OXYGENHUB
# 53a0fb2e4ac6 oxygenhub / crates / hub / src / assistants.rs
42.3 KiB · Rust · last changed Postgres, step 1: every query numbers its placeholders $1, $2, ... 21 days ago source blame history raw
e71846aa Andy McCall ↶ 1 
//! AI assistants (hub spec §13.4, #97): chat-completion endpoints the hub
2 
//! may ask to review a proposal or draft its description. Assistants are
3 
//! kept at three levels, site, organisation and repository, and combined
4 
//! downwards: a repository sees its organisation's and the site's beside
5 
//! its own, the innermost of a name wins, and one disabled at an outer
6 
//! level is off for everything inside it. Each level adds a prompt; the
7 
//! prompt in force for a repository is the site's, the organisation's and
8 
//! the repository's own, each under a heading. Tokens are sealed with
9 
//! ChaCha20-Poly1305 under `keys/assistants.key`, shown masked, and never
10 
//! leave the server.
11
12 
use crate::db::{now_ms, Pool};
13 
use crate::Shared;
14 
use rand::RngCore;
15 
use ring::aead;
16 
use sqlx::FromRow;
17 
use std::path::Path;
18 
use std::time::Duration;
19
20 
/// The request shapes an assistant may speak.
21 
pub const APIS: [&str; 2] = ["chat-completions", "anthropic-messages"];
22 
/// Characters of context (prompt, description, diffs) a call may carry
23 
/// unless the assistant says otherwise.
24 
pub const DEFAULT_BUDGET: i64 = 120_000;
5360cea3 Andy McCall ↶ 25 
/// How long a call may take while a person waits for it (a draft, a
26 
/// connection test): inside Cloudflare's 100 seconds for a proxied request.
27 
pub const CALL_TIMEOUT: Duration = Duration::from_secs(90);
28 
/// How long a call answered in the background may take (a review, a
29 
/// summary): a model that thinks first needs minutes on a large proposal
30 
/// (oxygenhub#201).
31 
pub const BACKGROUND_TIMEOUT: Duration = Duration::from_secs(300);
32 
/// The longest answer asked for: room for a model that thinks before it
33 
/// writes (oxygenhub#201: 4096 was spent on thinking alone).
34 
pub const MAX_ANSWER_TOKENS: u32 = 16_000;
e71846aa Andy McCall ↶ 35 
/// The most an answer is kept.
36 
const MAX_ANSWER: usize = 64 * 1024;
37
2a83f530 Andy McCall ↶ 38 
pub use crate::levels::Scope;
e71846aa Andy McCall ↶ 39
40 
#[derive(Clone, Debug, FromRow)]
41 
pub struct Assistant {
42 
    pub id: i64,
43 
    pub scope: String,
44 
    pub scope_id: i64,
45 
    pub name: String,
46 
    pub endpoint: String,
47 
    /// One of [`APIS`].
48 
    pub api: String,
49 
    pub model: String,
50 
    /// Extra request headers, one `Name: value` per line.
51 
    pub headers: String,
52 
    /// The sealed token; empty when the endpoint needs none.
53 
    pub token: Vec<u8>,
54 
    pub enabled: bool,
55 
    pub budget: i64,
56 
    pub created_ms: i64,
57 
    pub updated_ms: i64,
58 
}
59
60 
impl Assistant {
61 
    pub fn scope(&self) -> Scope {
62 
        match self.scope.as_str() {
63 
            "org" => Scope::Org(self.scope_id),
64 
            "repo" => Scope::Repo(self.scope_id),
65 
            _ => Scope::Site,
66 
        }
67 
    }
68
69 
    pub fn has_token(&self) -> bool {
70 
        !self.token.is_empty()
71 
    }
72
73 
    /// The extra headers as pairs; malformed lines are skipped.
74 
    pub fn header_list(&self) -> Vec<(String, String)> {
75 
        parse_headers(&self.headers).unwrap_or_default()
76 
    }
77 
}
78
79 
/// What a settings form supplies for an assistant.
80 
#[derive(Clone, Debug, Default)]
81 
pub struct Fields {
82 
    pub name: String,
83 
    pub endpoint: String,
84 
    pub api: String,
85 
    pub model: String,
86 
    pub headers: String,
87 
    pub enabled: bool,
88 
    pub budget: i64,
89 
}
90
91 
/// `Name: value` lines to pairs: `Err(line)` names the first bad one.
92 
pub fn parse_headers(text: &str) -> Result<Vec<(String, String)>, String> {
93 
    let mut out = vec![];
94 
    for line in text.lines().map(str::trim).filter(|l| !l.is_empty()) {
95 
        let Some((name, value)) = line.split_once(':') else { return Err(line.to_string()) };
96 
        let (name, value) = (name.trim(), value.trim());
97 
        let name_ok = !name.is_empty() && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_');
98 
        if !name_ok || value.chars().any(|c| c.is_control()) {
99 
            return Err(line.to_string());
100 
        }
101 
        out.push((name.to_string(), value.to_string()));
102 
    }
103 
    Ok(out)
104 
}
105
106 
// -------------------------------------------------------------- sealing
107
108 
/// The key that seals tokens, kept in `<data>/keys/assistants.key`.
109 
#[derive(Clone)]
110 
pub struct SecretKey([u8; 32]);
111
112 
impl SecretKey {
113 
    pub fn load_or_create(keys: &Path) -> anyhow::Result<SecretKey> {
4ac01a73 Andy McCall ↶ 114 
        SecretKey::load_or_create_named(keys, "assistants.key")
115 
    }
116
117 
    /// The same, for another key file beside it (`secrets.key` seals Flow
118 
    /// secrets, #107).
119 
    pub fn load_or_create_named(keys: &Path, file: &str) -> anyhow::Result<SecretKey> {
e71846aa Andy McCall ↶ 120 
        std::fs::create_dir_all(keys)?;
4ac01a73 Andy McCall ↶ 121 
        let path = keys.join(file);
e71846aa Andy McCall ↶ 122 
        if let Ok(bytes) = std::fs::read(&path) {
123 
            if bytes.len() == 32 {
124 
                return Ok(SecretKey(bytes.try_into().unwrap()));
125 
            }
126 
        }
127 
        let mut k = [0u8; 32];
128 
        rand::rngs::OsRng.fill_bytes(&mut k);
129 
        std::fs::write(&path, k)?;
130 
        #[cfg(unix)]
131 
        {
132 
            use std::os::unix::fs::PermissionsExt;
133 
            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
134 
        }
135 
        Ok(SecretKey(k))
136 
    }
137
138 
    fn key(&self) -> aead::LessSafeKey {
139 
        aead::LessSafeKey::new(aead::UnboundKey::new(&aead::CHACHA20_POLY1305, &self.0).expect("key length"))
140 
    }
141
142 
    /// Seal a token: a random nonce, then the ciphertext and tag. An
143 
    /// empty token seals to nothing, meaning "no token".
144 
    pub fn seal(&self, plain: &str) -> Vec<u8> {
145 
        if plain.is_empty() {
146 
            return vec![];
147 
        }
148 
        let mut nonce = [0u8; 12];
149 
        rand::rngs::OsRng.fill_bytes(&mut nonce);
150 
        let mut out = plain.as_bytes().to_vec();
151 
        self.key().seal_in_place_append_tag(aead::Nonce::assume_unique_for_key(nonce), aead::Aad::empty(), &mut out).expect("seal");
152 
        let mut sealed = nonce.to_vec();
153 
        sealed.extend(out);
154 
        sealed
155 
    }
156
157 
    /// The token back, or `None` when the bytes were sealed under another
158 
    /// key or damaged. Nothing opens to an empty token.
159 
    pub fn open(&self, sealed: &[u8]) -> Option<String> {
160 
        if sealed.is_empty() {
161 
            return Some(String::new());
162 
        }
163 
        let (nonce, rest) = sealed.split_at_checked(12)?;
164 
        let mut buf = rest.to_vec();
165 
        let nonce = aead::Nonce::try_assume_unique_for_key(nonce).ok()?;
166 
        let plain = self.key().open_in_place(nonce, aead::Aad::empty(), &mut buf).ok()?;
167 
        String::from_utf8(plain.to_vec()).ok()
168 
    }
169 
}
170
171 
// ------------------------------------------------------------- storage
172
173 
pub async fn list(pool: &Pool, scope: Scope) -> sqlx::Result<Vec<Assistant>> {
5d90e0e0 Andy McCall 174 
    sqlx::query_as("SELECT * FROM assistants WHERE scope = $1 AND scope_id = $2 ORDER BY name")
e71846aa Andy McCall ↶ 175 
        .bind(scope.kind())
176 
        .bind(scope.id())
177 
        .fetch_all(pool)
178 
        .await
179 
}
180
181 
pub async fn get(pool: &Pool, id: i64) -> sqlx::Result<Option<Assistant>> {
5d90e0e0 Andy McCall 182 
    sqlx::query_as("SELECT * FROM assistants WHERE id = $1").bind(id).fetch_optional(pool).await
e71846aa Andy McCall ↶ 183 
}
184
185 
/// Add an assistant; `None` when the level already has one of that name.
186 
pub async fn create(pool: &Pool, scope: Scope, f: &Fields, token: &[u8]) -> sqlx::Result<Option<Assistant>> {
187 
    let now = now_ms();
188 
    let r = sqlx::query_as(
189 
        "INSERT INTO assistants (scope, scope_id, name, endpoint, api, model, headers, token, enabled, budget, created_ms, updated_ms) \
5d90e0e0 Andy McCall 190 
         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) ON CONFLICT DO NOTHING RETURNING *",
e71846aa Andy McCall ↶ 191 
    )
192 
    .bind(scope.kind())
193 
    .bind(scope.id())
194 
    .bind(&f.name)
195 
    .bind(&f.endpoint)
196 
    .bind(&f.api)
197 
    .bind(&f.model)
198 
    .bind(&f.headers)
199 
    .bind(token)
200 
    .bind(f.enabled)
201 
    .bind(f.budget)
202 
    .bind(now)
203 
    .bind(now)
204 
    .fetch_optional(pool)
205 
    .await?;
206 
    Ok(r)
207 
}
208
209 
/// Change an assistant's details; `token` is `None` to keep the stored
210 
/// one. False when the name is taken at that level.
211 
pub async fn update(pool: &Pool, id: i64, f: &Fields, token: Option<&[u8]>) -> sqlx::Result<bool> {
212 
    let r = match token {
213 
        Some(t) => sqlx::query(
5d90e0e0 Andy McCall 214 
            "UPDATE assistants SET name = $1, endpoint = $2, api = $3, model = $4, headers = $5, enabled = $6, budget = $7, token = $8, updated_ms = $9 \
215 
             WHERE id = $10 AND NOT EXISTS (SELECT 1 FROM assistants o WHERE o.scope = assistants.scope AND o.scope_id = assistants.scope_id AND o.name = $11 AND o.id <> $12)",
e71846aa Andy McCall ↶ 216 
        )
217 
        .bind(&f.name)
218 
        .bind(&f.endpoint)
219 
        .bind(&f.api)
220 
        .bind(&f.model)
221 
        .bind(&f.headers)
222 
        .bind(f.enabled)
223 
        .bind(f.budget)
224 
        .bind(t)
225 
        .bind(now_ms())
226 
        .bind(id)
227 
        .bind(&f.name)
228 
        .bind(id)
229 
        .execute(pool)
230 
        .await?,
231 
        None => sqlx::query(
5d90e0e0 Andy McCall 232 
            "UPDATE assistants SET name = $1, endpoint = $2, api = $3, model = $4, headers = $5, enabled = $6, budget = $7, updated_ms = $8 \
233 
             WHERE id = $9 AND NOT EXISTS (SELECT 1 FROM assistants o WHERE o.scope = assistants.scope AND o.scope_id = assistants.scope_id AND o.name = $10 AND o.id <> $11)",
e71846aa Andy McCall ↶ 234 
        )
235 
        .bind(&f.name)
236 
        .bind(&f.endpoint)
237 
        .bind(&f.api)
238 
        .bind(&f.model)
239 
        .bind(&f.headers)
240 
        .bind(f.enabled)
241 
        .bind(f.budget)
242 
        .bind(now_ms())
243 
        .bind(id)
244 
        .bind(&f.name)
245 
        .bind(id)
246 
        .execute(pool)
247 
        .await?,
248 
    };
249 
    Ok(r.rows_affected() == 1)
250 
}
251
ed89fae5 Andy McCall ↶ 252 
/// A renamed assistant keeps its name on the reviews it answered and the
253 
/// events that mention it, for the repositories its level covers: the
254 
/// name is what people read, not a key.
255 
pub async fn rename_in_history(pool: &Pool, scope: Scope, owner_hint: &str, old: &str, new: &str) -> sqlx::Result<()> {
256 
    if old == new || old.is_empty() || new.is_empty() {
257 
        return Ok(());
258 
    }
259 
    let like = format!("%{old}%");
260 
    match scope {
261 
        Scope::Site => {
ffb67a81 Andy McCall 262 
            for table in ["proposal_reviews", "proposal_comments"] {
5d90e0e0 Andy McCall 263 
                sqlx::query(&format!("UPDATE {table} SET via = $1 WHERE via = $2")).bind(new).bind(old).execute(pool).await?;
ffb67a81 Andy McCall 264 
            }
5d90e0e0 Andy McCall 265 
            sqlx::query("UPDATE proposal_events SET event = replace(event, $1, $2) WHERE event LIKE $3")
ed89fae5 Andy McCall ↶ 266 
                .bind(old)
267 
                .bind(new)
268 
                .bind(&like)
269 
                .execute(pool)
270 
                .await?;
271 
        }
272 
        Scope::Org(_) => {
5d90e0e0 Andy McCall 273 
            let in_org = "proposal_id IN (SELECT p.id FROM proposals p JOIN repositories r ON r.id = p.repo_id WHERE r.owner = $1)";
ffb67a81 Andy McCall 274 
            for table in ["proposal_reviews", "proposal_comments"] {
5d90e0e0 Andy McCall 275 
                sqlx::query(&format!("UPDATE {table} SET via = $1 WHERE via = $2 AND {in_org}"))
ffb67a81 Andy McCall 276 
                    .bind(new)
277 
                    .bind(old)
278 
                    .bind(owner_hint)
279 
                    .execute(pool)
280 
                    .await?;
281 
            }
5d90e0e0 Andy McCall 282 
            sqlx::query(&format!("UPDATE proposal_events SET event = replace(event, $1, $2) WHERE event LIKE $3 AND {in_org}"))
ed89fae5 Andy McCall ↶ 283 
                .bind(old)
284 
                .bind(new)
285 
                .bind(&like)
286 
                .bind(owner_hint)
287 
                .execute(pool)
288 
                .await?;
289 
        }
290 
        Scope::Repo(id) => {
5d90e0e0 Andy McCall 291 
            let in_repo = "proposal_id IN (SELECT id FROM proposals WHERE repo_id = $1)";
ffb67a81 Andy McCall 292 
            for table in ["proposal_reviews", "proposal_comments"] {
5d90e0e0 Andy McCall 293 
                sqlx::query(&format!("UPDATE {table} SET via = $1 WHERE via = $2 AND {in_repo}"))
ffb67a81 Andy McCall 294 
                    .bind(new)
295 
                    .bind(old)
296 
                    .bind(id)
297 
                    .execute(pool)
298 
                    .await?;
299 
            }
5d90e0e0 Andy McCall 300 
            sqlx::query(&format!("UPDATE proposal_events SET event = replace(event, $1, $2) WHERE event LIKE $3 AND {in_repo}"))
ed89fae5 Andy McCall ↶ 301 
                .bind(old)
302 
                .bind(new)
303 
                .bind(&like)
304 
                .bind(id)
305 
                .execute(pool)
306 
                .await?;
307 
        }
308 
    }
309 
    Ok(())
310 
}
311
e71846aa Andy McCall ↶ 312 
pub async fn set_enabled(pool: &Pool, id: i64, enabled: bool) -> sqlx::Result<()> {
5d90e0e0 Andy McCall 313 
    sqlx::query("UPDATE assistants SET enabled = $1, updated_ms = $2 WHERE id = $3")
e71846aa Andy McCall ↶ 314 
        .bind(enabled)
315 
        .bind(now_ms())
316 
        .bind(id)
317 
        .execute(pool)
318 
        .await?;
319 
    Ok(())
320 
}
321
322 
pub async fn delete(pool: &Pool, id: i64) -> sqlx::Result<()> {
5d90e0e0 Andy McCall 323 
    sqlx::query("DELETE FROM assistants WHERE id = $1").bind(id).execute(pool).await?;
e71846aa Andy McCall ↶ 324 
    Ok(())
325 
}
326
327 
/// Forget a level's assistants and prompt, when the organisation or
328 
/// repository goes.
329 
pub async fn delete_scope(pool: &Pool, scope: Scope) -> sqlx::Result<()> {
5d90e0e0 Andy McCall 330 
    sqlx::query("DELETE FROM assistants WHERE scope = $1 AND scope_id = $2").bind(scope.kind()).bind(scope.id()).execute(pool).await?;
331 
    sqlx::query("DELETE FROM assistant_prompts WHERE scope = $1 AND scope_id = $2")
332 
        .bind(scope.kind())
333 
        .bind(scope.id())
334 
        .execute(pool)
335 
        .await?;
e71846aa Andy McCall ↶ 336 
    Ok(())
337 
}
338
339 
/// The prompt a level adds, empty when none.
340 
pub async fn prompt(pool: &Pool, scope: Scope) -> sqlx::Result<String> {
5d90e0e0 Andy McCall 341 
    Ok(sqlx::query_scalar("SELECT prompt FROM assistant_prompts WHERE scope = $1 AND scope_id = $2")
e71846aa Andy McCall ↶ 342 
        .bind(scope.kind())
343 
        .bind(scope.id())
344 
        .fetch_optional(pool)
345 
        .await?
346 
        .unwrap_or_default())
347 
}
348
349 
pub async fn set_prompt(pool: &Pool, scope: Scope, text: &str) -> sqlx::Result<()> {
350 
    if text.trim().is_empty() {
5d90e0e0 Andy McCall 351 
        sqlx::query("DELETE FROM assistant_prompts WHERE scope = $1 AND scope_id = $2")
e71846aa Andy McCall ↶ 352 
            .bind(scope.kind())
353 
            .bind(scope.id())
354 
            .execute(pool)
355 
            .await?;
356 
    } else {
357 
        sqlx::query(
5d90e0e0 Andy McCall 358 
            "INSERT INTO assistant_prompts (scope, scope_id, prompt, updated_ms) VALUES ($1, $2, $3, $4) \
e71846aa Andy McCall ↶ 359 
             ON CONFLICT (scope, scope_id) DO UPDATE SET prompt = excluded.prompt, updated_ms = excluded.updated_ms",
360 
        )
361 
        .bind(scope.kind())
362 
        .bind(scope.id())
363 
        .bind(text.trim())
364 
        .bind(now_ms())
365 
        .execute(pool)
366 
        .await?;
367 
    }
368 
    Ok(())
369 
}
370
371 
// ----------------------------------------------------- what applies where
372
373 
/// An assistant seen from a level: where it comes from, and whether it is
374 
/// on once outer levels have had their say.
375 
#[derive(Clone, Debug)]
376 
pub struct Available {
377 
    pub assistant: Assistant,
378 
    /// `the site`, `the acme organisation`, or empty for the level's own.
379 
    pub from: String,
380 
    /// Off because a level above disabled an assistant of this name.
381 
    pub off_above: bool,
382 
}
383
384 
impl Available {
385 
    pub fn on(&self) -> bool {
386 
        self.assistant.enabled && !self.off_above
387 
    }
388 
}
389
390 
/// Every assistant a level sees, outermost first, one per name: the
391 
/// innermost definition of a name wins, and a name disabled at an outer
392 
/// level is off inside it whatever the inner level says.
393 
pub async fn available(pool: &Pool, scope: Scope, owner: &str) -> sqlx::Result<Vec<Available>> {
2a83f530 Andy McCall ↶ 394 
    let mut levels = crate::levels::above(pool, scope, owner).await?;
e71846aa Andy McCall ↶ 395 
    levels.push((scope, String::new()));
396 
    let mut out: Vec<Available> = vec![];
397 
    let mut off: Vec<String> = vec![];
398 
    for (level, from) in levels {
399 
        for a in list(pool, level).await? {
400 
            let off_above = off.iter().any(|n| n.eq_ignore_ascii_case(&a.name));
401 
            if !a.enabled && !off.iter().any(|n| n.eq_ignore_ascii_case(&a.name)) {
402 
                off.push(a.name.clone());
403 
            }
404 
            out.retain(|o| !o.assistant.name.eq_ignore_ascii_case(&a.name));
405 
            out.push(Available { assistant: a, from: from.clone(), off_above });
406 
        }
407 
    }
408 
    Ok(out)
409 
}
410
411 
/// The assistants a repository may ask, by name.
412 
pub async fn enabled_for_repo(pool: &Pool, repo: &crate::db::repos::RepoRow) -> sqlx::Result<Vec<Assistant>> {
413 
    Ok(available(pool, Scope::Repo(repo.id), &repo.owner).await?.into_iter().filter(Available::on).map(|a| a.assistant).collect())
414 
}
415
416 
/// The prompts a level inherits, outermost first: (where from, text),
417 
/// only the levels that set one.
418 
pub async fn inherited_prompts(pool: &Pool, scope: Scope, owner: &str) -> sqlx::Result<Vec<(String, String)>> {
419 
    let mut out = vec![];
2a83f530 Andy McCall ↶ 420 
    for (level, from) in crate::levels::above(pool, scope, owner).await? {
e71846aa Andy McCall ↶ 421 
        let text = prompt(pool, level).await?;
422 
        if !text.is_empty() {
423 
            out.push((from, text));
424 
        }
425 
    }
426 
    Ok(out)
427 
}
428
429 
/// The prompt in force for a repository: each level's text under a
430 
/// heading, outermost first, so a project adds to what the site says.
431 
pub async fn prompt_for_repo(pool: &Pool, repo: &crate::db::repos::RepoRow) -> sqlx::Result<String> {
432 
    let scope = Scope::Repo(repo.id);
433 
    let mut parts = inherited_prompts(pool, scope, &repo.owner).await?;
434 
    let own = prompt(pool, scope).await?;
435 
    if !own.is_empty() {
436 
        parts.push(("this repository".to_string(), own));
437 
    }
438 
    Ok(parts.into_iter().map(|(from, text)| format!("## Instructions from {from}\n\n{text}\n")).collect::<Vec<_>>().join("\n"))
439 
}
440
441 
// -------------------------------------------------------------- calling
442
443 
/// Ask an assistant: the system prompt and the request, the answer's
444 
/// text. Errors are for the person who asked: a status and the first
445 
/// line of what the endpoint said, or why no answer came.
5360cea3 Andy McCall ↶ 446 
pub async fn ask(app: &Shared, a: &Assistant, system: &str, user: &str, wait: Duration) -> Result<String, String> {
e71846aa Andy McCall ↶ 447 
    let Some(token) = app.assistant_key.open(&a.token) else {
448 
        return Err("its token cannot be read: set it again".into());
449 
    };
9a777fec Andy McCall ↶ 450 
    let client = crate::net::client(&a.endpoint, &app.config.outbound.allow, wait).await?;
e71846aa Andy McCall ↶ 451 
    let mut req = client.post(&a.endpoint).header("content-type", "application/json");
452 
    let body = match a.api.as_str() {
453 
        "anthropic-messages" => {
454 
            if !token.is_empty() {
455 
                req = req.header("x-api-key", &token);
456 
            }
457 
            req = req.header("anthropic-version", "2023-06-01");
458 
            serde_json::json!({
459 
                "model": a.model,
5360cea3 Andy McCall ↶ 460 
                "max_tokens": MAX_ANSWER_TOKENS,
e71846aa Andy McCall ↶ 461 
                "system": system,
462 
                "messages": [{ "role": "user", "content": user }],
463 
            })
464 
        }
465 
        _ => {
466 
            if !token.is_empty() {
467 
                req = req.header("authorization", format!("Bearer {token}"));
468 
            }
5360cea3 Andy McCall ↶ 469 
            // No length here: providers differ (`max_tokens`, or
470 
            // `max_completion_tokens` for newer OpenAI models, with
471 
            // different ceilings), and their defaults are generous.
e71846aa Andy McCall ↶ 472 
            serde_json::json!({
473 
                "model": a.model,
474 
                "messages": [
475 
                    { "role": "system", "content": system },
476 
                    { "role": "user", "content": user },
477 
                ],
478 
            })
479 
        }
480 
    };
481 
    for (name, value) in a.header_list() {
482 
        req = req.header(name, value);
483 
    }
484 
    let r = req.json(&body).send().await.map_err(|e| {
485 
        if e.is_timeout() {
5360cea3 Andy McCall ↶ 486 
            format!("no answer within {} seconds", wait.as_secs())
e71846aa Andy McCall ↶ 487 
        } else {
488 
            scrub(&e.to_string(), &token)
489 
        }
490 
    })?;
491 
    let status = r.status();
492 
    let text: String = r.text().await.unwrap_or_default().chars().take(MAX_ANSWER).collect();
493 
    if !status.is_success() {
494 
        let why = serde_json::from_str::<serde_json::Value>(&text)
495 
            .ok()
496 
            .and_then(|v| v["error"]["message"].as_str().or(v["error"].as_str()).or(v["message"].as_str()).map(str::to_string))
497 
            .unwrap_or_else(|| text.lines().next().unwrap_or("").chars().take(160).collect());
498 
        return Err(scrub(&format!("{} {}", status.as_u16(), why.trim()), &token));
499 
    }
500 
    let v: serde_json::Value = serde_json::from_str(&text).map_err(|_| "the answer was not JSON".to_string())?;
5360cea3 Andy McCall ↶ 501 
    let (answer, stop) = answer_of(&a.api, &v);
502 
    finish(answer, stop)
503 
}
504
505 
/// Why an answer ended, as the person who asked needs to know it.
506 
#[derive(Debug, PartialEq, Eq)]
507 
enum Stop {
508 
    /// It finished.
509 
    Done,
510 
    /// It reached the length it was allowed (thinking counts against it).
511 
    Length,
512 
    /// The provider declined to answer, with its category if it gave one.
513 
    Declined(Option<String>),
514 
}
515
516 
/// The text of a provider's answer (text parts only: thinking is not
517 
/// part of the answer), and why it ended.
518 
fn answer_of(api: &str, v: &serde_json::Value) -> (String, Stop) {
519 
    match api {
520 
        "anthropic-messages" => {
521 
            let text = v["content"]
522 
                .as_array()
523 
                .map(|parts| {
524 
                    parts
525 
                        .iter()
526 
                        .filter(|p| p["type"].as_str().is_none_or(|t| t == "text"))
527 
                        .filter_map(|p| p["text"].as_str())
528 
                        .collect::<Vec<_>>()
529 
                        .join("")
530 
                })
531 
                .unwrap_or_default();
532 
            let stop = match v["stop_reason"].as_str() {
533 
                Some("max_tokens") => Stop::Length,
534 
                Some("refusal") => Stop::Declined(v["stop_details"]["category"].as_str().map(str::to_string)),
535 
                _ => Stop::Done,
536 
            };
537 
            (text, stop)
538 
        }
539 
        _ => {
540 
            let choice = &v["choices"][0];
541 
            let text = match &choice["message"]["content"] {
542 
                serde_json::Value::String(s) => s.clone(),
543 
                serde_json::Value::Array(parts) => parts.iter().filter_map(|p| p["text"].as_str()).collect::<Vec<_>>().join(""),
544 
                _ => String::new(),
545 
            };
546 
            let stop = match choice["finish_reason"].as_str() {
547 
                Some("length") => Stop::Length,
548 
                Some("content_filter") => Stop::Declined(None),
549 
                _ => Stop::Done,
550 
            };
551 
            (text, stop)
552 
        }
e71846aa Andy McCall ↶ 553 
    }
554 
}
555
5360cea3 Andy McCall ↶ 556 
/// The answer, or why there is none. An answer cut short is kept, with a
557 
/// note saying so.
558 
fn finish(answer: String, stop: Stop) -> Result<String, String> {
559 
    match stop {
560 
        Stop::Declined(category) => Err(match category {
561 
            Some(c) => format!("it declined to answer ({c})"),
562 
            None => "it declined to answer".into(),
563 
        }),
564 
        Stop::Length if answer.trim().is_empty() => {
565 
            Err("it ran out of room before writing an answer (it spent its length limit thinking): try a smaller proposal".into())
566 
        }
567 
        Stop::Length => Ok(format!("{}\n\n*(Cut short: the answer reached its length limit.)*", answer.trim_end())),
568 
        Stop::Done if answer.trim().is_empty() => Err("the answer carried no text".into()),
569 
        Stop::Done => Ok(answer),
570 
    }
571 
}
572
155cab14 Andy McCall ↶ 573 
/// Providers the add form offers, with what they need (#109):
574 
/// (id, label, name, endpoint, api).
575 
pub const PRESETS: &[(&str, &str, &str, &str, &str)] = &[
576 
    ("anthropic", "Anthropic (Claude)", "Claude", "https://api.anthropic.com/v1/messages", "anthropic-messages"),
577 
    ("openai", "OpenAI (ChatGPT)", "ChatGPT", "https://api.openai.com/v1/chat/completions", "chat-completions"),
578 
    ("gemini", "Google Gemini", "Gemini", "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions", "chat-completions"),
579 
    ("deepseek", "DeepSeek", "DeepSeek", "https://api.deepseek.com/chat/completions", "chat-completions"),
580 
    ("mistral", "Mistral", "Mistral", "https://api.mistral.ai/v1/chat/completions", "chat-completions"),
581 
    ("perplexity", "Perplexity", "Perplexity", "https://api.perplexity.ai/chat/completions", "chat-completions"),
582 
    ("ollama", "Ollama (on your network)", "Ollama", "http://localhost:11434/v1/chat/completions", "chat-completions"),
583 
];
584
585 
/// Where an endpoint lists its models: `…/chat/completions` → `…/models`,
586 
/// `…/messages` → `…/models`.
587 
pub fn models_url(endpoint: &str) -> Option<String> {
588 
    let e = endpoint.trim_end_matches('/');
589 
    e.strip_suffix("/chat/completions").or_else(|| e.strip_suffix("/messages")).map(|base| format!("{base}/models"))
590 
}
591
592 
/// The chat models an endpoint offers for this token, sorted; `Err` when
593 
/// it cannot say (no list, refused, unreachable). Embedding, speech and
594 
/// image models are left out.
9a777fec Andy McCall ↶ 595 
pub async fn list_models(endpoint: &str, api: &str, token: &str, allow: &[String]) -> Result<Vec<String>, String> {
155cab14 Andy McCall ↶ 596 
    let url = models_url(endpoint).ok_or("this endpoint has no model list next to it")?;
9a777fec Andy McCall ↶ 597 
    let client = crate::net::client(&url, allow, std::time::Duration::from_secs(15)).await?;
155cab14 Andy McCall ↶ 598 
    let mut req = client.get(&url);
599 
    if api == "anthropic-messages" {
600 
        req = req.header("anthropic-version", "2023-06-01");
601 
        if !token.is_empty() {
602 
            req = req.header("x-api-key", token);
603 
        }
604 
    } else if !token.is_empty() {
605 
        req = req.header("authorization", format!("Bearer {token}"));
606 
    }
607 
    let r = req.send().await.map_err(|e| scrub(&e.to_string(), token))?;
608 
    let status = r.status();
609 
    if !status.is_success() {
610 
        return Err(format!("the model list answered {}", status.as_u16()));
611 
    }
612 
    let v: serde_json::Value = r.json().await.map_err(|_| "the model list was not JSON".to_string())?;
613 
    let skip = ["embed", "tts", "whisper", "dall-e", "moderation", "audio", "image", "realtime", "transcribe", "search-preview"];
614 
    let mut out: Vec<String> = v["data"]
615 
        .as_array()
616 
        .or(v["models"].as_array())
617 
        .ok_or("the model list had no data")?
618 
        .iter()
619 
        .filter_map(|m| m["id"].as_str().or(m["name"].as_str()))
620 
        .map(|id| id.strip_prefix("models/").unwrap_or(id).to_string())
621 
        .filter(|id| !skip.iter().any(|s| id.to_lowercase().contains(s)))
622 
        .collect();
623 
    out.sort();
624 
    out.dedup();
625 
    if out.is_empty() {
626 
        return Err("the model list was empty".into());
627 
    }
628 
    Ok(out)
629 
}
630
e71846aa Andy McCall ↶ 631 
/// A tiny exchange, for the settings page's TEST: the start of the answer.
632 
pub async fn test(app: &Shared, a: &Assistant) -> Result<String, String> {
5360cea3 Andy McCall ↶ 633 
    let answer =
634 
        ask(app, a, "You are being connected to an OxygenHub site. Answer briefly.", "Reply with the single word OK.", CALL_TIMEOUT)
635 
            .await?;
e71846aa Andy McCall ↶ 636 
    Ok(answer.trim().chars().take(80).collect())
637 
}
638
639 
/// Never let the token through in an error message.
640 
fn scrub(text: &str, token: &str) -> String {
641 
    if token.is_empty() {
642 
        text.to_string()
643 
    } else {
644 
        text.replace(token, "***")
645 
    }
646 
}
647
648 
#[cfg(test)]
649 
mod tests {
650 
    use super::*;
651
652 
    #[test]
653 
    fn tokens_seal_and_open_only_under_their_key() {
654 
        let dir = tempfile::tempdir().unwrap();
655 
        let k = SecretKey::load_or_create(dir.path()).unwrap();
656 
        let sealed = k.seal("sk-very-secret");
657 
        assert_ne!(sealed, b"sk-very-secret");
658 
        assert!(!String::from_utf8_lossy(&sealed).contains("secret"));
659 
        assert_eq!(k.open(&sealed).as_deref(), Some("sk-very-secret"));
660 
        assert_eq!(SecretKey::load_or_create(dir.path()).unwrap().open(&sealed).as_deref(), Some("sk-very-secret"), "the key is kept");
661 
        let other = SecretKey::load_or_create(tempfile::tempdir().unwrap().path()).unwrap();
662 
        assert_eq!(other.open(&sealed), None);
663 
        assert_eq!(k.open(&[1, 2, 3]), None);
664 
        assert_eq!(k.seal(""), Vec::<u8>::new());
665 
        assert_eq!(k.open(&[]).as_deref(), Some(""));
5360cea3 Andy McCall ↶ 666 
    }
667
668 
    #[test]
669 
    fn answers_say_why_they_stopped() {
670 
        let a = |v: serde_json::Value| {
671 
            let (text, stop) = answer_of("anthropic-messages", &v);
672 
            finish(text, stop)
673 
        };
674 
        // #201: all of the length spent thinking.
675 
        let thought = serde_json::json!({ "stop_reason": "max_tokens", "content": [{ "type": "thinking", "thinking": "" }] });
676 
        assert!(a(thought).unwrap_err().contains("ran out of room"));
677 
        let cut = serde_json::json!({ "stop_reason": "max_tokens", "content": [{ "type": "thinking", "thinking": "" }, { "type": "text", "text": "Half" }] });
678 
        assert!(a(cut).unwrap().starts_with("Half\n\n*(Cut short"));
679 
        let declined = serde_json::json!({ "stop_reason": "refusal", "stop_details": { "category": "cyber" }, "content": [] });
680 
        assert_eq!(a(declined).unwrap_err(), "it declined to answer (cyber)");
681 
        let ok = serde_json::json!({ "stop_reason": "end_turn", "content": [{ "type": "text", "text": "Fine." }] });
682 
        assert_eq!(a(ok).unwrap(), "Fine.");
683 
        let chat = |v: serde_json::Value| {
684 
            let (text, stop) = answer_of("chat-completions", &v);
685 
            finish(text, stop)
686 
        };
687 
        assert!(chat(serde_json::json!({ "choices": [{ "finish_reason": "length", "message": { "content": "" } }] }))
688 
            .unwrap_err()
689 
            .contains("ran out of room"));
690 
        assert_eq!(
691 
            chat(serde_json::json!({ "choices": [{ "finish_reason": "content_filter", "message": { "content": "" } }] })).unwrap_err(),
692 
            "it declined to answer"
693 
        );
694 
        assert_eq!(
695 
            chat(serde_json::json!({ "choices": [{ "finish_reason": "stop", "message": { "content": "Yes." } }] })).unwrap(),
696 
            "Yes."
697 
        );
e71846aa Andy McCall ↶ 698 
    }
699
700 
    #[test]
701 
    fn headers_parse_or_name_the_bad_line() {
702 
        assert_eq!(
703 
            parse_headers("X-Org: acme\n\n OpenAI-Beta : v1 ").unwrap(),
704 
            vec![("X-Org".into(), "acme".into()), ("OpenAI-Beta".into(), "v1".into())]
705 
        );
706 
        assert_eq!(parse_headers("no colon").unwrap_err(), "no colon");
707 
        assert_eq!(parse_headers("bad name: x").unwrap_err(), "bad name: x");
708 
    }
709 
}
7d2eb590 Andy McCall ↶ 710
711 
// ------------------------------------------------------- reviewing
712
713 
/// At most this many assistant calls per repository per hour.
714 
pub const CALLS_PER_HOUR: usize = 30;
715
716 
/// Who is answering what, and recent calls per repository.
717 
#[derive(Default)]
718 
pub struct Gate {
719 
    busy: std::collections::HashSet<(i64, String)>,
720 
    recent: std::collections::HashMap<i64, Vec<i64>>,
721 
}
722
723 
impl Gate {
724 
    /// Take the slot for (proposal, assistant), or say why not.
725 
    fn take(&mut self, repo_id: i64, proposal_id: i64, name: &str) -> Result<(), String> {
726 
        let key = (proposal_id, name.to_lowercase());
727 
        if self.busy.contains(&key) {
728 
            return Err(format!("{name} is already answering this proposal"));
729 
        }
730 
        let now = now_ms();
731 
        let calls = self.recent.entry(repo_id).or_default();
732 
        calls.retain(|t| now - *t < 3_600_000);
733 
        if calls.len() >= CALLS_PER_HOUR {
734 
            return Err(format!("this repository has asked assistants {CALLS_PER_HOUR} times in the last hour; try later"));
735 
        }
736 
        calls.push(now);
737 
        self.busy.insert(key);
738 
        Ok(())
739 
    }
740
741 
    fn release(&mut self, proposal_id: i64, name: &str) {
742 
        self.busy.remove(&(proposal_id, name.to_lowercase()));
743 
    }
744 
}
745
746 
/// What a reviewer is told about a proposal: its title, description,
747 
/// changes and diff, cut to `budget` characters.
748 
pub fn review_context(
749 
    row: &crate::db::repos::RepoRow,
750 
    p: &crate::db::proposals::ProposalRow,
751 
    loaded: &crate::web::proposals::Loaded,
752 
    budget: usize,
753 
) -> String {
754 
    let mut head =
755 
        format!("# Proposal #{}: {}\n\nRepository {}/{} · into {} · by {}\n\n", p.number, p.title, row.owner, row.name, p.target, p.author);
756 
    if !p.body.trim().is_empty() {
757 
        head.push_str("## Description\n\n");
758 
        head.push_str(p.body.trim());
759 
        head.push_str("\n\n");
760 
    }
761 
    context_text(head, &loaded.changes, &loaded.diffs, budget)
762 
}
763
764 
/// What a drafter is told: the title so far, the changes and the diff.
765 
pub fn draft_context(
766 
    row: &crate::db::repos::RepoRow,
767 
    title: &str,
768 
    target: &str,
769 
    changes: &[crate::repos::view::ChangeView],
770 
    diffs: &[oxy_core::repo::FileDiff],
771 
    budget: usize,
772 
) -> String {
773 
    let head = format!(
774 
        "# Proposal: {}\n\nRepository {}/{} · into {}\n\n",
775 
        if title.trim().is_empty() { "(untitled)" } else { title.trim() },
776 
        row.owner,
777 
        row.name,
778 
        target
779 
    );
780 
    context_text(head, changes, diffs, budget)
781 
}
782
783 
/// `head`, the list of changes, then the diff as `-`/`+` lines per hunk,
784 
/// binary files noted, the diff cut so the whole fits `budget`.
785 
fn context_text(mut text: String, changes: &[crate::repos::view::ChangeView], diffs: &[oxy_core::repo::FileDiff], budget: usize) -> String {
786 
    text.push_str(&format!("## Changes ({})\n\n", changes.len()));
787 
    for c in changes {
788 
        text.push_str(&format!("- {} {}\n", c.short, c.title));
789 
        let body = c.body.trim();
790 
        if !body.is_empty() {
791 
            for line in body.lines().take(20) {
792 
                text.push_str("  ");
793 
                text.push_str(line);
794 
                text.push('\n');
795 
            }
796 
        }
797 
    }
798 
    text.push_str("\n## Diff\n\n");
799 
    let head = text.chars().count();
800 
    let mut diff = String::new();
801 
    for f in diffs {
802 
        diff.push_str(&format!("### {} ({})\n", f.path, f.kind));
803 
        if let Some(from) = &f.from {
804 
            diff.push_str(&format!("renamed from {from}\n"));
805 
        }
806 
        let binary = f.hunks.iter().any(|h| h.added.iter().chain(h.removed.iter().map(|(_, l)| l)).any(|l| l.contains(&0)));
807 
        if binary {
808 
            diff.push_str("(binary)\n\n");
809 
            continue;
810 
        }
811 
        diff.push_str("```\n");
812 
        for h in &f.hunks {
813 
            diff.push_str(&format!("@@ after line {} @@\n", h.base_line));
814 
            for (_, l) in &h.removed {
815 
                diff.push('-');
816 
                diff.push_str(String::from_utf8_lossy(l).trim_end_matches('\n'));
817 
                diff.push('\n');
818 
            }
819 
            for l in &h.added {
820 
                diff.push('+');
821 
                diff.push_str(String::from_utf8_lossy(l).trim_end_matches('\n'));
822 
                diff.push('\n');
823 
            }
824 
        }
825 
        diff.push_str("```\n\n");
826 
    }
827 
    let room = budget.saturating_sub(head + 80);
828 
    if diff.chars().count() > room {
829 
        let cut: String = diff.chars().take(room).collect();
830 
        text.push_str(&cut);
831 
        text.push_str("\n\n(the diff was cut here to fit the context budget)\n");
832 
    } else {
833 
        text.push_str(&diff);
834 
    }
835 
    text
836 
}
837
838 
/// The system prompt for a review: who the assistant is, what a review
839 
/// here is, then the prompts the levels set.
840 
pub fn review_system_prompt(a: &Assistant, site: &str, prompts: &str) -> String {
841 
    let mut s = format!(
842 
        "You are {name}, an AI assistant reviewing a proposal on {site}, an OxygenHub site. \
843 
         A person asked for your review; it is recorded as a review comment made via you, under their name. \
844 
         You cannot approve: only people approve. Answer in Markdown: start with a one-paragraph summary, \
845 
         then findings (correctness first, then clarity), each naming the file and quoting the lines it is about; \
846 
         keep praise out unless something is notably well done; say so plainly when you find nothing wrong.",
847 
        name = a.name
848 
    );
849 
    if !prompts.trim().is_empty() {
850 
        s.push_str("\n\n");
851 
        s.push_str(prompts.trim());
852 
    }
853 
    s
854 
}
855
856 
/// Ask `a` to review proposal `p` for `by`: records the request, calls the
857 
/// endpoint in the background, and stores the answer as a `comment` review
858 
/// via the assistant (or an event saying why none came). `Err` is for the
859 
/// person who asked, when nothing was started.
860 
pub async fn request_review(
861 
    app: &Shared,
862 
    row: &crate::db::repos::RepoRow,
863 
    p: &crate::db::proposals::ProposalRow,
864 
    by: &crate::db::accounts::Account,
865 
    a: Assistant,
866 
) -> Result<(), String> {
867 
    app.assistant_gate.lock().unwrap_or_else(|e| e.into_inner()).take(row.id, p.id, &a.name)?;
868 
    let pool = &app.db;
869 
    crate::db::proposals::add_event(pool, p.id, &by.username, &format!("asked {} to review", a.name), "").await.ok();
870 
    crate::db::accounts::audit(
871 
        pool,
872 
        Some(by),
873 
        "assistant.asked",
874 
        &format!("{}/{}", row.owner, row.name),
875 
        &format!("{} #{}", a.name, p.number),
876 
    )
877 
    .await
878 
    .ok();
879 
    let (app, row, p, by) = (app.clone(), row.clone(), p.clone(), by.clone());
880 
    tokio::spawn(async move {
881 
        let outcome = answer_review(&app, &row, &p, &a).await;
882 
        app.assistant_gate.lock().unwrap_or_else(|e| e.into_inner()).release(p.id, &a.name);
883 
        match outcome {
884 
            Ok(body) => {
885 
                if crate::db::proposals::add_review_via(&app.db, p.id, by.id, &by.username, "comment", &body, &a.name).await.is_ok() {
886 
                    crate::db::proposals::add_event(&app.db, p.id, &by.username, &format!("review.comment via {}", a.name), "").await.ok();
887 
                    crate::web::proposals::reviewed(&app, &row, &p, &by, "comment").await;
888 
                    crate::hooks::emit(
889 
                        &app,
890 
                        &row,
891 
                        "review",
892 
                        &by.username,
893 
                        serde_json::json!({ "number": p.number, "verdict": "comment", "via": a.name }),
894 
                    )
895 
                    .await;
896 
                }
897 
            }
898 
            Err(why) => {
899 
                crate::db::proposals::add_event(&app.db, p.id, &by.username, &format!("{} did not answer", a.name), &why).await.ok();
900 
            }
901 
        }
902 
    });
903 
    Ok(())
904 
}
905
906 
async fn answer_review(
907 
    app: &Shared,
908 
    row: &crate::db::repos::RepoRow,
909 
    p: &crate::db::proposals::ProposalRow,
910 
    a: &Assistant,
911 
) -> Result<String, String> {
912 
    let repo = crate::repos::names::RepoName::new(&row.owner, &row.name).ok_or("bad repository name")?;
913 
    let loaded = crate::web::proposals::load(app, &repo, p.clone()).await.map_err(|e| format!("the proposal could not be loaded: {e}"))?;
914 
    let budget = usize::try_from(a.budget).unwrap_or(DEFAULT_BUDGET as usize).max(1_000);
915 
    let prompts = prompt_for_repo(&app.db, row).await.map_err(|e| e.to_string())?;
916 
    let system = review_system_prompt(a, &app.config.site.name, &prompts);
ffb67a81 Andy McCall 917 
    let user = review_context(row, p, &loaded, budget.saturating_sub(system.chars().count()));
5360cea3 Andy McCall ↶ 918 
    ask(app, a, &system, &user, BACKGROUND_TIMEOUT).await
ffb67a81 Andy McCall 919 
}
920
921 
// -------------------------------------------------------- summaries
922
923 
/// The system prompt for a summary posted as a comment (oxygenhub#190).
924 
pub fn summary_system_prompt(a: &Assistant, site: &str, prompts: &str) -> String {
925 
    let mut s = format!(
926 
        "You are {name}, an AI assistant working on {site}, an OxygenHub site, with a next-generation version control system \
927 
         called Oxygen (its command is oxy). A proposal is Oxygen's equivalent of a merge request or pull request. \
928 
         Please summarise the proposal and comment on it. A person asked for this; it is posted as a comment made via you, \
929 
         under their name. Answer in Markdown: a short summary of what the proposal changes and why, then anything a reviewer \
930 
         should look at closely; keep to what the description and the diff show.",
931 
        name = a.name
932 
    );
933 
    if !prompts.trim().is_empty() {
934 
        s.push_str("\n\n");
935 
        s.push_str(prompts.trim());
936 
    }
937 
    s
938 
}
939
940 
/// Ask `a` to summarise proposal `p` for `by`: like [`request_review`],
941 
/// but the answer is a conversation comment via the assistant.
942 
pub async fn request_summary(
943 
    app: &Shared,
944 
    row: &crate::db::repos::RepoRow,
945 
    p: &crate::db::proposals::ProposalRow,
946 
    by: &crate::db::accounts::Account,
947 
    a: Assistant,
948 
) -> Result<(), String> {
949 
    app.assistant_gate.lock().unwrap_or_else(|e| e.into_inner()).take(row.id, p.id, &a.name)?;
950 
    let pool = &app.db;
951 
    crate::db::proposals::add_event(pool, p.id, &by.username, &format!("asked {} for a summary", a.name), "").await.ok();
952 
    crate::db::accounts::audit(
953 
        pool,
954 
        Some(by),
955 
        "assistant.asked",
956 
        &format!("{}/{}", row.owner, row.name),
957 
        &format!("{} #{} summary", a.name, p.number),
958 
    )
959 
    .await
960 
    .ok();
961 
    let (app, row, p, by) = (app.clone(), row.clone(), p.clone(), by.clone());
962 
    tokio::spawn(async move {
963 
        let outcome = answer_summary(&app, &row, &p, &a).await;
964 
        app.assistant_gate.lock().unwrap_or_else(|e| e.into_inner()).release(p.id, &a.name);
965 
        match outcome {
966 
            Ok(body) => {
967 
                crate::db::proposals::add_comment_via(&app.db, p.id, by.id, &by.username, &body, &a.name).await.ok();
968 
            }
969 
            Err(why) => {
970 
                crate::db::proposals::add_event(&app.db, p.id, &by.username, &format!("{} did not answer", a.name), &why).await.ok();
971 
            }
972 
        }
973 
    });
974 
    Ok(())
975 
}
976
977 
async fn answer_summary(
978 
    app: &Shared,
979 
    row: &crate::db::repos::RepoRow,
980 
    p: &crate::db::proposals::ProposalRow,
981 
    a: &Assistant,
982 
) -> Result<String, String> {
983 
    let repo = crate::repos::names::RepoName::new(&row.owner, &row.name).ok_or("bad repository name")?;
984 
    let loaded = crate::web::proposals::load(app, &repo, p.clone()).await.map_err(|e| format!("the proposal could not be loaded: {e}"))?;
985 
    let budget = usize::try_from(a.budget).unwrap_or(DEFAULT_BUDGET as usize).max(1_000);
986 
    let prompts = prompt_for_repo(&app.db, row).await.map_err(|e| e.to_string())?;
987 
    let system = summary_system_prompt(a, &app.config.site.name, &prompts);
7d2eb590 Andy McCall ↶ 988 
    let user = review_context(row, p, &loaded, budget.saturating_sub(system.chars().count()));
5360cea3 Andy McCall ↶ 989 
    ask(app, a, &system, &user, BACKGROUND_TIMEOUT).await
7d2eb590 Andy McCall ↶ 990 
}
991
992 
// -------------------------------------------------------- drafting
993
994 
/// The system prompt for drafting a proposal's description.
995 
pub fn draft_system_prompt(a: &Assistant, site: &str, prompts: &str) -> String {
996 
    let mut s = format!(
997 
        "You are {name}, an AI assistant drafting the description of a proposal on {site}, an OxygenHub site, \
998 
         for the person who will open or edit it; they read and change your draft before saving, and the draft is theirs. \
999 
         Write Markdown for the description field only: no title line, no greeting, no sign-off. \
1000 
         Say what the changes do and why, what a reviewer should look at, and how to verify them; \
1001 
         keep to what the diff shows, and keep it short.",
1002 
        name = a.name
1003 
    );
1004 
    if !prompts.trim().is_empty() {
1005 
        s.push_str("\n\n");
1006 
        s.push_str(prompts.trim());
1007 
    }
1008 
    s
1009 
}
1010
1011 
/// What a description is drafted from.
1012 
pub struct Draft<'a> {
1013 
    /// The proposal's id, or minus the repository's for one not yet opened:
1014 
    /// one draft per assistant at a time for it.
1015 
    pub slot: i64,
1016 
    pub title: &'a str,
1017 
    pub target: &'a str,
1018 
    pub changes: &'a [crate::repos::view::ChangeView],
1019 
    pub diffs: &'a [oxy_core::repo::FileDiff],
1020 
}
1021
1022 
/// Ask `a` for a description, now; the answer goes into the editor,
1023 
/// nothing is saved. `Err` is for the person.
1024 
pub async fn draft_description(
1025 
    app: &Shared,
1026 
    row: &crate::db::repos::RepoRow,
1027 
    by: &crate::db::accounts::Account,
1028 
    a: &Assistant,
1029 
    d: Draft<'_>,
1030 
) -> Result<String, String> {
1031 
    let Draft { slot, title, target, changes, diffs } = d;
1032 
    app.assistant_gate.lock().unwrap_or_else(|e| e.into_inner()).take(row.id, slot, &a.name)?;
1033 
    crate::db::accounts::audit(&app.db, Some(by), "assistant.drafted", &format!("{}/{}", row.owner, row.name), &a.name).await.ok();
1034 
    let budget = usize::try_from(a.budget).unwrap_or(DEFAULT_BUDGET as usize).max(1_000);
1035 
    let prompts = prompt_for_repo(&app.db, row).await.map_err(|e| e.to_string());
1036 
    let outcome = match prompts {
1037 
        Ok(prompts) => {
1038 
            let system = draft_system_prompt(a, &app.config.site.name, &prompts);
1039 
            let user = draft_context(row, title, target, changes, diffs, budget.saturating_sub(system.chars().count()));
5360cea3 Andy McCall ↶ 1040 
            ask(app, a, &system, &user, CALL_TIMEOUT).await
7d2eb590 Andy McCall ↶ 1041 
        }
1042 
        Err(e) => Err(e),
1043 
    };
1044 
    app.assistant_gate.lock().unwrap_or_else(|e| e.into_inner()).release(slot, &a.name);
1045 
    outcome.map(|t| t.trim().to_string())
1046 
}