Assistants through the API and oh 62ceb2eec18c

- **Assistants through the API and `oh` (§13.4).** List, add or change, and remove a repository's, an organisation's or the site's assistants, and read or set their prompts: `/repos/{o}/{n}/assistants`, `/orgs/{org}/assistants`, `/admin/assistants`; `oh assistant list|add|remove|prompt` with `--org` or `--site`. Tokens are write-only and read from an environment variable by `oh`.

// ------------------------------------------------------------- assistants

/// An AI assistant at a level (hub spec §13.4). The token never leaves the

/// hub: `has_token` says whether one is set.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct Assistant {

    pub name: String,

    pub endpoint: String,

    pub api: String,

    pub model: String,

    #[serde(default, skip_serializing_if = "String::is_empty")]

    pub headers: String,

    pub enabled: bool,

    pub budget: i64,

    pub has_token: bool,

    /// Where it comes from: empty for the level's own, else `the site` or

    /// `the NAME organisation`.

    #[serde(default, skip_serializing_if = "String::is_empty")]

    pub from: String,

    /// Off because a level above turned a name like it off.

    #[serde(default)]

    pub off_above: bool,

}

/// `POST …/assistants`: add one, or change the one of that name. A

/// `preset` (`anthropic`, `openai`, `gemini`, `deepseek`, `mistral`,

/// `perplexity`, `ollama`) fills what is left out; the model must be one

/// the endpoint lists when it lists any; `token` is write-only.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct NewAssistant {

    #[serde(default)]

    pub name: String,

    #[serde(default)]

    pub preset: String,

    #[serde(default)]

    pub endpoint: String,

    #[serde(default)]

    pub api: String,

    pub model: String,

    #[serde(default)]

    pub token: String,

    #[serde(default)]

    pub headers: String,

    #[serde(default = "yes")]

    pub enabled: bool,

    #[serde(default)]

    pub budget: Option<i64>,

}

fn yes() -> bool {

    true

}

/// A level's prompt and those it inherits, outermost first.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct AssistantPrompt {

    pub prompt: String,

    #[serde(default, skip_serializing_if = "Vec::is_empty")]

    pub inherited: Vec<(String, String)>,

}

        .route("/repos/{owner}/{name}/assistants", get(repo_assistants).post(repo_assistant_put))

        .route("/repos/{owner}/{name}/assistants/prompt", get(repo_prompt).put(repo_prompt_put))

        .route("/repos/{owner}/{name}/assistants/{assistant}", axum::routing::delete(repo_assistant_delete))

        .route("/orgs/{org}/assistants", get(org_assistants).post(org_assistant_put))

        .route("/orgs/{org}/assistants/prompt", get(org_prompt).put(org_prompt_put))

        .route("/orgs/{org}/assistants/{assistant}", axum::routing::delete(org_assistant_delete))

        .route("/admin/assistants", get(site_assistants).post(site_assistant_put))

        .route("/admin/assistants/prompt", get(site_prompt).put(site_prompt_put))

        .route("/admin/assistants/{assistant}", axum::routing::delete(site_assistant_delete))

// -------------------------------------------------------- assistants (§13.4)

use crate::levels::At;

use crate::web::assistants as aa;

/// The level a repository's assistants live at, for its admins (repo:admin).

async fn repo_level(app: &Shared, c: &Caller, owner: &str, name: &str) -> Result<(Account, At), ApiError> {

    let me = c.require("repo:admin")?.clone();

    let (_, row, _) = reach(app, c, owner, name, Access::Admin).await?;

    Ok((me, At::repo(&row)))

}

/// An organisation's level, for its owners (repo:admin).

async fn org_level(app: &Shared, c: &Caller, org: &str) -> Result<(Account, At), ApiError> {

    let me = c.require("repo:admin")?.clone();

    let o = db::accounts::org_by_name(&app.db, org).await?.ok_or_else(|| not_found("no such organisation"))?;

    if !auth::roles::is_org_owner(&app.db, &me, o.id).await? {

        return Err(not_found("no such organisation"));

    }

    Ok((me, At::org(&o)))

}

/// The site's level, for its administrators.

fn site_level(c: &Caller) -> Result<(Account, At), ApiError> {

    Ok((require_site_admin(c)?.clone(), At::site()))

}

fn put_outcome(r: Result<String, String>) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {

    match r {

        Ok(msg) => Ok((StatusCode::OK, Json(serde_json::json!({ "ok": msg })))),

        Err(e) => Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, e)),

    }

}

macro_rules! assistant_routes {

    ($list:ident, $put:ident, $del:ident, $prompt:ident, $prompt_put:ident, ($($p:ident: $t:ty),*), $level:expr) => {

        async fn $list(State(app): State<Shared>, headers: HeaderMap, Path(($($p),*)): Path<($($t),*)>) -> Result<Json<Vec<Assistant>>, ApiError> {

            let c = caller(&app, &headers).await?;

            let (_, at) = $level(&app, &c, $(&$p),*).await?;

            Ok(Json(aa::api_list(&app, &at).await?))

        }

        async fn $put(

            State(app): State<Shared>,

            headers: HeaderMap,

            Path(($($p),*)): Path<($($t),*)>,

            Json(body): Json<NewAssistant>,

        ) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {

            let c = caller(&app, &headers).await?;

            let (me, at) = $level(&app, &c, $(&$p),*).await?;

            put_outcome(aa::api_put(&app, &me, &at, body).await?)

        }

        async fn $prompt(State(app): State<Shared>, headers: HeaderMap, Path(($($p),*)): Path<($($t),*)>) -> Result<Json<AssistantPrompt>, ApiError> {

            let c = caller(&app, &headers).await?;

            let (_, at) = $level(&app, &c, $(&$p),*).await?;

            Ok(Json(aa::api_prompt(&app, &at).await?))

        }

        async fn $prompt_put(

            State(app): State<Shared>,

            headers: HeaderMap,

            Path(($($p),*)): Path<($($t),*)>,

            Json(body): Json<AssistantPrompt>,

        ) -> Result<Json<AssistantPrompt>, ApiError> {

            let c = caller(&app, &headers).await?;

            let (me, at) = $level(&app, &c, $(&$p),*).await?;

            aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;

            Ok(Json(aa::api_prompt(&app, &at).await?))

        }

    };

}

assistant_routes!(repo_assistants, repo_assistant_put, _rd, repo_prompt, repo_prompt_put, (owner: String, name: String), repo_level);

async fn repo_assistant_delete(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, assistant)): Path<(String, String, String)>,

) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let (me, at) = repo_level(&app, &c, &owner, &name).await?;

    if aa::api_delete(&app, &me, &at, &assistant).await? {

        Ok(StatusCode::NO_CONTENT)

    } else {

        Err(not_found("no such assistant at this level"))

    }

}

async fn org_level_one(app: &Shared, c: &Caller, org: &str) -> Result<(Account, At), ApiError> {

    org_level(app, c, org).await

}

async fn org_assistants(State(app): State<Shared>, headers: HeaderMap, Path(org): Path<String>) -> Result<Json<Vec<Assistant>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, at) = org_level_one(&app, &c, &org).await?;

    Ok(Json(aa::api_list(&app, &at).await?))

}

async fn org_assistant_put(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path(org): Path<String>,

    Json(body): Json<NewAssistant>,

) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {

    let c = caller(&app, &headers).await?;

    let (me, at) = org_level_one(&app, &c, &org).await?;

    put_outcome(aa::api_put(&app, &me, &at, body).await?)

}

async fn org_assistant_delete(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((org, assistant)): Path<(String, String)>,

) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let (me, at) = org_level_one(&app, &c, &org).await?;

    if aa::api_delete(&app, &me, &at, &assistant).await? {

        Ok(StatusCode::NO_CONTENT)

    } else {

        Err(not_found("no such assistant at this level"))

    }

}

async fn org_prompt(State(app): State<Shared>, headers: HeaderMap, Path(org): Path<String>) -> Result<Json<AssistantPrompt>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, at) = org_level_one(&app, &c, &org).await?;

    Ok(Json(aa::api_prompt(&app, &at).await?))

}

async fn org_prompt_put(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path(org): Path<String>,

    Json(body): Json<AssistantPrompt>,

) -> Result<Json<AssistantPrompt>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (me, at) = org_level_one(&app, &c, &org).await?;

    aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;

    Ok(Json(aa::api_prompt(&app, &at).await?))

}

async fn site_assistants(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Assistant>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, at) = site_level(&c)?;

    Ok(Json(aa::api_list(&app, &at).await?))

}

async fn site_assistant_put(

    State(app): State<Shared>,

    headers: HeaderMap,

    Json(body): Json<NewAssistant>,

) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {

    let c = caller(&app, &headers).await?;

    let (me, at) = site_level(&c)?;

    put_outcome(aa::api_put(&app, &me, &at, body).await?)

}

async fn site_assistant_delete(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path(assistant): Path<String>,

) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let (me, at) = site_level(&c)?;

    if aa::api_delete(&app, &me, &at, &assistant).await? {

        Ok(StatusCode::NO_CONTENT)

    } else {

        Err(not_found("no such assistant at this level"))

    }

}

async fn site_prompt(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<AssistantPrompt>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, at) = site_level(&c)?;

    Ok(Json(aa::api_prompt(&app, &at).await?))

}

async fn site_prompt_put(

    State(app): State<Shared>,

    headers: HeaderMap,

    Json(body): Json<AssistantPrompt>,

) -> Result<Json<AssistantPrompt>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (me, at) = site_level(&c)?;

    aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;

    Ok(Json(aa::api_prompt(&app, &at).await?))

}

/// For the API (§13.4): every assistant a level sees.

pub async fn api_list(app: &Shared, at: &At) -> sqlx::Result<Vec<hub_api::Assistant>> {

    Ok(assistants::available(&app.db, at.scope, &at.owner)

        .await?

        .into_iter()

        .map(|v| hub_api::Assistant {

            name: v.assistant.name.clone(),

            endpoint: v.assistant.endpoint.clone(),

            api: v.assistant.api.clone(),

            model: v.assistant.model.clone(),

            headers: v.assistant.headers.clone(),

            enabled: v.assistant.enabled,

            budget: v.assistant.budget,

            has_token: v.assistant.has_token(),

            off_above: v.off_above,

            from: v.from,

        })

        .collect())

}

/// For the API: add an assistant, or change the level's own one of that

/// name (an empty token keeps the stored one). `Err` is for the caller.

pub async fn api_put(

    app: &Shared,

    actor: &crate::db::accounts::Account,

    at: &At,

    b: hub_api::NewAssistant,

) -> sqlx::Result<Result<String, String>> {

    let f = AssistantForm {

        csrf_token: String::new(),

        action: String::new(),

        id: None,

        name: b.name,

        endpoint: b.endpoint,

        api: b.api,

        model: b.model,

        headers: b.headers,

        token: b.token,

        enabled: b.enabled.then(|| "1".to_string()),

        budget: b.budget.map(|n| n.to_string()).unwrap_or_default(),

        prompt: String::new(),

        preset: b.preset,

    };

    let fields = match fields(&f) {

        Ok(x) => x,

        Err(e) => return Ok(Err(e)),

    };

    let existing = assistants::list(&app.db, at.scope).await?.into_iter().find(|a| a.name.eq_ignore_ascii_case(&fields.name));

    let token = f.token.trim().to_string();

    let effective = match (&existing, token.is_empty()) {

        (Some(a), true) => app.assistant_key.open(&a.token).unwrap_or_default(),

        _ => token.clone(),

    };

    if let Err(e) = model_offered(&fields, &effective).await {

        return Ok(Err(e));

    }

    Ok(Ok(match existing {

        Some(a) => {

            let sealed = (!token.is_empty()).then(|| app.assistant_key.seal(&token));

            assistants::update(&app.db, a.id, &fields, sealed.as_deref()).await?;

            accounts::audit(&app.db, Some(actor), "assistant.updated", &at.label, &fields.name).await.ok();

            format!("{} updated", fields.name)

        }

        None => {

            assistants::create(&app.db, at.scope, &fields, &app.assistant_key.seal(&token)).await?;

            accounts::audit(&app.db, Some(actor), "assistant.added", &at.label, &fields.name).await.ok();

            format!("{} added", fields.name)

        }

    }))

}

/// For the API: remove the level's own assistant of that name.

pub async fn api_delete(app: &Shared, actor: &crate::db::accounts::Account, at: &At, name: &str) -> sqlx::Result<bool> {

    let Some(a) = assistants::list(&app.db, at.scope).await?.into_iter().find(|a| a.name.eq_ignore_ascii_case(name)) else {

        return Ok(false);

    };

    assistants::delete(&app.db, a.id).await?;

    accounts::audit(&app.db, Some(actor), "assistant.deleted", &at.label, &a.name).await.ok();

    Ok(true)

}

/// For the API: the level's prompt and what it inherits.

pub async fn api_prompt(app: &Shared, at: &At) -> sqlx::Result<hub_api::AssistantPrompt> {

    Ok(hub_api::AssistantPrompt {

        prompt: assistants::prompt(&app.db, at.scope).await?,

        inherited: assistants::inherited_prompts(&app.db, at.scope, &at.owner).await?,

    })

}

/// For the API: set the level's prompt (empty clears it).

pub async fn api_set_prompt(app: &Shared, actor: &crate::db::accounts::Account, at: &At, text: &str) -> sqlx::Result<Result<(), String>> {

    if text.chars().count() > 20_000 {

        return Ok(Err("a prompt is up to 20000 characters".into()));

    }

    assistants::set_prompt(&app.db, at.scope, text).await?;

    accounts::audit(&app.db, Some(actor), "assistant.prompt", &at.label, "").await.ok();

    Ok(Ok(()))

}

pub(crate) mod assistants;

#[tokio::test(flavor = "multi_thread")]

async fn api_assistants_at_each_level() {

    let h = hub().await;

    let app = &h.app;

    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))

        .await

        .cookie

        .unwrap();

    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;

    let csrf = csrf_of(&page.body);

    let mint = |scopes: &'static str| {

        let (app, andy, csrf) = (app.clone(), andy.clone(), csrf.clone());

        async move {

            let r = call(&app, "POST", "/settings/tokens", None, Some(&andy), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;

            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()

        }

    };

    let admin = mint("scopes=repo%3Aadmin").await;

    let write = mint("scopes=repo%3Aread&scopes=repo%3Awrite").await;

    api(app, "POST", "/api/v1/repos", Some(&admin), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;

    // A stand-in endpoint with no model list: any model name is taken.

    let router = axum::Router::new().route(

        "/v1/chat/completions",

        axum::routing::post(|| async { axum::Json(serde_json::json!({ "choices": [{ "message": { "content": "OK" } }] })) }),

    );

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let ep = format!("http://127.0.0.1:{port}/v1/chat/completions");

    // The site's, by its administrator; the repository's, by its admin.

    let body = serde_json::json!({ "preset": "gemini", "endpoint": ep, "model": "gemini-3-pro", "token": "sk-secret" }).to_string();

    let (st, v) = api(app, "POST", "/api/v1/admin/assistants", Some(&admin), Some(&body)).await;

    assert_eq!(st, StatusCode::OK, "{v}");

    assert_eq!(v["ok"], "Gemini added");

    let body =

        serde_json::json!({ "name": "Claude", "endpoint": ep, "api": "chat-completions", "model": "m", "token": "sk-2" }).to_string();

    let (st, _) = api(app, "POST", "/api/v1/repos/andy/demo/assistants", Some(&write), Some(&body)).await;

    assert_eq!(st, StatusCode::FORBIDDEN, "repo:admin is needed");

    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/assistants", Some(&admin), Some(&body)).await;

    assert_eq!(st, StatusCode::OK, "{v}");

    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/assistants", Some(&admin), None).await;

    assert_eq!(st, StatusCode::OK);

    let names: Vec<(&str, &str, bool)> = v

        .as_array()

        .unwrap()

        .iter()

        .map(|a| (a["name"].as_str().unwrap(), a["from"].as_str().unwrap_or(""), a["has_token"].as_bool().unwrap()))

        .collect();

    assert_eq!(names, [("Gemini", "the site", true), ("Claude", "", true)]);

    assert!(!v.to_string().contains("sk-"), "tokens never come back");

    // Changing it keeps the token when none is given.

    let body = serde_json::json!({ "name": "Claude", "endpoint": ep, "api": "chat-completions", "model": "m2" }).to_string();

    let (_, v) = api(app, "POST", "/api/v1/repos/andy/demo/assistants", Some(&admin), Some(&body)).await;

    assert_eq!(v["ok"], "Claude updated");

    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/assistants", Some(&admin), None).await;

    assert_eq!((v[1]["model"].as_str(), v[1]["has_token"].as_bool()), (Some("m2"), Some(true)));

    // Prompts: the site's is inherited by the repository.

    let (st, _) = api(app, "PUT", "/api/v1/admin/assistants/prompt", Some(&admin), Some(r#"{"prompt":"Be brief."}"#)).await;

    assert_eq!(st, StatusCode::OK);

    let (_, v) = api(app, "PUT", "/api/v1/repos/andy/demo/assistants/prompt", Some(&admin), Some(r#"{"prompt":"Rust."}"#)).await;

    assert_eq!(v["prompt"], "Rust.");

    assert_eq!(v["inherited"], serde_json::json!([["the site", "Be brief."]]));

    // Removed.

    let (st, _) = api(app, "DELETE", "/api/v1/repos/andy/demo/assistants/claude", Some(&admin), None).await;

    assert_eq!(st, StatusCode::NO_CONTENT);

    let (st, _) = api(app, "DELETE", "/api/v1/repos/andy/demo/assistants/claude", Some(&admin), None).await;

    assert_eq!(st, StatusCode::NOT_FOUND);

}

    /// AI assistants of the repository (its admins), or with --org or

    /// --site of an organisation or the site

    Assistant {

        #[command(subcommand)]

        cmd: AssistantCmd,

        /// An organisation's assistants instead of the repository's

        #[arg(long, global = true)]

        org: Option<String>,

        /// The site's assistants (administrators)

        #[arg(long, global = true, conflicts_with = "org")]

        site: bool,

    },

}

#[derive(Subcommand)]

enum AssistantCmd {

    /// The assistants this level sees, its own and those inherited

    List,

    /// Add an assistant, or change the one of that name

    Add {

        /// How it shows on reviews (default: the provider's name)

        #[arg(long, default_value = "")]

        name: String,

        /// anthropic, openai, gemini, deepseek, mistral, perplexity or ollama

        #[arg(long, default_value = "")]

        preset: String,

        /// The endpoint, when no preset or another one

        #[arg(long, default_value = "")]

        endpoint: String,

        /// chat-completions or anthropic-messages

        #[arg(long, default_value = "")]

        api: String,

        /// One the endpoint lists (`oh assistant models` shows them)

        #[arg(long)]

        model: String,

        /// The API key, read from this environment variable (never typed on the command line)

        #[arg(long, value_name = "VAR")]

        token_env: Option<String>,

        /// Add it turned off

        #[arg(long)]

        off: bool,

    },

    /// Remove this level's assistant of that name

    Remove { name: String },

    /// Show this level's prompt, and those it inherits

    Prompt {

        /// Set it from this file (`-` for standard input; an empty file clears it)

        #[arg(long, value_name = "FILE")]

        set: Option<std::path::PathBuf>,

    },

        Cmd::Assistant { cmd, org, site } => assistant(&c, &t, cmd, org, site, json),

        }

    }

    Ok(0)

}

fn assistant(c: &Client, t: &Target, cmd: AssistantCmd, org: Option<String>, site: bool, json: bool) -> Result<i32> {

    let base = match (&org, site) {

        (Some(o), _) => format!("/orgs/{}/assistants", enc(o)),

        (None, true) => "/admin/assistants".to_string(),

        (None, false) => format!("{}/assistants", t.repo_path()?),

    };

    match cmd {

        AssistantCmd::List => {

            if json {

                println!("{}", c.get_text(&base)?);

                return Ok(0);

            }

            let list: Vec<hub_api::Assistant> = c.get(&base)?;

            if list.is_empty() {

                println!("{}", ui::dim("No assistants."));

            }

            for a in list {

                let state = if a.enabled && !a.off_above {

                    ui::ok("on")

                } else if a.off_above {

                    ui::dim("off above")

                } else {

                    ui::dim("off")

                };

                let from = if a.from.is_empty() { String::new() } else { ui::dim(&format!(" · from {}", a.from)) };

                println!("{} {}  {} {}{}", state, a.name, ui::dim(&a.model), ui::dim(&a.endpoint), from);

            }

        }

        AssistantCmd::Add { name, preset, endpoint, api, model, token_env, off } => {

            let token = match token_env {

                Some(var) => std::env::var(&var).map_err(|_| anyhow::anyhow!("${var} is not set"))?,

                None => String::new(),

            };

            let body =

                hub_api::NewAssistant { name, preset, endpoint, api, model, token, headers: String::new(), enabled: !off, budget: None };

            let r: serde_json::Value = c.send("POST", &base, &body)?;

            println!("{} {}", ui::ok("✔"), r["ok"].as_str().unwrap_or("saved"));

        }

        AssistantCmd::Remove { name } => {

            c.send_text("DELETE", &format!("{base}/{}", enc(&name)), &serde_json::json!({}))?;

            println!("{} removed {name}", ui::ok("✔"));

        }

        AssistantCmd::Prompt { set } => {

            let p: hub_api::AssistantPrompt = match set {

                Some(path) => {

                    let text = if path.as_os_str() == "-" {

                        let mut s = String::new();

                        std::io::Read::read_to_string(&mut std::io::stdin(), &mut s)?;

                        s

                    } else {

                        std::fs::read_to_string(&path)?

                    };

                    c.send("PUT", &format!("{base}/prompt"), &hub_api::AssistantPrompt { prompt: text, inherited: vec![] })?

                }

                None => c.get(&format!("{base}/prompt"))?,

            };

            if json {

                println!("{}", serde_json::to_string(&p)?);

                return Ok(0);

            }

            for (from, text) in &p.inherited {

                println!("{}\n{}\n", ui::dim(&format!("── from {from}")), text);

            }

            if p.prompt.is_empty() {

                println!("{}", ui::dim("No prompt of its own."));

            } else {

                println!("{}\n{}", ui::dim("── this level"), p.prompt);

            }

### 13.4 AI assistants (done 2026-10-04)

- **API.** `POST /repos/{o}/{n}/proposals/{n}/review-requests {"assistant": NAME}` (the author or a writer; 202 when started, 409 when that assistant is already answering or the repository is over its hourly limit, 422 for a name the repository cannot use); reviews carry `via`. Settings: `GET`/`POST /repos/{o}/{n}/assistants` (repo:admin; `POST` adds or changes by name, with `preset`, an optional write-only `token` that an empty value keeps, and the model checked against the endpoint's list), `DELETE …/assistants/{name}`, and `GET`/`PUT …/assistants/prompt` (the level's text and what it inherits); the same under `/orgs/{org}/assistants` for its owners and `/admin/assistants` for site administrators. `oh assistant list|add|remove|prompt` uses them, with `--org` or `--site`, and reads a token only from an environment variable (`--token-env`). Hub actions by an assistant are attributed "ASSISTANT via WHO" everywhere, so a project can require that a human has approved regardless of what an assistant said.