create-workframe 0.1.17 → 0.1.20

package/workframe-api/handler_modules/handler_provider.py

@@ -8,7 +8,6 @@ from typing import Any
 import action_proxy
 import internal_proxy_auth
 import llm_proxy
-import openrouter_catalog
 import platform_auth
 import run_surface_wiring
 
@@ -125,7 +124,8 @@ class ProviderRoutesMixin:
             self._json(401, {"ok": False, "error": "no_session"})
             return
         workspace_id = qs.get("workspace_id", [""])[0]
-        self._json(200, srv.list_user_providers(user_id, workspace_id))
+        credential_scope = qs.get("credential_scope", ["effective"])[0]
+        self._json(200, srv.list_user_providers(user_id, workspace_id, credential_scope))
 
     def _route_post_me_credentials(self, body: dict) -> None:
         srv = _srv()
@@ -191,19 +191,18 @@ class ProviderRoutesMixin:
             self._json(500, {"ok": False, "error": f"db_error: {exc}"})
             return
         srv._invalidate_user_llm_picker_cache(user_id)
+        srv._revoke_runtime_llm_leases(payer_user_id=user_id, provider=provider)
         self._log_audit("credential_stored", "credential_binding", cred_id, f"provider={provider}")
-        health: dict[str, Any] = {}
-        if provider == "openrouter":
-            secret_probe = srv._credential_secret(
-                {
-                    "credential_ref": cred_ref,
-                    "scope": "user",
-                    "user_id": user_id,
-                },
-                user_id,
-            )
-            if secret_probe:
-                health = openrouter_catalog.probe_account(secret_probe)
+        # Credential persistence must not depend on an upstream network round-trip.
+        # OpenRouter's account endpoints can each consume their full timeout when a
+        # self-hosted install has restricted egress, leaving the settings UI stuck
+        # in "Saving…" even though the encrypted credential is already committed.
+        # Model/catalog requests provide the first real provider health signal.
+        health: dict[str, Any] = {
+            "ok": True,
+            "provider": provider,
+            "status": "stored",
+        }
         try:
             srv._bootstrap_model_after_llm_connect(user_id, str(body.get("workspace_id") or ""), provider)
         except (OSError, RuntimeError, ValueError) as exc:

package/workframe-api/handler_modules/handler_workspace.py

@@ -15,6 +15,7 @@ import uuid
 import activity_feed
 import api_errors
 import chat_bind
+import message_reactions
 from email_sender import APP_BASE_URL, send_branded_invite_email
 
 list_room_sessions = chat_bind.list_room_sessions
@@ -31,6 +32,56 @@ def _srv():
 
 class WorkspaceRoutesMixin:
 
+    def _route_get_message_reactions(self, qs: dict[str, list[str]]) -> None:
+        srv = _srv()
+        user_id = str(getattr(self, "auth_user", "") or "")
+        if not user_id:
+            self._json(401, {"ok": False, "error": "no_session"})
+            return
+        conn = srv._workframe_db()
+        try:
+            payload = message_reactions.list_reactions(
+                conn,
+                qs.get("scope", [""])[0],
+                user_id,
+                srv._user_can_access_room,
+            )
+        except PermissionError:
+            self._json(403, {"ok": False, "error": "forbidden"})
+            return
+        except ValueError as exc:
+            self._json(400, {"ok": False, "error": str(exc)})
+            return
+        finally:
+            conn.close()
+        self._json(200, payload)
+
+    def _route_post_message_reactions_toggle(self, body: dict) -> None:
+        srv = _srv()
+        user_id = str(getattr(self, "auth_user", "") or "")
+        if not user_id:
+            self._json(401, {"ok": False, "error": "no_session"})
+            return
+        conn = srv._workframe_db()
+        try:
+            payload = message_reactions.toggle_reaction(
+                conn,
+                str(body.get("scope") or ""),
+                str(body.get("message_id") or ""),
+                str(body.get("emoji") or ""),
+                user_id,
+                srv._user_can_access_room,
+            )
+        except PermissionError:
+            self._json(403, {"ok": False, "error": "forbidden"})
+            return
+        except ValueError as exc:
+            self._json(400, {"ok": False, "error": str(exc)})
+            return
+        finally:
+            conn.close()
+        self._json(200, payload)
+
     def _route_get_board(self, qs: dict[str, list[str]]) -> None:
         srv = _srv()
         self._json(200, srv.board_list())
@@ -452,8 +503,9 @@ class WorkspaceRoutesMixin:
             return
         sender_agent = str(body.get("sender_agent_id", "")).strip()
         content = str(body.get("content", "")).strip()
-        content_type = str(body.get("content_type", "text")).strip()
-        parent_id = str(body.get("parent_message_id", "") or None)
+        content_type = str(body.get("content_type") or "text").strip()
+        parent_value = body.get("parent_message_id")
+        parent_id = str(parent_value).strip() if parent_value else None
         if not content:
             self._json(400, {"error": "content required"})
             return
@@ -875,6 +927,7 @@ class WorkspaceRoutesMixin:
             self._json(400, {"error": str(exc)})
             return
         cred_id = str(payload["credential_id"])
+        srv._revoke_runtime_llm_leases(workspace_id=ws_id, provider=provider)
         self._log_audit("credential_stored", "credential_binding", cred_id, f"provider={provider}")
         try:
             srv._bootstrap_model_after_llm_connect("", ws_id, provider)
@@ -923,6 +976,11 @@ class WorkspaceRoutesMixin:
         if not affected:
             self._json(404, {"error": "credential_not_found"})
             return
+        srv._revoke_runtime_llm_leases(
+            workspace_id=ws_id,
+            provider=provider,
+            credential_binding_id=binding_id,
+        )
         self._log_audit("credential_revoked", "credential_binding", binding_id, f"workspace={ws_id}")
         spec = srv._catalog_provider(provider)
         if spec and str(spec.get("category") or "") == "messaging":

package/workframe-api/hermes_profiles.py

@@ -10,6 +10,7 @@ import shutil
 import sqlite3
 import time
 import uuid
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
@@ -223,12 +224,19 @@ def _scrub_orphan_top_level_yaml_lines(profile: str) -> None:
         return
     out: list[str] = []
     changed = False
+    root_list_key = ""
     for line in lines:
         stripped = line.lstrip()
         indent = len(line) - len(stripped)
         if indent == 0 and stripped.startswith("- "):
+            if root_list_key == "fallback_providers":
+                out.append(line)
+                continue
             changed = True
             continue
+        if indent == 0 and stripped and not stripped.startswith("#") and ":" in stripped:
+            key, _, value = stripped.partition(":")
+            root_list_key = key.strip() if not value.strip() else ""
         out.append(line)
     if changed:
         try:
@@ -724,6 +732,14 @@ def _agent_label(profile: str) -> str:
 
 
 def _native_display_name() -> str:
+    slug = str(_srv().NATIVE_PROFILE or "").strip()
+    if slug:
+        db_name = _agent_db_display_name(slug)
+        if db_name:
+            return db_name
+        reg_name = str(_srv()._agent_registry_row(slug).get("display_name") or "").strip()
+        if reg_name:
+            return reg_name
     return f"{_srv().PROJECT_NAME} Agent"
 
 
@@ -1122,6 +1138,9 @@ def profile_create(
                 if lane.get("room"):
                     results["room"] = lane["room"]
                 results["steps"].extend(lane.get("steps") or [])
+                if lane.get("ok") is False:
+                    results["ok"] = False
+                    results["error"] = str(lane.get("error") or "bootstrap_dm_lane_failed")
             except Exception as exc:
                 results["steps"].append({"step": "bootstrap_dm_lane", "ok": False, "error": str(exc)})
                 results["ok"] = False
@@ -1159,15 +1178,18 @@ def profile_create(
     if _install_child_base_artifacts(prof, display_name=child_label, role=child_role):
         results["steps"].append({"step": "install_child_base", "ok": True})
     
-    # 2. Start the gateway for this profile
-    try:
-        ok, out, port = _srv()._configure_profile_api(prof)
-        results["steps"].append({"step": "configure_api", "ok": ok, "api_port": port, "output": out.strip()})
-        if ok:
-            ok2, out2 = _srv()._patch_profile_gateway_run_script(prof)
-            results["steps"].append({"step": "patch_run_script", "ok": ok2, "output": out2.strip()})
-    except Exception as exc:
-        results["steps"].append({"step": "configure_api", "ok": False, "error": str(exc)})
+    # 2. A per-user DM runtime owns its gateway. The child template is identity/config
+    # authority only, so starting a second template gateway is both redundant and a
+    # secure-mode false failure. Standalone profile creation still provisions one.
+    if not bootstrap_dm:
+        try:
+            ok, out, port = _srv()._configure_profile_api(prof)
+            results["steps"].append({"step": "configure_api", "ok": ok, "api_port": port, "output": out.strip()})
+            if ok:
+                ok2, out2 = _srv()._patch_profile_gateway_run_script(prof)
+                results["steps"].append({"step": "patch_run_script", "ok": ok2, "output": out2.strip()})
+        except Exception as exc:
+            results["steps"].append({"step": "configure_api", "ok": False, "error": str(exc)})
     
     # 3–4. Template model/gateway only when not bootstrapping a per-user DM runtime (C1).
     if not bootstrap_dm:

package/workframe-api/llm_proxy.py

@@ -115,8 +115,14 @@ def _build_upstream_request(
             "authorization",
             "x-api-key",
             "x-goog-api-key",
+            "accept-encoding",
         }
     }
+    # urllib does not transparently decode compressed upstream responses. If
+    # the caller's Accept-Encoding reaches OpenRouter, gzip bytes can be sent
+    # back as JSON after this proxy normalizes response headers. Prefer an
+    # identity response and still preserve Content-Encoding defensively below.
+    upstream_headers["Accept-Encoding"] = "identity"
     upstream_headers.update(upstream_auth_header(provider, secret))
     if provider == "openrouter":
         upstream_headers.setdefault("HTTP-Referer", "https://workfra.me")
@@ -150,10 +156,16 @@ def forward_request(
         with urllib.request.urlopen(req, timeout=600) as resp:
             resp_body = resp.read()
             out_headers = {"Content-Type": resp.headers.get("Content-Type", "application/octet-stream")}
+            content_encoding = resp.headers.get("Content-Encoding", "").strip()
+            if content_encoding:
+                out_headers["Content-Encoding"] = content_encoding
             return resp.status, out_headers, resp_body
     except urllib.error.HTTPError as exc:
         raw = exc.read()
         out_headers = {"Content-Type": exc.headers.get("Content-Type", "application/json")}
+        content_encoding = exc.headers.get("Content-Encoding", "").strip()
+        if content_encoding:
+            out_headers["Content-Encoding"] = content_encoding
         return exc.code, out_headers, raw
 
 
@@ -190,6 +202,9 @@ def stream_request_to_handler(
             content_type = resp.headers.get("Content-Type", "application/octet-stream")
             handler.send_response(resp.status)
             handler.send_header("Content-Type", content_type)
+            content_encoding = resp.headers.get("Content-Encoding", "").strip()
+            if content_encoding:
+                handler.send_header("Content-Encoding", content_encoding)
             handler.end_headers()
             if "text/event-stream" in content_type.lower():
                 while True:
@@ -209,6 +224,9 @@ def stream_request_to_handler(
         raw = exc.read()
         handler.send_response(exc.code)
         handler.send_header("Content-Type", exc.headers.get("Content-Type", "application/json"))
+        content_encoding = exc.headers.get("Content-Encoding", "").strip()
+        if content_encoding:
+            handler.send_header("Content-Encoding", content_encoding)
         handler.end_headers()
         handler.wfile.write(raw)
     except urllib.error.URLError as exc:

package/workframe-api/mention_invoke.py

@@ -77,22 +77,31 @@ def _invoke_room_agent_mention(
     # session. The triggering user's vault credential is overlaid per turn
     # below; do not switch the room onto that user's private runtime profile.
     hermes_slug = template_slug
-    display_model = str(agent_row.get("model_name") or "").strip()
-    display_provider = str(agent_row.get("model_provider") or "").strip()
-    if not display_model:
-        display_model = str(_srv()._read_model_block(hermes_slug).get("default") or "").strip()
-    if not display_provider:
-        display_provider = _srv()._llm_billing_provider(
-            hermes_slug,
-            user_id=triggered_by_user_id,
-            workspace_id=workspace_id,
-        )
+    # The Hermes agent template is the provider/model source of truth. The DB
+    # columns are a UI index and may lag a just-completed save, so never let
+    # them choose execution routing for a room mention.
+    model_block = _srv()._read_model_block(hermes_slug)
+    display_model = str(model_block.get("default") or agent_row.get("model_name") or "").strip()
+    display_provider = _srv()._llm_billing_provider(
+        hermes_slug,
+        user_id=triggered_by_user_id,
+        workspace_id=workspace_id,
+        block=model_block,
+    )
 
     turn_id = str(uuid.uuid4())
     segments: list[dict[str, Any]] = []
     last_flush = 0.0
     flush_interval = 0.05
     run_id = str(uuid.uuid4())
+    turn_metadata = json.dumps(
+        {
+            "run_id": run_id,
+            "model": display_model,
+            "llm_provider": display_provider,
+        },
+        separators=(",", ":"),
+    )
     session_id = ""
     user_text = ""
     provider = ""
@@ -152,8 +161,8 @@ def _invoke_room_agent_mention(
                         """
                         INSERT INTO messages (
                             id, room_id, sender_user_id, sender_agent_id, parent_message_id,
-                            content, content_type, is_edited, created_at, updated_at
-                        ) VALUES (?,?,?,?,?,?,?,?,?,?)
+                            content, content_type, metadata, is_edited, created_at, updated_at
+                        ) VALUES (?,?,?,?,?,?,?,?,?,?,?)
                         """,
                         (
                             mid,
@@ -163,6 +172,7 @@ def _invoke_room_agent_mention(
                             parent_message_id,
                             error,
                             "text",
+                            turn_metadata,
                             0,
                             now_ts,
                             now_ts,
@@ -241,13 +251,7 @@ def _invoke_room_agent_mention(
             raise ValueError("session_bootstrap_failed: could not start agent session for this room")
 
         turn_body = profile_gateway._profile_turn_payload(hermes_slug, user_text, room_id)
-        provider = str(agent_row.get("model_provider") or "").strip()
-        if not provider:
-            provider = _srv()._llm_billing_provider(
-                hermes_slug,
-                user_id=triggered_by_user_id,
-                workspace_id=workspace_id,
-            )
+        provider = display_provider
         if triggered_by_user_id:
             run_ledger.ensure_schema()
             auth_req = run_authority.mention_run_request(
@@ -396,8 +400,8 @@ def _invoke_room_agent_mention(
                 """
                 INSERT INTO messages (
                     id, room_id, sender_user_id, sender_agent_id, parent_message_id,
-                    content, content_type, is_edited, created_at, updated_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?)
+                    content, content_type, metadata, is_edited, created_at, updated_at
+                ) VALUES (?,?,?,?,?,?,?,?,?,?,?)
                 """,
                 (
                     mid,
@@ -407,6 +411,7 @@ def _invoke_room_agent_mention(
                     parent_message_id,
                     assistant,
                     "text",
+                    turn_metadata,
                     0,
                     now_ts,
                     now_ts,
@@ -427,7 +432,7 @@ def _invoke_room_agent_mention(
             session_id,
             "completed",
             provider,
-            str(agent_row.get("model_name") or "default"),
+            display_model or "default",
             error=None,
         )
         lane_bindings.chat_dispatch(
@@ -459,8 +464,8 @@ def _invoke_room_agent_mention(
                 triggered_by_user_id,
                 session_id,
                 "failed",
-                str(agent_row.get("model_provider") or "openrouter"),
-                str(agent_row.get("model_name") or "default"),
+                display_provider or "openrouter",
+                display_model or "default",
                 error=err_text,
             )
         except Exception:  # noqa: BLE001

package/workframe-api/message_reactions.py

@@ -0,0 +1,139 @@
+"""Authenticated message reactions shared by room and agent-DM chat surfaces."""
+from __future__ import annotations
+
+import sqlite3
+import time
+from typing import Any, Callable
+
+
+RoomAccessCheck = Callable[[sqlite3.Connection, str, str], bool]
+
+
+def _resolved_scope(
+    conn: sqlite3.Connection,
+    scope: str,
+    user_id: str,
+    can_access_room: RoomAccessCheck,
+) -> tuple[str, str | None]:
+    raw = str(scope or "").strip()
+    if not raw or len(raw) > 512:
+        raise ValueError("invalid_scope")
+    if raw.startswith("room:"):
+        room_id = raw[5:].strip()
+        if not room_id or not can_access_room(conn, room_id, user_id):
+            raise PermissionError("forbidden")
+        return f"room:{room_id}", room_id
+    if raw.startswith("dm:"):
+        dm_key = raw[3:].strip()
+        if not dm_key:
+            raise ValueError("invalid_scope")
+        # DM session identifiers are external Hermes ids. Namespacing them by
+        # the authenticated user prevents another account from reading or
+        # mutating a user's private interaction metadata.
+        return f"dm:{user_id}:{dm_key}", None
+    raise ValueError("invalid_scope")
+
+
+def _reaction_rows(conn: sqlite3.Connection, scope_key: str, user_id: str) -> list[dict[str, Any]]:
+    rows = conn.execute(
+        """
+        SELECT mr.message_id, mr.emoji, mr.user_id, mr.created_at,
+               u.display_name, u.avatar_url
+        FROM message_reactions AS mr
+        LEFT JOIN users AS u ON u.id = mr.user_id
+        WHERE mr.scope_key = ?
+        ORDER BY mr.created_at, mr.emoji, mr.user_id
+        """,
+        (scope_key,),
+    ).fetchall()
+    grouped: dict[tuple[str, str], dict[str, Any]] = {}
+    for row in rows:
+        message_id = str(row["message_id"])
+        emoji = str(row["emoji"])
+        key = (message_id, emoji)
+        reaction = grouped.setdefault(
+            key,
+            {
+                "message_id": message_id,
+                "emoji": emoji,
+                "count": 0,
+                "reacted": False,
+                "reactors": [],
+            },
+        )
+        reactor_user_id = str(row["user_id"])
+        reaction["count"] += 1
+        reaction["reacted"] = reaction["reacted"] or reactor_user_id == user_id
+        reaction["reactors"].append(
+            {
+                "user_id": reactor_user_id,
+                "display_name": str(row["display_name"] or "Member"),
+                "avatar_url": row["avatar_url"],
+            }
+        )
+    return list(grouped.values())
+
+
+def list_reactions(
+    conn: sqlite3.Connection,
+    scope: str,
+    user_id: str,
+    can_access_room: RoomAccessCheck,
+) -> dict[str, Any]:
+    scope_key, _ = _resolved_scope(conn, scope, user_id, can_access_room)
+    return {"ok": True, "reactions": _reaction_rows(conn, scope_key, user_id)}
+
+
+def toggle_reaction(
+    conn: sqlite3.Connection,
+    scope: str,
+    message_id: str,
+    emoji: str,
+    user_id: str,
+    can_access_room: RoomAccessCheck,
+) -> dict[str, Any]:
+    clean_message_id = str(message_id or "").strip()
+    clean_emoji = str(emoji or "").strip()
+    if not clean_message_id or len(clean_message_id) > 512:
+        raise ValueError("invalid_message_id")
+    if not clean_emoji or len(clean_emoji) > 24:
+        raise ValueError("invalid_emoji")
+
+    scope_key, room_id = _resolved_scope(conn, scope, user_id, can_access_room)
+    if room_id:
+        exists = conn.execute(
+            "SELECT 1 FROM messages WHERE id = ? AND room_id = ? AND deleted_at IS NULL",
+            (clean_message_id, room_id),
+        ).fetchone()
+        if not exists:
+            raise ValueError("message_not_found")
+
+    existing = conn.execute(
+        """
+        SELECT 1 FROM message_reactions
+        WHERE scope_key = ? AND message_id = ? AND user_id = ? AND emoji = ?
+        """,
+        (scope_key, clean_message_id, user_id, clean_emoji),
+    ).fetchone()
+    if existing:
+        conn.execute(
+            """
+            DELETE FROM message_reactions
+            WHERE scope_key = ? AND message_id = ? AND user_id = ? AND emoji = ?
+            """,
+            (scope_key, clean_message_id, user_id, clean_emoji),
+        )
+        reacted = False
+    else:
+        conn.execute(
+            """
+            INSERT INTO message_reactions (scope_key, message_id, user_id, emoji, created_at)
+            VALUES (?, ?, ?, ?, ?)
+            """,
+            (scope_key, clean_message_id, user_id, clean_emoji, str(int(time.time()))),
+        )
+        reacted = True
+    conn.commit()
+
+    rows = [row for row in _reaction_rows(conn, scope_key, user_id) if row["message_id"] == clean_message_id]
+    return {"ok": True, "reacted": reacted, "message_id": clean_message_id, "reactions": rows}