llm-tuner 0.4.3 → 0.5.0

package/src/core/engines/ollama-service.js

@@ -0,0 +1,158 @@
+import fs from 'node:fs/promises';
+import { run, fetchJson, sleep } from '../util.js';
+import { TunerError } from '../errors.js';
+
+const CONFIG = '/etc/systemd/system/ollama.service.d/llm-tuner.conf';
+const KEYS = ['OLLAMA_FLASH_ATTENTION', 'OLLAMA_KV_CACHE_TYPE', 'OLLAMA_NUM_PARALLEL', 'CUDA_DEVICE_ORDER', 'CUDA_VISIBLE_DEVICES'];
+const fail = () => { throw new TunerError('errors.ollamaServiceConfig'); };
+
+export function validateServiceEnv(env) {
+  if (!env || typeof env !== 'object' || Array.isArray(env) || Object.keys(env).some((k) => !KEYS.includes(k))) fail();
+  if (!['0', '1'].includes(env.OLLAMA_FLASH_ATTENTION) || !['f16', 'q8_0', 'q4_0'].includes(env.OLLAMA_KV_CACHE_TYPE)) fail();
+  if (typeof env.OLLAMA_NUM_PARALLEL !== 'string' || !/^[1-9]\d?$/.test(env.OLLAMA_NUM_PARALLEL) || Number(env.OLLAMA_NUM_PARALLEL) > 64) fail();
+  if (env.CUDA_DEVICE_ORDER !== undefined || env.CUDA_VISIBLE_DEVICES !== undefined) {
+    if (env.CUDA_DEVICE_ORDER !== 'PCI_BUS_ID' || typeof env.CUDA_VISIBLE_DEVICES !== 'string' || !/^(0|[1-9]\d{0,2})(,(0|[1-9]\d{0,2}))*$/.test(env.CUDA_VISIBLE_DEVICES)) fail();
+    const ids = env.CUDA_VISIBLE_DEVICES.split(',');
+    if (ids.length > 128 || ids.some((v) => Number(v) > 127) || new Set(ids).size !== ids.length) fail();
+  }
+  return Object.fromEntries(KEYS.filter((k) => env[k] !== undefined).map((k) => [k, env[k]]));
+}
+
+const configText = (env) => ['[Service]', ...Object.entries(env).map(([k, v]) => `Environment="${k}=${v}"`), ''].join('\n');
+const matches = (live, env) => live && KEYS.every((k) => live[k] === env[k]);
+
+// This operation is passed as literal argv, never read from a writable script.
+// Both validation layers run before touching the fixed root-owned destination.
+const SCRIPT = String.raw`set -eu
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+umask 077
+tmp=
+trap 'rc=$?; test -z "$tmp" || rm -f -- "$tmp"; if test "$rc" != 0; then exit 70; fi' EXIT
+test "$(id -u)" = 0
+test "$#" = 5
+case "$1" in 0|1) ;; *) exit 1;; esac
+case "$2" in f16|q8_0|q4_0) ;; *) exit 1;; esac
+case "$3" in ''|*[!0-9]*|0*) exit 1;; esac
+test "$3" -ge 1 && test "$3" -le 64
+if test -n "$4$5"; then
+  test "$4" = PCI_BUS_ID
+  case "$5" in ''|*[!0-9,]*|,*|*,|*,,*) exit 1;; esac
+  oldifs=$IFS; IFS=,; seen=,
+  for gpu in $5; do
+    case "$gpu" in 0) ;; 0*) exit 1;; esac
+    test "$gpu" -le 127
+    case "$seen" in *,"$gpu",*) exit 1;; esac
+    seen=$seen$gpu,
+  done
+  IFS=$oldifs
+fi
+trusted_dir() {
+  test ! -L "$1" && test -d "$1" && test "$(stat -c %u "$1")" = 0 &&
+    test -z "$(find "$1" -maxdepth 0 -perm /022 -print)"
+}
+for parent in /etc /etc/systemd /etc/systemd/system /run; do trusted_dir "$parent"; done
+dir=/etc/systemd/system/ollama.service.d
+file=/etc/systemd/system/ollama.service.d/llm-tuner.conf
+lockdir=/run/llm-tuner
+test ! -L "$dir" && test ! -L "$lockdir"
+test -d "$dir" || mkdir -m 755 "$dir"
+test -d "$lockdir" || mkdir -m 700 "$lockdir"
+trusted_dir "$dir" && trusted_dir "$lockdir"
+test ! -L "$lockdir/ollama.lock"
+exec 9>"$lockdir/ollama.lock"
+flock -n 9
+if test -e "$file" || test -L "$file"; then
+  test ! -L "$file" && test -f "$file" && test "$(stat -c %u "$file")" = 0
+  test -z "$(find "$file" -maxdepth 0 -perm /022 -print)"
+fi
+body=$(printf '[Service]\nEnvironment="OLLAMA_FLASH_ATTENTION=%s"\nEnvironment="OLLAMA_KV_CACHE_TYPE=%s"\nEnvironment="OLLAMA_NUM_PARALLEL=%s"\n' "$1" "$2" "$3")
+if test -n "$4"; then
+  body=$(printf '%s\nEnvironment="CUDA_DEVICE_ORDER=%s"\nEnvironment="CUDA_VISIBLE_DEVICES=%s"\n' "$body" "$4" "$5")
+fi
+live_matches() {
+  pid=$(systemctl show ollama.service --property=MainPID --value) || return 1
+  case "$pid" in ''|*[!0-9]*|0) return 1;; esac
+  live=$(tr '\000' '\n' < "/proc/$pid/environ") || return 1
+  for pair in "OLLAMA_FLASH_ATTENTION=$1" "OLLAMA_KV_CACHE_TYPE=$2" "OLLAMA_NUM_PARALLEL=$3"; do
+    printf '%s\n' "$live" | grep -Fxq -- "$pair" || return 1
+  done
+  if test -n "$4"; then
+    printf '%s\n' "$live" | grep -Fxq -- "CUDA_DEVICE_ORDER=$4" || return 1
+    printf '%s\n' "$live" | grep -Fxq -- "CUDA_VISIBLE_DEVICES=$5" || return 1
+  elif printf '%s\n' "$live" | grep -Eq '^CUDA_(DEVICE_ORDER|VISIBLE_DEVICES)='; then
+    return 1
+  fi
+  test "$pid" = "$(systemctl show ollama.service --property=MainPID --value)"
+}
+restarted=0
+if ! live_matches "$@"; then restarted=1; fi
+tmp=$(mktemp "$dir/.llm-tuner-XXXXXXXX")
+printf '%s\n' "$body" > "$tmp"
+chmod 644 "$tmp"
+changed=0; backup=
+if ! cmp -s "$file" "$tmp"; then
+  if test -f "$file"; then
+    backup=$(mktemp "$file.bak-llm-tuner-XXXXXXXX")
+    cp -p -- "$file" "$backup"
+  fi
+  mv -f -- "$tmp" "$file"
+  tmp=; changed=1
+fi
+if test "$changed$restarted" != 00; then systemctl daemon-reload; fi
+if test "$restarted" = 1; then systemctl restart ollama.service; fi
+live_matches "$@"
+printf 'changed=%s\nrestarted=%s\nbackup=%s\n' "$changed" "$restarted" "$backup"
+`;
+
+export function serviceInvocation(input) {
+  const env = validateServiceEnv(input);
+  // The elevated watchdog can terminate the privileged process group; its
+  // unprivileged parent cannot reliably signal a root shell after pkexec.
+  return { command: '/usr/bin/timeout', args: ['--signal=TERM', '--kill-after=5s', '45s', '/bin/sh', '-c', SCRIPT, 'llm-tuner-ollama', ...KEYS.map((k) => env[k] ?? '')] };
+}
+
+export const serviceIO = {
+  async inspect(env) {
+    try {
+      const query = () => run('/usr/bin/systemctl', ['show', 'ollama.service', '--property=MainPID', '--value']);
+      const p = await query();
+      if (p.code || !/^[1-9]\d*$/.test(p.stdout.trim())) return null;
+      for (const target of ['/etc', '/etc/systemd', '/etc/systemd/system', '/etc/systemd/system/ollama.service.d', CONFIG]) {
+        const st = await fs.lstat(target);
+        if (st.isSymbolicLink() || st.uid !== 0 || (st.mode & 0o022)) return null;
+      }
+      if (await fs.readFile(CONFIG, 'utf8') !== configText(env)) return null;
+      const raw = await fs.readFile(`/proc/${p.stdout.trim()}/environ`, 'utf8');
+      const again = await query();
+      if (again.code || p.stdout !== again.stdout) return null;
+      return Object.fromEntries(raw.split('\0').filter((v) => v.includes('=')).map((v) => [v.slice(0, v.indexOf('=')), v.slice(v.indexOf('=') + 1)]));
+    } catch { return null; }
+  },
+  async ready(apiUrl) {
+    const deadline = Date.now() + 15000;
+    while (Date.now() < deadline) {
+      if ((await fetchJson(`${apiUrl}/api/version`, { timeout: 1000 }))?.ok) return true;
+      await sleep(250);
+    }
+    return false;
+  },
+};
+
+export function validateServiceTarget(apiUrl) {
+  let url;
+  try { url = new URL(apiUrl); } catch { throw new TunerError('errors.ollamaServiceTarget'); }
+  if (url.protocol !== 'http:' || !['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname) || url.port !== '11434' || url.username || url.password || url.pathname !== '/' || url.search || url.hash) throw new TunerError('errors.ollamaServiceTarget');
+  return url.origin;
+}
+
+export async function reconcileOllamaService(apiUrl, input, { authorize } = {}) {
+  const origin = validateServiceTarget(apiUrl);
+  const env = validateServiceEnv(input);
+  if (matches(await serviceIO.inspect(env), env)) return { changed: false, restarted: false, backups: [] };
+  if (typeof authorize !== 'function') throw new TunerError('errors.ollamaAuthorizationRequired');
+  const result = await authorize({ operation: 'ollama-service-env', env });
+  if (!result || typeof result.changed !== 'boolean' || typeof result.restarted !== 'boolean' || !Array.isArray(result.backups) || result.backups.some((b) => typeof b !== 'string')) throw new TunerError('errors.ollamaAuthorizationFailed');
+  if (!(await serviceIO.ready(origin))) throw new TunerError('errors.ollamaServiceReady');
+  return result;
+}

package/src/core/engines/ollama.js

@@ -5,6 +5,7 @@ import { run, which, exists, fetchJson, freePort, spawnLogged, killProcess, slee
 import { modelMetaFromFile } from '../gguf.js';
 import { runApiBenchmark } from '../benchmark.js';
 import { TunerError, benchError } from '../errors.js';
+import { reconcileOllamaService, validateServiceEnv, validateServiceTarget } from './ollama-service.js';
 
 const DEFAULT_HOST = '127.0.0.1:11434';
 
@@ -270,24 +271,29 @@ export const ollama = {
    * 1) Create a tuned model variant with per-model parameters (num_ctx, num_gpu...).
    * 2) Set server-wide env (KV type, flash attention, GPU order) for the Ollama service.
    */
-  async apply(ctx, model, c, { dryRun = false, useSudo = false, skipIfApplied = false } = {}) {
+  async apply(ctx, model, c, { dryRun = false, skipIfApplied = false, authorize } = {}) {
     const name = this.tunedName(model.key, c);
     const env = this.serverEnv(c);
     const result = { tunedModel: name, modelfile: this.modelfile(model.key, c), env, changes: [], pendingCommands: [] };
     if (dryRun) return { dryRun: true, ...result };
+    if (PLATFORM === 'linux' && ctx.detection.systemd) {
+      validateServiceTarget(ctx.detection.apiUrl);
+      validateServiceEnv(env);
+    }
 
     const dir = path.join(os.tmpdir(), `llm-tuner-${timestamp()}`);
     await fs.mkdir(dir, { recursive: true });
     if (skipIfApplied && (await this.isApplied(ctx, model, c))) {
       result.changes.push({ code: 'changes.ollamaExists', params: { name } });
-      return result;
+    } else {
+      const mf = path.join(dir, 'Modelfile');
+      await fs.writeFile(mf, result.modelfile);
+      const r = await run(ctx.detection.bin, ['create', name, '-f', mf], { timeout: 300_000 });
+      if (r.code !== 0) throw new Error(`ollama create failed: ${(r.stderr || r.stdout).slice(-300)}`);
+      result.changes.push({ code: 'changes.ollamaCreated', params: { name } });
     }
-    const mf = path.join(dir, 'Modelfile');
-    await fs.writeFile(mf, result.modelfile);
-    const r = await run(ctx.detection.bin, ['create', name, '-f', mf], { timeout: 300_000 });
-    if (r.code !== 0) throw new Error(`ollama create failed: ${(r.stderr || r.stdout).slice(-300)}`);
-    result.changes.push({ code: 'changes.ollamaCreated', params: { name } });
 
+    // Model parameters cannot carry server-global KV/FA settings. Reapply them even on a preset hit.
     if (PLATFORM === 'win32') {
       for (const [k, v] of Object.entries(env)) await run('setx', [k, v]);
       result.changes.push({ code: 'changes.ollamaSetx' });
@@ -302,22 +308,9 @@ export const ollama = {
       await sleep(2000);
       await run('open', ['-a', 'Ollama']);
     } else if (ctx.detection.systemd) {
-      const conf = ['[Service]', ...Object.entries(env).map(([k, v]) => `Environment="${k}=${v}"`), ''].join('\n');
-      const confFile = path.join(dir, 'llm-tuner.conf');
-      await fs.writeFile(confFile, conf);
-      const cmds = [
-        'sudo mkdir -p /etc/systemd/system/ollama.service.d',
-        `sudo cp ${confFile} /etc/systemd/system/ollama.service.d/llm-tuner.conf`,
-        'sudo systemctl daemon-reload',
-        'sudo systemctl restart ollama',
-      ];
-      if (useSudo) {
-        const ok = (await run('sudo', ['-n', 'true'])).code === 0;
-        if (ok) {
-          for (const cmd of cmds) { const [, ...rest] = cmd.split(' '); await run('sudo', ['-n', ...rest]); }
-          result.changes.push({ code: 'changes.ollamaSystemd' });
-        } else result.pendingCommands.push(...cmds);
-      } else result.pendingCommands.push(...cmds);
+      const service = await reconcileOllamaService(ctx.detection.apiUrl, env, { authorize });
+      result.backups = service.backups;
+      result.changes.push({ code: service.restarted ? 'changes.ollamaSystemd' : 'changes.ollamaSystemdUnchanged' });
     } else {
       result.pendingCommands.push(...Object.entries(env).map(([k, v]) => `export ${k}=${v}`), 'ollama serve');
     }

package/src/core/index.js

@@ -4,10 +4,11 @@ export { planCandidates, placeLayers, maxFullOffloadContext, kvTotalBytes, KV_TY
 export { Tuner, ENGINES, detectEngines, pickBest, slim } from './tuner.js';
 export { PROFILES, DEFAULT_PROFILE, normalizeProfile, QUALITY_KV_TYPES, kvTypesFor, meetsQuality, fitsFullyOnGpu, pickVariant, recommendProfile, HINT_TARGETS, variantHints, VRAM_BUSY_FRACTION, vramInUse } from './profiles.js';
 export { installPlans, runInstall, openUrl } from './installer.js';
-export { fmtBytes, configDir } from './util.js';
+export { fmtBytes, configDir, resolveConnectableHost } from './util.js';
 export { findPreset, savePreset, listPresets, presetsDir, presetPath, variantsSignature, hardwareFingerprint } from './presets.js';
-export { readSettings, writeSettings, settingsPath, THEMES, DEFAULT_THEME, normalizeTheme } from './settings.js';
+export { readSettings, writeSettings, settingsPath, THEMES, DEFAULT_THEME, normalizeTheme, getActiveServer, DEFAULT_SERVERS, DEFAULT_ACTIVE_SERVER_ID } from './settings.js';
 export { TunerError, benchError } from './errors.js';
 export { sampleRam, sampleGpus, startTelemetrySampler } from './telemetry.js';
 export { checkUpdate, isNewerVersion, CURRENT_VERSION } from './updater.js';
 export { detectAgents, installMcpServer, SUPPORTED_AGENTS } from './mcp/index.js';
+export { TunerApiClient } from './client.js';

package/src/core/settings.js

@@ -9,6 +9,11 @@ import { PROFILES } from './profiles.js';
 export const THEMES = Object.freeze(['system', 'light', 'dark']);
 export const DEFAULT_THEME = 'system';
 
+export const DEFAULT_SERVERS = Object.freeze([
+  Object.freeze({ id: 'local', name: 'Local Machine', url: 'http://127.0.0.1:7860', token: null }),
+]);
+export const DEFAULT_ACTIVE_SERVER_ID = 'local';
+
 /** Returns the value if it is a valid profile, otherwise null. */
 function storedProfile(value) {
   return PROFILES.includes(value) ? value : null;
@@ -18,15 +23,47 @@ export function normalizeTheme(theme) {
   return THEMES.includes(theme) ? theme : DEFAULT_THEME;
 }
 
+export function normalizeServers(servers) {
+  if (!Array.isArray(servers)) return [...DEFAULT_SERVERS];
+  const list = servers
+    .filter((s) => s && typeof s === 'object' && s.id)
+    .map((s) => ({
+      id: String(s.id),
+      name: String(s.name || s.id),
+      url: String(s.url || '').replace(/\/+$/, ''),
+      token: s.token ? String(s.token) : null,
+    }));
+  if (list.length === 0) return [...DEFAULT_SERVERS];
+  if (!list.some((s) => s.id === 'local')) {
+    list.unshift(DEFAULT_SERVERS[0]);
+  }
+  return list;
+}
+
+export function normalizeActiveServerId(activeId, servers) {
+  const list = normalizeServers(servers);
+  return list.some((s) => s.id === activeId) ? activeId : DEFAULT_ACTIVE_SERVER_ID;
+}
+
+export function getActiveServer(settings) {
+  const servers = normalizeServers(settings?.servers);
+  const activeId = normalizeActiveServerId(settings?.activeServerId, servers);
+  return servers.find((s) => s.id === activeId) || servers[0];
+}
+
 export const settingsPath = () => path.join(configDir(), 'settings.json');
 
 /** Current settings. A missing, corrupt or hand-edited file yields the defaults; never throws. */
 export async function readSettings() {
   const s = await readJson(settingsPath(), null);
+  const servers = normalizeServers(s?.servers);
+  const activeServerId = normalizeActiveServerId(s?.activeServerId, servers);
   return {
     lang: normalizeLocale(s?.lang),
     theme: normalizeTheme(s?.theme),
     profile: storedProfile(s?.profile),
+    servers,
+    activeServerId,
   };
 }
 
@@ -37,8 +74,19 @@ export async function writeSettings(patch) {
   const lang = normalizeLocale(patch?.lang !== undefined ? patch.lang : base.lang);
   const theme = normalizeTheme(patch?.theme !== undefined ? patch.theme : base.theme);
   const profile = storedProfile(patch?.profile) ?? base.profile;
-  const next = { ...base, ...patch, lang, theme, profile };
+  const servers = patch?.servers !== undefined ? normalizeServers(patch.servers) : normalizeServers(base.servers);
+  const activeServerId = patch?.activeServerId !== undefined
+    ? normalizeActiveServerId(patch.activeServerId, servers)
+    : normalizeActiveServerId(base.activeServerId, servers);
+
+  const next = { ...base, ...patch, lang, theme, profile, servers, activeServerId };
   await fs.mkdir(configDir(), { recursive: true });
   await fs.writeFile(settingsPath(), JSON.stringify(next, null, 2));
-  return { lang: next.lang, theme: next.theme, profile: storedProfile(next.profile) };
+  return {
+    lang: next.lang,
+    theme: next.theme,
+    profile: storedProfile(next.profile),
+    servers: next.servers,
+    activeServerId: next.activeServerId,
+  };
 }

package/src/core/tuner.js

@@ -270,7 +270,7 @@ export class Tuner extends EventEmitter {
    * Balanced measures and loads the key the user chose; speed and quality reuse the variant stored in
    * the preset, or pick one once the VRAM is free.
    */
-  async load(key, ctx, { force = false, dryRun = false, maxCandidates = 3, depthFraction = 0.5, measure = true, confirmApply = async () => true, profile: requested = DEFAULT_PROFILE } = {}) {
+  async load(key, ctx, { force = false, dryRun = false, maxCandidates = 3, depthFraction = 0.5, measure = true, confirmApply = async () => true, authorizeOllama, profile: requested = DEFAULT_PROFILE } = {}) {
     return this.withTelemetry(async () => {
       const profile = normalizeProfile(requested);
       const model = await this.modelInfo(key);
@@ -320,7 +320,7 @@ export class Tuner extends EventEmitter {
       if (!(await confirmApply(preview))) return { source, candidate: slim(candidate), report, preview, applied: false, profile, variant: loadKey };
 
       this.log('status', { code: 'status.applying', progress: { pct: 88, phase: 'apply' } });
-      const applied = await this.engine.apply(this.ctx, modelObj, candidate, { useSudo: true, skipIfApplied: source === 'preset' });
+      const applied = await this.engine.apply(this.ctx, modelObj, candidate, { useSudo: true, skipIfApplied: source === 'preset', ...(authorizeOllama ? { authorize: authorizeOllama } : {}) });
       this.log('applied', { result: applied, progress: { pct: 92, phase: 'apply' } });
       if (applied.pendingCommands?.length) return { source, candidate: slim(candidate), report, applied, loaded: null, profile, variant: loadKey };
 

package/src/core/util.js

@@ -146,3 +146,29 @@ export function cpuBusyPercent(a, b) {
   }
   return total > 0 ? 100 * (1 - idle / total) : 0;
 }
+
+export function resolveConnectableHost(host = '127.0.0.1', networkInterfaces = os.networkInterfaces) {
+  if (host !== '0.0.0.0' && host !== '::') {
+    return host;
+  }
+
+  let interfaces;
+  if (typeof networkInterfaces === 'function') {
+    interfaces = networkInterfaces();
+  } else if (networkInterfaces && typeof networkInterfaces.networkInterfaces === 'function') {
+    interfaces = networkInterfaces.networkInterfaces();
+  } else {
+    interfaces = os.networkInterfaces();
+  }
+
+  for (const name of Object.keys(interfaces || {})) {
+    const list = interfaces[name] || [];
+    const addr = list.find((info) => (info.family === 'IPv4' || info.family === 4) && !info.internal);
+    if (addr) {
+      return addr.address;
+    }
+  }
+
+  return '127.0.0.1';
+}
+

package/src/i18n/en.js

@@ -1,5 +1,25 @@
 // English catalog: the base language. Every key here must also exist in es.js.
 export default {
+  "web.localServerSettings": "Local Server Settings",
+  "web.serverAutostartLabel": "Start server after login",
+  "web.serverStartupEnabled": "Automatic server startup is enabled",
+  "web.serverStartupDisabled": "Automatic server startup is disabled",
+  "web.serverStartupUnknown": "Automatic server startup state is unknown",
+  "web.serverStartupSaved": "Startup setting saved for next login",
+  "web.serverTokenLabel": "Server authentication token",
+  "web.serverTokenReveal": "Reveal token",
+  "web.serverTokenHide": "Hide token",
+  "web.serverTokenCopy": "Copy token",
+  "web.serverTokenCopied": "Token copied",
+  "web.serverNoConfig": "No server configuration yet. Run /serve or enable automatic startup first.",
+  "web.serverConnectionInfo": "Server listens on {host}:{port}. On another computer use this computer LAN IP with port {port}, not 0.0.0.0 or localhost.",
+  "web.serverStartupUnconfirmed": "Could not confirm startup state.",
+  "web.serverTokenCopyFailed": "Could not confirm token copy.",
+  "cli.serverConnection": "View server connection details and token",
+  "cli.serverConnectionDetails": "Listen address: {host}:{port}; Authentication Token: {token}; From another computer use the server LAN IP with port {port}, not 0.0.0.0 or localhost.",
+  "cli.serverNoConfig": "No server configuration yet. Run /serve or enable automatic startup first.",
+  "cli.serverConnectionInvalid": "Saved server configuration is invalid.",
+  "cli.serverConnectionHelp": "In /settings, select View server connection details and token to retrieve the saved token. Desktop Settings also provides explicit reveal and copy actions.",
   // Engine choice
   'engine.reason.onlyInstalled': '{name} is the only one installed.',
   'engine.reason.multiGpu': 'You have several GPUs: LM Studio lets you set the GPU order and the KV type per model.',
@@ -42,6 +62,13 @@ export default {
   'errors.ggufNotFound': 'Cannot find the GGUF file for {key}',
   'errors.lmstudioOpen': 'LM Studio is open; close it before applying the configuration.',
   'errors.ollamaUnknownModel': 'Ollama does not recognize the model {key}',
+  'errors.ollamaServiceConfig': 'Invalid Ollama service configuration; no privileged operation was started.',
+  'errors.ollamaServiceTarget': 'Automatic service configuration requires the local Ollama service on port 11434.',
+  'errors.ollamaServiceReady': 'Ollama did not become ready after configuration. The model was not loaded.',
+  'errors.ollamaAuthorizationRequired': 'Administrator authorization is required. Run interactively to authorize Ollama configuration, then retry.',
+  'errors.ollamaAuthorizationUnavailable': 'Administrator authorization is unavailable. Check that sudo or a desktop polkit authentication agent is installed.',
+  'errors.ollamaAuthorizationCancelled': 'Administrator authorization was cancelled. The model was not loaded.',
+  'errors.ollamaAuthorizationFailed': 'Ollama service configuration failed. Check the service and its configuration backup before retrying.',
 
   // Install methods
   'install.ollamaScript': 'Official script (ollama.com/install.sh, asks for sudo)',
@@ -73,10 +100,13 @@ export default {
   'changes.ollamaSetx': 'User environment variables updated (setx)',
   'changes.ollamaLaunchctl': 'Variables set with launchctl (until the next reboot; also add them to your profile if you want them to persist)',
   'changes.ollamaSystemd': 'systemd override installed and Ollama restarted',
+  'changes.ollamaSystemdUnchanged': 'Ollama service settings verified; no restart needed',
 
   'errors.unknownLocale': 'Unknown language "{lang}". Valid values: {list}',
   'errors.unknownTheme': 'Unknown theme "{theme}". Valid values: {list}',
   'errors.unknownProfile': 'Unknown profile "{profile}". Valid values: {list}',
+  'errors.unauthorized': 'Unauthorized: a valid Bearer token is required.',
+  'errors.forbiddenRemote': 'Forbidden: this operation cannot be performed remotely.',
   'errors.installNotFinished': 'The installation did not finish. Run llm-tuner again when it is done.',
   'errors.modelDownloadFailed': 'Could not download the model',
   'errors.noInstaller': 'There is no automatic installer for this system.',
@@ -106,7 +136,7 @@ Commands:
   /load                        Tune and load a model with optimal hardware settings
   /mcp                         Connect local engine to AI coding agents as MCP server
   /presets                     List saved presets
-  /settings                    Interactive settings menu (language and theme)
+  /settings                    Interactive settings menu (language, theme, and server startup)
   /help                        Show this help message
   /exit                        Exit the interactive menu
 
@@ -124,12 +154,27 @@ Options:
   --lang <en|es>               Interface language (saved for next time)
   --theme <system|light|dark>  Interface theme (saved for next time)
 
+Server startup can be enabled or disabled after login in /settings. It starts on your next login, not immediately.
+
+Ollama service changes may ask for administrator authorization in the terminal.
+Unchanged settings do not restart the service. JSON/noninteractive mode never asks for a password.
+
 Presets are saved in {presetsDir}`,
   'cli.desktopStartFailed': 'Could not start the desktop app: {error}\nThe desktop runtime (Electron) is downloaded the first time you run llm-tuner-desktop, so that first run needs a network connection.\nThe terminal interface works without it: run llm-tuner.',
   'cli.settingsTitle': 'Settings',
   'cli.settingsMenu': 'Select an option to configure:',
   'cli.settingsLanguage': 'Language',
   'cli.settingsTheme': 'Theme',
+  'cli.settingsAutostart': 'Automatic server startup after login',
+  'cli.settingsAutostartEnable': 'Enable',
+  'cli.settingsAutostartDisable': 'Disable',
+  'cli.enabled': 'Enabled',
+  'cli.disabled': 'Disabled',
+  'cli.unknown': 'Unknown',
+  'cli.autostartEnabled': 'Server startup is enabled for your next login.',
+  'cli.autostartDisabled': 'Server startup is disabled.',
+  'cli.autostartFailed': 'Could not update automatic server startup: {error}',
+  'cli.settingsServers': 'Active Server',
   'cli.settingsExit': 'Save and return',
   'cli.settingsSaved': 'Settings saved.',
   'cli.langNotSaved': 'Could not save the language preference: {error}',
@@ -273,12 +318,25 @@ Presets are saved in {presetsDir}`,
   'web.mcpAlreadyConfigured': 'Configured',
   'web.mcpSuccess': 'Successfully configured MCP in: {agents}',
   'web.mcpSaveBtn': 'Save & Configure',
+  'web.servers': 'Servers',
+  'web.addServer': 'Add Server',
+  'web.removeServer': 'Remove',
+  'web.addServerModalTitle': 'Add Remote Server',
+  'web.serverName': 'Server Name',
+  'web.serverUrl': 'Server URL',
+  'web.serverToken': 'Authentication Token',
+  'web.testConnection': 'Test Connection',
+  'web.saveServer': 'Save Server',
+  'web.serverConnected': 'Connection successful!',
+  'web.serverConnectionFailed': 'Could not connect to server: {error}',
+  'web.serverActive': 'Active',
 
   // CLI Slash Commands
   'cli.menuTitle': 'Select a command:',
   'cli.cmdLoadDesc': 'Tune and load a model with optimal hardware settings',
   'cli.cmdMcpDesc': 'Connect local engine to AI coding agents as MCP server',
   'cli.cmdPresetsDesc': 'View saved tuning presets',
+  'cli.cmdServeDesc': 'Start remote server mode with API authentication',
   'cli.cmdSettingsDesc': 'Configure interface language and visual theme',
   'cli.cmdHelpDesc': 'View usage help and CLI flags',
   'cli.cmdExitDesc': 'Exit',

package/src/i18n/es.js

@@ -1,5 +1,25 @@
 // Spanish catalog. Same keys and {params} as en.js.
 export default {
+  "web.localServerSettings": "Configuración del servidor local",
+  "web.serverAutostartLabel": "Iniciar servidor después del inicio de sesión",
+  "web.serverStartupEnabled": "El inicio automático del servidor está habilitado",
+  "web.serverStartupDisabled": "El inicio automático del servidor está deshabilitado",
+  "web.serverStartupUnknown": "El estado del inicio automático del servidor es desconocido",
+  "web.serverStartupSaved": "Configuración de inicio guardada para el próximo inicio de sesión",
+  "web.serverTokenLabel": "Token de autenticación del servidor",
+  "web.serverTokenReveal": "Mostrar token",
+  "web.serverTokenHide": "Ocultar token",
+  "web.serverTokenCopy": "Copiar token",
+  "web.serverTokenCopied": "Token copiado",
+  "web.serverNoConfig": "Aún no hay configuración del servidor. Ejecute /serve o habilite el inicio automático primero.",
+  "web.serverConnectionInfo": "El servidor escucha en {host}:{port}. Desde otro ordenador, use la IP LAN de este equipo con el puerto {port}, no 0.0.0.0 ni localhost.",
+  "web.serverStartupUnconfirmed": "No se pudo confirmar el estado del inicio.",
+  "web.serverTokenCopyFailed": "No se pudo confirmar la copia del token.",
+  "cli.serverConnection": "Ver detalles de conexión del servidor y token",
+  "cli.serverConnectionDetails": "Dirección de escucha: {host}:{port}; Token de autenticación: {token}; Desde otro ordenador, use la IP LAN del servidor con el puerto {port}, no 0.0.0.0 ni localhost.",
+  "cli.serverNoConfig": "Aún no hay configuración del servidor. Ejecute /serve o habilite el inicio automático primero.",
+  "cli.serverConnectionInvalid": "La configuración del servidor guardada no es válida.",
+  "cli.serverConnectionHelp": "En /settings, seleccione 'Ver detalles de conexión del servidor y token' para recuperar el token guardado. Los Ajustes de escritorio también ofrecen acciones explícitas de mostrar y copiar.",
   // Engine choice
   'engine.reason.onlyInstalled': '{name} es el único instalado.',
   'engine.reason.multiGpu': 'Tienes varias GPUs: LM Studio permite fijar el orden de GPUs y el tipo de KV por modelo.',
@@ -42,6 +62,13 @@ export default {
   'errors.ggufNotFound': 'No encuentro el archivo GGUF de {key}',
   'errors.lmstudioOpen': 'LM Studio está abierto; ciérralo antes de aplicar la configuración.',
   'errors.ollamaUnknownModel': 'Ollama no reconoce el modelo {key}',
+  'errors.ollamaServiceConfig': 'Configuración de servicio de Ollama no válida; no se inició ninguna operación con privilegios.',
+  'errors.ollamaServiceTarget': 'La configuración automática requiere el servicio local de Ollama en el puerto 11434.',
+  'errors.ollamaServiceReady': 'Ollama no estuvo disponible después de la configuración. El modelo no se cargó.',
+  'errors.ollamaAuthorizationRequired': 'Se requiere autorización de administrador. Ejecuta en modo interactivo para autorizar la configuración de Ollama e inténtalo de nuevo.',
+  'errors.ollamaAuthorizationUnavailable': 'La autorización de administrador no está disponible. Comprueba que sudo o un agente de autenticación polkit de escritorio estén instalados.',
+  'errors.ollamaAuthorizationCancelled': 'Se canceló la autorización de administrador. El modelo no se cargó.',
+  'errors.ollamaAuthorizationFailed': 'Falló la configuración del servicio de Ollama. Comprueba el servicio y su copia de seguridad antes de reintentar.',
 
   // Install methods
   'install.ollamaScript': 'Script oficial (ollama.com/install.sh, pide sudo)',
@@ -73,10 +100,13 @@ export default {
   'changes.ollamaSetx': 'Variables de entorno de usuario actualizadas (setx)',
   'changes.ollamaLaunchctl': 'Variables aplicadas con launchctl (hasta el próximo reinicio; añade también a tu perfil si quieres que persistan)',
   'changes.ollamaSystemd': 'Override de systemd instalado y Ollama reiniciado',
+  'changes.ollamaSystemdUnchanged': 'Configuración del servicio de Ollama verificada; no requiere reinicio',
 
   'errors.unknownLocale': 'Idioma desconocido "{lang}". Valores válidos: {list}',
   'errors.unknownTheme': 'Tema desconocido "{theme}". Valores válidos: {list}',
   'errors.unknownProfile': 'Perfil desconocido "{profile}". Valores válidos: {list}',
+  'errors.unauthorized': 'No autorizado: se requiere un token Bearer válido.',
+  'errors.forbiddenRemote': 'Prohibido: esta operación no se puede ejecutar de forma remota.',
   'errors.installNotFinished': 'La instalación no terminó. Vuelve a ejecutar llm-tuner cuando acabe.',
   'errors.modelDownloadFailed': 'No se pudo descargar el modelo',
   'errors.noInstaller': 'No hay un instalador automático para este sistema.',
@@ -106,7 +136,7 @@ Comandos:
   /load                        Ajustar y cargar un modelo con la configuración óptima
   /mcp                         Conectar motor local con agentes de IA como servidor MCP
   /presets                     Listar presets guardados
-  /settings                    Menú interactivo de configuración (idioma y tema)
+  /settings                    Menú interactivo de configuración (idioma, tema e inicio del servidor)
   /help                        Mostrar esta ayuda
   /exit                        Salir del menú interactivo
 
@@ -124,12 +154,27 @@ Opciones:
   --lang <en|es>               Idioma de la interfaz (se guarda para la próxima vez)
   --theme <system|light|dark>  Tema de la interfaz (se guarda para la próxima)
 
+El inicio del servidor se habilita o deshabilita después de iniciar sesión desde /settings. Se ejecuta en el próximo inicio de sesión, no de inmediato.
+
+Los cambios del servicio de Ollama pueden solicitar autorización de administrador en la terminal.
+Si los ajustes no cambian, el servicio no se reinicia. El modo JSON/no interactivo nunca pide contraseña.
+
 Los presets se guardan en {presetsDir}`,
   'cli.desktopStartFailed': 'No se pudo iniciar la aplicación de escritorio: {error}\nEl entorno de escritorio (Electron) se descarga la primera vez que ejecutas llm-tuner-desktop, así que esa primera ejecución necesita conexión a la red.\nLa interfaz de terminal funciona sin él: ejecuta llm-tuner.',
   'cli.settingsTitle': 'Configuración',
   'cli.settingsMenu': 'Selecciona una opción para configurar:',
   'cli.settingsLanguage': 'Idioma',
   'cli.settingsTheme': 'Tema',
+  'cli.settingsAutostart': 'Inicio automático del servidor después de iniciar sesión',
+  'cli.settingsAutostartEnable': 'Habilitar',
+  'cli.settingsAutostartDisable': 'Deshabilitar',
+  'cli.enabled': 'Habilitado',
+  'cli.disabled': 'Deshabilitado',
+  'cli.unknown': 'Desconocido',
+  'cli.autostartEnabled': 'El inicio del servidor quedó habilitado para tu próximo inicio de sesión.',
+  'cli.autostartDisabled': 'El inicio del servidor quedó deshabilitado.',
+  'cli.autostartFailed': 'No se pudo actualizar el inicio automático del servidor: {error}',
+  'cli.settingsServers': 'Servidor activo',
   'cli.settingsExit': 'Guardar y volver',
   'cli.settingsSaved': 'Configuración guardada.',
   'cli.langNotSaved': 'No se pudo guardar la preferencia de idioma: {error}',
@@ -273,12 +318,25 @@ Los presets se guardan en {presetsDir}`,
   'web.mcpAlreadyConfigured': 'Configurado',
   'web.mcpSuccess': 'MCP configurado con éxito en: {agents}',
   'web.mcpSaveBtn': 'Guardar y configurar',
+  'web.servers': 'Servidores',
+  'web.addServer': 'Agregar servidor',
+  'web.removeServer': 'Eliminar',
+  'web.addServerModalTitle': 'Agregar servidor remoto',
+  'web.serverName': 'Nombre del servidor',
+  'web.serverUrl': 'URL del servidor',
+  'web.serverToken': 'Token de autenticación',
+  'web.testConnection': 'Probar conexión',
+  'web.saveServer': 'Guardar servidor',
+  'web.serverConnected': '¡Conexión exitosa!',
+  'web.serverConnectionFailed': 'No se pudo conectar al servidor: {error}',
+  'web.serverActive': 'Activo',
 
   // CLI Slash Commands
   'cli.menuTitle': 'Selecciona un comando:',
   'cli.cmdLoadDesc': 'Ajustar y cargar un modelo con la configuración óptima',
   'cli.cmdMcpDesc': 'Conectar motor local con agentes de IA como servidor MCP',
   'cli.cmdPresetsDesc': 'Ver presets de configuración guardados',
+  'cli.cmdServeDesc': 'Iniciar en modo servidor remoto con autenticación de API',
   'cli.cmdSettingsDesc': 'Configurar idioma y tema de la interfaz',
   'cli.cmdHelpDesc': 'Ver ayuda de uso y opciones',
   'cli.cmdExitDesc': 'Salir',