feat(hub): dashboard Ask settings for hub-api and frontend (0.187.0)

kerberoshub.api.ask.* sets ASK_ENABLED and the ASK_AZURE_OPENAI_* model
settings on hub-api (endpoint, apiKey and deployment are required when
enabled); kerberoshub.frontend.features.ask.enabled sets
FEATURE_ASK_ENABLED. Both default to off. scripts/check-hub-ask.sh checks
the rendering.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.186.0
+version: 0.187.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -508,6 +508,37 @@ in `all` and `ui` modes. The chart does not change the API image tag.
 
 Validate rendering with `bash scripts/check-hub-mcp.sh` from the repository root.
 
+### Ask
+
+Ask lets signed-in users type a question about their recordings on the
+dashboard. An Azure OpenAI deployment answers it by calling the MCP recording
+and device tools with the user's own grants; `/mcp` itself does not need to be
+enabled. Deploy compatible Hub API and frontend images, then set:
+
+```yaml
+kerberoshub:
+    api:
+        ask:
+            enabled: true
+            azureOpenAI:
+                endpoint: https://my-resource.openai.azure.com
+                apiKey: <key>
+                deployment: <deployment>
+                reasoningEffort: low
+    frontend:
+        features:
+            ask:
+                enabled: "true"
+```
+
+The deployment must support function calling and structured output. Rendering
+fails when Ask is enabled without an endpoint, key or deployment. Each question
+uses up to six model turns; the API limits each user to six questions a minute.
+Both settings default to off; the API setting applies only to Hub API pods in
+`all` and `ui` modes.
+
+Validate rendering with `bash scripts/check-hub-ask.sh` from the repository root.
+
 ### Passkeys
 
 Users and sub-users can create and manage their own passkeys in **Profile >
@@ -875,6 +906,11 @@ kerberospipeline:
 | `kerberoshub.api.corsAllowedOrigins` | Additional complete HTTP(S) origins allowed to call the Hub API. Configured frontend origins remain allowed automatically. | `[]` |
 | `kerberoshub.api.mcp.enabled` | Expose the read-only `/mcp` endpoint; sets `MCP_ENABLED`. Requires a compatible Hub API image. | `false` |
 | `kerberoshub.api.mcp.allowedOrigins` | Exact HTTP(S) origins for browser MCP clients, joined into `MCP_ALLOWED_ORIGINS`. Independent of REST CORS; no wildcards or trailing slash. | `[]` |
+| `kerberoshub.api.ask.enabled` | Expose `POST /ask` for dashboard questions about recordings; sets `ASK_ENABLED`. Requires a compatible Hub API image. | `false` |
+| `kerberoshub.api.ask.azureOpenAI.endpoint` | Azure OpenAI resource URL; sets `ASK_AZURE_OPENAI_ENDPOINT`. Required when Ask is enabled. | `""` |
+| `kerberoshub.api.ask.azureOpenAI.apiKey` | Azure OpenAI API key; sets `ASK_AZURE_OPENAI_API_KEY`. Required when Ask is enabled. | `""` |
+| `kerberoshub.api.ask.azureOpenAI.deployment` | Deployment name; the model must support function calling and structured output. Sets `ASK_AZURE_OPENAI_DEPLOYMENT`. Required when Ask is enabled. | `""` |
+| `kerberoshub.api.ask.azureOpenAI.reasoningEffort` | Optional `minimal`, `low`, `medium` or `high`; empty for models without reasoning. Sets `ASK_AZURE_OPENAI_REASONING_EFFORT`. | `""` |
 | `kerberoshub.api.disableAgentHeartbeat` | Temporarily stop serving the polled `GET /devices` list (hub-api returns `204` without database reads). Devices still load once through `/session/bootstrap`; online/offline status stops refreshing. | `false` |
 | `kerberoshub.api.mediaProxy.enabled` | Serve media through hub-api (`/media/proxy`) instead of handing out Vault/storage URLs, hiding the storage endpoint from clients. | `false` |
 | `kerberoshub.api.mediaProxy.publicUrl` | Public hub-api base URL used in proxied media URLs. Defaults to `{schema}://{url}`. | `""` |
@@ -1022,6 +1058,7 @@ kerberospipeline:
 | `kerberoshub.frontend.features.media.filter.events.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.events`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.tags.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.tags`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.defaultView` | Default view for the media page: `timeline` or `grid`. | `"timeline"` |
+| `kerberoshub.frontend.features.ask.enabled` | Show the dashboard Ask block; sets `FEATURE_ASK_ENABLED`. Needs `kerberoshub.api.ask.enabled`. | `"false"` |
 | `kerberoshub.frontend.features.floorplan.enabled` | Enable or disable `kerberoshub.frontend.features.floorplan`. | `"true"` |
 | `kerberoshub.frontend.features.floorplan.colorDeviceActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
 | `kerberoshub.frontend.features.floorplan.colorDeviceInactive` | Color customization for `floorplan` in the frontend. | `"hsla(0, 3%, 41%, 1)"` |

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -334,6 +334,20 @@ spec:
               value: {{ $mcp.enabled | default false | quote }}
             - name: MCP_ALLOWED_ORIGINS
               value: {{ join "," ($mcp.allowedOrigins | default list) | quote }}
+            {{- $ask := .Values.kerberoshub.api.ask | default dict }}
+            - name: ASK_ENABLED
+              value: {{ $ask.enabled | default false | quote }}
+            {{- if $ask.enabled }}
+            {{- $askModel := $ask.azureOpenAI | default dict }}
+            - name: ASK_AZURE_OPENAI_ENDPOINT
+              value: {{ required "kerberoshub.api.ask.azureOpenAI.endpoint is required when Ask is enabled" $askModel.endpoint | quote }}
+            - name: ASK_AZURE_OPENAI_API_KEY
+              value: {{ required "kerberoshub.api.ask.azureOpenAI.apiKey is required when Ask is enabled" $askModel.apiKey | quote }}
+            - name: ASK_AZURE_OPENAI_DEPLOYMENT
+              value: {{ required "kerberoshub.api.ask.azureOpenAI.deployment is required when Ask is enabled" $askModel.deployment | quote }}
+            - name: ASK_AZURE_OPENAI_REASONING_EFFORT
+              value: {{ $askModel.reasoningEffort | default "" | quote }}
+            {{- end }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -309,6 +309,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
 
         # features > floorplan
+        - name: FEATURE_ASK_ENABLED
+          value: "{{ (.Values.kerberoshub.frontend.features.ask | default dict).enabled | default "false" }}"
         - name: FEATURE_FLOORPLAN_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"      
         # features > map

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -390,6 +390,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
 
         # features > floorplan
+        - name: FEATURE_ASK_ENABLED
+          value: "{{ (.Values.kerberoshub.frontend.features.ask | default dict).enabled | default "false" }}"
         - name: FEATURE_FLOORPLAN_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"
 

charts/hub/values.yaml

@@ -426,6 +426,20 @@ kerberoshub:
       # Exact HTTP(S) origins for browser MCP clients; no wildcards or trailing slash.
       # Clients without an Origin header (such as VS Code) need no entries.
       allowedOrigins: []
+    # Ask: signed-in users ask questions about their recordings on the dashboard;
+    # an Azure OpenAI deployment answers them with the MCP tools, limited to the
+    # user's grants. Requires a compatible API image; also set
+    # frontend.features.ask.enabled to show the dashboard block.
+    ask:
+      enabled: false
+      azureOpenAI:
+        # Resource URL, e.g. https://my-resource.openai.azure.com
+        endpoint: ""
+        apiKey: ""
+        # Deployment name; the model must support function calling and structured output.
+        deployment: ""
+        # Optional: minimal, low, medium or high; leave empty for models without reasoning.
+        reasoningEffort: ""
     # Temporarily stop serving the polled GET /devices list: hub-api answers 204
     # without querying MongoDB. The frontend still loads devices once through
     # /session/bootstrap, but device online/offline status stops refreshing.
@@ -803,6 +817,9 @@ kerberoshub:
         colorChartSelectionFill: "rgba(132, 86, 159, 0.07)"
         colorChartSelectionStroke: "rgba(132, 86, 159, 0.4)"
         colorChartGridStroke: "rgba(0, 106, 255, 0.18)"
+      # Ask about recordings on the dashboard; needs api.ask.enabled.
+      ask:
+        enabled: "false" # Enable or disable the dashboard Ask block 'true' or 'false'
       # Floor-plan feature
       floorplan:
         enabled: "true" # Enable or disable floorplan feature 'true' or 'false'

scripts/check-hub-ask.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+# Prints "<deployment> <variable> <value>" for every ASK_ and FEATURE_ASK_ variable.
+extract_ask() {
+  awk '
+    /^---/ { deployment=0; name=""; variable="" }
+    /^kind: Deployment$/ { deployment=1 }
+    deployment && /^  name:/ { name=$2 }
+    /- name: (FEATURE_)?ASK_/ { variable=$3; next }
+    variable != "" && /value:/ {
+      value=$0
+      sub(/^[[:space:]]*value: /, "", value)
+      print name, variable, value
+      variable=""
+    }
+  ' | sort
+}
+
+assert_ask() {
+  local rendered="$1" expected="$2" actual
+  actual="$(printf '%s\n' "$rendered" | extract_ask)"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Unexpected Ask environment:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
+    return 1
+  fi
+}
+
+model=(
+  --set kerberoshub.api.ask.azureOpenAI.endpoint=https://ask.example.openai.azure.com
+  --set kerberoshub.api.ask.azureOpenAI.apiKey=test-key
+  --set kerberoshub.api.ask.azureOpenAI.deployment=ask-model
+  --set kerberoshub.api.ask.azureOpenAI.reasoningEffort=low
+)
+
+assert_ask "$(helm template hub "$CHART_DIR")" "$(printf '%s\n' \
+  'hub-api ASK_ENABLED "false"' \
+  'hub-frontend FEATURE_ASK_ENABLED "false"')"
+echo "OK: Ask is off by default and passes no model settings"
+
+assert_ask "$(helm template hub "$CHART_DIR" --set kerberoshub.api.ask.enabled=true \
+  --set kerberoshub.frontend.features.ask.enabled=true "${model[@]}")" "$(printf '%s\n' \
+  'hub-api ASK_AZURE_OPENAI_API_KEY "test-key"' \
+  'hub-api ASK_AZURE_OPENAI_DEPLOYMENT "ask-model"' \
+  'hub-api ASK_AZURE_OPENAI_ENDPOINT "https://ask.example.openai.azure.com"' \
+  'hub-api ASK_AZURE_OPENAI_REASONING_EFFORT "low"' \
+  'hub-api ASK_ENABLED "true"' \
+  'hub-frontend FEATURE_ASK_ENABLED "true"')"
+echo "OK: enabled Ask passes the model settings to hub-api only"
+
+assert_ask "$(helm template hub "$CHART_DIR" --set kerberoshub.api.ask=null --set kerberoshub.frontend.features.ask=null)" \
+  "$(printf '%s\n' 'hub-api ASK_ENABLED "false"' 'hub-frontend FEATURE_ASK_ENABLED "false"')"
+echo "OK: values files without an ask section keep it off"
+
+[[ -z "$(helm template hub "$CHART_DIR" --set mode=pipeline --set kerberoshub.api.ask.enabled=true "${model[@]}" | extract_ask)" ]]
+echo "OK (pipeline): no Ask environment"
+
+for missing in endpoint apiKey deployment; do
+  if output="$(helm template hub "$CHART_DIR" --set kerberoshub.api.ask.enabled=true "${model[@]}" \
+    --set "kerberoshub.api.ask.azureOpenAI.$missing=" 2>&1)"; then
+    echo "Rendering succeeded without azureOpenAI.$missing" >&2
+    exit 1
+  fi
+  grep -q "kerberoshub.api.ask.azureOpenAI.$missing is required" <<< "$output"
+done
+echo "OK: enabled Ask requires endpoint, apiKey and deployment"
+
+helm lint "$CHART_DIR" --quiet --set kerberoshub.api.ask.enabled=true "${model[@]}"
+echo "All Hub Ask configuration checks passed."