agentic-workspace
Public
README.md
README.md
Agentic Workspace turns a local model into a coding agent that works on a real folder on your machine: it reads the repository, proposes a plan, makes multi-file edits as reversible transactions, runs your build and tests, uses Git and GitHub, researches the web, and delegates bounded sub-tasks to sub-agents. Nothing it changes happens behind your back — by default the model has to propose a plan and you have to type /accept before a single file is written.
Version 0.3.1. It adds tools and a small prompt hint only; it never takes over LM Studio's prediction loop, so it composes with rootmonster/context-compressor 0.7.0+ in the same chat through the agentic-workspace/v1 result protocol.
Install from the LM Studio Hub, enable the plugin in a chat, and set Workspace path in the plugin's settings to the folder you want it to work in. LM Studio gives every chat its own empty working-directories/<id> folder; the plugin uses that only when the setting is blank, and a folder you picked for the chat yourself always wins. Whichever folder applies is the workspace: the plugin cannot read or write outside it (workspace_inspect overview reports the root it is using).
From source instead:
Nothing else is needed. The browser module is off by default and, when you turn it on, uses a Chrome/Chromium/Edge you already have — no browser is downloaded.
The defaults are Plan mode, commands on, destructive commits off. Here is exactly what that looks like.
1. You ask for something.
(The @agentic marker is what turns on the six-step workflow hint by default; the permission-mode hint is added to every message regardless. Set Workflow prompt hint to always if you would rather not type it.)
2. The model looks around and proposes a plan. It calls workspace_inspect and workspace_edit(action="preview") freely — reading is never gated — and then calls workspace_plan(action="propose"). You see the plan restated in the chat, and it stops. Nothing has been written. If it tries to skip ahead, the edit comes back refused with APPROVAL_REQUIRED, which tells it to propose a plan first.
3. You reply.
LM Studio shows Approved plan_…: Fix the off-by-one in sum(), and your message reaches the model as an instruction to execute the approved plan.
4. It executes. The edit is committed as a transaction, node --test runs, and the result comes back with the exit code. If the tests fail it edits again — still under the same approved plan, no further prompts. When it is done it calls workspace_plan(action="complete") and mutating tools lock again.
5. You inspect. Every change is on disk under .agentic/transactions/<tx_id>/ as plan.json, changes.diff, review.md and before/after snapshots, and workspace_edit(action="rollback", transaction_id: "tx_…") puts it back.
If you would rather approve every single action, move the Permission mode slider to 0. If you trust the model with the folder, move it to 2.
One slider, three modes: 0 = Manual · 1 = Plan · 2 = Auto. The default is 1 (Plan).
| Mode | What happens to a mutating call | You type |
|---|---|---|
| 0 — Manual | Every one is staged: the call returns pending_approval with an approval_… id and the exact call to resume with. The model reports the id and stops. | /accept approval_… for each |
| 1 — Plan (default) | Refused with APPROVAL_REQUIRED until you approve one workspace_plan proposal. After that everything in the plan runs unasked until the model completes the plan. | /accept plan_… once |
| 2 — Auto | Runs immediately. workspace_plan is not even registered. | nothing |
Reads, searches, To-Do boards, notes and plan proposals are never gated in any mode.
Allow destructive commits is a separate ceiling that applies in all three modes, including Auto. While it is off — the default — anything that deletes, moves or overwrites existing content is refused outright, before approvals are considered. Creating new files is not destructive, so scaffolding a new project needs nothing switched on.
Plan mode: the model proposes, you approve once, and mutating tools stay open until the plan is completed — or until the model proposes a new plan, which supersedes the approved one and locks mutating tools again. That is why a well-behaved model proposes again only when the plan itself has to change.
Manual mode: each staged call is single-use and bound to the SHA-256 of that exact operation — for an edit, the same operations against the same file contents — so an approval never carries over to a different call, or to the same edit after a file changed underneath it. Approvals expire 24 hours after they are staged; a denial blocks that identical operation for the same 24 hours.
Repository initialization, staging, commits, checkouts, branch creation and deletion, pushes and issue/PR creation are all gated the same way, as are commands, browser control, web search/fetch and sub-agent runs.
Outside Auto mode every message you send also carries a short <agentic-mode> block naming the mode, the current plan and up to five pending approvals, so the model can tell you which id to name.
| Tool | What it is for |
|---|---|
workspace_inspect | Overview, trees, ranged line-numbered reads, literal/regex search, ranked lexical code search, filename discovery, metadata, and the index of durable state for recovery. |
workspace_edit | Transactional create / rewrite / replace / splice / copy / move / delete / mkdir — previewed with a full diff, committed under re-checked preconditions, rolled back on demand. |
workspace_plan | Propose, show, complete and list the plan you approve before mutating tools run. Registered outside Auto mode. |
workspace_notes | Scratchpad notes under .agentic/notes/ plus one persistent .agentic/MEMORY.md the model reads at the start of a task. Never gated. |
workspace_tasks | Durable To-Do boards with dependencies, priorities, evidence, decisions, blockers and checkpoints. |
workspace_research | Web search and page fetch with a durable source ledger, sourced notes, and bounded deep-research runs that produce a report. |
workspace_command | Allowlisted foreground and background processes — executable plus argument array, never a shell string — with timeouts, cancellation and complete output artifacts. |
Ten tools with precise actions cost far less prompt context than dozens of near-identical single-purpose tools — and the whole schema block is re-sent on every turn, so that matters on a local model.
Nothing is written when the model plans an edit. A transaction is recorded first:
Commit re-resolves and re-checks every path, hash, existence state, mode and symlink boundary under a workspace-wide lock. If a multi-file commit fails partway, the files already written are restored. That is practical transactional recovery on an ordinary filesystem — not a claim of kernel-level atomicity.
Mutation locks are keyed by the resolved workspace, so two LM Studio chats open on the same repository cannot both pass stale checks and silently overwrite each other.
Every result carries stable ids and state paths, so when the conversation is compacted the model can pick the thread back up:
See Context-compressor integration for what survives compaction and what is deliberately dropped.
Every field in the plugin's settings panel. Defaults are what you get on a fresh install; changes take effect on your next message.
| Setting | Key | Default | Range | What it does |
|---|---|---|---|---|
| Workspace path | defaultWorkspacePath | (blank) | text | Folder the tools work in. Wins over LM Studio's auto-created per-chat folder (working-directories/<id>); a working directory you picked for the chat yourself still wins. Blank with no chat folder means the tools refuse with INVALID_INPUT. |
| Permission mode | permissionMode | 1 | 0–2 | 0 Manual, 1 Plan, 2 Auto — see Permission modes. |
| Allow destructive commits | allowDestructiveEdits | off | on / off | The ceiling that applies in every mode: delete, move and overwrite of existing content, forced rollback, checkout, branch deletion and forced push. |
| Paths the model may not write | protectedPatterns | .env,.env.*,**/*.pem,**/*.key | text | Comma- or newline-separated globs. Blocks edits, not reads — keep real secrets outside the workspace. .git/** and .agentic/** are always write-protected. |
| Maximum readable text file bytes | maxReadBytes | 5000000 | 1000–50000000 | Larger or binary files are refused by the text tools. |
Every row below is a real run of the live harness in this repository, on a Windows host, one model at a time. The matrix rows were loaded at a 16384-token context; the qwen/qwen3.8-27b file is the original baseline, whose S1 and S5 ran at 8192 and whose other rows carry their own (ctx N) label:
node --test, report the exit code (Auto mode).workspace_plan, stop, then execute after the user types , which the real prompt preprocessor handles.| Model | S1 | S3 | S5 | S9 | What happened |
|---|---|---|---|---|---|
qwen/qwen3.8-27b | ✅ | ✅ | ✅ | ❌ | The strongest of the set: S1, S3 and S5 clean in-process, and S1 and S3 clean again through the installed plugin. S9 builds and verifies the whole project (4/4 scored, 11/11 checks) and then the trailing chat overflows a 16384-token window on this model — 3 of 3 fresh runs, so the earlier "passed at the ceiling" sample was luck rather than a pass. Pair it with a context compressor or give it a larger window. |
openai/gpt-oss-20b | ✅ | ✅ | ✅ | ❌ | The cleanest of the set: 4–14 tool calls per scenario and no invalid tool requests anywhere. S9 scored 4/4 — package.json, src/wordcount.js, three passing tests — and the run is still recorded as a failure because the following prompt needed 16931 tokens. |
google/gemma-4-26b-a4b-qat | ✅ | ✅ | ❌ | ❌ | Follows the workflow hint to the letter: memory file, To-Do board, evidence on every item. That bookkeeping used half of S5's ten-round budget, and the round budget ran out before the background job was canceled. S9 made one invalid tool request, diagnosed the schema error from the feedback, then produced 11 803 tokens of reply and reached the context ceiling without retrying. |
qwen3-14b-abliterated | ❌ | ✅ | ✅ | ❌ | Plan mode and command control are clean. S1 stops after a single real call, with the rest of its tool calls printed as <tool_call>{…}</tool_call> prose instead of being called. S9 ends the same way and for the same reason: its create of package.json carrying overwrite: true applies, and the next file is printed as prose, so the run stops after two tool calls with one applied transaction and nothing under or . |
✅ = every check passed. ✅⚠️ = every check passed and the run reached the context ceiling. ❌ = at least one check failed, or the run ended in an error. A model whose SDK trainedForToolUse flag is false is refused by the harness before any scenario runs and would be listed here as "not tool-trained (SDK flag)" with no scenario results; none of the seven models above was refused by that check.
The Checks column in live/results/*.md counts two different things, and both are recorded as passing. A scored check is a pass/fail assertion about the filesystem, git or .agentic/ state. A measurement is a number or string folded into a check name — score: 4/4, applied transactions: 5, model ran node --test: yes (2) — that exists to be read afterwards and can never fail a run. So S9's 11/11 is four scored criteria plus seven measurements; the criteria it actually met are the score: line in the JSON, which is why a 4/4 and an 11/11 sit in the same row.
S9 also does not require a tidy result. It asks for a working package.json, something under src/, tests under tests/ and a green node --test; a model is free to leave extra fixtures behind, and qwen/qwen3.8-27b wrote a sample.txt alongside the CLI to exercise it. Nothing in the plugin cleans a workspace up after a run, and no scenario asserts that the tree contains only the files it asked for.
Wall-clock numbers depend on the host GPU and are comparable only within one model. The full per-scenario tables, including checks, tool calls, rounds, invalid requests and token counts, are committed under live/results/:
Why did it stop and ask me for something?
The default is Plan mode. Mutating tools stay locked until you approve one plan, so the first attempt to edit, run a command or commit comes back APPROVAL_REQUIRED and the model proposes a plan instead. Reply /accept and it carries on. If you never want that, set the Permission mode slider to 2 (Auto).
I typed /accept and nothing happened.
/accept decides exactly one record — with no id, the most recently staged one. If several are waiting, name the id: /accept approval_…. Nothing pending at all gets you a message saying so.
Are approvals tied to this chat?
No. There is no chat id available to a plugin, so an approval is scoped to the workspace whose .agentic/approvals/state.json holds it. Two chats open on the same folder share the same pending items. Every record — an approved plan included — expires 24 hours after it was created, which is what stops a plan approved yesterday from silently unlocking Plan mode today.
I changed a setting and it did not take effect. Settings are read once per tools-provider call, so a change lands on your next message, not the one in flight. Send anything and the new value is live.
What is the .agentic/ folder, and can the model write to it?
It is the plugin's durable state inside your workspace: transactions, jobs, agent runs, task boards, research projects, approvals, plans, notes, MEMORY.md, journal.ndjson and stored artifacts. It is readable but never writable by the model — .agentic/** and .git/** are refused for every model edit, whichever tool tries. That asymmetry is deliberate: recovery after a context compaction works by reading those files back. Add it to your .gitignore if you do not want it committed.
Can I delete .agentic/?
Yes, when nothing is running. You lose transaction history, rollback ability, boards, notes and memory. Nothing else breaks; the plugin recreates it.
Does it need network access?
Only for workspace_research and the browser module, and both are gated by the permission mode. Everything else is local. Set Web domain allowlist if you want to narrow it, or turn Enable web research tools off entirely.
How do I pair it with a context compressor?
Install rootmonster/context-compressor 0.7.0+ and enable both in the same chat. This plugin registers no prediction-loop handler, so there is nothing to conflict: the compressor owns prediction, token accounting and compaction, and this one owns the tools. The compressor understands the agentic-workspace/v1 envelope and keeps ids, statuses, artifact paths and hashes while dropping declared bulky payloads. The revision that also preserves staged approvals and plans through compaction ships alongside this 0.3.0 release; on an older compressor those ids still survive in the result summary and retention facts.
Is a command sandboxed? No. An allowed executable runs with the operating-system permissions of LM Studio. The allowlist, the no-shell argument arrays and the workspace-contained working directory reduce accidents; they are not a sandbox. Use a disposable account, container or VM for a repository you do not trust, and read SECURITY.md.
A capable model still produces nothing.
Read .agentic/journal.ndjson: every mutation, refusal and approval decision is recorded there with its reason. The tool results in the chat carry the same message. Most stalls on small models are tool-call formatting, not the task — see Model compatibility.
npm run live needs LM Studio running; it unloads everything, JIT-loads one model, and writes live/results/<date>-<model>.{json,md}. --driver installed drives the plugin as LM Studio actually loads it (lms dev --install -y first), which needs LM Studio's Developer → Server Settings → Require Authentication switched on and an API token whose "Allow calling servers from mcp.json" permission is on — that switch is mislabelled: it is the plugin-use permission, and it silently resets to deny whenever token mode is off. Pass the token with --token-file <path> or LM_API_TOKEN; once authentication is on every SDK call needs it, including the harness's own model loads. None of this applies to using the plugin: end users install it from the Hub and need no token and no server settings.
The source release passes:
O_NOFOLLOW, and POSIX-only path-alias cases).It has been run live against seven local models on a Windows host, in-process and through the installed plugin (lms dev --install, SDK pluginTools with an API token) — every row of Model compatibility is one of those runs. Still open: authenticated gh actions, browser launch, dual-plugin end-to-end compaction with a context compressor, and macOS/Linux hosts.
See Release validation, Security, Tool reference, Architecture and Capability matrix.
Free for personal and internal professional use — use it, modify it, self-host it at home or at work at no cost.
Commercial embedding requires a license: incorporating this software (or a derivative) into a product or service that people pay for requires a separate commercial agreement with the author — contact via GitHub or the LM Studio Hub profile. See LICENSE for the full terms.
Agentic Workspace turns a local model into a coding agent that works on a real folder on your machine: it reads the repository, proposes a plan, makes multi-file edits as reversible transactions, runs your build and tests, uses Git and GitHub, researches the web, and delegates bounded sub-tasks to sub-agents. Nothing it changes happens behind your back — by default the model has to propose a plan and you have to type /accept before a single file is written.
Version 0.3.1. It adds tools and a small prompt hint only; it never takes over LM Studio's prediction loop, so it composes with rootmonster/context-compressor 0.7.0+ in the same chat through the agentic-workspace/v1 result protocol.
Install from the LM Studio Hub, enable the plugin in a chat, and set Workspace path in the plugin's settings to the folder you want it to work in. LM Studio gives every chat its own empty working-directories/<id> folder; the plugin uses that only when the setting is blank, and a folder you picked for the chat yourself always wins. Whichever folder applies is the workspace: the plugin cannot read or write outside it (workspace_inspect overview reports the root it is using).
From source instead:
Nothing else is needed. The browser module is off by default and, when you turn it on, uses a Chrome/Chromium/Edge you already have — no browser is downloaded.
The defaults are Plan mode, commands on, destructive commits off. Here is exactly what that looks like.
1. You ask for something.
(The @agentic marker is what turns on the six-step workflow hint by default; the permission-mode hint is added to every message regardless. Set Workflow prompt hint to always if you would rather not type it.)
2. The model looks around and proposes a plan. It calls workspace_inspect and workspace_edit(action="preview") freely — reading is never gated — and then calls workspace_plan(action="propose"). You see the plan restated in the chat, and it stops. Nothing has been written. If it tries to skip ahead, the edit comes back refused with APPROVAL_REQUIRED, which tells it to propose a plan first.
3. You reply.
LM Studio shows Approved plan_…: Fix the off-by-one in sum(), and your message reaches the model as an instruction to execute the approved plan.
4. It executes. The edit is committed as a transaction, node --test runs, and the result comes back with the exit code. If the tests fail it edits again — still under the same approved plan, no further prompts. When it is done it calls workspace_plan(action="complete") and mutating tools lock again.
5. You inspect. Every change is on disk under .agentic/transactions/<tx_id>/ as plan.json, changes.diff, review.md and before/after snapshots, and workspace_edit(action="rollback", transaction_id: "tx_…") puts it back.
If you would rather approve every single action, move the Permission mode slider to 0. If you trust the model with the folder, move it to 2.
One slider, three modes: 0 = Manual · 1 = Plan · 2 = Auto. The default is 1 (Plan).
| Mode | What happens to a mutating call | You type |
|---|---|---|
| 0 — Manual | Every one is staged: the call returns pending_approval with an approval_… id and the exact call to resume with. The model reports the id and stops. | /accept approval_… for each |
| 1 — Plan (default) | Refused with APPROVAL_REQUIRED until you approve one workspace_plan proposal. After that everything in the plan runs unasked until the model completes the plan. | /accept plan_… once |
| 2 — Auto | Runs immediately. workspace_plan is not even registered. | nothing |
Reads, searches, To-Do boards, notes and plan proposals are never gated in any mode.
Allow destructive commits is a separate ceiling that applies in all three modes, including Auto. While it is off — the default — anything that deletes, moves or overwrites existing content is refused outright, before approvals are considered. Creating new files is not destructive, so scaffolding a new project needs nothing switched on.
Plan mode: the model proposes, you approve once, and mutating tools stay open until the plan is completed — or until the model proposes a new plan, which supersedes the approved one and locks mutating tools again. That is why a well-behaved model proposes again only when the plan itself has to change.
Manual mode: each staged call is single-use and bound to the SHA-256 of that exact operation — for an edit, the same operations against the same file contents — so an approval never carries over to a different call, or to the same edit after a file changed underneath it. Approvals expire 24 hours after they are staged; a denial blocks that identical operation for the same 24 hours.
Repository initialization, staging, commits, checkouts, branch creation and deletion, pushes and issue/PR creation are all gated the same way, as are commands, browser control, web search/fetch and sub-agent runs.
Outside Auto mode every message you send also carries a short <agentic-mode> block naming the mode, the current plan and up to five pending approvals, so the model can tell you which id to name.
| Tool | What it is for |
|---|---|
workspace_inspect | Overview, trees, ranged line-numbered reads, literal/regex search, ranked lexical code search, filename discovery, metadata, and the index of durable state for recovery. |
workspace_edit | Transactional create / rewrite / replace / splice / copy / move / delete / mkdir — previewed with a full diff, committed under re-checked preconditions, rolled back on demand. |
workspace_plan | Propose, show, complete and list the plan you approve before mutating tools run. Registered outside Auto mode. |
workspace_notes | Scratchpad notes under .agentic/notes/ plus one persistent .agentic/MEMORY.md the model reads at the start of a task. Never gated. |
workspace_tasks | Durable To-Do boards with dependencies, priorities, evidence, decisions, blockers and checkpoints. |
workspace_research | Web search and page fetch with a durable source ledger, sourced notes, and bounded deep-research runs that produce a report. |
workspace_command | Allowlisted foreground and background processes — executable plus argument array, never a shell string — with timeouts, cancellation and complete output artifacts. |
Ten tools with precise actions cost far less prompt context than dozens of near-identical single-purpose tools — and the whole schema block is re-sent on every turn, so that matters on a local model.
Nothing is written when the model plans an edit. A transaction is recorded first:
Commit re-resolves and re-checks every path, hash, existence state, mode and symlink boundary under a workspace-wide lock. If a multi-file commit fails partway, the files already written are restored. That is practical transactional recovery on an ordinary filesystem — not a claim of kernel-level atomicity.
Mutation locks are keyed by the resolved workspace, so two LM Studio chats open on the same repository cannot both pass stale checks and silently overwrite each other.
Every result carries stable ids and state paths, so when the conversation is compacted the model can pick the thread back up:
See Context-compressor integration for what survives compaction and what is deliberately dropped.
Every field in the plugin's settings panel. Defaults are what you get on a fresh install; changes take effect on your next message.
| Setting | Key | Default | Range | What it does |
|---|---|---|---|---|
| Workspace path | defaultWorkspacePath | (blank) | text | Folder the tools work in. Wins over LM Studio's auto-created per-chat folder (working-directories/<id>); a working directory you picked for the chat yourself still wins. Blank with no chat folder means the tools refuse with INVALID_INPUT. |
| Permission mode | permissionMode | 1 | 0–2 | 0 Manual, 1 Plan, 2 Auto — see Permission modes. |
| Allow destructive commits | allowDestructiveEdits | off | on / off | The ceiling that applies in every mode: delete, move and overwrite of existing content, forced rollback, checkout, branch deletion and forced push. |
| Paths the model may not write | protectedPatterns | .env,.env.*,**/*.pem,**/*.key | text | Comma- or newline-separated globs. Blocks edits, not reads — keep real secrets outside the workspace. .git/** and .agentic/** are always write-protected. |
| Maximum readable text file bytes | maxReadBytes | 5000000 | 1000–50000000 | Larger or binary files are refused by the text tools. |
Every row below is a real run of the live harness in this repository, on a Windows host, one model at a time. The matrix rows were loaded at a 16384-token context; the qwen/qwen3.8-27b file is the original baseline, whose S1 and S5 ran at 8192 and whose other rows carry their own (ctx N) label:
node --test, report the exit code (Auto mode).workspace_plan, stop, then execute after the user types , which the real prompt preprocessor handles.| Model | S1 | S3 | S5 | S9 | What happened |
|---|---|---|---|---|---|
qwen/qwen3.8-27b | ✅ | ✅ | ✅ | ❌ | The strongest of the set: S1, S3 and S5 clean in-process, and S1 and S3 clean again through the installed plugin. S9 builds and verifies the whole project (4/4 scored, 11/11 checks) and then the trailing chat overflows a 16384-token window on this model — 3 of 3 fresh runs, so the earlier "passed at the ceiling" sample was luck rather than a pass. Pair it with a context compressor or give it a larger window. |
openai/gpt-oss-20b | ✅ | ✅ | ✅ | ❌ | The cleanest of the set: 4–14 tool calls per scenario and no invalid tool requests anywhere. S9 scored 4/4 — package.json, src/wordcount.js, three passing tests — and the run is still recorded as a failure because the following prompt needed 16931 tokens. |
google/gemma-4-26b-a4b-qat | ✅ | ✅ | ❌ | ❌ | Follows the workflow hint to the letter: memory file, To-Do board, evidence on every item. That bookkeeping used half of S5's ten-round budget, and the round budget ran out before the background job was canceled. S9 made one invalid tool request, diagnosed the schema error from the feedback, then produced 11 803 tokens of reply and reached the context ceiling without retrying. |
qwen3-14b-abliterated | ❌ | ✅ | ✅ | ❌ | Plan mode and command control are clean. S1 stops after a single real call, with the rest of its tool calls printed as <tool_call>{…}</tool_call> prose instead of being called. S9 ends the same way and for the same reason: its create of package.json carrying overwrite: true applies, and the next file is printed as prose, so the run stops after two tool calls with one applied transaction and nothing under or . |
✅ = every check passed. ✅⚠️ = every check passed and the run reached the context ceiling. ❌ = at least one check failed, or the run ended in an error. A model whose SDK trainedForToolUse flag is false is refused by the harness before any scenario runs and would be listed here as "not tool-trained (SDK flag)" with no scenario results; none of the seven models above was refused by that check.
The Checks column in live/results/*.md counts two different things, and both are recorded as passing. A scored check is a pass/fail assertion about the filesystem, git or .agentic/ state. A measurement is a number or string folded into a check name — score: 4/4, applied transactions: 5, model ran node --test: yes (2) — that exists to be read afterwards and can never fail a run. So S9's 11/11 is four scored criteria plus seven measurements; the criteria it actually met are the score: line in the JSON, which is why a 4/4 and an 11/11 sit in the same row.
S9 also does not require a tidy result. It asks for a working package.json, something under src/, tests under tests/ and a green node --test; a model is free to leave extra fixtures behind, and qwen/qwen3.8-27b wrote a sample.txt alongside the CLI to exercise it. Nothing in the plugin cleans a workspace up after a run, and no scenario asserts that the tree contains only the files it asked for.
Wall-clock numbers depend on the host GPU and are comparable only within one model. The full per-scenario tables, including checks, tool calls, rounds, invalid requests and token counts, are committed under live/results/:
Why did it stop and ask me for something?
The default is Plan mode. Mutating tools stay locked until you approve one plan, so the first attempt to edit, run a command or commit comes back APPROVAL_REQUIRED and the model proposes a plan instead. Reply /accept and it carries on. If you never want that, set the Permission mode slider to 2 (Auto).
I typed /accept and nothing happened.
/accept decides exactly one record — with no id, the most recently staged one. If several are waiting, name the id: /accept approval_…. Nothing pending at all gets you a message saying so.
Are approvals tied to this chat?
No. There is no chat id available to a plugin, so an approval is scoped to the workspace whose .agentic/approvals/state.json holds it. Two chats open on the same folder share the same pending items. Every record — an approved plan included — expires 24 hours after it was created, which is what stops a plan approved yesterday from silently unlocking Plan mode today.
I changed a setting and it did not take effect. Settings are read once per tools-provider call, so a change lands on your next message, not the one in flight. Send anything and the new value is live.
What is the .agentic/ folder, and can the model write to it?
It is the plugin's durable state inside your workspace: transactions, jobs, agent runs, task boards, research projects, approvals, plans, notes, MEMORY.md, journal.ndjson and stored artifacts. It is readable but never writable by the model — .agentic/** and .git/** are refused for every model edit, whichever tool tries. That asymmetry is deliberate: recovery after a context compaction works by reading those files back. Add it to your .gitignore if you do not want it committed.
Can I delete .agentic/?
Yes, when nothing is running. You lose transaction history, rollback ability, boards, notes and memory. Nothing else breaks; the plugin recreates it.
Does it need network access?
Only for workspace_research and the browser module, and both are gated by the permission mode. Everything else is local. Set Web domain allowlist if you want to narrow it, or turn Enable web research tools off entirely.
How do I pair it with a context compressor?
Install rootmonster/context-compressor 0.7.0+ and enable both in the same chat. This plugin registers no prediction-loop handler, so there is nothing to conflict: the compressor owns prediction, token accounting and compaction, and this one owns the tools. The compressor understands the agentic-workspace/v1 envelope and keeps ids, statuses, artifact paths and hashes while dropping declared bulky payloads. The revision that also preserves staged approvals and plans through compaction ships alongside this 0.3.0 release; on an older compressor those ids still survive in the result summary and retention facts.
Is a command sandboxed? No. An allowed executable runs with the operating-system permissions of LM Studio. The allowlist, the no-shell argument arrays and the workspace-contained working directory reduce accidents; they are not a sandbox. Use a disposable account, container or VM for a repository you do not trust, and read SECURITY.md.
A capable model still produces nothing.
Read .agentic/journal.ndjson: every mutation, refusal and approval decision is recorded there with its reason. The tool results in the chat carry the same message. Most stalls on small models are tool-call formatting, not the task — see Model compatibility.
npm run live needs LM Studio running; it unloads everything, JIT-loads one model, and writes live/results/<date>-<model>.{json,md}. --driver installed drives the plugin as LM Studio actually loads it (lms dev --install -y first), which needs LM Studio's Developer → Server Settings → Require Authentication switched on and an API token whose "Allow calling servers from mcp.json" permission is on — that switch is mislabelled: it is the plugin-use permission, and it silently resets to deny whenever token mode is off. Pass the token with --token-file <path> or LM_API_TOKEN; once authentication is on every SDK call needs it, including the harness's own model loads. None of this applies to using the plugin: end users install it from the Hub and need no token and no server settings.
The source release passes:
O_NOFOLLOW, and POSIX-only path-alias cases).It has been run live against seven local models on a Windows host, in-process and through the installed plugin (lms dev --install, SDK pluginTools with an API token) — every row of Model compatibility is one of those runs. Still open: authenticated gh actions, browser launch, dual-plugin end-to-end compaction with a context compressor, and macOS/Linux hosts.
See Release validation, Security, Tool reference, Architecture and Capability matrix.
Free for personal and internal professional use — use it, modify it, self-host it at home or at work at no cost.
Commercial embedding requires a license: incorporating this software (or a derivative) into a product or service that people pay for requires a separate commercial agreement with the author — contact via GitHub or the LM Studio Hub profile. See LICENSE for the full terms.
workspace_vcs | Git and GitHub CLI workflows as structured arguments: init, status, diff, log, show, add, commit, checkout, branch, push, issues, pull requests. |
workspace_browser | Optional persistent Chrome/Chromium/Edge sessions for JavaScript-heavy pages. Off by default. |
workspace_agent | Durable coding, research or general sub-agents, run in bounded passes rebuilt from persisted state rather than a growing hidden transcript. |
npm, npx, tsc, eslint and prettier run without a shell. Those are .cmd shims on Windows, which Node refuses to spawn directly; the plugin resolves each shim to its JavaScript entry and runs it under node, and the result reports resolvedExecutable / resolvedScript.workspace_command status takes tail_chars (default 2000, up to 20000) and returns the last part of the live stdout/stderr, without ever reading the whole log.depends_on accepts "1", "2", … meaning "the n-th item of this create/add", since no item_ id exists yet.workspace_edit and workspace_command take an idempotency_key; the same key with the same operations returns the original result, and the same key with different operations is refused rather than re-run — which is what a model needs after its context was compressed.workspace_agent run takes commit_edits; it can only lower the default the permission mode derives (Auto / approved plan: commit; Manual: leave transactions planned for you), never raise it.workspace_inspect search is literal or regex over file contents; semantic_search ranks files by lexical relevance to a query, for "where is the thing that does X" questions.gh. gh_auth reports whether the GitHub CLI is logged in; issue_list, issue_create, pr_list, pr_create and pr_diff use it. gh must be on the executable allowlist (it is by default).| Maximum editable file bytes | maxEditableBytes | 2000000 | 1000–20000000 | Checked before and after a transaction. |
| Maximum tool preview characters | maxToolResultChars | 14000 | 1000–100000 | How much of a result the model sees inline; the full content is stored as an artifact. |
| Allow process execution | processExecutionEnabled | on | on / off | The workspace_command tool. Executable plus argument array, allowlisted, no shell. Turn it off for a repository you do not trust. |
| Inherit full process environment | inheritProcessEnvironment | off | on / off | Off keeps unrelated environment secrets away from commands. |
| Allowed executables | allowedExecutables | node,npm,npx,pnpm,python,python3,pytest,git,gh,tsc,deno,uv,ruff,eslint,prettier | text | Bare names only, comma-separated. Trim it to what the project needs. |
| Maximum command duration | maxCommandSeconds | 180 | 1–3600 | Bounds run, and start with a positive timeout. start with timeout_seconds: 0 deliberately bypasses it so a dev server can outlive the turn — you cancel that one yourself. |
| Command output preview characters | maxCommandPreviewChars | 10000 | 1000–100000 | Per stdout/stderr stream; the full streams live under .agentic/jobs/. |
| Maximum command artifact bytes | maxCommandArtifactBytes | 20000000 | 10000–200000000 | Per stdout/stderr stream, on disk. |
| Enable durable sub-agents | internalAgentsEnabled | on | on / off | The workspace_agent tool. |
| Agent model id | agentModelId | (blank) | text | Blank uses the chat's model. A separate small model is worth setting for background runs. |
| Agent maximum passes | agentMaxPasses | 6 | 1–20 | Each pass rebuilds a compact view from durable state. |
| Agent tool rounds per pass | agentRoundsPerPass | 4 | 1–12 | Tool rounds inside one pass before state is projected again. |
| Agent maximum tool calls | agentMaxToolCalls | 40 | 1–200 | Hard budget for one run. |
| Allow agents to run commands | agentAllowCommands | on | on / off | Also needs process execution. In Manual mode a run that could run commands or reach the web is staged for approval. |
| Enable durable To-Do boards | taskBoardsEnabled | on | on / off | The workspace_tasks tool. Never gated. |
| Enable web research tools | webResearchEnabled | on | on / off | The workspace_research tool. Search and fetch are gated by the permission mode because they leave your machine. |
| Default web search provider | webSearchProvider | auto | text | One of auto, duckduckgo, wikipedia, searxng. |
| SearXNG base URL | searxngBaseUrl | (blank) | text | Your self-hosted SearXNG endpoint, used by the searxng provider and by auto. |
| Web domain allowlist | webAllowedDomains | (blank) | text | Optional comma/newline-separated domains. Blank allows public hosts; private networks stay blocked either way. |
| Allow private-network web access | allowPrivateNetworkWeb | off | on / off | Enabling this permits localhost, LAN and private IP targets and weakens the SSRF protection. Leave it off unless the target is trusted. |
| Web request timeout | webTimeoutSeconds | 20 | 2–120 | Per search or fetch request, in seconds. |
| Maximum web response bytes | maxWebResponseBytes | 4000000 | 10000–50000000 | Hard cap on a fetched response before extraction. |
| Maximum extracted web text characters | maxWebTextChars | 80000 | 1000–500000 | Long pages are stored as bounded research sources and previewed compactly. |
| Allow sub-agents to use web research | agentAllowWeb | on | on / off | Also needs web research enabled for the chat. |
| Enable Git and GitHub tools | vcsToolsEnabled | on | on / off | The workspace_vcs tool. Needs process execution and git/gh on the allowlist. |
| Enable browser sessions | browserEnabled | off | on / off | Optional Chromium automation. Needs puppeteer-core and a Chrome/Chromium/Edge you already have. |
| Browser executable path | browserExecutablePath | (blank) | text | Blank auto-detects the usual Chrome, Chromium and Edge locations. |
| Run browser headless | browserHeadless | on | on / off | Turn off only when you want to watch the automated window. |
| Allow browser JavaScript evaluation | browserAllowEvaluate | off | on / off | A high-risk escape hatch for page scripting. Off by default. |
| Workflow prompt hint | workflowHintMode | marker | text | off, marker (only when your message contains @agentic), or always. |
/acceptnode --test pass (Auto mode, up to 40 rounds).src/tests/qwen/qwen3-1.7b | ✅ | ❌ | ✅ | ❌ | Fixes a single file, and passes S5 by recovering twice: refused for timeout_seconds: 0, it re-runs with the 180 seconds the refusal names, then abandons a placeholder job id and goes back for the real one. What it cannot do is stop repeating a call that failed. In S3 it proposes a plan and mutates nothing before /accept, then spends 15 of its 26 calls re-sending one replace whose search string is not in the file. In S9 it writes package.json, src/wordcount.js and three test files — 3 of the 4 scored checks, none of the tests passing — then repeats one denied workspace_vcs log fourteen times until it hits the context ceiling. |
meta/llama-3.2-3b | ❌ | ❌ | ❌ | ❌ | Not usable. S1 spent eleven calls without applying a single edit (operations sent as a string rather than an array, twice). S3, S5 and S9 each ended on the first round with an engine error: the model's output does not match its own template's tool-call grammar. |
glm-4.7-flash-uncensored-heretic-neo-code-imatrix-max | ❌ | ❌ | ❌ | ❌ | Not usable. It collapses every multi-field call into a single string field, leaking its own template markers (title: "…</objective></arg_key><arg_value>…"), so workspace_plan(action="propose") never validated in S3, and S9 spent 39 calls — 27 of them workspace_notes — without applying a single transaction. |
qwen/qwen3.8-27b and openai/gpt-oss-20b both produced a correct, tested project and then ran out of context — the 27B in 3 of 3 fresh attempts, including through the installed plugin (one of those three is committed as a result file; the other two are recorded in that file's note). This is not something a setting recovers from: once the accumulated prompt is already larger than the window the engine returns a 400, and contextOverflowPolicy: stopAtLimit can only stop a prediction, not shrink a prompt. Raise the context length, or pair the plugin with a context compressor, before asking for a full project.qwen/qwen3-1.7b passes S1 in six tool calls. Every model that failed S1 failed on tool-call format rather than on the difficulty of the fix, which is a single replace of a + b + 1.workspace_plan, not just one that can read the hint. Every model that produced valid tool calls proposed a plan and mutated nothing before /accept; none was held back by the earlier <agentic-mode> block still sitting in the history. The two models that produced no plan at all never got a valid workspace_plan(action="propose") call out; neither ignored the mode. Stopping after the proposal is a separate skill from making one: qwen/qwen3-1.7b proposed, kept calling tools anyway, and failed S3 on its own repeated replace rather than on the gate.google/gemma-4-26b-a4b-qat edits files perfectly well and still spent half its round budget on bookkeeping and never canceled the job. qwen/qwen3-1.7b passes, but only after burning two calls on the literal placeholder <JOB_ID_FROM_SECOND_STEP> before going back for the id it was given.overwrite: true on a create, timeout_seconds: 0 on a run. Neither is a dead end: overwrite: true over a path that does not exist is not a destructive commit, and the timeout_seconds: 0 refusal names both repairs and the 180-second default that an omitted timeout becomes, which is what qwen/qwen3-1.7b sent on its next call. If a capable model is still producing nothing, read .agentic/journal.ndjson — every mutation, refusal and approval decision is recorded there with its reason — and the tool results in the chat itself, before blaming the task.trainedForToolUse check. Prefer a stock release.2026-08-26-qwen-qwen3.8-27b.md (S1–S9) — its S9 row is the single sample that landed just under the ceiling and is recorded as ✅⚠️; three later runs at the same context, including the installed-driver one below, all hard-failed on prompt size, which is why the table above records S9 as a failure. Result files are never hand-edited: each .md is generated from its .json. Two of them (qwen3-14b-abliterated, qwen-qwen3-1.7b) are composites of rows from before and after a fix commit, and say so in their header.2026-08-26-openai-gpt-oss-20b.md2026-08-26-google-gemma-4-26b-a4b-qat.md2026-08-26-qwen3-14b-abliterated.md2026-08-26-qwen-qwen3-1.7b.md2026-08-26-meta-llama-3.2-3b.md2026-08-26-glm-4.7-flash-uncensored-heretic-neo-code-imatrix-max.md2026-08-26-qwen-qwen3.8-27b-installed.md (the same model through the installed plugin)npm install
npm run check
lms dev --install -y
@agentic Fix the off-by-one in sum() in src/math.js and make the tests pass.
/accept
/accept plan_… approve the proposed plan
/accept approve the most recent pending item
/accept approval_… looks good approve with a note
/deny approval_… keep the old name deny with a reason the model must act on
.agentic/transactions/<transaction-id>/
├── plan.json normalized operations, hashes, modes, destructive causes
├── review.md the human-readable receipt
├── changes.diff the complete unified diff
└── snapshots/ before and after content
workspace_inspect { action: "changes" }
workspace_plan { action: "current" }
workspace_notes { action: "read", memory: true }
workspace_edit { action: "show", transaction_id: "tx_..." }
workspace_tasks { action: "show", board_id: "todo_..." }
workspace_research { action: "show", research_id: "research_..." }
workspace_agent { action: "status", run_id: "run_..." }
workspace_command { action: "status", job_id: "job_..." }
npm run live -- --model <key> --scenario S1,S3,S5,S9
@agentic Create a To-Do board for this refactor, inspect the repository, make the changes transactionally, run the relevant checks, and keep the board evidence current.
Start a deep research project on the current LM Studio plugin API. Use multiple queries, fetch the strongest primary sources, record source IDs for each claim, and produce a report.
Review the current changes, show me the transaction diff, run the test suite, then create a Git commit only if verification succeeds.
npm run check # typecheck + the Node regression suite
npm run check:offline # the same with the SDK/zod/puppeteer types stubbed
npm run live -- --model <key> --scenario S1,S3 # live harness, in-process
npm run live -- --model <key> --driver installed --scenario S1
workspace_vcs | Git and GitHub CLI workflows as structured arguments: init, status, diff, log, show, add, commit, checkout, branch, push, issues, pull requests. |
workspace_browser | Optional persistent Chrome/Chromium/Edge sessions for JavaScript-heavy pages. Off by default. |
workspace_agent | Durable coding, research or general sub-agents, run in bounded passes rebuilt from persisted state rather than a growing hidden transcript. |
npm, npx, tsc, eslint and prettier run without a shell. Those are .cmd shims on Windows, which Node refuses to spawn directly; the plugin resolves each shim to its JavaScript entry and runs it under node, and the result reports resolvedExecutable / resolvedScript.workspace_command status takes tail_chars (default 2000, up to 20000) and returns the last part of the live stdout/stderr, without ever reading the whole log.depends_on accepts "1", "2", … meaning "the n-th item of this create/add", since no item_ id exists yet.workspace_edit and workspace_command take an idempotency_key; the same key with the same operations returns the original result, and the same key with different operations is refused rather than re-run — which is what a model needs after its context was compressed.workspace_agent run takes commit_edits; it can only lower the default the permission mode derives (Auto / approved plan: commit; Manual: leave transactions planned for you), never raise it.workspace_inspect search is literal or regex over file contents; semantic_search ranks files by lexical relevance to a query, for "where is the thing that does X" questions.gh. gh_auth reports whether the GitHub CLI is logged in; issue_list, issue_create, pr_list, pr_create and pr_diff use it. gh must be on the executable allowlist (it is by default).| Maximum editable file bytes | maxEditableBytes | 2000000 | 1000–20000000 | Checked before and after a transaction. |
| Maximum tool preview characters | maxToolResultChars | 14000 | 1000–100000 | How much of a result the model sees inline; the full content is stored as an artifact. |
| Allow process execution | processExecutionEnabled | on | on / off | The workspace_command tool. Executable plus argument array, allowlisted, no shell. Turn it off for a repository you do not trust. |
| Inherit full process environment | inheritProcessEnvironment | off | on / off | Off keeps unrelated environment secrets away from commands. |
| Allowed executables | allowedExecutables | node,npm,npx,pnpm,python,python3,pytest,git,gh,tsc,deno,uv,ruff,eslint,prettier | text | Bare names only, comma-separated. Trim it to what the project needs. |
| Maximum command duration | maxCommandSeconds | 180 | 1–3600 | Bounds run, and start with a positive timeout. start with timeout_seconds: 0 deliberately bypasses it so a dev server can outlive the turn — you cancel that one yourself. |
| Command output preview characters | maxCommandPreviewChars | 10000 | 1000–100000 | Per stdout/stderr stream; the full streams live under .agentic/jobs/. |
| Maximum command artifact bytes | maxCommandArtifactBytes | 20000000 | 10000–200000000 | Per stdout/stderr stream, on disk. |
| Enable durable sub-agents | internalAgentsEnabled | on | on / off | The workspace_agent tool. |
| Agent model id | agentModelId | (blank) | text | Blank uses the chat's model. A separate small model is worth setting for background runs. |
| Agent maximum passes | agentMaxPasses | 6 | 1–20 | Each pass rebuilds a compact view from durable state. |
| Agent tool rounds per pass | agentRoundsPerPass | 4 | 1–12 | Tool rounds inside one pass before state is projected again. |
| Agent maximum tool calls | agentMaxToolCalls | 40 | 1–200 | Hard budget for one run. |
| Allow agents to run commands | agentAllowCommands | on | on / off | Also needs process execution. In Manual mode a run that could run commands or reach the web is staged for approval. |
| Enable durable To-Do boards | taskBoardsEnabled | on | on / off | The workspace_tasks tool. Never gated. |
| Enable web research tools | webResearchEnabled | on | on / off | The workspace_research tool. Search and fetch are gated by the permission mode because they leave your machine. |
| Default web search provider | webSearchProvider | auto | text | One of auto, duckduckgo, wikipedia, searxng. |
| SearXNG base URL | searxngBaseUrl | (blank) | text | Your self-hosted SearXNG endpoint, used by the searxng provider and by auto. |
| Web domain allowlist | webAllowedDomains | (blank) | text | Optional comma/newline-separated domains. Blank allows public hosts; private networks stay blocked either way. |
| Allow private-network web access | allowPrivateNetworkWeb | off | on / off | Enabling this permits localhost, LAN and private IP targets and weakens the SSRF protection. Leave it off unless the target is trusted. |
| Web request timeout | webTimeoutSeconds | 20 | 2–120 | Per search or fetch request, in seconds. |
| Maximum web response bytes | maxWebResponseBytes | 4000000 | 10000–50000000 | Hard cap on a fetched response before extraction. |
| Maximum extracted web text characters | maxWebTextChars | 80000 | 1000–500000 | Long pages are stored as bounded research sources and previewed compactly. |
| Allow sub-agents to use web research | agentAllowWeb | on | on / off | Also needs web research enabled for the chat. |
| Enable Git and GitHub tools | vcsToolsEnabled | on | on / off | The workspace_vcs tool. Needs process execution and git/gh on the allowlist. |
| Enable browser sessions | browserEnabled | off | on / off | Optional Chromium automation. Needs puppeteer-core and a Chrome/Chromium/Edge you already have. |
| Browser executable path | browserExecutablePath | (blank) | text | Blank auto-detects the usual Chrome, Chromium and Edge locations. |
| Run browser headless | browserHeadless | on | on / off | Turn off only when you want to watch the automated window. |
| Allow browser JavaScript evaluation | browserAllowEvaluate | off | on / off | A high-risk escape hatch for page scripting. Off by default. |
| Workflow prompt hint | workflowHintMode | marker | text | off, marker (only when your message contains @agentic), or always. |
/acceptnode --test pass (Auto mode, up to 40 rounds).src/tests/qwen/qwen3-1.7b | ✅ | ❌ | ✅ | ❌ | Fixes a single file, and passes S5 by recovering twice: refused for timeout_seconds: 0, it re-runs with the 180 seconds the refusal names, then abandons a placeholder job id and goes back for the real one. What it cannot do is stop repeating a call that failed. In S3 it proposes a plan and mutates nothing before /accept, then spends 15 of its 26 calls re-sending one replace whose search string is not in the file. In S9 it writes package.json, src/wordcount.js and three test files — 3 of the 4 scored checks, none of the tests passing — then repeats one denied workspace_vcs log fourteen times until it hits the context ceiling. |
meta/llama-3.2-3b | ❌ | ❌ | ❌ | ❌ | Not usable. S1 spent eleven calls without applying a single edit (operations sent as a string rather than an array, twice). S3, S5 and S9 each ended on the first round with an engine error: the model's output does not match its own template's tool-call grammar. |
glm-4.7-flash-uncensored-heretic-neo-code-imatrix-max | ❌ | ❌ | ❌ | ❌ | Not usable. It collapses every multi-field call into a single string field, leaking its own template markers (title: "…</objective></arg_key><arg_value>…"), so workspace_plan(action="propose") never validated in S3, and S9 spent 39 calls — 27 of them workspace_notes — without applying a single transaction. |
qwen/qwen3.8-27b and openai/gpt-oss-20b both produced a correct, tested project and then ran out of context — the 27B in 3 of 3 fresh attempts, including through the installed plugin (one of those three is committed as a result file; the other two are recorded in that file's note). This is not something a setting recovers from: once the accumulated prompt is already larger than the window the engine returns a 400, and contextOverflowPolicy: stopAtLimit can only stop a prediction, not shrink a prompt. Raise the context length, or pair the plugin with a context compressor, before asking for a full project.qwen/qwen3-1.7b passes S1 in six tool calls. Every model that failed S1 failed on tool-call format rather than on the difficulty of the fix, which is a single replace of a + b + 1.workspace_plan, not just one that can read the hint. Every model that produced valid tool calls proposed a plan and mutated nothing before /accept; none was held back by the earlier <agentic-mode> block still sitting in the history. The two models that produced no plan at all never got a valid workspace_plan(action="propose") call out; neither ignored the mode. Stopping after the proposal is a separate skill from making one: qwen/qwen3-1.7b proposed, kept calling tools anyway, and failed S3 on its own repeated replace rather than on the gate.google/gemma-4-26b-a4b-qat edits files perfectly well and still spent half its round budget on bookkeeping and never canceled the job. qwen/qwen3-1.7b passes, but only after burning two calls on the literal placeholder <JOB_ID_FROM_SECOND_STEP> before going back for the id it was given.overwrite: true on a create, timeout_seconds: 0 on a run. Neither is a dead end: overwrite: true over a path that does not exist is not a destructive commit, and the timeout_seconds: 0 refusal names both repairs and the 180-second default that an omitted timeout becomes, which is what qwen/qwen3-1.7b sent on its next call. If a capable model is still producing nothing, read .agentic/journal.ndjson — every mutation, refusal and approval decision is recorded there with its reason — and the tool results in the chat itself, before blaming the task.trainedForToolUse check. Prefer a stock release.2026-08-26-qwen-qwen3.8-27b.md (S1–S9) — its S9 row is the single sample that landed just under the ceiling and is recorded as ✅⚠️; three later runs at the same context, including the installed-driver one below, all hard-failed on prompt size, which is why the table above records S9 as a failure. Result files are never hand-edited: each .md is generated from its .json. Two of them (qwen3-14b-abliterated, qwen-qwen3-1.7b) are composites of rows from before and after a fix commit, and say so in their header.2026-08-26-openai-gpt-oss-20b.md2026-08-26-google-gemma-4-26b-a4b-qat.md2026-08-26-qwen3-14b-abliterated.md2026-08-26-qwen-qwen3-1.7b.md2026-08-26-meta-llama-3.2-3b.md2026-08-26-glm-4.7-flash-uncensored-heretic-neo-code-imatrix-max.md2026-08-26-qwen-qwen3.8-27b-installed.md (the same model through the installed plugin)npm install
npm run check
lms dev --install -y
@agentic Fix the off-by-one in sum() in src/math.js and make the tests pass.
/accept
/accept plan_… approve the proposed plan
/accept approve the most recent pending item
/accept approval_… looks good approve with a note
/deny approval_… keep the old name deny with a reason the model must act on
.agentic/transactions/<transaction-id>/
├── plan.json normalized operations, hashes, modes, destructive causes
├── review.md the human-readable receipt
├── changes.diff the complete unified diff
└── snapshots/ before and after content
workspace_inspect { action: "changes" }
workspace_plan { action: "current" }
workspace_notes { action: "read", memory: true }
workspace_edit { action: "show", transaction_id: "tx_..." }
workspace_tasks { action: "show", board_id: "todo_..." }
workspace_research { action: "show", research_id: "research_..." }
workspace_agent { action: "status", run_id: "run_..." }
workspace_command { action: "status", job_id: "job_..." }
npm run live -- --model <key> --scenario S1,S3,S5,S9
@agentic Create a To-Do board for this refactor, inspect the repository, make the changes transactionally, run the relevant checks, and keep the board evidence current.
Start a deep research project on the current LM Studio plugin API. Use multiple queries, fetch the strongest primary sources, record source IDs for each claim, and produce a report.
Review the current changes, show me the transaction diff, run the test suite, then create a Git commit only if verification succeeds.
npm run check # typecheck + the Node regression suite
npm run check:offline # the same with the SDK/zod/puppeteer types stubbed
npm run live -- --model <key> --scenario S1,S3 # live harness, in-process
npm run live -- --model <key> --driver installed --scenario S1