AI settings API with key management #80

Merged

approver_agent merged 3 commits from task/ai-settings-api_176b2a30-6e90-4339-b430-5b8967b2fd32 into feature/b28d9979-0f7a-4e81-bdff-2f16f3db2053-settings-admin-ai

2026-10-06 09:16:10 -04:00

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	799e7b62d0	Redact the AI key from model lists and fit the longest prompt CI / ci (push) Successful in 2m6s Details CI / ci (pull_request) Successful in 2m7s Details GET /settings/ai/models now removes the stored API key from every model ID and display name the provider returns, so a provider that echoes the key in a successful list cannot disclose it. PATCH /settings/ai gets its own body limit, sized for 8,000 characters at 12 bytes of JSON each (a \u-escaped surrogate pair) plus the other fields. A valid prompt of three- or four-byte characters was refused by the shared 16 KiB limit; the 8,000-character rule stays the only limit on the prompt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 09:04:16 -04:00
dev_agentandClaude Opus 5.5	94632e0950	Keep the stored AI key on the endpoint it was stored for CI / ci (push) Successful in 1m59s Details CI / ci (pull_request) Successful in 1m59s Details PATCH /settings/ai refused nothing when the base URL or provider changed with a key stored, so a session could point base_url at another server and have POST /settings/ai/verify send it the key. Both changes are now refused while a key is stored: remove the key, change the endpoint, then store the new key. A preset without a fixed base URL takes a key only when its base URL passes secureurl.Check, so the key never crosses the network in plain text. Maestro task: 176b2a30-6e90-4339-b430-5b8967b2fd32 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 08:52:01 -04:00
dev_agentandClaude Opus 5.5	60a92ec78f	Add AI settings API with key management GET/PATCH /api/v1/settings/ai return and change provider, base_url, model, temperature and system_prompt, with read-only api_key_last4 and key_verified_at. PATCH requires a preset provider, temperature 0-1 in 0.1 steps and a system_prompt of at most 8000 characters. PUT /settings/ai/api-key seals the key with secretbox and records its last four characters; POST /settings/ai/verify calls Provider.Verify and records key_verified_at or returns the provider's typed error; GET /settings/ai/models lists the live models; POST /settings/ai/reset-prompt restores household.DefaultPersonaPrompt. The new internal/ai/aisettings service also builds the harness.Config for each skill run from the saved settings. presets.ForAccount builds a provider's ListModels and Verify without a model, so a key can be checked and a model picked before one is chosen. Tests scan every response body from these routes for the full key, and a harness run with the Fake provider uses the PATCHed model and temperature. Maestro task: 176b2a30-6e90-4339-b430-5b8967b2fd32 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 08:50:12 -04:00

Author

SHA1

Message

Date

dev_agentandClaude Opus 5.5

799e7b62d0

Redact the AI key from model lists and fit the longest prompt

CI / ci (push) Successful in 2m6s

Details

CI / ci (pull_request) Successful in 2m7s

Details

GET /settings/ai/models now removes the stored API key from every model
ID and display name the provider returns, so a provider that echoes the
key in a successful list cannot disclose it.

PATCH /settings/ai gets its own body limit, sized for 8,000 characters at
12 bytes of JSON each (a \u-escaped surrogate pair) plus the other
fields. A valid prompt of three- or four-byte characters was refused by
the shared 16 KiB limit; the 8,000-character rule stays the only limit
on the prompt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 09:04:16 -04:00

dev_agentandClaude Opus 5.5

94632e0950

Keep the stored AI key on the endpoint it was stored for

CI / ci (push) Successful in 1m59s

Details

CI / ci (pull_request) Successful in 1m59s

Details

PATCH /settings/ai refused nothing when the base URL or provider changed
with a key stored, so a session could point base_url at another server
and have POST /settings/ai/verify send it the key. Both changes are now
refused while a key is stored: remove the key, change the endpoint, then
store the new key. A preset without a fixed base URL takes a key only
when its base URL passes secureurl.Check, so the key never crosses the
network in plain text.

Maestro task: 176b2a30-6e90-4339-b430-5b8967b2fd32

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 08:52:01 -04:00

dev_agentandClaude Opus 5.5

60a92ec78f

Add AI settings API with key management

GET/PATCH /api/v1/settings/ai return and change provider, base_url,
model, temperature and system_prompt, with read-only api_key_last4 and
key_verified_at. PATCH requires a preset provider, temperature 0-1 in
0.1 steps and a system_prompt of at most 8000 characters.
PUT /settings/ai/api-key seals the key with secretbox and records its
last four characters; POST /settings/ai/verify calls Provider.Verify and
records key_verified_at or returns the provider's typed error;
GET /settings/ai/models lists the live models; POST
/settings/ai/reset-prompt restores household.DefaultPersonaPrompt.

The new internal/ai/aisettings service also builds the harness.Config
for each skill run from the saved settings. presets.ForAccount builds a
provider's ListModels and Verify without a model, so a key can be
checked and a model picked before one is chosen.

Tests scan every response body from these routes for the full key, and
a harness run with the Fake provider uses the PATCHed model and
temperature.

Maestro task: 176b2a30-6e90-4339-b430-5b8967b2fd32

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 08:50:12 -04:00