empathy-framework 4.6.6__tar.gz → 4.7.0__tar.gz

{empathy_framework-4.6.6 → empathy_framework-4.7.0}/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to the Empathy Framework will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.7.0] - 2026-01-24
+
+### Security
+
+- **Fixed path traversal vulnerability** in dashboard patterns API (`dashboard/backend/api/patterns.py`)
+  - Export and download endpoints now validate paths using `_validate_file_path()`
+  - Prevents CWE-22 path traversal attacks via filename parameters
+
+- **Fixed hardcoded JWT secret** in authentication service (`backend/services/auth_service.py`)
+  - JWT_SECRET_KEY now requires explicit environment variable (no default fallback)
+  - Enforces minimum 32-byte secret length for HS256 security
+  - Fails fast at startup if not configured
+
+- **Added SSRF protection** for webhook URLs (`src/empathy_os/monitoring/alerts.py`)
+  - New `_validate_webhook_url()` function prevents Server-Side Request Forgery
+  - Blocks localhost, private IPs, cloud metadata services, and internal ports
+
+### Changed
+
+- **Exception handling** documented per coding standards with `# noqa: BLE001` and `# INTENTIONAL:` comments
+- **Test discovery** fixed for `tests/unit/test_generator/` directory
+
+### Fixed
+
+- **Audit logger test imports** corrected from `empathy_llm_toolkit` to `empathy_os` path
+
 ## [4.6.6] - 2026-01-22
 
 ### Performance

{empathy_framework-4.6.6 → empathy_framework-4.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: empathy-framework
-Version: 4.6.6
+Version: 4.7.0
 Summary: AI collaboration framework with real LLM agent execution, AskUserQuestion tool integration, Socratic agent generation, progressive tier escalation (70-85% cost savings), meta-orchestration, dynamic agent composition (6 patterns), intelligent caching (85% hit rate), semantic workflow discovery, visual workflow editor, MCP integration for Claude Code, and multi-agent orchestration.
 Author-email: Patrick Roebuck <admin@smartaimemory.com>
 Maintainer-email: Smart-AI-Memory <admin@smartaimemory.com>
@@ -264,6 +264,7 @@ Requires-Dist: bandit<2.0,>=1.7; extra == "dev"
 Requires-Dist: pre-commit<5.0,>=3.0; extra == "dev"
 Requires-Dist: httpx<1.0.0,>=0.27.0; extra == "dev"
 Requires-Dist: fastapi<1.0.0,>=0.109.1; extra == "dev"
+Requires-Dist: requests<3.0.0,>=2.28.0; extra == "dev"
 Provides-Extra: developer
 Requires-Dist: anthropic<1.0.0,>=0.25.0; extra == "developer"
 Requires-Dist: openai<2.0.0,>=1.12.0; extra == "developer"
@@ -359,10 +360,10 @@ Dynamic: license-file
 
 **The Claude-optimized AI collaboration framework with breakthrough meta-orchestration - agents that compose themselves.**
 
-🚀 **v4.6.6: Performance Optimized** - 36% faster scanning, 39% faster init, 11,000+ tests passing. Built and tested extensively with Claude Code. **Full multi-LLM support** - works seamlessly with OpenAI, Gemini, and local models.
+🚀 **v4.7.0: Security Hardened** - Fixed critical vulnerabilities (path traversal, JWT, SSRF), 11,000+ tests passing. Built and tested extensively with Claude Code. **Full multi-LLM support** - works seamlessly with OpenAI, Gemini, and local models.
 
 [![PyPI](https://img.shields.io/pypi/v/empathy-framework)](https://pypi.org/project/empathy-framework/)
-[![Tests](https://img.shields.io/badge/tests-4%2C000%2B%20passing-brightgreen)](https://github.com/Smart-AI-Memory/empathy-framework/actions)
+[![Tests](https://img.shields.io/badge/tests-11%2C000%2B%20passing-brightgreen)](https://github.com/Smart-AI-Memory/empathy-framework/actions)
 [![Coverage](https://img.shields.io/badge/coverage-68%25-yellow)](https://github.com/Smart-AI-Memory/empathy-framework)
 [![License](https://img.shields.io/badge/license-Fair%20Source%200.9-blue)](https://github.com/Smart-AI-Memory/empathy-framework/blob/main/LICENSE)
 [![Python](https://img.shields.io/badge/python-3.10+-blue)](https://www.python.org)
@@ -372,11 +373,11 @@ Dynamic: license-file
 pip install empathy-framework[developer]  # Lightweight for individual developers
 ```
 
-## What's New in v4.6.6 🚀 **PERFORMANCE OPTIMIZED**
+## What's New in v4.7.0 🔒 **SECURITY HARDENED**
 
-### **Faster Scanning, Faster Init, More Tests**
+### **Critical Security Fixes + Performance**
 
-**v4.6.6** delivers significant performance improvements across core framework operations:
+**v4.7.0** addresses critical security vulnerabilities and maintains the performance improvements from v4.6.6:
 
 **Performance Gains:**
 

{empathy_framework-4.6.6 → empathy_framework-4.7.0}/README.md

@@ -2,10 +2,10 @@
 
 **The Claude-optimized AI collaboration framework with breakthrough meta-orchestration - agents that compose themselves.**
 
-🚀 **v4.6.6: Performance Optimized** - 36% faster scanning, 39% faster init, 11,000+ tests passing. Built and tested extensively with Claude Code. **Full multi-LLM support** - works seamlessly with OpenAI, Gemini, and local models.
+🚀 **v4.7.0: Security Hardened** - Fixed critical vulnerabilities (path traversal, JWT, SSRF), 11,000+ tests passing. Built and tested extensively with Claude Code. **Full multi-LLM support** - works seamlessly with OpenAI, Gemini, and local models.
 
 [![PyPI](https://img.shields.io/pypi/v/empathy-framework)](https://pypi.org/project/empathy-framework/)
-[![Tests](https://img.shields.io/badge/tests-4%2C000%2B%20passing-brightgreen)](https://github.com/Smart-AI-Memory/empathy-framework/actions)
+[![Tests](https://img.shields.io/badge/tests-11%2C000%2B%20passing-brightgreen)](https://github.com/Smart-AI-Memory/empathy-framework/actions)
 [![Coverage](https://img.shields.io/badge/coverage-68%25-yellow)](https://github.com/Smart-AI-Memory/empathy-framework)
 [![License](https://img.shields.io/badge/license-Fair%20Source%200.9-blue)](https://github.com/Smart-AI-Memory/empathy-framework/blob/main/LICENSE)
 [![Python](https://img.shields.io/badge/python-3.10+-blue)](https://www.python.org)
@@ -15,11 +15,11 @@
 pip install empathy-framework[developer]  # Lightweight for individual developers
 ```
 
-## What's New in v4.6.6 🚀 **PERFORMANCE OPTIMIZED**
+## What's New in v4.7.0 🔒 **SECURITY HARDENED**
 
-### **Faster Scanning, Faster Init, More Tests**
+### **Critical Security Fixes + Performance**
 
-**v4.6.6** delivers significant performance improvements across core framework operations:
+**v4.7.0** addresses critical security vulnerabilities and maintains the performance improvements from v4.6.6:
 
 **Performance Gains:**
 

empathy_framework-4.7.0/docs/getting-started/choose-your-path.md

@@ -0,0 +1,96 @@
+# Choose Your Path
+
+You've installed the framework and run your first workflow. Now choose the approach that fits your needs.
+
+---
+
+## Three Ways to Use Empathy Framework
+
+| Path | Best For | Complexity |
+|------|----------|------------|
+| [CLI Power User](#path-1-cli-power-user) | Quick tasks, automation, CI/CD | Simple |
+| [Workflow Developer](#path-2-workflow-developer) | Custom automations, Python integration | Moderate |
+| [Meta-Orchestration](#path-3-meta-orchestration) | Complex tasks, multi-agent teams | Advanced |
+
+---
+
+## Path 1: CLI Power User
+
+**Best for:** Quick tasks, shell scripts, CI/CD pipelines
+
+Use the `empathy` CLI to run pre-built workflows without writing Python.
+
+### Key Commands
+
+```bash
+# Run workflows
+empathy workflow run security-audit --path ./src
+empathy workflow run bug-predict --path ./src
+empathy workflow run release-prep --path .
+
+# Track costs
+empathy telemetry show
+empathy telemetry savings --days 30
+```
+
+### Next Steps
+
+- [CLI Guide](../reference/CLI_GUIDE.md) - Complete command reference
+- [CLI Cheatsheet](../reference/CLI_CHEATSHEET.md) - Quick reference
+
+---
+
+## Path 2: Workflow Developer
+
+**Best for:** Custom automations, integrating AI into Python apps
+
+Use the Python API to run and build workflows.
+
+### Using Built-in Workflows
+
+```python
+from empathy_os.workflows import SecurityAuditWorkflow
+import asyncio
+
+async def audit():
+    workflow = SecurityAuditWorkflow()
+    result = await workflow.execute(target_path="./src")
+    print(f"Found {len(result.findings)} issues")
+
+asyncio.run(audit())
+```
+
+### Next Steps
+
+- [Practical Patterns](../how-to/practical-patterns.md) - Ready-to-use patterns
+- [Examples](../tutorials/examples/simple-chatbot.md) - Working code
+
+---
+
+## Path 3: Meta-Orchestration
+
+**Best for:** Complex tasks needing multiple AI agents
+
+Describe what you want and let the framework compose agent teams.
+
+```python
+from empathy_os.orchestration import MetaOrchestrator
+
+orchestrator = MetaOrchestrator()
+plan = orchestrator.analyze_and_compose(
+    task="Review code for security and suggest performance improvements",
+    context={"path": "./src"}
+)
+result = await orchestrator.execute(plan)
+```
+
+### Next Steps
+
+- [Meta-Orchestration Tutorial](../tutorials/META_ORCHESTRATION_TUTORIAL.md)
+- [Multi-Agent Philosophy](../explanation/multi-agent-philosophy.md)
+
+---
+
+## Still Not Sure?
+
+**Start with the CLI.** Move to Workflows when you need custom logic, and Meta-Orchestration when tasks get complex.

empathy_framework-4.7.0/docs/getting-started/first-steps.md

@@ -0,0 +1,146 @@
+# First Steps
+
+Run your first AI workflow and see results in under 5 minutes.
+
+---
+
+## Your First Workflow
+
+Let's run a **security audit** on some code. This workflow scans for vulnerabilities and provides actionable recommendations.
+
+### Option 1: CLI (Fastest)
+
+```bash
+# Scan your source directory
+empathy workflow run security-audit --path ./src
+
+# Or scan current directory
+empathy workflow run security-audit --path .
+```
+
+**Example output:**
+```
+Security Audit Results
+======================
+Status: completed
+Findings: 3
+
+[HIGH] SQL query vulnerable to injection
+  File: src/database.py:45
+  Fix: Use parameterized queries
+
+[MEDIUM] Hardcoded API key in config
+  File: src/config.py:12
+  Fix: Move to environment variable
+
+[LOW] Missing input validation
+  File: src/handlers/user.py:28
+  Fix: Validate user input before processing
+
+Cost: $0.0850
+```
+
+### Option 2: Python
+
+```python
+from empathy_os.workflows import SecurityAuditWorkflow
+import asyncio
+
+async def audit():
+    workflow = SecurityAuditWorkflow(enable_cache=True)
+    result = await workflow.execute(target_path="./src")
+
+    print(f"Status: {result.status}")
+    print(f"Found {len(result.findings)} issues:")
+
+    for finding in result.findings:
+        print(f"  [{finding.severity}] {finding.description}")
+
+    print(f"\nCost: ${result.cost_report.total_cost:.4f}")
+
+asyncio.run(audit())
+```
+
+---
+
+## Try More Workflows
+
+Empathy Framework includes 10+ built-in workflows:
+
+| Workflow | Command | What It Does |
+|----------|---------|--------------|
+| Security Audit | `empathy workflow run security-audit` | Find vulnerabilities |
+| Bug Prediction | `empathy workflow run bug-predict` | Predict likely bugs |
+| Test Coverage | `empathy workflow run test-coverage` | Generate missing tests |
+| Release Prep | `empathy workflow run release-prep` | Pre-release checklist |
+| Dependency Check | `empathy workflow run dependency-check` | Find outdated deps |
+
+```bash
+# List all available workflows
+empathy workflow list
+
+# Get help for a specific workflow
+empathy workflow run security-audit --help
+```
+
+---
+
+## Understanding the Output
+
+Every workflow returns:
+
+| Field | Description |
+|-------|-------------|
+| `status` | `success`, `partial`, or `failed` |
+| `findings` | List of issues found (for analysis workflows) |
+| `cost_report` | API costs and cache hit rate |
+| `metadata` | Timing, model used, etc. |
+
+### Cost Tracking
+
+```bash
+# See your usage
+empathy telemetry show
+
+# See cost breakdown
+empathy telemetry savings --days 7
+```
+
+All telemetry data stays local in `~/.empathy/telemetry/`.
+
+---
+
+## What Just Happened?
+
+When you ran the security audit:
+
+1. **File scanning** - The workflow read your source files
+2. **Tiered analysis** - Simple files used a cheap model, complex ones used a capable model
+3. **Pattern matching** - Known vulnerability patterns were detected
+4. **Report generation** - Results were formatted and returned
+
+This is the **tiered model** approach - automatically routing to the right model based on task complexity.
+
+---
+
+## Next Step
+
+Now that you've run a workflow, it's time to [Choose Your Path](choose-your-path.md) based on how you want to use the framework.
+
+---
+
+## Quick Reference
+
+```bash
+# Run workflows
+empathy workflow run <name> --path <path>
+empathy workflow list
+
+# Check status
+empathy telemetry show
+empathy telemetry savings
+
+# Get help
+empathy --help
+empathy workflow --help
+```

empathy_framework-4.7.0/docs/getting-started/index.md

@@ -0,0 +1,80 @@
+# Getting Started
+
+Welcome to Empathy Framework! This guide will take you from zero to running your first AI workflow in about 10 minutes.
+
+---
+
+## Your Journey
+
+```
+Installation (2 min) → First Steps (5 min) → Choose Your Path (3 min)
+```
+
+| Step | What You'll Do | Time |
+|------|----------------|------|
+| 1. [Installation](installation.md) | Install the framework and set up an API key | 2 min |
+| 2. [First Steps](first-steps.md) | Run your first AI workflow | 5 min |
+| 3. [Choose Your Path](choose-your-path.md) | Pick the approach that fits your needs | 3 min |
+
+---
+
+## Quick Install
+
+If you're in a hurry:
+
+```bash
+# Install
+pip install empathy-framework[developer]
+
+# Set API key
+export ANTHROPIC_API_KEY="sk-ant-..."
+
+# Run a workflow
+empathy workflow run security-audit --path ./src
+```
+
+Then come back here to understand what you just did!
+
+---
+
+## What is Empathy Framework?
+
+Empathy Framework is a production-ready toolkit for building AI systems that:
+
+- **Automate software tasks** - Security audits, code review, test generation
+- **Coordinate multiple AI agents** - Teams of specialized agents working together
+- **Optimize costs** - Smart routing between cheap/capable/premium models
+- **Remember context** - Short-term and long-term memory for AI agents
+
+### Key Concepts
+
+| Concept | What It Does |
+|---------|--------------|
+| **Workflows** | Pre-built automations (security audit, release prep, test coverage) |
+| **Meta-Orchestration** | Automatic composition of agent teams based on your task |
+| **Tiered Models** | Route tasks to cheap/capable/premium models based on complexity |
+| **Memory** | Redis-backed short-term memory for agent coordination |
+
+---
+
+## Prerequisites
+
+- **Python 3.10+** (check with `python --version`)
+- **pip** (latest version recommended)
+- **API key** for at least one LLM provider (Anthropic recommended)
+
+---
+
+## Next Step
+
+Ready? Start with [Installation](installation.md).
+
+---
+
+## Already Installed?
+
+Jump to:
+
+- [First Steps](first-steps.md) - Run your first workflow
+- [Choose Your Path](choose-your-path.md) - Find the right approach for you
+- [CLI Cheatsheet](../reference/CLI_CHEATSHEET.md) - Quick command reference

empathy_framework-4.7.0/docs/getting-started/installation.md

@@ -0,0 +1,171 @@
+# Installation
+
+Get Empathy Framework installed and configured in about 2 minutes.
+
+---
+
+## Step 1: Install the Package
+
+Choose your installation option:
+
+=== "Recommended (Developer)"
+
+    ```bash
+    pip install empathy-framework[developer]
+    ```
+
+    Includes: CLI tools, VSCode extension support, all workflows, local telemetry.
+
+=== "Minimal"
+
+    ```bash
+    pip install empathy-framework
+    ```
+
+    Core functionality only. Add extras later as needed.
+
+=== "Full"
+
+    ```bash
+    pip install empathy-framework[full]
+    ```
+
+    Everything: LLM providers, healthcare support, webhooks, caching.
+
+=== "Healthcare"
+
+    ```bash
+    pip install empathy-framework[healthcare]
+    ```
+
+    Includes: FHIR client, HL7 parsing, HIPAA audit logging.
+
+### Verify Installation
+
+```bash
+python -c "import empathy_os; print(f'Empathy Framework v{empathy_os.__version__}')"
+```
+
+---
+
+## Step 2: Configure an LLM Provider
+
+You need at least one LLM provider. Anthropic (Claude) is recommended.
+
+### Option A: Environment Variable (Quick)
+
+```bash
+# Anthropic (recommended)
+export ANTHROPIC_API_KEY="sk-ant-..."
+
+# Or OpenAI
+export OPENAI_API_KEY="sk-..."
+
+# Or Google
+export GOOGLE_API_KEY="..."
+```
+
+### Option B: .env File (Persistent)
+
+Create a `.env` file in your project root:
+
+```bash
+# .env
+ANTHROPIC_API_KEY=sk-ant-...
+```
+
+The framework auto-detects `.env` files.
+
+### Option C: Interactive Setup
+
+```bash
+python -m empathy_os.models.cli provider --interactive
+```
+
+### Verify Provider
+
+```bash
+python -m empathy_os.models.cli provider
+```
+
+Expected output:
+```
+Current provider: anthropic
+Available models: claude-opus-4, claude-sonnet-4, claude-haiku-4
+API key configured
+```
+
+---
+
+## Step 3: Optional - Redis for Memory
+
+Redis enables multi-agent coordination and session persistence. Skip this for now if you just want to try the framework.
+
+=== "macOS (Homebrew)"
+
+    ```bash
+    brew install redis
+    brew services start redis
+    redis-cli ping  # Should return: PONG
+    ```
+
+=== "Docker"
+
+    ```bash
+    docker run -d -p 6379:6379 --name empathy-redis redis:alpine
+    ```
+
+=== "Skip for Now"
+
+    The framework works without Redis (falls back to in-memory storage).
+
+    You can add Redis later when you need:
+
+    - Multi-agent coordination
+    - Session persistence
+    - Pattern staging
+
+See [Redis Setup](redis-setup.md) for production configuration.
+
+---
+
+## Troubleshooting
+
+### "No API key configured"
+
+```bash
+# Check your environment
+env | grep API_KEY
+
+# Set it
+export ANTHROPIC_API_KEY="sk-ant-..."
+
+# Verify
+python -m empathy_os.models.cli provider --check
+```
+
+### "ModuleNotFoundError: empathy_os"
+
+```bash
+# Reinstall
+pip install --upgrade empathy-framework[developer]
+
+# Or for development
+pip install -e .[dev]
+```
+
+### Python version too old
+
+```bash
+python --version  # Need 3.10+
+
+# Use pyenv to manage versions
+pyenv install 3.11
+pyenv local 3.11
+```
+
+---
+
+## Next Step
+
+You're installed! Continue to [First Steps](first-steps.md) to run your first workflow.

{empathy_framework-4.6.6 → empathy_framework-4.7.0}/empathy_framework.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: empathy-framework
-Version: 4.6.6
+Version: 4.7.0
 Summary: AI collaboration framework with real LLM agent execution, AskUserQuestion tool integration, Socratic agent generation, progressive tier escalation (70-85% cost savings), meta-orchestration, dynamic agent composition (6 patterns), intelligent caching (85% hit rate), semantic workflow discovery, visual workflow editor, MCP integration for Claude Code, and multi-agent orchestration.
 Author-email: Patrick Roebuck <admin@smartaimemory.com>
 Maintainer-email: Smart-AI-Memory <admin@smartaimemory.com>
@@ -264,6 +264,7 @@ Requires-Dist: bandit<2.0,>=1.7; extra == "dev"
 Requires-Dist: pre-commit<5.0,>=3.0; extra == "dev"
 Requires-Dist: httpx<1.0.0,>=0.27.0; extra == "dev"
 Requires-Dist: fastapi<1.0.0,>=0.109.1; extra == "dev"
+Requires-Dist: requests<3.0.0,>=2.28.0; extra == "dev"
 Provides-Extra: developer
 Requires-Dist: anthropic<1.0.0,>=0.25.0; extra == "developer"
 Requires-Dist: openai<2.0.0,>=1.12.0; extra == "developer"
@@ -359,10 +360,10 @@ Dynamic: license-file
 
 **The Claude-optimized AI collaboration framework with breakthrough meta-orchestration - agents that compose themselves.**
 
-🚀 **v4.6.6: Performance Optimized** - 36% faster scanning, 39% faster init, 11,000+ tests passing. Built and tested extensively with Claude Code. **Full multi-LLM support** - works seamlessly with OpenAI, Gemini, and local models.
+🚀 **v4.7.0: Security Hardened** - Fixed critical vulnerabilities (path traversal, JWT, SSRF), 11,000+ tests passing. Built and tested extensively with Claude Code. **Full multi-LLM support** - works seamlessly with OpenAI, Gemini, and local models.
 
 [![PyPI](https://img.shields.io/pypi/v/empathy-framework)](https://pypi.org/project/empathy-framework/)
-[![Tests](https://img.shields.io/badge/tests-4%2C000%2B%20passing-brightgreen)](https://github.com/Smart-AI-Memory/empathy-framework/actions)
+[![Tests](https://img.shields.io/badge/tests-11%2C000%2B%20passing-brightgreen)](https://github.com/Smart-AI-Memory/empathy-framework/actions)
 [![Coverage](https://img.shields.io/badge/coverage-68%25-yellow)](https://github.com/Smart-AI-Memory/empathy-framework)
 [![License](https://img.shields.io/badge/license-Fair%20Source%200.9-blue)](https://github.com/Smart-AI-Memory/empathy-framework/blob/main/LICENSE)
 [![Python](https://img.shields.io/badge/python-3.10+-blue)](https://www.python.org)
@@ -372,11 +373,11 @@ Dynamic: license-file
 pip install empathy-framework[developer]  # Lightweight for individual developers
 ```
 
-## What's New in v4.6.6 🚀 **PERFORMANCE OPTIMIZED**
+## What's New in v4.7.0 🔒 **SECURITY HARDENED**
 
-### **Faster Scanning, Faster Init, More Tests**
+### **Critical Security Fixes + Performance**
 
-**v4.6.6** delivers significant performance improvements across core framework operations:
+**v4.7.0** addresses critical security vulnerabilities and maintains the performance improvements from v4.6.6:
 
 **Performance Gains:**