fix: 修复独立环境登录 404 与「添加第一个模型」500（4.11 回归） (#2755)

* fix(space): keep dedicated-environment Space login working

A dedicated environment runs the OSS runtime with system.edition=cloud. The
process-level 'LangBot Models' compatibility provider is part of the OSS
single-Workspace contract, but write_space_model_providers() skipped creating it
for every non-community edition. The Space OAuth callback then unconditionally
rewarded the provider row by api key, so provider_service raised
WorkspaceNotFoundError('Provider not found') and the whole callback returned 404
-- after the Account and its Workspace had already been created. Every retry
failed the same way, making dedicated-environment login impossible on 4.11.x.

Gate the compatibility provider on the deployment shape instead of the edition
(genuine multi-tenant Cloud runs in CLOUD_RUNTIME persistence and never reaches
this path), and treat a missing provider row as a model-routing warning rather
than an authentication failure so a data anomaly can never block login.

* fix(agent): bind the first model to the 4.11 runner config

create_llm_model() still wrote the auto-selected model into the pre-4.11
ai['local-agent'] container. On a 4.11 Workspace that key does not exist, so the
assignment raised KeyError and POST /provider/models/llm returned 500 the first
time a user added a model -- and the default pipeline kept primary='', so every
Agent run failed with 'No authorized model for local-agent'.

Delegate to RunnerDefaultConfigService, which resolves the selected runner and
writes the schema-defined model selector into ai.runner_config[<runner id>].

Also default the NOT NULL description column on pipeline and bot creation:
omitting an optional description returned a 500 from the constraint instead of
creating the resource.

* fix(agent): keep seeding the model for pipelines that never migrated

set_pipeline_llm_model_if_empty() returns False when a pipeline has no 4.11
runner selected -- that is exactly the un-migrated shape, which still carries
ai.local-agent. Seed that container, but only when it exists, so the legacy path
keeps its old behaviour without the KeyError.

src/langbot/pkg/api/http/service/bot.py

@@ -779,6 +779,9 @@ class BotService:
         else:
             bot_data['event_bindings'] = await self._normalize_event_bindings(context, bot_data['event_bindings'])
         bot_data.setdefault('plugin_processors', [])
+        # The column is NOT NULL; a caller that omits the optional description
+        # must not get a 500 from the database constraint.
+        bot_data.setdefault('description', '')
 
         await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_bot.Bot).values(bot_data))
 

src/langbot/pkg/api/http/service/model.py

@@ -402,15 +402,37 @@ class LLMModelsService:
             )
             pipeline = result.first()
             if pipeline is not None:
-                model_config = pipeline.config.get('ai', {}).get('local-agent', {}).get('model', {})
-                if not model_config.get('primary', ''):
-                    pipeline_config = pipeline.config
-                    pipeline_config['ai']['local-agent']['model'] = {
-                        'primary': model_data['uuid'],
-                        'fallbacks': [],
-                    }
-                    pipeline_data = {'config': pipeline_config}
-                    await self.ap.pipeline_service.update_pipeline(context, pipeline.uuid, pipeline_data)
+                # 4.11 pipelines keep the model selector inside
+                # ai.runner_config[<runner id>], not in the pre-4.11
+                # ai.local-agent container, so the schema-aware default-config
+                # service owns this. Touching ai['local-agent'] directly raised
+                # KeyError and turned "add the first model" into a 500 on every
+                # freshly created Workspace.
+                updated = await self.ap.runner_default_config_service.set_pipeline_llm_model_if_empty(
+                    context,
+                    pipeline,
+                    model_data['uuid'],
+                )
+                if not updated:
+                    # Pipelines that have not gone through the 4.11 migration still
+                    # carry the legacy container; keep seeding it, but only when it
+                    # actually exists.
+                    legacy_config = (pipeline.config or {}).get('ai', {}).get('local-agent')
+                    if isinstance(legacy_config, dict):
+                        legacy_model = legacy_config.get('model')
+                        if not isinstance(legacy_model, dict):
+                            legacy_model = {}
+                        if not legacy_model.get('primary', ''):
+                            legacy_config['model'] = {
+                                **legacy_model,
+                                'primary': model_data['uuid'],
+                                'fallbacks': legacy_model.get('fallbacks') or [],
+                            }
+                            await self.ap.pipeline_service.update_pipeline(
+                                context,
+                                pipeline.uuid,
+                                {'config': pipeline.config},
+                            )
 
         return model_data['uuid']
 

src/langbot/pkg/api/http/service/pipeline.py

@@ -183,6 +183,9 @@ class PipelineService:
                 raise ValueError(f'Maximum number of pipelines ({max_pipelines}) reached')
 
         pipeline_data = pipeline_data.copy()
+        # The column is NOT NULL; a caller that omits the optional description
+        # must not get a 500 from the database constraint.
+        pipeline_data.setdefault('description', '')
         pipeline_data['uuid'] = str(uuid.uuid4())
         pipeline_data['workspace_uuid'] = workspace_uuid
         pipeline_data['for_version'] = self.ap.ver_mgr.get_current_version()

src/langbot/pkg/api/http/service/user.py

@@ -33,6 +33,7 @@ from ....entity.persistence.workspace import MembershipRole, MembershipStatus, W
 from ....utils import constants
 from ....entity.errors import account as account_errors
 from ....workspace.collaboration import normalize_email
+from ....workspace.errors import WorkspaceNotFoundError
 from ....utils import bounded_executor
 
 if typing.TYPE_CHECKING:
@@ -255,10 +256,23 @@ class UserService:
         access = accesses[0]
         if access.membership.role != MembershipRole.OWNER.value:
             return
-        await self.ap.provider_service.update_space_model_provider_api_keys(
-            access.workspace.uuid,
-            api_key,
-        )
+        # A missing compatibility provider row is a model-routing problem, not an
+        # authentication one. Letting provider_service raise here aborted the whole
+        # Space OAuth callback after the Account had already been created, so the
+        # user logged in "successfully" but received 404 on every retry.
+        try:
+            await self.ap.provider_service.update_space_model_provider_api_keys(
+                access.workspace.uuid,
+                api_key,
+            )
+        except WorkspaceNotFoundError:
+            logger = getattr(self.ap, 'logger', None)
+            if logger is not None:
+                logger.warning(
+                    'Space model provider row is missing for workspace %s; '
+                    'skipping credential refresh so login can proceed',
+                    access.workspace.uuid,
+                )
 
     async def is_initialized(self) -> bool:
         account = await self._identity_scalar(

src/langbot/pkg/persistence/mgr.py

@@ -1608,7 +1608,14 @@ class PersistenceManager:
         return policies
 
     async def write_space_model_providers(self):
-        if constants.edition != 'community':
+        # Only a single-Workspace deployment may own the process-level
+        # compatibility provider. Genuine multi-tenant Cloud runs in CLOUD_RUNTIME
+        # persistence mode and never reaches this method, but a dedicated
+        # environment is `edition=cloud` on top of OSS persistence, so gating on
+        # the edition alone left it without the provider row -- and the Space OAuth
+        # callback then failed with "Provider not found" on every login.
+        deployment = getattr(self.ap, 'deployment', None)
+        if deployment is not None and getattr(deployment, 'multi_workspace_enabled', False):
             # SaaS Workspace/provider linkage is explicit control-plane state;
             # a process-level compatibility provider must never be projected
             # into an arbitrary cloud Workspace.