lex-llm 0.4.9 → 0.4.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2b7839d1fcb47e176aa62970f3ec40d04b9e25095418285d3cf6a5d492ccb8d
-  data.tar.gz: f444cd5054325a007f05749d6d4a2ca0933bf1f5b7004b2585daaa97745eb337
+  metadata.gz: a203372d751b290a71cc289e382d80a49fafcc0687925c02594b8c5cfe6ef7aa
+  data.tar.gz: 95cfd5a03c002a16da80bac58914f1fb808a940db378d99035f97b6256240863
 SHA512:
-  metadata.gz: 7412bc0234b379941ae045fa826f267d97b1577dba15ee7268957d62c999808e27392d9acf65d0bf464c31aa7365e3912642a4b0041eb92294f108c4203d8f38
-  data.tar.gz: a90e99a7c61f6fda2ffc4d2e4fd6b2fcba6f69bf75d5da526cacef550c345aadd157ea1ee6efeae59e3f69160a8e6ad92237a31997e9ef259c69dc29a6db01e6
+  metadata.gz: 645bde1f8e4b6701fa5092f2b92e2867f63d243c239341e691921efa9cc74a861b3382f00665efd8f4d1420976c462f9c47eaa89bdae93ae60655983681bcddc
+  data.tar.gz: f180a90275c427970e6129ae3f0ef285fabb68fa92a97059687fb37fcf9282f5e083b159f3757293a79ae4bf71f263a54fb9387469f55da25a23959e295d2371

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.4.10 - 2026-05-13
+
+- Add cache-backed `model_detail` lookup with 24-hour TTL; nil results are not cached; `fetch_model_detail` hook for subclasses to override with live API calls.
+- Build `model_detail_cache_key` from tier, slug, instance, and credential fingerprint so remote providers never share model detail entries across credentials.
+- Add `credential_cache_fragment` — includes an 8-char SHA-256 credential fingerprint in cache keys for non-local providers.
+- Add `source_tag`, `credential_fingerprint`, and `config_fingerprint` to `CredentialSources` for provenance tracking across discovered instances.
+- Suppress Faraday raw stacktrace dumps on connection failures by setting `errors: false` on the response logger middleware.
+- Rescue `Faraday::ConnectionFailed` in `discover_offerings` and return an empty list with a concise warning instead of propagating the exception.
+- Wire `model_allowed?` filtering into `discover_offerings` so whitelist/blacklist settings are enforced during live discovery (was dead code before).
+- Check instance config first for `model_whitelist`/`model_blacklist` before falling back to provider settings, enabling per-instance override.
+- Add `legion-cache >= 1.3.0` as a runtime dependency and include `Legion::Cache::Helper` in the base `Provider` class.
+
 ## 0.4.9 - 2026-05-13
 
 - Route provider, tool, streaming, model, attachment, connection, credential, and fleet diagnostics through `Legion::Logging::Helper`.

data/lex-llm.gemspec

@@ -35,6 +35,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'faraday-multipart', '>= 1'
   spec.add_dependency 'faraday-net_http', '>= 1'
   spec.add_dependency 'faraday-retry', '>= 1'
+  spec.add_dependency 'legion-cache', '>= 1.3.0'
   spec.add_dependency 'legion-crypt', '>= 1.5.1'
   spec.add_dependency 'legion-json', '>= 1.2.1'
   spec.add_dependency 'legion-logging', '>= 1.3.2'

data/lib/legion/extensions/llm/connection.rb

@@ -79,7 +79,7 @@ module Legion
           faraday.response :logger,
                            logger,
                            bodies: debug_logger?(logger),
-                           errors: true,
+                           errors: false,
                            headers: false,
                            log_level: :debug do |logger|
             logger.filter(logging_regexp('[A-Za-z0-9+/=]{100,}'), '[BASE64 DATA]')

data/lib/legion/extensions/llm/credential_sources.rb

@@ -167,6 +167,30 @@ module Legion
           Digest::SHA256.hexdigest(val.to_s)
         end
 
+        # Build a human-readable source tag describing where a credential was found.
+        # Format: "type:location:key" e.g. "env:ANTHROPIC_API_KEY", "file:~/.claude/settings.json:anthropicApiKey"
+        def source_tag(type, location, key = nil)
+          parts = [type.to_s, location.to_s]
+          parts << key.to_s if key && !key.to_s.empty?
+          parts.join(':')
+        end
+
+        # Generate a short fingerprint (first 8 chars of SHA-256) for a credential value.
+        # Stable for the lifetime of the credential; safe to log and include in audit events.
+        def credential_fingerprint(value)
+          return nil if value.nil? || value.to_s.strip.empty?
+
+          Digest::SHA256.hexdigest(value.to_s)[0, 8]
+        end
+
+        # Extract fingerprint from a config hash by finding the first credential field.
+        def config_fingerprint(config)
+          val = config[:api_key] || config['api_key'] ||
+                config[:bearer_token] || config['bearer_token'] ||
+                config[:access_token] || config['access_token']
+          credential_fingerprint(val)
+        end
+
         # Returns true when the URL points to localhost / 127.0.0.1 / ::1.
         def localhost?(url)
           return false if url.nil?
@@ -185,7 +209,9 @@ module Legion
         module_function :env, :claude_config, :claude_config_value,
                         :claude_env_value, :codex_token, :codex_openai_key,
                         :setting, :socket_open?, :http_ok?,
-                        :dedup_credentials, :credential_hash, :localhost?
+                        :dedup_credentials, :credential_hash,
+                        :source_tag, :credential_fingerprint, :config_fingerprint,
+                        :localhost?
 
         # --- private helpers -----------------------------------------------
 

data/lib/legion/extensions/llm/provider.rb

@@ -28,6 +28,7 @@ module Legion
       class Provider
         include Streaming
         include Legion::Logging::Helper
+        include Legion::Cache::Helper
 
         attr_reader :config, :connection
 
@@ -123,10 +124,14 @@ module Legion
           provider_health = health(live:)
           @cached_offerings = Array(list_models(live:, **filters)).filter_map do |model|
             next unless model_matches_filters?(model, filters)
+            next unless model_allowed?(model.id)
 
             offering_from_model(model, health: provider_health)
           end
           @cached_offerings
+        rescue Faraday::ConnectionFailed => e
+          log.warn("[#{slug}] instance=#{provider_instance_id} unreachable: #{e.message}")
+          []
         end
 
         def health(live: false)
@@ -284,12 +289,14 @@ module Legion
         # ── Model allow-list / deny-list filtering ────────────────────────
 
         def model_whitelist
-          wl = settings[:model_whitelist] if respond_to?(:settings)
+          wl = config.model_whitelist if config.respond_to?(:model_whitelist)
+          wl ||= settings[:model_whitelist] if respond_to?(:settings)
           Array(wl).map { |p| p.to_s.downcase }
         end
 
         def model_blacklist
-          bl = settings[:model_blacklist] if respond_to?(:settings)
+          bl = config.model_blacklist if config.respond_to?(:model_blacklist)
+          bl ||= settings[:model_blacklist] if respond_to?(:settings)
           Array(bl).map { |p| p.to_s.downcase }
         end
 
@@ -371,21 +378,24 @@ module Legion
           nil
         end
 
-        def model_cache_set(key, value, ttl:)
-          return unless defined?(Legion::Cache)
+        def model_detail(model_name)
+          key = model_detail_cache_key(model_name)
+          cached = cache_get(key)
+          return cached if cached
 
-          cache_local_instance? ? local_cache_set(key, value, ttl: ttl) : cache_set(key, value, ttl: ttl)
+          result = fetch_model_detail(model_name)
+          cache_set(key, result, ttl: 86_400) if result
+          result
         rescue StandardError => e
-          handle_exception(e, level: :debug, handled: true, operation: 'lex.provider.model_cache_set')
+          handle_exception(e, level: :warn, handled: true, operation: 'llm.provider.model_detail',
+                              model: model_name)
+          nil
         end
 
-        def model_cache_fetch(key, ttl:, &)
-          return yield unless defined?(Legion::Cache)
-
-          cache_local_instance? ? local_cache_fetch(key, ttl: ttl, &) : cache_fetch(key, ttl: ttl, &)
-        rescue StandardError => e
-          handle_exception(e, level: :debug, handled: true, operation: 'llm.provider.model_cache_fetch', key:)
-          yield
+        # Override in subclasses to make a live API call for model detail.
+        # Must return a Hash with symbol keys (e.g. { context_window: 128000 }).
+        def fetch_model_detail(_model_name)
+          nil
         end
 
         def cache_instance_key
@@ -448,6 +458,26 @@ module Legion
 
         private
 
+        def model_detail_cache_key(model_name)
+          tier = offering_tier
+          instance_key = cache_instance_key
+          cred_fp = credential_cache_fragment
+          key_parts = ['model_info', tier, slug, instance_key, cred_fp, model_name].compact
+          key_parts.join('.')
+        end
+
+        def credential_cache_fragment
+          return nil if cache_local_instance?
+
+          cred = config.respond_to?(:bearer_token) && config.bearer_token
+          cred ||= config.respond_to?(:api_key) && config.api_key
+          cred ||= config.respond_to?(:bedrock_access_key_id) && config.bedrock_access_key_id
+          return nil unless cred
+
+          require 'digest'
+          Digest::SHA256.hexdigest(cred.to_s)[0, 8]
+        end
+
         def validate_paint_inputs!(with:, mask:)
           return if with.nil? && mask.nil?
 

data/lib/legion/extensions/llm/version.rb

@@ -3,7 +3,7 @@
 module Legion
   module Extensions
     module Llm
-      VERSION = '0.4.9'
+      VERSION = '0.4.10'
     end
   end
 end

data/lib/legion/extensions/llm.rb

@@ -9,6 +9,15 @@ require 'faraday/multipart'
 require 'faraday/retry'
 require 'legion/json'
 require 'legion/logging'
+# legion/cache writes DEBUG lines to $stdout on first load; suppress them here
+# so callers that capture our stdout (e.g. Open3-based integration tests) are unaffected.
+begin
+  old_stdout = $stdout
+  $stdout = File.open(File::NULL, 'w')
+  require 'legion/cache'
+ensure
+  $stdout = old_stdout
+end
 require 'logger'
 require 'marcel'
 require 'ruby_llm/schema'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-llm
 version: !ruby/object:Gem::Version
-  version: 0.4.9
+  version: 0.4.10
 platform: ruby
 authors:
 - LegionIO
@@ -108,6 +108,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '1'
+- !ruby/object:Gem::Dependency
+  name: legion-cache
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.0
 - !ruby/object:Gem::Dependency
   name: legion-crypt
   requirement: !ruby/object:Gem::Requirement