## Turn 1

*   `app/main.py`: FastAPI app, registers proxy routes and dashboard pages. (Entry point)
    *   `app/proxy.py`: Handles `/v1/chat/completions`, records metadata, forwards to `llama.cpp`. (Data flow/Logic)
    *   `app/store.py`: SQLite operations (inserts runs/requests). (Data persistence)
    *   `app/reports.py`: Aggregates stats from SQLite for dashboard. (Data retrieval)
    *   `app/redaction.py`: Removes secrets before previews. (Security/Data processing)

    *   *Entry Points:*
        *   `app/main.py` (FastAPI routes)
        *   `app/proxy.py` (Specifically the `/v1/chat/completions` endpoint)

    *   *Data Flow:*
        1.  User Request -> `app/main.py` (Routing)
        2.  `app/main.py` -> `app/proxy.py` (Processing/Forwarding)
        3.  `app/proxy.py` -> `app/store.py` (Logging/Metadata storage)
        4.  `app/proxy.py` -> `llama.cpp` (Upstream inference)
        5.  `app/reports.py` -> `app/store.py` (Querying for dashboard)
        6.  `app/redaction.py` -> (Applied during report/preview generation)

    *   *Risky Modules:*
        *   `app/proxy.py`: Handles external requests and forwards to an upstream service (potential for injection or SSRF if not validated).
        *   `app/store.py`: Database interactions (SQL injection risk if not using parameterized queries).
        *   `app/redaction.py`: If the regex/logic for secret removal is flawed, sensitive data could leak to the dashboard.
        *   `app/main.py`: General surface area for authentication/authorization bypasses.

    *   `entry_points`: List of files/routes.
    *   `data_flow`: Step-by-step description.
    *   `risks`: List of potential security/stability issues.

    *   *Entry Points:* `app/main.py` (FastAPI routes), `app/proxy.py` (`/v1/chat/completions`).
    *   *Data Flow:* User -> `main.py` -> `proxy.py` -> `store.py` (logging) & `llama.cpp` (inference). Dashboard -> `reports.py` -> `store.py` -> `redaction.py` -> User.
    *   *Risks:* SQL Injection (`store.py`), Secret Leakage (`redaction.py`), SSRF/Request Forgery (`proxy.py`), Unauthorized Access (`main.py`).