feat: expand agent integrations and GPU backends

Author: voidstackloop

README.md

@@ -61,6 +61,8 @@ Beyond chat, Modelforge includes an **agentic mode** — the model can read/writ
 **Models & hardware**
 - Model recommendations based on your actual hardware — RAM and VRAM are detected and summed **across all GPUs**, not just the first one, so multi-GPU machines get accurate suggestions.
 - **GPU offload control** — set how many model layers Ollama offloads to GPU (`num_gpu`) per chat, per project, or as a global default; leave it blank to let Ollama decide automatically.
+- **Custom local GPU backends** — register any OpenAI-compatible local endpoint as a no-key GPU backend, including vLLM, LocalAI, TGI, vendor runtimes, and custom CUDA/ROCm/SYCL/Vulkan llama-server builds. Models from these endpoints appear beside other custom providers and retain streaming and Agent tool-calling support when the server supports it.
+- **Bounded VRAM cache** — llama.cpp model loads are coalesced, active models are protected, and idle model/offload variants are evicted least-recently-used so switching models does not grow VRAM use without limit.
 - **Real Hugging Face search** — typing in the model search box queries the actual Hugging Face Hub API (not just "paste an exact URL"), showing real repos ranked by downloads/likes; expand one to see its actual GGUF files with real file sizes, then either pull it via Ollama or download it directly for the llama.cpp backend. Pasting an exact `hf.co/user/repo` tag or a full URL still works too, for Ollama's own pull mechanism.
 - Models with reliable tool/function-calling support are flagged with a 🔧 badge, so picking a good Agent mode model doesn't require guesswork.
 - **Custom model storage location** — Settings → General → Ollama Server → "Model storage location" lets you point downloaded models at any folder (e.g. a larger or faster drive) instead of Ollama's default location. If this app started Ollama, it restarts it automatically with the new location; if Ollama is running outside the app, you're told to restart it yourself.
@@ -142,19 +144,25 @@ Click **Agent** in the chat toolbar and pick a folder — that becomes the model
 
 | Tool | What it does |
 |---|---|
-| `read_file` | Read a text file in the workspace |
+| `read_file` | Read a text file, optionally by line range |
 | `write_file` | Create or overwrite a file (creates parent directories as needed) |
+| `replace_in_file` | Replace an exact text block without rewriting the whole file; supports Undo |
+| `find_files`, `file_info` | Discover files by glob and inspect path metadata |
 | `list_dir` | List files and subdirectories |
 | `search_files` | Search for a text string across the workspace |
+| `make_directory`, `move_path`, `delete_path` | Organize workspace files with explicit approval for mutations |
 | `run_command` | Execute a shell command in the workspace (or a subfolder), with a 60s timeout |
 | `run_code` | Run a Python or JavaScript snippet — a convenience over shell-quoting multi-line code through `run_command`, not a new capability |
 | `git_status`, `git_diff`, `git_log` | Read-only git helpers (auto-approvable, like the file tools) so the model doesn't need to guess flag syntax |
 | `git_commit` | Stage everything and commit — requires approval, like `write_file` |
+| `github_list_repositories` | List repositories accessible to the linked GitHub account |
+| `github_repository_tree` | Inspect a repository's complete file structure before analysis |
+| `github_read_file` | Read selected files from public or private linked-account repositories |
 
 **Safety model:**
-- `read_file`, `write_file`, `list_dir`, and `search_files` are genuinely confined to the chosen workspace folder — path-traversal attempts (`../../etc`, absolute paths elsewhere on disk) are rejected before anything runs.
+- Built-in filesystem tools are genuinely confined to the chosen workspace folder — path traversal (`../../etc`), absolute paths elsewhere on disk, and symlinks that resolve outside the workspace are rejected before anything runs.
 - `run_command` and `run_code` are different: a shell command (or a script `run_code` hands to `python3`/`node`) is opaque text that can reference any path on the system regardless of its working directory, so neither is sandboxed the way the file tools are. As a safety net, commands (and `run_code`'s source text) matching destructive or system-level patterns — deleting outside the workspace, formatting a drive, shutting down the machine, registry deletion, `sudo`/`runas`, piping a remote script into a shell — are **rejected outright**, even if already approved. This blocklist catches the common catastrophic cases, not everything a shell or script can do — only approve a command or snippet you actually understand.
-- Every call (including ones the blocklist doesn't catch) shows an **Allow / Deny** card before it executes — nothing runs without an explicit click. Read-only tools (`read_file`, `list_dir`, `search_files`, `git_status`, `git_diff`, `git_log`) can be marked "always allow this session" to cut down on repetitive approvals; `write_file`, `run_command`, `run_code`, and `git_commit` always require a fresh click, since they have real, potentially irreversible effects.
+- Every call (including ones the blocklist doesn't catch) shows an **Allow / Deny** card before it executes — nothing runs without an explicit click. Read-only tools (`read_file`, `find_files`, `file_info`, `list_dir`, `search_files`, `git_status`, `git_diff`, `git_log`) can be marked "always allow this session" to cut down on repetitive approvals; filesystem mutations, `run_command`, `run_code`, and `git_commit` always require a fresh click, since they have real, potentially irreversible effects.
 - A per-turn step limit (25 tool-result → model-continuation round trips) stops a model from looping indefinitely without producing a final answer.
 - The trust list for "always allow" is in-memory only — closing and reopening a chat resets it.
 

app/src/accounts.ts

@@ -0,0 +1,76 @@
+import * as secretsStore from "./secrets-store";
+
+export type AccountProvider = "github" | "huggingface";
+
+export interface LinkedAccount {
+    provider: AccountProvider;
+    username: string;
+    displayName: string | null;
+    avatarUrl: string | null;
+    profileUrl: string;
+}
+
+const TOKEN_KEYS: Record<AccountProvider, string> = {
+    github: "github_token",
+    huggingface: "huggingface_token",
+};
+
+function assertProvider(provider: AccountProvider): void {
+    if (provider !== "github" && provider !== "huggingface") throw new Error("Unsupported account provider.");
+}
+
+async function requestProfile(provider: AccountProvider, token: string): Promise<LinkedAccount> {
+    const url = provider === "github" ? "https://api.github.com/user" : "https://huggingface.co/api/whoami-v2";
+    const headers: Record<string, string> = { Authorization: `Bearer ${token}`, Accept: "application/json" };
+    if (provider === "github") {
+        headers["X-GitHub-Api-Version"] = "2026-03-10";
+        headers["User-Agent"] = "Modelforge";
+    }
+    let response: Response;
+    try {
+        response = await fetch(url, { headers });
+    } catch (error) {
+        throw new Error(`Couldn't reach ${provider === "github" ? "GitHub" : "Hugging Face"}: ${(error as Error).message}`);
+    }
+    if (response.status === 401) throw new Error("The token is invalid or has expired.");
+    if (!response.ok) throw new Error(`Account verification failed (HTTP ${response.status}).`);
+    const data = await response.json() as Record<string, unknown>;
+    const username = String(provider === "github" ? data.login ?? "" : data.name ?? data.username ?? "");
+    if (!username) throw new Error("The account provider returned an incomplete profile.");
+    return {
+        provider,
+        username,
+        displayName: typeof data.fullname === "string" ? data.fullname : typeof data.name === "string" && provider === "github" ? data.name : null,
+        avatarUrl: typeof data.avatar_url === "string" ? data.avatar_url : typeof data.avatarUrl === "string" ? data.avatarUrl : null,
+        profileUrl: provider === "github" ? `https://github.com/${username}` : `https://huggingface.co/${username}`,
+    };
+}
+
+export async function connectAccount(provider: AccountProvider, token: string): Promise<LinkedAccount> {
+    assertProvider(provider);
+    const trimmed = token.trim();
+    if (!trimmed) throw new Error("Enter an access token.");
+    const profile = await requestProfile(provider, trimmed);
+    secretsStore.setSecret(TOKEN_KEYS[provider], trimmed);
+    secretsStore.setSecret(`${TOKEN_KEYS[provider]}_profile`, JSON.stringify(profile));
+    return profile;
+}
+
+export function getLinkedAccount(provider: AccountProvider): LinkedAccount | null {
+    assertProvider(provider);
+    if (!secretsStore.hasSecret(TOKEN_KEYS[provider])) return null;
+    const stored = secretsStore.getSecret(`${TOKEN_KEYS[provider]}_profile`);
+    if (!stored) return null;
+    try { return JSON.parse(stored) as LinkedAccount; } catch { return null; }
+}
+
+export function disconnectAccount(provider: AccountProvider): void {
+    assertProvider(provider);
+    secretsStore.setSecret(TOKEN_KEYS[provider], "");
+    secretsStore.setSecret(`${TOKEN_KEYS[provider]}_profile`, "");
+}
+
+export function getAccountToken(provider: AccountProvider): string | null {
+    assertProvider(provider);
+    return secretsStore.getSecret(TOKEN_KEYS[provider]);
+}

app/src/agent-tools.test.ts

@@ -6,6 +6,12 @@ import { execSync } from "node:child_process";
 import {
     readFile,
     writeFile,
+    replaceInFile,
+    findFiles,
+    fileInfo,
+    makeDirectory,
+    movePath,
+    deletePath,
     listDir,
     searchFiles,
     executeTool,
@@ -49,6 +55,13 @@ describe("agent-tools", () => {
             fs.writeFileSync(path.join(workspace, "sub", "file.txt"), "hi");
             expect(readFile(workspace, "sub/file.txt")).toBe("hi");
         });
+
+        it.skipIf(process.platform === "win32")("rejects a symlink that escapes the workspace", () => {
+            const outside = fs.mkdtempSync(path.join(os.tmpdir(), "agent-tools-outside-"));
+            fs.writeFileSync(path.join(outside, "secret.txt"), "secret");
+            fs.symlinkSync(outside, path.join(workspace, "escape"), "dir");
+            expect(() => readFile(workspace, "escape/secret.txt")).toThrow(/symbolic link/);
+        });
     });
 
     describe("readFile", () => {
@@ -68,6 +81,12 @@ describe("agent-tools", () => {
             expect(result.length).toBeLessThan(200_000);
             expect(result).toContain("truncated");
         });
+
+        it("reads an inclusive line range from a large file", () => {
+            fs.writeFileSync(path.join(workspace, "lines.txt"), "one\ntwo\nthree\nfour");
+            expect(readFile(workspace, "lines.txt", 2, 3)).toBe("two\nthree");
+            expect(() => readFile(workspace, "lines.txt", 99, 100)).toThrow(/beyond the file/);
+        });
     });
 
     describe("writeFile", () => {
@@ -89,6 +108,45 @@ describe("agent-tools", () => {
         });
     });
 
+    describe("precise filesystem tools", () => {
+        it("replaces a unique text block and supports rollback", () => {
+            fs.writeFileSync(path.join(workspace, "edit.txt"), "before middle after");
+            expect(replaceInFile(workspace, "edit.txt", "middle", "updated")).toMatchObject({ replacements: 1 });
+            expect(readFile(workspace, "edit.txt")).toBe("before updated after");
+            rollbackLastWrite(workspace);
+            expect(readFile(workspace, "edit.txt")).toBe("before middle after");
+        });
+
+        it("rejects ambiguous replacements unless replaceAll is enabled", () => {
+            fs.writeFileSync(path.join(workspace, "edit.txt"), "same same");
+            expect(() => replaceInFile(workspace, "edit.txt", "same", "new")).toThrow(/matched 2 times/);
+            expect(replaceInFile(workspace, "edit.txt", "same", "new", true).replacements).toBe(2);
+        });
+
+        it("finds files with recursive glob patterns and skips dependencies", () => {
+            fs.mkdirSync(path.join(workspace, "src", "nested"), { recursive: true });
+            fs.writeFileSync(path.join(workspace, "root.ts"), "");
+            fs.writeFileSync(path.join(workspace, "src", "nested", "child.ts"), "");
+            fs.mkdirSync(path.join(workspace, "node_modules"));
+            fs.writeFileSync(path.join(workspace, "node_modules", "ignored.ts"), "");
+            expect(findFiles(workspace, "**/*.ts")).toEqual(["root.ts", "src/nested/child.ts"]);
+        });
+
+        it("reports metadata and creates, moves, then deletes workspace paths", () => {
+            expect(makeDirectory(workspace, "a/b")).toEqual({ created: true });
+            fs.writeFileSync(path.join(workspace, "a", "b", "file.txt"), "hello");
+            expect(fileInfo(workspace, "a/b/file.txt")).toMatchObject({ type: "file", sizeBytes: 5 });
+            expect(movePath(workspace, "a/b/file.txt", "renamed/file.txt")).toEqual({ moved: true });
+            expect(deletePath(workspace, "renamed/file.txt")).toEqual({ deleted: true });
+            expect(fs.existsSync(path.join(workspace, "renamed", "file.txt"))).toBe(false);
+        });
+
+        it("never deletes or moves the workspace root", () => {
+            expect(() => deletePath(workspace, ".", true)).toThrow(/workspace root/);
+            expect(() => movePath(workspace, ".", "moved")).toThrow(/workspace root/);
+        });
+    });
+
     describe("rollbackLastWrite", () => {
         it("returns null when there is nothing to roll back", () => {
             expect(rollbackLastWrite(workspace)).toBeNull();