databricks-tellr-app 0.4.3.dev3462__tar.gz → 0.4.3.dev3464__tar.gz

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3462
+Version: 0.4.3.dev3464
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -42,7 +42,7 @@ Requires-Dist: google-auth-oauthlib==1.2.4
 Requires-Dist: google-auth-httplib2==0.3.0
 Requires-Dist: cryptography==46.0.3
 Requires-Dist: sse-starlette==3.0.3
-Requires-Dist: databricks-sdk==0.120.0
+Requires-Dist: databricks-sdk==0.157.0
 Requires-Dist: mlflow[databricks]==3.14.0
 Requires-Dist: mlflow-skinny==3.14.0
 Requires-Dist: databricks-agents==1.11.0

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/databricks_tellr_app/run.py

@@ -68,23 +68,6 @@ def init_database(seed_databricks_defaults: bool = False) -> None:
         logger.error(f"Failed to bootstrap Graph Configuration: {e}\n{tb}")
         raise SystemExit(1) from e
 
-    logger.info("Backfilling Conversation Pins...")
-    try:
-        from src.core.database import get_session_local
-        from src.services.conversation_pins import backfill_conversation_pins
-
-        result = backfill_conversation_pins(get_session_local())
-        logger.info(
-            "Conversation Pins ready: release_id=%s version=%s pinned=%s",
-            result.graph_release_id,
-            result.graph_version,
-            result.pinned_count,
-        )
-    except Exception as e:
-        tb = traceback.format_exc()
-        logger.error(f"Failed to backfill Conversation Pins: {e}\n{tb}")
-        raise SystemExit(1) from e
-
     # Data migrations/backfills that used to run in the FastAPI lifespan now run
     # HERE, once, before the server forks its workers — the uvicorn workers must
     # never execute migration code (4 of them racing the migration chain on boot

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3462
+Version: 0.4.3.dev3464
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -42,7 +42,7 @@ Requires-Dist: google-auth-oauthlib==1.2.4
 Requires-Dist: google-auth-httplib2==0.3.0
 Requires-Dist: cryptography==46.0.3
 Requires-Dist: sse-starlette==3.0.3
-Requires-Dist: databricks-sdk==0.120.0
+Requires-Dist: databricks-sdk==0.157.0
 Requires-Dist: mlflow[databricks]==3.14.0
 Requires-Dist: mlflow-skinny==3.14.0
 Requires-Dist: databricks-agents==1.11.0

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/databricks_tellr_app.egg-info/requires.txt

@@ -36,7 +36,7 @@ google-auth-oauthlib==1.2.4
 google-auth-httplib2==0.3.0
 cryptography==46.0.3
 sse-starlette==3.0.3
-databricks-sdk==0.120.0
+databricks-sdk==0.157.0
 mlflow[databricks]==3.14.0
 mlflow-skinny==3.14.0
 databricks-agents==1.11.0

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev3462"
+version = "0.4.3.dev3464"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -86,7 +86,7 @@ dependencies = [
     # langgraph-prebuilt 1.0.10→1.1.0, added langgraph-sdk==0.4.2. These match
     # the repo-root requirements.txt and pyproject.toml. MUST be re-verified via
     # a devloop deploy on db-tellr-dev-pinfix or equivalent before PR3 ships.
-    "databricks-sdk==0.120.0",
+    "databricks-sdk==0.157.0",
     "mlflow[databricks]==3.14.0",
     "mlflow-skinny==3.14.0",
     "databricks-agents==1.11.0",

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/src/api/mcp_server.py

@@ -33,7 +33,6 @@ from src.core.settings_db import (
     get_default_slide_style_id,
     get_default_template_id,
 )
-from src.domain.conversation_engine import with_legacy_marker
 from src.domain.slide_deck import SlideDeck
 from src.services.permission_service import get_permission_service
 
@@ -238,23 +237,14 @@ async def enqueue_create_job(
         #
         # MCP stays on the legacy monolith (its worker payload carries no engine
         # key, and the graph's one-shot path, spec §6.4, is not built).
-        # Since 2026-10-12 the graph is the DEFAULT engine, derived from the
-        # deck's first user message -- so a create_deck deck whose transcript
-        # did not say otherwise would resolve to the graph the first time
-        # someone chatted on it in the browser, and fail there
-        # (ConversationPinMissingError: MCP sessions are unpinned).  The
-        # persisted first message therefore carries the LEGACY opt-out; the
-        # prompt the worker runs (payload "message" below) is untouched.
-        persisted_prompt = (
-            with_legacy_marker(prompt)
-            if mode == "generate" and is_first_message
-            else prompt
-        )
+        # create_deck stores that on the session it creates (deck_mode="legacy"),
+        # so no prompt has to say it: every prompt, create or edit, is persisted
+        # verbatim.
         await asyncio.to_thread(
             session_manager.add_message,
             session_id=session_id,
             role="user",
-            content=persisted_prompt,
+            content=prompt,
             message_type="user_query",
             request_id=request_id,
         )
@@ -536,10 +526,9 @@ async def _create_deck_impl(
             session = session_manager.create_session(
                 created_by=identity.user_name,
                 agent_config=agent_config,
-                # Legacy deck: unpinned, and enqueue_create_job persists the
-                # first message with the USE LEGACY MODE opt-out so the
-                # transcript-derived engine agrees in every surface.
+                # Legacy deck: unpinned, and locked to the monolith from creation.
                 graph_capable=False,
+                deck_mode="legacy",
             )
             # create_session returns a dict (see SessionManager.create_session);
             # guard against a model-object return defensively so this stays

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/src/api/middleware/security_headers.py

@@ -24,6 +24,13 @@ Content-Security-Policy differentiated by response type:
      Radix UI injects inline styles at runtime; CSP hashes apply to
      <style>/<script> *elements*, not style *attributes*, so
      ``style-src`` needs 'unsafe-inline'.
+  3. Monaco: the editors load from jsDelivr via @monaco-editor/react, the
+     JS through ``script-src`` and ``editor.main.css`` as a stylesheet
+     link, so ``style-src`` also allows ``https://cdn.jsdelivr.net``.
+     Without it the sheet is blocked and the editor renders broken (its
+     input textarea shows as a stray box above the text). Given
+     'unsafe-inline' already, the origin adds no real style-injection
+     surface; ``script-src`` already trusts it.
 
   ``script-src 'unsafe-inline'`` + CDNs is a deliberate, documented
   trade-off forced by srcdoc inheritance: slides remain confined by the
@@ -83,7 +90,7 @@ from starlette.responses import Response
 DOCUMENT_CSP = (
     "default-src 'self'; "
     "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdn.tailwindcss.com; "
-    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+    "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; "
     "img-src 'self' data:; "
     "font-src 'self' data: https://cdn.jsdelivr.net https://fonts.gstatic.com; "
     "connect-src 'self'; "

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/src/api/routes/chat.py

@@ -37,7 +37,11 @@ from src.api.services.job_queue import (
     is_pinned_graph_configuration_error_event,
     pinned_graph_configuration_error_event_payload,
 )
-from src.api.services.session_manager import SessionNotFoundError, get_session_manager
+from src.api.services.session_manager import (
+    DeckModeLockedError,
+    SessionNotFoundError,
+    get_session_manager,
+)
 from src.core.context_utils import run_in_thread_with_context
 from src.core.database import get_db
 from src.core.permission_context import get_permission_context
@@ -48,7 +52,6 @@ from src.core.settings_db import (
 )
 from src.core.user_context import get_current_user
 from src.database.models.profile_contributor import PermissionLevel
-from src.domain.conversation_engine import selects_graph_engine
 from src.services.agent import UnsafeContentError
 from src.services.conversation_pins import ActiveGraphReleaseUnavailableError
 from src.services.permission_service import PERMISSION_PRIORITY, get_permission_service
@@ -75,6 +78,34 @@ class _EngineModeUnresolvedError(Exception):
     """The async route's engine-mode resolution (and nothing else) failed closed."""
 
 
+DECK_MODE_LOCKED_CODE = "deck_mode_locked"
+
+_DECK_MODE_LABELS = {"agent": "Agent mode", "legacy": "Legacy mode"}
+
+
+def _deck_mode_locked(exc: DeckModeLockedError) -> HTTPException:
+    """The 409 for a message asking for a Deck Mode other than the deck's locked one."""
+    label = _DECK_MODE_LABELS.get(exc.deck_mode, exc.deck_mode)
+    return HTTPException(
+        status_code=409,
+        detail={
+            "code": DECK_MODE_LOCKED_CODE,
+            "message": f"This deck's mode is already set to {label}, and it can't be changed.",
+            "deck_mode": exc.deck_mode,
+        },
+    )
+
+
+async def _mark_chat_request_error(session_manager, request_id: str, code: str) -> None:
+    """Best effort: a failed status write must never mask the 409/503 being raised."""
+    try:
+        await asyncio.to_thread(
+            session_manager.update_chat_request_status, request_id, "error", code
+        )
+    except Exception:
+        logger.warning("Failed to mark chat request %s as errored", request_id, exc_info=True)
+
+
 def _engine_mode_unavailable() -> HTTPException:
     return HTTPException(status_code=503, detail=dict(ENGINE_MODE_UNAVAILABLE_DETAIL))
 
@@ -344,7 +375,7 @@ def _maybe_create_session(request: ChatRequest, session_manager) -> bool:
                     _without_template_pin(_seeded_for_new_session(agent_config_data))
                 ),
                 created_by=current_user,
-                graph_capable=selects_graph_engine(request.message),
+                graph_capable=True,
             )
             logger.info(
                 "Created session from client-generated ID",
@@ -382,7 +413,7 @@ def _maybe_create_session(request: ChatRequest, session_manager) -> bool:
             _without_template_pin(_seeded_for_new_session(agent_config_data))
         ),
         created_by=current_user,
-        graph_capable=selects_graph_engine(request.message),
+        graph_capable=True,
     )
     request.session_id = session["session_id"]
     return True
@@ -555,6 +586,42 @@ async def send_message_streaming(
             detail="Session is currently processing another request. Please wait.",
         )
 
+    # The user message is saved BEFORE the engine is resolved: the resolver
+    # reads the deck's owner column, which this save locks atomically with the
+    # message.  Nothing has started streaming yet, so every failure here must
+    # release the lock taken above itself.
+    try:
+        session_data = await asyncio.to_thread(
+            session_manager.get_session, request.session_id
+        )
+        is_first_message = session_data.get("message_count", 0) == 0
+        await asyncio.to_thread(
+            session_manager.add_user_message,
+            request.session_id,
+            request.message,
+            message_type="user_input",
+            requested_deck_mode=request.deck_mode,
+        )
+    except SessionNotFoundError as e:
+        await asyncio.to_thread(session_manager.release_session_lock, request.session_id)
+        raise HTTPException(
+            status_code=404,
+            detail=f"Session not found: {request.session_id}",
+        ) from e
+    except DeckModeLockedError as e:
+        await asyncio.to_thread(session_manager.release_session_lock, request.session_id)
+        raise _deck_mode_locked(e) from e
+    except ActiveGraphReleaseUnavailableError as e:
+        await asyncio.to_thread(session_manager.release_session_lock, request.session_id)
+        raise HTTPException(
+            status_code=503,
+            detail="No active Graph Release available",
+        ) from e
+    except Exception as e:
+        await asyncio.to_thread(session_manager.release_session_lock, request.session_id)
+        logger.error(f"Failed to save streaming chat message: {e}")
+        raise HTTPException(status_code=500, detail="Internal server error") from e
+
     # ws4d D2 — the engine for this turn is resolved HERE, in the chat route,
     # and passed down.  Not in send_message_streaming and not in the job queue:
     # MCP's enqueue_create_job drains through the same worker as POST
@@ -606,6 +673,8 @@ async def send_message_streaming(
                     else None,
                     image_ids=request.image_ids,
                     engine_mode=engine_mode,
+                    is_first_message_override=is_first_message,
+                    user_message_persisted=True,
                 ):
                     event_queue.put(event)
             except Exception as e:
@@ -746,26 +815,26 @@ async def submit_chat_async(
         )
 
         # Capture first-message flag BEFORE persisting the user message,
-        # because add_message increments message_count.
+        # because saving the message increments message_count.
         session_data = await asyncio.to_thread(
             session_manager.get_session, request.session_id
         )
         is_first_message = session_data.get("message_count", 0) == 0
 
-        # Persist user message
+        # Persist user message (locks the deck's mode atomically with it)
         await asyncio.to_thread(
-            session_manager.add_message,
-            session_id=request.session_id,
-            role="user",
-            content=request.message,
+            session_manager.add_user_message,
+            request.session_id,
+            request.message,
             message_type="user_query",
             request_id=request_id,
+            requested_deck_mode=request.deck_mode,
         )
 
         # ws4d D2 — resolved AFTER the user message is persisted just above,
-        # because resolve_engine_mode reads the deck's EARLIEST role='user'
-        # message: on turn 1 that row has to exist already or a USE LEGACY MODE
-        # opt-out in the very first message would resolve to the default
+        # because resolve_engine_mode reads the deck owner's `deck_mode`
+        # column, which that save locks: on turn 1 the column has to be set
+        # already or a legacy first message would resolve to the NULL default
         # (graph) engine.
         #
         # FAIL CLOSED (#271 C24/C47): a failure of THIS call (and only this call)
@@ -815,6 +884,23 @@ async def submit_chat_async(
             session_manager.release_session_lock, request.session_id
         )
         raise _engine_mode_unavailable() from e.__cause__
+    except DeckModeLockedError as e:
+        await asyncio.to_thread(
+            session_manager.release_session_lock, request.session_id
+        )
+        await _mark_chat_request_error(session_manager, request_id, DECK_MODE_LOCKED_CODE)
+        raise _deck_mode_locked(e) from e
+    except ActiveGraphReleaseUnavailableError as e:
+        await asyncio.to_thread(
+            session_manager.release_session_lock, request.session_id
+        )
+        await _mark_chat_request_error(
+            session_manager, request_id, "no_active_graph_release"
+        )
+        raise HTTPException(
+            status_code=503,
+            detail="No active Graph Release available",
+        ) from e
     except Exception as e:
         # Release lock on failure
         await asyncio.to_thread(

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/src/api/routes/tour.py

@@ -65,16 +65,15 @@ def _phase1_create_session(created_by: str) -> dict:
     fixture = _load_fixture()
     sm = get_session_manager()
 
-    # Graph-capable (pinned): the fixture's chat_prompt carries no
-    # USE LEGACY MODE opt-out, so since 2026-10-12 the tour deck resolves to
-    # the graph like any other deck, and a graph turn on an unpinned session
-    # raises ConversationPinMissingError.  The fixture already ships a
-    # deck_spec for exactly this (ws4d), so a user who keeps chatting after the
-    # tour gets the default engine.
+    # Graph-capable (pinned) and locked to the agent engine from creation, so
+    # a user who keeps chatting after the tour stays on the graph.  A graph
+    # turn on an unpinned session raises ConversationPinMissingError.  The
+    # fixture already ships a deck_spec for exactly this (ws4d).
     session = sm.create_session(
         title=fixture["title"],
         created_by=created_by,
         graph_capable=True,
+        deck_mode="agent",
     )
     session_id = session["session_id"]
 

{databricks_tellr_app-0.4.3.dev3462 → databricks_tellr_app-0.4.3.dev3464}/src/api/schemas/requests.py

@@ -1,6 +1,6 @@
 """Request schemas for the API."""
 
-from typing import Optional
+from typing import Literal, Optional
 
 from pydantic import BaseModel, Field, field_validator, model_validator
 
@@ -82,6 +82,13 @@ class ChatRequest(BaseModel):
         default=None,
         description="Agent configuration for session creation (tools, style, prompts)",
     )
+    deck_mode: Optional[Literal["agent", "legacy"]] = Field(
+        default=None,
+        description=(
+            "Deck Mode to lock the deck to with its first message. Ignored once the "
+            "deck is locked, unless it differs from the stored mode (then 409)."
+        ),
+    )
 
     @field_validator("session_id", mode="before")
     @classmethod