Users, groups, permissions, model settings and reasoning display

Four features, plus the schema machinery they needed.

**Schema sync.** The first live instance had data in it, and create_all
only creates missing *tables* -- a new column silently never appeared.
db/migrations.py now diffs the declared models against the database and
ALTER TABLE ... ADD COLUMN for what is missing, deriving a backfill
default from the column type (SQLite refuses a NOT NULL column without
one, and a Python-side `default=dict` cannot be expressed in DDL).
Verified against a copy of the live database: eight changes applied, all
rows preserved, second run a no-op. Renames, drops and retypes are still
manual and say so.

**Permissions.** A flat set of named booleans: an instance baseline
widened by each group the user belongs to. A group grants and never
denies -- with denies, "why can this user not do X" cannot be answered
without simulating every group. Admins bypass entirely, because an admin
can grant it back to themselves in two clicks and pretending otherwise
is theatre. Model *access* is separate: public, or granted to groups.
The picker is not the boundary -- switching a chat to a model you cannot
reach is a 403.

**Model settings.** Ordering, pinned-first, an instance default and a
per-user default, display names, descriptions, capability flags, and
uploaded images. Images are stored and served locally rather than by
URL: a remote URL makes every page render a request to a third party.
Uploads are validated by magic number, not the declared content type,
and stored under a random name. Models with no image get a generated
initial whose hue is derived from the model id, so it is stable.

**Reasoning display.** Streams into its own collapsible block above the
answer, labelled "Thought for 14 seconds", collapsed once finished, and
never replayed as context on the next turn. Two sources: the
reasoning_content delta field, and <think> tags inline in content -- the
latter needs a streaming splitter because the tags arrive split across
chunks. Models emitting no reasoning show nothing, via a :has() rule
rather than JavaScript. Verified against qwen35-9b on llama-swap: 694
reasoning events, 52 answer tokens, cleanly separated.

Two bugs found and fixed while testing:

- A bare `Mapped[list]` relationship is treated by SQLAlchemy as a scalar
  and returns None instead of []. It needs the element type.
- FastAPI substitutes the default for an empty form value, so with
  `x: str | None = Form(None)` a submitted `x=` is indistinguishable from
  an absent field. That silently broke clearing a system prompt or a
  temperature. update_chat now reads the raw form and checks key presence.

143 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/services/chat.py

@@ -110,28 +110,43 @@ def build_request(db: DBSession, chat: Chat, *, upto: Message | None = None) ->
     }
 
 
-def default_model(db: DBSession) -> tuple[str, str] | None:
-    """First enabled model on the first enabled connection, or None."""
-    model = db.scalar(
-        select(Model)
-        .join(Connection)
-        .where(Model.enabled.is_(True), Connection.enabled.is_(True))
-        .order_by(Connection.position, Model.model_id)
-    )
-    if model is None:
+def default_model(db: DBSession, user=None) -> tuple[str, str] | None:
+    """The model a new chat should start with, as (model_id, connection_id).
+
+    Preference order: the user's own choice, then the instance default, then
+    whatever is first in the admin's ordering. Each is checked against what the
+    user may actually reach, so a default they have lost access to falls
+    through rather than producing a chat they cannot use.
+    """
+    from lembas.security import permissions
+    from lembas.services import settings_store
+
+    reachable = permissions.models_visible_to(db, user)
+    if not reachable:
         return None
-    return model.model_id, model.connection_id
+
+    by_id = {model.model_id: model for model in reachable}
+
+    preferred = (user.settings_json or {}).get("default_model") if user is not None else None
+    if preferred and preferred in by_id:
+        return preferred, by_id[preferred].connection_id
+
+    instance_default = settings_store.get(db, "default_model")
+    if instance_default and instance_default in by_id:
+        return instance_default, by_id[instance_default].connection_id
+
+    # Pinned models sort first, matching what the picker shows at the top.
+    ordered = sorted(reachable, key=lambda m: (not m.pinned, m.position, m.model_id))
+    chosen = ordered[0]
+    return chosen.model_id, chosen.connection_id
 
 
-def available_models(db: DBSession) -> list[Model]:
-    return list(
-        db.scalars(
-            select(Model)
-            .join(Connection)
-            .where(Model.enabled.is_(True), Connection.enabled.is_(True))
-            .order_by(Connection.position, Model.model_id)
-        )
-    )
+def available_models(db: DBSession, user=None) -> list[Model]:
+    """Models this user may start a chat with, pinned first."""
+    from lembas.security import permissions
+
+    reachable = permissions.models_visible_to(db, user)
+    return sorted(reachable, key=lambda m: (not m.pinned, m.position, m.model_id))
 
 
 def fallback_title(text: str) -> str:

src/lembas/services/llm/openai_client.py

@@ -223,6 +223,28 @@ async def complete(endpoint: Endpoint, payload: dict[str, Any]) -> str:
         raise LLMError("The endpoint returned no completion.") from exc
 
 
+def delta_reasoning(chunk: dict[str, Any]) -> str:
+    """Pull a reasoning delta out of one streamed chunk.
+
+    Providers disagree on the field name -- llama.cpp, llama-swap and vLLM use
+    ``reasoning_content``, some others just ``reasoning`` -- so both are read.
+    Models that emit ``<think>`` tags inline in ``content`` instead are handled
+    by lembas.services.reasoning.
+    """
+    try:
+        choices = chunk.get("choices") or []
+        if not choices:
+            return ""
+        delta = choices[0].get("delta") or {}
+        for field in ("reasoning_content", "reasoning"):
+            value = delta.get(field)
+            if isinstance(value, str) and value:
+                return value
+        return ""
+    except (AttributeError, TypeError):
+        return ""
+
+
 def delta_text(chunk: dict[str, Any]) -> str:
     """Pull the text out of one streamed chunk, tolerating provider variation."""
     try:

src/lembas/services/reasoning.py

@@ -0,0 +1,133 @@
+"""Separating a reasoning model's thinking from its answer.
+
+Endpoints do this two different ways and LLeMbas has to cope with both:
+
+1. A dedicated ``reasoning_content`` field in the streamed delta. This is what
+   llama.cpp, llama-swap, vLLM and DeepSeek emit, and it is unambiguous.
+2. ``<think>...</think>`` tags inline in ``content``. Ollama and various
+   proxies do this, and it is a nuisance: the tags arrive split across chunks,
+   so the text has to be scanned as a stream rather than with a regex at the
+   end.
+
+The splitter below handles the second case. It buffers only as much as a
+partial tag could occupy, so latency is unaffected in the overwhelmingly common
+case where no tag is present at all.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+
+# Tag spellings seen in the wild. Checked longest-first so <thinking> is not
+# mistaken for <think> followed by "ing>".
+_TAGS: tuple[tuple[str, str], ...] = (
+    ("<thinking>", "</thinking>"),
+    ("<think>", "</think>"),
+    ("<reasoning>", "</reasoning>"),
+)
+
+REASONING = "reasoning"
+CONTENT = "content"
+
+# Longest opening tag, minus one: the most that can ever need holding back
+# while waiting to see whether a partial "<thi" turns into a real tag.
+_MAX_PARTIAL = max(len(open_tag) for open_tag, _ in _TAGS) - 1
+
+
+class ReasoningSplitter:
+    """Splits a stream of content chunks into reasoning and answer runs.
+
+    Feed it whatever arrives; it yields ``(kind, text)`` pairs. Call
+    :meth:`flush` at the end to release anything still buffered.
+    """
+
+    def __init__(self) -> None:
+        self._buffer = ""
+        self._in_reasoning = False
+        self._closing = ""
+
+    def feed(self, chunk: str) -> Iterator[tuple[str, str]]:
+        self._buffer += chunk
+        yield from self._drain(final=False)
+
+    def flush(self) -> Iterator[tuple[str, str]]:
+        yield from self._drain(final=True)
+
+    def _drain(self, *, final: bool) -> Iterator[tuple[str, str]]:
+        while self._buffer:
+            if self._in_reasoning:
+                index = self._buffer.find(self._closing)
+                if index == -1:
+                    # Hold back enough that a closing tag split across chunks is
+                    # still recognised once the rest arrives.
+                    keep = 0 if final else len(self._closing) - 1
+                    emit, self._buffer = self._split(keep)
+                    if emit:
+                        yield (REASONING, emit)
+                    return
+                if index:
+                    yield (REASONING, self._buffer[:index])
+                self._buffer = self._buffer[index + len(self._closing) :]
+                self._in_reasoning = False
+                self._closing = ""
+                continue
+
+            opening_at, opening, closing = self._find_opening()
+            if opening_at == -1:
+                keep = 0 if final else _MAX_PARTIAL
+                emit, self._buffer = self._split(keep)
+                if emit:
+                    yield (CONTENT, emit)
+                return
+
+            if opening_at:
+                yield (CONTENT, self._buffer[:opening_at])
+            self._buffer = self._buffer[opening_at + len(opening) :]
+            self._in_reasoning = True
+            self._closing = closing
+
+    def _find_opening(self) -> tuple[int, str, str]:
+        best = (-1, "", "")
+        for opening, closing in _TAGS:
+            index = self._buffer.find(opening)
+            if index != -1 and (best[0] == -1 or index < best[0]):
+                best = (index, opening, closing)
+        return best
+
+    def _split(self, keep: int) -> tuple[str, str]:
+        """Emit everything except the last `keep` characters."""
+        if keep <= 0:
+            return self._buffer, ""
+        if len(self._buffer) <= keep:
+            return "", self._buffer
+        return self._buffer[:-keep], self._buffer[-keep:]
+
+
+def strip_reasoning(text: str) -> tuple[str, str]:
+    """Split a complete string into (answer, reasoning).
+
+    The non-streaming counterpart, used when replaying stored content.
+    """
+    splitter = ReasoningSplitter()
+    answer: list[str] = []
+    thinking: list[str] = []
+    for kind, piece in splitter.feed(text):
+        (thinking if kind == REASONING else answer).append(piece)
+    for kind, piece in splitter.flush():
+        (thinking if kind == REASONING else answer).append(piece)
+    return "".join(answer), "".join(thinking)
+
+
+def format_duration(milliseconds: int) -> str:
+    """Human phrasing for the 'Thought for ...' label."""
+    if milliseconds <= 0:
+        return ""
+    seconds = milliseconds / 1000
+    if seconds < 1:
+        return "less than a second"
+    if seconds < 60:
+        return f"{seconds:.0f} second{'' if round(seconds) == 1 else 's'}"
+    minutes, remainder = divmod(int(seconds), 60)
+    if remainder == 0:
+        return f"{minutes} minute{'' if minutes == 1 else 's'}"
+    return f"{minutes}m {remainder}s"

src/lembas/services/uploads.py

@@ -0,0 +1,106 @@
+"""Storing uploaded images.
+
+Only model avatars use this today. Files are written under the data directory
+and served back by a dedicated route, never from a URL supplied by a user --
+a remote image URL would turn every page render into a request to a third
+party, which is both a privacy leak and a way to make the UI depend on someone
+else's uptime.
+"""
+
+from __future__ import annotations
+
+import logging
+import secrets
+from pathlib import Path
+
+from lembas.config import settings
+
+log = logging.getLogger(__name__)
+
+# Raster and vector formats a browser will render inline. Deliberately narrow:
+# every entry here is something that cannot execute in an <img> tag.
+ALLOWED_TYPES: dict[str, str] = {
+    "image/png": ".png",
+    "image/jpeg": ".jpg",
+    "image/webp": ".webp",
+    "image/gif": ".gif",
+}
+
+MAX_BYTES = 2 * 1024 * 1024  # 2 MB; these are 64px avatars
+
+# Magic numbers, checked against the declared content type. A browser sniffs
+# content, so trusting the client's Content-Type alone would let a file claim
+# to be a PNG and be served as something else.
+_SIGNATURES: tuple[tuple[bytes, str], ...] = (
+    (b"\x89PNG\r\n\x1a\n", "image/png"),
+    (b"\xff\xd8\xff", "image/jpeg"),
+    (b"GIF87a", "image/gif"),
+    (b"GIF89a", "image/gif"),
+)
+
+
+class UploadError(Exception):
+    """A rejected upload, with a message fit to show the user."""
+
+
+def _detect(payload: bytes) -> str | None:
+    for signature, media_type in _SIGNATURES:
+        if payload.startswith(signature):
+            return media_type
+    # WEBP is "RIFF" + 4 size bytes + "WEBP".
+    if payload[:4] == b"RIFF" and payload[8:12] == b"WEBP":
+        return "image/webp"
+    return None
+
+
+def models_dir() -> Path:
+    path = settings.uploads_dir / "models"
+    path.mkdir(parents=True, exist_ok=True)
+    return path
+
+
+def save_model_image(payload: bytes, declared_type: str) -> str:
+    """Validate and store a model avatar. Returns the stored filename."""
+    if not payload:
+        raise UploadError("The file was empty.")
+    if len(payload) > MAX_BYTES:
+        raise UploadError(f"Images must be under {MAX_BYTES // (1024 * 1024)} MB.")
+
+    actual = _detect(payload)
+    if actual is None:
+        raise UploadError("That does not look like a PNG, JPEG, WEBP or GIF image.")
+    if declared_type and declared_type.split(";")[0].strip() != actual:
+        # Not fatal on its own, but worth knowing about.
+        log.info("upload declared %s but is actually %s", declared_type, actual)
+
+    # Random name rather than the client's: no path traversal, no collisions,
+    # and no leaking whatever the uploader called the file.
+    filename = f"{secrets.token_hex(16)}{ALLOWED_TYPES[actual]}"
+    (models_dir() / filename).write_bytes(payload)
+    return filename
+
+
+def model_image_path(filename: str) -> Path | None:
+    """Resolve a stored filename to a path, refusing anything outside the dir."""
+    if not filename or "/" in filename or "\\" in filename or filename.startswith("."):
+        return None
+    path = (models_dir() / filename).resolve()
+    try:
+        path.relative_to(models_dir().resolve())
+    except ValueError:
+        return None
+    return path if path.is_file() else None
+
+
+def delete_model_image(filename: str) -> None:
+    path = model_image_path(filename)
+    if path is not None:
+        path.unlink(missing_ok=True)
+
+
+def media_type_for(filename: str) -> str:
+    suffix = Path(filename).suffix.lower()
+    for media_type, extension in ALLOWED_TYPES.items():
+        if extension == suffix:
+            return media_type
+    return "application/octet-stream"