sync: 176 file da Baida98/AI@eeb3eb47 (2026-08-25 09:19 UTC) [deploy-all]

agents/planner.py

@@ -194,6 +194,7 @@ def _parse_plan(raw: str) -> dict | None:
 
 class Planner:
     def __init__(self, llm_client: AIClient | None = None):
+        self._explicit_llm = llm_client is not None
         if llm_client is not None:
             self.llm = llm_client
         else:
@@ -211,6 +212,8 @@ class Planner:
     def _get_fast_llm(self) -> AIClient:
         """Gap-5: Cerebras gpt-oss-120b (2000+ tok/s) per quick-start draft.
         Fallback: Groq openai/gpt-oss-20b se CEREBRAS_API_KEY assente."""
+        if self._explicit_llm:
+            return self.llm
         try:
             from models.role_router import RoleRouter, Role
             return RoleRouter.get_client(Role.REASONER)  # Cerebras 120B

api/agent.py

@@ -45,7 +45,7 @@ from .auth_guard import require_role, AuthRole
 from pydantic import BaseModel, field_validator
 from typing import Literal
 from .state import (
-    _agent_tasks, _task_checkpoints, _loop_registry, _run_stream_tasks,
+    _agent_tasks, _task_ai_clients, _task_checkpoints, _loop_registry, _run_stream_tasks,
     _prune_agent_tasks, _prune_checkpoints, _prune_loop_registry,
     _get_mem_manager, _get_mem_manager_async, _get_executor, _get_planner, _get_ai_client,
     ReasonLoopIn, AgentTaskIn,
@@ -87,6 +87,21 @@ except Exception:
 router = APIRouter()
 
 
+def _attach_byok_client(task_id: str, credentials: object) -> None:
+    """Create a task-scoped LLM client without persisting or logging credentials."""
+    if credentials is None:
+        return
+    try:
+        runtime_config = credentials.as_runtime_config()
+        if not runtime_config:
+            return
+        from models.ai_client import AIClient
+        _task_ai_clients[task_id] = AIClient(byok_credentials=runtime_config)
+    except Exception as exc:
+        # Never include the payload or credential values in diagnostics.
+        _logger.warning("[agent] unable to initialise BYOK task client: %s", type(exc).__name__)
+
+
 # ── Deprecated run_loop ────────────────────────────────────────────────────────
 
 @router.post('/run_loop', deprecated=True)
@@ -601,6 +616,8 @@ async def create_agent_task(body: AgentTaskIn, role: AuthRole = Depends(require_
 
     # Already in memory → return immediately (normal path, includes S358 reconnect)
     if task_id in _agent_tasks:
+        if task_id not in _task_ai_clients:
+            _attach_byok_client(task_id, body.provider_credentials)
         return {'taskId': task_id, 'status': _agent_tasks[task_id]['status']}
 
     # S359: try Supabase lazy restore (only hit network after backend restart)
@@ -610,6 +627,7 @@ async def create_agent_task(body: AgentTaskIn, role: AuthRole = Depends(require_
         # Use context from the incoming request (not persisted to save space).
         restored['context'] = body.context
         _agent_tasks[task_id] = restored
+        _attach_byok_client(task_id, body.provider_credentials)
         return {'taskId': task_id, 'status': restored['status'], 'restored': True}
 
     # Brand new task
@@ -627,6 +645,10 @@ async def create_agent_task(body: AgentTaskIn, role: AuthRole = Depends(require_
         'persona':           body.persona,           # P17-F5: expertise persona hint
         'session_id':        body.session_id or '',   # P17-F2: BB session key (normalize None→'')
     }
+    # Le credenziali BYOK restano in una mappa runtime separata dai metadata task
+    # e non raggiungono Supabase, checkpoint o buffer SSE.
+    _attach_byok_client(task_id, body.provider_credentials)
+
     # BG-4: restore cross-session handoff context (async, non-blocking)
     if body.session_id:
         _hctx = await sb_restore_handoff_context(body.session_id)
@@ -735,6 +757,7 @@ async def list_agent_tasks(limit: int = 50, status: str = '', role: AuthRole = D
 async def cancel_agent_task(task_id: str, role: AuthRole = Depends(require_role(AuthRole.MACHINE))):  # GAP-1-fix
     if task_id in _agent_tasks:
         _agent_tasks[task_id]['status'] = 'CANCELLED'
+    _task_ai_clients.pop(task_id, None)
     reg = _loop_registry.get(task_id)
     if reg and not reg.get('done'):
         at = reg.get('asyncio_task')
@@ -947,8 +970,9 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
         async def run_loop() -> None:
             try:
                 from agents.unified_loop import UnifiedAgentLoop
-                # S388: singleton — evita OpenAI() per ogni task
-                client = _get_ai_client()
+                # Ogni task BYOK usa il suo client effimero; gli altri mantengono
+                # il singleton runtime. Le credenziali non entrano nel task dict.
+                client = _task_ai_clients.get(task_id) or _get_ai_client()
                 try:
                     from agents.critic import Critic
                     from agents.response_verifier import ResponseVerifier
@@ -1051,11 +1075,20 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
                 _hctx = task.get("_handoff_context", "")
                 if _hctx:
                     context_str = f"{_hctx}\n\n{context_str}".strip()
-                # P17-F5: route primary LLM to persona-appropriate client
-                _persona_client = _get_persona_llm_client(_persona, client)
+                # I router persona dipendono dalle env del backend: con BYOK il
+                # client per task resta autorevole in ogni fase, incluso il planner.
+                _is_byok_task = task_id in _task_ai_clients
+                _persona_client = client if _is_byok_task else _get_persona_llm_client(_persona, client)
+                _planner = _get_planner()
+                if _is_byok_task:
+                    try:
+                        from agents.planner import Planner
+                        _planner = Planner(llm_client=client)
+                    except Exception as exc:
+                        _logger.warning("[agent] BYOK planner fallback: %s", type(exc).__name__)
                 loop = UnifiedAgentLoop(
                     llm_client=_persona_client, critic=_critic, verifier=_verifier,
-                    memory=await _get_mem_manager_async(), executor=_get_executor(), planner=_get_planner(),
+                    memory=await _get_mem_manager_async(), executor=_get_executor(), planner=_planner,
                 )
                 step_idx = [0]
                 _backend_steps: list[dict] = []  # GAP-SYNC-FIX: log step per resume preciso
@@ -1347,6 +1380,9 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
                 asyncio.create_task(_tg_error(task_id, task.get('goal', ''), str(err))).add_done_callback(_log_task_exc)
 
             finally:
+                # Il task è terminale: rimuove l’unico riferimento alle credenziali
+                # BYOK, lasciando replay SSE e metadati senza segreti.
+                _task_ai_clients.pop(task_id, None)
                 reg_entry['done'] = True
                 reg_entry['finished_at'] = time.time()
                 for q in list(reg_entry['subscriber_queues']):

api/state.py

@@ -7,7 +7,7 @@ import os, time, asyncio as _asyncio_mod, json as _json, re as _re
 import logging
 from typing import Optional, Any, AsyncIterator, List, Tuple
 from fastapi import HTTPException, APIRouter, Request, Body
-from pydantic import BaseModel, field_validator
+from pydantic import BaseModel, Field, SecretStr, field_validator
 from .version import RUNTIME_VERSION
 
 _logger = logging.getLogger("api.state")
@@ -128,6 +128,9 @@ SENSITIVE = {
 # ── In-memory stores ──────────────────────────────────────────────────────────
 _mem_fallback: dict[str, dict] = {}
 _agent_tasks: dict[str, dict] = {}
+# Client LLM BYOK associati al task: memoria effimera, mai serializzata nei task,
+# checkpoint, eventi SSE o persistenza Supabase.
+_task_ai_clients: dict[str, Any] = {}
 _run_stream_tasks: dict[str, dict] = {}
 _loop_registry: dict[str, dict] = {}
 _LOOP_REGISTRY_TTL_S: float = 10 * 60
@@ -245,10 +248,13 @@ def _prune_agent_tasks() -> None:
                and now - v.get('created_at', 0) > _AGENT_TASK_TTL_MS]
     for k in expired:
         _agent_tasks.pop(k, None)
+        _task_ai_clients.pop(k, None)
+
     if len(_agent_tasks) > _AGENT_TASK_MAX:
         oldest = sorted(_agent_tasks.items(), key=lambda x: x[1].get('created_at', 0))
         for k, _ in oldest[:len(_agent_tasks) - _AGENT_TASK_MAX]:
             _agent_tasks.pop(k, None)
+            _task_ai_clients.pop(k, None)
 
 def _prune_loop_registry() -> None:
     now = time.time()
@@ -284,6 +290,30 @@ class ReasonLoopIn(BaseModel):
     def coerce_str(cls, v: object) -> str:
         return str(v).strip()[:2000] if v else ""
 
+class ProviderCredentialsIn(BaseModel):
+    """Credenziali LLM BYOK limitate ai provider OpenAI-compatible supportati.
+
+    SecretStr evita l’esposizione accidentale del valore in repr o log Pydantic;
+    as_runtime_config() è l’unico punto che restituisce stringhe al client effimero.
+    """
+    groq: list[SecretStr] = Field(default_factory=list)
+    openrouter: list[SecretStr] = Field(default_factory=list)
+
+    @field_validator('groq', 'openrouter', mode='before')
+    @classmethod
+    def coerce_tokens(cls, value: object) -> list[object]:
+        return value if isinstance(value, list) else []
+
+    def as_runtime_config(self) -> dict[str, list[str]]:
+        credentials: dict[str, list[str]] = {}
+        for provider in ('groq', 'openrouter'):
+            values = [item.get_secret_value().strip() for item in getattr(self, provider)]
+            values = list(dict.fromkeys(value for value in values if value))
+            if values:
+                credentials[provider] = values
+        return credentials
+
+
 class AgentTaskIn(BaseModel):
     goal: str
     context: list[dict] = []
@@ -295,6 +325,7 @@ class AgentTaskIn(BaseModel):
     resume_from_step: Optional[int] = None
     persona: Optional[str] = None
     negative_constraints: Optional[str] = ""
+    provider_credentials: Optional[ProviderCredentialsIn] = None
 
     @field_validator('goal', mode='before')
     @classmethod

models/ai_client.py

@@ -74,8 +74,13 @@ _PROVIDER_DEFS = [
 
 
 class AIClient:
-    def __init__(self) -> None:
-        self.providers = self._load_providers()
+    def __init__(self, byok_credentials: dict[str, list[str]] | None = None) -> None:
+        # Le chiavi BYOK appartengono a un singolo task e vivono solo in questa
+        # istanza: non vengono scritte in env, Supabase, cache semantica o log.
+        self._byok_providers = self._providers_from_byok(byok_credentials or {})
+        # I profili BYOK precedono i provider runtime: la stessa API conserva
+        # comunque il fallback server-side in caso di quota o errore upstream.
+        self.providers = self._byok_providers + self._load_providers()
         self._client_cache: dict[tuple[str, str, str], OpenAI] = {}
         # Round-robin e circuit breaker sono indicizzati per purpose e profilo.
         self._rr_indices: dict[str, int] = {}
@@ -83,6 +88,39 @@ class AIClient:
         self._breaker_threshold = 2
         self._breaker_cooldown_s = 60.0
 
+    @staticmethod
+    def _providers_from_byok(credentials: dict[str, list[str]]) -> list[ProviderConfig]:
+        """Build task-scoped provider profiles from browser BYOK credentials.
+
+        Only known OpenAI-compatible providers are accepted. Values are copied
+        into the transient client instance and intentionally never logged or
+        persisted; empty, malformed and unsupported entries are ignored.
+        """
+        providers: list[ProviderConfig] = []
+        for definition in _PROVIDER_DEFS:
+            raw_tokens = credentials.get(definition["name"], [])
+            if not isinstance(raw_tokens, list):
+                continue
+            seen_tokens: set[str] = set()
+            for raw_token in raw_tokens:
+                if not isinstance(raw_token, str):
+                    continue
+                token = raw_token.strip()
+                if not token or token in seen_tokens:
+                    continue
+                seen_tokens.add(token)
+                providers.append(ProviderConfig(
+                    id=-(10_000 + len(providers)),
+                    name=definition["name"],
+                    api_key=token,
+                    base_url=definition["base_url"],
+                    default_model=os.getenv(definition["model_env"], definition["default_model"]),
+                    tier=definition["tier"],
+                    purpose=definition["purpose"],
+                    profile=f"byok-{len(seen_tokens)}",
+                ))
+        return providers
+
     def _load_providers(self) -> list[ProviderConfig]:
         """Carica la flotta: prova Supabase (tabella `ai_providers`, source of
         truth dichiarata in supabase/migrations/20260711_ai_providers_fleet.sql),
@@ -375,7 +413,7 @@ class AIClient:
         return provider
 
     async def chat(self, messages: list, model: Optional[str] = None, temperature: float = 0.7, max_tokens: int = 4096) -> str:
-        if not self.providers: self.providers = self._load_providers()
+        if not self.providers: self.providers = self._byok_providers + self._load_providers()
         
         # S-CACHE-1: Lookup semantico preventivo
         cached = await get_cached_response(messages)
@@ -464,7 +502,7 @@ class AIClient:
 
     async def stream_chat(self, messages: list, model: Optional[str] = None, temperature: float = 0.7, max_tokens: int = 4096) -> AsyncIterator[str]:
         """Streaming con failover immediato tra i provider configurati."""
-        if not self.providers: self.providers = self._load_providers()
+        if not self.providers: self.providers = self._byok_providers + self._load_providers()
         # Nessun provider configurato: feedback immediato all'utente invece di
         # cadere silenziosamente nel loop vuoto e dare un messaggio generico.
         if not self.providers:

tests/test_ai_client_byok.py

@@ -0,0 +1,56 @@
+import sys
+import types
+import unittest
+from unittest.mock import patch
+
+
+_semantic_cache = types.ModuleType("api.semantic_cache")
+
+
+async def _cache_miss(*_args, **_kwargs):
+    return None
+
+
+async def _cache_noop(*_args, **_kwargs):
+    return None
+
+
+_semantic_cache.get_cached_response = _cache_miss
+_semantic_cache.set_cached_response = _cache_noop
+sys.modules.setdefault("api.semantic_cache", _semantic_cache)
+
+from models.ai_client import AIClient
+
+
+class AIClientByokTests(unittest.TestCase):
+    def test_byok_profiles_are_preferred_and_do_not_require_runtime_environment(self):
+        with patch.object(AIClient, "_load_providers", return_value=[]):
+            client = AIClient(byok_credentials={
+                "groq": [" gsk-primary ", "gsk-primary", "gsk-fallback"],
+                "openrouter": ["sk-or-primary"],
+            })
+
+        self.assertEqual([provider.name for provider in client.providers], [
+            "groq", "groq", "openrouter",
+        ])
+        self.assertEqual([provider.profile for provider in client.providers], [
+            "byok-1", "byok-2", "byok-1",
+        ])
+        self.assertEqual([provider.api_key for provider in client.providers], [
+            "gsk-primary", "gsk-fallback", "sk-or-primary",
+        ])
+        self.assertTrue(all(provider.id < 0 for provider in client.providers))
+
+    def test_unknown_or_malformed_credentials_are_ignored(self):
+        with patch.object(AIClient, "_load_providers", return_value=[]):
+            client = AIClient(byok_credentials={
+                "unsupported": ["secret"],
+                "groq": "not-a-list",  # type: ignore[dict-item]
+                "openrouter": ["", "   "],
+            })
+
+        self.assertEqual(client.providers, [])
+
+
+if __name__ == "__main__":
+    unittest.main()