@jossuealcala/madre 1.0.1 → 1.0.3

package/src/modules/intents.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Intenciones: how hard each agent should think for the message being written.
 //
 // It reads the request, the conversation it belongs to and what this project has measured, and
@@ -17,6 +19,7 @@ import { join } from 'node:path';
 import { defineModule } from './sdk.mjs';
 import { t } from '../i18n.mjs';
 import { IntentsDesk } from './intents-desk.mjs';
+import { moduleOnIn } from '../module-scope.mjs';
 
 const desks = new Map();
 // One desk per project room, made the first time anything asks for it.
@@ -38,7 +41,8 @@ export function deskFor(ctx) {
   return desks.get(where.roomDir);
 }
 
-const enabled = (ctx) => ctx.config?.modules?.intents?.enabled !== false;
+// On unless turned off, for every project or for this one (module-scope.mjs).
+const enabled = (ctx) => moduleOnIn(ctx.config?.modules?.intents ?? {}, ctx.roomId ?? null, true);
 const count = (value) => Math.max(0, Math.min(50, Number.parseInt(value, 10) || 0));
 const modeOf = (value) => (Number.isInteger(value) && value >= 0 && value <= 4 ? value : null);
 const nameOrNull = (value) => (typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,120}$/.test(value) ? value : null);
@@ -46,10 +50,10 @@ const nameOrNull = (value) => (typeof value === 'string' && /^[A-Za-z0-9][A-Za-z
 export default defineModule({
   id: 'intents',
   configKey: 'intents',
-  name: 'Intenciones',
+  name: 'Suggested effort',
   vendor: 'MADRE',
   version: '1.0.0',
-  summary: 'Suggests how hard Claude Code and Codex should think for the message you are writing, from what was measured on this project. It suggests; you choose.',
+  summary: 'Suggests how hard Claude Code and Codex should think about your message, based on what worked in this project. You decide.',
   creates: ['nothing in the project', 'its measurements next to the project, in intents.jsonl'],
   settings: { enabled: true },
   card: 'intents',
@@ -64,7 +68,7 @@ export default defineModule({
       method: 'GET', path: '/api/intents',
       handler: async (ctx, { url }) => {
         const desk = deskFor(ctx);
-        if (!desk) return { status: 503, body: { error: t('Intenciones is not available in this project.') } };
+        if (!desk) return { status: 503, body: { error: t('Suggested effort is not available in this project.') } };
         let models = {};
         try { models = JSON.parse(url.searchParams.get('models') ?? '{}') ?? {}; } catch { models = {}; }
         const chosen = Object.fromEntries(Object.entries(models).map(([agent, model]) => [agent, nameOrNull(model)]));
@@ -97,8 +101,8 @@ export default defineModule({
       method: 'POST', path: '/api/intents/calibrate',
       handler: async (ctx, { payload }) => {
         const desk = deskFor(ctx);
-        if (!desk) return { status: 503, body: { error: t('Intenciones is not available in this project.') } };
-        if (!enabled(ctx)) return { status: 409, body: { error: t('Turn Intenciones on first.') } };
+        if (!desk) return { status: 503, body: { error: t('Suggested effort is not available in this project.') } };
+        if (!enabled(ctx)) return { status: 409, body: { error: t('Turn Suggested effort on first.') } };
         const result = await desk.start({
           kind: payload?.kind === 'full' ? 'full' : 'quick',
           agent: String(payload?.agent ?? ''),
@@ -113,7 +117,7 @@ export default defineModule({
     {
       method: 'POST', path: '/api/intents/answer',
       handler: async (ctx, { payload }) => {
-        const result = deskFor(ctx)?.answer(String(payload?.choice ?? '')) ?? { error: t('Intenciones is not available in this project.') };
+        const result = deskFor(ctx)?.answer(String(payload?.choice ?? '')) ?? { error: t('Suggested effort is not available in this project.') };
         return { status: result.error ? 409 : 200, body: result };
       },
     },

package/src/modules/local-models.mjs

@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
+// What this computer can do with a local AI, measured and not assumed (2026-10-16).
+//
+// The local AI was sized for one machine: a 16 GB Mac ran a 3B model and trained a 1.5B one, and
+// a 32 GB one trained a 3B. A person with a 128 GB Mac Studio or a 24 GB graphics card can run and
+// train far larger models, and a person with 8 GB should not be offered what will not load. This
+// reads the hardware once — the memory the model would live in and what would compute — and sets
+// it against the minimums of each model size, so the room can say, model by model and feature by
+// feature, what this computer runs, what it trains and what it should leave off.
+//
+// The minimums are deliberately conservative, for the whole computer, not the model alone:
+//   · run    a 4-bit model in Ollama with an 8k window, the system and the browser still open;
+//   · train  a LoRA with mlx-lm (on a 4-bit base from 3B up, QLoRA; at full precision below that).
+// On a Mac the memory is unified and the GPU may use about three quarters of it; on an NVIDIA card
+// what counts is its own memory (VRAM). Without either, a model still runs on the processor —
+// slower — and nothing is trained: a LoRA on a processor takes days.
+
+import { execFile } from 'node:child_process';
+import { arch as osArch, cpus as osCpus, platform as osPlatform, totalmem as osTotalmem } from 'node:os';
+
+const GB = 1024 ** 3;
+
+// One family, every size, so a recommendation is a step up or down a single ladder and a model
+// trained at one size is the same model at another. Qwen2.5 Instruct: multilingual (it answers in
+// the human's language), open weights, an Ollama tag and an MLX 4-bit build at every size.
+export const MODEL_TIERS = [
+  { id: '0.5b', params: 0.5, label: 'Qwen2.5 0.5B', ollama: 'qwen2.5:0.5b', base: 'Qwen/Qwen2.5-0.5B-Instruct', runGb: 4, trainGb: 8 },
+  { id: '1.5b', params: 1.5, label: 'Qwen2.5 1.5B', ollama: 'qwen2.5:1.5b', base: 'Qwen/Qwen2.5-1.5B-Instruct', runGb: 6, trainGb: 12 },
+  { id: '3b', params: 3, label: 'Qwen2.5 3B', ollama: 'qwen2.5:3b', base: 'mlx-community/Qwen2.5-3B-Instruct-4bit', quantized: true, runGb: 8, trainGb: 16 },
+  { id: '7b', params: 7, label: 'Qwen2.5 7B', ollama: 'qwen2.5:7b', base: 'mlx-community/Qwen2.5-7B-Instruct-4bit', quantized: true, runGb: 12, trainGb: 24 },
+  { id: '14b', params: 14, label: 'Qwen2.5 14B', ollama: 'qwen2.5:14b', base: 'mlx-community/Qwen2.5-14B-Instruct-4bit', quantized: true, runGb: 20, trainGb: 36 },
+  { id: '32b', params: 32, label: 'Qwen2.5 32B', ollama: 'qwen2.5:32b', base: 'mlx-community/Qwen2.5-32B-Instruct-4bit', quantized: true, runGb: 36, trainGb: 64 },
+  { id: '72b', params: 72, label: 'Qwen2.5 72B', ollama: 'qwen2.5:72b', base: 'mlx-community/Qwen2.5-72B-Instruct-4bit', quantized: true, runGb: 64, trainGb: 128 },
+];
+
+// What the local AI does in MADRE, and the smallest model each one is worth turning on with. Below
+// it the feature works but answers poorly enough that it is better left off.
+export const LOCAL_FEATURES = [
+  { id: 'search', needs: null },            // search by meaning: an embedding model, ~0.3 GB
+  { id: 'archivist', needs: '3b' },         // the notes it distils from each conversation
+  { id: 'agent', needs: '3b' },             // @madre answering in a project
+  { id: 'coordinator', needs: '7b' },       // the Coordinator answering about every project
+  { id: 'train', needs: '1.5b', train: true }, // training your own model on what the project knows
+];
+
+const run = (file, args, { timeoutMs = 2500, exec = execFile } = {}) => new Promise((resolve) => {
+  try {
+    exec(file, args, { timeout: timeoutMs, windowsHide: true }, (error, stdout) => resolve(error ? null : String(stdout ?? '')));
+  } catch { resolve(null); }
+});
+
+// NVIDIA's own tool, if the card and its driver are there: name and memory of each card, in MiB.
+export function parseNvidia(output) {
+  return String(output ?? '').split('\n').map((line) => line.split(',').map((part) => part.trim())).filter(([name, mib]) => name && Number.isFinite(Number(mib)))
+    .map(([name, mib]) => ({ name, vramGb: Math.round(Number(mib) / 1024) }));
+}
+
+// The hardware, read once. Everything is injectable so the reading can be tested on any machine.
+export async function detectHardware({ platform = osPlatform(), arch = osArch(), totalmem = osTotalmem(), cpus = osCpus(), exec = execFile } = {}) {
+  const memoryGb = Math.round(totalmem / GB);
+  const cores = Array.isArray(cpus) ? cpus.length : 0;
+  let chip = Array.isArray(cpus) && cpus[0]?.model ? String(cpus[0].model).trim() : null;
+  if (platform === 'darwin') {
+    const brand = await run('sysctl', ['-n', 'machdep.cpu.brand_string'], { exec });
+    if (brand?.trim()) chip = brand.trim();
+  }
+  // Apple silicon: one memory for the processor and the GPU, which MLX and Ollama both use.
+  if (platform === 'darwin' && arch === 'arm64') return { platform, arch, chip, cores, memoryGb, accelerator: 'apple', acceleratorGb: memoryGb, gpus: [] };
+  const gpus = parseNvidia(await run('nvidia-smi', ['--query-gpu=name,memory.total', '--format=csv,noheader,nounits'], { exec }));
+  if (gpus.length) {
+    // A model lives on one card unless it is split; the largest card is what one model may count on.
+    const largest = Math.max(...gpus.map((gpu) => gpu.vramGb));
+    return { platform, arch, chip, cores, memoryGb, accelerator: 'nvidia', acceleratorGb: largest, gpus };
+  }
+  return { platform, arch, chip, cores, memoryGb, accelerator: 'cpu', acceleratorGb: 0, gpus: [] };
+}
+
+// The memory a model may count on, in the units the minimums are written in (a whole Mac's).
+// A Mac's GPU takes about three quarters of the unified memory, which the minimums already allow
+// for; an NVIDIA card gives the model all of its own, so its VRAM counts for a third more.
+export function usableGb(hardware) {
+  if (!hardware) return 0;
+  if (hardware.accelerator === 'apple') return hardware.acceleratorGb;
+  if (hardware.accelerator === 'nvidia') return Math.round(hardware.acceleratorGb / 0.75);
+  return hardware.memoryGb;
+}
+
+// Model by model: does it run here (fast, slowly on the processor, or not), does it train here,
+// and why not. Then the one to recommend for each, and what each feature of the local AI may use.
+export function hardwareFit(hardware) {
+  const usable = usableGb(hardware);
+  const accelerated = hardware?.accelerator === 'apple' || hardware?.accelerator === 'nvidia';
+  const models = MODEL_TIERS.map((tier) => {
+    const runs = usable >= tier.runGb ? (accelerated ? 'yes' : 'slow') : 'no';
+    const trains = accelerated && usable >= tier.trainGb ? 'yes' : 'no';
+    const trainWhy = !accelerated ? 'no-accelerator' : trains === 'no' ? 'memory' : null;
+    return { ...tier, run: runs, train: trains, runWhy: runs === 'no' ? 'memory' : runs === 'slow' ? 'no-accelerator' : null, trainWhy };
+  });
+  // Recommended: the largest that runs well, but no larger than 14B for the everyday model of a
+  // project — beyond that answers come slowly enough to hold the room up. On a processor alone,
+  // no larger than 3B. Training: the largest that trains, no larger than what it then runs.
+  const runnable = models.filter((model) => model.run === 'yes');
+  const everyday = (accelerated ? runnable.filter((model) => model.params <= 14) : models.filter((model) => model.run === 'slow' && model.params <= 3));
+  const run = everyday.at(-1) ?? null;
+  const trainable = models.filter((model) => model.train === 'yes' && runnable.includes(model));
+  const train = trainable.at(-1) ?? null;
+  const largestRun = (accelerated ? runnable : models.filter((model) => model.run === 'slow')).at(-1) ?? null;
+  const order = MODEL_TIERS.map((tier) => tier.id);
+  const features = LOCAL_FEATURES.map((feature) => {
+    if (!feature.needs) return { id: feature.id, ok: true, needs: null };
+    const at = order.indexOf(feature.needs);
+    const ok = feature.train ? Boolean(train) && order.indexOf(train.id) >= at : Boolean(largestRun) && order.indexOf(largestRun.id) >= at;
+    return { id: feature.id, ok, needs: feature.needs, slow: !feature.train && ok && !accelerated };
+  });
+  return { hardware, usableGb: usable, accelerated, models, recommended: { run, train, largestRun }, features };
+}
+
+let measured = null;
+// Read once per process: the hardware does not change under a running room.
+export function hardwareOnce(options) {
+  if (!measured) measured = detectHardware(options).then(hardwareFit).catch(() => hardwareFit({ accelerator: 'cpu', acceleratorGb: 0, memoryGb: 0, gpus: [] }));
+  return measured;
+}

package/src/modules/mcp-connect.mjs

@@ -0,0 +1,293 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
+// CONNECT MCP: MCP servers a person adds to one project, for its agents (2026-10-14).
+//
+// The settings live in the project's Settings › Connect MCP, and only there: this module has no
+// card in MODULES (`card: 'settings'`). What it does, in the order a server goes through it:
+//
+//   1. Added by hand (a command, or an address with no sign-in, a token or OAuth) or imported from
+//      the person's other apps (.mcp.json, Claude Code, Codex, Gemini CLI, Cursor, opencode.json).
+//      Secrets go to the vault; src/mcp/connect.mjs says how.
+//   2. Checked at once: MADRE starts it through the same proxy a turn uses, does the MCP
+//      handshake and reads its tools. A server that does not answer stays out of every turn and
+//      its row says why, so a broken server costs a line in Settings, never a turn.
+//   3. Handed to the turns of this project, through src/mcp/proxy.mjs, with the tools that read
+//      from #1 and the ones that act from the mode chosen for it (#4 unless lowered).
+
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { defineModule } from './sdk.mjs';
+import { summary as vaultSummary } from '../vault.mjs';
+import { declareDestinations } from '../outbound.mjs';
+import { t } from '../i18n.mjs';
+import {
+  ACTION_MODES, SERVER_ID, authorizeUrl, cleanServer, discoverOAuth, exchangeCode, forgetServerSecrets,
+  grantFrom, importable, keepOAuth, keepSecrets, pkce, readMcp, readOAuth, registerClient, writeMcp,
+} from '../mcp/connect.mjs';
+
+export const PROXY = fileURLToPath(new URL('../mcp/proxy.mjs', import.meta.url));
+const CHECK_MS = 30000;
+
+// The argv every CLI is given for a connected server: the proxy, the project and the server. No
+// secret, ever; the allowed tools travel so the proxy can refuse the others.
+export const proxyArgs = ({ stateRoot, projectRoot, id, allow = null }) => [PROXY, '--state', stateRoot, '--project', projectRoot, '--server', id, ...(allow ? ['--allow', allow.join(',')] : [])];
+
+// Starts the server the way a turn would and asks it what it has. Resolves with its tools — each
+// with whether it only reads — or with the reason it did not answer.
+export function checkServer({ stateRoot, projectRoot, id, timeoutMs = CHECK_MS, command = process.execPath }) {
+  return new Promise((resolve) => {
+    let child;
+    let out = '';
+    let err = '';
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try { child?.stdin.end(); child?.kill('SIGTERM'); } catch { /* gone */ }
+      resolve(result);
+    };
+    const timer = setTimeout(() => finish({ ok: false, problem: t('it did not answer within {seconds}s', { seconds: Math.round(timeoutMs / 1000) }) }), timeoutMs);
+    try {
+      child = spawn(command, proxyArgs({ stateRoot, projectRoot, id }), { cwd: projectRoot, stdio: ['pipe', 'pipe', 'pipe'], shell: false, windowsHide: true });
+    } catch (error) { finish({ ok: false, problem: error.message }); return; }
+    const send = (message) => { if (!settled) child.stdin.write(`${JSON.stringify(message)}\n`); };
+    child.stdin.on('error', () => {});
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk) => { err = `${err}${chunk}`.slice(-2000); });
+    child.on('error', (error) => finish({ ok: false, problem: error.message }));
+    child.on('close', (code) => finish({ ok: false, problem: lastLine(err) ?? t('it exited with code {code} before it spoke', { code }) }));
+    let info = null;
+    child.stdout.on('data', (chunk) => {
+      out += chunk;
+      for (let newline = out.indexOf('\n'); newline >= 0; newline = out.indexOf('\n')) {
+        const line = out.slice(0, newline).trim();
+        out = out.slice(newline + 1);
+        let message;
+        try { message = JSON.parse(line); } catch { continue; }
+        if (message.id === 1) {
+          if (message.error) { finish(authFailure(message.error.message) ?? { ok: false, problem: String(message.error.message ?? 'initialize failed').slice(0, 300) }); return; }
+          info = message.result?.serverInfo ?? null;
+          send({ jsonrpc: '2.0', method: 'notifications/initialized' });
+          send({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
+        } else if (message.id === 2) {
+          if (message.error) { finish(authFailure(message.error.message) ?? { ok: false, problem: String(message.error.message ?? 'tools/list failed').slice(0, 300) }); return; }
+          const tools = (message.result?.tools ?? []).filter((tool) => typeof tool?.name === 'string').slice(0, 200).map((tool) => ({
+            name: tool.name,
+            readOnly: tool.annotations?.readOnlyHint === true,
+            description: String(tool.description ?? '').replace(/\s+/g, ' ').trim().slice(0, 160),
+          }));
+          finish({ ok: true, tools, server: info ? { name: String(info.name ?? ''), version: String(info.version ?? '') } : null });
+          return;
+        }
+      }
+    });
+    send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'madre', version: '1' } } });
+  });
+}
+const lastLine = (text) => String(text ?? '').trim().split('\n').filter(Boolean).at(-1)?.replace(/^MADRE MCP [^:]+:\s*/, '').slice(0, 300) ?? null;
+const authFailure = (message) => (/MADRE_AUTH_REQUIRED/.test(String(message ?? '')) ? { ok: false, needsAuth: true, problem: /refused the credentials/.test(String(message)) ? t('The server refused the credentials. Check the token.') : t('Sign in to this server again.') } : null);
+
+// What a turn is handed for one server: the tools that read, and the ones that act when the mode
+// allows them. Nothing for a ghost, nothing unchecked, nothing for an agent it was not given to.
+export function serverForTurn(server, { stateRoot, projectRoot, agent, mode }) {
+  if (!server.enabled || server.problem || !server.tools?.length || mode === 0) return null;
+  if (server.agents && !server.agents.includes(agent)) return null;
+  const reading = server.tools.filter((tool) => tool.readOnly).map((tool) => tool.name);
+  const acting = server.tools.filter((tool) => !tool.readOnly).map((tool) => tool.name);
+  const actionsFrom = ACTION_MODES.includes(server.actions) ? server.actions : 4;
+  const acts = mode >= actionsFrom;
+  const tools = acts ? [...reading, ...acting] : reading;
+  if (!tools.length) return null;
+  return {
+    name: server.id,
+    command: process.execPath,
+    args: proxyArgs({ stateRoot, projectRoot, id: server.id, allow: tools }),
+    env: {},
+    tools,
+    // The core keeps the rule for #4 itself: tools that act and need #4 are declared as sending.
+    sends: actionsFrom === 4 ? acting : [],
+    brief: `${server.label}${server.server?.name && server.server.name !== server.label ? ` (${server.server.name})` : ''}, connected by the human for this project.${acting.length ? acts ? ' Its tools that act are on in this turn: say what you will do before calling one.' : ` Only its tools that read are on; the ones that act need #${actionsFrom}.` : ''}`,
+  };
+}
+
+// What Settings shows: everything but values. Whether a secret is held is said by name.
+async function publicServers(ctx) {
+  const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+  const held = new Set((await vaultSummary(ctx.stateRoot, 'mcp').catch(() => [])).map((one) => one.name));
+  return Promise.all(servers.map(async (server) => ({
+    ...server,
+    signedIn: server.auth === 'oauth' ? Boolean((await readOAuth(ctx.stateRoot, server.id))?.access_token) : undefined,
+    tokenHeld: server.auth === 'token' ? held.has(`${server.id}_token`) : undefined,
+  })));
+}
+
+async function saveChecked(ctx, server) {
+  const check = await checkServer({ stateRoot: ctx.stateRoot, projectRoot: ctx.projectRoot, id: server.id });
+  const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+  const next = servers.map((one) => (one.id === server.id ? {
+    ...one,
+    tools: check.ok ? check.tools : one.tools,
+    server: check.ok ? check.server : one.server ?? null,
+    checkedAt: new Date().toISOString(),
+    problem: check.ok ? null : check.problem,
+    needsAuth: check.needsAuth || undefined,
+  } : one));
+  await writeMcp(ctx.stateRoot, ctx.projectRoot, { servers: next });
+  await ctx.record('mcp.checked', { id: server.id, ok: check.ok, tools: check.ok ? check.tools.length : undefined, problem: check.ok ? undefined : check.problem });
+  return check;
+}
+
+// A refusal of cleanServer, in the room's language: its slots filled, a command's reason too.
+const said = ({ error, errorArgs = {} }) => t(error, { ...errorArgs, ...(errorArgs.why ? { why: t(errorArgs.why, errorArgs.whyArgs ?? {}) } : {}) });
+const refuseFromPhone = (viaPhone) => (viaPhone ? { status: 403, body: { error: t('MCP servers are connected from the computer, not from the phone.') } } : null);
+// Sign-ins in flight: the state the server will send back, and what is needed to finish.
+const pending = new Map();   // state -> { id, verifier, clientId, redirectUri, authorization, resource, at }
+
+export default defineModule({
+  id: 'mcp',
+  name: 'Outside tools (MCP)',
+  vendor: 'MADRE',
+  version: '1.0.0',
+  summary: 'MCP servers you add to this project, for its agents: a command on this computer or an address on the internet. Each one is started and checked before any agent can use it; tools that read work from #1, tools that act from the mode you choose.',
+  creates: ['the list of servers, kept in MADRE\'s own folder for this project, never inside the project', 'its secrets in MADRE\'s vault, never in the list'],
+  requires: ['nothing; a server is checked when you add it'],
+  card: 'settings',
+  settings: { enabled: true },
+  async status(ctx) {
+    const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+    const ready = servers.filter((one) => one.enabled && !one.problem && one.tools?.length).length;
+    return { status: { installed: true, detail: servers.length ? t('{ready} of {total} tools ready', { ready, total: servers.length }) : t('no tools yet') } };
+  },
+  async toolsForTurn(ctx, turn) {
+    const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+    return servers.map((server) => serverForTurn(server, { stateRoot: ctx.stateRoot, projectRoot: ctx.projectRoot, agent: turn.agent, mode: Number(turn.mode) })).filter(Boolean);
+  },
+  routes: [
+    { method: 'GET', path: '/api/x/mcp/servers', async handler(ctx) { return { status: 200, body: { servers: await publicServers(ctx) } }; } },
+    {
+      method: 'POST', path: '/api/x/mcp/servers',
+      async handler(ctx, { payload, viaPhone }) {
+        const refused = refuseFromPhone(viaPhone); if (refused) return refused;
+        const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+        const before = servers.find((one) => one.id === payload?.id);
+        const made = cleanServer({ ...payload, replace: Boolean(payload?.replace && before) }, { existing: servers });
+        if (made.error) return { status: 400, body: { error: said(made) } };
+        const kept = await keepSecrets(ctx.stateRoot, made.secrets);
+        if (!kept.ok) return { status: 400, body: { error: t(kept.error) } };
+        // An edit keeps what the check learned until it is checked again.
+        const server = before ? { ...made.server, tools: before.tools, server: before.server } : made.server;
+        await writeMcp(ctx.stateRoot, ctx.projectRoot, { servers: [...servers.filter((one) => one.id !== server.id), server] });
+        await ctx.record('mcp.connected', { id: server.id, transport: server.transport, auth: server.auth });
+        const check = server.auth === 'oauth' && !(await readOAuth(ctx.stateRoot, server.id))?.access_token ? { ok: false, needsAuth: true } : await saveChecked(ctx, server);
+        return { status: 200, body: { check, servers: await publicServers(ctx) } };
+      },
+    },
+    {
+      method: 'POST', path: /^\/api\/x\/mcp\/servers\/([a-z][a-z0-9-]{0,30})\/(check|toggle|actions|agents|remove)$/,
+      async handler(ctx, { payload, params: [id, what], viaPhone }) {
+        const refused = refuseFromPhone(viaPhone); if (refused) return refused;
+        const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+        const server = servers.find((one) => one.id === id);
+        if (!server) return { status: 404, body: { error: t('That server is not connected in this project.') } };
+        if (what === 'check') return { status: 200, body: { check: await saveChecked(ctx, server), servers: await publicServers(ctx) } };
+        if (what === 'remove') {
+          await forgetServerSecrets(ctx.stateRoot, server);
+          await writeMcp(ctx.stateRoot, ctx.projectRoot, { servers: servers.filter((one) => one.id !== id) });
+          await ctx.record('mcp.removed', { id });
+          return { status: 200, body: { servers: await publicServers(ctx) } };
+        }
+        const change = what === 'toggle' ? { enabled: payload?.enabled === true }
+          : what === 'actions' ? { actions: ACTION_MODES.includes(Number(payload?.actions)) ? Number(payload.actions) : server.actions }
+            : { agents: Array.isArray(payload?.agents) && payload.agents.length ? payload.agents.filter((one) => /^[a-z0-9_-]+$/.test(one)) : null };
+        await writeMcp(ctx.stateRoot, ctx.projectRoot, { servers: servers.map((one) => (one.id === id ? { ...one, ...change } : one)) });
+        return { status: 200, body: { servers: await publicServers(ctx) } };
+      },
+    },
+    // What the person's other apps already have: names, places and what kind; never a value.
+    {
+      method: 'GET', path: '/api/x/mcp/import',
+      async handler(ctx, { viaPhone }) {
+        const refused = refuseFromPhone(viaPhone); if (refused) return refused;
+        const found = await importable({ projectRoot: ctx.projectRoot });
+        const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+        return { status: 200, body: { found: found.map((one, index) => ({ index, source: one.source, name: one.name, id: one.id, transport: one.transport, where: one.url ?? one.command?.join(' ') ?? '', env: Object.keys(one.env ?? {}), headers: Object.keys(one.headers ?? {}), disabled: one.disabled, taken: servers.some((server) => server.id === one.id) })) } };
+      },
+    },
+    {
+      method: 'POST', path: '/api/x/mcp/import',
+      async handler(ctx, { payload, viaPhone }) {
+        const refused = refuseFromPhone(viaPhone); if (refused) return refused;
+        const found = await importable({ projectRoot: ctx.projectRoot });
+        const picks = (Array.isArray(payload?.picks) ? payload.picks : []).map(Number).filter((index) => Number.isInteger(index) && found[index]);
+        const results = [];
+        for (const index of picks) {
+          const one = found[index];
+          const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+          // Every value an app kept is treated as a secret: the vault is the only place it goes.
+          const quote = (word) => (/[\s"'\\$`|&;<>()*?[#~]/.test(word) ? `'${String(word).replace(/'/g, '')}'` : word);
+          const made = cleanServer({
+            id: one.id, label: one.name, transport: one.transport, url: one.url, auth: one.url && Object.keys(one.headers ?? {}).some((name) => name.toLowerCase() === 'authorization') ? 'none' : 'none',
+            command: one.command ? one.command.map(quote).join(' ') : '',
+            env: Object.entries(one.env ?? {}).map(([name, value]) => ({ name, value: String(value), secret: true })),
+            headers: Object.entries(one.headers ?? {}).map(([name, value]) => ({ name, value: String(value), secret: true })),
+            enabled: !one.disabled,
+          }, { existing: servers });
+          if (made.error) { results.push({ id: one.id, ok: false, problem: said(made) }); continue; }
+          const kept = await keepSecrets(ctx.stateRoot, made.secrets);
+          if (!kept.ok) { results.push({ id: one.id, ok: false, problem: t(kept.error) }); continue; }
+          await writeMcp(ctx.stateRoot, ctx.projectRoot, { servers: [...servers, made.server] });
+          await ctx.record('mcp.connected', { id: made.server.id, transport: made.server.transport, auth: made.server.auth, from: one.source });
+          const check = await saveChecked(ctx, made.server);
+          results.push({ id: made.server.id, ok: check.ok, problem: check.problem, needsAuth: check.needsAuth });
+        }
+        return { status: 200, body: { results, servers: await publicServers(ctx) } };
+      },
+    },
+    // OAuth: the page asks for the address to open; the server comes back to the callback below.
+    {
+      method: 'POST', path: /^\/api\/x\/mcp\/servers\/([a-z][a-z0-9-]{0,30})\/signin$/,
+      async handler(ctx, { params: [id], viaPhone, url }) {
+        const refused = refuseFromPhone(viaPhone); if (refused) return refused;
+        const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+        const server = servers.find((one) => one.id === id && one.transport === 'http');
+        if (!server) return { status: 404, body: { error: t('That server is not connected in this project.') } };
+        // MADRE's own process reaches this server to sign in: the list of what left the machine
+        // names it as the server the person connected, not as an address nothing declares.
+        declareDestinations('mcp', [{ id: server.id, host: new URL(server.url).hostname, to: t('{name} · an MCP server you connected', { name: server.label }), what: t('the sign-in: how to sign in, the registration of MADRE and the token'), when: t('when you press Sign in on it'), where: t('Settings › Outside tools (MCP)') }]);
+        const found = await discoverOAuth(server.url).catch((error) => ({ ok: false, problem: error.message }));
+        if (!found.ok) return { status: 409, body: { error: t(found.problem) } };
+        const redirectUri = `${url.origin}/api/x/mcp/oauth/callback`;
+        const client = await registerClient(found.authorization, redirectUri).catch((error) => ({ ok: false, problem: error.message }));
+        if (!client.ok) return { status: 409, body: { error: t('The server did not let MADRE register: {problem}', { problem: client.problem }) } };
+        const { verifier, challenge } = pkce();
+        const state = randomBytes(18).toString('hex');
+        for (const [key, one] of pending) if (Date.now() - one.at > 15 * 60000) pending.delete(key);
+        pending.set(state, { id, verifier, clientId: client.clientId, redirectUri, authorization: found.authorization, resource: found.resource, at: Date.now() });
+        return { status: 200, body: { open: authorizeUrl({ authorization: found.authorization, clientId: client.clientId, redirectUri, challenge, state, resource: found.resource, scopes: found.scopes }) } };
+      },
+    },
+    {
+      method: 'GET', path: '/api/x/mcp/oauth/callback',
+      async handler(ctx, { url }) {
+        const page = (title, text) => ({ status: 200, html: `<!doctype html><meta charset="utf-8"><title>MADRE</title><body style="font:15px system-ui;margin:12vh auto;max-width:34em;padding:0 16px;color:#1d2321"><h1 style="font-size:20px">${title}</h1><p>${text}</p></body>` });
+        const state = url.searchParams.get('state') ?? '';
+        const flow = pending.get(state);
+        pending.delete(state);
+        if (!flow) return page(t('This sign-in expired'), t('Sign in again from Settings › Outside tools (MCP).'));
+        if (url.searchParams.get('error')) return page(t('The sign-in was not completed'), t('The server said: {problem}', { problem: String(url.searchParams.get('error_description') ?? url.searchParams.get('error')).replace(/[<>&]/g, '') }));
+        const done = await exchangeCode({ authorization: flow.authorization, clientId: flow.clientId, redirectUri: flow.redirectUri, code: url.searchParams.get('code') ?? '', verifier: flow.verifier, resource: flow.resource }).catch((error) => ({ ok: false, problem: error.message }));
+        if (!done.ok) return page(t('The sign-in was not completed'), t('The server said: {problem}', { problem: String(done.problem).replace(/[<>&]/g, '') }));
+        await keepOAuth(ctx.stateRoot, flow.id, { ...grantFrom(done.tokens), token_endpoint: flow.authorization.token_endpoint, client_id: flow.clientId, resource: flow.resource });
+        const { servers } = await readMcp(ctx.stateRoot, ctx.projectRoot);
+        const server = servers.find((one) => one.id === flow.id);
+        const check = server ? await saveChecked(ctx, server) : { ok: false };
+        return page(check.ok ? t('Connected') : t('Signed in'), check.ok ? t('{name} is connected to this project with {n} tools. You can close this tab and go back to MADRE.', { name: server?.label ?? flow.id, n: check.tools.length }) : t('You are signed in, but the server did not answer yet: {problem}. Check it again from Settings › Outside tools (MCP).', { problem: String(check.problem ?? '').replace(/[<>&]/g, '') }));
+      },
+    },
+  ],
+});
+
+export { SERVER_ID };

package/src/modules/ollama.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // OLLAMA: local intelligence. Embeddings and distillation on this machine when
 // Ollama runs. The server offers the wiring through ctx.services.ollama.
 
@@ -5,6 +7,15 @@ import { defineModule } from './sdk.mjs';
 import { t } from '../i18n.mjs';
 import { findOnPath } from './helpers.mjs';
 import { RECOMMENDED } from '../ollama.mjs';
+import { hardwareOnce } from './local-models.mjs';
+
+// The chat model to pull is the one this computer runs well (local-models.mjs), not one size for
+// every machine; the embedding model is small enough for all of them. With the hardware, the page
+// says which sizes run here and which features of the local AI are worth turning on.
+export async function recommendedHere() {
+  const fit = await hardwareOnce();
+  return { ...RECOMMENDED, chat: fit.recommended.run?.ollama ?? RECOMMENDED.chat, hardware: fit };
+}
 
 // Ollama is not an npm package, so each system has its own way in. Where MADRE can run it, the
 // command is shown on the button before it runs; where it cannot, it hands over the download.
@@ -49,7 +60,7 @@ export default defineModule({
   name: 'Local AI',
   vendor: 'MADRE · LOCAL INTELLIGENCE',
   tracks: { name: 'ollama', github: 'ollama/ollama' },
-  summary: 'Recall by meaning and memory distillation on this machine, through Ollama: no provider tokens, nothing leaves.',
+  summary: 'Searches and sums up the project\'s memory with local AI (Ollama): free, and nothing leaves your computer.',
   creates: ['nothing in the project', 'a block in ~/.pulse/config.json', 'models in Ollama\'s own store when you press PULL'],
   requires: ['Ollama running (the app, or ollama serve)', 'an embedding model and a chat model \u00b7 MADRE can pull the recommended ones'],
   settings: { enabled: true, embeddings: true, archivist: true, agent: true },
@@ -71,7 +82,7 @@ export default defineModule({
       models: probe.models.map((model) => model.name),
       status: { installed: settings.enabled && project.on && probe.running && roles.length > 0, detail },
       ollama: { ...view, project },
-      recommended: RECOMMENDED,
+      recommended: await recommendedHere(),
       preflight: probe.running ? { ok: true, problems: [] } : { ok: false, problems: ['Ollama is not running: open the Ollama app or run `ollama serve`, then RECHECK.'] },
       install: { display: settings.enabled ? 'disable Ollama' : 'enable Ollama (config.json)', platforms: [] },
     };
@@ -101,8 +112,8 @@ export default defineModule({
     return { status: 200, body: { enabled, ollama: status } };
   },
   routes: [
-    { method: 'GET', path: '/api/ollama', handler: async (ctx) => ({ status: 200, body: { ollama: await ollamaView(await ctx.services.ollama.wire({ probe: false }), ctx.settings), recommended: RECOMMENDED } }) },
-    { method: 'POST', path: '/api/ollama/probe', handler: async (ctx) => ({ status: 200, body: { ollama: await ollamaView(await ctx.services.ollama.wire(), ctx.settings), recommended: RECOMMENDED } }) },
+    { method: 'GET', path: '/api/ollama', handler: async (ctx) => ({ status: 200, body: { ollama: await ollamaView(await ctx.services.ollama.wire({ probe: false }), ctx.settings), recommended: await recommendedHere() } }) },
+    { method: 'POST', path: '/api/ollama/probe', handler: async (ctx) => ({ status: 200, body: { ollama: await ollamaView(await ctx.services.ollama.wire(), ctx.settings), recommended: await recommendedHere() } }) },
     { method: 'POST', path: '/api/ollama/settings', handler: async (ctx, { payload }) => {
       const next = { ...(ctx.config.modules?.ollama ?? {}) };
       for (const key of ['embeddings', 'archivist', 'agent', 'enabled']) if (typeof payload[key] === 'boolean') next[key] = payload[key];