mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
6eda7d706e
With svc-ai-agent-broker in the inventory, Open WebUI adds the broker as a second OpenAI connection (OPENAI_API_BASE_URLS/KEYS). It forwards the user's id and email headers and waits up to the broker's request_timeout, so a cold agent start can finish. BYPASS_MODEL_ACCESS_CONTROL turns false while the broker is enabled. agent_model_grants.py then runs inside the container and: - grants every LiteLLM model read access for all users; - grants hermes and openclaw read access for their /roles/web-app-<platform>/agent-user group only; - reads grants back from the database, because the API view is filtered by the admin access control. The grant rows also give every gateway model the database entry whose absence made check_model_access answer "Model not found". Open WebUI shows a model without a grant to administrators only. So a svc-ai-litellm deploy now reruns the grant step in a running Open WebUI, and a model added to the gateway is visible without an Open WebUI deploy. The include sets application_id explicitly, because the app loader's include var would otherwise resolve Open WebUI's lookups against LiteLLM. Without the broker the rendered connection, key and bypass are unchanged; only the variable name moves to the plural form Open WebUI falls back from. The Playwright spec: - revokes biber in Keycloak; - removes the stale Open WebUI membership, which the OIDC sync keeps when the groups claim turns empty; - asserts every served gateway model is listed for biber and no agent model is; - grants the groups and expects both agents to answer through the broker. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>