancelling operation drops its progress bar and its time estimate, the same call the strip makes: a percentage still climbing under "Cancelling" reads as the cancel not having taken. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): give the operation card a verb, live node disclosure and its per-node detail The card carried no verb, so an install, a removal and a staging op rendered as spinner plus name plus kind tag and were indistinguishable. It now runs the same verb and icon chain as the one-line strip, which is what stops the page that is meant to carry more detail from carrying less. The auto-expand default was evaluated once at mount. An operation is listed as soon as it is admitted but its nodes are filled in only when the fan-out starts reporting, so a card mounted at creation latched on the empty list and stayed collapsed. The default is a live expression now, and state holds only an explicit choice. Also: an optional onRetry gates a Retry button, so the page can own the install reconstruction without the card ever showing a control with nothing behind it; the disclosure moved above the region it controls and gained aria-controls; the toggle is gated at more than one node so the count is never "1 nodes"; an unmapped node status is passed through instead of being relabelled "Queued"; error text is clamped with the full string in the title; and file_name plus the per-node progress bar are rendered again, reviving three CSS rules that had gone dead along with the detail they styled. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): add the Activity page Live operations, unacknowledged failures and the record of what finished, at /app/activity in the Operate console. Cancelling an install now lives here behind a labelled button rather than on the strip, and a failed install can be retried: the retry dismisses the failure first so it still reaches the record, then reissues the model, backend or node-scoped backend install. The sidebar Operate entry carries the operation count. The console rail is only rendered on an Operate route and can be collapsed, so a badge there could vanish while operations were still running. Two follow-ups from review fold in here: a failed removal or staging job no longer reports a failed install on either the card or the strip, and the card's error text can shrink so one unbroken token cannot widen the card. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): dismiss operations by job, and stop the Activity page contradicting itself Dismissing resolved the job by display id, but /api/operations strips the "node:<nodeID>:" prefix before emitting, so a local install and a node-scoped install of one backend arrive as two jobs sharing one id. Dismissing by id retired whichever came first. That defeated the guarantee retry was built around: with the wrong job dismissed, the reinstall overwrote the acted-on failure's opcache entry in place, bypassing recordTerminal, while an unrelated failure vanished from Needs attention. dismissFailedOp, the card's dismiss control and the strip now all pass the jobID, which is what the endpoint takes. A filter matching nothing rendered the "nothing has ever run" empty state while the header counted the records the filter had hidden. The empty state is now gated on the All chip and a narrowed view gets its own message plus a way back; the header counts the instance rather than the chip, so selecting Backends no longer reports "Nothing running" over running model installs. Also: the summary drops a zero clause instead of rendering "0 needs attention" on the happy path and pluralises both counts; a record duration is floored at "< 1s" and rejected above a day, so a zero-value start stamp cannot render a span of millennia and a zero span cannot render "installed in" with nothing after it; a deletion cancelled mid-flight reports the cancellation rather than claiming it was removed; and the retry variant comment names the fix instead of calling the gap closed. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: document the Activity page and the operations history endpoints Adds an Activity page under Operations covering the one-line operations strip, the /app/activity sections and filters, per-operation cancel, retry and dismiss, the in-memory 50-entry record, and the sidebar count. Documents GET and DELETE /api/operations/history, and fills the gap in the admin-only endpoint list, which also omitted the pre-existing POST /api/operations/:jobID/dismiss. Corrects the distributed-mode install-watching section: the per-node breakdown now lives on the Activity page rather than on the strip, which rolls a fan-out up into a single phrase. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: correct nine details in the Activity page documentation The operations strip never renders a file name: its detail line is the error, the node roll-up, the target node, the phase or the queued note. Drops the stale clause in the distributed-mode section, where the per-node bullet is now the only place a file name is described. Scopes the phase vocabulary to artifact-backed gallery models, since a plain GGUF install emits no phase. Corrects the per-node list: the toggle exists for any fan-out of two or more workers and the four-node threshold only governs whether it starts open, while the N nodes tag needs more than one node. Notes that a cancelled operation can sit in the live section reading Cancelling, that cluster staging never reaches the record, and that Clear history appears only when the record has something in it. Names the operations response envelope, with a JSON example, so callers do not index a bare array, and stops describing the icon-only dismiss control as a labelled button. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: drop the unreachable Cancelling state and scope the byte claims An operation can only report isCancelled while it is unprocessed, but every writer of Cancelled sets Processed in the same breath, on the peer path as much as the local one, and the cache evicts cancelled entries before the handler sees them. The state cannot reach the page, so the live section is described again as running or queued operations. Byte counts come from the artifact bridge alone, the same producer as the phase, so a plain GGUF install, a removal and a backend install report none. Scopes both to artifact-backed gallery models and leaves the verb, the name and the percentage as what every operation shows. A worker backend install reports its bytes through fields the operations payload does not carry, so the distributed section now describes the percentage and the node roll-up, with per-file counts pointed at the per-node detail. Also: staging jobs carry no error, so they never reach Needs attention and Retry never had a staging case to exclude; an install that involves workers is no longer called node-scoped, which this page uses for node-targeted installs; and the record timestamps carry nanoseconds. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: state only the verb and the name as unconditional on the strip The percentage is as conditional as the bytes were: it renders only for a running operation that has reported progress, so a queued operation, a failed one and a removal never carry it. A removal in particular sits at progress zero for its whole visible life, since the delete path reports none and its completion is filtered out. Both the strip and the card paragraphs now lead with what always shows and list the rest as conditions. The Cluster chip matches on a node list that finished operations do not carry, so a fan-out install leaves the chip once it reaches the record. Scoped that claim to the live sections. Two more of the same shape, found by re-reading each clause alone: the strip also appears for a failure, which is not running, and the four-second hold only applies when nothing replaces the operation that just finished. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): stop reporting a cancelled install as installed, and make queued real Three defects that all trace to one root cause: `isCancelled: true` is unreachable from /api/operations. Every writer of Cancelled=true also sets Processed=true, the handler skips Processed && Cancelled, and OpCache.GetStatus evicts a cancelled op before the handler iterates it. Cancelling the last running operation put a green "Installed model X" on the strip for four seconds: the completion hold was guarded by `!previous.isCancelled`, which is dead. A cancellation deletes the operation server side, so the strip sees exactly what it sees on a completion, and nothing in the payload separates the two. The signal now comes from the side that issued the cancel: the operations context remembers the job IDs it cancelled (pruned after a minute) and the strip asks before it holds anything. A cancelled operation goes as soon as it stops; the record already reports it as cancelled. isQueued was set only when the gallery status was missing, but markQueued publishes a "queued" status at admission, so a queued op has a status for its whole queued life and the state was unreachable outside a microsecond window. Every operation waiting behind a running install rendered as "Installing model X" with a spinner. The queued phase is now the signal, via an exported PhaseQueued and a nil-safe OpStatus.IsQueued() next to the writer. With those two fixed, the Cancelling state has no way to be entered: cancelling is instantaneous from the API's point of view. Its branches, CSS, locale key and the isCancelled field itself are removed rather than left for a future reader to assume they work. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): keep a removal a removal, and say what an install is doing OpStatus.Deletion was set once, at admission, and lost on the next status write: UpdateStatus replaces the whole status and only carried Nodes forward. Every later writer (the worker's first write, the progress ticks, the failure path) leaves the field at its zero value, so the flag survived only the queued window, and both surfaces test isQueued first. The reachable consequence is that a failed removal reported itself as a failed install, which is exactly the shape the Activity page offers Retry for, and Retry installs: pressing it on a removal that failed re-downloaded the model. A running delete also rendered as "Installing model X" with a spinner, and a successful one as "Installed model X". Carry Deletion forward the way Nodes already is. A job is a delete or an install for its whole life; an unset flag means "no new information", not "this is an install". Pinned by Go specs on both the service and /api/operations: the existing Playwright specs were green only because they stubbed a payload the server could not emit. Also restore the operation's own status message on the Activity card. Phases and byte counters exist only on the managed-artifact path, so a legacy files: gallery model and every backend install rendered a sub-row with nothing in it but the verb. The strip stays terse on purpose. And give the strip's name a min-width floor: overflow: hidden zeroes its automatic minimum, so a long error squeezed the name down to "mod…" and the identity of the thing that broke was the first thing lost. primaryOperation is made module-private: its comment claimed the Activity page selected the same operation, but that page shows all of them, partitioned into failed and running, and never imported it. Assisted-by: Claude Code:Opus 5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(activity): read the operations record from PostgreSQL The Activity page's record of finished installs and removals was a 50-entry in-memory ring per frontend replica. In distributed mode that is the wrong place for it: each replica keeps its own copy, a replica added by a scale-out or a rolling deploy starts empty and never backfills, and "Clear history" clears only the replica that served the request, so the record reappears on the next poll routed elsewhere. The data is already in gallery_operations. Read it from there. GalleryStore gains ListTerminal and ClearTerminal, sharing a lifted terminalStatuses set with CleanOld so there is one definition of "finished". ListTerminal orders by updated_at, when the operation reached its terminal status, because the record reports what finished and when. OpCache.History and ClearHistory dispatch on whether a store is wired, so the HTTP handlers and the OpRecord JSON shape are unchanged and the page needed no change. A failed store read falls back to the local ring rather than blanking the page, and ClearHistory empties the ring as well so a database blip cannot resurrect a record the admin just cleared. The name derivation in recordTerminal is lifted into operationDisplayName and used by both paths, so the ring and the store cannot name the same operation differently. Also fixes a pre-existing bug the store path made visible: the backend channel hardcoded op_type "backend_install" even for a removal, while the model channel derives model_install/model_delete from op.Delete. Both channels carry the same ManagementOp, whose Delete field the backend handler already branches on, so the backend channel now derives backend_delete the same way. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(activity): keep a cancelled operation cancelled, and report a failed clear Review follow-up on the store-backed Activity record. A cancelled install was recorded as a failure. The cancel handler persists "cancelled" synchronously, then the handler goroutine unwinds with the context error and Start hands that to updateError unconditionally, which overwrote the row with "failed: context canceled". The page rendered a cancelled install as a red failure card offering Retry, with a raw context error as the reason. Fixed in GalleryStore rather than in Start, because an operation finishes once and the paths that retire one are not mutually exclusive: UpdateStatus now refuses to rewrite a row that already reached a terminal status. That also pins updated_at to when the operation really finished, which is the key the record is ordered by, and Create's upsert now freezes the same columns so a worker dequeuing an operation the admin cancelled while it was queued cannot reopen it as pending. ClearHistory returned nothing, so a failed delete logged a warning while the handler still answered 200. The admin watched the record clear and come back on the next fetch with nothing said about why. It now returns the error, the DELETE handler answers 500, and the store is cleared before the local ring so a failure leaves the fallback record intact rather than faking an empty one. Hydrate is the only reader that decides from op_type whether an operation is a removal, and it tested for "model_delete" exactly, so the backend_delete added in the previous commit hydrated as an install: a replica restarting during a backend removal rendered "Installing backend X". Both discriminations now go through IsDeleteOpType/IsBackendOpType so a fifth op_type cannot silently read as an install in whichever consumer was missed. Also: the backend channel now persists Cancellable as !op.Delete, matching the model channel; IsBackend falls back to the op_type prefix, since is_backend_op is only written by UpsertCacheKey and the rows needing the name fallback were reporting backend operations as models; and an unrecognized terminal status is logged rather than quietly filed as a success, which is what the comment already claimed. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(activity): keep a reaped operation correctable by its real outcome The terminal-status freeze added in the previous commit was too wide. It froze "failed" alongside "completed" and "cancelled", and the stale reaper writes "failed" onto operations that are still going to run. The gallery worker is a single goroutine consuming both channels serially, so an operation queued behind a large download sits in "pending" with nothing bumping updated_at, and ReapStaleOperations gives up on it after 30 minutes. That used to be self-healing: the worker dequeued it, Create reset the row to "pending", and the operation reported its real outcome. With the freeze the row stayed "failed" forever while the install ran and succeeded underneath it: a red failure card offering Retry for a model that is installed, omitted from ListActive so no replica hydrates it, and no longer deduped cluster-wide by FindDuplicate. Freeze on ("completed", "cancelled") instead. That is all the cancelled-install fix ever needed, and it leaves a failure correctable by what actually happened. The set is separate from terminalStatuses, which ListTerminal, ClearTerminal and CleanOld all still want in full, because the two mean different things: a failure can be superseded by a real outcome, a completion or a cancellation is the real outcome. UpdateStatus now writes the error column unconditionally, so a corrected outcome drops the previous attempt's reason rather than being recorded as completed while still carrying "stale operation reaped" as its error. Also adds the route-level spec for the 500 branch of DELETE /api/operations/history, and trims a comment that credited the persisted cancellable column with more than it survives long enough to do. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(activity): offer Cancel in the phase that can honour it The cancellable flag was set at both ends of an operation's life and was wrong at both, in opposite directions. A queued operation is cancellable whatever it is. EnqueueModelOp and EnqueueBackendOp select on the operation context, so cancelling one that is still waiting releases the delivery goroutine and abandonQueued retires it: the worker never sees it, nothing is downloaded, nothing is deleted. markQueued nevertheless wrote Cancellable: !deletion, so a queued removal reported cancellable: false and the UI hid the Cancel button in the one window where pressing it both works and leaves no trace. A removal queued behind a large install was stuck there until the install finished. A running removal is not cancellable at all. DeleteModel and DeleteBackend take no context, and modelHandler only checks the operation context after the call returns, so a "cancelled" verdict would land after the model was already gone. Both handlers nevertheless wrote Cancellable: true unconditionally at entry, ahead of the op.Delete branch, offering a Cancel button the server cannot honour. So the queued phase is more cancellable than the running phase, which is the reverse of the usual shape. markQueued now reports true unconditionally, and the handler-entry writes report !op.Delete. Both sites carry a comment saying why, because reading either one alone suggests the other is a bug. GalleryStore.Create keeps !op.Delete: it runs at dequeue, so its value already describes the running phase. Its comment now says so. Specs cover queued removal, queued install, running removal and running install through the handlers, plus the queued-removal case through /api/operations where the flag is consumed, plus the behaviour the whole asymmetry rests on: a removal cancelled while queued never reaches the worker and deletes nothing. No existing spec asserted the old values. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Write] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(activity): clamp the installer message, and add a real-binary e2e spec Running the page against a real local-ai showed the legacy installer message wrapping to three lines and dominating the card: it embeds an absolute file path, so it is both long and a single unbreakable token. One line, ellipsised, full text in the title, matching what the error string already does. The spec that found it runs with no route stubbing at all. Every other spec here stubs /api/operations, which is how a payload the server cannot emit (isDeletion true on a live operation) stayed green through a full review while the UI rendered a removal as an install. It is skipped unless LOCALAI_REAL_BINARY is set, so CI is unaffected. Assisted-by: Claude Code:claude-opus-5 [Read] [Edit] [Bash] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-07-28 19:33:48 +02:00
mudler's LocalAI [bot]andEttore Di Giacinto	ff299df453	perf(http): gzip responses, cache hashed assets, bound the trace endpoints (#11056) ... Three measured HTTP-layer regressions on a live deployment, fixed together because they all shape the bytes on the wire. 1. No compression. The server sent no Content-Encoding regardless of what the client asked for, confirmed with curl straight at 127.0.0.1:8080 so it was not an ingress artefact. Adds gzip middleware, on by default and configurable via LOCALAI_DISABLE_HTTP_COMPRESSION and LOCALAI_HTTP_COMPRESSION_MIN_LENGTH (default 1024 bytes so tiny bodies are not wastefully wrapped). Streaming routes are skipped explicitly: an SSE Accept header, a WebSocket upgrade, and the completion / SSE / log-tail path prefixes, because whether a completion request streams is decided by the request body, which the middleware runs too early to see. Already-compressed formats (woff2, png, mp4, ...) are skipped too; gzip made those marginally larger. Measured over the embedded React build: JS+CSS 2815 KB raw to 808 KB gzipped (3.48x). 2. No cache headers on content-hashed assets. Vite hashes the filenames, so a given /assets/ URL can never change content, yet they shipped with no Cache-Control, ETag or Last-Modified, and the browser re-fetched the whole bundle on every navigation with no conditional request available. /assets/* now carries public, max-age=31536000, immutable. index.html stays no-cache so a deploy is picked up, and the unhashed locale JSONs get a short TTL rather than the immutable one. 3. Unbounded trace endpoints. /api/traces returned 21,033,606 bytes in 4.65s and /api/backend-traces 3,471,682 bytes in 1.50s, and the admin UI polls both every few seconds. The ring buffer holds up to 1024 entries, each embedding full input_text payloads. Both list endpoints now take limit / offset / full, default to 50 entries, and strip the heavy fields (request and response bodies plus headers for API traces, body and data for backend traces) unless full=true. Every trace gets a process-lifetime ID and GET /api/traces/{id} and /api/backend-traces/{id} serve the full record, which is what the UI fetches when a row is expanded. The list body stays a JSON array; paging metadata rides in X-Total-Count, X-Trace-Offset and X-Trace-Limit. Reproducing the live shape in a test, the polled payload goes from 21,131,097 bytes to 7,201 bytes. Assisted-by: Claude:claude-opus-4-8 [Claude Code] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-07-22 22:51:25 +02:00
mudler's LocalAI [bot]andEttore Di Giacinto	40d35c0385	docs: onboarding overhaul, dedup, and error docs (#7711) (#10895) ... * docs: fix CPU image tag (latest, not latest-cpu) Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: use canonical localai/localai registry in models guide Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: replace dead llama-stable backend with llama-cpp Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: correct mitm-proxy intercept config and redaction tier Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: fix text-to-audio endpoint and broken notice block Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: fix VAD example, stale FAQ, broken link, CLI list, whats-new dump Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: render advanced/reference section indexes (consolidate _index) Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: remove duplicate getting-started build/kubernetes pages Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: fold container image reference into installation/containers Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: remove stale advanced fine-tuning page (superseded by features/fine-tuning) Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: fold distribution/longcat/sound pages into their parents Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: make getting-started index accurate and complete Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: carry one concrete model through the getting-started path Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: add end-to-end 'build your first agent' walkthrough Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: add runtime errors reference; consolidate troubleshooting from FAQ Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: add agent actions catalog Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: agent-scoped MCP, skills walkthrough, agentic disambiguation Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: add concrete gallery install lines to media feature pages Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: merge installation into getting-started (URLs preserved via aliases) Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: add Operations section; move operator pages and P2P API reference Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: journey-ordered top nav and grouped feature sections Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: add docs-with-code process gate (PR template + agent instructions) Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs: remove em/en dashes from documentation prose Signed-off-by: Ettore Di Giacinto <mudler@localai.io> --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-07-17 22:08:20 +02:00
Richard Palethorpe	eb32cd9073	feat(realtime): eager blocking pipeline warm-up + /backend/load API (#10662) ... Realtime sessions previously lazy-loaded each pipeline sub-model (VAD, transcription, LLM, TTS) on first use, so every cold session paid a per-request model-load stall and load errors only surfaced mid-stream. Warm the whole pipeline eagerly and blockingly at session start (including the voice-gate speaker-recognition model, which an enforced gate blocks each utterance on; compaction's summary_model stays lazy since it only runs off the response path): - Add backend.PreloadModel / PreloadModelByName as the single load path for every modality (no transcription special-case; backend-omitted configs are deprecated). - The realtime session blocks on Model.Warmup and returns a model_load_error to the client if any stage fails to load; updateSession warms in the background. Opt out per pipeline with pipeline.disable_warmup, exposed as a UI toggle via the config-metadata registry. Add a LocalAI-native POST /backend/load (and /v1/backend/load) that pre-loads a model -- expanding realtime pipelines into their sub-models -- as the inverse of /backend/shutdown. There is one preload engine (backend.PreloadStages): the realtime Warmup methods, /backend/load and the --load-to-memory startup flag all use it, so --load-to-memory now also expands pipeline models and records load-failure traces. Pipeline sub-model alias resolution is likewise shared (ModelConfigLoader.LoadResolvedModelConfig). Surface the endpoint everywhere an admin manages models: - MCP admin tool load_model (httpapi + inproc clients, safety/catalog prompts, catalog/dispatch tests). - "Load into memory" action in the React models UI. - Swagger regenerated; docs moved to the general backend-monitor page since it is not realtime-specific. Fix a Traces UI crash ("json: unsupported value: -Inf"): audio-snippet RMS/peak now floor at a finite dBFS, and backend-trace data is sanitized to drop non-finite floats before marshaling. The sanitizer is copy-on-write -- it runs on every RecordBackendTrace, so containers are only re-allocated on the paths that actually changed. Migrate core/http/openresponses_test.go onto the prebuilt mock-backend the rest of the http suite already uses -- it was the last spec still pointing at a real HuggingFace model, so it 404'd wherever no vision backend was built -- and fix its item_reference specs to send the spec's "id" field instead of "item_id", which the handler never accepted. Assisted-by: Claude:claude-opus-4-8 Claude Code Signed-off-by: Richard Palethorpe <io@richiejp.com>	2026-07-03 18:00:37 +02:00
LocalAI [bot]andEttore Di Giacinto	f72046b5b5	fix(auth): make advisory locks dialect-aware and harden SQLite DSN (#10509) ... * fix(auth): make advisory locks dialect-aware and harden SQLite DSN Fixes #10506. Two failures hit deployments that use the default SQLite auth database: 1. advisorylock executed PostgreSQL-only SQL (pg_advisory_lock / pg_try_advisory_lock) unconditionally. On a SQLite auth DB the job store, agent store and node registry migrations failed with "no such function: pg_advisory_lock". WithLockCtx/TryWithLockCtx now branch on the gorm dialect: PostgreSQL keeps the cross-process advisory lock, every other dialect uses a context-aware, per-key in-process lock (a SQLite auth DB is effectively single-process, so serializing within the process is sufficient). 2. The SQLite auth DSN set no busy timeout, so transient SQLITE_BUSY over network-backed storage (SMB/CIFS/NFS, e.g. Azure Files) failed the auth migration immediately with "database is locked". The DSN now sets _busy_timeout=5000 and _txlock=immediate (caller-supplied values are preserved). WAL is intentionally not enabled since its shared-memory mmap does not work over network filesystems. Docs note that PostgreSQL should be used when the data directory lives on shared storage. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-4-8 [Claude Code] * test(jobs): regression test for #10506 SQLite job store migration Exercises the exact caller chain that failed in the issue: auth.InitDB(sqlite) -> jobs.NewJobStore -> advisorylock.WithLockCtx -> AutoMigrate. Before the dialect-aware advisory lock fix this failed with "no such function: pg_advisory_lock"; the test now asserts it migrates cleanly on a SQLite auth DB. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: Claude:claude-opus-4-8 [Claude Code] --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-06-25 17:18:55 +02:00
LocalAI [bot]andEttore Di Giacinto	f15b9178ec	feat(usage): track and visualise usage per API key (#9920) ... * feat(usage): add Source, APIKeyID, APIKeyName columns to UsageRecord Adds three additive columns plus UsageSource* constants. The columns are auto-migrated by InitDB. APIKeyID is a nullable foreign reference to UserAPIKey.ID; APIKeyName is snapshotted on each row so revoked keys keep showing their name in history. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(usage): backfill Source on pre-feature usage rows InitDB now classifies any pre-existing usage_record with an empty source: 'legacy-api-key' user -> legacy, everything else -> web. The backfill is idempotent (only touches NULL/empty rows). Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(usage): add GetUserUsageBySource aggregator Groups by (bucket, source, api_key_id, api_key_name). Filters out legacy by default. Returns both per-bucket detail and roll-ups (by_source, by_key sorted desc and capped at 200, grand_total). The MAX(created_at) projection is iterated via Rows().Scan into a string column and parsed manually because the SQLite driver surfaces the aggregated timestamp as a string, which database/sql refuses to scan directly into time.Time. Postgres returns a real timestamp; the same string path handles its RFC3339 form too. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(usage): log Rows() errors and assert LastUsed in tests Adds rows.Err() and Rows() open-failure logging in computeSourceTotals so silent data drops surface in logs. Logs on parseLastUsedString format misses for the same reason. Strengthens the snapshot-survival test to assert LastUsed is a recent timestamp, locking the SQLite time-string parser behaviour. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(usage): add admin GetAllUsageBySource with filters and truncation Optional user_id and api_key_id filters (composed with AND). Legacy bucket is included for admin callers. truncated=true when more than 200 distinct keys would be in the by_key roll-up. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(auth): plumb auth_source and auth_apikey through Echo context tryAuthenticate now sets auth_source on every successful branch (web for session/Bearer-session, apikey for Bearer-key/x-api-key/ token-cookie, legacy for legacy env key match). For named-key branches it also stores the resolved *UserAPIKey under auth_apikey so downstream middlewares can snapshot id+name without re-validating. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(auth): expand tryAuthenticate godoc and cover Bearer-session branch Documents all three context-keys side effects (auth_source, auth_apikey, _auth_session) plus the split of responsibilities with the parent Middleware. Adds a test for the Bearer-as-session-token classification so future regressions there fail loudly. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(usage): UsageMiddleware records source + snapshots key name Reads auth_source and auth_apikey from the Echo context (set by auth.Middleware in the previous task). Snapshots UserAPIKey.ID and Name onto each row so revoked keys remain readable in history. Falls back to source=web when no auth_source is set (auth disabled or unrecognised path). Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(usage): add /api/auth/usage/sources and admin variant Self endpoint filters legacy server-side; admin endpoint includes legacy and accepts user_id + api_key_id filters. Response includes buckets, totals.{by_source, by_key, grand_total}, and a truncated flag set when the per-key roll-up was capped at 200. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs(routes): mark test mirror handlers as keep-in-sync with production The newTestAuthApp helper duplicates production route handlers inline because it cannot use RegisterAuthRoutes (which requires a *application.Application). Naming the source path on each mirror makes the drift contract explicit for future maintainers. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): add usageApi.getMySources/getAdminSources + i18n strings Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): add Sources tab skeleton with data fetch Adds Usage page tab that fetches /api/auth/usage/sources (or the admin variant). Renders raw totals plus a placeholder key list; real visualisations land in subsequent commits. Restructures the existing tab button block so Models and Sources are visible to non-admins (Users remains admin-only). Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): source mix ribbon + searchable/sortable sources table Replaces the SourcesTab placeholder rendering with two reusable components: SourceMixRibbon (one segmented bar per source class) and SourcesTable (search + sort + revoked-key dim). Pulls the current API key list to detect revoked keys. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(ui): skip revoked-key detection until the key list is known existingKeyIds defaulted to an empty Set, which made every live api_key row render as (revoked) during the brief window before apiKeysApi.list() resolved, and permanently after a fetch failure. Use null as the unknown state and suppress the revoked badge until the parent provides a real Set. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(ui): top-N stacked time chart and drill-in chip for Sources tab Top 7 sources by total tokens get distinct colours; the rest roll up into 'Other'. Clicking a row in the SourcesTable dims everything except that series in the chart; the chip is the canonical clear. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * docs(usage): document per-API-key Sources tab and endpoints Extends features/authentication.md Usage Tracking section with: - A 'Sources' tab description and source-class taxonomy - Endpoint documentation for /api/auth/usage/sources and the admin variant - Response shape example with by_source / by_key / grand_total - Migration note about pre-feature row backfill Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix(usage): silence errcheck on deferred rows.Close CI errcheck flagged the bare 'defer rows.Close()' in computeSourceTotals. Wrap in a closure that discards the close error explicitly; an error here is non-actionable since we have already drained the rows and logged any iteration failure. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * refactor(usage): bound batcher intake and add Shutdown/FlushNow hooks The pre-existing usage batcher had no cap on its add() path; the usageMaxPending=5000 constant only guarded the re-queue path after a failed write, leaving memory growth unbounded if the DB fell behind. This commit: - Adds the cap to add() so saturation drops new records (rate-limited warn at 1/1024) instead of growing unbounded. - Raises usageMaxPending to 50000 to absorb realistic inference bursts. - Replaces the package-level batcher global with a mutex-guarded pair plus a currentBatcher() accessor so Init / Shutdown cycles are race-free. - Adds ShutdownUsageRecorder() for graceful drain on process exit (not yet wired into app shutdown, just published). - Adds FlushNow() for deterministic tests; the middleware suite no longer needs 6s sleeps per spec and now runs in ~50ms instead of 18s. - Re-queue on failed flush is now cap-aware: prepends as much of the failed batch as fits alongside concurrent arrivals, instead of dropping the whole batch when full. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat(usage): drain usage batcher on graceful shutdown Registers ShutdownUsageRecorder with the existing signals.RegisterGracefulTerminationHandler so SIGINT/SIGTERM synchronously flushes any in-memory usage records before the process exits. Without this, up to one flush interval (5s) of recorded usage was lost when LocalAI restarted. Refs: #9862 Signed-off-by: Ettore Di Giacinto <mudler@localai.io> --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>	2026-05-21 16:34:02 +02:00
Ettore Di Giacinto	7e0b73deaa	fix(docs): fix broken references to distributed mode ... Signed-off-by: Ettore Di Giacinto <mudler@localai.io>	2026-04-03 09:46:06 +02:00
Ettore Di Giacinto	aea21951a2	feat: add users and authentication support (#9061) ... * feat(ui): add users and authentication support Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat: allow the admin user to impersonificate users Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: ui improvements, disable 'Users' button in navbar when no auth is configured Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat: add OIDC support Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: gate models Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: cache requests to optimize speed Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * small UI enhancements Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore(ui): style improvements Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: cover other paths by auth Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: separate local auth, refactor Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * security hardening, approval mode Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: fix tests and expectations Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: update localagi/localrecall Signed-off-by: Ettore Di Giacinto <mudler@localai.io> --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io>	2026-03-19 21:40:51 +01:00