feat(llamaswap): add llama-swaps (TLS) DSN scheme

llama-swap was http-only by DSN, pushing TLS-fronted instances onto the openai://
scheme (which loses the management/image methods). Add a "llama-swaps" scheme
that builds an https base URL, alongside "llama-swap" (http, local-first) —
mirroring redis/rediss. Both share one factory; llama-swaps is scheme-only (no
default built-in). The choice stays explicit because a DSN has no reliable
http-vs-https signal.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -79,12 +79,13 @@ alias   := bare token (no slash), expands INLINE, recursively, cycle-checked
 `LLM_<NAME>=scheme://[token@]host[/path]` — e.g.
 `LLM_M5=foreman://token@foreman-m5.example` defines provider `m5`; then
 `m5/qwen3:30b` works in Parse, chains, and aliases. Scheme ∈ {foreman,
-ollama, ollama-cloud, openai, anthropic, google, gemini, llama-swap} ∪
+ollama, ollama-cloud, openai, anthropic, google, gemini, llama-swap,
-RegisterScheme. Token = credential; base URL = `https://host` always —
+llama-swaps} ∪ RegisterScheme. Token = credential; base URL = `https://host`
-**except `llama-swap`, which builds `http://host` (local-first; ADR-0015).**
+always — **except `llama-swap`, which builds `http://host` (local-first);
-`New()` scans the process env eagerly; unknown names also resolve lazily at
+`llama-swaps` is its TLS twin (`https://host`), mirroring redis/rediss
-Parse time (`my-prov` → `LLM_MY_PROV`). Malformed entries fail on use, not at
+(ADR-0015).** `New()` scans the process env eagerly; unknown names also resolve
-startup.
+lazily at Parse time (`my-prov` → `LLM_MY_PROV`). Malformed entries fail on use,
+not at startup.
 
 ## Health & failover (ADR-0006, ADR-0008)
 

README.md

@@ -159,15 +159,17 @@ m, _ := reg.Parse("m5/qwen3:30b,m1/qwen3:30b,thinking")
 ```
 
 DSN format: `scheme://[token@]host[/path]`, scheme ∈ `foreman`, `ollama`,
-`ollama-cloud`, `openai`, `anthropic`, `google`/`gemini`, `llama-swap`, or any
+`ollama-cloud`, `openai`, `anthropic`, `google`/`gemini`, `llama-swap`,
-scheme you add with `RegisterScheme`. The token is the credential (bearer token
+`llama-swaps`, or any scheme you add with `RegisterScheme`. The token is the
-/ API key); the base URL is always `https://host[/path]` — except `llama-swap`,
+credential (bearer token / API key); the base URL is always `https://host[/path]`
-which builds `http://host[:port]` since it's local-first. `New()` loads `LLM_*`
+— except `llama-swap`, which builds `http://host[:port]` since it's local-first
-vars eagerly; unknown provider names also resolve lazily at Parse time
+(`llama-swaps` is the TLS twin → `https://host`, mirroring redis/rediss). `New()`
-(`my-prov/x` → `LLM_MY_PROV`).
+loads `LLM_*` vars eagerly; unknown provider names also resolve lazily at Parse
+time (`my-prov/x` → `LLM_MY_PROV`).
 
 ```
-LLM_LS=llama-swap://token@box.local:8080   # then "ls/qwen3:14b" parses
+LLM_LS=llama-swap://token@box.local:8080    # http  → "ls/qwen3:14b" parses
+LLM_LS=llama-swaps://token@swap.example.com # https → TLS-fronted instance
 ```
 
 [llama-swap](https://github.com/mostlygeek/llama-swap) is a model-swapping proxy

builtin.go

@@ -20,6 +20,12 @@ const (
 	ProviderOllamaCloud = "ollama-cloud"
 	ProviderForeman     = "foreman"
 	ProviderLlamaSwap   = "llama-swap"
+	// ProviderLlamaSwapTLS is the DSN scheme for a TLS-fronted llama-swap
+	// (https base URL). It is a scheme only, not a default built-in provider
+	// name. Why a separate scheme rather than auto-detecting: a DSN carries no
+	// reliable signal for http vs https, so the choice is explicit
+	// (llama-swap = http local-first, llama-swaps = https), mirroring rediss.
+	ProviderLlamaSwapTLS = "llama-swaps"
 )
 
 // registerBuiltins installs the built-in providers and env-DSN scheme
@@ -70,24 +76,28 @@ func registerBuiltins(r *Registry, httpClient *http.Client) {
 
 	// llama-swap: OpenAI-compatible chat + image generation + management
 	// endpoints over a model-swapping proxy. Chat reuses the openai client
-	// (provider/llamaswap delegates); the DSN builds an http:// base URL
+	// (provider/llamaswap delegates). Two schemes: "llama-swap" builds an
-	// because llama-swap is local-first (TLS-fronted instances can use the
+	// http:// base URL (local-first default), "llama-swaps" builds https://
-	// openai:// scheme for chat). The no-DSN built-in errors on use with a
+	// for a TLS-fronted instance (mirrors redis/rediss). The no-DSN built-in
-	// clear message, mirroring foreman.
+	// errors on use with a clear message, mirroring foreman.
 	llamaSwapOpts := func(extra ...llamaswap.Option) []llamaswap.Option {
 		if httpClient != nil {
 			extra = append(extra, llamaswap.WithHTTPClient(httpClient))
 		}
 		return extra
 	}
-	r.providers[ProviderLlamaSwap] = llamaswap.New(llamaSwapOpts(llamaswap.WithName(ProviderLlamaSwap))...)
+	llamaSwapScheme := func(urlScheme string) SchemeFactory {
-	r.schemes[ProviderLlamaSwap] = func(name string, dsn DSN) (llm.Provider, error) {
+		return func(name string, dsn DSN) (llm.Provider, error) {
-		return llamaswap.New(llamaSwapOpts(
+			return llamaswap.New(llamaSwapOpts(
-			llamaswap.WithName(name),
+				llamaswap.WithName(name),
-			llamaswap.WithBaseURL("http://"+dsn.Host),
+				llamaswap.WithBaseURL(urlScheme+"://"+dsn.Host),
-			llamaswap.WithToken(dsn.Token),
+				llamaswap.WithToken(dsn.Token),
-		)...), nil
+			)...), nil
+		}
 	}
+	r.providers[ProviderLlamaSwap] = llamaswap.New(llamaSwapOpts(llamaswap.WithName(ProviderLlamaSwap))...)
+	r.schemes[ProviderLlamaSwap] = llamaSwapScheme("http")
+	r.schemes[ProviderLlamaSwapTLS] = llamaSwapScheme("https")
 
 	// Anthropic and Anthropic-compatible endpoints.
 	anthropicOpts := func(extra ...anthropic.Option) []anthropic.Option {

builtin_llamaswap_test.go

@@ -51,6 +51,28 @@ func TestLlamaSwapScheme(t *testing.T) {
 	}
 }
 
+// TestLlamaSwapsScheme: the "llama-swaps" scheme builds an https base URL for a
+// TLS-fronted instance (vs "llama-swap" which is http local-first).
+func TestLlamaSwapsScheme(t *testing.T) {
+	r := newTestRegistry(t)
+	if err := r.LoadEnv(map[string]string{
+		"LLM_LST": "llama-swaps://tok@swap.example.com",
+	}); err != nil {
+		t.Fatalf("LoadEnv: %v", err)
+	}
+	p, ok := r.Provider("lst")
+	if !ok {
+		t.Fatal("provider \"lst\" not registered")
+	}
+	lp, ok := p.(*llamaswap.Provider)
+	if !ok {
+		t.Fatalf("provider is %T, want *llamaswap.Provider", p)
+	}
+	if want := "https://swap.example.com"; lp.BaseURL() != want {
+		t.Errorf("baseURL = %q, want %q", lp.BaseURL(), want)
+	}
+}
+
 // TestLlamaSwapBuiltinNoURL: the no-DSN built-in resolves but errors clearly on
 // use (mirrors foreman), rather than silently hitting a wrong host.
 func TestLlamaSwapBuiltinNoURL(t *testing.T) {

docs/adr/0015-llama-swap-provider.md

@@ -38,11 +38,13 @@ features leak into the canonical API).
   `Unload` (POST `/api/models/unload[/:model]`). A small `doJSON` helper shares
   bearer auth + error mapping; non-2xx → `*llm.APIError` (so `llm.Classify`
   applies), transport errors wrapped raw.
-- DSN: the `llama-swap` scheme builds an **http://** base URL from the host
+- DSN: two schemes share one factory. `llama-swap` builds an **http://** base
-  (llama-swap is local-first), deliberately *not* the DSN's https-always
+  URL from the host (llama-swap is local-first), deliberately *not* the DSN's
-  `BaseURL()`. A TLS-fronted instance can use the `openai://` scheme for chat.
+  https-always `BaseURL()`; `llama-swaps` builds **https://** for a TLS-fronted
-  A no-DSN built-in `llama-swap` provider registers but errors on use (mirrors
+  instance (mirrors redis/rediss). Why a second scheme rather than auto-detect:
-  foreman).
+  a DSN carries no reliable http-vs-https signal, so the choice stays explicit.
+  Only `llama-swap` registers a no-DSN built-in provider (errors on use, mirrors
+  foreman); `llama-swaps` is a scheme only.
 - Image generation is implemented here too, against the new `imagegen`
   interface (see ADR-0016).
 

progress.md

@@ -1,5 +1,12 @@
 # progress
 
+## 2026-06-27 — llama-swaps (TLS) DSN scheme
+
+Follow-up to the llama-swap provider: added the `llama-swaps` DSN scheme (https
+base URL) alongside `llama-swap` (http, local-first), mirroring redis/rediss, so
+a TLS-fronted instance is first-class instead of being pushed to the `openai://`
+scheme. Scheme-only (no default built-in); shares one factory in builtin.go.
+
 ## 2026-06-27 — llama-swap provider + canonical image-gen interface
 
 **Landed (ADR-0015, ADR-0016).** New `provider/llamaswap`: chat **delegates to