Make the AI provider a manual choice and Amazee.ai strictly opt-in - #50
Merged
Merged
Conversation
ensure_ai_available() constructed a trial provisioner and minted a free trial whenever it found an empty credential store, so any request, cron or install path that called it enrolled a site that had never opted in. That branch is gone; the method now matches the PHP core exactly, self-healing credentials that are already stored and establishing nothing. The provider default of 'anthropic' and the two coalescings that restored it are gone too. Empty means AI is off rather than Anthropic: the service adapter refuses to build a client, AiClient rejects an absent provider, and health reports ai_provider_selected: False. Sites keep any provider they already saved. Which action established an Amazee connection is now recorded through a new ProvenanceAwareConfigStorage, so a demo and an operator's own account are distinguishable from a stored fact rather than from a guess.
SummaryRemoves AI provider auto-selection and Amazee.ai auto-enrollment: Type: refactor Walkthrough
Related Issues & PRsNo related issues identified. AI Review Summary — generated by ai-pr-review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Review: Approved
No findings above the confidence threshold. The changes look good.
Token usage by agent
| Agent | Model | Input | Output | Cache Write | Cache Read | Total | Est. Cost |
|---|---|---|---|---|---|---|---|
| code-reviewer | Sonnet 5 | 1 | 448 / 16384 | 41332 | 0 | 41781 | $0.1617 |
| silent-failure-hunter | Sonnet 5 | 1 | 777 / 16384 | 39844 | 0 | 40622 | $0.1610 |
| Total | 2 | 1225 | 81176 | 0 | 82403 | $0.3227 | |
| Context enrichment | (context) | 8204 | — | — | — | — | — |
| Language profiles | (profile) | 1021 | — | — | — | — | — |
AI Review — generated by ai-pr-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed here
AutoProvisioner.ensure_ai_available()constructed anAmazeeTrialProvisionerand minted a free trial whenever it found an empty credential store, so any request, cron or install path that called it enrolled a site that had never opted in. That branch is deleted; the method now matches the PHP core exactly — it self-heals credentials that are already stored and establishes nothing. Its return value is consequently alwaysFalse(there is no success left to report); the signature is unchanged so callers keep working, and a caller that branched onTrueshould move that branch to its own explicitprovision()call.Alongside:
ScoltaConfig.ai_providerdefaults to"",HealthCheckerno longer coalesces it and gainsai_provider_selected,AiClientrejects an absent provider instead of quietly becoming Anthropic, andAiServiceAdapter._get_client()refuses to build a client with no provider — raising theApiKeyMissingExceptioncallers already degrade on. NewAmazeeConnectionSourceandProvenanceAwareConfigStoragemirror the PHP core.The policy
A — no default provider. Selection is always manual. Nothing ships with an AI provider selected, and while none is selected AI features are simply off: search still works, no provider is assumed, and Anthropic in particular is not silently assumed.
B — Amazee.ai is never auto-enabled. No credential is provisioned and no outbound Amazee call is made on a request, cron, install or activation path for a site that has not opted in. The only automatic Amazee activity permitted is re-resolving gateway model names against a key already on disk, which only a site that already connected can reach.
Migration is going-forward only. A provider already persisted by a site is read as-is — nothing rewrites, clears or re-defaults it, and there is no update hook that turns AI off on a working install.
Amazee is email-only
Connecting is two explicit actions, mirroring amazee.ai's own
ai_provider_amazeeiomodule:There is deliberately no paste-your-API-key path. amazee.ai issues and manages the keys; a second credential scheme would have nothing behind it.
Provenance
Which of the two actions established a connection is recorded when it happens, so surfaces report a stored fact instead of a guess. scolta-php#273 collapsed the two Amazee source cases because nothing recorded which had run — recording it is the fix, rather than guessing or giving up. Credentials connected before this release report the origin-free
Amazeesource and claim nothing.Dependency
Requires the core changes in scolta-php#275, already merged to
main. CI resolvestag1/scolta-phpfromdev-main, so this is testable now. The committedcomposer.lockstays pinned at the stable release — bumping it is release-time work, not part of this PR.Tests
822 tests, ruff clean. New
tests/ai/amazee/test_manual_provider_and_opt_in.pyuses a transport that fails the test if it is called at all, so an unexpected outbound Amazee request names the endpoint rather than being swallowed. Two tests that asserted the old first-use mint behaviour are replaced by tests asserting its absence; the self-heal test now drives an explicitprovision()for its setup, sinceensure_ai_available()no longer establishes anything.