@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/llm/provider.py

@@ -1,626 +0,0 @@
-"""Audit-specific LLM provider adapters (FR-94).
-
-Reference: design.md Section 5.1
-
-This module provides audit-specific LLM provider adapters layered on top of
-the generic ``vds_agent_core.llm.provider`` surfaces:
-- Codex OAuth credential resolution (audit-specific auth mechanism)
-- Native Anthropic SDK client builders for direct Claude API access
-- Audit-specific ``LLMSettings`` extending ``BaseLLMSettings`` with the
-  audit ``LLMConfig`` model and Codex secret-resolution semantics
-
-It is NOT a compatibility shim — generic LLMClient Protocol and canonical
-``LLMSettings`` live in ``vds_agent_core.llm.provider`` and should be
-imported from there by non-audit consumers. Audit-orchestrator code
-imports from this module to pick up the audit-specific adapter chain.
-"""
-
-from __future__ import annotations
-
-# Note: Generic LLMClient Protocol is in vds_agent_core.llm.provider.
-# This module defines audit-specific LLMSettings (Codex OAuth, native Anthropic SDK).
-import re
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any
-from urllib.parse import urlparse
-
-import httpx
-from vds_agent_core.llm.provider import LLMSettings as BaseLLMSettings
-from vds_platform_core.credentials import resolve_secret
-
-from ..config import LLM_MODEL_TIER_SENTINEL, LLMConfig, LLMProtocolType, get_config
-
-if TYPE_CHECKING:
-    from pydantic import SecretStr
-
-# Re-export for backward compatibility
-__all__ = [
-    "LLMProtocolType",
-    "LLMProvider",
-    "LLMSettings",
-    "build_anthropic_client",
-    "build_async_anthropic_client",
-    "build_pydantic_anthropic_provider",
-    "build_structured_output_extra_body",
-    "normalize_openai_base_url",
-    "resolve_openai_protocol_api_key",
-    "resolve_protocol_api_key",
-    "resolve_protocol_base_url",
-    "should_suppress_anthropic_tool_choice",
-    "should_suppress_openai_tool_choice",
-]
-
-OPENAI_DUMMY_API_KEY = "no-key-required"
-_OPENAI_TOOL_CHOICE_SUPPRESSION_HOST_SUFFIXES: frozenset[str] = frozenset(
-    {
-        "api.z.ai",
-        "dashscope.aliyuncs.com",
-        "dashscope-intl.aliyuncs.com",
-    }
-)
-_OFFICIAL_ANTHROPIC_HOST_SUFFIXES: frozenset[str] = frozenset(
-    {
-        "api.anthropic.com",
-        "api.eu.anthropic.com",
-    }
-)
-
-LEGACY_CLIENT_SUPPORTED_PROTOCOLS: frozenset[LLMProtocolType] = frozenset(
-    {
-        LLMProtocolType.ANTHROPIC,
-        LLMProtocolType.OPENAI,
-        LLMProtocolType.GEMINI,
-        LLMProtocolType.OPENAI_CODEX,
-    }
-)
-
-
-def normalize_openai_base_url(base_url: str | None) -> str | None:
-    """Normalize OpenAI-compatible base URL to include `/v1` when provided."""
-    if not base_url:
-        return None
-    normalized = str(base_url).strip().rstrip("/")
-    if not normalized:
-        return None
-    parsed = urlparse(normalized)
-    path = (parsed.path or "").rstrip("/")
-    last_segment = path.split("/")[-1] if path else ""
-    if last_segment == "v1" or re.fullmatch(r"v\d+(?:\.\d+)?", last_segment):
-        return normalized
-    if not normalized.endswith("/v1"):
-        normalized = f"{normalized}/v1"
-    return normalized
-
-
-def normalize_codex_base_url(base_url: str | None) -> str | None:
-    """Normalize Codex base URL to endpoint root (SDK appends `/responses`)."""
-    if not base_url:
-        return None
-    normalized = str(base_url).strip().rstrip("/")
-    if not normalized:
-        return None
-    if normalized.endswith("/responses"):
-        normalized = normalized[: -len("/responses")]
-    return normalized
-
-
-def resolve_protocol_base_url(settings: LLMConfig, protocol: LLMProtocolType | None = None) -> str | None:
-    """Resolve protocol base URL using generic config fields only."""
-    effective_protocol = protocol or settings.protocol
-    raw_base_url = resolve_secret(settings.base_url)
-    base_url = str(raw_base_url or "").strip() or None
-    if effective_protocol == LLMProtocolType.OPENAI_CODEX:
-        return normalize_codex_base_url(base_url)
-    if effective_protocol == LLMProtocolType.OPENAI:
-        return normalize_openai_base_url(base_url)
-    return base_url
-
-
-def resolve_openai_protocol_api_key(settings: LLMConfig) -> str:
-    """Resolve OpenAI API key, using deterministic dummy key for local/proxy endpoints."""
-    if settings.api_key:
-        return resolve_secret(settings.api_key) or ""
-    return OPENAI_DUMMY_API_KEY
-
-
-def resolve_protocol_api_key(
-    settings: LLMConfig,
-    protocol: LLMProtocolType | None = None,
-    *,
-    allow_openai_dummy: bool = True,
-) -> str:
-    """Resolve protocol API key from generic config fields only."""
-    effective_protocol = protocol or settings.protocol
-    if settings.api_key:
-        return resolve_secret(settings.api_key) or ""
-
-    if effective_protocol == LLMProtocolType.OPENAI and allow_openai_dummy:
-        return OPENAI_DUMMY_API_KEY
-
-    raise ValueError(f"VDS_AUDIT_LLM__API_KEY is required for protocol '{effective_protocol.value}'")
-
-
-def should_suppress_openai_tool_choice(
-    base_url: str | SecretStr | None,
-    protocol: LLMProtocolType | str | None = None,
-) -> bool:
-    """Return True when an OpenAI-compatible endpoint rejects explicit tool_choice.
-
-    DashScope's OpenAI-compatible chat endpoint rejects ``tool_choice=required`` in
-    thinking mode for ``qwen3.5-plus``. Suppressing the field allows structured
-    output tool calls to proceed while leaving official OpenAI endpoints untouched.
-    """
-    protocol_value = str(getattr(protocol, "value", protocol) or "").strip().lower()
-    if protocol_value != LLMProtocolType.OPENAI.value:
-        return False
-    raw_base_url = resolve_secret(base_url)
-    normalized_base_url = str(raw_base_url or "").strip()
-    if not normalized_base_url:
-        return False
-    host = (urlparse(normalized_base_url).hostname or "").lower()
-    return any(
-        host == suffix or host.endswith(f".{suffix}") for suffix in _OPENAI_TOOL_CHOICE_SUPPRESSION_HOST_SUFFIXES
-    )
-
-
-def should_suppress_anthropic_tool_choice(
-    base_url: str | SecretStr | None,
-    protocol: LLMProtocolType | str | None = None,
-) -> bool:
-    """Return True when an Anthropic-compatible endpoint rejects explicit tool_choice.
-
-    Several Anthropic-compatible proxy gateways, including DashScope's Anthropic
-    compatibility layer, reject the explicit tool_choice payload used by
-    PydanticAI. Official Anthropic endpoints should keep the default behavior.
-    """
-    protocol_value = str(getattr(protocol, "value", protocol) or "").strip().lower()
-    if protocol_value != LLMProtocolType.ANTHROPIC.value:
-        return False
-    raw_base_url = resolve_secret(base_url)
-    normalized_base_url = str(raw_base_url or "").strip()
-    if not normalized_base_url:
-        return False
-    host = (urlparse(normalized_base_url).hostname or "").lower()
-    if not host:
-        return False
-    return not any(host == suffix or host.endswith(f".{suffix}") for suffix in _OFFICIAL_ANTHROPIC_HOST_SUFFIXES)
-
-
-def _should_strip_anthropic_auth_token(*, base_url: str | SecretStr | None, api_key: str | None) -> bool:
-    if not str(api_key or "").strip():
-        return False
-    return should_suppress_anthropic_tool_choice(base_url, LLMProtocolType.ANTHROPIC)
-
-
-def build_anthropic_client(*, api_key: str, base_url: str | None) -> Any:
-    from anthropic import Anthropic
-
-    client = Anthropic(
-        api_key=api_key,
-        base_url=base_url,
-    )
-    if _should_strip_anthropic_auth_token(base_url=base_url, api_key=api_key):
-        client.auth_token = None
-    return client
-
-
-def build_async_anthropic_client(*, api_key: str, base_url: str | None) -> Any:
-    from anthropic import AsyncAnthropic
-
-    client = AsyncAnthropic(
-        api_key=api_key,
-        base_url=base_url,
-    )
-    if _should_strip_anthropic_auth_token(base_url=base_url, api_key=api_key):
-        client.auth_token = None
-    return client
-
-
-def build_pydantic_anthropic_provider(*, api_key: str, base_url: str | None) -> Any:
-    from pydantic_ai.providers.anthropic import AnthropicProvider
-
-    return AnthropicProvider(
-        anthropic_client=build_async_anthropic_client(api_key=api_key, base_url=base_url),
-    )
-
-
-def build_structured_output_extra_body(
-    base_url: str | SecretStr | None,
-    protocol: LLMProtocolType | str | None = None,
-) -> dict[str, Any] | None:
-    """Return provider-specific extra_body overrides for structured output tool calls.
-
-    DashScope's compatibility endpoints reject explicit ``tool_choice=required`` /
-    object-style payloads in thinking mode on output-tool paths. Suppressing the
-    field keeps reasoning available while avoiding provider-specific rejections.
-    """
-    if should_suppress_openai_tool_choice(base_url, protocol):
-        return {"tool_choice": None}
-    if should_suppress_anthropic_tool_choice(base_url, protocol):
-        return {"tool_choice": None}
-    return None
-
-
-def _read_credential_field(credentials: Any, *field_names: str) -> str:
-    for field_name in field_names:
-        if isinstance(credentials, dict):
-            raw_value = credentials.get(field_name)
-        else:
-            raw_value = getattr(credentials, field_name, None)
-        value = str(raw_value or "").strip()
-        if value:
-            return value
-    return ""
-
-
-class LLMSettings(BaseLLMSettings):
-    """Audit-specific LLM settings — inherits BaseLLMSettings directly.
-
-    Keeps the core-owned shared settings contract while preserving the audit
-    runtime fields that downstream audit code still reads today.
-
-    Inherits: build_client(), select_model(), build_pydantic_ai_model() from core.
-    """
-
-    # Audit-specific fields not in BaseLLMSettings or requiring audit defaults.
-    use_pydantic_ai: bool = True
-    api_key: SecretStr | None = None
-    # Override LLMRuntimeConfig default (True) to match LLMConfig audit default.
-    stream: bool = False
-    model_simple: str = LLM_MODEL_TIER_SENTINEL
-    model_standard: str = LLM_MODEL_TIER_SENTINEL
-    model_complex: str = LLM_MODEL_TIER_SENTINEL
-    max_cost_per_repo: float = 2.00
-    max_tokens_per_request: int = 12000
-
-    @classmethod
-    def from_config(cls) -> LLMSettings:
-        """Create LLMSettings from global config."""
-        config = get_config()
-        return cls(**config.llm.model_dump())
-
-    @staticmethod
-    def _is_local_openai_endpoint(base_url: str | None) -> bool:
-        if not base_url:
-            return False
-        parsed = urlparse(base_url)
-        host = (parsed.hostname or "").lower()
-        return host in {"localhost", "127.0.0.1", "0.0.0.0", "::1"}
-
-    def get_client(self) -> Any:
-        """Get sync client for configured protocol."""
-        protocol = self.protocol
-        if protocol not in LEGACY_CLIENT_SUPPORTED_PROTOCOLS:
-            raise ValueError(f"Unsupported protocol: {protocol}")
-
-        if protocol == LLMProtocolType.ANTHROPIC:
-            return build_anthropic_client(
-                api_key=resolve_protocol_api_key(self, protocol, allow_openai_dummy=False),
-                base_url=resolve_protocol_base_url(self, protocol),
-            )
-
-        if protocol in {LLMProtocolType.OPENAI, LLMProtocolType.OPENAI_CODEX}:
-            base_url = resolve_protocol_base_url(self, protocol)
-            if protocol == LLMProtocolType.OPENAI and self._is_local_openai_endpoint(base_url):
-                return OllamaClient(base_url=(base_url or "http://127.0.0.1:11434/v1").removesuffix("/v1"))
-
-            from openai import OpenAI
-
-            default_headers: dict[str, str] | None = None
-            if protocol == LLMProtocolType.OPENAI_CODEX:
-                from vds_audit_orchestrator.llm.codex_oauth import get_codex_credentials
-
-                if not base_url:
-                    raise ValueError("openai-codex protocol requires VDS_AUDIT_LLM__BASE_URL")
-                credentials = get_codex_credentials()
-                api_key = _read_credential_field(credentials, "access_token", "token")
-                if not api_key:
-                    raise ValueError("openai-codex credentials missing access token")
-                account_id = _read_credential_field(credentials, "account_id", "chatgpt_account_id")
-                if account_id:
-                    default_headers = {"ChatGPT-Account-Id": account_id}
-            else:
-                api_key = resolve_openai_protocol_api_key(self)
-            return OpenAI(
-                api_key=api_key,
-                base_url=base_url,
-                default_headers=default_headers,
-            )
-
-        from google.genai import Client as GenAIClient
-
-        base_url = resolve_protocol_base_url(self, protocol)
-        return GenAIClient(
-            api_key=resolve_protocol_api_key(self, protocol, allow_openai_dummy=False),
-            http_options={"base_url": base_url} if base_url else None,
-        )
-
-    def get_async_client(self) -> Any:
-        """Get async client for configured protocol."""
-        protocol = self.protocol
-        if protocol not in LEGACY_CLIENT_SUPPORTED_PROTOCOLS:
-            raise ValueError(f"Unsupported protocol: {protocol}")
-
-        if protocol == LLMProtocolType.ANTHROPIC:
-            return build_async_anthropic_client(
-                api_key=resolve_protocol_api_key(self, protocol, allow_openai_dummy=False),
-                base_url=resolve_protocol_base_url(self, protocol),
-            )
-
-        if protocol in {LLMProtocolType.OPENAI, LLMProtocolType.OPENAI_CODEX}:
-            base_url = resolve_protocol_base_url(self, protocol)
-            if protocol == LLMProtocolType.OPENAI and self._is_local_openai_endpoint(base_url):
-                return AsyncOllamaClient(base_url=(base_url or "http://127.0.0.1:11434/v1").removesuffix("/v1"))
-
-            from openai import AsyncOpenAI
-
-            default_headers: dict[str, str] | None = None
-            if protocol == LLMProtocolType.OPENAI_CODEX:
-                from vds_audit_orchestrator.llm.codex_oauth import get_codex_credentials
-
-                if not base_url:
-                    raise ValueError("openai-codex protocol requires VDS_AUDIT_LLM__BASE_URL")
-                credentials = get_codex_credentials()
-                api_key = _read_credential_field(credentials, "access_token", "token")
-                if not api_key:
-                    raise ValueError("openai-codex credentials missing access token")
-                account_id = _read_credential_field(credentials, "account_id", "chatgpt_account_id")
-                if account_id:
-                    default_headers = {"ChatGPT-Account-Id": account_id}
-            else:
-                api_key = resolve_openai_protocol_api_key(self)
-            return AsyncOpenAI(
-                api_key=api_key,
-                base_url=base_url,
-                default_headers=default_headers,
-            )
-
-        # google-genai currently provides sync client in this codebase.
-        from google.genai import Client as GenAIClient
-
-        base_url = resolve_protocol_base_url(self, protocol)
-        return GenAIClient(
-            api_key=resolve_protocol_api_key(self, protocol, allow_openai_dummy=False),
-            http_options={"base_url": base_url} if base_url else None,
-        )
-
-    def select_model(self, complexity: str) -> str:
-        """Select model tier based on task complexity.
-
-        Extends core select_model() with audit-specific aliases (low→simple, high→complex).
-        """
-        normalized = complexity.strip().lower()
-        if normalized in {"simple", "low"}:
-            return super().select_model("simple")
-        if normalized in {"complex", "high", "critical"}:
-            return super().select_model("complex")
-        return super().select_model("standard")
-
-
-class LLMProvider:
-    """LLM provider with centralized configuration."""
-
-    def __init__(self) -> None:
-        self._client: Any | None = None
-        self._config = get_config()
-
-    @property
-    def config(self) -> LLMConfig:
-        return self._config.llm
-
-    @property
-    def enabled(self) -> bool:
-        return self._config.llm.enabled or self._config.features.llm_enabled
-
-    def get_client(self) -> Any:
-        if self._client is None:
-            settings = LLMSettings.from_config()
-            self._client = settings.get_client()
-        return self._client
-
-    def get_model(self, complexity: str = "standard") -> str:
-        settings = LLMSettings.from_config()
-        return settings.select_model(complexity)
-
-    def get_async_client(self) -> Any:
-        settings = LLMSettings.from_config()
-        return settings.get_async_client()
-
-
-@dataclass(slots=True)
-class _OllamaContentBlock:
-    text: str
-
-
-@dataclass(slots=True)
-class _OllamaMessageResponse:
-    content: list[_OllamaContentBlock]
-    usage: Any | None = None
-
-
-class _OllamaMessages:
-    def __init__(self, base_url: str) -> None:
-        self._client = httpx.Client(base_url=base_url, timeout=60, trust_env=False)
-
-    @staticmethod
-    def _normalize_content(content: Any) -> str:
-        if isinstance(content, str):
-            return content
-        if isinstance(content, list):
-            parts: list[str] = []
-            for item in content:
-                if isinstance(item, dict) and item.get("type") == "text":
-                    parts.append(str(item.get("text", "")))
-                elif isinstance(item, str):
-                    parts.append(item)
-            return "".join(parts)
-        return str(content)
-
-    def create(
-        self,
-        *,
-        model: str,
-        messages: list[dict[str, Any]],
-        max_tokens: int | None = None,
-        system: str | None = None,
-        **kwargs: Any,
-    ) -> _OllamaMessageResponse:
-        payload_messages: list[dict[str, str]] = []
-        if system:
-            payload_messages.append({"role": "system", "content": system})
-        for msg in messages:
-            payload_messages.append(
-                {
-                    "role": msg.get("role", "user"),
-                    "content": self._normalize_content(msg.get("content", "")),
-                }
-            )
-        payload: dict[str, Any] = {
-            "model": model,
-            "messages": payload_messages,
-            "stream": False,
-        }
-        format_hint = kwargs.get("format")
-        if format_hint is not None:
-            payload["format"] = format_hint
-
-        options = dict(kwargs.get("options") or {})
-        for option_key in (
-            "temperature",
-            "top_p",
-            "top_k",
-            "repeat_penalty",
-            "repeat_last_n",
-            "seed",
-            "num_ctx",
-            "num_keep",
-            "min_p",
-            "typical_p",
-            "presence_penalty",
-            "frequency_penalty",
-            "mirostat",
-            "mirostat_eta",
-            "mirostat_tau",
-            "stop",
-        ):
-            if option_key in kwargs and kwargs[option_key] is not None:
-                options[option_key] = kwargs[option_key]
-        if max_tokens is not None:
-            options["num_predict"] = max_tokens
-        if options:
-            payload["options"] = options
-
-        response = self._client.post("/api/chat", json=payload)
-        if response.status_code == 404:
-            prompt = "\n".join(f"{m['role']}: {m['content']}" for m in payload_messages)
-            gen_payload: dict[str, Any] = {"model": model, "prompt": prompt, "stream": False}
-            if format_hint is not None:
-                gen_payload["format"] = format_hint
-            if options:
-                gen_payload["options"] = options
-            response = self._client.post("/api/generate", json=gen_payload)
-        response.raise_for_status()
-        data = response.json()
-        text = data.get("message", {}).get("content") or data.get("response", "")
-        return _OllamaMessageResponse(content=[_OllamaContentBlock(text=text)])
-
-
-class OllamaClient:
-    def __init__(self, base_url: str) -> None:
-        self.messages = _OllamaMessages(base_url=base_url)
-
-
-class _AsyncOllamaMessages:
-    """Async version of Ollama messages API."""
-
-    def __init__(self, base_url: str) -> None:
-        self._client = httpx.AsyncClient(base_url=base_url, timeout=60, trust_env=False)
-
-    @staticmethod
-    def _normalize_content(content: Any) -> str:
-        if isinstance(content, str):
-            return content
-        if isinstance(content, list):
-            parts: list[str] = []
-            for item in content:
-                if isinstance(item, dict) and item.get("type") == "text":
-                    parts.append(str(item.get("text", "")))
-                elif isinstance(item, str):
-                    parts.append(item)
-            return "".join(parts)
-        return str(content)
-
-    async def create(
-        self,
-        *,
-        model: str,
-        messages: list[dict[str, Any]],
-        max_tokens: int | None = None,
-        system: str | None = None,
-        **kwargs: Any,
-    ) -> _OllamaMessageResponse:
-        payload_messages: list[dict[str, str]] = []
-        if system:
-            payload_messages.append({"role": "system", "content": system})
-        for msg in messages:
-            payload_messages.append(
-                {
-                    "role": msg.get("role", "user"),
-                    "content": self._normalize_content(msg.get("content", "")),
-                }
-            )
-        payload: dict[str, Any] = {
-            "model": model,
-            "messages": payload_messages,
-            "stream": False,
-        }
-        format_hint = kwargs.get("format")
-        if format_hint is not None:
-            payload["format"] = format_hint
-
-        options = dict(kwargs.get("options") or {})
-        for option_key in (
-            "temperature",
-            "top_p",
-            "top_k",
-            "repeat_penalty",
-            "repeat_last_n",
-            "seed",
-            "num_ctx",
-            "num_keep",
-            "min_p",
-            "typical_p",
-            "presence_penalty",
-            "frequency_penalty",
-            "mirostat",
-            "mirostat_eta",
-            "mirostat_tau",
-            "stop",
-        ):
-            if option_key in kwargs and kwargs[option_key] is not None:
-                options[option_key] = kwargs[option_key]
-        if max_tokens is not None:
-            options["num_predict"] = max_tokens
-        if options:
-            payload["options"] = options
-
-        response = await self._client.post("/api/chat", json=payload)
-        if response.status_code == 404:
-            prompt = "\n".join(f"{m['role']}: {m['content']}" for m in payload_messages)
-            gen_payload: dict[str, Any] = {"model": model, "prompt": prompt, "stream": False}
-            if format_hint is not None:
-                gen_payload["format"] = format_hint
-            if options:
-                gen_payload["options"] = options
-            response = await self._client.post("/api/generate", json=gen_payload)
-        response.raise_for_status()
-        data = response.json()
-        text = data.get("message", {}).get("content") or data.get("response", "")
-        return _OllamaMessageResponse(content=[_OllamaContentBlock(text=text)])
-
-
-class AsyncOllamaClient:
-    """Async Ollama client matching Anthropic AsyncClient interface."""
-
-    def __init__(self, base_url: str) -> None:
-        self.messages = _AsyncOllamaMessages(base_url=base_url)