dev-server: optional LLM relay for bring-your-own-key AI features - #108
Merged
Conversation
drawtonomy generates scenarios in the browser, but browsers cannot call the AI vendors directly: CORS policy differs per vendor and some refuse browser-origin requests. This adds a small forwarding module so the page can post to one same-origin route instead. Supports Anthropic, OpenAI and Gemini. Each vendor's HTTP shape is described in one table, so adding or fixing a vendor touches a single place. The caller's API key travels per request in a header, is used only to build the outgoing call, and is never written to disk, added to the environment, or logged. Gemini takes its key in a header rather than the ?key= query parameter so it cannot land in an access log. Tests use a stub fetch, so they need no network and no key.
The relay answers for its own path and reports back when it did not, so the existing static serving and SPA fallback are reached unchanged for every other request.
README gains a section naming the three supported providers, where to get a key, and what the server does and does not do with it.
DRAWTONOMY_LLM_BASE_URL swaps the host of every vendor URL while keeping the path and headers, so a stand-in server sees exactly what a vendor would. This makes it possible to develop the relay, or exercise the whole generation flow, without a real key and without spending on API calls.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
trim.378B04A1-EE1C-4454-8A87-F53CB4C25F68.MOV
Adds an optional LLM relay to the dev server so browsers can reach LLM APIs (Anthropic / OpenAI / Gemini) without CORS issues. The API key comes from a request header supplied by the page, is used for that request only, and is never logged or stored. Same localhost-only binding as the static server.
POST /api/ai-scenario/llm-relay— forwards to the vendor selected by headerDRAWTONOMY_LLM_BASE_URL— point the relay at a local stand-in for testing