Users, groups, permissions, model settings and reasoning display

Four features, plus the schema machinery they needed.

**Schema sync.** The first live instance had data in it, and create_all
only creates missing *tables* -- a new column silently never appeared.
db/migrations.py now diffs the declared models against the database and
ALTER TABLE ... ADD COLUMN for what is missing, deriving a backfill
default from the column type (SQLite refuses a NOT NULL column without
one, and a Python-side `default=dict` cannot be expressed in DDL).
Verified against a copy of the live database: eight changes applied, all
rows preserved, second run a no-op. Renames, drops and retypes are still
manual and say so.

**Permissions.** A flat set of named booleans: an instance baseline
widened by each group the user belongs to. A group grants and never
denies -- with denies, "why can this user not do X" cannot be answered
without simulating every group. Admins bypass entirely, because an admin
can grant it back to themselves in two clicks and pretending otherwise
is theatre. Model *access* is separate: public, or granted to groups.
The picker is not the boundary -- switching a chat to a model you cannot
reach is a 403.

**Model settings.** Ordering, pinned-first, an instance default and a
per-user default, display names, descriptions, capability flags, and
uploaded images. Images are stored and served locally rather than by
URL: a remote URL makes every page render a request to a third party.
Uploads are validated by magic number, not the declared content type,
and stored under a random name. Models with no image get a generated
initial whose hue is derived from the model id, so it is stable.

**Reasoning display.** Streams into its own collapsible block above the
answer, labelled "Thought for 14 seconds", collapsed once finished, and
never replayed as context on the next turn. Two sources: the
reasoning_content delta field, and <think> tags inline in content -- the
latter needs a streaming splitter because the tags arrive split across
chunks. Models emitting no reasoning show nothing, via a :has() rule
rather than JavaScript. Verified against qwen35-9b on llama-swap: 694
reasoning events, 52 answer tokens, cleanly separated.

Two bugs found and fixed while testing:

- A bare `Mapped[list]` relationship is treated by SQLAlchemy as a scalar
  and returns None instead of []. It needs the element type.
- FastAPI substitutes the default for an empty form value, so with
  `x: str | None = Form(None)` a submitted `x=` is indistinguishable from
  an absent field. That silently broke clearing a system prompt or a
  temperature. update_chat now reads the raw form and checks key presence.

143 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_reasoning.py

@@ -0,0 +1,140 @@
+"""Splitting a reasoning model's thinking from its answer."""
+
+from __future__ import annotations
+
+import pytest
+
+from lembas.services.llm.openai_client import delta_reasoning
+from lembas.services.reasoning import (
+    CONTENT,
+    REASONING,
+    ReasoningSplitter,
+    format_duration,
+    strip_reasoning,
+)
+
+
+def run(chunks: list[str]) -> tuple[str, str]:
+    """Feed chunks through the splitter and return (answer, reasoning)."""
+    splitter = ReasoningSplitter()
+    answer, thinking = [], []
+    for chunk in chunks:
+        for kind, piece in splitter.feed(chunk):
+            (thinking if kind == REASONING else answer).append(piece)
+    for kind, piece in splitter.flush():
+        (thinking if kind == REASONING else answer).append(piece)
+    return "".join(answer), "".join(thinking)
+
+
+# --- The dedicated field -----------------------------------------------------
+def test_reasoning_content_field():
+    chunk = {"choices": [{"delta": {"reasoning_content": "hmm"}}]}
+    assert delta_reasoning(chunk) == "hmm"
+
+
+def test_plain_reasoning_field_is_also_accepted():
+    assert delta_reasoning({"choices": [{"delta": {"reasoning": "hmm"}}]}) == "hmm"
+
+
+def test_no_reasoning_field():
+    assert delta_reasoning({"choices": [{"delta": {"content": "hi"}}]}) == ""
+
+
+@pytest.mark.parametrize("chunk", [{}, {"choices": []}, {"choices": [{"delta": {}}]}])
+def test_delta_reasoning_tolerates_junk(chunk):
+    assert delta_reasoning(chunk) == ""
+
+
+# --- Inline <think> tags -----------------------------------------------------
+def test_plain_content_passes_straight_through():
+    assert run(["Hello ", "world"]) == ("Hello world", "")
+
+
+def test_think_block_is_extracted():
+    answer, thinking = run(["<think>weighing it up</think>The answer is 6."])
+    assert answer == "The answer is 6."
+    assert thinking == "weighing it up"
+
+
+def test_tag_split_across_chunks():
+    """The tag arrives in pieces, which is the whole reason this is a stream
+    machine and not a regex."""
+    answer, thinking = run(["<th", "ink>rea", "soning</thi", "nk>done"])
+    assert answer == "done"
+    assert thinking == "reasoning"
+
+
+def test_single_character_chunks():
+    source = "<think>abc</think>xyz"
+    assert run(list(source)) == ("xyz", "abc")
+
+
+def test_thinking_variant_is_not_mistaken_for_think():
+    answer, thinking = run(["<thinking>deep</thinking>shallow"])
+    assert answer == "shallow"
+    assert thinking == "deep"
+
+
+def test_content_before_and_after_a_think_block():
+    answer, thinking = run(["before <think>mid</think> after"])
+    assert answer == "before  after"
+    assert thinking == "mid"
+
+
+def test_unterminated_think_block_flushes_as_reasoning():
+    """A truncated stream must not lose the partial thinking."""
+    answer, thinking = run(["<think>never closed"])
+    assert answer == ""
+    assert thinking == "never closed"
+
+
+def test_newlines_survive():
+    answer, thinking = run(["<think>a\nb</think>c\nd"])
+    assert thinking == "a\nb"
+    assert answer == "c\nd"
+
+
+def test_a_lone_angle_bracket_is_not_swallowed():
+    assert run(["5 < 6 and 7 > 3"]) == ("5 < 6 and 7 > 3", "")
+
+
+def test_no_output_is_withheld_at_the_end():
+    """Whatever is buffered for a possible partial tag must be released on
+    flush, or the last few characters of every reply would vanish."""
+    answer, _ = run(["the end<thi"])
+    assert answer == "the end<thi"
+
+
+def test_emits_incrementally_rather_than_only_at_the_end():
+    """Buffering the whole reply would defeat the point of streaming."""
+    splitter = ReasoningSplitter()
+    emitted = list(splitter.feed("a fairly long stretch of ordinary answer text"))
+    assert emitted, "nothing emitted before flush"
+    assert emitted[0][0] == CONTENT
+
+
+# --- Whole strings -----------------------------------------------------------
+def test_strip_reasoning_round_trip():
+    answer, thinking = strip_reasoning("<think>because</think>Therefore 42.")
+    assert (answer, thinking) == ("Therefore 42.", "because")
+
+
+def test_strip_reasoning_leaves_plain_text_alone():
+    assert strip_reasoning("just an answer") == ("just an answer", "")
+
+
+# --- Duration phrasing -------------------------------------------------------
+@pytest.mark.parametrize(
+    ("milliseconds", "expected"),
+    [
+        (0, ""),
+        (-5, ""),
+        (400, "less than a second"),
+        (1000, "1 second"),
+        (8200, "8 seconds"),
+        (60000, "1 minute"),
+        (95000, "1m 35s"),
+    ],
+)
+def test_format_duration(milliseconds, expected):
+    assert format_duration(milliseconds) == expected