0.1.4

0.1.4 is a large hardening release: 8 new features, 6 security fixes and 37 bug
fixes, concentrated in GGUF inference, the coder, and Knowledge (RAG).

Highlights

Image understanding is usable again. The vision projector was pinned to the
CPU for every user, on every GPU, to work around a failure that affects one AMD
card. A screenshot took about ten minutes with the graphics card idle, close
enough to the timeout that it often failed outright. It now runs on the GPU and
the same image takes a couple of seconds. Separately, a recent llama.cpp change
altered the structure localm passes the prompt in, which truncated every image
prompt and crashed the model process; localm now detects which layout the
installed runtime uses.

Run a Mixture-of-Experts model in a fraction of the VRAM. A new "MoE expert
layers on CPU" setting (n_cpu_moe, off by default) keeps the expert weights of
the first N layers in system RAM while the rest of the model still runs on the
GPU. Measured on a 7B MoE, the GPU footprint dropped from 3961 MiB to 241 MiB
with all 16 layers set. It is a footprint dial rather than a speed-up: at the
same VRAM it runs at about the same speed, so reach for it when something else
needs the card, or when a model would otherwise not fit at all.

Knowledge collections no longer lose documents. A chunk whose text contained
certain rarer separator characters was split in half when the collection was read
back, so those documents were dropped and the next save wrote the collection back
without them. On a real 1192-chunk collection this deleted 26 chunks every time
it was opened and saved. Existing collections recover on their next load and
nothing needs re-importing. The same fault is fixed in agent memory and in the
coder's stored episodes.

The coder can search your indexed Knowledge collections, so it is no longer
limited to files in the project directory. Search asks for confirmation by
default, retrieved text goes through the same sanitiser as anything else
untrusted, and a restricted (shared, non-owner) session cannot use the tools at
all. Lexical only for now, not the hybrid search the Knowledge page can do.

Models page. Sort by any column, rename a model outright (localm rename),
and see a model switch actually happening rather than a frozen page. Registered
models now show their real architecture and whether they are MoE, read from the
file's own header rather than guessed from the name.

Security

• A model can no longer hang the coder with a search pattern.
• A plugin name can no longer escape the plugins folder.
• Installing a plugin can no longer delete a different plugin.
• A model's own bundled code is no longer executed just because you loaded it.
• localm rm no longer deletes outside your models folder.
• A HuggingFace repo can no longer make an empty download look finished.

Three model routes that read arbitrary host paths now require filesystem access
as an explicit scope, and the file browser can no longer be read by another page
on your machine.

Upgrading

localm update

Two changes are opt-in and need one command each:

• localm setup-llama --force picks up the new bundled AMD ROCm runtime
  (build b1307, up from b1288: two months of upstream llama.cpp, a newer ROCm,
  and more gfx1030 kernels). An existing install keeps working untouched until
  you run it.
• The same command clears 49 upstream command-line tools that Windows installs
  were carrying and localm never invokes. No library is affected.

Fresh install

git clone --depth 1 --branch v0.1.4 https://github.com/Matlan1/localm.git

Then run setup.bat (Windows) or setup.sh, which creates a private virtual
environment, detects your GPU and provisions the matching llama.cpp backend.

Verifying the download

localm-0.1.4.zip.sig is an Ed25519 signature over the zip. The built-in
updater checks it against a pinned public key automatically, and refuses a build
that does not verify or that would move you backwards.

Full changelog

Every entry, with the reasoning behind each fix, is in
CHANGELOG.md.
Commit range: v0.1.3...v0.1.4.

Known limitations

Media generation (image, music, video) needs a local ComfyUI backend, which
localm comfy setup can install for you. Semantic search in Knowledge needs the
on-device embedding model from localm setup-embeddings. The primary development
hardware is AMD; the NVIDIA path is validated by design and testing rather than
on the maintainer's own machine.