machinaos 0.0.76 → 0.0.78

package/server/nodes/whatsapp/_refresh.py

@@ -0,0 +1,62 @@
+"""WhatsApp service-status refresh callback (Wave 11.I, milestone J).
+
+Moved from ``services/status_broadcaster._refresh_whatsapp_status``.
+Plugin packages register their own callback via
+``status_broadcaster.register_service_refresh``; the broadcaster no
+longer hardcodes a per-service refresh.
+
+Calls the Go-service ``status`` RPC via the plugin's own client and
+mirrors the result into the broadcaster cache. Silently swallows
+exceptions if the WhatsApp Go service is unavailable -- mirrors
+pre-migration behaviour.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+from typing import TYPE_CHECKING
+
+from opentelemetry import trace
+
+if TYPE_CHECKING:
+    from services.status_broadcaster import StatusBroadcaster
+
+logger = logging.getLogger(__name__)
+tracer = trace.get_tracer(__name__)
+
+
+async def refresh_whatsapp_status(broadcaster: "StatusBroadcaster") -> None:
+    """Refresh WhatsApp cache + broadcast. One pass per
+    ``_refresh_all_services`` cycle.
+    """
+    with tracer.start_as_current_span("broadcaster.refresh_whatsapp") as span:
+        try:
+            from ._service import get_client
+
+            client = await get_client()
+            status_data = await client.call("status")
+
+            broadcaster._status["whatsapp"] = {
+                "connected": status_data.get("connected", False),
+                "has_session": status_data.get("has_session", False),
+                "running": status_data.get("running", False),
+                "pairing": status_data.get("pairing", False),
+                "device_id": status_data.get("device_id"),
+                "qr": None,
+                "timestamp": time.time(),
+            }
+            logger.debug(
+                "[StatusBroadcaster] Refreshed WhatsApp status: connected=%s",
+                status_data.get("connected"),
+            )
+            await broadcaster.broadcast({
+                "type": "whatsapp_status",
+                "data": broadcaster._status["whatsapp"],
+            })
+            span.set_attribute("connected", bool(status_data.get("connected", False)))
+        except Exception as exc:  # noqa: BLE001
+            span.record_exception(exc)
+            logger.debug(
+                "[StatusBroadcaster] Could not refresh WhatsApp status: %s", exc
+            )

package/server/nodes/whatsapp/_runtime.py

@@ -3,7 +3,7 @@
 Spawns the binary with cwd inside the project (``<data_dir>/whatsapp``)
 so the SQLite session DB lives next to ``credentials.db`` and survives
 ``pnpm install``, version bumps, and worktree switches. Lazy-init from
-``services.whatsapp_service.get_client()``; teardown from FastAPI lifespan.
+``nodes.whatsapp._service.get_client()``; teardown from FastAPI lifespan.
 
 Subclasses :class:`BaseProcessSupervisor` for spawning, tree-kill, status
 snapshots, restart policy, and the singleton ``get_instance()`` accessor.

package/server/pyproject.toml

@@ -43,21 +43,28 @@ dependencies = [
     "cryptography>=44.0.0",
 
     # AI - All providers (directly imported in ai.py)
-    # Versions pinned to exactly match the main branch so that the LangGraph
-    # agent loop behaves identically. The `response.tool_calls` empty-payload
-    # regression on tool_use responses appears to come from a library skew
-    # somewhere in this set; lockstepping with main eliminates it as a
-    # variable. Lift these pins when the upstream cause is identified.
-    "langchain-core==1.2.28",
-    "langchain-openai==1.1.12",
+    # Originally pinned to lockstep with main to neutralise a tool_calls
+    # empty-payload regression. Lifted to 1.3.x in response to security
+    # advisories GHSA-jcc3-qxqm-r62h (unsafe deserialization in
+    # langchain-core <=1.3.2), the langchain-openai DNS-rebinding SSRF
+    # advisory (<1.1.14), and the langchain-text-splitters SSRF advisory
+    # (<1.1.2). Full backend suite (1018/1018) re-validated after the bump.
+    "langchain-core==1.3.3",
+    "langchain-openai==1.1.14",
     "langchain-anthropic==1.4.0",
     "anthropic==0.94.0",
     "langchain-google-genai==4.2.1",
     "google-genai==1.72.0",
     "langchain-groq==1.1.2",
     "langchain-cerebras==0.8.2",
+    # textChunker plugin (recursive / markdown / token strategies). Bumped
+    # to 1.1.2+ alongside langchain-core 1.3.3 to clear the
+    # HTMLHeaderTextSplitter SSRF advisory; the 1.1 line requires
+    # langchain-core>=1.3, which we now satisfy.
+    "langchain-text-splitters==1.1.2",
     "langgraph==1.1.6",
     "deepagents==0.5.2",
+
     # Pydantic 2.13 changed validator ordering; pin to main's 2.12 line
     # to keep AIMessage construction/tool-schema generation identical.
     "pydantic==2.12.5",
@@ -91,6 +98,14 @@ dependencies = [
     # Markdown formatting (GFM to platform-native)
     "markdown-it-py>=3.0.0",
 
+    # Local LLM SDKs — used by `nodes/model/_local_validator.py` to
+    # introspect the user's actually-loaded models (context_length,
+    # max_output_tokens). Replaces hand-rolled httpx probes against
+    # /api/show and /api/v0/models so each SDK's own typed result
+    # struct is the source of truth.
+    "ollama>=0.6.0",
+    "lmstudio>=1.5.0",
+
     # Gmail API
     "google-api-python-client>=2.100.0",
     "google-auth>=2.27.0",
@@ -102,6 +117,11 @@ dependencies = [
 
     # RLM (Recursive Language Models) agent
     "rlms>=0.1.1",
+
+    # MCP (Model Context Protocol) — host server for spawned CLI sessions
+    # to discover and call MachinaOs tools (mcp__machina__*) the same way
+    # VSCode's Claude Code extension does.
+    "mcp>=1.0.0",
 ]
 
 [project.optional-dependencies]
@@ -116,6 +136,8 @@ dev = [
 docs = [
     "beautifulsoup4>=4.12.0",
     "pypdf>=5.0.0",
+    # `langchain-text-splitters` moved to top-level dependencies (above) —
+    # the textChunker plugin is part of the runtime, not optional.
 ]
 keyring = [
     "keyring>=25.0.0",  # OS-native credential storage (Windows/macOS/Linux)

package/server/routers/schemas.py

@@ -100,7 +100,7 @@ async def load_options(method: str, body: dict | None = None):
     parameter map (e.g. ``{"group_id": "..."}`` for
     whatsappGroupMembers).
     """
-    from services.node_option_loaders import dispatch_load_options
+    from services.ws_handler_registry import dispatch_load_options
 
     params = (body or {}).get("params", body or {}) if isinstance(body, dict) else {}
     options = await dispatch_load_options(method, params)
@@ -111,7 +111,7 @@ async def load_options(method: str, body: dict | None = None):
 async def list_load_options():
     """Registered loadOptionsMethod names. Editor probes this on boot
     to know which dynamic-option loaders are wired backend-side."""
-    from services.node_option_loaders import list_load_options_methods
+    from services.ws_handler_registry import list_load_options_methods
 
     return {"methods": list_load_options_methods()}
 

package/server/routers/webhook.py

@@ -1,14 +1,23 @@
 """Dynamic webhook endpoint router for incoming HTTP requests.
 
-Works like WhatsApp trigger - uses broadcaster.send_custom_event() to dispatch
-to event_waiter which resolves waiting trigger nodes.
+Two dispatch paths:
+
+1. **Plugin-owned WebhookSource** (Wave 12 framework). Plugins register
+   a :class:`services.events.WebhookSource` for their path; the router
+   verifies the signature, shapes a :class:`WorkflowEvent`, and queues
+   it onto the source. The source's owning plugin pulls events via
+   ``source.emit()`` and dispatches into ``event_waiter``.
+2. **Legacy generic webhook** (pre-framework). Falls through to
+   ``broadcaster.send_custom_event("webhook_received", …)`` so existing
+   ``webhookTrigger`` nodes keep working untouched.
 """
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse
 from typing import Dict
 import asyncio
 import logging
 
+from services.events import WEBHOOK_SOURCES
 from services.status_broadcaster import get_status_broadcaster
 
 logger = logging.getLogger(__name__)
@@ -38,10 +47,21 @@ def resolve_webhook_response(node_id: str, response_data: dict):
 async def handle_webhook(path: str, request: Request):
     """Handle incoming webhook requests.
 
-    Dispatches webhook_received event to trigger waiting webhookTrigger nodes.
-    Similar to how WhatsApp events dispatch to whatsappReceive nodes.
+    Path-handler dispatch (Wave 12) runs first; legacy generic
+    dispatch is the fallback for paths nobody has claimed.
     """
-    # Build webhook request data
+    source = WEBHOOK_SOURCES.get(path)
+    if source is not None:
+        try:
+            await source.handle(request)
+        except HTTPException:
+            raise
+        except Exception as e:
+            logger.exception("[Webhook] %s handler crashed: %s", path, e)
+            raise HTTPException(status_code=500, detail=str(e))
+        logger.info("[Webhook] %s %s -> %s", request.method, path, type(source).__name__)
+        return JSONResponse({"status": "received", "path": path}, status_code=200)
+
     body = await request.body()
     json_body = None
     content_type = request.headers.get("content-type", "")
@@ -63,12 +83,9 @@ async def handle_webhook(path: str, request: Request):
 
     logger.info(f"[Webhook] Received: {request.method} /webhook/{path}")
 
-    # Dispatch event using broadcaster (same pattern as WhatsApp)
     broadcaster = get_status_broadcaster()
     await broadcaster.send_custom_event("webhook_received", webhook_data)
 
-    # For now, always return immediate response
-    # TODO: Support responseNode mode by storing Future and waiting
     return JSONResponse(
         content={
             "status": "received",