writeJSON serializes body as JSON and writes it to the response with the given status code and a JSON Content-Type header.

NewRouter wires up the chi router with the supplied services. Kept separate from init() so tests can build a router without DSQL.

--- helpers --------------------------------------------------------------- do builds a request (JSON-encoding body when non-nil), serves it through t

Register adds a tool to the registry.

CreateHash returns an Argon2id hash of a plain-text password using the provided algorithm parameters. The returned hash follows the format used by the

Get returns the decoded secret. The first successful call loads from DB and decodes base64; later calls return the cached bytes. If load fails, the ne

BuildSystemPrompt assembles the full system prompt from hardcoded rules and configurable sections. The result is cached per session to preserve LLM pr

DefaultCharLimits returns sensible defaults.

isPrivateOrRestrictedIP returns true for IPs that should never be fetched: IPv4: - 10.0.0.0/8 RFC 1918 private - 172.16.0.0/12 RFC 1918 private - 192

Parse verifies a token against the secret and returns the decoded claims.

forceCompress drops the oldest ~50% of Turns from history. This is the emergency strategy when summarization fails or history is still over budget aft

splitStatements splits SQL content by semicolons at the end of a line. Skips empty statements and comment-only lines.

EncryptAESGCM encrypts plaintext with AES-256-GCM using the given data key. It returns a fresh 12-byte nonce and the ciphertext. The caller stores bot

NewService returns a system Service. Callers that create users or workspaces must pass WithProvisioner so the corresponding passwords data key is cre

RequireAuth returns a middleware that rejects any request without a valid bearer token. On success, the request's context carries the parsed *Claims,

isOverBudget checks whether the current history + system + summary + tools exceed the model's context window. Returns false if contextWindow is 0 (no

makeExecArgs is a test helper that wraps a command string into the JSON format that OpenAI would send as tool_call arguments: {"command": "echo hello"

makeReadFileArgs is a test helper that wraps a file path into the JSON format that OpenAI would send as tool_call arguments: {"path": "/tmp/foo.txt"}

parseTurnBoundaries returns the indices of all user messages in history. Each user message marks the start of a new Turn — a complete cycle of: user →

CheckHash is like ComparePasswordAndHash, except it also returns the params that the hash was created with. This can be useful if you want to update y

DecodeHash expects a hash created from this package, and parses it to return the params used to create it, as well as the salt and key (password hash)

GenerateDataKey returns a fresh 32-byte AES-256 key drawn from crypto/rand. Use this when a workspace/user/system scope first needs to encrypt somethi

do issues a request against the API base URL with the standard 30s timeout. Most methods use this.

estimateMessageTokens estimates the token count of a single message using a character-based heuristic: ~2.5 characters per token, no external tokenize

makeArgs is a test helper that wraps an expression string into the JSON format that OpenAI would send as tool_call arguments: {"expression": "1+2"} Th

makeEditFileArgs is a test helper that builds the JSON arguments for edit_file.

summarizeOldTurns summarizes the oldest Turns in history using the LLM, keeping the most recent Turns as-is. The summary replaces the original message

ComparePasswordAndHash performs a constant-time comparison between a plain-text password and Argon2id hash, using the parameters and salt contained in

DecryptAESGCM reverses EncryptAESGCM. It returns the plaintext, or a non-nil error if the ciphertext or nonce was modified after encryption (AES-GCM c

Login authenticates with email and password. On success the token is stored in the Client and attached to all subsequent requests; callers who need to

NewWsRegistry adapts an existing *system.Service to the Registry interface. The service keeps owning the underlying SQL queries; this type only expose

PushToSession dispatches a WSEvent to all live connections of every member of the session. Streaming callbacks (OnTextDelta / OnToolCall OnToolResult

calcRightSidebarWidth returns how wide the right sidebar should be. Extra space goes to logs first (up to max), then to chat. Returns 0 if there's not

decodeErr pulls the "error" field out of a writeAuthError JSON body.

findSafeBoundary finds the nearest Turn boundary at or before targetIndex. Normal case: returns the last boundary <= targetIndex. For example, if bou

newTestServer spins up a real api.NewRouter against fake services, wraps it in an httptest.Server, and returns a Client pointed at it. The server is t

setupEditFile is a test helper that creates a temp file with the given content and returns its path. The file is automatically cleaned up when the tes

ChatSync consumes a ChatStream channel and assembles the events into a complete Message. Use this when streaming output is not needed (e.g., wen summa

Decrypt reverses Encrypt for a blob produced by the same master key. Returns an error if the blob was tampered with or was produced by a different key

Encrypt encrypts plaintext with the master key. Returns an opaque blob that must be passed back to Decrypt unchanged.

Get returns the tool with the given name if it exists.

NewRegistry creates a new tool registry.

ServeHTTP handles POST /sessions/{sessionID}/reply.

ddgTimeRange maps our normalized time range codes to DuckDuckGo's df parameter. DuckDuckGo uses "t" for year instead of "y".

isObviousPrivateHost is a lightweight pre-flight check that catches obviously private hostnames without performing DNS resolution. The real SSRF guard

makeWriteFileArgs is a test helper that builds the JSON arguments for write_file. overwrite is optional — pass true to set it.

parseDDGResults extracts search results from DuckDuckGo's HTML response. Link and snippet matches are aligned by position (the Nth link corresponds to

setupService creates a Service for testing using the shared testPool. Cleans up data before each test to ensure isolation.

signTestToken builds a signed token with the given claims, failing the test on any signing error.

statusForError maps known sentinel errors to HTTP status codes; otherwise falls back to fallback (typically 404 or 500 depending on the call site).

updateViewport rebuilds the chat content and scrolls to the bottom.

===================================================================== System scope ===================================================================

Me returns the currently authenticated user, identified by the bearer token. CLIs use this to discover the user's ID without keeping it in local state

NewBus returns a Bus with an empty socket map.

OpenKeyManager returns a crypto.KeyManager backed by gocloud.dev/secrets, picked by URL scheme. Supported URLs: awskms://<keyID>?region=<region> AWS

SessionFromDB constructs a chat.Session from a db.AppChatSession.

clampDelay constrains a duration to [0, maxRetryWait].

estimateTokens estimates the total token count of a message slice.

estimateToolTokens estimates how many tokens the tool definitions occupy in the request. Each tool's name, description, and JSON-serialized parameters

extractText converts HTML to plain text by removing script/style/noscript blocks, stripping all tags, and normalizing whitespace. TODO: upgrade to pro

formatJSON pretty-prints JSON. If the input is not valid JSON, returns it as-is.