databricks-tellr-app 0.4.3.dev33__tar.gz → 0.4.3.dev35__tar.gz

{databricks_tellr_app-0.4.3.dev33 → databricks_tellr_app-0.4.3.dev35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev33
+Version: 0.4.3.dev35
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev33 → databricks_tellr_app-0.4.3.dev35}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev33
+Version: 0.4.3.dev35
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev33 → databricks_tellr_app-0.4.3.dev35}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev33"
+version = "0.4.3.dev35"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev33 → databricks_tellr_app-0.4.3.dev35}/src/api/services/session_naming.py

@@ -89,10 +89,21 @@ def _was_truncated(response: object) -> bool:
 
 
 def build_session_title_model():
-    """The title model: Gateway-routed, on the requesting user's OBO identity."""
+    """The title model: Gateway-routed, on the app service principal.
+
+    Titles run as the service principal (``get_system_client``), the same
+    identity the graph runtime uses for every model call
+    (``DatabricksModelAdapter._default_client_factory``). They are not OBO:
+    Unity AI Gateway refuses a user token that lacks the ``ai-gateway`` scope
+    (403 "Provided OAuth token does not have required scopes: ai-gateway"),
+    and the app's ``user_api_scopes`` do not include it. The graph already
+    sends the same user message to the Gateway as the service principal, so
+    this adds no new data exposure. Per-user identity on Gateway calls is
+    workstream 2b (it needs the ``ai-gateway`` user scope and user re-consent).
+    """
     from databricks_langchain import ChatDatabricks
 
-    from src.core.databricks_client import get_user_client
+    from src.core.databricks_client import get_system_client
     from src.core.defaults import SESSION_TITLE_MODEL
 
     return ChatDatabricks(
@@ -100,7 +111,7 @@ def build_session_title_model():
         use_ai_gateway=True,
         max_tokens=50,
         temperature=0.3,
-        workspace_client=get_user_client(),
+        workspace_client=get_system_client(),
     )
 
 

{databricks_tellr_app-0.4.3.dev33 → databricks_tellr_app-0.4.3.dev35}/src/services/model_endpoint_catalog.py

@@ -222,7 +222,9 @@ class DatabricksModelEndpointCatalog:
                     True,
                 )
             invocable = gateway_invocable_name(name)
-            if invocable is None:
+            # Offer only names the save rule accepts (validate_gateway_model_name),
+            # so the picker never lists a model the save then refuses with a 422.
+            if invocable is None or not _GATEWAY_MODEL_NAME.fullmatch(invocable):
                 continue
             discovered.append(
                 SystemModelEndpoint(name=invocable, display_name=None, description=None, docs=None)