Native Flowcy agent

The github-pm service owns model invocation at POST /api/v1/agent/chat. Set FLOWCY_CHAT_MODEL to an AI Gateway model ID. It is required; there is no fallback to MODEL_NAME. The iOS app never selects a model or receives model credentials. Existing account metering and rate limits apply to each model request.

POST /api/v1/agent/tools exposes the existing MCP registry over Streamable HTTP using the native RxAuth account bearer (or web session). Personal API tokens are rejected. Tool handlers enforce account ownership. Public /api/mcp OAuth grants are unchanged. The phone discovers tools with its existing account, confirms writes in a native sheet, executes approved calls on the service, and returns tool results to the chat endpoint for the next streamed model turn.

The phone also declares show_ui, which it answers itself: the model passes a json-render style spec ({ root, elements } from a closed component catalog) and the transcript draws it as a native view. Phones talking to a deployment without show_ui in the allowlist get HTTP 400 and resend without it.

Chat returns newline-delimited JSON: text, tool-call, finish, or error. Deploy the native account feature routes, agent routes, and model configuration together before releasing the matching mobile app. An older deployment with cookie-only feature routes rejects native bearers; this is not a reason to clear a valid device account session.

Admin model playground

Dashboard → Admin → Agent Models → Test chat opens a separate test dialog. Admins select an enabled configured model and send multi-turn text messages; switching models starts a fresh conversation. Conversations last only while the dialog is open. Tests consume the signed-in account's AI allowance.

POST /api/v1/admin/agent/chat requires the same verified admin role as model management, then delegates to /api/v1/agent/chat. The request uses modelId, messages (user/assistant messages), and tools: []. Responses use the existing NDJSON text, finish, and error events. Model availability, rate limits, subscription admission, and cost settlement remain enforced by the shared handler.