legion-llm 0.3.2 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45ff0d9cdd07ee541c80dbac46e66d37542af95a96a614e31fc4af2c2bdf7833
-  data.tar.gz: 1562706b98e0e6e301a76dec373cecbcf99a3eb3a8e74a0d258928fbbaaf5be7
+  metadata.gz: bd0b530095616abc383dcd06473a6c435753f021458c76c981da1d4e98583a5f
+  data.tar.gz: 21d8645355c14d591891c3484ca90957e99b0cb376b115eb61dd61f3e0721800
 SHA512:
-  metadata.gz: e28b6c1e39599d1ecd16a60ff67bf4c7625b2d3cdcb2406b465751640b13d44d8a16e593644a4ee30f0bdcaff577580a19e7577e48a7bb07dc3fcfaaf28b3de9
-  data.tar.gz: d8fe57b67e87f8035c9c78c9bc8489aea68d75d50e477ca0007cd471cd24254081cf6784d2350d128d721dbbf4e5332340ac8e5d8297e9feffb1efe826b87d11
+  metadata.gz: 53f3b6bd09f86625986e6f9d5c53f665e000e71d78dc5db36d599f1b5e5d7267d40ca1a2fe1e9f2b48cc54fb7ab6d272108869a02b327ff9669f978b83280e71
+  data.tar.gz: 381d707e3bdb75a1cf87d82404dc842140f98fa4bb5091e5a837685235327684b800de977efcd24857bb0ab8ab5bc75d42fdc22364aa4b024d6adf8f27cdab65

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Legion LLM Changelog
 
+## [0.3.4] - 2026-03-18
+
+### Added
+- Auto-configure LLM providers from environment variables (`AWS_BEARER_TOKEN_BEDROCK`, `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `CODEX_API_KEY`, `GEMINI_API_KEY`)
+- `ANTHROPIC_MODEL` env var sets default model for Anthropic and Bedrock providers
+- Import Claude CLI config from `~/.claude/settings.json` and `~/.claude.json`
+- Auto-detect Ollama via local port probe (no env var needed)
+- Auto-enable providers when credentials are found in environment
+
+## [0.3.3] - 2026-03-17
+
+### Added
+- `Router::GatewayInterceptor`: optional gateway routing mode for cloud-tier LLM calls
+- Gateway settings: endpoint, API key, model policy per risk tier, fallback_to_direct
+- Identity header builder: X-Agent-Id, X-Tenant-Id, X-AIRB-Project-Id, X-Risk-Tier
+- Model selection policy: fnmatch-based allowlist per risk tier
+- Wired gateway interceptor into `chat_single` for automatic cloud-tier interception
+
 ## [0.3.2] - 2026-03-16
 
 ### Added

data/CLAUDE.md

@@ -284,7 +284,7 @@ In-memory signal consumer with pluggable handlers. Adjusts effective priorities
 | `lib/legion/llm/embeddings.rb` | Embeddings module: generate, generate_batch, default_model |
 | `lib/legion/llm/shadow_eval.rb` | Shadow evaluation: enabled?, should_sample?, evaluate, compare |
 | `lib/legion/llm/structured_output.rb` | JSON schema enforcement with native response_format and prompt fallback |
-| `lib/legion/llm/version.rb` | Version constant (0.3.2) |
+| `lib/legion/llm/version.rb` | Version constant (0.3.3) |
 | `lib/legion/llm/quality_checker.rb` | QualityChecker module with QualityResult struct |
 | `lib/legion/llm/escalation_history.rb` | EscalationHistory mixin: `escalation_history`, `escalated?`, `final_resolution`, `escalation_chain` |
 | `lib/legion/llm/router/escalation_chain.rb` | EscalationChain value object |

data/lib/legion/llm/claude_config_loader.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Legion
+  module LLM
+    module ClaudeConfigLoader
+      CLAUDE_SETTINGS = File.expand_path('~/.claude/settings.json')
+      CLAUDE_CONFIG   = File.expand_path('~/.claude.json')
+
+      module_function
+
+      def load
+        config = read_json(CLAUDE_SETTINGS).merge(read_json(CLAUDE_CONFIG))
+        return if config.empty?
+
+        apply_claude_config(config)
+      end
+
+      def read_json(path)
+        return {} unless File.exist?(path)
+
+        require 'json'
+        ::JSON.parse(File.read(path), symbolize_names: true)
+      rescue StandardError
+        {}
+      end
+
+      def apply_claude_config(config)
+        apply_api_keys(config)
+        apply_model_preference(config)
+      end
+
+      def apply_api_keys(config)
+        llm = Legion::LLM.settings
+        providers = llm[:providers]
+
+        if config[:anthropicApiKey] && providers.dig(:anthropic, :api_key).nil?
+          providers[:anthropic][:api_key] = config[:anthropicApiKey]
+          Legion::Logging.debug 'Imported Anthropic API key from Claude CLI config'
+        end
+
+        return unless config[:openaiApiKey] && providers.dig(:openai, :api_key).nil?
+
+        providers[:openai][:api_key] = config[:openaiApiKey]
+        Legion::Logging.debug 'Imported OpenAI API key from Claude CLI config'
+      end
+
+      def apply_model_preference(config)
+        return unless config[:preferredModel] || config[:model]
+
+        model = config[:preferredModel] || config[:model]
+        llm = Legion::LLM.settings
+        return if llm[:default_model]
+
+        llm[:default_model] = model
+        Legion::Logging.debug "Imported model preference from Claude CLI config: #{model}"
+      end
+    end
+  end
+end

data/lib/legion/llm/providers.rb

@@ -4,6 +4,7 @@ module Legion
   module LLM
     module Providers
       def configure_providers
+        auto_enable_from_resolved_credentials
         settings[:providers].each do |provider, config|
           next unless config[:enabled]
 
@@ -11,6 +12,37 @@ module Legion
         end
       end
 
+      def auto_enable_from_resolved_credentials
+        settings[:providers].each do |provider, config|
+          next if config[:enabled]
+
+          has_creds = case provider
+                      when :bedrock
+                        config[:bearer_token] || (config[:api_key] && config[:secret_key])
+                      when :ollama
+                        ollama_running?(config)
+                      else
+                        config[:api_key]
+                      end
+          next unless has_creds
+
+          config[:enabled] = true
+          Legion::Logging.info "Auto-enabled #{provider} provider (credentials found)"
+        end
+      end
+
+      def ollama_running?(config)
+        require 'socket'
+        url = config[:base_url] || 'http://localhost:11434'
+        host_part = url.gsub(%r{^https?://}, '').split(':')
+        addr = host_part[0]
+        port = (host_part[1] || '11434').to_i
+        Socket.tcp(addr, port, connect_timeout: 1).close
+        true
+      rescue StandardError
+        false
+      end
+
       def apply_provider_config(provider, config)
         case provider
         when :bedrock

data/lib/legion/llm/router/gateway_interceptor.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Legion
+  module LLM
+    module Router
+      module GatewayInterceptor
+        module_function
+
+        def intercept(resolution, context: {})
+          return resolution unless gateway_enabled?
+          return resolution unless resolution&.tier == :cloud
+
+          model = resolution.model
+          risk_tier = context[:risk_tier]&.to_sym
+
+          unless model_allowed?(model, risk_tier)
+            Legion::Logging.warn "[llm] gateway policy blocked model=#{model} risk_tier=#{risk_tier}"
+            return nil
+          end
+
+          Resolution.new(
+            tier:     :cloud,
+            provider: :gateway,
+            model:    model,
+            rule:     'gateway_intercept',
+            metadata: { original_provider: resolution.provider }
+          )
+        end
+
+        def gateway_enabled?
+          settings = gateway_settings
+          settings[:enabled] == true && !settings[:endpoint].nil?
+        end
+
+        def model_allowed?(model, risk_tier)
+          return true unless risk_tier
+
+          allowlist = gateway_settings.dig(:model_policy, risk_tier)
+          return true unless allowlist.is_a?(Array) && !allowlist.empty?
+
+          allowlist.any? { |pattern| File.fnmatch?(pattern, model.to_s) }
+        end
+
+        def gateway_headers(context)
+          {
+            'X-Agent-Id'        => context[:worker_id],
+            'X-Tenant-Id'       => context[:tenant_id],
+            'X-AIRB-Project-Id' => context[:airb_project_id],
+            'X-Risk-Tier'       => context[:risk_tier]&.to_s,
+            'X-Legion-Task-Id'  => context[:task_id]&.to_s
+          }.compact
+        end
+
+        def gateway_settings
+          llm = Legion::Settings[:llm]
+          return {} unless llm.is_a?(Hash)
+
+          (llm[:gateway] || {}).transform_keys(&:to_sym)
+        rescue StandardError
+          {}
+        end
+      end
+    end
+  end
+end

data/lib/legion/llm/router.rb

@@ -4,6 +4,7 @@ require_relative 'router/resolution'
 require_relative 'router/rule'
 require_relative 'router/health_tracker'
 require_relative 'router/escalation_chain'
+require_relative 'router/gateway_interceptor'
 require_relative 'discovery/ollama'
 require_relative 'discovery/system'
 

data/lib/legion/llm/settings.rb

@@ -4,14 +4,16 @@ module Legion
   module LLM
     module Settings
       def self.default
+        model_override = ENV.fetch('ANTHROPIC_MODEL', nil)
         {
           enabled:          true,
           connected:        false,
-          default_model:    nil,
+          default_model:    model_override,
           default_provider: nil,
           providers:        providers,
           routing:          routing_defaults,
-          discovery:        discovery_defaults
+          discovery:        discovery_defaults,
+          gateway:          gateway_defaults
         }
       end
 
@@ -47,6 +49,18 @@ module Legion
         }
       end
 
+      def self.gateway_defaults
+        {
+          enabled:            false,
+          endpoint:           nil,
+          api_key:            nil,
+          timeout_seconds:    30,
+          model_policy:       {},
+          headers:            {},
+          fallback_to_direct: true
+        }
+      end
+
       def self.providers
         {
           bedrock:   {
@@ -55,23 +69,23 @@ module Legion
             api_key:       nil,
             secret_key:    nil,
             session_token: nil,
-            bearer_token:  nil,
+            bearer_token:  'env://AWS_BEARER_TOKEN_BEDROCK',
             region:        'us-east-2'
           },
           anthropic: {
             enabled:       false,
             default_model: 'claude-sonnet-4-6',
-            api_key:       nil
+            api_key:       'env://ANTHROPIC_API_KEY'
           },
           openai:    {
             enabled:       false,
             default_model: 'gpt-4o',
-            api_key:       nil
+            api_key:       ['env://OPENAI_API_KEY', 'env://CODEX_API_KEY']
           },
           gemini:    {
             enabled:       false,
             default_model: 'gemini-2.0-flash',
-            api_key:       nil
+            api_key:       'env://GEMINI_API_KEY'
           },
           ollama:    {
             enabled:       false,

data/lib/legion/llm/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module LLM
-    VERSION = '0.3.2'
+    VERSION = '0.3.4'
   end
 end

data/lib/legion/llm.rb

@@ -19,6 +19,9 @@ module Legion
       def start
         Legion::Logging.debug 'Legion::LLM is running start'
 
+        require 'legion/llm/claude_config_loader'
+        ClaudeConfigLoader.load
+
         configure_providers
         run_discovery
         set_defaults
@@ -114,6 +117,7 @@ module Legion
         if (intent || tier) && Router.routing_enabled?
           resolution = Router.resolve(intent: intent, tier: tier, model: model, provider: provider)
           if resolution
+            resolution = Router::GatewayInterceptor.intercept(resolution, context: kwargs.fetch(:context, {}))
             model    = resolution.model
             provider = resolution.provider
           end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-llm
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.4
 platform: ruby
 authors:
 - Esity
@@ -89,6 +89,7 @@ files:
 - legion-llm.gemspec
 - lib/legion/llm.rb
 - lib/legion/llm/bedrock_bearer_auth.rb
+- lib/legion/llm/claude_config_loader.rb
 - lib/legion/llm/compressor.rb
 - lib/legion/llm/discovery/ollama.rb
 - lib/legion/llm/discovery/system.rb
@@ -99,6 +100,7 @@ files:
 - lib/legion/llm/quality_checker.rb
 - lib/legion/llm/router.rb
 - lib/legion/llm/router/escalation_chain.rb
+- lib/legion/llm/router/gateway_interceptor.rb
 - lib/legion/llm/router/health_tracker.rb
 - lib/legion/llm/router/resolution.rb
 - lib/legion/llm/router/rule.rb