Agent runtime: majordomo in-process, Ollama Cloud config, chat endpoint (#56) (#70)

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/service/agent.go

@@ -0,0 +1,62 @@
+package service
+
+import (
+	"context"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// Chat persistence for the garden assistant (#56). The run loop itself lives in
+// internal/agent; this is the part that needs pansy's permission checks.
+
+// maxRetainedTurns caps how much of a thread is kept in context. Retained turns
+// are a working memory, not an archive — a season of chat replayed into every
+// prompt would cost more than it informs.
+const maxRetainedTurns = 20
+
+// AgentHistory returns the recent messages of the actor's own thread for a
+// garden they can edit, oldest first.
+//
+// Requires EDITOR, not viewer: the assistant acts, so being able to talk to it
+// about a garden is the same permission as being able to change it. A viewer
+// asking it to plant something would get a refusal from every tool anyway, and
+// offering the conversation would be offering something that cannot work.
+func (s *Service) AgentHistory(ctx context.Context, actorID, gardenID int64) ([]domain.AgentMessage, error) {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleEditor); err != nil {
+		return nil, err
+	}
+	conv, err := s.store.EnsureConversation(ctx, gardenID, actorID)
+	if err != nil {
+		return nil, err
+	}
+	return s.store.ListAgentMessages(ctx, conv, maxRetainedTurns*2)
+}
+
+// RecordAgentExchange stores one user message and the assistant's reply, and
+// returns the reply row. Called by the runtime after a turn completes.
+func (s *Service) RecordAgentExchange(ctx context.Context, actorID, gardenID int64, userMessage, reply string, changeSetID *int64) (*domain.AgentMessage, error) {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleEditor); err != nil {
+		return nil, err
+	}
+	conv, err := s.store.EnsureConversation(ctx, gardenID, actorID)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := s.store.AppendAgentMessage(ctx, &domain.AgentMessage{
+		ConversationID: conv, Role: domain.AgentRoleUser, Body: userMessage,
+	}); err != nil {
+		return nil, err
+	}
+	return s.store.AppendAgentMessage(ctx, &domain.AgentMessage{
+		ConversationID: conv, Role: domain.AgentRoleAssistant, Body: reply, ChangeSetID: changeSetID,
+	})
+}
+
+// ClearAgentHistory drops the actor's thread for a garden — the "start over"
+// escape hatch when a conversation has gone somewhere unhelpful.
+func (s *Service) ClearAgentHistory(ctx context.Context, actorID, gardenID int64) error {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleEditor); err != nil {
+		return err
+	}
+	return s.store.DeleteConversation(ctx, gardenID, actorID)
+}

internal/service/revisions.go

@@ -99,7 +99,8 @@ type ChangeSetOptions struct {
 	Source string
 	// Summary is the one-line description shown in the history list.
 	Summary string
-	// AgentRunID joins this change set back to the executus run that produced it.
+	// AgentRunID joins this change set back to the agent run that produced it,
+	// so a change in the history list can be correlated with the run's log lines.
 	AgentRunID *string
 }
 
@@ -128,7 +129,11 @@ func (s *Service) WithChangeSet(ctx context.Context, actorID, gardenID int64, op
 		// which is exactly the situation undo exists for. Record what happened,
 		// mark the summary, and still report the failure.
 		sc.summary = partialSummary(sc.summary)
-		if _, cerr := s.commitScope(ctx, sc, nil); cerr != nil {
+		// Detached from cancellation on purpose. The commonest reason fn failed is
+		// that ctx was cancelled or timed out — and using that same dead context
+		// to record what committed would fail too, losing the history for changes
+		// that really happened. That is precisely the case this path exists for.
+		if _, cerr := s.commitScope(context.WithoutCancel(ctx), sc, nil); cerr != nil {
 			slog.Error("service: partial turn could not be recorded", "error", cerr, "garden", gardenID)
 		}
 		return nil, err
@@ -306,8 +311,10 @@ func (s *Service) RevertChangeSet(ctx context.Context, actorID, changeSetID int6
 		changes, conflict, err := s.applyInverse(ctx, r, applied)
 		if err != nil {
 			// Record what actually landed before surfacing the failure, so the
-			// partial revert is visible and undoable rather than orphaned.
-			if _, cerr := s.commitScope(ctx, sc, &target.ID); cerr != nil {
+			// partial revert is visible and undoable rather than orphaned. Detached
+			// from cancellation for the same reason as WithChangeSet's path: a
+			// timed-out context can't be used to write the record of what it did.
+			if _, cerr := s.commitScope(context.WithoutCancel(ctx), sc, &target.ID); cerr != nil {
 				slog.Error("service: partial revert could not be recorded", "error", cerr, "changeSet", changeSetID)
 			}
 			return nil, nil, err