Agent runtime: majordomo in-process, Ollama Cloud config, chat endpoint (#56) (#70)

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/config/config.go

@@ -19,6 +19,9 @@ const (
 	RegistrationClosed = "closed"
 )
 
+// DefaultAgentModel is the assistant's model when PANSY_AGENT_MODEL is unset.
+const DefaultAgentModel = "ollama-cloud/glm-5.2:cloud"
+
 // Config is the fully-resolved runtime configuration.
 type Config struct {
 	// Port is the TCP port the HTTP server listens on (PANSY_PORT, default 8080).
@@ -37,6 +40,8 @@ type Config struct {
 	LocalAuth bool
 	// OIDC holds the optional OpenID Connect provider settings.
 	OIDC OIDCConfig
+	// Agent holds the garden-assistant settings.
+	Agent AgentConfig
 	// TrustedProxies is the set of proxy CIDRs/IPs gin trusts for client IP
 	// resolution (PANSY_TRUSTED_PROXIES, comma-separated). Empty trusts none.
 	TrustedProxies []string
@@ -51,6 +56,33 @@ type OIDCConfig struct {
 	ButtonLabel  string // PANSY_OIDC_BUTTON_LABEL — login-page button text
 }
 
+// AgentConfig holds the garden assistant's settings.
+type AgentConfig struct {
+	// Model is the majordomo model spec, passed VERBATIM to majordomo.Parse
+	// (PANSY_AGENT_MODEL). The grammar is majordomo's, not pansy's — parsing or
+	// validating it here would only mean two places to update when it grows. A
+	// comma-separated spec is a failover chain, so
+	// "ollama-cloud/glm-5.2:cloud,ollama-cloud/kimi-k2.6:cloud" gets a fallback
+	// for free.
+	Model string
+	// OllamaCloudAPIKey authenticates against Ollama Cloud
+	// (OLLAMA_CLOUD_API_KEY — the same secret name gadfly uses, which is why
+	// it isn't majordomo's own OLLAMA_API_KEY; pansy passes it explicitly rather
+	// than relying on ambient environment).
+	OllamaCloudAPIKey string
+	// Enabled turns the assistant on (PANSY_AGENT_ENABLED). Defaults to on when
+	// a key is present, so an instance with no key starts cleanly and simply
+	// doesn't offer the agent — the same shape as OIDC 404ing when unconfigured.
+	Enabled bool
+}
+
+// Ready reports whether the assistant can actually be offered. Both the route
+// registration and whatever advertises capabilities gate on this, so what's
+// advertised always matches what's live.
+func (a AgentConfig) Ready() bool {
+	return a.Enabled && a.OllamaCloudAPIKey != "" && a.Model != ""
+}
+
 // Enabled reports whether enough OIDC config is present to attempt discovery.
 func (o OIDCConfig) Enabled() bool {
 	return o.Issuer != "" && o.ClientID != ""
@@ -87,6 +119,16 @@ func Load() *Config {
 		TrustedProxies: envList("PANSY_TRUSTED_PROXIES"),
 	}
 
+	agentKey := envStr("OLLAMA_CLOUD_API_KEY", "")
+	cfg.Agent = AgentConfig{
+		Model:             envStr("PANSY_AGENT_MODEL", DefaultAgentModel),
+		OllamaCloudAPIKey: agentKey,
+		// Default on when a key is present: having configured the key IS the
+		// opt-in, and making people set a second flag to use what they just
+		// configured is a papercut with no upside.
+		Enabled: envBool("PANSY_AGENT_ENABLED", agentKey != ""),
+	}
+
 	if cfg.Registration != RegistrationOpen && cfg.Registration != RegistrationClosed {
 		slog.Warn("config: invalid PANSY_REGISTRATION, defaulting to open", "value", cfg.Registration)
 		cfg.Registration = RegistrationOpen