llm-tuner 0.4.3 → 0.4.4

package/electron/main.js

@@ -2,6 +2,7 @@ import { app, BrowserWindow, shell, nativeImage } from 'electron';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { startServer } from '../src/web/server.js';
+import { createOllamaAuthorizer } from '../src/platform/ollama-authorize.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -20,7 +21,7 @@ if (process.platform === 'win32') {
 let server;
 
 async function createWindow() {
-  const started = await startServer({ port: 0 });
+  const started = await startServer({ port: 0, authorizeOllama: createOllamaAuthorizer({ mode: 'desktop' }) });
   server = started.server;
 
   const iconFile = process.platform === 'win32' ? 'icon.ico' : 'icon.png';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-tuner",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Detects your hardware and finds the fastest configuration to run local LLMs with LM Studio or Ollama.",
   "keywords": [
     "llm",

package/src/cli/commands/load.js

@@ -18,6 +18,7 @@ import { profileChoices, profileNotes, profileSwitchNote, profileEventLines, sho
 import { getColors } from '../colors.js';
 import { withNav, NAV_BACK, backChoice } from '../nav.js';
 import { TerminalAnimation } from '../animation.js';
+import { createOllamaAuthorizer } from '../../platform/ollama-authorize.js';
 
 export async function loadCommand(args, { lang, theme }) {
   const c = getColors(theme);
@@ -290,6 +291,11 @@ export async function loadCommand(args, { lang, theme }) {
   let result;
   try {
     result = await tuner.load(modelKey, ctx, {
+      authorizeOllama: createOllamaAuthorizer({
+        mode: process.stdin.isTTY && process.stderr.isTTY && !args.json ? 'terminal' : 'noninteractive',
+        beforePrompt: () => anim.stop(),
+        afterPrompt: () => anim.start(t('status.applying')),
+      }),
       profile,
       force: !!args.force,
       dryRun: !!args['dry-run'],
@@ -309,6 +315,15 @@ export async function loadCommand(args, { lang, theme }) {
         return confirmed;
       },
     });
+  } catch (e) {
+    if (!/^errors\.ollama(?:Service|Authorization)/.test(e.code || '')) throw e;
+    if (args.json) {
+      console.log(JSON.stringify({ ok: false, code: e.code, params: e.params || {}, error: t(e.code, e.params) }));
+      process.exitCode = 1;
+      return;
+    }
+    e.message = t(e.code, e.params);
+    throw e;
   } finally {
     anim.stop();
   }

package/src/core/engines/ollama-service.js

@@ -0,0 +1,158 @@
+import fs from 'node:fs/promises';
+import { run, fetchJson, sleep } from '../util.js';
+import { TunerError } from '../errors.js';
+
+const CONFIG = '/etc/systemd/system/ollama.service.d/llm-tuner.conf';
+const KEYS = ['OLLAMA_FLASH_ATTENTION', 'OLLAMA_KV_CACHE_TYPE', 'OLLAMA_NUM_PARALLEL', 'CUDA_DEVICE_ORDER', 'CUDA_VISIBLE_DEVICES'];
+const fail = () => { throw new TunerError('errors.ollamaServiceConfig'); };
+
+export function validateServiceEnv(env) {
+  if (!env || typeof env !== 'object' || Array.isArray(env) || Object.keys(env).some((k) => !KEYS.includes(k))) fail();
+  if (!['0', '1'].includes(env.OLLAMA_FLASH_ATTENTION) || !['f16', 'q8_0', 'q4_0'].includes(env.OLLAMA_KV_CACHE_TYPE)) fail();
+  if (typeof env.OLLAMA_NUM_PARALLEL !== 'string' || !/^[1-9]\d?$/.test(env.OLLAMA_NUM_PARALLEL) || Number(env.OLLAMA_NUM_PARALLEL) > 64) fail();
+  if (env.CUDA_DEVICE_ORDER !== undefined || env.CUDA_VISIBLE_DEVICES !== undefined) {
+    if (env.CUDA_DEVICE_ORDER !== 'PCI_BUS_ID' || typeof env.CUDA_VISIBLE_DEVICES !== 'string' || !/^(0|[1-9]\d{0,2})(,(0|[1-9]\d{0,2}))*$/.test(env.CUDA_VISIBLE_DEVICES)) fail();
+    const ids = env.CUDA_VISIBLE_DEVICES.split(',');
+    if (ids.length > 128 || ids.some((v) => Number(v) > 127) || new Set(ids).size !== ids.length) fail();
+  }
+  return Object.fromEntries(KEYS.filter((k) => env[k] !== undefined).map((k) => [k, env[k]]));
+}
+
+const configText = (env) => ['[Service]', ...Object.entries(env).map(([k, v]) => `Environment="${k}=${v}"`), ''].join('\n');
+const matches = (live, env) => live && KEYS.every((k) => live[k] === env[k]);
+
+// This operation is passed as literal argv, never read from a writable script.
+// Both validation layers run before touching the fixed root-owned destination.
+const SCRIPT = String.raw`set -eu
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+umask 077
+tmp=
+trap 'rc=$?; test -z "$tmp" || rm -f -- "$tmp"; if test "$rc" != 0; then exit 70; fi' EXIT
+test "$(id -u)" = 0
+test "$#" = 5
+case "$1" in 0|1) ;; *) exit 1;; esac
+case "$2" in f16|q8_0|q4_0) ;; *) exit 1;; esac
+case "$3" in ''|*[!0-9]*|0*) exit 1;; esac
+test "$3" -ge 1 && test "$3" -le 64
+if test -n "$4$5"; then
+  test "$4" = PCI_BUS_ID
+  case "$5" in ''|*[!0-9,]*|,*|*,|*,,*) exit 1;; esac
+  oldifs=$IFS; IFS=,; seen=,
+  for gpu in $5; do
+    case "$gpu" in 0) ;; 0*) exit 1;; esac
+    test "$gpu" -le 127
+    case "$seen" in *,"$gpu",*) exit 1;; esac
+    seen=$seen$gpu,
+  done
+  IFS=$oldifs
+fi
+trusted_dir() {
+  test ! -L "$1" && test -d "$1" && test "$(stat -c %u "$1")" = 0 &&
+    test -z "$(find "$1" -maxdepth 0 -perm /022 -print)"
+}
+for parent in /etc /etc/systemd /etc/systemd/system /run; do trusted_dir "$parent"; done
+dir=/etc/systemd/system/ollama.service.d
+file=/etc/systemd/system/ollama.service.d/llm-tuner.conf
+lockdir=/run/llm-tuner
+test ! -L "$dir" && test ! -L "$lockdir"
+test -d "$dir" || mkdir -m 755 "$dir"
+test -d "$lockdir" || mkdir -m 700 "$lockdir"
+trusted_dir "$dir" && trusted_dir "$lockdir"
+test ! -L "$lockdir/ollama.lock"
+exec 9>"$lockdir/ollama.lock"
+flock -n 9
+if test -e "$file" || test -L "$file"; then
+  test ! -L "$file" && test -f "$file" && test "$(stat -c %u "$file")" = 0
+  test -z "$(find "$file" -maxdepth 0 -perm /022 -print)"
+fi
+body=$(printf '[Service]\nEnvironment="OLLAMA_FLASH_ATTENTION=%s"\nEnvironment="OLLAMA_KV_CACHE_TYPE=%s"\nEnvironment="OLLAMA_NUM_PARALLEL=%s"\n' "$1" "$2" "$3")
+if test -n "$4"; then
+  body=$(printf '%s\nEnvironment="CUDA_DEVICE_ORDER=%s"\nEnvironment="CUDA_VISIBLE_DEVICES=%s"\n' "$body" "$4" "$5")
+fi
+live_matches() {
+  pid=$(systemctl show ollama.service --property=MainPID --value) || return 1
+  case "$pid" in ''|*[!0-9]*|0) return 1;; esac
+  live=$(tr '\000' '\n' < "/proc/$pid/environ") || return 1
+  for pair in "OLLAMA_FLASH_ATTENTION=$1" "OLLAMA_KV_CACHE_TYPE=$2" "OLLAMA_NUM_PARALLEL=$3"; do
+    printf '%s\n' "$live" | grep -Fxq -- "$pair" || return 1
+  done
+  if test -n "$4"; then
+    printf '%s\n' "$live" | grep -Fxq -- "CUDA_DEVICE_ORDER=$4" || return 1
+    printf '%s\n' "$live" | grep -Fxq -- "CUDA_VISIBLE_DEVICES=$5" || return 1
+  elif printf '%s\n' "$live" | grep -Eq '^CUDA_(DEVICE_ORDER|VISIBLE_DEVICES)='; then
+    return 1
+  fi
+  test "$pid" = "$(systemctl show ollama.service --property=MainPID --value)"
+}
+restarted=0
+if ! live_matches "$@"; then restarted=1; fi
+tmp=$(mktemp "$dir/.llm-tuner-XXXXXXXX")
+printf '%s\n' "$body" > "$tmp"
+chmod 644 "$tmp"
+changed=0; backup=
+if ! cmp -s "$file" "$tmp"; then
+  if test -f "$file"; then
+    backup=$(mktemp "$file.bak-llm-tuner-XXXXXXXX")
+    cp -p -- "$file" "$backup"
+  fi
+  mv -f -- "$tmp" "$file"
+  tmp=; changed=1
+fi
+if test "$changed$restarted" != 00; then systemctl daemon-reload; fi
+if test "$restarted" = 1; then systemctl restart ollama.service; fi
+live_matches "$@"
+printf 'changed=%s\nrestarted=%s\nbackup=%s\n' "$changed" "$restarted" "$backup"
+`;
+
+export function serviceInvocation(input) {
+  const env = validateServiceEnv(input);
+  // The elevated watchdog can terminate the privileged process group; its
+  // unprivileged parent cannot reliably signal a root shell after pkexec.
+  return { command: '/usr/bin/timeout', args: ['--signal=TERM', '--kill-after=5s', '45s', '/bin/sh', '-c', SCRIPT, 'llm-tuner-ollama', ...KEYS.map((k) => env[k] ?? '')] };
+}
+
+export const serviceIO = {
+  async inspect(env) {
+    try {
+      const query = () => run('/usr/bin/systemctl', ['show', 'ollama.service', '--property=MainPID', '--value']);
+      const p = await query();
+      if (p.code || !/^[1-9]\d*$/.test(p.stdout.trim())) return null;
+      for (const target of ['/etc', '/etc/systemd', '/etc/systemd/system', '/etc/systemd/system/ollama.service.d', CONFIG]) {
+        const st = await fs.lstat(target);
+        if (st.isSymbolicLink() || st.uid !== 0 || (st.mode & 0o022)) return null;
+      }
+      if (await fs.readFile(CONFIG, 'utf8') !== configText(env)) return null;
+      const raw = await fs.readFile(`/proc/${p.stdout.trim()}/environ`, 'utf8');
+      const again = await query();
+      if (again.code || p.stdout !== again.stdout) return null;
+      return Object.fromEntries(raw.split('\0').filter((v) => v.includes('=')).map((v) => [v.slice(0, v.indexOf('=')), v.slice(v.indexOf('=') + 1)]));
+    } catch { return null; }
+  },
+  async ready(apiUrl) {
+    const deadline = Date.now() + 15000;
+    while (Date.now() < deadline) {
+      if ((await fetchJson(`${apiUrl}/api/version`, { timeout: 1000 }))?.ok) return true;
+      await sleep(250);
+    }
+    return false;
+  },
+};
+
+export function validateServiceTarget(apiUrl) {
+  let url;
+  try { url = new URL(apiUrl); } catch { throw new TunerError('errors.ollamaServiceTarget'); }
+  if (url.protocol !== 'http:' || !['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname) || url.port !== '11434' || url.username || url.password || url.pathname !== '/' || url.search || url.hash) throw new TunerError('errors.ollamaServiceTarget');
+  return url.origin;
+}
+
+export async function reconcileOllamaService(apiUrl, input, { authorize } = {}) {
+  const origin = validateServiceTarget(apiUrl);
+  const env = validateServiceEnv(input);
+  if (matches(await serviceIO.inspect(env), env)) return { changed: false, restarted: false, backups: [] };
+  if (typeof authorize !== 'function') throw new TunerError('errors.ollamaAuthorizationRequired');
+  const result = await authorize({ operation: 'ollama-service-env', env });
+  if (!result || typeof result.changed !== 'boolean' || typeof result.restarted !== 'boolean' || !Array.isArray(result.backups) || result.backups.some((b) => typeof b !== 'string')) throw new TunerError('errors.ollamaAuthorizationFailed');
+  if (!(await serviceIO.ready(origin))) throw new TunerError('errors.ollamaServiceReady');
+  return result;
+}

package/src/core/engines/ollama.js

@@ -5,6 +5,7 @@ import { run, which, exists, fetchJson, freePort, spawnLogged, killProcess, slee
 import { modelMetaFromFile } from '../gguf.js';
 import { runApiBenchmark } from '../benchmark.js';
 import { TunerError, benchError } from '../errors.js';
+import { reconcileOllamaService, validateServiceEnv, validateServiceTarget } from './ollama-service.js';
 
 const DEFAULT_HOST = '127.0.0.1:11434';
 
@@ -270,24 +271,29 @@ export const ollama = {
    * 1) Create a tuned model variant with per-model parameters (num_ctx, num_gpu...).
    * 2) Set server-wide env (KV type, flash attention, GPU order) for the Ollama service.
    */
-  async apply(ctx, model, c, { dryRun = false, useSudo = false, skipIfApplied = false } = {}) {
+  async apply(ctx, model, c, { dryRun = false, skipIfApplied = false, authorize } = {}) {
     const name = this.tunedName(model.key, c);
     const env = this.serverEnv(c);
     const result = { tunedModel: name, modelfile: this.modelfile(model.key, c), env, changes: [], pendingCommands: [] };
     if (dryRun) return { dryRun: true, ...result };
+    if (PLATFORM === 'linux' && ctx.detection.systemd) {
+      validateServiceTarget(ctx.detection.apiUrl);
+      validateServiceEnv(env);
+    }
 
     const dir = path.join(os.tmpdir(), `llm-tuner-${timestamp()}`);
     await fs.mkdir(dir, { recursive: true });
     if (skipIfApplied && (await this.isApplied(ctx, model, c))) {
       result.changes.push({ code: 'changes.ollamaExists', params: { name } });
-      return result;
+    } else {
+      const mf = path.join(dir, 'Modelfile');
+      await fs.writeFile(mf, result.modelfile);
+      const r = await run(ctx.detection.bin, ['create', name, '-f', mf], { timeout: 300_000 });
+      if (r.code !== 0) throw new Error(`ollama create failed: ${(r.stderr || r.stdout).slice(-300)}`);
+      result.changes.push({ code: 'changes.ollamaCreated', params: { name } });
     }
-    const mf = path.join(dir, 'Modelfile');
-    await fs.writeFile(mf, result.modelfile);
-    const r = await run(ctx.detection.bin, ['create', name, '-f', mf], { timeout: 300_000 });
-    if (r.code !== 0) throw new Error(`ollama create failed: ${(r.stderr || r.stdout).slice(-300)}`);
-    result.changes.push({ code: 'changes.ollamaCreated', params: { name } });
 
+    // Model parameters cannot carry server-global KV/FA settings. Reapply them even on a preset hit.
     if (PLATFORM === 'win32') {
       for (const [k, v] of Object.entries(env)) await run('setx', [k, v]);
       result.changes.push({ code: 'changes.ollamaSetx' });
@@ -302,22 +308,9 @@ export const ollama = {
       await sleep(2000);
       await run('open', ['-a', 'Ollama']);
     } else if (ctx.detection.systemd) {
-      const conf = ['[Service]', ...Object.entries(env).map(([k, v]) => `Environment="${k}=${v}"`), ''].join('\n');
-      const confFile = path.join(dir, 'llm-tuner.conf');
-      await fs.writeFile(confFile, conf);
-      const cmds = [
-        'sudo mkdir -p /etc/systemd/system/ollama.service.d',
-        `sudo cp ${confFile} /etc/systemd/system/ollama.service.d/llm-tuner.conf`,
-        'sudo systemctl daemon-reload',
-        'sudo systemctl restart ollama',
-      ];
-      if (useSudo) {
-        const ok = (await run('sudo', ['-n', 'true'])).code === 0;
-        if (ok) {
-          for (const cmd of cmds) { const [, ...rest] = cmd.split(' '); await run('sudo', ['-n', ...rest]); }
-          result.changes.push({ code: 'changes.ollamaSystemd' });
-        } else result.pendingCommands.push(...cmds);
-      } else result.pendingCommands.push(...cmds);
+      const service = await reconcileOllamaService(ctx.detection.apiUrl, env, { authorize });
+      result.backups = service.backups;
+      result.changes.push({ code: service.restarted ? 'changes.ollamaSystemd' : 'changes.ollamaSystemdUnchanged' });
     } else {
       result.pendingCommands.push(...Object.entries(env).map(([k, v]) => `export ${k}=${v}`), 'ollama serve');
     }

package/src/core/tuner.js

@@ -270,7 +270,7 @@ export class Tuner extends EventEmitter {
    * Balanced measures and loads the key the user chose; speed and quality reuse the variant stored in
    * the preset, or pick one once the VRAM is free.
    */
-  async load(key, ctx, { force = false, dryRun = false, maxCandidates = 3, depthFraction = 0.5, measure = true, confirmApply = async () => true, profile: requested = DEFAULT_PROFILE } = {}) {
+  async load(key, ctx, { force = false, dryRun = false, maxCandidates = 3, depthFraction = 0.5, measure = true, confirmApply = async () => true, authorizeOllama, profile: requested = DEFAULT_PROFILE } = {}) {
     return this.withTelemetry(async () => {
       const profile = normalizeProfile(requested);
       const model = await this.modelInfo(key);
@@ -320,7 +320,7 @@ export class Tuner extends EventEmitter {
       if (!(await confirmApply(preview))) return { source, candidate: slim(candidate), report, preview, applied: false, profile, variant: loadKey };
 
       this.log('status', { code: 'status.applying', progress: { pct: 88, phase: 'apply' } });
-      const applied = await this.engine.apply(this.ctx, modelObj, candidate, { useSudo: true, skipIfApplied: source === 'preset' });
+      const applied = await this.engine.apply(this.ctx, modelObj, candidate, { useSudo: true, skipIfApplied: source === 'preset', ...(authorizeOllama ? { authorize: authorizeOllama } : {}) });
       this.log('applied', { result: applied, progress: { pct: 92, phase: 'apply' } });
       if (applied.pendingCommands?.length) return { source, candidate: slim(candidate), report, applied, loaded: null, profile, variant: loadKey };
 

package/src/i18n/en.js

@@ -42,6 +42,13 @@ export default {
   'errors.ggufNotFound': 'Cannot find the GGUF file for {key}',
   'errors.lmstudioOpen': 'LM Studio is open; close it before applying the configuration.',
   'errors.ollamaUnknownModel': 'Ollama does not recognize the model {key}',
+  'errors.ollamaServiceConfig': 'Invalid Ollama service configuration; no privileged operation was started.',
+  'errors.ollamaServiceTarget': 'Automatic service configuration requires the local Ollama service on port 11434.',
+  'errors.ollamaServiceReady': 'Ollama did not become ready after configuration. The model was not loaded.',
+  'errors.ollamaAuthorizationRequired': 'Administrator authorization is required. Run interactively to authorize Ollama configuration, then retry.',
+  'errors.ollamaAuthorizationUnavailable': 'Administrator authorization is unavailable. Check that sudo or a desktop polkit authentication agent is installed.',
+  'errors.ollamaAuthorizationCancelled': 'Administrator authorization was cancelled. The model was not loaded.',
+  'errors.ollamaAuthorizationFailed': 'Ollama service configuration failed. Check the service and its configuration backup before retrying.',
 
   // Install methods
   'install.ollamaScript': 'Official script (ollama.com/install.sh, asks for sudo)',
@@ -73,6 +80,7 @@ export default {
   'changes.ollamaSetx': 'User environment variables updated (setx)',
   'changes.ollamaLaunchctl': 'Variables set with launchctl (until the next reboot; also add them to your profile if you want them to persist)',
   'changes.ollamaSystemd': 'systemd override installed and Ollama restarted',
+  'changes.ollamaSystemdUnchanged': 'Ollama service settings verified; no restart needed',
 
   'errors.unknownLocale': 'Unknown language "{lang}". Valid values: {list}',
   'errors.unknownTheme': 'Unknown theme "{theme}". Valid values: {list}',
@@ -124,6 +132,9 @@ Options:
   --lang <en|es>               Interface language (saved for next time)
   --theme <system|light|dark>  Interface theme (saved for next time)
 
+Ollama service changes may ask for administrator authorization in the terminal.
+Unchanged settings do not restart the service. JSON/noninteractive mode never asks for a password.
+
 Presets are saved in {presetsDir}`,
   'cli.desktopStartFailed': 'Could not start the desktop app: {error}\nThe desktop runtime (Electron) is downloaded the first time you run llm-tuner-desktop, so that first run needs a network connection.\nThe terminal interface works without it: run llm-tuner.',
   'cli.settingsTitle': 'Settings',

package/src/i18n/es.js

@@ -42,6 +42,13 @@ export default {
   'errors.ggufNotFound': 'No encuentro el archivo GGUF de {key}',
   'errors.lmstudioOpen': 'LM Studio está abierto; ciérralo antes de aplicar la configuración.',
   'errors.ollamaUnknownModel': 'Ollama no reconoce el modelo {key}',
+  'errors.ollamaServiceConfig': 'Configuración de servicio de Ollama no válida; no se inició ninguna operación con privilegios.',
+  'errors.ollamaServiceTarget': 'La configuración automática requiere el servicio local de Ollama en el puerto 11434.',
+  'errors.ollamaServiceReady': 'Ollama no estuvo disponible después de la configuración. El modelo no se cargó.',
+  'errors.ollamaAuthorizationRequired': 'Se requiere autorización de administrador. Ejecuta en modo interactivo para autorizar la configuración de Ollama e inténtalo de nuevo.',
+  'errors.ollamaAuthorizationUnavailable': 'La autorización de administrador no está disponible. Comprueba que sudo o un agente de autenticación polkit de escritorio estén instalados.',
+  'errors.ollamaAuthorizationCancelled': 'Se canceló la autorización de administrador. El modelo no se cargó.',
+  'errors.ollamaAuthorizationFailed': 'Falló la configuración del servicio de Ollama. Comprueba el servicio y su copia de seguridad antes de reintentar.',
 
   // Install methods
   'install.ollamaScript': 'Script oficial (ollama.com/install.sh, pide sudo)',
@@ -73,6 +80,7 @@ export default {
   'changes.ollamaSetx': 'Variables de entorno de usuario actualizadas (setx)',
   'changes.ollamaLaunchctl': 'Variables aplicadas con launchctl (hasta el próximo reinicio; añade también a tu perfil si quieres que persistan)',
   'changes.ollamaSystemd': 'Override de systemd instalado y Ollama reiniciado',
+  'changes.ollamaSystemdUnchanged': 'Configuración del servicio de Ollama verificada; no requiere reinicio',
 
   'errors.unknownLocale': 'Idioma desconocido "{lang}". Valores válidos: {list}',
   'errors.unknownTheme': 'Tema desconocido "{theme}". Valores válidos: {list}',
@@ -124,6 +132,9 @@ Opciones:
   --lang <en|es>               Idioma de la interfaz (se guarda para la próxima vez)
   --theme <system|light|dark>  Tema de la interfaz (se guarda para la próxima)
 
+Los cambios del servicio de Ollama pueden solicitar autorización de administrador en la terminal.
+Si los ajustes no cambian, el servicio no se reinicia. El modo JSON/no interactivo nunca pide contraseña.
+
 Los presets se guardan en {presetsDir}`,
   'cli.desktopStartFailed': 'No se pudo iniciar la aplicación de escritorio: {error}\nEl entorno de escritorio (Electron) se descarga la primera vez que ejecutas llm-tuner-desktop, así que esa primera ejecución necesita conexión a la red.\nLa interfaz de terminal funciona sin él: ejecuta llm-tuner.',
   'cli.settingsTitle': 'Configuración',

package/src/platform/ollama-authorize.js

@@ -0,0 +1,79 @@
+import { spawn } from 'node:child_process';
+import { serviceInvocation } from '../core/engines/ollama-service.js';
+import { TunerError } from '../core/errors.js';
+
+export const authorizationIO = { spawn };
+
+function parseResult(stdout) {
+  const fields = Object.create(null);
+  for (const line of stdout.trimEnd().split('\n')) {
+    const index = line.indexOf('=');
+    const key = line.slice(0, index);
+    if (index < 0 || !['changed', 'restarted', 'backup'].includes(key) || Object.hasOwn(fields, key)) throw new TunerError('errors.ollamaAuthorizationFailed');
+    fields[key] = line.slice(index + 1);
+  }
+  if (!['0', '1'].includes(fields.changed) || !['0', '1'].includes(fields.restarted) || typeof fields.backup !== 'string' || (fields.backup && !/^\/etc\/systemd\/system\/ollama\.service\.d\/llm-tuner\.conf\.bak-llm-tuner-[A-Za-z0-9]+$/.test(fields.backup))) throw new TunerError('errors.ollamaAuthorizationFailed');
+  return { changed: fields.changed === '1', restarted: fields.restarted === '1', backups: fields.backup ? [fields.backup] : [] };
+}
+
+/** The interface chooses interaction, never the operation or its destinations. */
+export function createOllamaAuthorizer({ mode = 'noninteractive', beforePrompt = () => {}, afterPrompt = () => {} } = {}) {
+  if (!['desktop', 'terminal', 'noninteractive'].includes(mode)) throw new TunerError('errors.ollamaServiceConfig');
+  return async (request) => {
+    if (!request || request.operation !== 'ollama-service-env' || Object.keys(request).some((k) => !['operation', 'env'].includes(k))) throw new TunerError('errors.ollamaServiceConfig');
+    const { command, args } = serviceInvocation(request.env);
+    const bin = mode === 'desktop' ? '/usr/bin/pkexec' : '/usr/bin/sudo';
+    const prefix = mode === 'desktop' ? ['--disable-internal-agent'] : mode === 'noninteractive' ? ['-n', '--'] : ['--'];
+    const terminal = mode === 'terminal';
+    try {
+      if (terminal) await beforePrompt();
+      return await new Promise((resolve, reject) => {
+        let child, timer, output = '', settled = false, pendingFailure;
+        const finish = (error, value) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          if (error) reject(error); else resolve(value);
+        };
+        const failed = () => new TunerError('errors.ollamaAuthorizationFailed');
+        const stop = () => {
+          pendingFailure = failed();
+          // A signal request is not proof of termination. Retain ownership
+          // until close, even if the OS refuses to signal the elevated child.
+          try { child.kill('SIGTERM'); } catch { /* wait for the elevated watchdog */ }
+        };
+        try {
+          child = authorizationIO.spawn(bin, [...prefix, command, ...args], {
+            env: { PATH: '/usr/sbin:/usr/bin:/sbin:/bin', LANG: 'C' },
+            stdio: terminal ? ['inherit', 'pipe', 'inherit'] : ['ignore', 'pipe', 'pipe'],
+          });
+        } catch (e) {
+          finish(new TunerError(e.code === 'ENOENT' ? 'errors.ollamaAuthorizationUnavailable' : 'errors.ollamaAuthorizationFailed'));
+          return;
+        }
+        timer = setTimeout(stop, 60000);
+        child.stdout?.on('data', (chunk) => {
+          if (pendingFailure) return;
+          output += String(chunk);
+          if (Buffer.byteLength(output) > 16384) { output = ''; stop(); }
+        });
+        // Drain diagnostics without collecting passwords or returning raw privileged output.
+        child.stderr?.resume();
+        child.on('error', (e) => {
+          const error = new TunerError(e.code === 'ENOENT' ? 'errors.ollamaAuthorizationUnavailable' : 'errors.ollamaAuthorizationFailed');
+          if (!child.pid) finish(error); else pendingFailure = error;
+        });
+        child.on('close', (code, signal) => {
+          if (pendingFailure) { finish(pendingFailure); return; }
+          if (code !== 0 || signal) {
+            finish(new TunerError(mode === 'desktop' && code === 126 ? 'errors.ollamaAuthorizationCancelled' : mode === 'noninteractive' && code === 1 ? 'errors.ollamaAuthorizationRequired' : 'errors.ollamaAuthorizationFailed'));
+            return;
+          }
+          try { finish(null, parseResult(output)); } catch (e) { finish(e); }
+        });
+      });
+    } finally {
+      if (terminal) await afterPrompt();
+    }
+  };
+}

package/src/web/server.js

@@ -113,18 +113,19 @@ const routes = {
   'GET /api/presets': async (req, url) => ({ presets: await listPresets({ engine: url.searchParams.get('engine'), modelKey: url.searchParams.get('model') }) }),
 
   // The "Load" button: preset -> apply + load, or benchmark -> preset -> apply + load.
-  'POST /api/load': async (req) => {
+  'POST /api/load': async (req, url, { authorizeOllama } = {}) => {
     if (busy) throw new TunerError('errors.loadInProgress');
     const { engine, model, ctx, force = false, candidates = 3, profile } = await body(req);
     // An unknown profile is rejected before any job exists; without one the tuner uses its default.
     const options = { force, maxCandidates: Number(candidates) };
+    if (authorizeOllama) options.authorizeOllama = authorizeOllama;
     if (profile !== undefined) options.profile = knownProfile(profile);
     const tuner = await Tuner.create(engine);
     const job = createJob();
     tuner.on('progress', (e) => job.emit(e));
     busy = true;
     tuner.load(model, Number(ctx), options)
-      .then((r) => job.finish({ ok: !!r.loaded?.ok || !!r.applied?.pendingCommands?.length, result: { ...r, report: r.report && { ...r.report, best: r.report.best && { candidate: slim(r.report.best.candidate), bench: r.report.best.bench } } } }))
+      .then((r) => job.finish({ ok: !!r.loaded?.ok, result: { ...r, report: r.report && { ...r.report, best: r.report.best && { candidate: slim(r.report.best.candidate), bench: r.report.best.bench } } } }))
       .catch((e) => job.finish({ ok: false, ...errorBody(e) }))
       .finally(() => { busy = false; });
     return { jobId: job.id };
@@ -163,9 +164,11 @@ const routes = {
 };
 
 
-async function handler(req, res) {
+async function handler(req, res, options) {
   const url = new URL(req.url, 'http://localhost');
   try {
+    // A foreign website must not trigger the desktop's privileged authorizer.
+    if (options.authorizeOllama && req.method === 'POST' && req.headers.origin && req.headers.origin !== `http://127.0.0.1:${req.socket.localPort}`) return send(res, 403, { error: 'Forbidden origin' });
     // Server-Sent Events for job progress.
     const ev = url.pathname.match(/^\/api\/jobs\/([\w-]+)\/events$/);
     if (ev) {
@@ -181,7 +184,7 @@ async function handler(req, res) {
       return;
     }
     const route = routes[`${req.method} ${url.pathname}`];
-    if (route) return send(res, 200, await route(req, url));
+    if (route) return send(res, 200, await route(req, url, options));
 
     const i18n = url.pathname.match(/^\/api\/i18n\/([\w-]+)$/);
     if (i18n && req.method === 'GET') {
@@ -208,9 +211,9 @@ async function handler(req, res) {
 }
 
 /** Start the local UI server (bound to localhost only). */
-export function startServer({ port = Number(process.env.PORT) || 7860, open = false } = {}) {
+export function startServer({ port = Number(process.env.PORT) || 7860, open = false, authorizeOllama } = {}) {
   return new Promise((resolve, reject) => {
-    const server = http.createServer(handler);
+    const server = http.createServer((req, res) => handler(req, res, { authorizeOllama }));
     server.on('error', reject);
     server.listen(port, '127.0.0.1', () => {
       const url = `http://127.0.0.1:${server.address().port}`;