experimental: codex / ai integration

README.md

@@ -129,6 +129,21 @@ max_entries = 200              # bounded oldest-first pruning; 10-10000
 [editing]
 mode = "vim"                   # "vim" or "standard"; description field only for now
 
+[ai]
+# Experimental and local-only. Disabled unless explicitly enabled. Each run
+# still requires confirmation after its exact scope and redactions are shown.
+enabled = false
+provider = "codex-cli"          # provider abstraction; only Codex CLI is implemented
+model = ""                      # empty uses the provider default for the whole run
+command = "codex"
+timeout = "3m"
+max_calls = 8
+max_request_bytes = 180000
+max_run_bytes = 900000
+max_file_bytes = 150000
+store_directory = ""           # defaults beside config.toml, mode 0700/0600
+exclude = ["*.lock", "go.sum", "package-lock.json", "vendor/", "node_modules/", "dist/", "build/", "generated/", "coverage/", "*.generated.*", "*_generated.*", "*.min.js", "*.map", ".env", ".env.*", "*.pem", "*.key", "*.p12", "*.pfx", "*credentials*"]
+
 [keybindings.general]
 quit = ["q", "ctrl+c"]
 help = ["?", "f1"]
@@ -156,6 +171,7 @@ edit = ["e"]
 auto_merge = ["a"]
 merge_now = ["M"]
 toggle_list = ["tab"]
+ai = ["A"]
 
 [keybindings.threads]
 search = ["/"]
@@ -258,6 +274,45 @@ Configuration loading also checks each active context independently. A key may
 be reused on unrelated screens, but assigning it to two different actions that
 can be active together reports the context and both conflicting actions.
 
+## Experimental local AI review
+
+Set `ai.enabled = true` to expose the `A` menu on the dashboard and thread
+screens. The initial provider uses the authenticated Codex CLI, so run
+`codex login` first. A full review creates clearly labelled `LOCAL AI · LOCAL
+ONLY` threads; it may also attach local-only context to unresolved GitHub
+threads. Pressing the normal reply key on a local AI thread starts a discussion
+with the same configured model. Resolving or unresolving those threads changes
+only the permission-restricted local per-PR state file. For small,
+self-contained replacements the model can include a standard GitHub-style
+suggestion in its local comment. These use the existing syntax-aware
+remove/add preview and remain local; diple does not apply or publish them.
+
+Every model run is manually confirmed. The preview shows the head commit,
+model, files, byte budget, call count, exclusions, and redaction count. Input
+comes exclusively from GitHub's authenticated PR diff and PR metadata: diple
+does not read the local checkout for AI review. Secret-like values are
+redacted, binary/generated/vendor/lock/oversized files are excluded, and the
+provider subprocess receives a small environment allowlist. Codex is launched
+ephemerally in an empty temporary directory with project instructions ignored,
+read-only sandboxing, approvals disabled, and all supported tool surfaces
+disabled. Any attempted tool event or malformed/out-of-range structured result
+fails the run closed.
+
+The AI menu distinguishes the inference-free provider status refresh from a
+provider test that makes one deliberately small structured model call. The
+test requires its own confirmation, consumes provider quota, and sends no PR
+content or local files. Preparing and running a review displays animated,
+stable progress; multi-chunk reviews report completed model calls. When the
+provider exposes a reasoning summary, diple shows a bounded, sanitized summary
+beside the progress bar. It never requests or displays hidden chain-of-thought.
+
+PR content is untrusted and is explicitly delimited as data in the model
+prompt. Results are validated against changed paths and lines, deduplicated,
+and retained as outdated when the PR head moves. No AI result is published to
+GitHub. Publishing proposed replies and additional providers remain future
+work; a future direct API provider must require no-training and zero-data-
+retention guarantees.
+
 When cached data exists, the picker and PR details are rendered immediately
 from that snapshot while a live GitHub refresh runs in the background. Cached
 screens are labelled with their save time and are replaced automatically when