ai-code-engineer 0.1.0__py3-none-any.whl

ai_code_engineer/planbook.py

@@ -0,0 +1,192 @@
+"""Ordered plan steps with a ledger, so a phase gates on real proof instead of memory.
+
+An attached plan used to be reference text: the model was told to do "the phase the user
+asked for", and the sequence lived in whoever typed the next request. This module makes
+the order a fact on disk. A step is complete only when a command run proved that tests
+executed and none failed, and the next step's task is generated from what is already done.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import re
+
+from .engine import atomic_json
+from .errors import PolicyError
+from . import memory as memory_store
+from .workspace import Workspace
+
+MAX_STEPS = 12
+STEP_HEADING = re.compile(
+    r"(?m)^\s{0,3}#{1,6}\s*(?:(?:phase|step|task|stage)s*\s+)?\b(\d+)\b\W*(?P<title>[^\n]*)$", re.I)
+
+
+def parse_steps(text: str) -> list[dict]:
+    """Numbered headings become steps; anything else is one undivided step."""
+    matches = list(STEP_HEADING.finditer(text))
+    if len(matches) < 2:
+        body = text.strip()
+        if not body:
+            raise PolicyError("The plan has no steps to run.")
+        return [{"id": 1, "title": body.splitlines()[0][:90], "body": body[:6000]}]
+    steps = []
+    for index, match in enumerate(matches):
+        end = matches[index + 1].start() if index + 1 < len(matches) else len(text)
+        title = (match.group("title") or "").strip().strip(":—-–") or f"step {index + 1}"
+        steps.append({"id": len(steps) + 1, "title": title[:90],
+                      "body": text[match.end():end].strip()[:6000]})
+        if len(steps) == MAX_STEPS:
+            break
+    return steps
+
+
+def key_for(root: str, plan_sha: str) -> str:
+    """Readable, unique per resolved project root, and per plan content.
+
+    The folder's own name is not enough: two checkouts of one project share the name `demo`,
+    and a ledger they both read hands a verified step to the folder that never ran it. The
+    root half is exactly the key the project notes use, so the two stores cannot disagree.
+    """
+    return memory_store.key_for(root) + "-" + plan_sha[:16]
+
+
+def relative_name(ws: Workspace, plan_file: str) -> str:
+    """The plan's workspace-relative name, whether the caller has a path or a full path."""
+    candidate = Path(plan_file)
+    if candidate.is_absolute():
+        try:
+            candidate = candidate.relative_to(ws.root)
+        except ValueError:
+            raise PolicyError("The plan file must be inside the selected project folder.") from None
+    return candidate.as_posix()
+
+
+def _same_root(stored: object, root: Path) -> bool:
+    """A ledger that disagrees about which folder it belongs to is not that folder's ledger."""
+    try:
+        return (str(Path(str(stored)).expanduser().resolve()).casefold()
+                == str(Path(root).expanduser().resolve()).casefold())
+    except OSError:
+        return False
+
+
+def open_book(plans_dir: Path, ws: Workspace, plan_file: str) -> tuple[Path, dict]:
+    """Load the ledger for this plan, or start one. A changed plan starts a new ledger."""
+    reference = ws.read(relative_name(ws, plan_file))
+    path = plans_dir / (key_for(str(ws.root), reference["sha256"]) + ".json")
+    if path.exists():
+        try:
+            book = json.loads(path.read_text(encoding="utf-8"))
+            if (book.get("schema") == 1 and book.get("plan_sha256") == reference["sha256"]
+                    and _same_root(book.get("root", ""), ws.root)
+                    and isinstance(book.get("steps"), list)):
+                return path, book
+        except (OSError, ValueError, TypeError):
+            pass
+    book = {"schema": 1, "root": str(ws.root), "plan_path": reference["path"],
+            "plan_sha256": reference["sha256"],
+            "steps": [dict(row, status="pending", session_id=None, verified_at=None)
+                      for row in parse_steps(reference["content"])]}
+    return path, book
+
+
+def step(book: dict, step_id: int) -> dict | None:
+    return next((row for row in book["steps"] if row["id"] == step_id), None)
+
+
+def current(book: dict) -> dict | None:
+    return next((row for row in book["steps"] if row["status"] != "verified"), None)
+
+
+def done_titles(book: dict) -> list[str]:
+    return [row["title"] for row in book["steps"] if row["status"] == "verified"]
+
+
+def task_for(book: dict, row: dict, note: str = "") -> str:
+    """The per-turn task the ledger sends instead of a hand-written phase request."""
+    lines = [f"Implement step {row['id']} of {len(book['steps'])} from the attached plan: "
+             + row["title"] + "."]
+    if row.get("body"):
+        lines.append("This step asks for:\n" + row["body"][:3000])
+    finished = done_titles(book)
+    if finished:
+        lines.append("Already applied and verified by a command run — do not redo, rename or "
+                     "rewrite them: " + ", ".join(finished) + ".")
+    lines.append("Touch only the files this step needs. Do not run builds or tests yourself; "
+                 "the user runs the command and approves each proposal.")
+    if note:
+        lines.append("User note for this step: " + note[:800])
+    return "\n".join(lines)[:4000]
+
+
+def proof_reason(session: dict) -> str:
+    """Why this session's last command run does, or does not, prove the step works."""
+    if session.get("state") != "CHECKS_PASSED":
+        return "the session is not in CHECKS_PASSED"
+    runs = session.get("runs") or []
+    if not runs:
+        return "no command has been recorded for this session"
+    run = runs[-1]
+    if run.get("status") != "passed":
+        return "the last command did not pass"
+    proof = run.get("proof")
+    if proof:
+        if proof.get("failures") or proof.get("errors"):
+            return "the test report shows failures or errors"
+        if proof.get("tests", 0) - proof.get("skipped", 0) <= 0:
+            return "the test report contains no executed test"
+        return ""
+    if run.get("tests_observed"):
+        return ""
+    # A compile-only recipe asks for no tests; the build passing is its proof.
+    if str(run.get("recipe", "")).endswith("compile"):
+        return ""
+    return "no test was observed running"
+
+
+def complete(path: Path, book: dict, step_id: int, session: dict) -> dict:
+    """Mark a step verified only from a session that proved it, then persist the ledger."""
+    row = step(book, step_id)
+    if row is None:
+        raise PolicyError("Unknown plan step: " + str(step_id)[:20])
+    if row["status"] == "verified":
+        return book
+    if session.get("id") != row.get("session_id"):
+        raise PolicyError("That session is not the one recorded for this plan step.")
+    reason = proof_reason(session)
+    if reason:
+        raise PolicyError(f"Plan step {step_id} cannot be marked done: {reason}.")
+    row.update(status="verified", verified_at=session.get("created"))
+    atomic_json(path, book)
+    return book
+
+
+def record_session(path: Path, book: dict, step_id: int, session_id: str) -> dict:
+    """Bind the session working on a step; a fix round rebinds it to the newer session."""
+    row = step(book, step_id)
+    if row is None:
+        raise PolicyError("Unknown plan step: " + str(step_id)[:20])
+    row["session_id"] = session_id
+    if row["status"] != "verified":
+        row["status"] = "in_progress"
+    atomic_json(path, book)
+    return book
+
+
+def reopen(path: Path, book: dict, step_id: int) -> dict:
+    """Un-verify a step whose applied files were rolled back, so the next one cannot build on nothing."""
+    row = step(book, step_id)
+    if row is None or row["status"] != "verified":
+        return book
+    row.update(status="in_progress", verified_at=None)
+    atomic_json(path, book)
+    return book
+
+
+def progress_line(book: dict) -> str:
+    verified = len(done_titles(book))
+    row = current(book)
+    if row is None:
+        return f"Plan complete — {verified}/{len(book['steps'])} steps verified"
+    return (f"Plan step {row['id']}/{len(book['steps'])}: {row['title']} "
+            f"({verified} verified)")

ai_code_engineer/providers.py

@@ -0,0 +1,404 @@
+"""Provider boundaries: no redirects, no proxies, no automatic cloud fallback."""
+from __future__ import annotations
+
+import json
+import math
+import os
+import time
+from typing import Protocol
+from urllib.error import HTTPError, URLError
+from urllib.request import HTTPRedirectHandler, ProxyHandler, Request, build_opener
+
+from .config import (Kind, OLLAMA, OPENROUTER, Settings, check_endpoint, kind_for, needs_consent,
+                     validate)
+from .errors import PolicyError, ProviderError, ProviderUnavailable
+from .redaction import redact
+
+
+class NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def _refuse(exc: HTTPError) -> ProviderError:
+    """The one translation of a provider that answered with an error code.
+
+    Never the request, the bearer token or the URL. The response body is a different case: it is the
+    only place Ollama writes *why* it refused, and "model requires more system memory (9.2 GiB) than
+    is available (6.1 GiB)" is the difference between a dead task and a fixable one. So a short,
+    collapsed, redacted excerpt is allowed — capped, not trusted.
+    """
+    detail = ""
+    try:
+        detail = redact(" ".join(exc.read(4096).decode("utf-8", "replace").split()))[:180]
+    except Exception:                                      # noqa: BLE001 - a body that will not
+        detail = ""                                        # read is not worth losing the code for
+    return ProviderError(f"Provider HTTP {exc.code}"
+                         + (f": {detail}" if detail else "")
+                         + "; no automatic retry or fallback.")
+
+
+def _opener():
+    """One opener for both reads, so a streaming body cannot inherit different rules than a buffered one."""
+    return build_opener(ProxyHandler({}), NoRedirect())
+
+
+def request_json(url: str, payload: dict | None = None, *, key: str | None = None,
+                 timeout: int = 120, max_bytes: int = 2_000_000) -> dict:
+    headers = {"Content-Type": "application/json"}
+    if key:
+        headers["Authorization"] = "Bearer " + key
+    request = Request(url, data=json.dumps(payload).encode() if payload is not None else None,
+                      headers=headers)
+    try:
+        with _opener().open(request, timeout=timeout) as response:
+            raw = response.read(max_bytes + 1)
+        if len(raw) > max_bytes:
+            raise ProviderError("Provider response exceeds size limit.")
+        result = json.loads(raw)
+        if not isinstance(result, dict):
+            raise ProviderError("Provider returned an invalid response.")
+        return result
+    except HTTPError as exc:
+        raise _refuse(exc) from None
+    except (URLError, TimeoutError, OSError):
+        raise ProviderUnavailable("Provider connection failed or timed out. A local model needs a "
+                       "longer request timeout for a reply this large.") from None
+    except (ValueError, UnicodeError):
+        raise ProviderError("Provider returned invalid JSON.") from None
+
+
+# A cold Ollama daemon answers nothing for a few seconds while it loads, which is the one failure a
+# second ask genuinely fixes. Two attempts and one second is the whole policy; more would only be a
+# slower way of saying the service is not running.
+PROBE_ATTEMPTS = 2
+PROBE_PAUSE = 1.0
+
+
+def request_probe_with_retry(url: str, payload: dict | None = None, *, key: str | None = None,
+                             timeout: int = 10, attempts: int = PROBE_ATTEMPTS,
+                             pause: float = PROBE_PAUSE) -> dict:
+    """One metadata read, asked twice if the first attempt never reached anything.
+
+    Only ever for metadata: `/api/tags` and `/api/show` are pure reads, so a repeat costs a second and
+    changes nothing. A generation call is deliberately not in here. Re-running `/api/chat` or a stream
+    starts another model load — minutes of CPU on a machine that may have just said it has no room —
+    and restarting a stream mid-answer breaks the row the user is already watching, which is what
+    `tests/test_transport.py` holds the refusal sentence for. So those keep one attempt, and the
+    distinction is typed (`ProviderUnavailable`) rather than read back out of an English message.
+    """
+    for attempt in range(max(1, attempts)):
+        try:
+            return request_json(url, payload, key=key, timeout=timeout)
+        except ProviderUnavailable:
+            if attempt + 1 >= attempts:
+                raise
+            time.sleep(pause)
+
+
+# A streaming body announces no length to trust, so the cap moves to what has been read. The same
+# figure as the buffered read, because a reply that grows past it is not an answer that arrived late.
+MAX_STREAM_BYTES = 2_000_000
+
+
+def ollama_chunk(line: bytes) -> dict | None:
+    """One NDJSON line from `/api/chat`: what was added, to which field, and how it ended."""
+    try:
+        chunk = json.loads(line)
+    except ValueError:
+        return None
+    if not isinstance(chunk, dict):
+        return None
+    message = chunk.get("message") if isinstance(chunk.get("message"), dict) else {}
+    return {"content": str(message.get("content") or ""),
+            "thinking": str(message.get("thinking") or message.get("reasoning") or ""),
+            "finish": str(chunk.get("done_reason") or "") or None,
+            "model": "", "done": bool(chunk.get("done"))}
+
+
+def openai_chunk(line: bytes) -> dict | None:
+    """One SSE frame from `/chat/completions`. Blank frames and comment lines carry no text.
+
+    DeepSeek's R1 line and OpenRouter's reasoning models put the deliberation in the delta beside the
+    content, under the same two names they use in the buffered answer, so the same fields are read
+    here — a streaming reply is not a licence to drop half of it.
+    """
+    text = line.decode("utf-8", "replace").strip()
+    if not text.startswith("data:"):
+        return None
+    body = text[5:].strip()
+    if body == "[DONE]":
+        return {"content": "", "thinking": "", "finish": None, "model": "", "done": True}
+    try:
+        chunk = json.loads(body)
+    except ValueError:
+        return None
+    choices = chunk.get("choices") or []
+    first = choices[0] if choices and isinstance(choices[0], dict) else {}
+    delta = first.get("delta") if isinstance(first.get("delta"), dict) else {}
+    return {"content": str(delta.get("content") or ""),
+            "thinking": str(delta.get("reasoning_content") or delta.get("reasoning") or ""),
+            "finish": first.get("finish_reason") or None,
+            "model": str(chunk.get("model") or ""), "done": False}
+
+
+def read_stream(url: str, payload: dict, *, key: str | None = None, timeout: int = 120,
+                on_token=None, chunk=ollama_chunk, max_bytes: int = MAX_STREAM_BYTES) -> dict:
+    """Read a streamed reply in pieces, saying each one as it lands, and return the whole of it.
+
+    The text is assembled here rather than trusted from the client's copy: the caller has to parse an
+    envelope, store a record and hash a proposal out of what arrives, and a browser that lost a frame
+    would otherwise change what the tool decided. `on_token` is a *display* consumer.
+    """
+    headers = {"Content-Type": "application/json", "Accept": "text/event-stream"}
+    if key:
+        headers["Authorization"] = "Bearer " + key
+    request = Request(url, data=json.dumps(payload).encode(), headers=headers)
+    content, thought, size, model, finish = [], [], 0, "", None
+    try:
+        with _opener().open(request, timeout=timeout) as response:
+            for line in response:
+                size += len(line)
+                if size > max_bytes:
+                    raise ProviderError("Provider response exceeds size limit.")
+                part = chunk(line)
+                if not part:
+                    continue
+                if part.get("model"):
+                    model = part["model"]
+                if part.get("finish"):
+                    finish = part["finish"]
+                if part["content"]:
+                    content.append(part["content"])
+                    if on_token is not None:
+                        on_token(part["content"])
+                thought.append(part["thinking"])
+                if part.get("done"):
+                    break
+    except HTTPError as exc:
+        raise _refuse(exc) from None
+    except (URLError, TimeoutError, OSError):
+        raise ProviderUnavailable("Provider connection failed or timed out. A local model needs a "
+                       "longer request timeout for a reply this large.") from None
+    except ValueError:
+        raise ProviderError("Provider returned invalid JSON.") from None
+    return {"content": "".join(content), "thinking": "".join(thought),
+            "finish": finish, "model": model}
+
+
+# Ollama's default context is small enough to cut a real coding prompt in half without saying so.
+# Measured on this machine with `qwen2.5-coder:3b`: a 20 000-character prompt and a 60 000-character
+# prompt both answered with `prompt_eval_count=2050`. The model replied from roughly the first eight
+# thousand characters and nothing reported the loss — and `num_predict` above the window was capped the
+# same quiet way. So the window is asked for explicitly, sized to the request that is being sent.
+MIN_CTX = 2048
+MAX_CTX = 16384
+TEMPLATE_MARKERS = 64
+
+
+def estimate_tokens(chars: int) -> int:
+    """The same ÷4 the interface labels as an estimate. It is an estimate: it fits English prose and
+    not code or Arabic, which is why it sizes a request rather than reporting one."""
+    return max(1, math.ceil(int(chars or 0) / 4))
+
+
+def context_window(prompt_chars: int, output_tokens: int) -> int:
+    """A power-of-two `num_ctx` with room for this prompt *and* its reply, clamped to what a CPU
+    box can hold — prompt processing, not generation, is what costs minutes here."""
+    need = estimate_tokens(prompt_chars) + int(output_tokens or 0) + TEMPLATE_MARKERS
+    window = MIN_CTX
+    while window < need and window < MAX_CTX:
+        window *= 2
+    return min(window, MAX_CTX)
+
+
+class ModelProvider(Protocol):
+    """The seam between the loop and a model.
+
+    `supports_stream` is declared rather than defaulted: a caller asks it before it passes
+    `on_token`, which is what lets the scripted providers in the tests keep the two-argument
+    signature they have always had.
+    """
+
+    model: str
+    supports_stream: bool
+
+    def generate(self, messages: list[dict], json_mode: bool = True,
+                 on_token=None) -> str: ...
+
+
+# A reasoning model answers twice: once in a field nobody asked for and once in `content`. The names
+# differ per provider — `reasoning` on Ollama and OpenRouter, `reasoning_content` on DeepSeek's R1 line,
+# `thinking` on Qwen — and all three have been seen carrying the words while `content` carried the JSON.
+REASONING_KEYS = ("reasoning", "reasoning_content", "thinking")
+REASONING_CHARS = 1200
+
+
+def read_reasoning(message) -> str:
+    """What the model thought out loud, capped and redacted — or "" when it kept that to itself.
+
+    This never enters the envelope path: `parse_action` must only ever see what the model was asked to
+    return, and reasoning is precisely the field that contains prose, braces and half-finished thoughts.
+    It is redacted here rather than at the surface because the raw words are also what a report exports,
+    and a chain of thought quoting a connection string is still quoting a connection string.
+    """
+    if not isinstance(message, dict):
+        return ""
+    for key in REASONING_KEYS:
+        value = message.get(key)
+        if isinstance(value, str) and value.strip():
+            return redact(value.strip())[:REASONING_CHARS]
+    return ""
+
+
+class OllamaProvider:
+    supports_stream = True
+
+    def __init__(self, settings: Settings, *, allow_cloud: bool = False):
+        self.settings = settings
+        self.model = settings.model
+        self.supports_thinking = False
+        self.reasoning = ""
+        self.allow_cloud = allow_cloud
+        # One rule for every provider, in ``config``: this device only, no credentials in the URL.
+        # It used to refuse a URL *path* as well, which is how a relocated Ollama became unusable.
+        self.endpoint = check_endpoint(OLLAMA, settings.endpoint)
+
+    def preflight(self) -> None:
+        info = request_json(self.endpoint + "/api/show", {"model": self.model}, timeout=10)
+        cloud_backed = bool("cloud" in self.model.casefold() or info.get("remote_host") or info.get("remote_model"))
+        if cloud_backed and not self.allow_cloud:
+            raise PolicyError("This Ollama model runs in the cloud. Approve cloud processing for public/synthetic code or choose a local model.")
+        if not cloud_backed and not info.get("model_info"):
+            raise PolicyError("Cannot establish that this is an installed local model.")
+        self.supports_thinking = "thinking" in (info.get("capabilities") or [])
+
+    def generate(self, messages: list[dict], json_mode: bool = True, on_token=None) -> str:
+        self.reasoning = ""
+        prompt_chars = sum(len(str(message.get("content", ""))) for message in messages or [])
+        payload = {
+            "model": self.model, "messages": messages,
+            # Asked for piece by piece only when somebody is listening. A turn that parses an envelope
+            # gains nothing from a stream, and an SSE reader is one more way for a reply to go wrong.
+            "stream": on_token is not None,
+            # temperature 0 is greedy decoding, and a weak model that is poor at Arabic
+            # tokenisation can sit on one token forever; 1.1 is the smallest penalty that
+            # breaks the loop without bending the distribution on English or code.
+            "options": {"temperature": 0, "num_predict": self.settings.output_tokens,
+                        "repeat_penalty": 1.1,
+                        "num_ctx": context_window(prompt_chars, self.settings.output_tokens)},
+        }
+        if json_mode:
+            payload["format"] = "json"
+        if self.supports_thinking:
+            # Measured on the local endpoint (2026-09-29, qwen3:4b): a prose turn with the switch off
+            # puts the deliberation at the *front of `content`* — its closing marker sits inside the
+            # text the reader is meant to call the answer — while the same 136 tokens with it on split
+            # into a 180-character reply and a 522-character field. An envelope keeps it off: under
+            # `format: json` the same request spent its whole budget thinking and answered nothing.
+            payload["think"] = not json_mode
+        if on_token is None:
+            result = request_json(self.endpoint + "/api/chat", payload,
+                                  timeout=self.settings.timeout_seconds)
+            message = result.get("message") if isinstance(result.get("message"), dict) else {}
+            value, thought = message.get("content"), message
+            truncated = result.get("done_reason") == "length"
+        else:
+            streamed = read_stream(self.endpoint + "/api/chat", payload,
+                                   timeout=self.settings.timeout_seconds, on_token=on_token,
+                                   chunk=ollama_chunk)
+            value, thought = streamed["content"], {"thinking": streamed["thinking"]}
+            truncated = streamed["finish"] == "length"
+        self.reasoning = read_reasoning(thought)
+        if truncated:
+            raise ProviderError("Model output truncated; reduce the change size.")
+        if not isinstance(value, str) or not value:
+            raise ProviderError("No model content returned.")
+        return value
+
+
+class OpenAICompatibleProvider:
+    """Every provider that answers ``POST {base}/chat/completions`` with the OpenAI shape.
+
+    That is OpenAI, Groq, DeepSeek, OpenRouter, LM Studio, vLLM and any custom base a user types:
+    one body, one response, a different URL and a different key. Anthropic and Gemini are *not* in
+    this class — different auth header, different body, different response — and are not offered.
+    The three things that really are OpenRouter-only (the upstream routing block, the echoed
+    upstream model, the free/paid rule) hang off ``Kind`` flags rather than a subclass.
+    """
+
+    supports_stream = True
+
+    def __init__(self, settings: Settings, api_key: str | None = None, *,
+                 allow_paid: bool = False, kind: Kind | None = None):
+        self.kind = kind or kind_for(settings.provider) or OPENROUTER
+        self.reasoning = ""
+        self.settings = settings
+        self.model = settings.model
+        if self.kind.free_only and not allow_paid and settings.model != "openrouter/free" \
+                and not str(settings.model).endswith(":free"):
+            raise PolicyError("Select the Paid cloud option explicitly to use a paid OpenRouter model.")
+        self.endpoint = check_endpoint(self.kind, settings.endpoint)
+        env_name = settings.api_key_env or self.kind.key_env
+        self.key = api_key or (os.environ.get(env_name) if env_name else "")
+        # A custom endpoint may or may not want a key — that is the user's server to decide — so only
+        # the rows that are known to require one refuse without it.
+        if self.kind.needs_key and not self.key:
+            raise ProviderError(f"Set {env_name or 'an API key'} in your environment (never in a file).")
+
+    def generate(self, messages: list[dict], json_mode: bool = True, on_token=None) -> str:
+        self.reasoning = ""
+        body = {
+            "model": self.settings.model, "messages": messages, "stream": on_token is not None,
+            "temperature": 0, "max_tokens": self.settings.output_tokens,
+        }
+        if json_mode:
+            body["response_format"] = {"type": "json_object"}
+        if self.kind.routing:
+            # Refuse OpenRouter's own failovers: a silent hop to another upstream means the model
+            # that answered is not the one that was reviewed.
+            body["provider"] = {"allow_fallbacks": False, "require_parameters": True}
+        if on_token is None:
+            try:
+                result = request_json(self.endpoint + "/chat/completions", body,
+                                      key=self.key or None, timeout=self.settings.timeout_seconds)
+                choice = result["choices"][0]
+                message = choice["message"] if isinstance(choice.get("message"), dict) else {}
+                value, thought = message.get("content"), message
+                finish, echoed = choice.get("finish_reason"), str(result.get("model") or "")
+            except (KeyError, IndexError, TypeError, AttributeError):
+                raise ProviderError(f"Invalid {self.kind.label} response.") from None
+        else:
+            streamed = read_stream(self.endpoint + "/chat/completions", body, key=self.key or None,
+                                   timeout=self.settings.timeout_seconds, on_token=on_token,
+                                   chunk=openai_chunk)
+            value, thought = streamed["content"], {"thinking": streamed["thinking"]}
+            finish, echoed = streamed["finish"], streamed["model"]
+        self.reasoning = read_reasoning(thought)
+        # Proposals must be complete; chat tolerates a missing finish_reason.
+        if not (finish == "stop" or (not json_mode and finish is None)):
+            raise ProviderError("Model did not finish normally; output discarded.")
+        if self.kind.routing and echoed:
+            self.model = echoed
+        if not isinstance(value, str) or not value:
+            raise ProviderError(f"Invalid {self.kind.label} response.")
+        return value
+
+
+def make_provider(settings: Settings, *, allow_cloud: bool, data_class: str,
+                  api_key: str | None = None, allow_paid: bool = False) -> ModelProvider:
+    validate(settings)
+    kind = kind_for(settings.provider) or OLLAMA
+    # Judged on the address that will actually be used, not on the string the settings happened to
+    # carry: an empty endpoint resolves through the profile, the environment and the table, and a
+    # consent decision made before that question is answered is made about a host nobody chose.
+    endpoint = check_endpoint(kind, settings.endpoint)
+    if kind.shape == "ollama":
+        # A cloud-backed Ollama model is discovered in preflight, not assumed from the endpoint.
+        provider = OllamaProvider(settings, allow_cloud=allow_cloud and data_class in {"public", "synthetic"})
+        provider.preflight()
+        return provider
+    if needs_consent(kind, endpoint) and (
+            not allow_cloud or data_class not in {"public", "synthetic"}):
+        raise PolicyError("Cloud requires --allow-cloud and --data-class public or synthetic.")
+    return OpenAICompatibleProvider(settings, api_key=api_key, allow_paid=allow_paid, kind=kind)

ai_code_engineer/redaction.py

@@ -0,0 +1,54 @@
+"""Keep credentials out of the text a build run leaves behind.
+
+Command output is stored on the session and fed back to the model on the next repair
+turn, so anything the project printed lands in a log file and possibly in a cloud
+request. Projects print their own connection strings often enough that the guarantee
+cannot be "nobody printed a secret"; the value is removed where it is captured.
+"""
+from __future__ import annotations
+
+import re
+
+# Placeholder text is not a secret and redacting it would only confuse the model.
+SKIP_VALUES = {"null", "none", "true", "false", "undefined", "***", "[redacted]", "string",
+               "change-me", "changeme", "secret", "password", "your-key-here", "<token>"}
+
+PATTERNS = (
+    # Whole PEM private keys, across lines.
+    re.compile(r"(?s)-----BEGIN[A-Z ]*PRIVATE KEY-----.*?-----END[A-Z ]*PRIVATE KEY-----"),
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b"),                      # AWS access key id
+    re.compile(r"\bgh[pousr]_[A-Za-z0-9]{20,}\b"),                      # GitHub token
+    re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b"),                    # Slack token
+    re.compile(r"\bAIza[0-9A-Za-z_\-]{35}\b"),                          # Google API key
+    re.compile(r"\bsk-(?:ant-|proj-)?[A-Za-z0-9_\-]{20,}\b"),           # OpenAI/Anthropic key
+    re.compile(r"\beyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{4,}\.[A-Za-z0-9_\-]{4,}\b"),  # JWT
+    re.compile(r"(?i)\bglpat-[A-Za-z0-9_\-]{20,}\b"),                   # GitLab token
+)
+
+# user:password inside any URL or JDBC-style connection string.
+URL_CREDENTIALS = re.compile(r"(?i)\b([a-z][a-z0-9+.\-]*://)[^\s/@:]+:[^\s/@]+@")
+# "password = hunter2", "API_KEY: 'abcd'", -Dtoken=abcd, and friends. The optional qualifier in
+# front exists because `\b` does not fire after an underscore: without it the two shapes that build
+# logs really print — SPRING_DATASOURCE_PASSWORD=… and AWS_SECRET_ACCESS_KEY=… — passed straight
+# through, into the session file and on to the next model request.
+ASSIGNMENT = re.compile(
+    r"(?i)\b([\w.]*_)?(password|passwd|pwd|secret|api[_-]?key|access[_-]?key|secret[_-]?key|"
+    r"client[_-]?secret|auth[_-]?token|token)(\s*[=:]\s*)([\"']?)([^\s,;\"']{6,})(\4)")
+
+
+def _assignment(match: re.Match) -> str:
+    value = match.group(5)
+    if value.casefold().strip("'\"") in SKIP_VALUES or value.startswith(("${", "$(", "%{")):
+        return match.group(0)
+    return ((match.group(1) or "") + match.group(2) + match.group(3) + match.group(4)
+            + "[redacted]" + match.group(6))
+
+
+def redact(text: str) -> str:
+    """Replace credential-shaped runs of characters; leave the surrounding log intact."""
+    if not isinstance(text, str) or not text:
+        return text
+    for pattern in PATTERNS:
+        text = pattern.sub("[redacted]", text)
+    text = URL_CREDENTIALS.sub(lambda m: m.group(1) + "[redacted]@", text)
+    return ASSIGNMENT.sub(_assignment, text)