dbec4a7190
* game-launcher: add launcher toggles, keyboard nav, auto-refresh * game-launcher: update README with runner toggle settings * fix: remove duplicate translation keys after upstream merge * fix(game-launcher): add ~/.local/share/Steam to steam roots for NixOS support * chore(game-launcher): bump version to 1.1.1 * feat(mimir): AI companion plugin with LLM chat panel Mimir is an AI companion for Noctalia — an LLM-powered chat interface with model selection, conversation history, and a bar widget. - Service-based architecture: service (brain) handles HTTP API calls, panel (chat) renders the UI, widget (status) shows bar indicator - OpenAI-compatible chat completions with dynamic model discovery - Floating side panel (center_right) with message history and simple markdown rendering (code blocks) - Model selection dropdown populated from API /models endpoint - Bar widget with brain icon to toggle chat panel - i18n via translations/en.json - Auto-detection of OpenCode Go API key from auth.json - Full-height floating panel layout matching oficial notes plugin .gitignore: add editor files, OS junk, auth secrets, compiled binary * mimir: rename author leo->Alexander, strip scrollBottom, update README with plans - plugin.toml: author leo -> Alexander, widget panel-toggle id -> alexander/mimir - widget.luau: togglePanel id -> alexander/mimir:chat - panel.luau: remove scrollBottom/dynamic key (unstable), remove setUpdateInterval - README.md: add future plans (commands, file search, etc.) - thumbnail.webp: removed (replaced by mimir-thumbnail.webp) * added thumbnail * added thumbnail.webp * mimir: bump 0.1.0 → 0.3.0, update README with tools + copy + editable approval * mimir: copy-to-clipboard toggle, editable command approval, unicode bold rendering * mimir: fix review findings — conditional auth, dedupe user msg, apply max_history * mimir: fix manifest validation — use select setting type, add README Plugin section * mimir: multi-tool queue support, plain approve/deny, better tool-use prompt * mimir: add full markdown rendering — headings, lists, quotes, hr, bold/italic * mimir: bump 0.3.2 — fix Lua pattern quantifiers, multi-tool queue, markdown rendering * mimir: fix security review findings * mimir: clarify selectable message text * mimir: add command history display * mimir: add web search * mimir: align README with template * mimir: fix CPU budget error with many messages --------- Co-authored-by: Ahmed5Emad <ahmed5emad@users.noreply.github.com>
Mimir
An AI companion for Noctalia that brings LLM-powered chat and terminal command execution directly into your desktop. Named after the Norse god of wisdom.
Plugin
| Field | Value |
|---|---|
| ID | alexander/mimir |
| Entries | Bar widget: status; panel: chat; service: brain |
Requirements
- A Noctalia build supporting
plugin_api >= 16. - An OpenAI-compatible API endpoint with
/chat/completionsand/modelsendpoints. - An API key (for hosted providers) or leave empty for local servers (e.g. Ollama).
curlandpython3onPATHfor the web search and page-fetch features.- An internet connection for the no-setup web search feature.
If you use OpenCode Go with the default OpenCode endpoint, Mimir auto-detects your API key from ~/.local/share/opencode/auth.json — no manual setup needed.
Usage
- Add the plugin directory as a path source in Noctalia settings.
- Enable
alexander/mimirin Settings → Plugins. - Add the bar widget
alexander/mimir:statusto your bar.
Click the brain icon in your bar or toggle the panel from a terminal:
noctalia msg panel-toggle alexander/mimir:chat
Type a message and press Enter. Mimir responds with formatted text — code blocks render in shaded boxes. Click the copy icon on any message to open its content in a selectable field, then copy the text manually.
When Mimir wants to run a terminal command in ask permission mode, the panel shows the command with Approve / Deny buttons.
Settings
| Setting | Type | Default | Description |
|---|---|---|---|
api_endpoint |
string |
https://opencode.ai/zen/go/v1 |
Base URL for the API. Change to http://localhost:11434/v1 for Ollama. |
api_key |
string |
(auto-detect) | API key. If empty and using the trusted OpenCode endpoint, reads from ~/.local/share/opencode/auth.json. |
tool_permission |
enum |
ask |
ask — prompt before commands; allow — run automatically; off — disable tools. |
tool_blocklist |
string |
sudo,su,passwd,rm,... |
Comma-separated commands rejected before execution. |
web_search_enabled |
bool |
true |
Enable or disable web search and public-page fetching. |
show_commands |
bool |
true |
Show executed commands in the chat. |
max_history |
int |
50 |
Max messages kept in context. |
glyph |
glyph |
brain |
Bar icon (per-widget setting). |
IPC
Send a message to Mimir without opening the panel:
noctalia msg plugin alexander/mimir:brain all input "your message"
Notes
- Conversation is ephemeral (in-memory only). Restarting clears it.
- API key auto-detection reads OpenCode Go's auth file at runtime only — never stored or logged.
- Web search uses DuckDuckGo's public HTML endpoint (no key or account). Search queries are sent to DuckDuckGo; results are cached in memory for five minutes and requests time out after 15 seconds. The model treats search results and fetched pages as untrusted data, not instructions.
- Web requests run through a
curl | python3subprocess (with the bundledwebparse.py) rather than inside the Luau VM, because Noctalia enforces small per-callback CPU budgets. - For best results, use a model with tool-calling support.
Security
Mimir is a trusted desktop plugin that runs the model's shell commands and makes outbound web requests. This is the security model:
- API key handling — the key is read at runtime only and never written to disk, state, or logs. Auto-detection from
~/.local/share/opencode/auth.jsonhappens only when the endpoint is exactlyhttps://opencode.aion port 443/absent. The API key is never sent to DuckDuckGo or fetched pages — web requests carry only a browser User-Agent and an Accept-Language header. - Command execution —
askmode shows every command for approval;allowruns non-blocked commands automatically;offdisables tools. The blocklist rejects destructive, interpreter, and network tools (sudo,rm,sh,python,curl,ssh,git, cloud CLIs, and more) as well as shell composition (; | & > < \$ ` and newlines). The blocklist is a safety guardrail, not a security boundary — raw shell execution inallowmode carries inherent risk. - Web fetch — only accepts
https://URLs, rejects credentials, private/loopback/link-local IPv4 and IPv6 addresses,localhost,.localhosts, and numeric/IP obfuscations. Requests verify TLS, follow no redirects, and are restricted to HTTPS. Parser input and output are size- and length-limited and control characters are stripped. - Residual risks — DNS rebinding cannot be fully prevented (Noctalia exposes no DNS resolution API), so
web_fetchis only for well-known public URLs. Plugins run as trusted code, so a malicious model output combined withallowmode can still run commands the blocklist does not cover — review commands inaskmode for sensitive work.