ashlr-plugin 1.36.4 → 1.37.1

package/servers/genome-server-handlers.ts

@@ -67,7 +67,7 @@ registerTool({
   description:
     "Merge pending proposals into the genome. Without `model` (and without " +
     "$ASHLR_LLM_URL) runs a deterministic sequential-apply; with an " +
-    "OpenAI-compatible endpoint it uses the LLM to merge conflicting proposals " +
+    "LLM configured by $ASHLR_LLM_URL it merges conflicting proposals " +
     "for the same section.",
   inputSchema: {
     type: "object",
@@ -75,7 +75,7 @@ registerTool({
       model: {
         type: "string",
         description:
-          "Optional OpenAI-compatible base URL (e.g. http://localhost:1234/v1). Pass 'none' to force offline sequential-apply. If omitted, falls back to $ASHLR_LLM_URL or sequential-apply.",
+          "Pass 'none' to force offline sequential-apply, or any other value (for example 'llm') to merge with the LLM configured by $ASHLR_LLM_URL (default local LM Studio at 127.0.0.1:1234). The value is never used as an endpoint. If omitted, uses the LLM only when $ASHLR_LLM_URL or $ASHLR_LLM_KEY is set.",
       },
       cwd: {
         type: "string",

package/servers/genome-server.ts

@@ -38,27 +38,26 @@ import type {
   ProviderRequest,
   StreamEvent,
 } from "@ashlr/core-efficiency";
+import { safeKeyedFetch } from "./_gateway-target.ts";
 
 // ---------------------------------------------------------------------------
 // LLM shim — OpenAI-compatible chat.completions streaming
 // ---------------------------------------------------------------------------
 
+/** Local LLM on loopback by IP literal; `localhost` by name is not accepted for a keyed call. */
+export const DEFAULT_GENOME_LLM_URL = "http://127.0.0.1:1234/v1";
+
 /**
  * Build a minimal LLMSummarizer that hits an OpenAI-compatible endpoint.
  *
- * Precedence:
- *   1. explicit `modelUrl` arg (per-call override)
- *   2. $ASHLR_LLM_URL / $ASHLR_LLM_KEY
- *   3. local LM Studio at http://localhost:1234/v1 (no key required)
- *
- * Returns null if no endpoint is configured AND no override given — the
- * scribe falls back to sequential-apply merging in that case.
+ * The endpoint comes only from user config ($ASHLR_LLM_URL, else local LM
+ * Studio at http://127.0.0.1:1234/v1), never from a tool argument, so the
+ * model cannot choose where $ASHLR_LLM_KEY or genome content goes.
+ * safeKeyedFetch() applies the gateway rules (https, or http only to
+ * 127.0.0.1 / [::1]; no credentials in the URL; no redirects).
  */
-export function buildLLMShim(modelUrl?: string): LLMSummarizer | undefined {
-  const base =
-    modelUrl ??
-    process.env.ASHLR_LLM_URL ??
-    "http://localhost:1234/v1";
+export function buildLLMShim(): LLMSummarizer | undefined {
+  const base = (process.env.ASHLR_LLM_URL ?? "").trim() || DEFAULT_GENOME_LLM_URL;
   const key = process.env.ASHLR_LLM_KEY ?? "";
   const model = process.env.ASHLR_LLM_MODEL ?? "local";
 
@@ -88,7 +87,7 @@ export function buildLLMShim(modelUrl?: string): LLMSummarizer | undefined {
 
       let res: Response;
       try {
-        res = await fetch(endpoint, {
+        res = await safeKeyedFetch(endpoint, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -226,12 +225,13 @@ export async function handleConsolidate(args: ConsolidateArgs): Promise<string>
   }
   // Only construct the LLM shim if caller explicitly requested one OR env is
   // configured. When args.model is the literal string "none", skip the shim
-  // and fall through to sequential-apply.
+  // and fall through to sequential-apply. Any other `model` value only opts
+  // in to LLM merging; it is never used as an endpoint.
   let router: LLMSummarizer | undefined;
   if (args.model === "none") {
     router = undefined;
   } else if (args.model || process.env.ASHLR_LLM_URL || process.env.ASHLR_LLM_KEY) {
-    router = buildLLMShim(args.model);
+    router = buildLLMShim();
   } else {
     // No configured endpoint — sequential-apply keeps this deterministic and
     // offline. Users opt into LLM merging by passing `model` or setting env.
@@ -330,14 +330,14 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     {
       name: "ashlr__genome_consolidate",
       description:
-        "Merge pending proposals into the genome. Without `model` (and without $ASHLR_LLM_URL) runs a deterministic sequential-apply; with an OpenAI-compatible endpoint it uses the LLM to merge conflicting proposals for the same section.",
+        "Merge pending proposals into the genome. Without `model` (and without $ASHLR_LLM_URL) runs a deterministic sequential-apply; with the LLM configured by $ASHLR_LLM_URL it merges conflicting proposals for the same section.",
       inputSchema: {
         type: "object",
         properties: {
           model: {
             type: "string",
             description:
-              "Optional OpenAI-compatible base URL (e.g. http://localhost:1234/v1). Pass 'none' to force offline sequential-apply. If omitted, falls back to $ASHLR_LLM_URL or sequential-apply.",
+              "Pass 'none' to force offline sequential-apply, or any other value (for example 'llm') to merge with the LLM configured by $ASHLR_LLM_URL (default local LM Studio at 127.0.0.1:1234). The value is never used as an endpoint. If omitted, uses the LLM only when $ASHLR_LLM_URL or $ASHLR_LLM_KEY is set.",
           },
           cwd: {
             type: "string",

package/servers/grep-server.ts

@@ -26,6 +26,7 @@ import { getCalibrationMultiplier } from "../scripts/read-calibration";
 import { recordSaving } from "./_stats";
 import { logGenomeCompressionRatioEvent } from "./_telemetry";
 import { clampToCwd, primaryProjectRoot } from "./_cwd-clamp";
+import { rgStopReason, rgTextArgs, truncateRgText } from "./_rg-text";
 import { getEmbeddingCache } from "./_tool-base";
 import { embed, upsertCorpus } from "./_embedding-model";
 import { populateGenomeEmbeddings } from "./_genome-embed-populator";
@@ -504,12 +505,15 @@ export async function ashlrGrep(input: {
 
   const rgBin = resolveRg();
 
-  const res = spawnSync(rgBin, ["--json", "-n", "--", input.pattern, cwd], {
+  const res = spawnSync(rgBin, rgTextArgs(input.pattern, cwd), {
     encoding: "utf-8",
     timeout: 15_000,
+    maxBuffer: 64 * 1024 * 1024,
   });
+  // `raw` is what a plain grep would have returned, so savings are counted
+  // against that, not against a verbose wire format.
   const raw = res.stdout ?? "";
-  const truncated = raw.length > 4000 ? raw.slice(0, 2000) + "\n\n[... truncated ...]\n\n" + raw.slice(-1000) : raw;
+  const truncated = truncateRgText(raw, rgStopReason(res));
   const summarized = await summarizeIfLarge(truncated, {
     toolName: "ashlr__grep",
     systemPrompt: PROMPTS.grep,

package/servers/orient-server-handlers.ts

@@ -40,12 +40,13 @@ registerTool({
     required: ["query"],
   },
   handler: async (args: Record<string, unknown>, _ctx: ToolCallContext): Promise<ToolResult> => {
-    const a = args as Partial<OrientArgs> & { endpointOverride?: string };
+    // Only the documented arguments are read. An extra `endpointOverride` (or
+    // any other key) is ignored: the LLM endpoint comes from user config only.
+    const a = args as Partial<OrientArgs>;
     const out = await orient({
       query: typeof a.query === "string" ? a.query : "",
       dir: typeof a.dir === "string" ? a.dir : undefined,
       depth: a.depth === "quick" || a.depth === "thorough" ? a.depth : undefined,
-      endpointOverride: typeof a.endpointOverride === "string" ? a.endpointOverride : undefined,
     });
     return { content: [{ type: "text", text: out.text }] };
   },

package/servers/orient-server.ts

@@ -37,6 +37,7 @@ import { scan, formatBaseline, listFiles } from "../scripts/baseline-scan";
 import { readFileSync } from "fs";
 import { recordSaving as recordSavingCore } from "./_stats";
 import { STOPWORDS, extractKeywords } from "./_text-helpers";
+import { safeKeyedFetch } from "./_gateway-target.ts";
 
 // Re-export for callers that historically imported `extractKeywords` from orient-server.
 export { extractKeywords, STOPWORDS };
@@ -206,11 +207,23 @@ interface CallLLMOpts {
   systemPrompt: string;
   userContent: string;
   timeoutMs?: number;
-  endpointOverride?: string;
+}
+
+/** LM Studio on loopback by IP literal; `localhost` by name is not accepted for a keyed call. */
+export const DEFAULT_ORIENT_LLM_URL = "http://127.0.0.1:1234/v1";
+
+/**
+ * The orient LLM endpoint comes only from user config (ASHLR_LLM_URL), never
+ * from a tool argument, so the model cannot choose where ASHLR_LLM_KEY or
+ * project excerpts go. safeKeyedFetch() then applies the gateway rules.
+ */
+export function orientLlmBaseUrl(env: Record<string, string | undefined> = process.env): string {
+  const configured = (env.ASHLR_LLM_URL ?? "").trim().replace(/\/+$/, "");
+  return configured || DEFAULT_ORIENT_LLM_URL;
 }
 
 export async function callLocalLLM(opts: CallLLMOpts): Promise<string | null> {
-  const base = opts.endpointOverride ?? process.env.ASHLR_LLM_URL ?? "http://localhost:1234/v1";
+  const base = orientLlmBaseUrl();
   const apiKey = process.env.ASHLR_LLM_KEY ?? "local-llm";
   const model = process.env.ASHLR_LLM_MODEL ?? "qwen/qwen3-coder-30b@8bit";
   const timeoutMs = opts.timeoutMs ?? LLM_TIMEOUT_MS;
@@ -218,7 +231,7 @@ export async function callLocalLLM(opts: CallLLMOpts): Promise<string | null> {
   const ctl = new AbortController();
   const t = setTimeout(() => ctl.abort(), timeoutMs);
   try {
-    const res = await fetch(`${base}/chat/completions`, {
+    const res = await safeKeyedFetch(`${base}/chat/completions`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
       signal: ctl.signal,
@@ -252,8 +265,6 @@ export interface OrientArgs {
   query: string;
   dir?: string;
   depth?: "quick" | "thorough";
-  /** Test hook: override LLM endpoint. */
-  endpointOverride?: string;
 }
 
 export interface OrientResult {
@@ -329,7 +340,6 @@ export async function orient(args: OrientArgs): Promise<OrientResult> {
     systemPrompt: ORIENT_SYSTEM_PROMPT,
     userContent,
     timeoutMs: LLM_TIMEOUT_MS,
-    endpointOverride: args.endpointOverride,
   });
 
   let synthesis: string;
@@ -419,9 +429,6 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
       query: typeof a.query === "string" ? a.query : "",
       dir: typeof a.dir === "string" ? a.dir : undefined,
       depth: a.depth === "quick" || a.depth === "thorough" ? a.depth : undefined,
-      endpointOverride: typeof (a as { endpointOverride?: string }).endpointOverride === "string"
-        ? (a as { endpointOverride?: string }).endpointOverride
-        : undefined,
     });
     return { content: [{ type: "text", text: out.text }] };
   } catch (err) {

package/servers/read-server.ts

@@ -26,7 +26,7 @@ import { isProSync } from "./_pro";
  * Minimum content byte-length before AST skeleton rendering is attempted.
  * Below this threshold the full snipCompact path is cheaper.
  */
-const AST_THRESHOLD = 6144;
+export const AST_THRESHOLD = 6144;
 
 /**
  * File extensions treated as code for the line-number-preservation path.

package/servers/write-server-handlers.ts

@@ -15,13 +15,21 @@ registerTool({
   inputSchema: {
     type: "object",
     properties: {
-      filePath: { type: "string", description: "Absolute or cwd-relative path to write" },
+      filePath: { type: "string", description: "Absolute or cwd-relative path to write (`path` is accepted too)" },
       content: { type: "string", description: "File content to write" },
     },
     required: ["filePath", "content"],
   },
   handler: async (args: Record<string, unknown>, _ctx: ToolCallContext): Promise<ToolResult> => {
-    const result = await ashlrWrite(args as unknown as WriteArgs);
+    // ashlr__read and ashlr__edit take `path`, so callers often pass it here too.
+    const filePath = args.filePath ?? args.path;
+    if (typeof filePath !== "string" || filePath === "") {
+      return { content: [{ type: "text", text: "ashlr__write: filePath must be a non-empty string" }], isError: true };
+    }
+    if (typeof args.content !== "string") {
+      return { content: [{ type: "text", text: "ashlr__write: content must be a string" }], isError: true };
+    }
+    const result = await ashlrWrite({ filePath, content: args.content } satisfies WriteArgs);
     return { content: [{ type: "text", text: formatWriteResult(result) }] };
   },
 });