refactor: remove land records tools, enhance RERA API integration

[parthashirolkar]

Summary

This PR refactors the tooling layer by removing the problematic Mahabhulekh land records integration and significantly enhancing the MahaRERA tooling with proper API authentication.

Changes

Removed

• land_records_tools.py - Removed Mahabhulekh 7/12 extract and property card scraping (unreliable, CAPTCHA issues)
• ROADMAP.md - Removed outdated roadmap file
• data/land_records_cache.json - Removed cache file for land records

Added

• agent.py - New dedicated agent setup module for cleaner code organization
• geocode_address function to GIS tools for address geocoding
• MahaRERA SPA API integration with AES encryption for secure credential handling
• Comprehensive test suite (30 unit tests covering geo, GIS, RERA, transit, and regulatory tools)
• langgraph.json and opencode.json - Configuration files

Enhanced

• rera_tools.py - Now uses the official MahaRERA SPA API with encrypted login credentials
• main.py - Updated to use new agent module and reflect tool changes
• subagents/definitions.py - Updated to remove land records references
• pyproject.toml - Updated dependencies

Testing

All tests pass:

• ✅ 30 unit tests (non-live)
• ✅ All ruff linting checks

Migration Notes

The title-verifier subagent has been removed from the workflow. Title verification functionality will need to be addressed through alternative means (manual or third-party API) in future iterations.

[parthashirolkar]

/oc review this PR

[opencode-agent]

Here's my review of this PR:

---

PR Review: refactor: remove land records tools, enhance RERA API integration

Overall Assessment

The PR is well-structured and achieves its stated goals. The removal of the unreliable Mahabhulekh scraper is reasonable, the new RERA SPA API integration with CryptoJS-compatible encryption is a solid addition, and the test suite is comprehensive. However, there are several issues that should be addressed before merging.

---

Critical Issues

1. Duplicated code between agent.py and main.py

agent.py (new) and main.py both define nearly identical SYSTEM_PROMPT, ALL_TOOLS lists, and imports. This is a maintenance hazard — they will drift apart (they already have). The agent.py module should be the single source of truth and main.py should import from it.

2. Stale references to removed functionality in main.py

main.py:20-21 still says:

"regulatory, spatial, and title data"

And main.py:45:

"GIS and land records data are for preliminary screening only"

But the title verifier and land records tools were removed. The agent.py version correctly omits these references. This inconsistency suggests main.py wasn't fully updated.

3. DEFAULT_TIMEOUT_SECS redefined in gis_tools.py

gis_tools.py:22 sets DEFAULT_TIMEOUT_SECS = 15 (for Nominatim), then gis_tools.py:131 redefines it to 30 (for PMRDA). The second assignment shadows the first, so the Nominatim geocoding function _geocode_sync at line 87 will use timeout=30 instead of the intended timeout=15. Use separate constants (e.g., NOMINATIM_TIMEOUT and PMRDA_TIMEOUT).

4. Module-level side effect in agent.py

agent.py:93 calls init_udcpr_store() at module scope. This means importing agent.py triggers ChromaDB initialization, which is unexpected and makes testing harder. This should be deferred to an explicit initialization function.

---

Security Concerns

5. Hardcoded credentials in rera_tools.py

rera_tools.py:39-41:

CRYPTOJS_KEY = "sdjhfsdkjgkls74385385"
_PUBLIC_USERNAME = "@maharera_public_view"
_PUBLIC_PASSWORD = "Maharera!@$1"

While these appear to be shared public-view credentials (not user-specific), they should be moved to environment variables. The CryptoJS key in particular is a secret that should not be in source control.

---

Minor Issues

6. Model change in config.py

CHAT_MODEL was changed from qwen/qwen3.6-plus:free to stepfun/step-3.5-flash:free with the old value commented out. This is a behavioral change that deserves mention in the PR description — it affects all agent interactions.

7. Token caching is not thread-safe

rera_tools.py:43-44 uses module globals _cached_token / _token_issued_at without locking. Fine for single-threaded async, but worth a note if this ever runs in a multi-threaded context.

8. Live tests only, no mocked tool tests

All tool-level tests are @pytest.mark.live (hitting real APIs). The unit tests only cover helper functions (_centroid, haversine_km, crypto). Adding mocked HTTP tests for the actual tool functions would improve CI reliability and speed.

9. Integration test URL matching inconsistency

test_rera_tools.py:140 and test_integration.py:51 check for "projectView" in URLs, but _extract_project_id matches /public/project/view/. These are different patterns — the tests may skip or fail depending on what the API returns.

---

Suggestions

• Deduplicate SYSTEM_PROMPT / ALL_TOOLS by having main.py import from agent.py
• Extract hardcoded credentials to env vars via tools/config.py
• Rename the duplicate DEFAULT_TIMEOUT_SECS to layer-specific constants
• Move init_udcpr_store() out of module scope in agent.py
• Add the model change to the PR description

Verdict

Request changes on items #1-3 (duplication, stale text, timeout shadowing) and #5 (hardcoded credentials). The rest are suggestions for follow-up.

opencode session  |  github run

[parthashirolkar]

/oc check if the issues you've raised have been fixed now

[opencode-agent]

Here's the status of all 9 review issues:

Critical / Requested Changes — All Fixed ✅

#	Issue	Status
1	Duplicated code between agent.py and main.py	✅ Fixed — main.py:15 now imports ALL_SUBAGENTS, ALL_TOOLS, SYSTEM_PROMPT from agent.py
2	Stale references to "title data" / "land records" in main.py	✅ Fixed — main.py no longer has its own prompt; imports from agent.py
3	DEFAULT_TIMEOUT_SECS shadowing in gis_tools.py	✅ Fixed — Now uses separate NOMINATIM_TIMEOUT = 15 (line 21) and PMRDA_TIMEOUT = 30 (line 112)
4	Module-level init_udcpr_store() in agent.py	✅ Fixed — Deferred to explicit initialize_udcpr_store() function (line 91), called from main.py:40
5	Hardcoded credentials in rera_tools.py	✅ Fixed — Now reads from env vars via tools/config.py:16-20 with defaults as fallback

Suggestions / Minor — Not Addressed

#	Issue	Status
6	Model change undocumented in PR	Not addressed (low priority)
7	Token caching not thread-safe	Not addressed (minor)
8	No mocked HTTP tests, only live	Not addressed
9	URL matching inconsistency	Not fixed — Tests at test_rera_tools.py:149,172 and test_integration.py:164 check for "projectView" in URLs, but _extract_project_id matches /public/project/view/. These are different strings — the test filter will never match real URLs, causing tests to skip or find None

Issue #9 is a real bug that should be fixed — the test filter should use "public/project/view/" instead of "projectView" to match the actual URL format produced by the scraper.

opencode session  |  github run