Catalog refactor and security/quality hardening pass (#59)

* feat: add Poolside provider (constant, profile, detection order, env keys)

* feat: wire Groq and Poolside providers end-to-end (config, registry, deployment, onboarding)

* refactor: consolidate version into root version.go with //go:embed VERSION

- Remove broken internal/version/ package (embedding stale 0.1.0 copy)
- Add root version.go with //go:embed VERSION (resolves to root VERSION)
- Revert client/client.go to SetVersion pattern (version set by root init)
- Remove legacy migration code (migrate.go, EnsureDeploymentConfigV2, etc.)
- Add deploymentOwnerProviderID for poolside/groq-direct routing

* fix: update Poolside default base URL to inference.poolside.ai

api.poolside.ai does not resolve — Poolside runs on Baseten
(inference.poolside.ai). Verified with curl that models endpoint
returns available models (laguna-m.1, laguna-xs.2).

* fix: add live fetcher functions for Poolside and Groq

Both providers were missing FetchPoolside and FetchGroq functions
and were not registered in the live.Registry map, causing
'live: unknown fetcher' errors during catalog discovery.

Also updates the parity test assertion from 19 to 21 providers.

* test: add live fetcher tests for Poolside and Groq

Adds mock HTTP server tests, no-key tests, and JSON parsing tests
for both FetchPoolside and FetchGroq, following the same pattern
as existing provider tests (grok, kimi, etc.).

* feat: add ClinePass provider

Adds ClinePass as an OpenAI-compatible provider using the
https://api.cline.bot/api/v1 endpoint with CLINE_API_KEY auth.

Wires through all layers: provider spec, env config, profile,
runtime profile, routing, live fetcher, client registry,
compat config, deployment, and tests.

* fix: set ClinePass probe to ProbeNone, use curated model list

Cline API does not expose a GET /models endpoint, so credential
probing fails with HTTP 404. Changed ProbeKind to ProbeNone (key
is saved without validation). Live fetcher returns a curated
static list of 10 known ClinePass models instead of hitting the
API.

* feat: add Poolside Laguna M.1 free model to ClinePass curated list

* feat: use ClinePass reference pricing, poolside stays free

* fix: add missing legacyDeploymentAndOwner entries for ClinePass, Poolside, Groq, MiniMax

* Catalog refactor and security/quality hardening pass

- Add fuzz CI job for guardrails, message sanitization, and cache-key
  fuzz targets
- Catalog v1 spec parsing, provider discovery/refresh, live enrichment,
  and deployment routing refactor
- Remove deprecated legacy catalog shim

* Apply gofumpt formatting to satisfy CI format check

Author: Patel230

.github/workflows/ci.yml

@@ -248,7 +248,28 @@ jobs:
           markdownlint-cli2 '**/*.md'
 
   # -------------------------------------------------------------------------
-  # 9. Cross-platform build matrix — zero CGO, all targets.
+  # 9. Fuzz the message-sanitization and cache-key helpers that consume
+  #    untrusted/adversarial LLM conversation content.
+  # -------------------------------------------------------------------------
+  fuzz:
+    name: fuzz (60s)
+    runs-on: ubuntu-latest
+    needs: [test]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Run fuzz targets
+        run: |
+          go test -fuzz=FuzzSanitizeMessages       -fuzztime=60s ./client
+          go test -fuzz=FuzzMergeConsecutiveRoles  -fuzztime=60s ./client
+          go test -fuzz=FuzzBuildCacheKey          -fuzztime=60s ./client
+          go test -fuzz=FuzzGuardrailsCheck        -fuzztime=60s ./client
+
+  # -------------------------------------------------------------------------
+  # 10. Cross-platform build matrix — zero CGO, all targets.
   # -------------------------------------------------------------------------
   build:
     name: build (${{ matrix.goos }}/${{ matrix.goarch }})

catalog/live/fetchers_providers.go

@@ -621,7 +621,7 @@ func FetchClinePass(env map[string]string) ([]Entry, error) {
 		{"cline-pass/mimo-v2.5-pro", "MiMo V2.5 Pro", "xiaomi", 131072, 8192, 1.74, 3.48},
 		{"cline-pass/mimo-v2.5", "MiMo V2.5", "xiaomi", 131072, 8192, 0.14, 0.28},
 		{"cline-pass/qwen3.7-max", "Qwen 3.7 Max", "qwen", 131072, 8192, 2.50, 7.50},
-		{"cline-pass/qwen3.7-plus", "Qwen 3.7 Plus", "qwen", 131072, 8192, 0.40, 1.60},
+		{"cline-pass/qwen3.7-plus", "Qwen 3.7 Plus", "qwen", 131072, 8192, 0.40, 1.28},
 		{"cline-pass/poolside-laguna-m.1-free", "Poolside Laguna M.1 (Free)", "poolside", 262144, 32768, 0, 0},
 	}
 	var entries []Entry

catalog/registry/providers.go

@@ -174,23 +174,31 @@ func providerSpecs() []ProviderSpec {
 			BaseURLEnv: []string{"POOLSIDE_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeOpenAIModels, ProbeBaseURL: "https://inference.poolside.ai/v1",
 			LiveFetcherKey: "poolside", LiveCatalogKey: "poolside",
-			ProtocolID: "openai-chat-completions", AdapterID: "poolside", RuntimeProfileKey: "poolside",
+			APIProtocolID: "openai-chat-completions", AdapterID: "poolside", RuntimeProfileKey: "poolside",
 		},
 		{
 			ProviderID: "groq", DisplayName: "Groq", DeploymentID: "groq-direct", SortOrder: 19, ChatPreference: 21,
 			RequiresKey: true, CredentialEnv: "GROQ_API_KEY",
 			BaseURLEnv: []string{"GROQ_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeOpenAIModels, ProbeBaseURL: "https://api.groq.com/openai/v1",
 			LiveFetcherKey: "groq", LiveCatalogKey: "groq",
+<<<<<<< HEAD
+			APIProtocolID: "openai-chat-completions", AdapterID: "groq", RuntimeProfileKey: "groq",
+=======
 			ProtocolID: "openai-chat-completions", AdapterID: "groq", RuntimeProfileKey: "groq",
+>>>>>>> origin/main
 		},
 		{
 			ProviderID: "clinepass", DisplayName: "ClinePass", DeploymentID: "clinepass", SortOrder: 20, ChatPreference: 22,
 			RequiresKey: true, CredentialEnv: "CLINE_API_KEY",
 			BaseURLEnv:     []string{"CLINE_API_BASE", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:      ProbeNone,
 			LiveFetcherKey: "clinepass", LiveCatalogKey: "clinepass",
+<<<<<<< HEAD
+			APIProtocolID: "openai-chat-completions", AdapterID: "clinepass", RuntimeProfileKey: "clinepass",
+=======
 			ProtocolID: "openai-chat-completions", AdapterID: "clinepass", RuntimeProfileKey: "clinepass",
+>>>>>>> origin/main
 		},
 		{
 			ProviderID: "opencodego", DisplayName: "OpenCode Go", DeploymentID: "opencodego", SortOrder: 21, ChatPreference: 13,

catalog/xiaomi/platform.go

@@ -14,6 +14,11 @@ import (
 // Inference GET {base}/models only returns id/object/owned_by.
 const DefaultPlatformModelsURL = "https://platform.xiaomimimo.com/api/v1/models"
 
+// maxPlatformResponseBytes caps how much of the platform catalog response is
+// read, so a malicious or misconfigured endpoint (including the env-overridable
+// XIAOMI_MIMO_PLATFORM_MODELS_URL) cannot exhaust memory via an unbounded body.
+const maxPlatformResponseBytes = 10 * 1024 * 1024 // 10 MiB
+
 var platformHTTPClient = &http.Client{Timeout: 30 * time.Second}
 
 // PlatformModel is one row from the platform catalog API.
@@ -65,7 +70,7 @@ func FetchPlatformModelsIndex(ctx context.Context, catalogURL string) (map[strin
 		return nil, fmt.Errorf("xiaomi platform catalog: %w", err)
 	}
 	defer func() { _ = resp.Body.Close() }()
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxPlatformResponseBytes))
 	if err != nil {
 		return nil, err
 	}