auto s = v;

while (!s.empty() && std::isspace((unsigned char)s.front())) s.remove_prefix(1);

while (!s.empty() && std::isspace((unsigned char)s.back())) s.remove_suffix(1);

if (s.empty()) return false;

// std::from_chars(double) is unavailable on this macOS SDK; use strtod on

// a NUL-terminated copy and require the whole token to be consumed.

std::string str(s);

char* end = nullptr;

errno = 0;

double val = std::strtod(str.c_str(), &end);

if (end != str.c_str() + str.size() || errno == ERANGE) return false;

out = val;

return true;

const ConfigMeta* meta = lang::config_meta(key);

if (!meta) return std::nullopt;

if (auto it = bool_fields().find(key); it != bool_fields().end())

return (cfg.*(it->second)) ? "true" : "false";

if (auto it = int_fields().find(key); it != int_fields().end())

return std::to_string(cfg.*(it->second));

if (auto it = float_fields().find(key); it != float_fields().end())

return fmt_float(cfg.*(it->second));

if (auto it = string_fields().find(key); it != string_fields().end())

return cfg.*(it->second);

if (key == "log_max_size_mb")

return std::to_string(cfg.log_max_size_mb);

return std::nullopt;

const std::string& value) {

const char* type = "string";

switch (m.type) {

case CfgType::Boolean: type = "boolean"; break;

case CfgType::Integer: type = "integer"; break;

case CfgType::Float: type = "float"; break;

case CfgType::Enum: type = "enum"; break;

case CfgType::String: type = "string"; break;

case CfgType::Path: type = "path"; break;

case CfgType::Text: type = "text"; break;

}

const char* edit = "live";

switch (m.edit) {

case CfgEdit::Live: edit = "live"; break;

case CfgEdit::RestartRequired: edit = "restart"; break;

case CfgEdit::RebuildRequired: edit = "rebuild"; break;

case CfgEdit::Locked: edit = "locked"; break;

}

nlohmann::json j = {

{"key", std::string(m.key)},

{"section", std::string(m.section)},

{"label", std::string(m.pretty)},

{"type", type},

{"edit", edit},

{"default", std::string(m.default_value)},

{"help", std::string(m.help)},

{"value", value},

};

if (m.secret) {

// Never echo a credential through the read surfaces; a non-empty

// secret shows as the "<set>" marker (writing "<set>" back is a

// no-op, so a dashboard that round-trips the mask cannot clobber

// the real key). Empty stays "" (C §1.7).

j["secret"] = true;

if (!value.empty()) j["value"] = "<set>";

}

if (m.type == CfgType::Enum) {

nlohmann::json opts = nlohmann::json::array();

std::string_view o = m.options;

size_t pos = 0;

while (pos <= o.size()) {

size_t c = o.find(',', pos);

std::string_view tok = (c == std::string_view::npos)

? o.substr(pos) : o.substr(pos, c - pos);

if (!tok.empty()) opts.push_back(std::string(tok));

if (c == std::string_view::npos) break;

pos = c + 1;

}

j["options"] = opts;

}

return j;

nlohmann::json arr = nlohmann::json::array();

for (const auto& m : lang::config_schema()) {

auto v = get_config_value(cfg, m.key);

arr.push_back(config_entry_json(m, v.value_or("")));

}

return nlohmann::json{{"config", arr}};

std::string_view value) {

const ConfigMeta* meta = lang::config_meta(key);

if (!meta) return std::unexpected(ConfigSetError::UnknownKey);

// Empty = reset to default: always valid.

if (value.empty()) return {};

switch (meta->type) {

case CfgType::Boolean: {

bool b;

if (!parse_bool_strict(value, b))

return std::unexpected(ConfigSetError::InvalidValue);

return {};

}

case CfgType::Integer: {

long n;

if (!parse_int_strict(value, n))

return std::unexpected(ConfigSetError::InvalidValue);

return {};

}

case CfgType::Float: {

double d;

if (!parse_float_strict(value, d))

return std::unexpected(ConfigSetError::InvalidValue);

return {};

}

case CfgType::Enum: {

// value must be one of the comma-separated options.

std::string_view opts = meta->options;

// Empty options list => choices are populated dynamically at

// runtime (e.g. desired_embedding_model, sourced from the models

// dir via GET /models). There is no static set to check against,

// so accept any non-empty value; the dashboard already constrains

// the user to real choices client-side.

if (opts.empty()) return {};

size_t pos = 0;

while (pos <= opts.size()) {

size_t comma = opts.find(',', pos);

std::string_view tok = (comma == std::string_view::npos)

? opts.substr(pos)

: opts.substr(pos, comma - pos);

if (tok == value) return {};

if (comma == std::string_view::npos) break;

pos = comma + 1;

}

return std::unexpected(ConfigSetError::InvalidValue);

}

case CfgType::String:

case CfgType::Path:

case CfgType::Text:

return {};

}

return {};

Config& cfg, std::string_view key, std::string_view value,

bool allow_locked) {

const ConfigMeta* meta = lang::config_meta(key);

if (!meta) return std::unexpected(ConfigSetError::UnknownKey);

if (meta->edit == CfgEdit::Locked && !allow_locked)

return std::unexpected(ConfigSetError::Locked);

if (auto v = validate_config_value(key, value); !v.has_value())

return std::unexpected(v.error());

// Empty means "reset to schema default" — re-run apply with the default.

std::string_view eff = value.empty() ? meta->default_value : value;

if (auto it = bool_fields().find(key); it != bool_fields().end()) {

bool b; parse_bool_strict(eff, b);

cfg.*(it->second) = b;

} else if (auto it = int_fields().find(key); it != int_fields().end()) {

long n{}; parse_int_strict(eff, n);

cfg.*(it->second) = static_cast<int>(n);

} else if (auto it = float_fields().find(key); it != float_fields().end()) {

double d{}; parse_float_strict(eff, d);

cfg.*(it->second) = static_cast<float>(d);

} else if (auto it = string_fields().find(key); it != string_fields().end()) {

cfg.*(it->second) = std::string(eff);

} else if (key == "log_max_size_mb") {

long n{}; parse_int_strict(eff, n);

cfg.log_max_size_mb = n;

} else {

return std::unexpected(ConfigSetError::UnknownKey);

}

ConfigSetResult r;

r.restart_required = (meta->edit == CfgEdit::RestartRequired);

r.rebuild_required = (meta->edit == CfgEdit::RebuildRequired);

return r;

if (auto it = bool_fields().find(key); it != bool_fields().end()) {

// Permissive: unrecognized strings parse as false, same as the

// INI loader's historical parse_bool().

std::string lower = value;

std::transform(lower.begin(), lower.end(), lower.begin(), ::tolower);

cfg.*(it->second) = (lower == "true" || lower == "yes" || lower == "1");

return true;

}

if (auto it = int_fields().find(key); it != int_fields().end()) {

cfg.*(it->second) = std::stoi(value);

return true;

}

if (auto it = float_fields().find(key); it != float_fields().end()) {

cfg.*(it->second) = std::stof(value);

return true;

}

if (auto it = string_fields().find(key); it != string_fields().end()) {

cfg.*(it->second) = value;

return true;

}

if (key == "log_max_size_mb") {

cfg.log_max_size_mb = std::stol(value);

return true;

}

return false;

namespace fs = std::filesystem;

if (db_path.empty() || !fs::exists(db_path)) return;

UserStore store(db_path);

for (const auto& meta : lang::config_schema()) {

auto v = store.get_setting(std::string(meta.key));

if (!v.has_value()) continue; // no row -> keep INI/default

// Best-effort: ignore invalid rows rather than fail startup.

// allow_locked: DB rows are the authoritative persisted state, so

// they must apply even for Locked keys (e.g. `port`). Locked only

// gates USER writes (CLI/dashboard), not the DB->live overlay.

(void)apply_config_value(cfg, meta.key, *v, /*allow_locked=*/true);

}

// NOTE: no provider is prepended to a bare embedding_model.

//

// Ragger-managed ONNX models live at ~/.ragger/models/<provider>/<model>/,

// and the dashboard only offers paths that exist in that layout, so a

// valid internal model name always contains '/'. A bare name is a broken

// value, and assuming "sentence-transformers/" silently resolves it to a

// real but *different* model — wrong for anything under onnx-community/ or

// any other provider, and enough to re-embed the corpus against a model

// nobody chose. Leave it bare: RaggerMemory reports it, the model fails to

// load, and the server degrades to keyword-only search while still

// recording conversations.

// Seed the desired_* embedding identity from current when unset, so the

// dashboard shows the live values as the starting target rather than

// blanks. "current" here is the config's embedding_* (which the drift

// guard keeps in sync with the stored vectors).

if (cfg.desired_embedding_model.empty())

cfg.desired_embedding_model = cfg.embedding_model;

if (cfg.desired_embedding_vector_type.empty())

cfg.desired_embedding_vector_type = cfg.embedding_vector_type;

if (cfg.desired_embedding_dimensions == 0)

cfg.desired_embedding_dimensions = cfg.embedding_dimensions;

if (cfg.desired_embedding_engine.empty())

cfg.desired_embedding_engine = cfg.embedding_engine;

// Seed desired_port from the committed port when unset, so the dashboard

// shows the live port as the starting target. The startup rectify (see

// main serve) then adopts any UI change into `port` on the next restart.

if (cfg.desired_port == 0)

cfg.desired_port = cfg.port;

std::vector<std::string_view> keys;

for (const auto& meta : lang::config_schema())

keys.push_back(meta.key);

return keys;

std::string_view key, std::string_view value, bool allow_locked) {

const ConfigMeta* meta = lang::config_meta(key);

if (!meta) return std::unexpected(ConfigSetError::UnknownKey);

if (meta->edit == CfgEdit::Locked && !allow_locked)

return std::unexpected(ConfigSetError::Locked);

// A secret key written back as the "<set>" mask is a no-op: the read

// surfaces only ever show "<set>", so a client that echoes the field

// unchanged must never overwrite the real credential (C §1.7). Shared

// path — covers both PUT /config/:key and `ragger config set`.

if (meta->secret && value == "<set>")

return ConfigSetResult{};

// Update the live config first (also validates). On failure, nothing is

// persisted.

Config& cfg = mutable_config();

auto applied = apply_config_value(cfg, key, value, allow_locked);

if (!applied.has_value()) return std::unexpected(applied.error());

// Persist to the DB settings table. Empty value stores an empty row,

// which overlay_settings_from_db() re-interprets as "use default" — so

// the round-trip stays consistent. Best-effort: if the DB isn't there

// yet, the live change still stands.

const std::string db_path = cfg.resolved_db_path();

if (std::filesystem::exists(db_path)) {

UserStore store(db_path);

store.set_setting(std::string(key), std::string(value));

}

return applied;