#3373 [GUI] Add Opt-In Local Model Extension Outside The App Installation

Description

## Problem and result

A Strata server managed outside the App can be usable through an API connection while **Manage Models** and **Storage** show no native downloads. Customizing bundled frontend files to expose that connection also conflicts with App updates.

This opt-in companion adds **Current Model** and isolated **Connected Local Models** cards while retaining the official catalog, download library and component updater. It uses the managed Tray as the sole lifecycle owner. No model files are moved or copied, and connected models do not become native prepared/downloaded rows.

## Related discussion

Scope proposal #3369; depends on the optional owner protocol in #3365. **Ready for review. Scope agreement has not yet been obtained; review is requested alongside that discussion.** It changes no defaults. Reasoning effort stays in the official composer; the separate API effort fix is #3363.

## Approach

All changes are new files under `tools/local-model-extension/`, based on `main` at `e88ee39d`. Existing engine, server, frontend, setup, installer and updater files are byte-identical to that base (`git diff e88ee39d -- . ':!tools/local-model-extension'` is empty).

An explicit external launcher adds a Node preload only to its App child. It checks the exact host entrypoint and listening port, preserves existing `NODE_OPTIONS`, and serves one versioned Shadow DOM/iframe UI package through a separate namespace. Package hashes, inventory, App 0.2.x and Bridge API 1 are checked before injection. Missing, disabled, corrupt or incompatible packages leave the original host listener in place. Activation, disable and rollback are outside the App install folder.

The companion accepts configurable loopback ports and physical model IDs, with optional display labels. It cross-checks the fresh owner snapshot with live API metadata. Context choices come from the actual native catalog; selected and effective values remain distinct. Idle choices are Never/5/10/30 Minutes. Explicit context, idle, preload and unload requests enter the existing Tray serial worker via atomic file IPC, with execution-time identity checks and durable acknowledgments. The companion never starts an inference server or bypasses owner drain/authentication through direct HTTP load/unload calls.

**Use In Chat** requires one existing App connection with the same API URL and physical ID. It preserves authentication and unrelated rows, updates confirmed display/capacity metadata, then selects the exact official picker entry after an explicit action. It does not change effort, Fast, permissions or client settings. The package contains no private model allowlist, Codex dependency, account details or local user paths.

## Examples

Anonymous simulated fixtures, rendered from the production extension assets and the actual `NativeModels` / `SettingsStorage` React components. These are UI render examples, **not evidence of inference, actual memory fit or an installed App update**. Original user screenshots were not uploaded. Captions identify the simulated state; no private paths, credentials or model IDs are present.

**Current Model**

<img src="https://raw.githubusercontent.com/medking82/Strata/98f8da6aa2de0587e9346f73e1fac213f928399f/tools/local-model-extension/examples/current-model.png" width="760" alt="Sanitized Current Model panel, simulated 128K context and 30-minute idle unload">

**Manage Models** — the native dialog is scrolled to the connected card's actions.

<img src="https://raw.githubusercontent.com/medking82/Strata/98f8da6aa2de0587e9346f73e1fac213f928399f/tools/local-model-extension/examples/manage-models.png" width="860" alt="Sanitized Manage Models dialog with the connected local model card">

**Storage** — native directories and download counts remain unchanged.

<img src="https://raw.githubusercontent.com/medking82/Strata/98f8da6aa2de0587e9346f73e1fac213f928399f/tools/local-model-extension/examples/storage.png" width="860" alt="Sanitized native Storage view with a separate connected model card">

[Current Model opened inside the App fixture](https://github.com/medking82/Strata/blob/98f8da6aa2de0587e9346f73e1fac213f928399f/tools/local-model-extension/examples/current-model-in-app.png). Generation source and setup instructions are in the added README; no original personal screenshot is used.

## Validation

Windows x64, Node 24.18.0, Python 3.12; candidate `98f8da6a` on base `e88ee39d`. Commands below omit the local windowless-runner wrapper.

**Passed:**

- `node --test tools/local-model-extension/owner_api.test.mjs tools/local-model-extension/extension_bridge.test.mjs tools/local-model-extension/host-preload.test.mjs tools/local-model-extension/package/ui.test.mjs`: **70 tests passed**, zero skipped, using the Tray candidate at `ff69390e` through `STRATA_TRAY_SOURCE`. Covers real loopback HTTP and file IPC, cross-language consumption/acknowledgment, matching/stale identities, actual host preload in disposable Node child processes, default/failure fallback, package compatibility, exact picker selection, cancellation, context/idle confirmation and unchanged native model counts/directories.
- `python -B -m unittest discover -s tools/local-model-extension -p test_*.py`: **13 tests passed**, including immutable package activation, disable, rollback, inventory/hash validation and launch-plan isolation.
- `node tools/local-model-extension/examples/render.mjs`: four actual UI render images; official eight catalog choices verified, external requests blocked, zero model mutations and zero browser page errors. Chrome ran headless with GPU disabled. Every image was visually inspected.
- Final UI-only checks passed again after anonymizing fixture names and paths. `git diff --check` passed; changed paths are confined to the new tools directory. No original application or runtime configuration was changed.

**Failed:**

- None unresolved in the final checks.

**Not run:**

- Installed Windows App launch/update and end-to-end real model inference, native GPU allocation, memory-fit limits, physical load/unload or idle timing for this portable candidate. No model download or GPU workload was launched. No CUDA/HIP/SYCL/Metal code is touched; those builds were not run.

## Limits

Scope agreement and targeted Windows acceptance remain outstanding. This is a narrowly version-gated external companion, not a general plugin platform or guaranteed compatibility with future App DOM layouts. Requires the managed Tray candidate and a matching existing App model connection. File IPC state must remain private to the local account. Interrupted commands are not replayed; manual inspection is needed before recovery. The public README documents opt-in, normal-launch bypass, disable and rollback.