Filamind AI v1.4.1

[1.4.1] — 2026-05-30

DS1821+ أصبح حقيقياً — binary AVX2 مبني ومُختبَر على الجهاز · DS1821+ goes from stub to real: AVX2 llama-server built and verified on the actual device.

Added

• Real llama-server for DS1821+ (device/ds1821-plus branch) — replaces the 5-byte stub placeholder with a genuine 5.7 MB binary:
  • llama.cpp b4400, CPU-only, compiled with -march=znver1 -mavx2 -mfma -mf16c.
  • Static libstdc++/libgcc so it runs on DSM 7.2's glibc 2.36 despite being built on Ubuntu 22.04 (glibc 2.35). Runtime deps are only libc/libm/ld-linux (verified via ldd).
  • Built with GGML_OPENMP=OFF + LLAMA_CURL=OFF to keep the dependency surface minimal.
• On-device verification (192.168.0.250):
  • ./llama-server --version → version: 1 (6e1531a) — executes cleanly, no "Exec format error", no glibc mismatch.
  • Loaded mistral-7b-instruct-v0.2-q4_k_m.gguf (291 tensors), system_info reports AVX2 = 1 | FMA = 1 | F16C = 1.
  • /health → {"status":"ok"}; a real chat completion returned actual generated text.
• build_ds1821_native.sh — the reproducible native-toolchain build recipe (an alternative to the Synology-toolchain path in build_llama_cpu_avx2.sh, which requires downloading the v1000 cross-toolchain).

Changed

• DS1821+ marked functional in the README, the top-of-changelog device table, and device/ds1821-plus's DEVICE.md — replacing the honest "not yet functional / stub" notes from v1.3.2.
• The DS1821+ SPK in releases is now a working package, not a stub-carrying placeholder.

Notes

• This is one of the two "missing features" called out in the v1.3.x honesty audit (the other — in-chat MCP tool-calling — shipped in v1.4.0). Both are now genuinely built and verified.
• Performance is CPU-bound: expect a few tokens/sec on 7B Q4 (the 62 GB RAM comfortably holds much larger models than the DVA 3221's 4 GB VRAM, at lower speed).

---

---

Install · التثبيت

Recommended (one-click updates): add the Package Source URL once:

DSM → Package Center → Settings → Package Sources → Add
Location: https://filamind-app.github.io/filamind-ai/

Manual install: download the SPK matching your device and upload via Package Center → Manual Install.

Device	SPK
DVA 3221 (GTX 1650, CUDA)	Filamind-1.4.1-dva3221.spk
DS1821+ (Ryzen V1500B, CPU AVX2)	Filamind-1.4.1-ds1821-plus.spk

Filamind AI v1.4.0

[1.4.0] — 2026-05-27

استدعاء الأدوات داخل المحادثة — الميزة التي كان عنوانها يسبق تنفيذها أصبحت حقيقية · In-chat MCP tool-calling: the headline feature that v1.3.0 announced but never wired is now actually built and tested.

Added — the real tool-call loop

• run_tool_loop() in control_daemon.py — a provider-agnostic multi-hop driver that finally connects the MCP runtime to the chat path. Flow: send the conversation + tool definitions to the model → if the model emits tool calls, execute each via MCPRegistry.call() → append the results → repeat until the model returns a plain answer or the 8-hop limit. Token usage accumulates across hops; a structured tool_trace is returned for the UI.
• Per-provider "turn" functions — each converts the canonical OpenAI-shaped history to its provider's native tool wire-format and parses tool calls back out:
  • _openai_turn — native tools + tool_calls (assistant) + role:"tool" results.
  • _anthropic_turn — tool_use content blocks + tool_result inside a user turn + stop_reason:"tool_use" detection.
  • _gemini_turn — function_declarations + functionCall parts + functionResponse parts.
  • _local_turn — b1620 has no native tools, so it emulates them: tool schemas are injected into the system prompt and the model is asked to emit <tool_call>{…}</tool_call>, which is parsed and executed. Best-effort — surfaced honestly in the UI.
• use_tools flag on POST /api/chat — when set, the loop runs for whichever provider is active. Off by default → existing single-shot paths untouched.
• Per-agent tool allow-list — agents table gains a tools JSON column (migrated in place). Empty = all enabled tools offered.
• UI — "🔧 Use tools" toggle in the chat toolbar (persisted in localStorage). Each turn that used tools renders an expandable tool-trace above the answer (tool name, arguments, result; red header on failure).

Verified

• End-to-end test: a "what is 6×7?" prompt drives the model to call calculator.eval({"expression":"6*7"}); the registry executes it (→ 42), the result is fed back, the model answers from it, and the trace + accumulated usage are captured. Cloud providers do this natively and reliably; the local b1620 emulation works but is hit-or-miss.

Honesty note

• This is the feature v1.3.0's headline claimed ("call tools mid-conversation") but never shipped. As of v1.4.0 the claim is true. The v1.3.0 entry and the in-app MCP tab were updated accordingly.

Still on the roadmap

• Per-agent tool-picker UI (backend column + allow-list logic ship now).
• Tier-B cloud tool servers (web search, GitHub, Home Assistant, Synology APIs).
• DS1821+ real AVX2 binary (still a stub — tracked separately).

---

---

Install · التثبيت

Recommended (one-click updates): add the Package Source URL once:

DSM → Package Center → Settings → Package Sources → Add
Location: https://filamind-app.github.io/filamind-ai/

Manual install: download the SPK matching your device and upload via Package Center → Manual Install.

Device	SPK
DVA 3221 (GTX 1650, CUDA)	Filamind-1.4.0-dva3221.spk
DS1821+ (Ryzen V1500B, CPU AVX2)	Filamind-1.4.0-ds1821-plus.spk

Filamind AI v1.3.2

[1.3.2] — 2026-05-27

تحصين أمني + إصلاحات واجهة + تصحيح الادعاءات لتطابق الواقع · Security hardening + UI fixes + honesty pass (claims corrected to match reality).

This release is the result of a candid 6-perspective internal audit. It fixes real security holes, a visible CSS regression, and corrects three places where earlier changelogs/docs overstated what the code does.

Security

• CSRF: closed the bypass + the coverage gaps. The old check used a substring match ("://" + host in referer), which a URL like https://evil/x?=://nas-host could satisfy. Replaced with strict urlparse().netloc host:port equality. Also added a centralized CSRF gate at the top of every mutating verb (do_POST/do_PUT/do_DELETE) — previously /api/users, /api/auth/login, /api/auth/setup, /api/config, /api/profile, /api/providers, /api/mcp/* had no CSRF protection, allowing a malicious page the admin opened to silently create a rogue admin account. Bearer-authed API clients remain exempt (no cookie → no CSRF surface).
• SSRF: defeated IP-literal encodings + redirect bypass. The model downloader and the fetch.get MCP tool both used naive string checks (host.startswith("10.")) that missed 169.254.169.254 (cloud metadata), all of IPv6, and decimal/hex IP encodings (http://2130706433/ = 127.0.0.1). Both now resolve via getaddrinfo and reject any private/loopback/link-local/CGNAT/reserved/IPv4-mapped address using the ipaddress module. The downloader additionally re-validates every HTTP redirect target (a public URL can no longer 302 into your LAN). Verified with a test matrix (decimal-IP, hex, metadata, file:// all blocked; github.com/huggingface.co allowed).
• Database file permissions. users.db (password + API-key hashes), mcp.db (audit log), and mcp_memory.db were created at the process umask (typically world-readable 0644). Now chmod 0600 at creation, and the etc/ directory is chmod 0700 in postinst — so co-resident DSM packages / other local users can't read the hashes.
• MCP memory store is now actually per-user. The memory.* tool stored everything in one global namespace (no user_id column), so any user could read/overwrite another user's notes. Added a composite (user_id, key) primary key; the registry now threads the caller's user_id into the handler via a thread-local context. Existing rows migrate into an anonymous namespace.
• Stored XSS in the admin Users table. A non-admin can set their own display_name; it was injected into the admin page via innerHTML unescaped, so <img onerror=…> would run in the admin's browser. Now HTML-escaped. The chat escapeHtml() also got a String() guard (it threw on non-string fields).
• Login brute-force + user-enumeration. Added a per-IP login throttle (10 attempts / 5 min → 429) and an equal-time path for unknown usernames (a missing user now runs a dummy PBKDF2 so response timing no longer reveals whether a username exists).
• DoS via giant Content-Length. _read_body now caps the read at 16 MB instead of allocating whatever the client claims.
• llama.cpp introspection endpoints locked down. /slots (which exposes other users' in-flight prompts on the shared engine), /metrics, and /props are now admin-only instead of any-authenticated-user.

Fixed

• Settings panels rendered completely unstyled. index.html referenced .card, .alert, .badge, .btn-danger, .modal-body but never defined them (and never loaded auth-common.css), so the MCP, About, and Providers cards plus every error/success banner showed as flat unstyled text — directly contradicting the v1.3.1 "modern visual pass". Added the missing component CSS (themed via the existing CSS variables) + a toggle switch and mini-table style for the MCP panel.
• Dead / stale UI removed. Deleted the empty, never-populated #providerSelect element from the top bar. Updated the Files/MCP toolbar tooltips (no longer "coming soon" — they open working panels). Replaced the stale "Coming in v1.3.1" MCP card (the app is v1.3.x) with an honest "tools are manual-only right now" notice.

Changed

• More of the UI now actually translates. The Settings tab navigation, modal title, Save/Cancel buttons, and the welcome screen were hardcoded English even though Arabic keys existed. They're now wired to i18n, and the welcome screen's "{agent} mode" suffix uses the translatable chat.mode_label_suffix instead of a concatenated English word (which broke RTL).

Honesty pass (docs corrected to match code)

• MCP claim corrected — the v1.3.0 headline ("lets the assistant call tools mid-conversation") was wrong; tools are manual-only. Corrected in this changelog, the v1.3.0 entry, and the in-app MCP tab.
• DS1821+ status corrected — now clearly marked as not yet functional (stub binary) at the top of this changelog and in the README, instead of implying full dual-device support.
• DSM Package Source caveat added — GitHub Pages is static and returns HTTP 405 to the POST requests DSM sends, so the "one-click update source" does not work as shipped; it needs a dynamic backend (e.g. a Cloudflare Worker). This limitation is now disclosed in docs/index.html and the in-app hint, instead of being presented as a working feature.

Security disclosure (transparency)

• 2026-05-27 — committed credential, remediated same day. During the initial public-repo bootstrap, a development NAS SSH password was briefly committed in copy_nas_libs.sh (~14 minutes public before the repo was made private). Remediation: the repo was deleted and recreated with clean history (the leaked commit SHAs now 404), the script was rewritten to take credentials from environment variables, GitHub secret-scanning + push-protection were enabled, and a local pre-push hook was added. The exposed password must still be treated as compromised and rotated — a history rewrite cannot recall data that was briefly public. Documented here per Keep-a-Changelog transparency norms.

---

---

Install · التثبيت

Recommended (one-click updates): add the Package Source URL once:

DSM → Package Center → Settings → Package Sources → Add
Location: https://filamind-app.github.io/filamind-ai/

Manual install: download the SPK matching your device and upload via Package Center → Manual Install.

Device	SPK
DVA 3221 (GTX 1650, CUDA)	Filamind-1.3.2-dva3221.spk
DS1821+ (Ryzen V1500B, CPU AVX2)	Filamind-1.3.2-ds1821-plus.spk

Filamind AI v1.3.1

[1.3.1] — 2026-05-27

تلميع UX: ربط زر MCP + إعادة تخطيط نافذة الإعدادات + تصميم عصري · UX polish: MCP button wired + redesigned Settings modal + modern visual pass.

Fixed

• Chat-toolbar MCP button was a dead end. It still showed the v1.2.0 "coming soon" alert even after the runtime + 8 tool servers shipped in v1.3.0. Click now opens Settings → MCP directly so users can immediately enable/disable servers and trigger them via "Run". Same fix applied to the Files button (routes to MCP tab for now until v1.4 ships per-agent file uploads).

Changed

• Settings modal completely re-laid-out. Replaces the cramped 640px-wide modal with a roomy 1024 × 720px panel and a vertical sidebar nav instead of an overflowing horizontal tab strip. Tabs are now icon-led (⚙ General, 🎛 Sampling, 🔑 Providers, 📊 Resources, 🧠 Models, 🖥 System, 🤖 Agents, 🔌 Connection, 🛠 MCP, ⓘ About) and stay anchored on the left as content scrolls. On screens narrower than 760 px it collapses to a single column with a horizontal scroll-tab strip — full-screen on phones.
• Open/close animation — backdrop fades in, modal slides up + scales (220 ms cubic-bezier easing). Switching tabs fades the content in (no more abrupt swap).
• Frosted backdrop — backdrop-filter: blur(6px) softens the chat behind the modal.

Improved (modern visual pass)

• Typography: added Inter to the font stack ahead of system fallbacks, tightened letter-spacing to -.005em, set base line-height to 1.55, headings to -.01em for that contemporary tight look.
• Shadow scale: three tiers — --shadow-sm for inputs/borders, --shadow for cards/dropdowns, --shadow-lg for the modal itself. Replaces the single flat shadow.
• Focus rings: real keyboard-accessible focus ring (var(--ring)) on every interactive element via :focus-visible. Click users see no ring change; tabbed users get a clear 3px accent halo.
• Scrollbars styled with a thin accent-on-hover scheme; works on Chromium/WebKit and Firefox.
• Dark mode bug fix: --bg-elev in dark theme was #28272500 (8-digit hex with 00 alpha = fully transparent), causing elevated surfaces to vanish. Corrected to #2a2926.
• Tab states: active tab now uses --accent-faint background instead of a thin border — clearer at a glance, especially in dark mode.

i18n

• No new strings (tab names use existing keys + emoji prefixes set via CSS ::before, so RTL flips correctly without touching JSON).

---

---

Install · التثبيت

Recommended (one-click updates): add the Package Source URL once:

DSM → Package Center → Settings → Package Sources → Add
Location: https://filamind-app.github.io/filamind-ai/

Manual install: download the SPK matching your device and upload via Package Center → Manual Install.

Device	SPK
DVA 3221 (GTX 1650, CUDA)	Filamind-1.3.1-dva3221.spk
DS1821+ (Ryzen V1500B, CPU AVX2)	Filamind-1.3.1-ds1821-plus.spk

Filamind AI v1.3.0

[1.3.0] — 2026-05-27

MCP — Model Context Protocol runtime + 8 Tier-A tool servers · أول إصدار يمنح المساعد القدرة على استدعاء أدوات حقيقية أثناء المحادثة.

Added — MCP Runtime

• package/bin/mcp_runtime.py (~300 lines) — in-process MCP-style tool registry with:
  • ToolServer base class + Tool descriptor (name, JSON-schema parameters, handler, sensitive flag for audit-log redaction).
  • Format adapters: tool.as_openai() / tool.as_anthropic() (input_schema) / tool.as_gemini() (function_declarations). One source of truth, three cloud-provider wire formats.
  • registry.call(tool, args, user_id, agent_id, hop) — dispatches, audit-logs, and enforces:
    • Rate limit: 60 calls/hour/user (configurable, sliding window).
    • Hop limit: 8 tool-call hops per chat turn (prevents runaway loops).
  • SQLite audit log at /var/packages/FilamindAI/etc/mcp.db with mcp_audit (id, ts, user_id, agent_id, tool, server, args_json, result_size, duration_ms, ok, error) and mcp_servers (name, enabled, config_json) tables. Indexed on ts DESC and (user_id, ts DESC) for fast UI queries.
  • Sensitive-args redaction — tools marked sensitive=True (e.g. shell.run) get <redacted> in the audit log instead of the raw arguments.

Added — 8 built-in Tool servers (Tier A)

• calculator.eval — safe arithmetic via AST whitelist. Allows + - * / // % **, abs/round/min/max/sum/len/pow/int/float, and constants pi, e. Blocks import, attribute access, lambdas, and unknown names.
• datetime.now / .parse / .offset — current time (UTC + local + epoch + weekday), parse 7+ common formats, add/subtract seconds.
• memory.set / .get / .list / .delete — persistent KV store in SQLite, 128-char key cap, 4 KB value cap.
• nas_info.snapshot — CPU count + load averages, total/available memory, disk usage per /volume*, GPU presence (/dev/nvidia*), uptime, hostname.
• filesystem.read_file / .list_dir — UTF-8 file read + directory listing under admin-defined allow_roots (defaults: /volume1/FilamindAI/shared, /volume1/AI/shared). 256 KB read cap. Path-traversal blocked via realpath + commonpath check.
• fetch.get — HTTPS GET against allow_hosts (defaults: github.com, huggingface.co, wikipedia.org, duckduckgo.com). 200 KB body cap, 10s timeout. Resolves DNS and refuses any private/RFC1918 IP (defeats DNS rebinding).
• shell.run — execute a command only if its exact string is in the admin's allow_commands list. Default list is empty → disabled until opted in. Suggests safe defaults: uptime, df -h, free -h, uname -a, date, hostname. Marked sensitive so args don't appear in the audit log.
• sqlite.query — read-only SELECT against SQLite files under allow-listed roots. Returns max 200 rows. Refuses anything that doesn't start with SELECT (case-insensitive).

Added — Daemon endpoints

• GET /api/mcp/servers — list registered servers + their tools + enabled state.
• GET /api/mcp/tools — flat list of all enabled tools (used by future cloud-provider tool-injection).
• GET /api/mcp/audit (admin) — last 100 audit log entries.
• POST /api/mcp/servers/<name>/toggle (admin) — {"enabled": true|false} enable / disable.
• POST /api/mcp/call — execute a tool. Body: {"tool": "calculator.eval", "args": {"expression": "2+2"}}. Returns {ok, result, server, duration_ms} or {ok:false, error, type} on tool-not-found / rate-limit / hop-limit.

Added — UI (Settings → MCP)

• Replaces the v1.2.0 "Coming in v1.3" placeholder with a real management surface:
  • Server list with per-server enable/disable toggle, tool count, expandable tool descriptions.
  • Tool tester — dropdown of all enabled tools + JSON arg input + Run button + result viewer.
  • Audit log viewer (admin only) — last 100 calls in a sortable table: timestamp, tool, duration, success/error.
  • Roadmap card listing Tier-B cloud integrations (Brave/Tavily search, GitHub, Home Assistant, Synology APIs) shipping in v1.3.1.
• 18 new i18n keys under mcp.* in both en.json and ar.json (natural Arabic phrasing — "قائمة الأدوات" / "سجل التدقيق").

Not yet wired (will follow in v1.3.0.x patches)

• Tool-call loop in _chat_router — endpoint-level tool injection per provider + auto-execution of returned tool_calls + multi-hop continuation. The runtime supports it; the chat router hasn't been touched yet.
• Per-agent allow-lists — agents table will get a tools JSON column; admin UI will pick which tools each agent can call.
• Tier C subprocess servers (puppeteer, real git, pdf) — needs Node.js bundled with the SPK; deferred to v1.4.

Build / install

• New files inside the SPK: package/bin/mcp_runtime.py, package/bin/mcp_servers.py. The daemon adds them to sys.path at boot and lazy-imports, so a missing/broken MCP module degrades gracefully (the daemon still serves chat).
• mcp.db created on first boot under etc/. No migration needed for existing installs.

---

---

Install · التثبيت

Recommended (one-click updates): add the Package Source URL once:

DSM → Package Center → Settings → Package Sources → Add
Location: https://filamind-app.github.io/filamind-ai/

Manual install: download the SPK matching your device and upload via Package Center → Manual Install.

Device	SPK
DVA 3221 (GTX 1650, CUDA)	Filamind-1.3.0-dva3221.spk
DS1821+ (Ryzen V1500B, CPU AVX2)	Filamind-1.3.0-ds1821-plus.spk

Filamind AI v1.2.5

Filamind AI v1.2.5

See CHANGELOG.md for details.

Install · التثبيت

Recommended (one-click updates): add the Package Source URL once:

DSM → Package Center → Settings → Package Sources → Add
Location: https://filamind-app.github.io/filamind-ai/

Manual install: download the SPK matching your device and upload via Package Center → Manual Install.

Device	SPK
DVA 3221 (GTX 1650, CUDA)	Filamind-1.2.5-dva3221.spk
DS1821+ (Ryzen V1500B, CPU AVX2)	Filamind-1.2.5-ds1821-plus.spk