style: automated autofixes from CodeQL workflow

.circleci/cci-agent-setup.yml

@@ -1,37 +0,0 @@
-<<<<<<< HEAD
-version: '2.1'
-
-jobs:
-    test:
-        docker:
-            - image: cimg/node:24.0-browsers
-        steps:
-            - checkout
-            - run: echo "Running example step, please edit this file"
-
-workflows:
-    main:
-        jobs:
-            - test
-=======
-version: "2.1"
-
-jobs:
-    test:
-        docker:
-            - image: cimg/node:24.0-browsers
-        steps:
-            - checkout
-            - run: echo "Running example step, please edit this file"
-
-workflows:
-<<<<<<< HEAD
-  main:
-    jobs:
-      - test
->>>>>>> 64b754cfe (fix(ci): populate cci-agent-setup.yml to fix "root is not an object" error)
-=======
-    main:
-        jobs:
-            - test
->>>>>>> 879e75bcf (style: apply automated autofixes (ruff / prettier / clang-format) [CodeQL Advanced])

.circleci/config.yml

@@ -1,152 +1,148 @@
 version: "2.1"
 
 executors:
-  python311:
-    docker:
-      - image: cimg/python:3.11
-    resource_class: medium
-    environment:
-      PIP_DISABLE_PIP_VERSION_CHECK: "1"
-      PIP_NO_PYTHON_VERSION_WARNING: "1"
-      PYTHONDONTWRITEBYTECODE: "1"
-      PYTHONUNBUFFERED: "1"
+    python311:
+        docker:
+            - image: cimg/python:3.11
+        resource_class: medium
+        environment:
+            PIP_DISABLE_PIP_VERSION_CHECK: "1"
+            PIP_NO_PYTHON_VERSION_WARNING: "1"
+            PYTHONDONTWRITEBYTECODE: "1"
+            PYTHONUNBUFFERED: "1"
 
 commands:
-  restore-pip-cache:
-    steps:
-      - restore_cache:
-          keys:
-            - pip-v1-{{ checksum "requirements-dev.txt" }}-{{ checksum "requirements.txt" }}
-            - pip-v1-{{ checksum "requirements-dev.txt" }}-
-            - pip-v1-
+    restore-pip-cache:
+        steps:
+            - restore_cache:
+                  keys:
+                      - pip-v1-{{ checksum "requirements-dev.txt" }}-{{ checksum "requirements.txt" }}
+                      - pip-v1-{{ checksum "requirements-dev.txt" }}-
+                      - pip-v1-
 
-  save-pip-cache:
-    steps:
-      - save_cache:
-          key: pip-v1-{{ checksum "requirements-dev.txt" }}-{{ checksum "requirements.txt" }}
-          paths:
-            - ~/.cache/pip
+    save-pip-cache:
+        steps:
+            - save_cache:
+                  key: pip-v1-{{ checksum "requirements-dev.txt" }}-{{ checksum "requirements.txt" }}
+                  paths:
+                      - ~/.cache/pip
 
-  install-dev-deps:
-    steps:
-      - run:
-          name: Install Python dependencies
-          command: |
-            python -m pip install --upgrade pip
-            pip install -r requirements-dev.txt
+    install-dev-deps:
+        steps:
+            - run:
+                  name: Install Python dependencies
+                  command: |
+                      python -m pip install --upgrade pip
+                      pip install -r requirements-dev.txt
 
+# Define a job to be invoked later in a workflow.
+# See: https://circleci.com/docs/guides/orchestrate/jobs-steps/#jobs-overview & https://circleci.com/docs/reference/configuration-reference/#jobs
 jobs:
-  lint:
-    executor: python311
-    steps:
-      - checkout
-      - restore-pip-cache
-      - install-dev-deps
-      - save-pip-cache
-      - run:
-          name: ruff
-          command: python -m ruff check tests shared scripts apps/aria/server.py
-      - run:
-          name: black (check)
-          command: python -m black --check tests shared scripts apps/aria/server.py
+    lint:
+        executor: python311
+        steps:
+            - checkout
+            - restore-pip-cache
+            - install-dev-deps
+            - save-pip-cache
+            - run:
+                  name: ruff
+                  command: python -m ruff check tests shared scripts apps/aria/server.py
+            - run:
+                  name: black (check)
+                  command: python -m black --check tests shared scripts apps/aria/server.py
 
-  type-check:
-    executor: python311
-    steps:
-      - checkout
-      - restore-pip-cache
-      - install-dev-deps
-      - save-pip-cache
-      - run:
-          name: mypy (advisory)
-          command: python -m mypy shared scripts function_app.py || true
+    type-check:
+        executor: python311
+        steps:
+            - checkout
+            - restore-pip-cache
+            - install-dev-deps
+            - save-pip-cache
+            - run:
+                  name: mypy (advisory)
+                  command: python -m mypy shared scripts function_app.py || true
 
-  pre-commit:
-    executor: python311
-    steps:
-      - checkout
-      - restore-pip-cache
-      - install-dev-deps
-      - save-pip-cache
-      - restore_cache:
-          keys:
-            - pre-commit-v1-{{ checksum ".pre-commit-config.yaml" }}
-            - pre-commit-v1-
-      - run:
-          name: pre-commit on changed files
-          command: |
-            if git rev-parse HEAD^ >/dev/null 2>&1; then
-              CHANGED=$(git diff --name-only --diff-filter=ACMRT HEAD^ HEAD --)
-            else
-              CHANGED=$(git diff-tree --no-commit-id --name-only -r HEAD)
-            fi
-            if [ -z "$CHANGED" ]; then
-              echo "No changed files; skipping."
-              exit 0
-            fi
-            pre-commit run --files $CHANGED --show-diff-on-failure --color=always
-      - save_cache:
-          key: pre-commit-v1-{{ checksum ".pre-commit-config.yaml" }}
-          paths:
-            - ~/.cache/pre-commit
+    pre-commit:
+        executor: python311
+        steps:
+            - checkout
+            - restore-pip-cache
+            - install-dev-deps
+            - save-pip-cache
+            - restore_cache:
+                  keys:
+                      - pre-commit-v1-{{ checksum ".pre-commit-config.yaml" }}
+                      - pre-commit-v1-
+            - run:
+                  name: pre-commit on changed files
+                  command: |
+                      if git rev-parse HEAD^ >/dev/null 2>&1; then
+                        CHANGED=$(git diff --name-only --diff-filter=ACMRT HEAD^ HEAD --)
+                      else
+                        CHANGED=$(git diff-tree --no-commit-id --name-only -r HEAD)
+                      fi
+                      if [ -z "$CHANGED" ]; then
+                        echo "No changed files; skipping."
+                        exit 0
+                      fi
+                      pre-commit run --files $CHANGED --show-diff-on-failure --color=always
+            - save_cache:
+                  key: pre-commit-v1-{{ checksum ".pre-commit-config.yaml" }}
+                  paths:
+                      - ~/.cache/pre-commit
 
-  unit-test:
-    executor: python311
-    parallelism: 2
-    steps:
-<<<<<<< HEAD
+    unit-test:
+        executor: python311
+        parallelism: 2
+        steps:
             - checkout
-            - run: echo "Running example step, please edit this file"
-version: "2.1"
-=======
-      - checkout
-      - restore-pip-cache
-      - install-dev-deps
-      - save-pip-cache
-      - run:
-          name: Run unit tests
-          environment:
-            CI: "true"
-            AZURE_CLIENT_ID: ""
-            AZURE_TENANT_ID: ""
-            AZURE_CLIENT_SECRET: ""
-            OPENAI_API_KEY: ""
-          command: |
-            mkdir -p data_out
-            TEST_FILES=$(circleci tests glob "tests/**/*.py" \
-              | grep -Ev "test_ui_(playwright|pyppeteer|selenium)\.py" \
-              | circleci tests split --split-by=timings)
-            python -m pytest $TEST_FILES \
-              -q --tb=short \
-              -m "not slow and not azure and not integration" \
-              --maxfail=1 \
-              --durations=10 \
-              --junitxml=data_out/junit-${CIRCLE_NODE_INDEX}.xml \
-              --cov=shared --cov=scripts \
-              --cov-report=xml:data_out/coverage-${CIRCLE_NODE_INDEX}.xml
-      - store_test_results:
-          path: data_out
-      - store_artifacts:
-          path: data_out
-          destination: test-output
+            - restore-pip-cache
+            - install-dev-deps
+            - save-pip-cache
+            - run:
+                  name: Run unit tests
+                  environment:
+                      CI: "true"
+                      AZURE_CLIENT_ID: ""
+                      AZURE_TENANT_ID: ""
+                      AZURE_CLIENT_SECRET: ""
+                      OPENAI_API_KEY: ""
+                  command: |
+                      mkdir -p data_out
+                      TEST_FILES=$(circleci tests glob "tests/**/*.py" \
+                        | grep -Ev "test_ui_(playwright|pyppeteer|selenium)\.py" \
+                        | circleci tests split --split-by=timings)
+                      python -m pytest $TEST_FILES \
+                        -q --tb=short \
+                        -m "not slow and not azure and not integration" \
+                        --maxfail=1 \
+                        --durations=10 \
+                        --junitxml=data_out/junit-${CIRCLE_NODE_INDEX}.xml \
+                        --cov=shared --cov=scripts \
+                        --cov-report=xml:data_out/coverage-${CIRCLE_NODE_INDEX}.xml
+            - store_test_results:
+                  path: data_out
+            - store_artifacts:
+                  path: data_out
+                  destination: test-output
 
-  ci-gate:
-    docker:
-      - image: cimg/base:stable
-    resource_class: small
-    steps:
-      - run: echo "All required CI jobs passed."
+    ci-gate:
+        docker:
+            - image: cimg/base:stable
+        resource_class: small
+        steps:
+            - run: echo "All required CI jobs passed."
 
 workflows:
-  ci:
-    jobs:
-      - lint
-      - type-check
-      - pre-commit
-      - unit-test
-      - ci-gate:
-          requires:
+    ci:
+        jobs:
             - lint
-            - unit-test
+            - type-check
             - pre-commit
->>>>>>> 625f1806b (ci: optimize CircleCI config with Python image, caching, and parallel jobs)
+            - unit-test
+            - ci-gate:
+                  requires:
+                      - lint
+                      - unit-test
+                      - pre-commit

.github/instructions/chat-providers.instructions.md

@@ -10,10 +10,12 @@ Order matters — first match wins:
 
 1. **Explicit choice** — `--provider` flag or API parameter
 2. **LMStudio** — if `LMSTUDIO_BASE_URL` is set
-3. **Azure OpenAI** — needs ALL 4: `AZURE_OPENAI_API_KEY`, `AZURE_OPENAI_ENDPOINT`, `AZURE_OPENAI_DEPLOYMENT`, `AZURE_OPENAI_API_VERSION`
-4. **OpenAI** — needs `OPENAI_API_KEY`
-5. **LoRA** — explicit `--provider lora` with adapter path
-6. **Local echo** — zero-dependency fallback with context-aware intent recognition
+3. **Ollama** — if `OLLAMA_BASE_URL` is set (or auto-detected at `http://127.0.0.1:11434/v1`)
+4. **Azure OpenAI** — needs ALL 4: `AZURE_OPENAI_API_KEY`, `AZURE_OPENAI_ENDPOINT`, `AZURE_OPENAI_DEPLOYMENT`, `AZURE_OPENAI_API_VERSION`
+5. **OpenAI** — needs `OPENAI_API_KEY`
+6. **Groq** — needs `GROQ_API_KEY`; auto-detected by probing `https://api.groq.com/openai/v1/models`
+7. **LoRA** — explicit `--provider lora` with adapter path
+8. **Local echo** — zero-dependency fallback with context-aware intent recognition
 
 ## Provider Contract (BaseChatProvider)
 
@@ -27,6 +29,15 @@ class BaseChatProvider:
 
 ## Key Implementations
 
+### GroqProvider
+
+- OpenAI-compatible provider for Groq cloud inference
+- Requires `GROQ_API_KEY` (get one at https://console.groq.com/keys)
+- Default model: `llama-3.1-8b-instant`; override with `GROQ_MODEL` or `--model`
+- Default endpoint: `https://api.groq.com/openai/v1`; override with `GROQ_BASE_URL`
+- Thread-safe availability cache (`_groq_availability_cache`, 30 s TTL)
+- Friendly error messages for auth failures, connection errors, and model-not-found
+
 ### LoraLocalProvider
 
 - Bridges torch + subprocess for local LoRA inference

.github/rulesets/main-default-automation.ruleset.json

@@ -34,10 +34,6 @@
             }
         },
         {
-            // Merge queue: prevents the thundering-herd problem when many
-            // auto-merge labeled PRs all become mergeable simultaneously.
-            // Requires enabling the merge queue in repository Settings → General
-            // → Pull Requests → "Allow merge queue" (UI-only setting).
             "type": "merge_queue",
             "parameters": {
                 "check_response_timeout_minutes": 60,
@@ -49,18 +45,6 @@
                 "min_entries_to_merge_wait_minutes": 5
             }
         }
-
-        // Optional hardening rules (enable when policy-ready):
-        // ,{ "type": "required_linear_history" }
-        // ,{ "type": "required_signatures" }
     ],
-    "bypass_actors": [
-        // Preferred: keep empty for strict mode, OR define a tightly scoped audited bypass.
-        // Example team bypass (replace IDs/types with real values):
-        // {
-        //   "actor_id": 1234567,
-        //   "actor_type": "Team",
-        //   "bypass_mode": "pull_request"
-        // }
-    ]
+    "bypass_actors": []
 }

.github/workflows/code-coverage.yml

@@ -0,0 +1 @@
+