@smythos/sre 1.7.18 → 1.7.20

package/src/subsystems/ObservabilityManager/Telemetry.service/connectors/OTel/OTel.class.ts

@@ -337,6 +337,12 @@ export class OTel extends TelemetryConnector {
 
                 const convSpan = tracer.startSpan('Agent.Conv', {
                     attributes: {
+                        // OTel standard attributes
+                        'gen_ai.operation.name': 'chat',
+                        'gen_ai.provider.name': conversation?.llmInference?.llmProviderName || 'unknown',
+                        'gen_ai.conversation.id': processId,
+                        'gen_ai.request.model': modelId || 'unknown',
+                        ////////////////////////////////
                         'agent.id': agentId,
                         'conv.id': processId,
                         'llm.model': modelId || 'unknown',

package/src/subsystems/Security/ManagedVault.service/connectors/SecretManagerManagedVault.ts

@@ -1,6 +1,5 @@
 import { ConnectorService } from '@sre/Core/ConnectorsService';
 import { Logger } from '@sre/helpers/Log.helper';
-//import { SmythRuntime } from '@sre/Core/SmythRuntime.class';
 import { AccessRequest } from '@sre/Security/AccessControl/AccessRequest.class';
 import { ACL } from '@sre/Security/AccessControl/ACL.class';
 import { SecureConnector } from '@sre/Security/SecureConnector.class';
@@ -9,16 +8,19 @@ import { IAccessCandidate, TAccessLevel, TAccessRole } from '@sre/types/ACL.type
 import {
     CreateSecretCommand,
     DeleteSecretCommand,
+    DescribeSecretCommand,
+    DescribeSecretCommandOutput,
     GetSecretValueCommand,
     GetSecretValueCommandOutput,
     ListSecretsCommand,
     ListSecretsCommandOutput,
     PutSecretValueCommand,
+    RestoreSecretCommand,
     SecretsManagerClient,
 } from '@aws-sdk/client-secrets-manager';
-import { randomUUID } from 'crypto';
 import { ManagedVaultConnector } from '../ManagedVaultConnector';
 import { SecretsManagerConfig } from '../../Vault.service/connectors/SecretsManager.class';
+const DELETION_MARKER_ERROR_MESSAGE = "You can't create this secret because a secret with this name is already scheduled for deletion."
 
 const console = Logger('SecretManagerManagedVault');
 
@@ -26,49 +28,87 @@ export class SecretManagerManagedVault extends ManagedVaultConnector {
     public name: string = 'SecretManagerManagedVault';
     public scope: string = 'smyth-managed-vault';
     private secretsManager: SecretsManagerClient;
+    private prefix: string;
 
-    constructor(protected _settings: SecretsManagerConfig & { vaultName: string }) {
+    constructor(protected _settings: SecretsManagerConfig & { vaultName: string, prefix: string }) {
         super(_settings);
-        //if (!SmythRuntime.Instance) throw new Error('SRE not initialized');
 
+        this.prefix = _settings.prefix || '';
         this.secretsManager = new SecretsManagerClient({
             region: _settings.region,
             ...(_settings.awsAccessKeyId && _settings.awsSecretAccessKey
                 ? {
-                      accessKeyId: _settings.awsAccessKeyId,
-                      secretAccessKey: _settings.awsSecretAccessKey,
-                  }
+                    accessKeyId: _settings.awsAccessKeyId,
+                    secretAccessKey: _settings.awsSecretAccessKey,
+                }
                 : {}),
         });
     }
 
     @SecureConnector.AccessControl
     protected async get(acRequest: AccessRequest, secretName: string) {
-        const secret = await this.getSecretByName(secretName);
-        return secret?.SecretString;
+        try {
+            const secret = await this.getSecretByName(acRequest, secretName);
+            return secret?.value;
+        } catch (error) {
+            console.error(error);
+            return null;
+        }
     }
 
     @SecureConnector.AccessControl
     protected async set(acRequest: AccessRequest, secretName: string, value: string) {
-        const secret = await this.getSecretByName(secretName);
+        const accountConnector = ConnectorService.getAccountConnector();
+        const teamId = await accountConnector.getCandidateTeam(acRequest.candidate);
+        const secret = await this.getSecretByName(acRequest, secretName);
         if (secret) {
-            await this.secretsManager.send(new PutSecretValueCommand({ SecretId: secret.ARN, SecretString: value }));
+            await this.secretsManager.send(new PutSecretValueCommand({ SecretId: secret.secretId, SecretString: value }));
         } else {
-            await this.secretsManager.send(
-                new CreateSecretCommand({
-                    Name: `smyth/${randomUUID()}`,
-                    SecretString: JSON.stringify({ [secretName]: value }),
-                    Tags: [{ Key: this.scope, Value: 'true' }],
-                })
-            );
+            const vaultKey = this.getVaultKey(secretName, teamId);
+            try {
+                await this.secretsManager.send(
+                    new CreateSecretCommand({
+                        Name: vaultKey,
+                        Description: `Smyth Managed Vault Secret`,
+                        SecretString: JSON.stringify({ [secretName]: value }),
+                        Tags: [{ Key: this.scope, Value: 'true' }],
+                    })
+                );
+            } catch (error) {
+                console.warn(error.message);
+                if (error.message === DELETION_MARKER_ERROR_MESSAGE) {
+                    // The secret already exists — check if it's pending deletion
+                    const secretDesc: DescribeSecretCommandOutput = await this.secretsManager.send(new DescribeSecretCommand({ SecretId: vaultKey }));
+
+                    if (secretDesc.DeletedDate) {
+                        console.debug(`Secret ${vaultKey} is pending deletion, restoring...`);
+                        await this.secretsManager.send(new RestoreSecretCommand({ SecretId: vaultKey }));
+                    } else {
+                        console.debug(`Secret ${vaultKey} already exists, updating value...`);
+                    }
+
+                    // Update or re-put the secret value
+                    await this.secretsManager.send(
+                        new PutSecretValueCommand({
+                            SecretId: vaultKey,
+                            SecretString: JSON.stringify({
+                                [secretName]: value,
+                            }),
+                        })
+                    );
+
+                } else {
+                    throw error;
+                }
+            }
         }
     }
 
     @SecureConnector.AccessControl
     protected async delete(acRequest: AccessRequest, secretName: string) {
-        const secret = await this.getSecretByName(secretName);
+        const secret = await this.getSecretByName(acRequest, secretName);
         if (secret) {
-            await this.secretsManager.send(new DeleteSecretCommand({ SecretId: secret.ARN }));
+            await this.secretsManager.send(new DeleteSecretCommand({ SecretId: secret.secretId, RecoveryWindowInDays: 7 }));
         }
     }
 
@@ -91,13 +131,35 @@ export class SecretManagerManagedVault extends ManagedVaultConnector {
         return acl;
     }
 
-    private async getSecretByName(secretName: string) {
+    private async getSecretByName(acRequest: AccessRequest, secretName: string) {
         try {
+
+            const accountConnector = ConnectorService.getAccountConnector();
+            const teamId = await accountConnector.getCandidateTeam(acRequest.candidate);
+            const vaultKey = this.getVaultKey(secretName, teamId);
+            let secret: GetSecretValueCommandOutput | null = null;
+            try {
+              const describeSecret: DescribeSecretCommandOutput = await this.secretsManager.send(new DescribeSecretCommand({ SecretId: vaultKey }));
+              if (describeSecret.DeletedDate) {
+                secret = null;
+              } else {
+                secret = await this.secretsManager.send(new GetSecretValueCommand({ SecretId: vaultKey }));
+              }
+            } catch (error) {
+                secret = null;
+                console.warn('Secret not found by Id, trying to get it by name');
+            }
+            if (secret) {
+                return this.getFormattedSecret(secret);
+            }
+
+            // if not found by Id, try to get it by name
             const secrets = [];
             let nextToken: string | undefined;
+            let listingVaultKey = this.getVaultKey('', teamId);
             do {
                 const listResponse: ListSecretsCommandOutput = await this.secretsManager.send(
-                    new ListSecretsCommand({ NextToken: nextToken, Filters: [{ Key: 'tag-key', Values: [this.scope] }] })
+                    new ListSecretsCommand({ NextToken: nextToken, Filters: [{ Key: 'tag-key', Values: [this.scope] }, { Key: 'name', Values: [listingVaultKey] }] })
                 );
                 if (listResponse.SecretList) {
                     for (const secret of listResponse.SecretList) {
@@ -105,7 +167,6 @@ export class SecretManagerManagedVault extends ManagedVaultConnector {
                             secrets.push({
                                 ARN: secret.ARN,
                                 Name: secret.Name,
-                                CreatedDate: secret.CreatedDate,
                             });
                         }
                     }
@@ -113,42 +174,44 @@ export class SecretManagerManagedVault extends ManagedVaultConnector {
                 nextToken = listResponse.NextToken;
             } while (nextToken);
 
-            const formattedSecrets = [];
             const $promises = [];
             for (const secret of secrets) {
                 $promises.push(getSpecificSecret(secret, this.secretsManager));
             }
             const results = await Promise.all($promises);
-            for (const result of results) {
-                formattedSecrets.push(result);
-            }
-            const secret = formattedSecrets.find((s) => s.Name === secretName);
-            return secret;
+            const secretData = results.find((s) => s.key === secretName);
+            return secretData;
         } catch (error) {
             console.error(error);
         }
 
         async function getSpecificSecret(secret, secretsManager: SecretsManagerClient) {
             const data: GetSecretValueCommandOutput = await secretsManager.send(new GetSecretValueCommand({ SecretId: secret.ARN }));
-            let secretString = data.SecretString;
-            let secretName = secret.Name;
-
-            if (secretString) {
-                try {
-                    let parsedSecret = JSON.parse(secretString);
-                    if (Object.keys(parsedSecret).length === 1) {
-                        secretName = Object.keys(parsedSecret)[0];
-                        secretString = parsedSecret[secretName];
-                    }
-                } catch (error) {}
-            }
-            return {
-                Name: secretName,
-                ARN: secret.ARN,
-                CreatedDate: secret.CreatedDate,
-                SecretId: secret.Name,
-                SecretString: secretString,
-            };
+            return this.getFormattedSecret(data);
+        }
+    }
+
+    getVaultKey(secretName: string, teamId: string) {
+        return `${this.prefix.length ? `${this.prefix}/` : ''}${teamId}/${secretName}`;
+    }
+
+    getFormattedSecret(secret: GetSecretValueCommandOutput) {
+        let secretString = secret.SecretString;
+        let secretName = secret.Name;
+
+        if (secretString) {
+            try {
+                let parsedSecret = JSON.parse(secretString);
+                if (Object.keys(parsedSecret).length === 1) {
+                    secretName = Object.keys(parsedSecret)[0];
+                    secretString = parsedSecret[secretName];
+                }
+            } catch (error) { }
         }
+        return {
+            secretId: secret.Name,
+            key: secretName,
+            value: secretString,
+        };
     }
 }

package/src/subsystems/Security/Vault.service/connectors/SecretsManager.class.ts

@@ -1,7 +1,5 @@
 import { ConnectorService } from '@sre/Core/ConnectorsService';
 import { Logger } from '@sre/helpers/Log.helper';
-//import { SmythRuntime } from '@sre/Core/SmythRuntime.class';
-import { AccessCandidate } from '@sre/Security/AccessControl/AccessCandidate.class';
 import { AccessRequest } from '@sre/Security/AccessControl/AccessRequest.class';
 import { ACL } from '@sre/Security/AccessControl/ACL.class';
 import { SecureConnector } from '@sre/Security/SecureConnector.class';
@@ -21,22 +19,24 @@ export type SecretsManagerConfig = {
     region: string;
     awsAccessKeyId?: string;
     awsSecretAccessKey?: string;
+    prefix?: string;
 };
 export class SecretsManager extends VaultConnector {
     public name: string = 'SecretsManager';
     private secretsManager: SecretsManagerClient;
+    private prefix: string;
 
     constructor(protected _settings: SecretsManagerConfig) {
         super(_settings);
         //if (!SmythRuntime.Instance) throw new Error('SRE not initialized');
-
+        this.prefix = _settings.prefix || '';
         this.secretsManager = new SecretsManagerClient({
             region: _settings.region,
             ...(_settings.awsAccessKeyId && _settings.awsSecretAccessKey
                 ? {
-                      accessKeyId: _settings.awsAccessKeyId,
-                      secretAccessKey: _settings.awsSecretAccessKey,
-                  }
+                    accessKeyId: _settings.awsAccessKeyId,
+                    secretAccessKey: _settings.awsSecretAccessKey,
+                }
                 : {}),
         });
     }
@@ -44,8 +44,14 @@ export class SecretsManager extends VaultConnector {
     @SecureConnector.AccessControl
     protected async get(acRequest: AccessRequest, secretName: string) {
         try {
-            const secret = await this.getSecretByName(secretName);
-            return secret?.SecretString;
+            const accountConnector = ConnectorService.getAccountConnector();
+            const teamId = await accountConnector.getCandidateTeam(acRequest.candidate);
+            // try fetchting by Id, if not found, try fetching by name
+            let secret = await this.getSecretById(teamId, secretName);
+            if (!secret) {
+                secret = await this.getSecretByName(acRequest, secretName);
+            }
+            return secret;
         } catch (error) {
             console.error(error);
             throw error;
@@ -60,8 +66,58 @@ export class SecretsManager extends VaultConnector {
 
     @SecureConnector.AccessControl
     protected async listKeys(acRequest: AccessRequest) {
-        console.warn('SecretsManager.listKeys is not implemented');
-        return [];
+        const accountConnector = ConnectorService.getAccountConnector();
+        const teamId = await accountConnector.getCandidateTeam(acRequest.candidate);
+        const secrets = [];
+        let nextToken: string | undefined;
+
+        do {
+            const listResponse: ListSecretsCommandOutput = await this.secretsManager.send(
+                new ListSecretsCommand({ NextToken: nextToken, Filters: [{ Key: 'tag-key', Values: ['smyth-vault'] }, { Key: 'name', Values: [this.getVaultKey(teamId, '')] }] })
+            );
+            if (listResponse.SecretList) {
+                for (const secret of listResponse.SecretList) {
+                    if (secret.Name) {
+                        secrets.push({
+                            ARN: secret.ARN,
+                            Name: secret.Name,
+                            CreatedDate: secret.CreatedDate,
+                        });
+                    }
+                }
+            }
+            nextToken = listResponse.NextToken;
+        } while (nextToken);
+
+      const $promises = [];
+        for (const secret of secrets) {
+            $promises.push(getSpecificSecret(secret, this.secretsManager));
+        }
+        const formattedSecrets = await Promise.all($promises);
+        return formattedSecrets;
+
+        async function getSpecificSecret(secret, secretsManager: SecretsManagerClient) {
+            const data: GetSecretValueCommandOutput = await secretsManager.send(new GetSecretValueCommand({ SecretId: secret.ARN }));
+            let secretString = data.SecretString;
+    
+            if (secretString) {
+              try {
+                let parsedSecret = JSON.parse(secretString);
+                const secretId = secret.Name?.split('/').pop();
+                const key = parsedSecret.key;
+                const value = parsedSecret.value;
+                const metadata = parsedSecret.metadata;
+                return {
+                  id: secretId,
+                  key,
+                  value,
+                  metadata,
+                };
+              } catch (error) {
+              }
+            }
+            return null;
+        }
     }
 
     public async getResourceACL(resourceId: string, candidate: IAccessCandidate) {
@@ -77,64 +133,38 @@ export class SecretsManager extends VaultConnector {
         return acl;
     }
 
-    private async getSecretByName(secretName: string) {
+    private async getSecretByName(acRequest: AccessRequest, secretName: string) {
         try {
-            const secrets = [];
-            let nextToken: string | undefined;
-            do {
-                const listResponse: ListSecretsCommandOutput = await this.secretsManager.send(
-                    new ListSecretsCommand({ NextToken: nextToken, Filters: [{ Key: 'tag-key', Values: ['smyth-vault'] }] })
-                );
-                if (listResponse.SecretList) {
-                    for (const secret of listResponse.SecretList) {
-                        if (secret.Name) {
-                            secrets.push({
-                                ARN: secret.ARN,
-                                Name: secret.Name,
-                                CreatedDate: secret.CreatedDate,
-                            });
-                        }
-                    }
-                }
-                nextToken = listResponse.NextToken;
-            } while (nextToken);
+            const secrets = await this.listKeys(acRequest);
+            const secret = secrets.find((s) => s.key === secretName);
+            return secret?.value;
+        } catch (error) {
+            console.error(error);
+            return null;
+        }      
+    }
 
-            const formattedSecrets = [];
-            const $promises = [];
-            for (const secret of secrets) {
-                $promises.push(getSpecificSecret(secret, this.secretsManager));
-            }
-            const results = await Promise.all($promises);
-            for (const result of results) {
-                formattedSecrets.push(result);
-            }
-            const secret = formattedSecrets.find((s) => s.Name === secretName);
-            return secret;
+    private getVaultKey(teamId: string, secretName: string) {
+        return `${this.prefix.length ? `${this.prefix}/` : ''}${teamId}/${secretName}`;
+    }
+
+    private async getSecretById(teamId: string, secretId: string) {
+        try {
+            const secret: GetSecretValueCommandOutput = await this.secretsManager.send(new GetSecretValueCommand({ SecretId: this.getVaultKey(teamId, secretId) }));
+            return this.getSecretValue(secret);
         } catch (error) {
             console.error(error);
+            return null;
         }
+    }
 
-        async function getSpecificSecret(secret, secretsManager: SecretsManagerClient) {
-            const data: GetSecretValueCommandOutput = await secretsManager.send(new GetSecretValueCommand({ SecretId: secret.ARN }));
-            let secretString = data.SecretString;
-            let secretName = secret.Name;
-
-            if (secretString) {
-                try {
-                    let parsedSecret = JSON.parse(secretString);
-                    if (Object.keys(parsedSecret).length === 1) {
-                        secretName = Object.keys(parsedSecret)[0];
-                        secretString = parsedSecret[secretName];
-                    }
-                } catch (error) {}
-            }
-            return {
-                Name: secretName,
-                ARN: secret.ARN,
-                CreatedDate: secret.CreatedDate,
-                SecretId: secret.Name,
-                SecretString: secretString,
-            };
+    private getSecretValue(secret: GetSecretValueCommandOutput) {
+        try {
+            const parsedSecret = typeof secret.SecretString === 'string' ? JSON.parse(secret.SecretString) : secret.SecretString;
+            return parsedSecret.value;
+        } catch (error) {
+            return null;
         }
+    
     }
 }

package/src/types/LLM.types.ts

@@ -80,6 +80,7 @@ export type TxAIToolsInfo = {
     };
 };
 
+// #region TLLMParams
 export type TToolsInfo = {
     openai: TOpenAIToolsInfo;
     xai: TxAIToolsInfo;
@@ -189,6 +190,8 @@ type TLLMImageGenConfig = {
 
 export type TLLMParams = TLLMTextGenConfig & TLLMSearchConfig & TLLMImageGenConfig & TLLMMiscConfig & TLLMRuntimeContext;
 
+// #endregion TLLMParams
+
 export type TLLMPreparedParams = TLLMParams & {
     body: any;
     modelEntryName?: string; // for usage reporting
@@ -344,6 +347,7 @@ export type ToolData = {
     function?: any;
     error?: string; // for Bedrock
     callId?: string; // for OpenAI Responses API call ID mapping
+    thoughtSignature?: string; // for Google AI - required to maintain reasoning context
 };
 
 /**
@@ -571,6 +575,7 @@ export interface TGoogleAIRequestBody {
         topK?: number;
         stopSequences?: string[];
         responseMimeType?: string;
+        media_resolution?: 'low' | 'medium' | 'high';
     };
     tools?: any;
     toolConfig?: any;