fix: honor resolved local paths and redact cache keys

Author: leehack

lib/src/core/engine/engine.dart

@@ -203,15 +203,13 @@ class LlamaEngine {
             'Explicit local model paths are not supported by URL-loading backends.',
           );
         }
-        if (source.isLocal) {
-          final entry = await modelDownloadManager.ensureModel(
-            source,
-            options: options,
-            onProgress: onProgress,
-          );
-          return loadModel(entry.filePath, modelParams: modelParams);
-        }
-        return loadModel(path, modelParams: modelParams);
+        final localSource = ModelSource.path(path);
+        final entry = await modelDownloadManager.ensureModel(
+          localSource,
+          options: options,
+          onProgress: onProgress,
+        );
+        return loadModel(entry.filePath, modelParams: modelParams);
       case RemoteModelUrl(:final url, :final useBrowserCache):
         if (!useBrowserCache) {
           throw LlamaUnsupportedException(

lib/src/core/models/download/model_download_manager_base.dart

@@ -309,13 +309,19 @@ int? _optionalInt(Object? value) {
 }
 
 String _metadataSafeSourceKey(String sourceCanonicalKey, String cacheKey) {
-  final candidate = sourceCanonicalKey.startsWith('url:')
-      ? sourceCanonicalKey.substring('url:'.length).split('#').first
+  final isUrlKey = sourceCanonicalKey.startsWith('url:');
+  final candidate = isUrlKey
+      ? sourceCanonicalKey
+            .substring('url:'.length)
+            .split('#')
+            .first
+            .split(RegExp(r'\s'))
+            .first
       : sourceCanonicalKey;
 
   final uri = Uri.tryParse(candidate);
   if (uri == null || (uri.scheme != 'http' && uri.scheme != 'https')) {
-    return sourceCanonicalKey;
+    return isUrlKey ? 'url:<redacted>#cacheKey=$cacheKey' : sourceCanonicalKey;
   }
 
   final redactedUri = Uri(

test/unit/core/engine/engine_test.dart

@@ -408,12 +408,45 @@ void main() {
         await nativeEngine.loadModelSource(source, options: options);
 
         expect(downloadManager.ensureModelCalls, 1);
-        expect(downloadManager.lastSource, source);
+        expect(downloadManager.lastSource?.path, source.path);
+        expect(downloadManager.lastSource?.cacheKey, source.cacheKey);
         expect(downloadManager.lastOptions, same(options));
         expect(nativeBackend.lastModelPath, '/models/model.gguf');
       },
     );
 
+    test(
+      'native loadModelSource honors resolver-provided local path',
+      () async {
+        final source = ModelSource.path('/models/original.gguf');
+        final resolvedSource = ModelSource.path('/models/resolved.gguf');
+        final entry = ModelCacheEntry(
+          sourceCanonicalKey: resolvedSource.metadataSourceKey,
+          cacheKey: resolvedSource.cacheKey,
+          fileName: resolvedSource.fileName,
+          filePath: '/models/resolved.gguf',
+          createdAt: DateTime.utc(2026),
+          updatedAt: DateTime.utc(2026),
+        );
+        final resolver = MockModelResolver(
+          const LocalModelFile('/models/resolved.gguf'),
+        );
+        final downloadManager = MockModelDownloadManager(entry);
+        final nativeBackend = MockLlamaBackend();
+        final nativeEngine = LlamaEngine(
+          nativeBackend,
+          modelResolver: resolver,
+          modelDownloadManager: downloadManager,
+        );
+
+        await nativeEngine.loadModelSource(source);
+
+        expect(resolver.lastSource, source);
+        expect(downloadManager.lastSource?.path, '/models/resolved.gguf');
+        expect(nativeBackend.lastModelPath, '/models/resolved.gguf');
+      },
+    );
+
     test('loadModelFromUrl unsupported on non-URL backend', () async {
       expect(
         () => engine.loadModelFromUrl('http://test.gguf'),

test/unit/core/models/download/model_cache_entry_test.dart

@@ -142,6 +142,28 @@ void main() {
       );
     });
 
+    test('toJson redacts url canonical keys with explicit file names', () {
+      final entry = ModelCacheEntry(
+        sourceCanonicalKey:
+            'url:https://user:secret@host/model.gguf?token=secret\nfileName:model.gguf',
+        cacheKey: 'abc123',
+        fileName: 'model.gguf',
+        filePath: '/cache/model.gguf',
+        createdAt: DateTime.utc(2026, 1, 2),
+        updatedAt: DateTime.utc(2026, 1, 2),
+      );
+
+      final encoded = jsonEncode(entry.toJson());
+
+      expect(encoded, isNot(contains('secret')));
+      expect(encoded, isNot(contains('token=secret')));
+      expect(encoded, isNot(contains('fileName:model.gguf')));
+      expect(
+        entry.sourceCanonicalKey,
+        'url:https://host/model.gguf#cacheKey=abc123',
+      );
+    });
+
     test('normalizes percent-encoded cache file names and paths', () {
       final entry = ModelCacheEntry(
         sourceCanonicalKey: 'path:/models/model.gguf',