Skip to content

LocalAI Cowork v0.3.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 10:03
v0.3.1
f221272
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LocalAI Cowork v0.3.1

v0.3.1 fixes persistent provider runs and brings the distributed local-first runtime into the stable release line.

Highlights

  • Provider runs work again: Ollama, OpenRouter, OpenAI, and custom OpenAI-compatible profiles no longer fail with credential scope is not supported when a persistent local run starts.
  • Credentials stay native: API keys are resolved inside the Rust backend from the operating-system credential store. They are never returned to the WebView and are transferred only through authenticated local IPC into the daemon's encrypted per-device binding.
  • Persistent local execution: Desktop chats and schedules can use the durable local daemon with recoverable run state, encrypted model configuration, workspace bindings, MCP bindings, approvals, input requests, checkpoints, and artifacts.
  • Distributed runtime foundation: The release includes personal-device execution, server/runner components, remote desktop and terminal foundations, versioned contracts, deployment assets, and the Android remote-control shell.
  • Security and reliability: Session-retention, refresh-token replay protection, browser-session rotation, worker soak coverage, and release/security gates were expanded.

Provider credential fix

The previous persistent-run path tried to read llm_profile secrets through the frontend credential IPC. That read is intentionally denied by the security boundary. v0.3.1 replaces it with a native credential bridge:

  1. Rust reads the profile credential from the operating-system credential store.
  2. The authenticated local IPC forwards it directly to the personal daemon.
  3. The daemon encrypts the provider binding and resolves it when creating the run.
  4. Ollama follows the same path without requiring an API key.

Regression tests cover hosted profiles, Ollama profiles, native credential resolution, encrypted immediate-run binding, and provider metadata mirroring.

Installation and update integrity

  • Windows: LocalAI-Cowork-Setup-x64.exe
  • Linux: AppImage, DEB, and RPM packages
  • In-app updates: signed Tauri updater artifacts and latest.json
  • Verification: SHA256SUMS, CycloneDX SBOM, third-party notices, provenance, and GitHub attestations

Windows publisher notice: Unless Authenticode credentials are configured for the release workflow, Windows may display “Unknown publisher.” Verify SHA256SUMS and the GitHub artifact attestations before running the installer. In-app updater artifacts are independently protected by the mandatory Tauri updater signature.

Full changelog: v0.3.0...v0.3.1

Assets 17
Loading