pgkiln 0.50.0 → 0.52.0

package/src/ai/chat.ts

@@ -1,10 +1,9 @@
 import Anthropic from '@anthropic-ai/sdk';
 import OpenAI from 'openai';
 import { owner } from '../db.ts';
-import { decryptSecret } from '../secrets.ts';
 import { claudeError } from './anthropic.ts';
 import { openAiError } from './openai.ts';
-import { envKeyName, MAX_PROMPT_CHARS, MAX_SYSTEM_CHARS, serviceForApp, usageToday, logUsage, type AiService, type CallInfo } from './service.ts';
+import { baseUrlFor, MAX_PROMPT_CHARS, MAX_SYSTEM_CHARS, serviceForApp, serviceKey, usageToday, logUsage, type AiService, type CallInfo } from './service.ts';
 import { AiError } from './types.ts';
 
 // Conversations with tools (AI assistant regions, src/runtime/assistant.ts):
@@ -23,7 +22,9 @@ import { AiError } from './types.ts';
 // service's effort, server-side refusal fallbacks. The assistant's content
 // is appended to the history unchanged (thinking blocks included): the
 // history only ever grows, as the API expects. OpenAI: Chat Completions with
-// strict function tools.
+// strict function tools; also Gemini (its OpenAI-compatible endpoint) and
+// OpenAI-compatible endpoints (121). An agent (src/runtime/ai-agents.ts)
+// may set the reasoning effort and a lower output limit per call.
 
 export interface ChatTool {
   name: string;
@@ -47,6 +48,10 @@ export interface ChatRequest {
   /** at most this many rounds of tool calls (then the model must answer) */
   maxRounds: number;
   runTool(name: string, input: Record<string, unknown>): Promise<ToolOutcome>;
+  /** (121) an agent's reasoning effort: Claude's output_config.effort, OpenAI's reasoning_effort (else the service's own) */
+  effort?: 'low' | 'medium' | 'high' | null;
+  /** (121) an agent's output limit per call (never above the service's maximum) */
+  maxTokens?: number | null;
 }
 
 export interface ChatResult {
@@ -69,16 +74,9 @@ export interface ChatInfo {
 /** Tool results are cut to this many characters (the model sees that they were). */
 export const MAX_TOOL_RESULT_CHARS = 20_000;
 
-function apiKey(s: AiService) {
-  let key: string | undefined;
-  try {
-    key = s.api_key_enc ? decryptSecret(s.api_key_enc) : process.env[envKeyName(s.provider)];
-  } catch (e) {
-    throw new AiError('config', `AI service ${s.name}: ${(e as Error).message}`);
-  }
-  if (!key) throw new AiError('config', `AI service ${s.name} has no API key (enter one in the builder, or set ${envKeyName(s.provider)} on the server).`);
-  return key;
-}
+
+/** The output limit of one call: the agent's, never above the service's. */
+const outputLimit = (s: AiService, req: ChatRequest) => Math.min(s.max_tokens, req.maxTokens ?? s.max_tokens);
 
 const clip = (text: string) => (text.length > MAX_TOOL_RESULT_CHARS ? `${text.slice(0, MAX_TOOL_RESULT_CHARS)}\n[cut off: the result was longer]` : text);
 
@@ -114,7 +112,7 @@ async function metered<T extends { model: string; input: number; output: number
 const TOO_MANY_ROUNDS = 'The assistant needed more steps than it may take for one question: ask a simpler question, or start a new conversation.';
 
 async function claudeChat(s: AiService, limits: Parameters<typeof metered>[1], req: ChatRequest, info: ChatInfo): Promise<ChatResult> {
-  const client = new Anthropic({ apiKey: apiKey(s), authToken: null, baseURL: s.base_url || undefined, timeout: s.timeout_s * 1000, maxRetries: 1 });
+  const client = new Anthropic({ apiKey: serviceKey(s), authToken: null, baseURL: baseUrlFor(s), timeout: s.timeout_s * 1000, maxRetries: 1 });
   const messages = [...(req.history as Anthropic.Beta.BetaMessageParam[]), { role: 'user', content: req.message } as Anthropic.Beta.BetaMessageParam];
   const tools: Anthropic.Beta.BetaTool[] = req.tools.map((t) => ({
     name: t.name, description: t.description, strict: true, input_schema: t.parameters as Anthropic.Beta.BetaTool.InputSchema,
@@ -126,11 +124,11 @@ async function claudeChat(s: AiService, limits: Parameters<typeof metered>[1], r
       try {
         m = await client.beta.messages.stream({
           model: s.model,
-          max_tokens: s.max_tokens,
+          max_tokens: outputLimit(s, req),
           system: req.system,
           messages,
           ...(tools.length ? { tools } : {}),
-          ...(s.effort ? { output_config: { effort: s.effort } } : {}),
+          ...((req.effort ?? s.effort) ? { output_config: { effort: (req.effort ?? s.effort)! } } : {}),
           ...(s.refusal_fallback ? { betas: ['server-side-fallback-2026-07-01'], fallbacks: 'default' as const } : {}),
         }).finalMessage();
       } catch (e) {
@@ -161,7 +159,7 @@ async function claudeChat(s: AiService, limits: Parameters<typeof metered>[1], r
 }
 
 async function openAiChat(s: AiService, limits: Parameters<typeof metered>[1], req: ChatRequest, info: ChatInfo): Promise<ChatResult> {
-  const client = new OpenAI({ apiKey: apiKey(s), baseURL: s.base_url || undefined, timeout: s.timeout_s * 1000, maxRetries: 1 });
+  const client = new OpenAI({ apiKey: serviceKey(s), baseURL: baseUrlFor(s), timeout: s.timeout_s * 1000, maxRetries: 1 });
   const messages = [...(req.history as OpenAI.Chat.ChatCompletionMessageParam[]), { role: 'user', content: req.message } as OpenAI.Chat.ChatCompletionMessageParam];
   const tools: OpenAI.Chat.ChatCompletionTool[] = req.tools.map((t) => ({
     type: 'function', function: { name: t.name, description: t.description, parameters: t.parameters, strict: true },
@@ -175,8 +173,10 @@ async function openAiChat(s: AiService, limits: Parameters<typeof metered>[1], r
           model: s.model,
           // the system prompt is sent with each request, not kept in the history
           messages: [{ role: 'system', content: req.system }, ...messages],
-          max_completion_tokens: s.max_tokens,
+          max_completion_tokens: outputLimit(s, req),
           ...(tools.length ? { tools } : {}),
+          // (121) an agent's reasoning effort; models without reasoning refuse it, so none is sent without one
+          ...(req.effort ? { reasoning_effort: req.effort } : {}),
         });
       } catch (e) {
         throw openAiError(e);

package/src/ai/service.ts

@@ -4,7 +4,7 @@ import { ClaudeProvider } from './anthropic.ts';
 import { OpenAiProvider } from './openai.ts';
 import { AiError, type AiProvider, type GenerateRequest, type GenerateResult, type ProviderName } from './types.ts';
 
-// AI services (migration 060): an administrator configures them in the
+// AI services (migration 060; Gemini and OpenAI-compatible endpoints: 121): an administrator configures them in the
 // builder (Workspace utilities → AI services) and allows each application
 // to use some of them, with optional limits per day. Every call goes
 // through generate() here: the service must exist, be enabled and be
@@ -35,33 +35,57 @@ export const DEFAULT_CLAUDE_MODEL = 'claude-opus-5-5';
 export const MAX_PROMPT_CHARS = 200_000;
 export const MAX_SYSTEM_CHARS = 50_000;
 
-const ENV_KEY: Record<ProviderName, string> = { anthropic: 'ANTHROPIC_API_KEY', openai: 'OPENAI_API_KEY' };
+const ENV_KEY: Record<ProviderName, string> = {
+  anthropic: 'ANTHROPIC_API_KEY', openai: 'OPENAI_API_KEY', gemini: 'GEMINI_API_KEY', openai_compatible: 'OPENAI_COMPATIBLE_API_KEY',
+};
 
 export const envKeyName = (p: ProviderName) => ENV_KEY[p];
 
+/** (121) The providers, as the builder names them. */
+export const PROVIDER_LABELS: Record<ProviderName, string> = {
+  anthropic: 'Claude', openai: 'OpenAI', gemini: 'Gemini', openai_compatible: 'OpenAI-compatible',
+};
+export const providerLabel = (p: string) => PROVIDER_LABELS[p as ProviderName] ?? p;
+
+/** (121) Google's OpenAI-compatible endpoint for Gemini (used when a Gemini service names no base URL). */
+export const GEMINI_BASE_URL = 'https://generativelanguage.googleapis.com/v1beta/openai/';
+
+/** The base URL a service's SDK client uses: its own, Gemini's default, or the SDK's default (undefined). */
+export const baseUrlFor = (s: Pick<AiService, 'provider' | 'base_url'>) => s.base_url || (s.provider === 'gemini' ? GEMINI_BASE_URL : undefined);
+
 /** Where the service's key comes from: stored (encrypted), the server's environment, or nowhere. */
 export function keySource(s: Pick<AiService, 'provider' | 'api_key_enc'>): 'stored' | 'env' | 'missing' {
   if (s.api_key_enc) return 'stored';
   return process.env[ENV_KEY[s.provider]] ? 'env' : 'missing';
 }
 
+/**
+ * The service's API key, decrypted only here (never stored elsewhere): the stored one, else the server's
+ * environment variable. An OpenAI-compatible endpoint may need none (a local Ollama): the SDK then sends a
+ * placeholder.
+ */
+export function serviceKey(s: AiService): string {
+  let key: string | undefined;
+  try {
+    key = s.api_key_enc ? decryptSecret(s.api_key_enc) : process.env[ENV_KEY[s.provider]];
+  } catch (e) {
+    throw new AiError('config', `AI service ${s.name}: ${(e as Error).message}`);
+  }
+  if (!key && s.provider === 'openai_compatible') return 'none';
+  if (!key) throw new AiError('config', `AI service ${s.name} has no API key (enter one in the builder, or set ${ENV_KEY[s.provider]} on the server).`);
+  return key;
+}
+
 export async function loadService(name: string): Promise<AiService | undefined> {
   return owner.one<AiService>('select * from meta.ai_service where name = $1', [name.toUpperCase()]);
 }
 
 /** The provider of a service, with its key (decrypted only here, never stored elsewhere). */
 export function providerFor(s: AiService): AiProvider {
-  let apiKey: string | undefined;
-  try {
-    apiKey = s.api_key_enc ? decryptSecret(s.api_key_enc) : process.env[ENV_KEY[s.provider]];
-  } catch (e) {
-    throw new AiError('config', `AI service ${s.name}: ${(e as Error).message}`);
-  }
-  if (!apiKey) throw new AiError('config', `AI service ${s.name} has no API key (enter one in the builder, or set ${ENV_KEY[s.provider]} on the server).`);
   const conf = {
     model: s.model,
-    apiKey,
-    baseUrl: s.base_url,
+    apiKey: serviceKey(s),
+    baseUrl: baseUrlFor(s),
     timeoutMs: s.timeout_s * 1000,
     maxTokens: s.max_tokens,
     effort: s.effort,

package/src/ai/types.ts

@@ -1,10 +1,15 @@
 // The provider interface of pgkiln's AI features (src/ai/): one request in,
 // one answer out, whatever the provider. Providers live in anthropic.ts
 // (Claude, with the official @anthropic-ai/sdk) and openai.ts (the official
-// openai SDK); service.ts picks one for an AI service and adds the checks,
+// openai SDK: OpenAI itself, Google Gemini through its OpenAI-compatible
+// endpoint, and any OpenAI-compatible endpoint such as Ollama, vLLM or Azure
+// OpenAI); service.ts picks one for an AI service and adds the checks,
 // limits and the usage log.
 
-export type ProviderName = 'anthropic' | 'openai';
+export type ProviderName = 'anthropic' | 'openai' | 'gemini' | 'openai_compatible';
+
+/** Providers that speak OpenAI's Chat Completions (the openai SDK). */
+export const isOpenAiFamily = (p: ProviderName) => p !== 'anthropic';
 
 export interface ProviderConfig {
   /** the model, exactly as the developer entered it (never changed or downgraded) */

package/src/app.ts

@@ -16,6 +16,7 @@ import { webSourceRoutes } from './builder/websources.ts';
 import { sqlRoutes } from './builder/sql.ts';
 import { automationRoutes } from './builder/automations.ts';
 import { workflowBuilderRoutes } from './builder/workflows.ts';
+import { workflowMigrateRoutes } from './builder/workflow-migrate.ts';
 import { regionSettingsRoutes } from './builder/region-settings.ts';
 import { templateRoutes } from './builder/templates.ts';
 import { searchRoutes } from './builder/search.ts';
@@ -24,6 +25,7 @@ import { topSqlRoutes } from './builder/top-sql.ts';
 import { diagnosticsRoutes } from './builder/diagnostics.ts';
 import { ldapRoutes } from './builder/ldap.ts';
 import { aiRoutes } from './builder/ai.ts';
+import { aiAgentRoutes } from './builder/ai-agents.ts';
 import { mailRoutes } from './builder/mail.ts';
 import { backupRoutes } from './builder/backups.ts';
 import { availabilityRoutes } from './builder/availability.ts';
@@ -52,7 +54,10 @@ import { blueprintRoutes } from './builder/blueprints.ts';
 import { accountRoutes } from './runtime/account.ts';
 import { taskRoutes } from './runtime/tasks.ts';
 import { dataReporterRoutes } from './runtime/data-reporter.ts';
+import { datasetRoutes } from './builder/datasets.ts';
 import { reporterBuilderRoutes } from './builder/reporter.ts';
+import { workspaceHomeRoutes } from './builder/workspace-home.ts';
+import { teamRoutes } from './builder/team.ts';
 import { formDesignerRoutes } from './runtime/form-designer.ts';
 import { formDesignerBuilderRoutes } from './builder/form-designer.ts';
 import { builderErrorPages, builderServerError } from './builder/errors.ts';
@@ -213,6 +218,7 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(layoutRoutes);
   await app.register(automationRoutes);
   await app.register(workflowBuilderRoutes);
+  await app.register(workflowMigrateRoutes);
   await app.register(reportSettingsRoutes);
   await app.register(regionSettingsRoutes);
   await app.register(templateRoutes);
@@ -223,6 +229,7 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(diagnosticsRoutes);
   await app.register(ldapRoutes);
   await app.register(aiRoutes);
+  await app.register(aiAgentRoutes);
   await app.register(mailRoutes);
   await app.register(backupRoutes);
   await app.register(availabilityRoutes);
@@ -239,6 +246,7 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(codeEditorRoutes);
   await app.register(dataReporterRoutes);
   await app.register(reporterBuilderRoutes);
+  await app.register(datasetRoutes);
   await app.register(formDesignerRoutes);
   await app.register(formDesignerBuilderRoutes);
   await app.register(sampleDataRoutes);
@@ -247,6 +255,8 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(assistantBuilderRoutes);
   await app.register(aiBuilderRoutes);
   await app.register(blueprintRoutes);
-  app.get('/', async (_req, reply) => reply.redirect('/builder'));
+  await app.register(workspaceHomeRoutes);
+  await app.register(teamRoutes);
+  app.get('/', async (_req, reply) => reply.redirect('/builder/home'));
   return app;
 }

package/src/builder/advisor.ts

@@ -6,7 +6,7 @@ import { devDbForApp } from '../workspace-db.ts';
 import { html, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { templateProblem } from '../runtime/document.ts';
-import { invokeStepReferences, stepProblems, stepWarnings } from '../workflow.ts';
+import { invokeStepReferences, isQuery, outcomeMap, stepProblems, stepWarnings } from '../workflow.ts';
 import { handlerProblems } from '../runtime/rest.ts';
 import { plpgsqlBlock } from '../runtime/rest-handlers.ts';
 import { processProblems } from '../runtime/processes.ts';
@@ -272,6 +272,8 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
         if (st?.type === 'sql' && typeof st.code === 'string') checks.push([`${v}step ${st.name}: code`, st.code, 'statements']);
         if (st?.type === 'task' && typeof st.owners === 'string' && st.owners.trim()) checks.push([`${v}step ${st.name}: owners`, st.owners, 'select']);
         if (st?.type === 'switch' && Array.isArray(st.cases)) for (const cs of st.cases) if (typeof cs?.when === 'string') checks.push([`${v}step ${st.name}: when`, cs.when, 'boolean']);
+        // (123) a send_mail step's recipients query
+        if (st?.type === 'send_mail' && typeof st.to === 'string' && isQuery(st.to)) checks.push([`${v}step ${st.name}: to`, st.to, 'select']);
         for (const [field, sql, shape] of checks) {
           checked++;
           const problem = await checkSql(c, sql, shape);
@@ -369,7 +371,8 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
     if (kind === 'rest_module') for (const problem of handlerProblems(row.handlers)) missing(e, 'Handlers (JSON)', problem);
     if (kind === 'workflow_definition') {
       const tasks = new Set(all.filter((x) => x.kind === 'task_definition').map((x) => x.row.name.toUpperCase()));
-      for (const problem of stepProblems(row.steps, tasks)) missing(e, 'Steps (JSON)', problem);
+      const outcomes = outcomeMap(all.filter((x) => x.kind === 'task_definition').map((x) => x.row));
+      for (const problem of stepProblems(row.steps, tasks, { outcomes, drafts: false })) missing(e, 'Steps (JSON)', problem);
       for (const warning of stepWarnings(row.steps)) missing(e, 'Steps (JSON)', warning, 'warning');
       // invoke_api steps: REST data sources, parameters, web credentials, variables (sprint 32)
       const refs = {
@@ -382,7 +385,7 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
       for (const warning of invokeRefs.warnings) missing(e, 'Steps (JSON)', warning, 'warning');
       if (row.dev_version) {
         const field = `Steps of version ${row.dev_version} (development)`;
-        for (const problem of stepProblems(row.dev_steps, tasks)) missing(e, field, problem, 'warning');
+        for (const problem of stepProblems(row.dev_steps, tasks, { outcomes })) missing(e, field, problem, 'warning');
         for (const warning of stepWarnings(row.dev_steps)) missing(e, field, warning, 'warning');
         const devRefs = invokeStepReferences(row.dev_steps, refs);
         for (const problem of [...devRefs.errors, ...devRefs.warnings]) missing(e, field, problem, 'warning');