steveandClaude Opus 4.8
41c28592a2
Moves the agent model out of env-only config into an admin-editable Settings
section, and enforces is_admin for the first time — it has been in the schema
since migration 0001, plumbed to the client, and checked nowhere.
Backend:
- Migration 0010: instance_settings, a single-row (CHECK id=1) table — pansy's
first instance-level state. Holds agent_model ('' = inherit env) and
agent_enabled (NULL = inherit env), version-guarded like every mutable row.
SECRETS STAY IN ENV: OLLAMA_CLOUD_API_KEY is never stored here.
- requireAdmin at the service seam (authoritative) plus a cheap middleware
early-403. Non-admin gets 403, not 404 — settings existence isn't masked.
- EffectiveAgent resolves DB-over-env (model, enabled); key always from env.
- The live Runner is hot-swapped, not built once. agentHolder holds it behind
an atomic.Pointer; the chat routes are now registered UNCONDITIONALLY and
nil-check agent.get(), so a settings change turns the assistant on/off/onto a
new model with no restart and no race against in-flight readers. /capabilities
reads the pointer, so it reports what's live, not what booted.
- internal/agentmodel is a new leaf package holding the one place that knows how
to turn a spec into a model. Both agent (to run) and service (to validate a
spec before storing it) import it; it can't live in agent, which imports
service. Settings PATCH validates the spec via Parse, so a typo is a 400 now
rather than a broken assistant on the next turn.
Frontend:
- /settings route (admin guard), a Settings page (model field, tri-state
enabled, live status), nav link shown only to admins.
- useCapabilities drops staleTime:Infinity — the assistant can now change under
a running page — and the settings save invalidates it.
Contract change: chat routes always exist, so "assistant off" is a runtime 503
+ capabilities:false, not a missing route. Updated the test that asserted the
old shape.
Verified live against the built binary: disable flips capabilities to false and
logs it; re-enable with a new model swaps it back; a bad spec is rejected 400;
the setting persists across a restart. Swap is race-clean under `go test -race`.
Docs: README (precedence + key-stays-in-env), DESIGN (decision + routes),
CLAUDE (don't re-add conditional route registration; key never in the DB).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ
82 lines
2.7 KiB
Go
82 lines
2.7 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
|
|
)
|
|
|
|
// The instance_settings row is seeded by migration 0010 and there is exactly one
|
|
// (CHECK id = 1), so reads never branch on existence and writes never insert.
|
|
|
|
const instanceSettingsColumns = `agent_model, agent_enabled, version, updated_at`
|
|
|
|
// scanInstanceSettings reads the single settings row. agent_enabled is a nullable
|
|
// INTEGER (NULL = inherit env), so it is scanned through sql.NullInt64.
|
|
func scanInstanceSettings(s scanner) (*domain.InstanceSettings, error) {
|
|
var (
|
|
out domain.InstanceSettings
|
|
enabled sql.NullInt64
|
|
)
|
|
if err := s.Scan(&out.AgentModel, &enabled, &out.Version, &out.UpdatedAt); err != nil {
|
|
return nil, err
|
|
}
|
|
if enabled.Valid {
|
|
b := enabled.Int64 != 0
|
|
out.AgentEnabled = &b
|
|
}
|
|
return &out, nil
|
|
}
|
|
|
|
// GetInstanceSettings returns the single settings row.
|
|
func (d *DB) GetInstanceSettings(ctx context.Context) (*domain.InstanceSettings, error) {
|
|
s, err := scanInstanceSettings(d.sql.QueryRowContext(ctx,
|
|
`SELECT `+instanceSettingsColumns+` FROM instance_settings WHERE id = 1`))
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
// The migration seeds this row, so its absence is a broken database, not a
|
|
// normal "not found" the caller should paper over.
|
|
return nil, fmt.Errorf("store: instance_settings row missing (migration 0010 not applied?)")
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: get instance settings: %w", err)
|
|
}
|
|
return s, nil
|
|
}
|
|
|
|
// UpdateInstanceSettings applies a version-guarded update to the single row,
|
|
// following the same optimistic-concurrency contract as every mutable resource:
|
|
// the updated row on success, (current row, ErrVersionConflict) on a version
|
|
// mismatch. There is no ErrNotFound path — the row always exists.
|
|
//
|
|
// agentEnabled is nil to store SQL NULL (inherit env), or a pointer to store an
|
|
// explicit 0/1.
|
|
func (d *DB) UpdateInstanceSettings(ctx context.Context, s *domain.InstanceSettings) (*domain.InstanceSettings, error) {
|
|
var enabled any
|
|
if s.AgentEnabled != nil {
|
|
enabled = boolToInt(*s.AgentEnabled)
|
|
}
|
|
updated, err := scanInstanceSettings(d.sql.QueryRowContext(ctx,
|
|
`UPDATE instance_settings
|
|
SET agent_model = ?, agent_enabled = ?,
|
|
version = version + 1,
|
|
updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
|
|
WHERE id = 1 AND version = ?
|
|
RETURNING `+instanceSettingsColumns,
|
|
s.AgentModel, enabled, s.Version,
|
|
))
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
current, gerr := d.GetInstanceSettings(ctx)
|
|
if gerr != nil {
|
|
return nil, gerr
|
|
}
|
|
return current, domain.ErrVersionConflict
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: update instance settings: %w", err)
|
|
}
|
|
return updated, nil
|
|
}
|