PWA, one send/stop button, audio in and out, web search as a tool

Four pieces of work.

**Installable.** A manifest carrying the instance name, PWA icons rasterised
from the existing mark at design time, a service worker and a themed offline
page. The worker caches the shell only and bails out on /api/, /auth/, /admin/
and anything accepting text/event-stream -- passing a reply stream through a
worker turns it into one delivery at the end, or nothing. It is served from
GET /sw.js rather than the static mount because a worker's scope is the path it
came from.

**Send and Stop are one button.** They were two, and the hidden one was never
hidden: `.btn` is display: inline-flex, which outranks the browser's own
`[hidden] { display: none }`, so Stop sat permanently beside Send. app.css now
forces the attribute to win -- every control toggled with `hidden` depended on
that -- and the composer renders one button carrying both icons, with ui.js
flipping data-composer-action and the type with it.

**Audio.** Speech to text and text to speech against any OpenAI-shaped
/v1/audio/* endpoint: dictate into the composer, have a reply read out.
Instance settings in Admin, per-reader overrides in Settings, with the voice
list discovered from the server where it offers one. Recorded audio is capped
and never written to disk -- it is not an attachment, it has no owner, and
nothing would ever sweep it.

**Web search, as a tool.** This is the tool loop PLAN.md described as the real
work: one reply is now a bounded sequence of requests rather than one. The model
asks, the tool runs, the result goes back and it is asked again, up to three
rounds. Providers are DuckDuckGo (no setup), SearXNG and Firecrawl.

Two decisions worth stating. Tools are only offered to models flagged `tools`,
because an endpoint without support rejects the whole request rather than
ignoring the array -- the same reason images only reach models flagged
`vision`. And tool results are not replayed as context on the next turn, for the
same reasons reasoning is not: the answer already contains what the model made
of them, and replaying stale results into every later request wastes the window
and reliably sends a small model into a search loop. The sources stay visible in
the transcript instead.

Search results are untrusted third-party text and are treated as such: escaped,
and only http/https URLs rendered as links.

338 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_tools.py

@@ -0,0 +1,227 @@
+"""Tool calling: reassembling calls, deciding what is offered, running it."""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from lembas.db.models import Chat, Connection, Model
+from lembas.services import settings_store
+from lembas.services import tools as tools_service
+from lembas.services.llm.openai_client import delta_tool_calls, finish_reason
+from lembas.services.search.base import SearchError, SearchResult
+
+
+# --- Reading the stream ------------------------------------------------------
+def test_delta_tool_calls_reads_the_normal_shape():
+    chunk = {"choices": [{"delta": {"tool_calls": [{"index": 0, "id": "a"}]}}]}
+    assert delta_tool_calls(chunk) == [{"index": 0, "id": "a"}]
+
+
+@pytest.mark.parametrize(
+    "chunk", [{}, {"choices": []}, {"choices": [{}]}, {"choices": [{"delta": {}}]}]
+)
+def test_delta_tool_calls_tolerates_junk(chunk):
+    assert delta_tool_calls(chunk) == []
+
+
+def test_finish_reason_is_read_when_present():
+    assert finish_reason({"choices": [{"finish_reason": "tool_calls"}]}) == "tool_calls"
+    assert finish_reason({"choices": [{}]}) == ""
+
+
+# --- The accumulator ---------------------------------------------------------
+def test_arguments_split_across_chunks_are_rejoined():
+    """Arguments arrive one token at a time; the id and name arrive once, on
+    the first fragment only. This is the real shape llama.cpp produces."""
+    accumulator = tools_service.ToolCallAccumulator()
+    accumulator.feed(
+        [{"index": 0, "id": "c1", "function": {"name": "web_search", "arguments": "{"}}]
+    )
+    for piece in ['"query"', ":", '"mallorn', ' tree"', "}"]:
+        accumulator.feed([{"index": 0, "function": {"arguments": piece}}])
+
+    assert accumulator.calls == [
+        {"id": "c1", "name": "web_search", "arguments": '{"query":"mallorn tree"}'}
+    ]
+
+
+def test_two_calls_are_kept_apart_by_index():
+    """Not by name: a model calling the same tool twice in one turn is exactly
+    the case that breaks if name is the key."""
+    accumulator = tools_service.ToolCallAccumulator()
+    accumulator.feed(
+        [
+            {"index": 0, "id": "a", "function": {"name": "web_search", "arguments": '{"q":1}'}},
+            {"index": 1, "id": "b", "function": {"name": "web_search", "arguments": '{"q":2}'}},
+        ]
+    )
+    assert [c["id"] for c in accumulator.calls] == ["a", "b"]
+    assert accumulator.calls[1]["arguments"] == '{"q":2}'
+
+
+def test_a_missing_index_is_treated_as_the_only_call():
+    """Some servers omit index entirely when there is just one call."""
+    accumulator = tools_service.ToolCallAccumulator()
+    accumulator.feed([{"function": {"name": "web_search", "arguments": "{}"}}])
+    assert len(accumulator.calls) == 1
+
+
+def test_a_call_with_no_name_is_not_a_call():
+    accumulator = tools_service.ToolCallAccumulator()
+    accumulator.feed([{"index": 0, "function": {"arguments": "{}"}}])
+    assert accumulator.calls == []
+    assert not accumulator
+
+
+def test_an_id_is_invented_when_the_server_supplies_none():
+    """The id is required when the results are sent back, and not every server
+    provides one."""
+    accumulator = tools_service.ToolCallAccumulator()
+    accumulator.feed([{"index": 0, "function": {"name": "web_search", "arguments": "{}"}}])
+    assert accumulator.calls[0]["id"]
+
+
+# --- What gets offered -------------------------------------------------------
+def _chat_with(db, user_id, *, capabilities):
+    connection = Connection(name="c", base_url="http://127.0.0.1:1", api_key_encrypted="")
+    db.add(connection)
+    db.commit()
+    db.add(
+        Model(connection_id=connection.id, model_id="m", capabilities_json=capabilities)
+    )
+    db.commit()
+    chat = Chat(user_id=user_id, model_id="m", connection_id=connection.id)
+    db.add(chat)
+    db.commit()
+    return chat
+
+
+def _user(db, user_id):
+    from lembas.db.models import User
+
+    return db.get(User, user_id)
+
+
+def test_nothing_is_offered_when_search_is_off(db, user_id):
+    chat = _chat_with(db, user_id, capabilities={"tools": True})
+    assert tools_service.enabled_tools(db, chat, _user(db, user_id)) == []
+
+
+def test_nothing_is_offered_to_a_model_without_the_tools_capability(db, user_id):
+    """Sending a tools array to an endpoint that does not implement tool calling
+    fails the entire request, exactly as image parts do without vision."""
+    settings_store.update(db, {"enabled": True}, key=settings_store.SEARCH)
+    chat = _chat_with(db, user_id, capabilities={})
+    assert tools_service.enabled_tools(db, chat, _user(db, user_id)) == []
+
+
+def test_web_search_is_offered_when_everything_lines_up(db, user_id):
+    settings_store.update(db, {"enabled": True}, key=settings_store.SEARCH)
+    chat = _chat_with(db, user_id, capabilities={"tools": True})
+
+    offered = tools_service.enabled_tools(db, chat, _user(db, user_id))
+    assert len(offered) == 1
+    assert offered[0]["function"]["name"] == "web_search"
+
+
+def test_nothing_is_offered_when_the_provider_cannot_run(db, user_id, monkeypatch):
+    """Offering a tool that will fail on every call is worse than not offering
+    it at all."""
+    monkeypatch.setattr(
+        "lembas.services.search.availability", lambda _key: "ddgs is not installed."
+    )
+    settings_store.update(db, {"enabled": True}, key=settings_store.SEARCH)
+    chat = _chat_with(db, user_id, capabilities={"tools": True})
+    assert tools_service.enabled_tools(db, chat, _user(db, user_id)) == []
+
+
+# --- Running one -------------------------------------------------------------
+async def test_running_web_search_formats_results_for_the_model(monkeypatch):
+    async def fake_run(_config, query, *, limit=None):
+        return [SearchResult("A title", "https://a.test", "a snippet")]
+
+    monkeypatch.setattr("lembas.services.search.run", fake_run)
+
+    outcome = await tools_service.run_tool({}, "web_search", '{"query": "mallorn"}')
+    assert "A title" in outcome.content
+    assert "https://a.test" in outcome.content
+    assert outcome.event["status"] == "ok"
+    assert outcome.event["results"][0]["host"] == "a.test"
+
+
+async def test_malformed_argument_json_is_treated_as_the_query(monkeypatch):
+    """Small models emit broken argument JSON often enough that this is a normal
+    path, not an exceptional one."""
+    seen = {}
+
+    async def fake_run(_config, query, *, limit=None):
+        seen["query"] = query
+        return []
+
+    monkeypatch.setattr("lembas.services.search.run", fake_run)
+    await tools_service.run_tool({}, "web_search", "mallorn tree")
+    assert seen["query"] == "mallorn tree"
+
+
+async def test_a_failed_search_hands_the_model_an_explanation(monkeypatch):
+    """A failed search should produce "I could not look that up", not kill the
+    whole reply."""
+
+    async def fake_run(_config, _query, *, limit=None):
+        raise SearchError("DuckDuckGo is rate limiting this instance.")
+
+    monkeypatch.setattr("lembas.services.search.run", fake_run)
+
+    outcome = await tools_service.run_tool({}, "web_search", '{"query": "x"}')
+    assert "rate limiting" in outcome.content
+    assert outcome.event["status"] == "error"
+
+
+async def test_an_unknown_tool_is_reported_rather_than_raised():
+    outcome = await tools_service.run_tool({}, "launch_missiles", "{}")
+    assert "no tool called" in outcome.content
+    assert outcome.event["status"] == "error"
+
+
+async def test_a_call_with_no_query_is_reported():
+    outcome = await tools_service.run_tool({}, "web_search", '{"query": "  "}')
+    assert outcome.event["status"] == "error"
+
+
+# --- The turns sent back -----------------------------------------------------
+def test_the_assistant_turn_echoes_the_calls():
+    """The endpoint needs its own tool_calls back before the tool replies, or it
+    has nothing to match the tool_call_ids against."""
+    turn = tools_service.assistant_turn(
+        [{"id": "c1", "name": "web_search", "arguments": '{"query":"x"}'}], "Looking it up."
+    )
+    assert turn["role"] == "assistant"
+    assert turn["content"] == "Looking it up."
+    assert turn["tool_calls"][0]["id"] == "c1"
+    assert turn["tool_calls"][0]["function"]["name"] == "web_search"
+
+
+def test_an_empty_assistant_message_becomes_null():
+    """Most endpoints reject an assistant turn whose content is an empty string
+    alongside tool_calls."""
+    turn = tools_service.assistant_turn([{"id": "c", "name": "n", "arguments": "{}"}], "")
+    assert turn["content"] is None
+
+
+def test_the_tool_turn_carries_the_call_id():
+    turn = tools_service.tool_turn({"id": "c1", "name": "web_search"}, "results here")
+    assert turn == {
+        "role": "tool",
+        "tool_call_id": "c1",
+        "name": "web_search",
+        "content": "results here",
+    }
+
+
+def test_the_schema_is_valid_json():
+    """It is sent verbatim to the endpoint; a schema that will not serialise
+    fails every request rather than one."""
+    json.dumps(tools_service.WEB_SEARCH_SCHEMA)
+    assert tools_service.WEB_SEARCH_SCHEMA["function"]["parameters"]["required"] == ["query"]