Documentation
¶
Overview ¶
Package models owns the per-agent model configuration: the eight capability overrides (build/exec/stt/vision/tts/image_gen/embedding/ search), each a (provider FK, bare model name) pair, plus the declared model slots and their per-slot assignments.
Index ¶
- func CheckEntitled(ctx context.Context, q *dbq.Queries, p authz.Principal, fk pgtype.UUID, ...) error
- func SystemDefault(ctx context.Context, d *db.DB, enc secrets.Store, capability string) (providerCatalogID, modelName, apiKey, baseURL string, err error)
- type AllowedModel
- type ModelCatalog
- type Pair
- type RefreshAgentFunc
- type Service
- func (s *Service) AllowedModels(ctx context.Context, p authz.Principal) (unrestricted bool, models []AllowedModel, err error)
- func (s *Service) Get(ctx context.Context, p authz.Principal, agentID uuid.UUID) (State, error)
- func (s *Service) Update(ctx context.Context, p authz.Principal, agentID uuid.UUID, req UpdateRequest) (State, error)
- type SlotAssignment
- type State
- type UpdateRequest
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CheckEntitled ¶
func CheckEntitled(ctx context.Context, q *dbq.Queries, p authz.Principal, fk pgtype.UUID, model string) error
CheckEntitled enforces model deny-by-default at every assignment entry point. A configured system default or a grant matching the caller's grantee set is required. An unset pair inherits the system default and needs no entitlement.
func SystemDefault ¶
func SystemDefault(ctx context.Context, d *db.DB, enc secrets.Store, capability string) (providerCatalogID, modelName, apiKey, baseURL string, err error)
SystemDefault returns the (providerCatalogID, modelName, apiKey, baseURL) tuple for one capability by reading the system_settings default pair and resolving the providers row. The agent-less counterpart to (*agentHandler).resolveModel — same shape, same fail-loud error messages, no agent-axis lookups. Used by callers that need a working model without an agent context (the in-airlock system agent today).
capability accepts "" / "text" / "vision" / "image" / "speech" / "transcription" / "embedding" — anything else returns "no model configured" since it falls through systemCapabilityDefault.
Pure function (no Service receiver) — both the per-agent resolver in api/agent_llm.go and this one read system_settings the same way, so the shared part stays a free function rather than mutating Service's dep set.
Types ¶
type AllowedModel ¶
AllowedModel is one (provider row, model id) pair a caller may assign.
type ModelCatalog ¶
type ModelCatalog interface {
ListModels(ctx context.Context, p authz.Principal, opts catalog.ListModelsOptions) ([]catalog.Model, error)
}
ModelCatalog is the slice of the catalog service used to verify, server-side, that a model assigned to a capability slot actually has that capability (defense-in-depth behind the UI's capability-filtered pickers). *catalog.Service satisfies it.
type Pair ¶
Pair is a (provider FK, bare model name) tuple. An empty ProviderID means "inherit the system default for this capability"; an empty Model has the same meaning. Both halves must be set together or both unset — except `search`, where a provider may stand alone (empty Model = the search backend's default model; a set Model overrides it).
type RefreshAgentFunc ¶
RefreshAgentFunc pushes a /refresh into a running agent container so it re-syncs its cached PromptData after a model-slot change. A model change alters the agent's Capabilities/SupportedModalities, which the prompt and the attach-modality guard render from — without a refresh those stay stale until the next restart. A dispatch-time hash check self-heals as a backstop (see trigger.AgentConfigHash), but this makes the correction immediate.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func New ¶
func New(d *db.DB, cat ModelCatalog, refresh RefreshAgentFunc, logger *zap.Logger) *Service
func (*Service) AllowedModels ¶
func (s *Service) AllowedModels(ctx context.Context, p authz.Principal) (unrestricted bool, models []AllowedModel, err error)
AllowedModels returns the models the caller may assign to an agent capability — the allow-list the model pickers render: the models granted to the caller's grantee set. This applies to admins too (an admin allows a model by granting it, which targets the All-Users group in their own grantee set). System defaults are intentionally NOT listed: a caller leaves a capability slot unset to fall back to the default, rather than picking it.
func (*Service) Get ¶
Get returns the agent and its declared model slots. Any agent member can read. ErrNotFound for a missing agent; ErrForbidden for a non-member caller.
func (*Service) Update ¶
func (s *Service) Update(ctx context.Context, p authz.Principal, agentID uuid.UUID, req UpdateRequest) (State, error)
Update validates and persists the model configuration, then returns the authoritative state. Admin-gated. ErrNotFound for a missing agent; ErrForbidden for a non-admin caller; ErrInvalidInput (wrapped with detail) for any pair-coherence violation.
type SlotAssignment ¶
SlotAssignment is one declared model-slot assignment. Slug must match an already-declared slot (via sync). Same model/provider pairing rule as Pair.
type State ¶
type State struct {
Agent dbq.Agent
Slots []dbq.AgentModelSlot
// Settings carries the tenant model defaults so callers can resolve the
// effective model for an unset override / unbound slot (modelresolve).
Settings dbq.SystemSetting
}
State is the authoritative read-side view returned by Get / Update.
type UpdateRequest ¶
type UpdateRequest struct {
Build Pair
Exec Pair
STT Pair
Vision Pair
TTS Pair
ImageGen Pair
Embedding Pair
Search Pair
Slots []SlotAssignment
}
UpdateRequest is the input to Update: all eight pairs plus any slot assignments the operator submitted. Slots not present in the agent's declared slot list are silently ignored.