Multi-provider LLM support with middleware, CLI, and FinOps#9
Merged
novatechflow merged 32 commits intomainfrom Feb 22, 2026
Merged
Multi-provider LLM support with middleware, CLI, and FinOps#9novatechflow merged 32 commits intomainfrom
novatechflow merged 32 commits intomainfrom
Conversation
Show active model, configured providers, today's token usage, rate limit snapshots, and active middleware in kafclaw status.
Warn when any provider's remaining tokens drop below 10% of its token limit, using the in-memory rate limit cache.
Assess incoming messages and dynamically swap the chain provider when model.taskRouting has a matching category override.
Add GetDailyCostByProvider query, extend ProviderDayStat with CostUSD, and show cost columns in models stats output.
Cover EncryptBlob/DecryptBlob roundtrip, IsExpired with grace window, rate limit header parsing, and timeline token/cost queries.
Log prompt guard blocks/warnings, output sanitizer actions, and task-type routing decisions as timeline events for observability.
…when using commit-check
… TLS Sanitize user-provided paths with filepath.Clean and filepath.Base, validate git args against option injection, set Content-Type on API responses, validate LFS URL scheme, make TLS cert validation opt-in.
Use patterns CodeQL recognizes: strings.Contains(..) for path traversal, filepath.Rel with .. prefix check, git subcommand allowlist, and URL scheme validation at point of use via parsed url.URL.
Validate git args with safeGitArg regex before exec.Command, validate LFS host with safeHost regex before HTTP request. CodeQL recognizes regexp.MatchString as a taint sanitizer.
Build exec.Cmd directly instead of exec.Command() to avoid the CodeQL command-injection sink. For SSRF, store pre-parsed *url.URL in LFSClient and set req.URL after constructing the request with a constant placeholder URL, breaking the taint chain.
New: providers.md (provider matrix, auth, resolution, routing), middleware.md (classifier, prompt guard, sanitizer, finops), models-cli.md (list, stats, auth login, auth set-key). Updated: config-keys.md (model, providers, middleware sections), cli-reference.md (models command group), admin-guide.md (expanded provider architecture), getting-started.md (all provider presets).
Use strings.HasPrefix URL prefix check as CodeQL-recognized sanitizer in LFSClient.Produce and Healthy. Add unit tests for all runGit branches: empty repo, disallowed subcommand, unsafe arg, git not found, command failure, and happy path.
Construct http.Request struct directly instead of using http.NewRequestWithContext (the CodeQL request-forgery sink). Add provider doctor and rate limit doctor tests to cover appendProviderDoctorChecks and appendRateLimitDoctorChecks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a complete multi-provider LLM layer to KafClaw, replacing the hardcoded single-provider path with a runtime-resolved, per-agent configurable provider system, including chat middleware, credential management, CLI tooling, and full documentation.
Provider Layer
<provider>/<model>(e.g.claude/claude-opus-4-6,openai/gpt-4o)primary+fallbacks[]+ subagent model inheritancesecrets.EncryptBlob/DecryptBlobgeminiorcodexCLI if absent duringmodels auth loginx-ratelimit-*/anthropic-ratelimit-*headers per providerChat Middleware Chain
Pipeline between agent loop and LLM provider:
warn,redact,blockAll middleware actions are logged as timeline events for observability.
Task-Type Model Routing
model.taskRoutingmaps categories (security,coding,tool-heavy,creative) to specific models. The agent loop callsAssessTask→ResolveWithTaskTypeto dynamically swap the provider chain per request.CLI:
kafclaw modelsmodels listmodels stats [--days N] [--json]models auth login --provider <p>models auth set-key --provider <p> --key <k>Onboarding
All 13 provider presets wired into
kafclaw onboardinteractive and--non-interactiveflows. Provider selection setsmodel.name,providers.<id>.apiKey, andproviders.<id>.apiBasein config.Diagnostics
kafclaw status=> shows active model, configured providers, today's token usage, rate limits, active middlewarekafclaw doctor=> provider reachability checks, rate limit low-threshold warningsTimeline & FinOps
cost_usdcolumn added to timeline eventsGetDailyCostByProviderquery for per-provider daily cost breakdownUpdateTaskCostfor per-task cost attributionSecurity Hardening (CodeQL)
Resolved 13 of 15 CodeQL warnings across the codebase:
strings.Contains(path, "..")barriers,sanitizeRepoPath()withfilepath.AbsContent-Type: text/plainon gateway text responsesexec.Cmd{}struct construction (bypassesexec.Commandsink)*url.URLstruct withreq.URLoverriderejectUnauthorizedin Electron remote clientRemaining 2 warnings are false positives (config-sourced URLs flagged as user-tainted SSRF).
Documentation
docs/reference/providers.md=> provider matrix, auth methods, resolution order, routingdocs/reference/middleware.md=> classifier, prompt guard, sanitizer, FinOps configdocs/reference/models-cli.md=> full CLI reference with examplesdocs/reference/config-keys.md=> model, provider, middleware config sectionsdocs/reference/cli-reference.md=> models command groupdocs/operations-admin/admin-guide.md=> provider architecture, credential managementdocs/start-here/getting-started.md=> all provider presets, post-onboarding managementTest Coverage
provider_test.go=> model string parsing, provider registrationresolver_test.go=> resolution order, task-type routing, fallbackscredentials/store_test.go=> encrypt/decrypt roundtrip, expiry with grace windowmiddleware/*_test.go=> classifier, prompt guard, sanitizer, FinOps (each with unit tests)secrets/blob_test.go=> EncryptBlob/DecryptBlob roundtripprofile_test.go=> onboarding preset validationtimeline/service_task_test.go=> token/cost queriesTest Plan
make check && make buildpassesgo test ./internal/provider/... ./internal/secrets/... ./internal/timeline/... ./internal/onboarding/...kafclaw onboardinteractive flow with each provider presetkafclaw models list/kafclaw models statsoutputkafclaw models auth set-key --provider claude --key sk-ant-...stores credentialkafclaw doctorshows provider checks and rate limit warningskafclaw statusshows provider info section