Add OpenClaw local models and unified model selection

NOTICE

@@ -10,6 +10,25 @@ included below or can be found in the respective project repositories.
 - Source: https://github.com/openclaw
 - License: See OpenClaw repository for license details
 
+## OpenClaw fs-safe Windows move compatibility backport
+- Source: https://github.com/openclaw/fs-safe
+- Revision: 6ae2e2e5086f2c48b813f78cb65fd787c9879a3f
+- Copyright: Copyright (c) 2026 openclaw
+- License: MIT License (text below)
+- Use: in-memory backport of Windows read-open timestamp handling for the exact fs-safe 0.8.5
+  module, with MicroClaw's digest-bound cleanup extension for deferred Windows metadata changes.
+  Both move and cleanup modules are source-hash pinned. Installed files are unchanged; path,
+  file identity and post-copy checks remain active.
+
+## OpenClaw llama.cpp exact-model setup adapter
+- Source: https://github.com/openclaw/openclaw
+- Package: @openclaw/llama-cpp-provider@2026.9.3
+- Use: source-hash-pinned in-memory model-chooser adaptation for Qwen3.5 4B and 9B.
+  Adds bounded Windows runtime-directory publication retries after transient locks,
+  retaining directory-identity checks and official pre/post-install validation.
+  Artifact verification, runtime management and config persistence remain OpenClaw-owned.
+  Installed provider files are unchanged.
+
 ## OpenClaw Windows Node
 - Source: https://github.com/openclaw/openclaw-windows-node
 - Revision: fc9add75eda78daf548d80a55ffb64e63b159961

README.md

@@ -142,6 +142,54 @@ On first launch, the desktop app opens a SetupWizard only when model configurati
 
 You can add or edit models any time under **Settings → Models**. Credentials are stored locally by the desktop app. If `.env` already contains `MODEL_BASE_URL`, `MODEL_API_KEY`, and `MODEL_NAME`, MicroClaw can prefill or auto-apply that configuration.
 
+#### Local models (experimental)
+
+**Settings → Models** lists cloud providers and **Local model** (llama.cpp) in compact cards. Existing saved custom API connections remain manageable, but the overview has no generic add-compatible-API button or unconfigured placeholder card. **Manage** expands the connection editor inline. Saving a connection there does not change the default model or send an AI test prompt; initial onboarding retains its existing flow. The default model is selected separately.
+
+The model button beside the chat composer searches configured models and the two managed local presets, **Qwen3.5 4B Q4_K_M** and **Qwen3.5 9B Q4_K_M**. Selection changes **only the current conversation**, using OpenClaw session overrides. New conversations carry their selected agent's explicit session key, including the main agent, so a model can be selected before the first message in multi-agent configurations. **Use agent default** clears that override without changing agent/global defaults, fallbacks, or other conversations. First use shows the exact model download size, missing embeddings, runtime disk reserve and CPU/GPU mode. Downloads require confirmation; selection changes only after successful preparation. Cancel/failure keeps the previous selection. Already-prepared models switch directly with an inline **Switching...** indicator, without briefly opening a preparation dialog or running setup/inference tests again. Preparation, failures and interrupted-operation recovery still use a persistent dialog.
+
+Both the chat model picker and **Settings → Models → Default model** use the same collapsible provider groups. Only the currently selected model's provider opens by default; headings can be toggled with a click, Enter or Space. Search reveals matching groups, and clearing it restores the previous folds. Folding only changes the list display, never model configuration or downloads. The settings picker still changes the global default, while the chat picker changes only its conversation.
+
+The chat picker shows **Loading models...** on its button for the first catalogue read, then opens the complete list. Later openings retain the previous list and file statuses while refreshing, replacing them together instead of repeatedly shrinking and repositioning the panel. Closing or leaving the button while the first read is pending prevents a late popup.
+
+Changing an existing cloud **default model** uses a revision-guarded `config.patch` and waits for the Gateway's applied revision, rather than restarting the entire Gateway. Only the primary default changes; fallbacks, model policy, credentials, agent overrides and session overrides are retained. Copilot selection/catalogue reads use prepared model metadata, not full provider discovery. A rejected, uncertain or still-applying change reports an error without an automatic retry or rollback; an explicit upstream restart requirement is not reported as a successful hot switch.
+
+If a conversation-model change becomes uncertain, the chat picker and model settings expose recovery rather than leaving all conversations locked. A fresh read can reconcile a completed RPC or a request whose original managed Gateway process has demonstrably stopped. Otherwise **Restart Gateway and recover** requires explicit confirmation, verifies shutdown of the owned process, and accepts the saved state without resending the patch or deleting history. A WebSocket reconnect or a matching model value alone is not proof that a delayed write has finished. Ordinary model switches still do not restart the Gateway.
+
+The installer prepares the pinned official llama.cpp provider without downloading model weights or the inference runtime. The installer discloses the provider and its declared capabilities; explicit user-disabled plugin policies are preserved. The local card shows **Connected** when the provider is installed and enabled, independently of whether either model is downloaded. This is provider availability, not an inference health check. Older installations can explicitly review and enable the component in local settings.
+
+- Opening model settings reads saved configuration, small router presets and metadata of the two pinned cache files. Plugin status reads never call ClawHub search, full hardware discovery, inference or downloads. Online component lookup occurs only during an explicit component review/install action.
+- Model rows show downloaded/not-downloaded or unknown file state. Missing files go through first-use preparation rather than becoming the active model. Cached weights can be reused after cancelled preparation; merely browsing never reads GGUF contents or scans the cache. Existing external connections remain separate.
+- **Download and select** immediately replaces confirmation with progress and shows the Gateway's current download/runtime message. Repeated clicks cannot resubmit consent. Preparation errors stay visible; retrying reuses complete, hash-verified cached weights rather than downloading them again.
+- **Model selection does not run “Test AI connection” or a tool-use probe.** **Start using** submits a revision-guarded `config.patch` and confirms the saved configuration has been applied using read-only revision checks. It does not generate a test reply or read a temporary file. Connection and model/tool compatibility errors are reported during actual chats. Configuration validation, conflicting-write protection and sandbox permissions remain unchanged; selection success does not certify model capabilities.
+- **Managed models**: 4B is listed first as the lightweight choice; 9B has higher resource requirements and can be slow on CPU. Choosing 4B always prepares 4B, never an automatic 9B replacement. OpenClaw still owns hardware admission, download hashes, runtime installation and cancellation. A version/source-hash-pinned in-memory adapter adds exact selection to the 2026.9.3 provider's wizard, preserves existing model routes, and fails closed if its source or exact-model receipts change. The underlying OpenClaw installation is not modified.
+- **Existing server**: expand **Advanced options and information** to connect to a llama-server you already run on `localhost`, `127.0.0.1`, or `::1`. Supply a key only if that service requires it. MicroClaw does not own or stop this server.
+- Cloud and local connections are retained when changing models. Selection does not add automatic cloud fallbacks; any previously authored OpenClaw fallback or agent/session override still needs to be reviewed separately. Local inference does not make network-dependent skills offline.
+- Cloud setup remains accessible while a local wizard is unfinished. Only saving or switching a model asks to cancel conflicting local setup first; declining leaves it untouched. The only unconfigured catalog entries offered are the two pinned local presets; existing saved connections are retained. Local connection management stays under advanced local settings.
+- The integration checks the Gateway's advertised setup methods and supported 2026.9.x versions. If the provider is missing from its built-in official catalog, MicroClaw verifies the official ClawHub package identity and requests `@openclaw/llama-cpp-provider@2026.9.3`, not a floating latest release. Downloads, runtime prerequisites and GPU support remain subject to the official provider.
+- Actual configuration writes remain protected in Windows Node + MXC mode, while a response is active, or until conflicting setup has safely ended. Preparing a local model does not itself block existing chats; applying a model change still does. After a disconnection, resume the retained operation rather than starting it again. Cancellation can be refused while OpenClaw finishes a protected step.
+
+**Windows compatibility:** MicroClaw includes the [upstream Windows file-open timestamp fix](https://github.com/openclaw/fs-safe/commit/6ae2e2e5086f2c48b813f78cb65fd787c9879a3f) for the exact `fs-safe@0.8.5` dependency bundled with the supported OpenClaw runtime. MicroClaw additionally handles deferred `ctime` changes after copying: only regular, single-link files with unchanged identity, size and modification time can be reconsidered, and their contents must match the SHA-256 captured during copying. Verification uses bounded buffers, rechecks the open handle and path, and checks the exact fingerprint again after mutation authorization before deletion. Genuine changes remain errors; hardlink aliases do not use this exception. A version- and SHA-256-pinned preload validates both move and cleanup modules and applies the changes in memory; installed OpenClaw files are not modified. Other dependency versions are left unchanged, and modified 0.8.5 source is rejected rather than patched speculatively. These checks run during file moves, not when opening model settings.
+
+The pinned llama.cpp adapter also retries transient Windows runtime-directory publication failures (`EPERM`, `EACCES`, `EBUSY`) up to five times over 3.1 seconds. Each attempt checks the original directory identities and requires the destination to remain absent. Permanent errors remain visible; archive hashes, pre/post-install version checks, cancellation and sandbox enforcement are unchanged.
+
+Official plugin installation and the real Electron setup flow have been verified through model download consent on Windows, and complete preparation has been checked with private copies of cached 4B/embedding weights and a freshly installed runtime. This does not run inference or certify its speed. GGUF weights are never downloaded automatically. The existing **Other models** OpenAI-compatible endpoint configuration also remains available for a separately managed local server.
+
+Local CPU replies can take longer, especially with the initial agent context. While the Gateway remains connected, the chat UI allows a bounded longer wait and checks history for a completed reply. Inactivity alone is shown as a waiting notice, not a model connection failure; a successful reply clears that inferred notice without hiding actual provider errors.
+
+For developers, run the opt-in contract check against an installed OpenClaw entry:
+
+```powershell
+$env:MICROCLAW_TEST_OPENCLAW_ENTRY = 'C:\path\to\openclaw\openclaw.mjs'
+npm --prefix desktop test -- src/local-model-gateway.integration.test.ts
+```
+
+Setting `MICROCLAW_TEST_INSTALL_LOCAL_PROVIDER=1` additionally installs the official plugin and checks separate exact-4B and exact-9B download consent steps in a disposable state directory. It checks cancellation without accepting the model download or modifying the user's OpenClaw configuration. Set `MICROCLAW_OPENCLAW_TEST_PACKAGE_DIR` to the OpenClaw package directory when running `src/openclaw-fs-safe-compat.test.ts` to verify both real pinned modules and confirm their installed bytes remain unchanged. Also set `MICROCLAW_TEST_LOCAL_PLUGIN_DIR` to an existing official plugin directory to exercise 100 offline copy/cleanup cycles and preservation of a concurrently changed source. `src/openclaw-fs-safe-cleanup.test.ts` covers timestamp, content, path and authorization races without an installed runtime.
+
+Alternatively, set `MICROCLAW_TEST_LOCAL_PLUGIN_DIR` to an existing official llama.cpp plugin directory to exercise direct selection against a disposable Gateway and a local endpoint that rejects all inference requests. The check requires a successful configuration switch with zero inference requests and does not touch the user's selected model.
+
+To exercise complete preparation, additionally set `MICROCLAW_TEST_LOCAL_CACHE` to a cache containing the pinned 4B and embedding files and run `npm --prefix desktop test -- src/local-model-preparation.integration.test.ts`. It copies those files into a disposable state directory, requires zero model/embedding download bytes in the consent receipt, and installs/verifies the official runtime. The runtime archive may be downloaded; model weights are not. The check does not select the model, run inference or change the source cache/user configuration.
+
 ### 3. Start working immediately
 
 The default home screen is not empty. It ships with starter task cards such as daily news, desktop organization, and travel help, plus prompt suggestions for common work. The bundled and managed skills are already installed, so optional service-specific credentials can be added later only when a particular workflow needs them.