@tasksai/install 0.1.38 → 0.1.40

package/runtime/software_use.py

@@ -0,0 +1,39 @@
+"""OS-held software-use lock; released by the OS if its process exits."""
+from contextlib import contextmanager
+from pathlib import Path
+import os
+
+
+@contextmanager
+def software_use(install_dir, *, exclusive=False):
+    lock = Path(install_dir) / '.software-use.lock'
+    if lock.is_symlink():
+        raise RuntimeError('Software-use lock cannot be a symbolic link')
+    with lock.open('a+b') as stream:
+        if os.name == 'nt':
+            import ctypes
+            from ctypes import wintypes
+            import msvcrt
+            class Overlapped(ctypes.Structure):
+                _fields_ = [('Internal',ctypes.c_size_t),('InternalHigh',ctypes.c_size_t),
+                            ('Offset',wintypes.DWORD),('OffsetHigh',wintypes.DWORD),('hEvent',wintypes.HANDLE)]
+            kernel = ctypes.WinDLL('kernel32',use_last_error=True)
+            kernel.LockFileEx.argtypes = [wintypes.HANDLE,wintypes.DWORD,wintypes.DWORD,wintypes.DWORD,wintypes.DWORD,ctypes.POINTER(Overlapped)]
+            kernel.LockFileEx.restype = wintypes.BOOL
+            kernel.UnlockFileEx.argtypes = [wintypes.HANDLE,wintypes.DWORD,wintypes.DWORD,wintypes.DWORD,ctypes.POINTER(Overlapped)]
+            kernel.UnlockFileEx.restype = wintypes.BOOL
+            handle = msvcrt.get_osfhandle(stream.fileno())
+            overlap = Overlapped()
+            if not kernel.LockFileEx(handle,1 | (2 if exclusive else 0),0,1,0,ctypes.byref(overlap)):
+                raise ctypes.WinError(ctypes.get_last_error())
+        else:
+            import fcntl
+            fcntl.flock(stream.fileno(), (fcntl.LOCK_EX if exclusive else fcntl.LOCK_SH) | fcntl.LOCK_NB)
+        try:
+            yield
+        finally:
+            if os.name == 'nt':
+                if not kernel.UnlockFileEx(handle,0,1,0,ctypes.byref(overlap)):
+                    raise ctypes.WinError(ctypes.get_last_error())
+            else:
+                fcntl.flock(stream.fileno(), fcntl.LOCK_UN)

package/runtime/workflow-requirements.txt

@@ -0,0 +1,5 @@
+mcp==1.28.1
+jsonschema==4.25.1
+python-docx==1.2.0
+pypdf==6.10.0
+XlsxWriter==3.2.9

package/runtime/workflows/account_snapshot.py

@@ -0,0 +1,33 @@
+"""Local display-only credit receipt. Never stores credentials or calls an API."""
+from datetime import datetime,timezone
+import json
+import os
+import uuid
+from pathlib import Path
+from .licensed_delivery import safe_directory
+from .store import JobError
+
+
+def read(root):
+    path=Path(root)/'account-display.json'
+    if path.is_symlink():raise JobError('Account display must not be a symbolic link')
+    if not path.exists():return {'credits':None,'updated_at':None,'license_type':None}
+    data=json.loads(path.read_text(encoding="utf-8"))
+    return {key:data.get(key) for key in ('credits','updated_at','license_type')}
+
+
+def remember(root,result):
+    credits=result.get('credits_balance',result.get('credits_remaining'))
+    if isinstance(credits,bool) or not isinstance(credits,int) or credits<0:return
+    root=safe_directory(root);prior=read(root)
+    kind=result.get('license_type',prior.get('license_type'))
+    if not isinstance(kind,str) or len(kind)>80:kind=None
+    data={'credits':credits,'updated_at':datetime.now(timezone.utc).isoformat(),'license_type':kind}
+    temporary=root/('account-display-'+uuid.uuid4().hex+'.tmp')
+    descriptor=os.open(temporary,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
+    try:
+        with os.fdopen(descriptor,'w',encoding='utf-8') as stream:
+            json.dump(data,stream);stream.flush();os.fsync(stream.fileno())
+        temporary.replace(root/'account-display.json')
+    finally:
+        temporary.unlink(missing_ok=True)

package/runtime/workflows/attachments.py

@@ -0,0 +1,45 @@
+"""Private-trial uploads backed by the existing immutable document store."""
+import base64
+import binascii
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from .documents import Documents, EXTENSIONS
+from .store import JobError, label
+
+MAX_UPLOAD = 2_000_000
+
+def upload(demo, job_id, filename, encoded, request_id):
+    label(request_id, 'request_id')
+    label(filename, 'filename')
+    job = demo.store.read(job_id)
+    if not job['current'] or job['current']['input'].get('example') is not True:
+        raise JobError('Only fictional projects are available in this trial')
+    if Path(filename).name != filename or '/' in filename or '\\' in filename or filename in ('.', '..'):
+        raise JobError('Choose a file by its filename, not a computer path')
+    if Path(filename).suffix.lower() not in EXTENSIONS:
+        raise JobError('Choose a PDF, Word document, or text file')
+    if not isinstance(encoded, str) or len(encoded) > 4 * ((MAX_UPLOAD + 2) // 3):
+        raise JobError('This trial accepts files up to 2 MB')
+    try:
+        raw = base64.b64decode(encoded, validate=True)
+    except (ValueError, binascii.Error):
+        raise JobError('The uploaded file could not be read; choose it again')
+    if not raw or len(raw) > MAX_UPLOAD:
+        raise JobError('Choose a nonempty file up to 2 MB')
+    # Isolated staging prevents same-name uploads from overwriting one another.
+    # Documents captures the original and extracted text before staging is removed.
+    with TemporaryDirectory(prefix='upload-', dir=demo.root) as temporary:
+        inbox = Path(temporary)
+        selected = inbox / filename
+        selected.write_bytes(raw); selected.chmod(0o600)
+        result = Documents(demo.store, inbox).import_document(job_id, filename, request_id, True)
+    view = demo.view(job_id)
+    view['notice'] = 'Document saved to this project. It is available to reuse; your generated documents have not changed.'
+    view['uploaded_document_id'] = result['document_id']
+    return view
+
+
+def read(demo, job_id, document_id):
+    result = demo.gateway.documents.read(job_id, document_id)
+    # Never expose filesystem paths or storage implementation to the host/card.
+    return {key: result[key] for key in ('id', 'filename', 'source_id', 'created_at', 'parts', 'warnings')}

package/runtime/workflows/authority_guides.py

@@ -0,0 +1,81 @@
+"""Immutable local copies of loader source metadata, not fetched source contents."""
+from datetime import date, datetime, timezone
+from hashlib import sha256
+import json
+import os
+from pathlib import Path
+import re
+import uuid
+from .licensed_delivery import safe_directory
+from .store import JobError, canonical
+
+PACK_FIELDS = ('status','coverage_level','state_name','state_code','county','locality','district','mls',
+               'registry_reviewed_on','registry_refresh_due_on','resolution_source')
+SOURCE_FIELDS = ('title','authority','jurisdiction','scope_type','effective_date','verification_status',
+                 'reviewed_on','refresh_due_on','url','purpose','limits')
+LIST_FIELDS = ('authority_layers','required_user_authorities','instructions')
+
+
+def _text(value):
+    if value is None:return None
+    if not isinstance(value,str) or len(value)>10000:raise JobError('Invalid source guide metadata')
+    return value
+
+
+def remember(root,skill_id,result):
+    if not re.fullmatch(r'realtor_[a-z0-9_]+',skill_id) or result.get('skill_id')!=skill_id:
+        raise JobError('Source guide does not match the requested skill')
+    packet={'skill_id':skill_id,**{k:_text(result.get(k)) for k in PACK_FIELDS}}
+    for key in LIST_FIELDS:
+        values=result.get(key) or []
+        if not isinstance(values,list) or len(values)>100:raise JobError('Source guide is too large')
+        packet[key]=[_text(v) for v in values]
+    sources=result.get('sources') or []
+    if not isinstance(sources,list) or len(sources)>100:raise JobError('Source guide is too large')
+    packet['sources']=[{k:_text(source.get(k)) for k in SOURCE_FIELDS} for source in sources]
+    encoded=canonical(packet).encode('utf-8')
+    if len(encoded)>200000:raise JobError('Source guide is too large')
+    identity=sha256(encoded).hexdigest();folder=safe_directory(Path(root)/'authority-guides')
+    destination=folder/(identity+'.json')
+    if destination.is_symlink():raise JobError('Source guide path must not be a symbolic link')
+    if not destination.exists():
+        temporary=folder/(uuid.uuid4().hex+'.tmp')
+        descriptor=os.open(temporary,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
+        try:
+            with os.fdopen(descriptor,'w',encoding='utf-8',newline='\n') as stream:
+                json.dump({'id':identity,'captured_at':datetime.now(timezone.utc).isoformat(),'packet':packet},stream)
+                stream.flush();os.fsync(stream.fileno())
+            # Exclusive destination creation preserves an existing immutable receipt.
+            try:
+                os.link(temporary,destination)
+            except FileExistsError:pass
+        finally:temporary.unlink(missing_ok=True)
+    return read(root,identity)
+
+
+def read(root,identity,today=None):
+    if not isinstance(identity,str) or not re.fullmatch(r'[a-f0-9]{64}',identity):raise JobError('Invalid source guide ID')
+    folder=Path(root)/'authority-guides';path=folder/(identity+'.json')
+    if folder.is_symlink() or path.is_symlink():raise JobError('Source guide path must not be a symbolic link')
+    record=json.loads(path.read_text(encoding='utf-8'));packet=record['packet']
+    if record.get('id')!=identity or sha256(canonical(packet).encode('utf-8')).hexdigest()!=identity:
+        raise JobError('Saved source guide changed')
+    today=today or date.today()
+    deadlines=[packet.get('registry_refresh_due_on')]+[s.get('refresh_due_on') for s in packet['sources']]
+    try:refresh_needed=any(not value or date.fromisoformat(value)<=today for value in deadlines)
+    except (ValueError,TypeError):refresh_needed=True
+    return {**record,'refresh_needed':refresh_needed,'metadata_only':True,'source_text_available':False}
+
+
+def for_skill(root,skill_id):
+    folder=Path(root)/'authority-guides'
+    if folder.is_symlink():raise JobError('Source guide path must not be a symbolic link')
+    if not folder.exists():return {'guides':[],'unavailable':0}
+    guides=[];unavailable=0
+    for path in folder.glob('*.json'):
+        try:
+            guide=read(root,path.stem)
+            if guide['packet']['skill_id']==skill_id:guides.append(guide)
+        except (JobError,OSError,ValueError,KeyError,TypeError):unavailable+=1
+    guides.sort(key=lambda guide:guide.get('captured_at',''),reverse=True)
+    return {'guides':guides,'unavailable':unavailable}

package/runtime/workflows/catalog.py

@@ -0,0 +1,51 @@
+"""Attach local presentation to an already selected and delivered skill.
+
+No catalog search, API calls, billing, source rewriting, or content generation.
+Bindings are application configuration, never user answers or uploaded files.
+"""
+from dataclasses import dataclass
+from hashlib import sha256
+
+from .store import JobError
+from .template import InputField, OutputFile, WorkflowTemplate
+
+
+@dataclass(frozen=True)
+class CatalogBinding:
+    product_id: str
+    skill_id: str
+    content_sha256: str
+    title: str
+    inputs: tuple[InputField, ...]
+    input_evidence: tuple[str, ...]
+    outputs: tuple[OutputFile, ...]
+    no_input_evidence: str = ''
+
+    def attach(self, *, product_id, skill_id, content):
+        """Fail closed on different delivered content; retain every instruction.
+
+        Exact quotes anchor field mappings to the source but do not establish
+        that a mapping is semantically correct. Developers must check optional
+        and conditional inputs before installing a binding.
+        """
+        if (product_id, skill_id) != (self.product_id, self.skill_id):
+            raise JobError('Presentation does not match the selected skill')
+        if not isinstance(content, str) or not content.strip() or sha256(content.encode()).hexdigest() != self.content_sha256:
+            raise JobError('Skill content changed; its presentation needs updating')
+        if len(self.inputs) != len(self.input_evidence):
+            raise JobError('Each input needs its original instruction')
+        evidence = self.input_evidence if self.inputs else (self.no_input_evidence,)
+        if any(not quote.strip() or quote not in content for quote in evidence):
+            raise JobError('Input mapping needs evidence from the selected skill')
+        template = WorkflowTemplate(self.skill_id, self.product_id, self.title, self.inputs, self.outputs)
+        return AttachedSkill(template, content)
+
+
+@dataclass(frozen=True)
+class AttachedSkill:
+    template: WorkflowTemplate
+    instructions: str
+
+    def intake(self, answers=None):
+        # Partial answers are allowed; missing fields remain visible.
+        return self.template.input_state(answers)

package/runtime/workflows/catalog_app.py

@@ -0,0 +1,174 @@
+"""Private-loopback customer workspace. No public HTTP routes or account secrets."""
+import argparse
+import asyncio
+import base64
+import json
+from pathlib import Path
+import secrets
+import socket
+import tempfile
+import uuid
+from starlette.applications import Starlette
+from starlette.responses import HTMLResponse,JSONResponse,PlainTextResponse,FileResponse
+from starlette.routing import Route
+from starlette.background import BackgroundTask
+from .catalog_workspace import CatalogWorkspace
+from .documents import Documents,EXTENSIONS,MAX_BYTES
+from .folders import Folders
+from .released_catalog import registry
+from .store import JobError
+from .workspace_launch import runtime_fingerprint
+
+ASSETS=Path(__file__).parent/'embedded'
+MAX_ENCODED_BYTES=4*((MAX_BYTES+2)//3)
+MAX_REQUEST_BYTES=MAX_ENCODED_BYTES+64_000
+
+
+async def bounded_json(request):
+    declared=request.headers.get('content-length')
+    if declared is not None:
+        try:size=int(declared)
+        except ValueError:raise JobError('Invalid request size')
+        if size<0 or size>MAX_REQUEST_BYTES:raise JobError('Input too large; choose a smaller document')
+    body=bytearray()
+    async for chunk in request.stream():
+        if len(body)+len(chunk)>MAX_REQUEST_BYTES:raise JobError('Input too large; choose a smaller document')
+        body.extend(chunk)
+    return json.loads(body)
+
+def app(workspace,token,*,on_shutdown=None):
+    active_actions=0
+    closing=False
+    prefix='/workspace/'+token
+    started_fingerprint=runtime_fingerprint()
+    page_html=(ASSETS/'catalog.html').read_text(encoding="utf-8").replace('__UPLOAD_LIMIT_BYTES__',str(MAX_BYTES)).replace('__UPLOAD_LIMIT_MB__',str(MAX_BYTES//1_000_000))
+    def local(request): return request.url.hostname in ('127.0.0.1','localhost')
+    async def health(request):
+        if not local(request):return PlainTextResponse('Not found',404)
+        from .workspace_launch import workspace_identity
+        return JSONResponse({'workspace_id':workspace_identity(workspace.root,workspace.store.owner),'runtime_fingerprint':started_fingerprint,'closing':closing})
+    async def page(request):
+        if not local(request):return PlainTextResponse('Not found',404)
+        return HTMLResponse(page_html,headers={'Cache-Control':'no-store','Content-Security-Policy':"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'"})
+    async def action(request):
+        nonlocal active_actions
+        if not local(request) or request.headers.get('origin')!=str(request.base_url).rstrip('/') or request.headers.get('content-type')!='application/json':
+            return PlainTextResponse('Not found',404)
+        if closing:return JSONResponse({'error':'Workspace is closing. Reopen it from your AI assistant.'},status_code=409)
+        active_actions+=1
+        try:
+            if runtime_fingerprint()!=started_fingerprint:
+                return JSONResponse({'error':'TasksAI has been updated. Reopen the workspace from your AI assistant to use the updated version. Your saved projects and documents are still available.'},status_code=409)
+            payload=await bounded_json(request);name=payload['action'];job_id=payload.get('job_id')
+            if name=='account':
+                from .account_snapshot import read
+                result=read(workspace.root)
+            elif name=='projects': result=workspace.projects(50,payload.get('offset',0))
+            elif name=='skills':
+                result={'skills':[]}
+                for skill_id,release in registry().items():
+                    path=workspace.root/'licensed-skills'/skill_id/release['content_sha256']/'instructions.md'
+                    if path.is_file(): result['skills'].append({'skill_id':skill_id,**release})
+            elif name=='create':result=workspace.create(payload['skill_id'],payload['version'],payload['content_hash'],payload['matter'],payload['request_id'])
+            elif name=='open':result=workspace.view(job_id)
+            elif name=='answers':result=workspace.save_answers(job_id,payload['answers'],payload['sequence'],payload.get('user_request'))
+            elif name=='documents':result={'documents':Documents(workspace.store,allow_customer_documents=True).list(job_id)}
+            elif name=='capture-source':
+                from .source_capture import capture
+                result=await asyncio.to_thread(capture,workspace,job_id,payload['guide_id'],payload['source_index'])
+            elif name=='select-authority':result=workspace.select_authority_guide(job_id,payload.get('guide_id'),payload['sequence'])
+            elif name=='authority-guides':
+                from .authority_guides import for_skill
+                result=for_skill(workspace.root,workspace.binding(job_id)['skill_id'])
+            elif name=='recommend-documents':
+                from .document_selection import recommend
+                result=await asyncio.to_thread(recommend,workspace,job_id)
+            elif name=='upload':
+                workspace.view(job_id);filename=payload['filename']
+                if not isinstance(filename,str) or Path(filename).name!=filename or '\\' in filename or Path(filename).suffix.lower() not in EXTENSIONS:raise JobError('Choose a PDF, Word or text document')
+                encoded=payload['encoded']
+                if not isinstance(encoded,str) or len(encoded)>MAX_ENCODED_BYTES:raise JobError(f'Choose a file up to {MAX_BYTES//1_000_000} MB')
+                raw=base64.b64decode(encoded,validate=True)
+                if not 0<len(raw)<=MAX_BYTES:raise JobError(f'Choose a file up to {MAX_BYTES//1_000_000} MB')
+                with tempfile.TemporaryDirectory(dir=workspace.root) as directory:
+                    selected=Path(directory)/filename;selected.write_bytes(raw)
+                    result=Documents(workspace.store,Path(directory),allow_customer_documents=True).import_document(job_id,filename,payload['request_id'],False)
+            elif name=='suggest':
+                if payload.get('consent') is not True:raise JobError('Confirm sending the selected document text to your AI assistant')
+                from .catalog_suggestions import suggest
+                result=await asyncio.to_thread(suggest,workspace,job_id,payload.get('document_ids',[]))
+            elif name=='apply-suggestion':
+                from .catalog_suggestions import apply
+                result=apply(workspace,job_id,payload['suggestion_id'],payload['candidate_id'],payload['sequence'])
+            elif name=='generate':
+                if payload.get('consent') is not True:raise JobError('Confirm sending the saved answers and selected document text to your AI assistant')
+                from .catalog_generation import generate
+                result=await asyncio.to_thread(generate,workspace,job_id,payload['sequence'],payload.get('revision'),payload['request_id'],payload['request'],payload.get('document_ids',[]))
+            elif name=='review':
+                if workspace.view(job_id)['needs_regeneration']:raise JobError('Saved answers are newer than the files. Generate the updated documents before reviewing them.')
+                if payload.get('confirmed') is not True:raise JobError('Confirm that you reviewed this version')
+                ticket=workspace.store.request_review(job_id,payload['revision'],payload['request_id'],'Current catalog work product and supporting evidence')
+                workspace.store.record_local_review(ticket['id'],payload['reviewer'],'review_recorded',workspace.store.review_attestation(ticket,'review_recorded'),evidence_kind='card_attestation')
+                result=workspace.view(job_id)
+            elif name=='folders':result=Folders(workspace).settings(job_id)
+            elif name in ('input','output'):result=await asyncio.to_thread(Folders(workspace).select,job_id,name)
+            elif name=='scan':result=await asyncio.to_thread(Folders(workspace).scan,job_id)
+            elif name=='export':result=await asyncio.to_thread(Folders(workspace).save,job_id)
+            else:raise JobError('Unknown workspace action')
+            return JSONResponse(result,headers={'Cache-Control':'no-store'})
+        except (JobError,ValueError,KeyError,TypeError,OSError) as exc:
+            return JSONResponse({'error':str(exc)},status_code=400)
+        finally:
+            active_actions-=1
+    async def shutdown(request):
+        nonlocal closing
+        if not local(request) or request.headers.get('origin')!=str(request.base_url).rstrip('/') or request.headers.get('content-type')!='application/json':
+            return PlainTextResponse('Not found',404)
+        try:
+            payload=await bounded_json(request)
+            if payload.get('confirmed') is not True:raise JobError('Confirm closing this local workspace')
+            if active_actions:return JSONResponse({'error':'TasksAI is still working. Wait for the current action to finish before closing.'},status_code=409)
+            if closing:return JSONResponse({'status':'closing'})
+            if on_shutdown is None:raise JobError('This workspace cannot be closed from this screen')
+            draft=payload.get('draft')
+            if draft is not None:
+                if not isinstance(draft,dict):raise JobError('Invalid answers to save before closing')
+                workspace.save_answers(draft['job_id'],draft['answers'],draft['sequence'],draft.get('user_request'))
+            closing=True
+            return JSONResponse({'status':'closing'},background=BackgroundTask(on_shutdown))
+        except (JobError,ValueError,TypeError,AttributeError,KeyError) as exc:return JSONResponse({'error':str(exc)},status_code=400)
+    async def download(request):
+        if not local(request):return PlainTextResponse('Not found',404)
+        try:
+            job=workspace.store.read(request.path_params['job_id'])
+            if not job['current'] or request.query_params.get('revision')!=job['current_revision']:raise JobError('Reopen the project to get its current files')
+            names={'word':'work-product.docx','excel':'work-product.xlsx'};filename=names.get(request.path_params['kind'])
+            if not filename:raise JobError('Unknown document')
+            path=Path(job['current']['directory'])/'package'/filename
+            if not path.is_file():raise JobError('This project does not include that document')
+            return FileResponse(path,filename=filename,headers={'Cache-Control':'no-store'})
+        except JobError as exc:return PlainTextResponse(str(exc),400)
+    async def source(request):
+        if not local(request):return PlainTextResponse('Not found',404)
+        try:
+            document=Documents(workspace.store,allow_customer_documents=True).read(request.path_params['job_id'],request.path_params['document_id'])
+            return FileResponse(document['original_file'],filename=document['filename'],
+                                headers={'Cache-Control':'no-store','X-Content-Type-Options':'nosniff'})
+        except (JobError,OSError,ValueError):
+            return PlainTextResponse('This saved source is unavailable. Reopen the project and add the original again.',400)
+    return Starlette(routes=[Route(prefix,page),Route(prefix+'/health',health),Route(prefix+'/shutdown',shutdown,methods=['POST']),Route(prefix+'/action',action,methods=['POST']),Route(prefix+'/file/{job_id}/{kind}',download),Route(prefix+'/source/{job_id}/{document_id}',source)])
+
+
+def main():
+    parser=argparse.ArgumentParser(description=__doc__);parser.add_argument('--root',type=Path,required=True);parser.add_argument('--owner',required=True);parser.add_argument('--port',type=int,default=0);args=parser.parse_args()
+    workspace=CatalogWorkspace(args.root.resolve(),args.owner);token=secrets.token_urlsafe(32)
+    sock=socket.socket();sock.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1);sock.bind(('127.0.0.1',args.port));port=sock.getsockname()[1]
+    connection=workspace.root/'workspace-connection.json'
+    connection.write_text(json.dumps({'url':f'http://127.0.0.1:{port}/workspace/{token}'}), encoding="utf-8");connection.chmod(0o600)
+    import uvicorn
+    server=uvicorn.Server(uvicorn.Config(app(workspace,token,on_shutdown=lambda:setattr(server,'should_exit',True)),host='127.0.0.1',port=port,access_log=False))
+    server.run(sockets=[sock])
+if __name__=='__main__':
+    from software_use import software_use
+    with software_use(Path(__file__).resolve().parents[2]):
+        main()