legion-llm 0.5.20 → 0.5.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f51b096c53558665dbfc074fa203c8624aa79444324cb686759aee35cd568ca6
-  data.tar.gz: 95c6a41fa6839d476cff0d60a6b56a1fbc7ad5be4f914f290fc877e0198e50bc
+  metadata.gz: '08ccdbe9c1f4187acdcae49df633370d7fecb9866fa441aa1e95a3f932d5c9e6'
+  data.tar.gz: df48f1ba0ef83a0fb26ba67865bf0f69ee415a349f2fc0e4ec40dd70f7f70815
 SHA512:
-  metadata.gz: 33a939afde771b78203d7c84f3fdb9ccbe226907037bc97f86a5650324c089e1034e9de3251ea1deb72d634680b3de6e263a48bbb933648621586598d1244f16
-  data.tar.gz: d0f98e6c6dfbee9040953991e8ab3a0de88cd37ed32a352b2d6d0ef52163e120756238d7d5f96c6f00d028b25e778a2076c9012550879fba1b98b06339d5a63e
+  metadata.gz: 9237a7a67d3b843bef628817cbd679fdce2f690e35b35f817e38b39c2e46918cb87d1c81b0b3c5a48589f54a163cbd7f3ef5956e73ba3c96f4f0ee3c1f803c9d
+  data.tar.gz: 996f35c9bb47ff5046bfd10fe48440a783480b81956b6e0b7f1f10bd860fd4aaab9dd9fcda3378761ac2942ea7f9c886d0bd19722cee9b46936f7ae8c662aa9d

data/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [0.5.21] - 2026-03-31
+
+### Added
+- Provider health checks at boot: each SaaS provider is pinged with a test request; failures disable the provider with a log warning
+- `resolve_llm_secrets` — resolves `env://` and `vault://` URIs in LLM settings before provider configuration (fixes late-loaded settings not being resolved)
+- `CodexConfigLoader.read_token` — extracts valid Codex auth token for fallback credential recovery
+- Credential recovery: when OpenAI fails health check, automatically tries `~/.codex/auth.json` token as fallback
+- Provider summary log after health checks listing all available providers
+- All-providers-down error log when no providers survive health checks
+- Embedding health check for SaaS providers during boot (Ollama skipped — model-pulled check is sufficient)
+- Direct Ollama embedding via `POST /api/embed` — bypasses RubyLLM which doesn't support Ollama embeddings
+- Pipeline executor provider fallback: on auth/forbidden errors, automatically retries with next enabled provider
+- `RubyLLM::Error` subclasses now caught in pipeline executor (previously only Faraday errors were rescued)
+
+### Changed
+- Bedrock default model corrected from `us.anthropic.claude-sonnet-4-6-v1` to `us.anthropic.claude-sonnet-4-6`
+- Ollama default model changed from `llama3` to `qwen3.5:latest`
+- `nomic-embed-text` added as first preference in `ollama_preferred` embedding models
+- `Discovery::Ollama.model_available?` now uses prefix matching (`mxbai-embed-large` matches `mxbai-embed-large:latest`)
+- Removed redundant `ping_provider` — replaced by `verify_providers` which checks all enabled SaaS providers
+- `ModelNotFoundError` during health check no longer disables the provider (RubyLLM registry gap, not auth failure)
+
 ## [0.5.20] - 2026-03-30
 
 ### Added

data/lib/legion/llm/codex_config_loader.rb

@@ -19,6 +19,20 @@ module Legion
         apply_codex_config(config)
       end
 
+      def read_token
+        return nil unless File.exist?(CODEX_AUTH)
+
+        config = read_json(CODEX_AUTH)
+        return nil if config.empty?
+        return nil unless config[:auth_mode] == 'chatgpt'
+
+        token = config.dig(:tokens, :access_token)
+        return nil unless token.is_a?(String) && !token.empty?
+        return nil unless token_valid?(token)
+
+        token
+      end
+
       def read_json(path)
         ::JSON.parse(File.read(path), symbolize_names: true)
       rescue StandardError => e

data/lib/legion/llm/discovery/ollama.rb

@@ -18,11 +18,11 @@ module Legion
           end
 
           def model_available?(name)
-            model_names.include?(name)
+            model_names.any? { |n| n == name || n.start_with?("#{name}:") }
           end
 
           def model_size(name)
-            models.find { |m| m['name'] == name }&.dig('size')
+            models.find { |m| m['name'] == name || m['name'].start_with?("#{name}:") }&.dig('size')
           end
 
           def refresh!

data/lib/legion/llm/embeddings.rb

@@ -22,6 +22,9 @@ module Legion
 
           provider ||= resolve_provider
           model    ||= resolve_model(provider)
+
+          return generate_ollama(text: text, model: model) if provider&.to_sym == :ollama
+
           response   = RubyLLM.embed(text, **build_opts(model, provider, dimensions))
           vector     = apply_dimension_enforcement(response.vectors.first, provider)
           return dimension_error(model, provider, vector) if vector.is_a?(String)
@@ -37,7 +40,10 @@ module Legion
 
           provider ||= resolve_provider
           model    ||= resolve_model(provider)
-          response   = RubyLLM.embed(texts, **build_opts(model, provider, dimensions))
+
+          return generate_ollama_batch(texts: texts, model: model) if provider&.to_sym == :ollama
+
+          response = RubyLLM.embed(texts, **build_opts(model, provider, dimensions))
           response.vectors.each_with_index.map do |vec, i|
             build_batch_entry(vec, model, provider, i)
           end
@@ -169,6 +175,37 @@ module Legion
         rescue StandardError
           {}
         end
+
+        def generate_ollama(text:, model:)
+          result = ollama_embed_request(model: model, input: text)
+          vector = result['embeddings']&.first
+          vector = apply_dimension_enforcement(vector, :ollama) if vector
+          return dimension_error(model, :ollama, vector) if vector.is_a?(String)
+
+          { vector: vector, model: model, provider: :ollama, dimensions: vector&.size || 0, tokens: 0 }
+        end
+
+        def generate_ollama_batch(texts:, model:)
+          result = ollama_embed_request(model: model, input: texts)
+          vectors = result['embeddings'] || []
+          vectors.each_with_index.map do |vec, i|
+            build_batch_entry(vec, model, :ollama, i)
+          end
+        end
+
+        def ollama_embed_request(model:, input:)
+          base_url = Legion::Settings.dig(:llm, :providers, :ollama, :base_url) || 'http://localhost:11434'
+          conn = Faraday.new(url: base_url) do |f|
+            f.options.timeout = 30
+            f.options.open_timeout = 5
+            f.adapter Faraday.default_adapter
+          end
+          body = { model: model, input: input }
+          response = conn.post('/api/embed', body.to_json, 'Content-Type' => 'application/json')
+          raise "Ollama embed failed: #{response.status} #{response.body}" unless response.success?
+
+          ::JSON.parse(response.body)
+        end
       end
     end
   end

data/lib/legion/llm/pipeline/executor.rb

@@ -141,6 +141,42 @@ module Legion
         end
 
         def step_provider_call
+          providers_tried = []
+          begin
+            execute_provider_request
+          rescue RubyLLM::UnauthorizedError, RubyLLM::ForbiddenError,
+                 Faraday::UnauthorizedError, Faraday::ForbiddenError => e
+            providers_tried << @resolved_provider
+            fallback = find_fallback_provider(exclude: providers_tried)
+            if fallback
+              if defined?(Legion::Logging)
+                Legion::Logging.warn "[pipeline] #{@resolved_provider} auth failed (#{e.class}), falling back to #{fallback[:provider]}:#{fallback[:model]}"
+              end
+              @resolved_provider = fallback[:provider]
+              @resolved_model = fallback[:model]
+              @warnings << { type: :provider_fallback, original_error: e.message, fallback: "#{@resolved_provider}:#{@resolved_model}" }
+              @timeline.record(
+                category: :provider, key: 'provider:fallback',
+                direction: :internal,
+                detail: "auth failed on #{providers_tried.last}, trying #{@resolved_provider}",
+                from: 'pipeline', to: "provider:#{@resolved_provider}"
+              )
+              retry
+            end
+            raise Legion::LLM::AuthError, e.message
+          rescue RubyLLM::RateLimitError => e
+            raise Legion::LLM::RateLimitError, e.message
+          rescue RubyLLM::ServerError, RubyLLM::ServiceUnavailableError, RubyLLM::OverloadedError,
+                 Faraday::ServerError => e
+            raise Legion::LLM::ProviderError, e.message
+          rescue Faraday::TooManyRequestsError => e
+            raise Legion::LLM::RateLimitError.new(e.message, retry_after: extract_retry_after(e))
+          rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
+            raise Legion::LLM::ProviderDown, e.message
+          end
+        end
+
+        def execute_provider_request
           @timestamps[:provider_start] = Time.now
           @timeline.record(
             category: :provider, key: 'provider:request_sent',
@@ -177,14 +213,6 @@ module Legion
 
           @timestamps[:provider_end] = Time.now
           record_provider_response
-        rescue Faraday::UnauthorizedError, Faraday::ForbiddenError => e
-          raise Legion::LLM::AuthError, e.message
-        rescue Faraday::TooManyRequestsError => e
-          raise Legion::LLM::RateLimitError.new(e.message, retry_after: extract_retry_after(e))
-        rescue Faraday::ServerError => e
-          raise Legion::LLM::ProviderError, e.message
-        rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
-          raise Legion::LLM::ProviderDown, e.message
         end
 
         def record_provider_response
@@ -220,6 +248,37 @@ module Legion
         end
 
         def step_provider_call_stream(&)
+          providers_tried = []
+          begin
+            execute_provider_request_stream(&)
+          rescue RubyLLM::UnauthorizedError, RubyLLM::ForbiddenError,
+                 Faraday::UnauthorizedError, Faraday::ForbiddenError => e
+            providers_tried << @resolved_provider
+            fallback = find_fallback_provider(exclude: providers_tried)
+            if fallback
+              if defined?(Legion::Logging)
+                Legion::Logging.warn "[pipeline] #{@resolved_provider} stream auth failed (#{e.class}), " \
+                                     "falling back to #{fallback[:provider]}:#{fallback[:model]}"
+              end
+              @resolved_provider = fallback[:provider]
+              @resolved_model = fallback[:model]
+              @warnings << { type: :provider_fallback, original_error: e.message, fallback: "#{@resolved_provider}:#{@resolved_model}" }
+              retry
+            end
+            raise Legion::LLM::AuthError, e.message
+          rescue RubyLLM::RateLimitError => e
+            raise Legion::LLM::RateLimitError, e.message
+          rescue RubyLLM::ServerError, RubyLLM::ServiceUnavailableError, RubyLLM::OverloadedError,
+                 Faraday::ServerError => e
+            raise Legion::LLM::ProviderError, e.message
+          rescue Faraday::TooManyRequestsError => e
+            raise Legion::LLM::RateLimitError.new(e.message, retry_after: extract_retry_after(e))
+          rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
+            raise Legion::LLM::ProviderDown, e.message
+          end
+        end
+
+        def execute_provider_request_stream(&)
           @timestamps[:provider_start] = Time.now
           @timeline.record(
             category: :provider, key: 'provider:request_sent',
@@ -243,14 +302,19 @@ module Legion
 
           @timestamps[:provider_end] = Time.now
           record_provider_response
-        rescue Faraday::UnauthorizedError, Faraday::ForbiddenError => e
-          raise Legion::LLM::AuthError, e.message
-        rescue Faraday::TooManyRequestsError => e
-          raise Legion::LLM::RateLimitError.new(e.message, retry_after: extract_retry_after(e))
-        rescue Faraday::ServerError => e
-          raise Legion::LLM::ProviderError, e.message
-        rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
-          raise Legion::LLM::ProviderDown, e.message
+        end
+
+        def find_fallback_provider(exclude: [])
+          providers = Legion::LLM.settings[:providers] || {}
+          providers.each do |name, config|
+            next unless config.is_a?(Hash) && config[:enabled]
+            next if exclude.include?(name) || exclude.include?(name.to_s)
+            next if name == :ollama
+            next unless config[:default_model]
+
+            return { provider: name, model: config[:default_model] }
+          end
+          nil
         end
 
         def step_response_normalization; end

data/lib/legion/llm/providers.rb

@@ -134,6 +134,64 @@ module Legion
         end
         Legion::Logging.info "Configured Ollama provider (#{config[:base_url]})"
       end
+
+      SAAS_PROVIDERS = %i[bedrock anthropic openai gemini azure].freeze
+
+      def verify_providers
+        settings[:providers].each do |provider, config|
+          next unless config[:enabled]
+          next unless SAAS_PROVIDERS.include?(provider)
+
+          model = config[:default_model]
+          next unless model
+
+          verify_single_provider(provider, model, config)
+        end
+
+        recover_with_alternative_credentials
+
+        enabled = settings[:providers].select { |_, c| c.is_a?(Hash) && c[:enabled] }
+        if enabled.empty?
+          Legion::Logging.error 'No LLM providers available — all providers failed health checks or are disabled. ' \
+                                'LLM features (chat, inference, embeddings) will not work. ' \
+                                'Check API keys, network connectivity, and provider configuration.'
+        else
+          names = enabled.map { |name, c| "#{name}/#{c[:default_model] || 'auto'}" }
+          Legion::Logging.info "LLM providers available: #{names.join(', ')}"
+        end
+      end
+
+      def recover_with_alternative_credentials
+        recover_openai_with_codex
+      end
+
+      def recover_openai_with_codex
+        openai_config = settings.dig(:providers, :openai)
+        return unless openai_config.is_a?(Hash) && !openai_config[:enabled]
+
+        token = CodexConfigLoader.read_token
+        return unless token
+
+        Legion::Logging.info 'OpenAI disabled — trying Codex auth token as fallback'
+        openai_config[:api_key] = token
+        configure_openai(openai_config)
+        openai_config[:enabled] = true
+        verify_single_provider(:openai, openai_config[:default_model], openai_config)
+      rescue StandardError => e
+        Legion::Logging.debug "Codex credential recovery failed: #{e.message}" if defined?(Legion::Logging)
+      end
+
+      def verify_single_provider(provider, model, config)
+        start_time = Time.now
+        RubyLLM.chat(model: model, provider: provider).ask('Respond with only the word: pong')
+        elapsed = ((Time.now - start_time) * 1000).round
+        Legion::Logging.info "Health check #{provider}/#{model}: OK (#{elapsed}ms)"
+      rescue RubyLLM::ModelNotFoundError => e
+        Legion::Logging.warn "Health check #{provider}/#{model}: model not in RubyLLM registry (#{e.message}) — provider stays enabled"
+      rescue StandardError => e
+        Legion::Logging.warn "Health check failed for #{provider}/#{model}: #{e.class}: #{e.message} — disabling provider"
+        config[:enabled] = false
+      end
     end
   end
 end

data/lib/legion/llm/settings.rb

@@ -150,7 +150,7 @@ module Legion
             bedrock: 'amazon.titan-embed-text-v2:0',
             openai:  'text-embedding-3-small'
           },
-          ollama_preferred:  %w[mxbai-embed-large bge-large snowflake-arctic-embed]
+          ollama_preferred:  %w[nomic-embed-text mxbai-embed-large bge-large snowflake-arctic-embed]
         }
       end
 
@@ -158,7 +158,7 @@ module Legion
         {
           bedrock:   {
             enabled:       false,
-            default_model: 'us.anthropic.claude-sonnet-4-6-v1',
+            default_model: 'us.anthropic.claude-sonnet-4-6',
             api_key:       nil,
             secret_key:    nil,
             session_token: nil,
@@ -189,7 +189,7 @@ module Legion
           },
           ollama:    {
             enabled:       false,
-            default_model: 'llama3',
+            default_model: 'qwen3.5:latest',
             base_url:      'http://localhost:11434'
           }
         }

data/lib/legion/llm/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module LLM
-    VERSION = '0.5.20'
+    VERSION = '0.5.21'
   end
 end

data/lib/legion/llm.rb

@@ -48,7 +48,9 @@ module Legion
         require 'legion/llm/codex_config_loader'
         CodexConfigLoader.load
 
+        resolve_llm_secrets
         configure_providers
+        verify_providers
         run_discovery
         detect_embedding_capability
         set_defaults
@@ -59,7 +61,6 @@ module Legion
         Legion::Settings[:llm][:connected] = true
         Legion::Logging.info 'Legion::LLM started'
         register_routes
-        ping_provider
       end
 
       def shutdown
@@ -220,6 +221,14 @@ module Legion
 
       private
 
+      def resolve_llm_secrets
+        return unless defined?(Legion::Settings::Resolver)
+
+        Legion::Settings::Resolver.resolve_secrets!(settings)
+      rescue StandardError => e
+        Legion::Logging.warn "LLM settings resolution failed: #{e.message}" if defined?(Legion::Logging)
+      end
+
       def pipeline_enabled?
         settings[:pipeline_enabled] == true
       rescue StandardError => e
@@ -603,11 +612,30 @@ module Legion
           next unless available
 
           resolved_model = available.is_a?(String) ? available : model&.to_s
+          next unless verify_embedding(provider, resolved_model)
+
           return { provider: provider, model: resolved_model }
         end
         nil
       end
 
+      def verify_embedding(provider, model)
+        return true if provider == :ollama
+        return true unless model
+
+        start_time = Time.now
+        RubyLLM.embed('health check', model: model, provider: provider)
+        elapsed = ((Time.now - start_time) * 1000).round
+        Legion::Logging.info "Embedding health check #{provider}/#{model}: OK (#{elapsed}ms)"
+        true
+      rescue RubyLLM::ModelNotFoundError => e
+        Legion::Logging.warn "Embedding health check #{provider}/#{model}: model not in RubyLLM registry (#{e.message}) — skipping"
+        false
+      rescue StandardError => e
+        Legion::Logging.warn "Embedding health check failed for #{provider}/#{model}: #{e.class}: #{e.message} — skipping"
+        false
+      end
+
       def probe_embedding_provider(provider, ollama_preferred)
         case provider
         when :ollama then detect_ollama_embedding(ollama_preferred)
@@ -651,19 +679,6 @@ module Legion
         Legion::Logging.warn "Discovery failed: #{e.message}"
       end
 
-      def ping_provider
-        model = settings[:default_model]
-        provider = settings[:default_provider]
-        return unless model && provider
-
-        start_time = Time.now
-        RubyLLM.chat(model: model, provider: provider).ask('Respond with only the word: pong')
-        elapsed = ((Time.now - start_time) * 1000).round
-        Legion::Logging.info "LLM ping #{provider}/#{model}: pong (#{elapsed}ms)"
-      rescue StandardError => e
-        Legion::Logging.warn "LLM ping failed for #{provider}/#{model}: #{e.message}"
-      end
-
       def register_routes
         return unless defined?(Legion::API) && Legion::API.respond_to?(:register_library_routes)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-llm
 version: !ruby/object:Gem::Version
-  version: 0.5.20
+  version: 0.5.21
 platform: ruby
 authors:
 - Esity