refactor(dashboard): H1 — extract chat_completion (+helper cluster) into routes/chat.py

[AVADSA25]

Summary

8th wave of the codec_dashboard route-extraction series — and the big one. Moves the largest remaining endpoint, the /api/chat LLM handler (chat_completion), plus its tightly-coupled private helper cluster, into a new routes/chat.py. Behavior is preserved verbatim (script-extracted, not retyped).

LOC reduction (cumulative since pre-B6 baseline)

Wave	After	Net
Pre-B6 baseline	3,912	—
B6 → G (PRs #160–#165)	2,022	-1,890
H1 (this PR)	1,310	-712

codec_dashboard.py is now 1,310 LOC — a 66.5% cut from where this refactor began.

What moved to routes/chat.py (798 LOC)

Symbol	Role
chat_completion	the POST /api/chat endpoint
_fetch_url_content	URL strip-and-fetch for inline context
_enrich_messages	memory / URL / web-search context injection
CHAT_SKILL_ALLOWLIST	the 53-skill set a chat message may auto-fire
_try_skill	pre-LLM skill hijack (shared with /api/command)
_try_skill_by_name	post-LLM [SKILL:...] resolver + calculator fallback
_chat_vision_response	image → vision-model branch (A-11 pending)
_build_chat_system_prompt	override + step-budget + observer suffixes

Safety surfaces — preserved & pinned

A new TestH1ChatExtraction::test_safety_surfaces_preserved scans routes/chat.py to lock these in:

• pre-LLM hijack consumes one step budget + gates destructive skills on codec_consent.chat_consent_ok
• post-LLM [SKILL:...] tags stay allowlist-gated + budget-gated + dropped (never leaked raw) on any failure — both stream and non-stream paths
• the <think> / [SKILL:...] streaming token machine stays codec_chat_stream.SkillTagBuffer

Back-compat (zero behavior change)

• codec_dashboard re-exports all 7 helpers identity-equal to routes.chat (asserted in test), so /api/command's _try_skill call and the existing test surface (codec_dashboard.CHAT_SKILL_ALLOWLIST, _build_chat_system_prompt, …) keep working untouched.
• CHAT_SYSTEM_PROMPT stays in codec_dashboard (routes.prompts also imports it) and is lazy-imported in routes/chat.py to avoid a load-time cycle.

What intentionally stays in codec_dashboard.py

/api/command (safety-critical) · the auto-escalate classifier cluster (Step 10, independent of chat_completion) · /api/services/status · page renderers · startup/shutdown hooks · _bg_* background daemons.

Test plan

• python3.13 -m pytest --ignore=tests/test_skills.py -q → 2,052 passed, 77 skipped (was 2,046 in G; +6 net)
• All 112 chat-touching tests pass first (test_chat_stream, test_chat_helpers, test_step_budget, test_chat_escalation, test_clipboard_url_fetch, test_shift_report, test_reaudit_mediums, test_python_exec, test_dashboard_llm)
• 7-helper identity-equal re-export verified
• test_full_product_audit::test_api_command_safety_gate still green (reworded comments so its index("/api/command") heuristic still finds the real endpoint)
• ruff check: 0 issues (dropped now-dead secrets + SkillTagBuffer/SKILL_TAG_RE imports)
• python3 -c 'import codec_dashboard': clean (no import cycle)

🤖 Generated with Claude Code