Root cause (from [timing] logs): chat "build" = 39.6s while prefill+first-token =
0.31s. The ~40s is create_chat_completion rendering the chat template via
llama-cpp-python's ImmutableSandboxedEnvironment, whose per-operation security
checks make a heavy template (gemma-4's recursive / O(n^2) macros over a big
Kilocode conversation) take tens of seconds — every request.

Fix (generic for ALL gguf/llama.cpp models): render the prompt ourselves with a
plain jinja2.Environment compiled ONCE from the model's tokenizer.chat_template
(same trim/lstrip, IgnoreGenerationTags + loopcontrols extensions, tojson filter,
same render vars), then tokenize with add_bos=False + special=True (matching
llama-cpp's added_special handling — no double BOS) and generate via
create_completion. Output is byte-identical to the sandboxed render (verified), but
without the sandbox overhead. Plus a small per-message render cache and finer
timing ([timing] chat render / tokenize / create_completion setup / first-token).
Falls back to create_chat_completion if the model has no chat_template or rendering
fails.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011DDv7BchtZQWsnPG6Jm49m