Ettore Di Giacinto 1f481b0747 feat(connectors): add-on roles and permissions, and sender pairing ...

A connector kind can now declare the roles it gives to a sender and the
capabilities it can grant to a role. The owner of a binding enables a
ceiling of capabilities and maps roles to them. The host stores these
values and returns them with the binding and the kind list, so an add-on
settings page can show them.

Capability names are a closed list owned by the host. Sensitive names
may be listed by a kind but are never granted to a role; only a paired
sender can use them.

Pairing proves that the owner controls a platform account. The owner
asks for a one-use code (valid ten minutes) and sends it as a direct
message to the bot from an allowlisted account. The host checks the code
before any model turn and never logs it. A binding holds three paired
senders, a pairing ends after 90 days, and five wrong codes in an hour
lock the sender out for an hour.

Contract: connector kinds gain optional roles and permissions, and a
message gains optional roles. They need manifest api 2, which the host
already accepts; protocol is unchanged and manifests that declare
nothing new behave as before. The host drops roles a kind does not
declare.

Enforcement of the capabilities by feature is not part of this change.

Assisted-by: Claude:claude-sonnet-5-5 go swag

2026-11-03 13:52:56 +00:00

..

addon_engine_jobs.go

feat(addons): installable add-ons foundation and the Tables add-on (#12702)

2026-10-22 17:57:19 +02:00

addon_engine_models_test.go

feat(addons): installable add-ons foundation and the Tables add-on (#12702)

2026-10-22 17:57:19 +02:00

addon_export_status_test.go

feat(addons): run the add-on owner as its own workload (#12867)

2026-10-24 14:29:39 +02:00

addon_export_status.go

feat(addons): run the add-on owner as its own workload (#12867)

2026-10-24 14:29:39 +02:00

agent_collections_param_test.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

agent_collections.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

aliases_test.go

feat(models): model aliases - redirect a model name to another configured model (#10414)

2026-06-20 22:38:42 +02:00

aliases.go

feat(models): model aliases - redirect a model name to another configured model (#10414)

2026-06-20 22:38:42 +02:00

api_instructions_test.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

api_instructions.go

feat(connectors): add-on roles and permissions, and sender pairing

2026-11-03 13:52:56 +00:00

audio_transform_internal_test.go

feat(realtime): LFM3-Audio speech-to-speech on llama.cpp, remove liquid-audio (#12958)

2026-10-29 22:06:41 +01:00

audio_transform.go

feat(realtime): LFM3-Audio speech-to-speech on llama.cpp, remove liquid-audio (#12958)

2026-10-29 22:06:41 +01:00

audio.go

[httpclient] validate redirect targets and pin dialed addresses for user URLs (#12853)

2026-10-23 11:54:42 +02:00

backend_apply_test.go

fix(backends): make backend install ops idempotent unless forced (#10643)

2026-07-02 19:16:29 +02:00

backend_available_cluster_test.go

fix(distributed): backend discovery hid worker-installed backends behind the controller's filesystem (#10967)

2026-07-20 01:09:37 +02:00

backend_library_test.go

feat(addons): list and install backends from a library (#12816)

2026-10-23 01:00:07 +02:00

backend_library.go

feat(addons): run the add-on owner as its own workload (#12867)

2026-10-24 14:29:39 +02:00

backend_load_test.go

feat(realtime): eager blocking pipeline warm-up + /backend/load API (#10662)

2026-07-03 18:00:37 +02:00

backend_load.go

feat(realtime): eager blocking pipeline warm-up + /backend/load API (#10662)

2026-07-03 18:00:37 +02:00

backend_logs_test.go

feat(api): Allow coding agents to interactively discover how to control and configure LocalAI (#9084)

2026-04-04 15:14:35 +02:00

backend_logs.go

feat(api): Allow coding agents to interactively discover how to control and configure LocalAI (#9084)

2026-04-04 15:14:35 +02:00

backend_monitor.go

fix(worker): reap deleted backends and stop models that live on a worker (#10956)

2026-07-20 01:09:22 +02:00

backend_test.go

feat: add FunASR speech recognition backend (#10090)

2026-09-11 22:06:26 +00:00

backend.go

feat(backends): --disable-backend-install disables backend downloads. (#12754)

2026-10-22 17:58:53 +02:00

branding_endpoints_test.go

test: add Go + React UI coverage gates and fill test gaps (#9989)

2026-05-26 22:06:10 +02:00

branding_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

branding.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

collections_embedding_internal_test.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

config_meta_test.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

config_meta.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

cors_proxy_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

cors_proxy.go

security(http): refuse redirects on outbound clients via hardened pkg/httpclient (#10087)

2026-05-30 12:04:10 +02:00

decisions_test.go

feat(api): add OpenAI Decisions endpoint (#12603)

2026-10-10 08:29:31 +02:00

decisions.go

feat(api): add OpenAI Decisions endpoint (#12603)

2026-10-10 08:29:31 +02:00

depth.go

feat(backend): add depth-anything (Depth Anything 3) C++/ggml backend + gallery (#10352)

2026-06-16 16:28:28 +02:00

detection.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

detokenize.go

feat(api): add /v1/detokenize endpoint (#9620)

2026-07-30 16:01:47 +02:00

discovery_cluster_capabilities_test.go

fix(distributed): backend discovery hid worker-installed backends behind the controller's filesystem (#10967)

2026-07-20 01:09:37 +02:00

discovery_cluster_installed_test.go

fix(distributed): backend discovery hid worker-installed backends behind the controller's filesystem (#10967)

2026-07-20 01:09:37 +02:00

edit_model_test.go

feat(models): route manual imports with remote assets through the gallery job queue

2026-10-13 08:14:30 +00:00

edit_model.go

fix(distributed): keep model replicas config-consistent (#11664)

2026-08-22 22:44:03 +02:00

engine_start_test.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

export_slot_cache_test.go

feat(llama-cpp): add slot prompt-cache save and restore API (#12730)

2026-10-17 18:23:02 +02:00

face_analyze.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

face_embed.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

face_forget.go

feat(face-recognition): add insightface/onnx backend for 1:1 verify, 1:N identify, embedding, detection, analysis (#9480)

2026-04-22 21:55:41 +02:00

face_identify.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

face_register_test.go

feat(faces): replay saved face enrollments (#11908)

2026-09-07 17:40:27 +02:00

face_register.go

feat(faces): replay saved face enrollments (#11908)

2026-09-07 17:40:27 +02:00

face_verify.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

failover_gap_internal_test.go

fix(failover): skip a target that answers HTTP 501 instead of failing the chain

2026-09-27 07:42:21 +00:00

failover_test.go

fix(failover): pass credential lookup from CLI

2026-09-27 07:42:20 +00:00

failover.go

feat(failover): expose chain status, pins and events over REST and SSE

2026-09-27 07:42:20 +00:00

finetune.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

forecast_test.go

feat(backends): timestral.cpp forecast backend and /v1/forecast API (#12885)

2026-10-24 22:47:04 +02:00

forecast.go

feat(backends): timestral.cpp forecast backend and /v1/forecast API (#12885)

2026-10-24 22:47:04 +02:00

gallery.go

feat(backends): --disable-backend-install disables backend downloads. (#12754)

2026-10-22 17:58:53 +02:00

get_token_metrics.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

images.go

feat(face-recognition): add insightface/onnx backend for 1:1 verify, 1:N identify, embedding, detection, analysis (#9480)

2026-04-22 21:55:41 +02:00

import_model_test.go

fix(models): resolver-gated queueing and editor polling for manual imports

2026-10-13 08:14:30 +00:00

import_model.go

docs(models): describe what a queued manual import adds

2026-10-13 08:14:30 +00:00

library_actor.go

feat(addons): run the add-on owner as its own workload (#12867)

2026-10-24 14:29:39 +02:00

library_sources_test.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

library_sources.go

feat(addons): run the add-on owner as its own workload (#12867)

2026-10-24 14:29:39 +02:00

localai_suite_test.go

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

mcp_addon_tools_internal_test.go

feat(addons): installable add-ons foundation and the Tables add-on (#12702)

2026-10-22 17:57:19 +02:00

mcp_prompts.go

feat(config): let model aliases carry an opt-in profile block (system prompt, MCP, client tools) (#12661)

2026-10-19 23:42:40 +02:00

mcp_resources.go

feat(config): let model aliases carry an opt-in profile block (system prompt, MCP, client tools) (#12661)

2026-10-19 23:42:40 +02:00

mcp_tools_internal_test.go

fix: Show MCP connection errors in the UI (#11495)

2026-08-13 22:25:58 +02:00

mcp_tools_profile_alias_test.go

feat(config): let model aliases carry an opt-in profile block (system prompt, MCP, client tools) (#12661)

2026-10-19 23:42:40 +02:00

mcp_tools.go

feat(config): let model aliases carry an opt-in profile block (system prompt, MCP, client tools) (#12661)

2026-10-19 23:42:40 +02:00

mcp.go

feat(addons): installable add-ons foundation and the Tables add-on (#12702)

2026-10-22 17:57:19 +02:00

metrics.go

feat(api): Allow coding agents to interactively discover how to control and configure LocalAI (#9084)

2026-04-04 15:14:35 +02:00

model3d_animation_internal_test.go

feat(kimodocpp): track usage through generic backend metadata (#12162)

2026-09-20 19:39:06 +01:00

model3d_animation.go

feat(kimodocpp): track usage through generic backend metadata (#12162)

2026-09-20 19:39:06 +01:00

model3d_internal_test.go

feat: Add 3d generation UI/API and trellis2cpp backend (#10979)

2026-07-29 16:15:04 +02:00

model3d_remesh_internal_test.go

feat: Add 3d generation UI/API and trellis2cpp backend (#10979)

2026-07-29 16:15:04 +02:00

model3d_remesh.go

feat: Add 3d generation UI/API and trellis2cpp backend (#10979)

2026-07-29 16:15:04 +02:00

model3d.go

feat: Add 3d generation UI/API and trellis2cpp backend (#10979)

2026-07-29 16:15:04 +02:00

model_load_cancel_test.go

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00

model_load_cancel.go

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00

model_load_status_test.go

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00

model_load_status.go

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00

model_storage.go

feat(models): report per-model disk usage in API and WebUI (#12551)

2026-10-07 22:03:48 +02:00

motion_duplex_test.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

motion_duplex.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

motion_internal_test.go

fix(motion): cap concurrent motion sessions per user

2026-10-13 08:27:24 +00:00

motion.go

fix(motion): cap concurrent motion sessions per user

2026-10-13 08:27:24 +00:00

nodes_agent_worker_test.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

nodes_backends_list_test.go

fix(proxy): propagate model env and accept direct keys (#12940)

2026-10-27 10:27:45 +01:00

nodes_install_async_test.go

fix(distributed): make per-node backend upgrade actually upgrade (#10838)

2026-07-15 09:16:55 +02:00

nodes_scheduling_alias_test.go

feat(distributed): key scheduling rules by a model alias (#11771)

2026-08-29 09:16:50 +02:00

nodes_scheduling_test.go

feat(distributed): declarative per-model scheduling via env/args (#10308)

2026-06-13 18:31:06 +02:00

nodes_scheduling_validation_test.go

feat: prefix-cache-aware routing for distributed mode (#10071)

2026-05-30 23:24:22 +02:00

nodes_test.go

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00

nodes_vrambudget_test.go

feat(vram): per-node VRAM allocation budget (LOCALAI_VRAM_BUDGET) (#10833)

2026-07-15 09:58:45 +02:00

nodes.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

p2p.go

feat(api): Allow coding agents to interactively discover how to control and configure LocalAI (#9084)

2026-04-04 15:14:35 +02:00

pii_test.go

feat(pii): NER tier engine — privacy-filter.cpp backend + NER-centric PII filter (#10360)

2026-06-18 11:45:22 +01:00

pii.go

feat(pii): NER tier engine — privacy-filter.cpp backend + NER-centric PII filter (#10360)

2026-06-18 11:45:22 +01:00

pin_model.go

feat: localai assistant chat modality (#9602)

2026-04-28 19:29:27 +02:00

portable_http_test.go

feat(diarization): return sound events with include_sounds (#12544)

2026-10-07 14:10:45 +02:00

portable_register_test.go

feat(audio): remember speakers from diarization (#12414)

2026-10-02 08:14:00 +02:00

quantization.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

router_corpus_test.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

router_corpus.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

router_decide_test.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

router_decide.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

score.go

feat(middleware): Model routing, PII filtering, Cloud model proxies (#9802)

2026-05-25 09:28:27 +02:00

settings_authority_test.go

fix(addons): make owner settings authoritative (#13033)

2026-11-02 18:48:39 +01:00

settings_test.go

fix(addons): make owner settings authoritative (#13033)

2026-11-02 18:48:39 +01:00

settings.go

fix(addons): make owner settings authoritative (#13033)

2026-11-02 18:48:39 +01:00

slot_cache_test.go

feat(llama-cpp): add slot prompt-cache save and restore API (#12730)

2026-10-17 18:23:02 +02:00

slot_cache.go

feat(llama-cpp): add slot prompt-cache save and restore API (#12730)

2026-10-17 18:23:02 +02:00

stores.go

feat(stores): add Valkey Search vector store backend (#11196)

2026-07-29 20:12:29 +02:00

system_info_test.go

feat(system): report per-model DRM VRAM (#12026)

2026-09-27 21:18:34 +02:00

system.go

feat(system): report per-model DRM VRAM (#12026)

2026-09-27 21:18:34 +02:00

systemone_gate_test.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

systemone_images_test.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

systemone_images.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

systemone_native_test.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

systemone_validate_test.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

systemone.go

feat(api): add OpenAI Decisions endpoint (#12603)

2026-10-10 08:29:31 +02:00

toggle_model_test.go

fix(distributed): keep model replicas config-consistent (#11664)

2026-08-22 22:44:03 +02:00

toggle_model.go

fix: correct stale symbol names in doc comments (#12139)

2026-09-19 23:39:44 +02:00

tokenize.go

feat(api): Allow coding agents to interactively discover how to control and configure LocalAI (#9084)

2026-04-04 15:14:35 +02:00

traces_test.go

fix(test): stop the backend-trace specs racing the lossy trace channel (#11146)

2026-07-27 22:38:23 +02:00

traces.go

feat(ui): give Operate and Studio a front door, and fix two layout regressions (#11305)

2026-08-03 00:16:08 +02:00

tts_speed_test.go

fix(tts): forward the OpenAI speed field to the backend (#11097) (#11120)

2026-07-27 19:03:32 +02:00

tts_speed.go

fix(tts): forward the OpenAI speed field to the backend (#11097) (#11120)

2026-07-27 19:03:32 +02:00

tts_voices_test.go

feat(audio): list available TTS voices

2026-09-11 21:55:21 +00:00

tts_voices.go

feat(audio): list available TTS voices

2026-09-11 21:55:21 +00:00

tts.go

feat(tts): support multi-reference personalities

2026-09-11 21:56:08 +00:00

types.go

fix(distributed): keep model replicas config-consistent (#11664)

2026-08-22 22:44:03 +02:00

user_scope_test.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

user_scope.go

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

vad.go

feat(api): Allow coding agents to interactively discover how to control and configure LocalAI (#9084)

2026-04-04 15:14:35 +02:00

video_internal_test.go

stablediffusion-ggml: run MiniMax-H3 video with references and add its gallery entries (#12668)

2026-10-13 17:58:21 +02:00

video.go

[httpclient] validate redirect targets and pin dialed addresses for user URLs (#12853)

2026-10-23 11:54:42 +02:00

voice_analyze.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

voice_embed.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

voice_forget.go

feat: voice recognition (#9500)

2026-04-23 12:07:14 +02:00

voice_identify.go

feat(voice-detect): report the encoder family so audio-registered voices are fingerprinted (#12499)

2026-10-08 19:26:11 +02:00

voice_profiles_test.go

feat(tts): support multi-reference personalities

2026-09-11 21:56:08 +00:00

voice_profiles.go

feat(tts): support multi-reference personalities

2026-09-11 21:56:08 +00:00

voice_register_test.go

feat(voice-detect): report the encoder family so audio-registered voices are fingerprinted (#12499)

2026-10-08 19:26:11 +02:00

voice_register.go

feat(voice-detect): report the encoder family so audio-registered voices are fingerprinted (#12499)

2026-10-08 19:26:11 +02:00

voice_verify.go

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

vram_test.go

feat(gallery): Speed up load times and clean gallery entries (#9211)

2026-05-06 14:51:38 +02:00

vram.go

feat(gallery): Speed up load times and clean gallery entries (#9211)

2026-05-06 14:51:38 +02:00

welcome.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00