Aider

All agent state is local files (repo-level .aider.* files, ~/.aider/, .aider.conf.yml, .env) whose locations are documented, so it can be copied immediately with no provider approval. There is no export/import feature or documented 'copy this and run it elsewhere' procedure; restoring means reinstalling aider, copying files from several locations (repo and home directory) and re-supplying API keys by hand.

• Aider YAML config file docs
• Aider options reference
• args.py (default file locations)

Nothing defining the agent is held by the provider: configuration, conventions/instruction files, chat and input history, model settings/metadata overrides, OAuth-obtained OpenRouter key (~/.aider/oauth-keys.env) and git history are all local files. Model API keys are the owner's own and are re-linked by setting environment variables; the OpenRouter onboarding uses OpenRouter's PKCE flow with a localhost callback, and keys can also be set directly. No schedules or identity exist (G11).

• onboarding.py (OpenRouter OAuth, local key file)
• Aider API key configuration
• Aider YAML config file docs

Runtime is Apache-2.0 with no licence check, account or activation. The only provider-related network calls (PostHog analytics, PyPI version check) are optional and failures are caught; core editing works against any owner-configured model endpoint. Hands-on provider-blocked run not performed (desk review).

• LICENSE.txt (Apache 2.0)
• analytics.py (errors disable PostHog)
• versioncheck.py (errors caught)

Any LiteLLM-supported model, including local Ollama/LM Studio open-weight models, can be used, and code editing uses text-based edit formats rather than vendor tool calling. However, /voice is hard-wired to OpenAI's hosted whisper-1 and refuses to start without OPENAI_API_KEY, so voice input is lost off that vendor.

• voice.py (model='whisper-1')
• commands.py cmd_voice (requires OPENAI_API_KEY)
• Aider with Ollama

Aider is local-first software with no provider account; all agent state lives on the owner's machine and is unaffected by any provider action or shutdown.

• Aider YAML config file docs
• Aider options reference

State is Markdown (.aider.chat.history.md), plain-text input history, YAML/JSON config and model settings, dotenv files and git; base prompts and logic are Python source shipped in the package. The repo-map tag cache is derived from source files that remain in the repo. No encryption is used.

• io.py (chat history as Markdown)
• model-settings.yml
• Aider options reference

--llm-history-file logs every message list sent to the LLM (including system prompts and history summaries), --show-prompts prints system prompts, and /settings or --verbose prints effective merged settings plus main/editor/weak model identities. Model aliases resolve through bundled, readable tables; there is no provider-operated context layer.

• base_coder.py (log_llm_history TO LLM)
• commands.py cmd_settings
• Aider options reference

Aider AI LLC receives analytics events (feature/command use, model names, token counts, errors, with PostHog exception autocapture) tied to a random UUID when analytics is enabled. On a fresh install 10% of users are asked with 'Yes' preselected (G10). The privacy policy and analytics page disclose no retention period for this data. Local item-by-item visibility exists only if the owner sets --analytics-log. Installs that are never asked send nothing.

• analytics.py (10% sample, PostHog)
• main.py (opt-in prompt)
• io.py confirm_ask default='y'
• Aider privacy policy (live, last updated April 12, 2025)
• Aider analytics documentation

Source shows no paid placement or sponsored tools. Default model selection is a disclosed, source-visible mapping from the API keys present, and the OpenRouter OAuth offer when no keys exist is disclosed at the prompt and can be declined or replaced by any --model. Aider sets OR_SITE_URL/OR_APP_NAME headers for OpenRouter app attribution, which does not steer the agent's choices.

• onboarding.py (default model selection)
• llm.py (OpenRouter attribution headers)

Every user input, assistant reply, tool message (including 'Running <command>', applied edits, confirmations) is appended to .aider.chat.history.md, which is not pruned. LLM file edits are auto-committed to git with full diffs by default. A write failure prints a warning to the owner. There are no schedules or provider-side actions (G11).

• io.py append_chat_history / tool_output
• base_coder.py shell command execution
• args.py --auto-commits default True
• Aider git integration docs

Git commits of aider's file edits are hash-chained, so edits to past commits are detectable with open tools, but the chat-history record (commands run, confirmations, conversation) has no integrity data, and nothing anchors the git chain outside the machine that holds it, so a full rewrite is undetectable by default.

• io.py (plain append to chat history)
• Aider git integration docs

The model cannot directly write the history file: edits to files not in chat, new-file creation and every shell command need owner confirmation, and shell commands cannot be auto-approved even with --yes-always. But the record is an ordinary writable file in the same user context, so an owner-approved shell command or edit can alter or delete it; protection rests on the approval prompt, not on separation.

• io.py confirm_ask (explicit_yes_required)
• base_coder.py shell confirmation

All of aider's source is available under Apache-2.0 and the default PyPI wheel is pure Python that can be diffed against the tag. But releases are uploaded with a token via twine with no provenance attestation (PyPI provenance endpoint returns 404), no documented verification procedure exists, and compiled dependency wheels are not tied to source by the project.

• .github/workflows/release.yml
• PyPI aider-chat 0.86.2
• LICENSE.txt

Aider has no agent identity. Commits are labelled by appending '(aider)' to the owner's git name and adding a 'Co-authored-by: aider (<model>) <aider@aider.chat>' trailer; these are unauthenticated strings, the trailer email is on the provider's domain, and recipients cannot verify that an action came from the owner's agent.

• repo.py (attribution rules)
• Aider git integration docs

Each session writes a timestamped header with aider version, models, edit format and repo-map settings to the chat history, so runtime and model changes are visible over time. But .aider* files are added to .gitignore by default, config, conventions and memory files have no product change history or attribution, and nothing restores a prior agent state (/undo only reverts aider's own code commits).

• io.py (session header)
• main.py check_gitignore
• Aider git integration docs

Owner layers are editable via conventions files (--read), .aider.conf.yml, model settings files and --commit-prompt, but the base system prompts for each edit format are hard-coded in Python source with no option to replace them, so replacing them needs source edits (G3).

• coders/editblock_prompts.py
• Aider conventions docs
• Aider options reference

The only cross-session memory is the Markdown chat history (re-used only with --restore-chat-history, off by default) and input history; both are documented, human-readable files the owner can edit or delete item by item. No hidden profiles are kept.

• args.py (history files, restore default False)
• Aider options reference

There is no plugin, MCP or tool interface; owner-supplied tools can only be used as shell commands the model suggests (with approval) or as --lint-cmd/--test-cmd. Built-ins can largely be switched off (--no-suggest-shell-commands, --no-auto-lint, --no-detect-urls, --no-git, ask mode).

• Aider options reference
• Aider in-chat commands docs

Most protections can be changed (confirmations via --yes-always, --no-verify-ssl, --no-gitignore, .aiderignore). Shell-command confirmation is locked: with --yes-always, shell commands are auto-declined (explicit_yes_required) and there is no setting to auto-run them.

• io.py confirm_ask (yes-always declines explicit prompts)
• base_coder.py shell confirmation

Aider runs locally with no remote flags; model settings and aliases are bundled with each release. The version check only offers an upgrade behind a confirmation prompt and can be disabled (--no-check-update); owners can pin any version via pip. A daily download of LiteLLM's third-party model-metadata JSON can change token-limit metadata but is not provider-controlled and can be overridden with .aider.model.metadata.json.

• versioncheck.py
• utils.py check_pip_install_extra (confirm)
• models.py ModelInfoManager
• Advanced model settings

File scope is per path (files in chat, --read read-only files, .aiderignore, --subtree-only) and enforced in code, and the agent cannot change its settings without an approval. Shell commands and URL fetching are on/off with per-invocation approval only, with no per-command or per-domain allow/deny lists. No spend capability or outbound messaging exists (G11).

• Aider options reference
• base_coder.py shell confirmation

Aider gates a fixed set of classes (shell commands, new files, edits to files not in chat, adding URLs, pip installs, architect edits); the owner cannot require approval for edits to files already in the chat or define other gated classes.

• base_coder.py
• Aider options reference

Ctrl-C stops the foreground LLM response and a second Ctrl-C within 2 s exits. The chat-history summarizer runs in a non-daemon background thread that sends chat content to the weak model; it is not cancelled by Ctrl-C, and sys.exit waits for it to finish.

• base_coder.py keyboard_interrupt
• base_coder.py summarizer thread
• Aider in-chat commands docs

Model traffic goes only to the owner-chosen endpoint. Non-content analytics are asked for explicitly but with 'Yes' preselected for the sampled 10% and can be disabled permanently; the PyPI version check is disclosed and switchable; a daily metadata fetch from GitHub (no content) has no off switch. The privacy policy lets changes take effect when posted (material changes on notice) and permits legal disclosure without owner notice. No training, advertising or sale use is described.

• Aider privacy policy (live, last updated April 12, 2025)
• Aider analytics documentation
• main.py analytics prompt
• models.py metadata fetch

Credentials are the owner's own API keys in environment variables, .env, config files or ~/.aider/oauth-keys.env, all visible and removable by the owner, and the provider holds no copy. Aider uses them only to call the owner-selected model.

• Aider API key configuration
• onboarding.py

With no provider-side agent copy, deletion is local, but there is no single delete action or documented procedure: the owner must remove .aider* files in each repo plus ~/.aider/ and home-directory config/env files by hand, with no confirmation. Analytics retention is graded in T3.

• Aider YAML config file docs
• Aider options reference