fred-runtime 3.3.0__tar.gz → 3.3.1__tar.gz

{fred_runtime-3.3.0 → fred_runtime-3.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-runtime
-Version: 3.3.0
+Version: 3.3.1
 Summary: Runtime adapters and infrastructure wiring for Fred v2 agents.
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0
@@ -12,8 +12,8 @@ Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Operating System :: OS Independent
 Requires-Python: <3.13,>=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: fred-core>=3.4.0
-Requires-Dist: fred-sdk>=3.3.0
+Requires-Dist: fred-core>=3.4.1
+Requires-Dist: fred-sdk>=3.3.1
 Requires-Dist: alembic>=1.18.4
 Requires-Dist: deepagents>=0.4.11
 Requires-Dist: httpx>=0.28.1
@@ -25,7 +25,7 @@ Requires-Dist: langfuse>=3.0.0
 Requires-Dist: requests<3,>=2.32
 Requires-Dist: PyYAML>=6.0
 Provides-Extra: app
-Requires-Dist: fastapi>=0.116; extra == "app"
+Requires-Dist: fastapi>=0.139.0; extra == "app"
 Provides-Extra: dev
 Requires-Dist: bandit>=1.8.6; extra == "dev"
 Requires-Dist: basedpyright==1.31.0; extra == "dev"

{fred_runtime-3.3.0 → fred_runtime-3.3.1}/fred_runtime/app/agent_app.py

@@ -63,9 +63,13 @@ from fred_core.logs.log_setup import log_setup
 from fred_core.logs.memory_log_store import RamLogStore
 from fred_core.security.models import AuthorizationError
 from fred_core.security.oidc import get_keycloak_client_id, get_keycloak_url
-from fred_core.security.rebac.rebac_engine import TeamPermission
+from fred_core.security.rebac.rebac_engine import (
+    ORGANIZATION_ID,
+    OrganizationPermission,
+    TeamPermission,
+)
 from fred_core.security.rebac.rebac_factory import rebac_factory
-from fred_core.security.structure import KeycloakUser
+from fred_core.security.structure import KeycloakUser, is_service_agent
 from fred_sdk.contracts.context import (
     AgentInvocationRequest,
     AgentInvocationResult,
@@ -110,6 +114,7 @@ from fred_runtime.react.react_runtime import ReActRuntime
 from fred_runtime.runtime_support.checkpoints import load_checkpoint
 
 from ..common.structures import AgentSettingsLike
+from ..integrations.inprocess_toolkit_registry import build_inprocess_toolkit
 from ..integrations.v2_runtime.adapters import (
     CompositeToolInvoker,
     FredKnowledgeSearchToolInvoker,
@@ -1183,6 +1188,20 @@ async def _authorize_execution_or_raise(
                 "(runtime_context.team_id)"
             ),
         )
+    if is_service_agent(authenticated_user):
+        # Solution A (RFC EVAL-AUTH): a service identity (the evaluation worker) is
+        # recognized for execution, scoped to the request team_id, without any stored
+        # OpenFGA relation. Legitimacy is anchored upstream at campaign creation. The
+        # team_id is guaranteed non-None above, so this stays team-scoped (never global).
+        _emit_audit_event(
+            container,
+            "info",
+            "service_agent_authorized",
+            user_id=authenticated_user.uid,
+            team_id=team_id,
+            agent_instance_id=request.agent_instance_id,
+        )
+        return
     try:
         await rebac.check_user_team_permission_or_raise(
             authenticated_user, TeamPermission.CAN_READ, team_id
@@ -1255,6 +1274,31 @@ async def _enforce_session_ownership(
     )
 
 
+async def _caller_can_manage_platform(caller: KeycloakUser | None) -> bool:
+    """True when the caller holds org-level ``can_manage_platform`` (CTRLP-12 C1).
+
+    The delete endpoints use this as an **admin branch**: a platform service
+    principal — e.g. the control-plane lifecycle worker erasing a conversation at
+    window expiry — may delete a session it does not personally own. Only the
+    per-user *ownership* check is waived; *authentication* stays enforced upstream
+    by ``_authenticated_user``.
+
+    Fails closed: returns False when there is no caller or when ReBAC is disabled
+    (dev/no-security), so ownership behaviour is unchanged there and the bypass
+    activates only when ReBAC is actually enforcing and the org permission is
+    granted. Reuses the AUTHZ-01 ``can_manage_platform`` permission — no second
+    bypass is forked.
+    """
+    if caller is None:
+        return False
+    rebac = get_runtime_context().config.rebac_engine
+    if rebac is None or not rebac.enabled:
+        return False
+    return await rebac.has_user_permission(
+        caller, OrganizationPermission.CAN_MANAGE_PLATFORM, ORGANIZATION_ID
+    )
+
+
 async def _authorize_and_resolve(
     request: RuntimeExecuteRequest,
     *,
@@ -2036,6 +2080,10 @@ async def _iterate_runtime_event_payloads(
         # at prepare-execution and the frontend forwards it — but it was also
         # silently dropped here, so no agent ever received a selected prompt.
         context_prompt_text=ctx.get("context_prompt_text"),
+        # Rebuilt by the frontend from the attachments that currently exist.
+        # When the final file is deleted this is absent, so the per-turn runtime
+        # notice disappears without leaving a checkpointed system message behind.
+        attachments_markdown=ctx.get("attachments_markdown"),
     )
 
     binding = BoundRuntimeContext(
@@ -2195,6 +2243,7 @@ def _build_agent_router(
     async def get_kpi_turns(
         limit: int = 50,
         container: PodApplicationContext = Depends(get_pod_container),
+        caller: KeycloakUser | None = Depends(_authenticated_user),
     ) -> list[KpiTurnRecord]:
         """
         Return recent agent.turn_completed KPI events, newest first.
@@ -2210,6 +2259,11 @@ def _build_agent_router(
           Grafana or Prometheus; this exposes the pod-local ring buffer
         - max 200 entries retained in memory (oldest evicted automatically)
         """
+        rebac = get_runtime_context().config.rebac_engine
+        if caller is not None and rebac is not None and rebac.enabled:
+            await rebac.check_user_permission_or_raise(
+                caller, OrganizationPermission.CAN_READ_METRICS, ORGANIZATION_ID
+            )
         with container._kpi_turns_lock:
             events = list(container.kpi_turns_buffer)
         events.reverse()
@@ -2219,6 +2273,7 @@ def _build_agent_router(
     async def get_audit_events(
         limit: int = 50,
         container: PodApplicationContext = Depends(get_pod_container),
+        caller: KeycloakUser | None = Depends(_authenticated_user),
     ) -> list[AuditEventRecord]:
         """
         Return recent security audit events, newest first.
@@ -2233,6 +2288,11 @@ def _build_agent_router(
           this ring buffer so the CLI can query them directly
         - max 200 entries retained in memory
         """
+        rebac = get_runtime_context().config.rebac_engine
+        if caller is not None and rebac is not None and rebac.enabled:
+            await rebac.check_user_permission_or_raise(
+                caller, OrganizationPermission.CAN_MANAGE_PLATFORM, ORGANIZATION_ID
+            )
         with container._audit_events_lock:
             events = list(container.audit_events_buffer)
         events.reverse()
@@ -2392,6 +2452,11 @@ def _build_agent_router(
                 detail="No history store configured — session history is unavailable.",
             )
         caller_uid = caller.uid if caller is not None else None
+        if await _caller_can_manage_platform(caller):
+            # Platform admin (e.g. CTRLP-12 lifecycle erase-at-expiry): delete every
+            # row for the session, not just the caller's — ownership is waived,
+            # authentication stays enforced upstream.
+            caller_uid = None
         count = await history_store.delete_session(
             session_id=session_id, user_id=caller_uid
         )
@@ -2717,7 +2782,8 @@ def _build_agent_router(
         caller_uid = caller.uid if caller is not None else None
         history_store = _get_history_store_for_owned_access(caller)
         if (
-            caller_uid is not None
+            not await _caller_can_manage_platform(caller)
+            and caller_uid is not None
             and history_store is not None
             and not await history_store.session_belongs_to_user(session_id, caller_uid)
         ):
@@ -3073,6 +3139,7 @@ def create_agent_app(
                     checkpointer=checkpointer,
                     history_store=history_store,
                     mcp_configuration=config.get_mcp_configuration(),
+                    inprocess_toolkit_factory=build_inprocess_toolkit,
                     control_plane_url=config.platform.control_plane_url,
                     rebac_engine=rebac_engine,
                     security_profile=(

{fred_runtime-3.3.0 → fred_runtime-3.3.1}/fred_runtime/common/mcp_runtime.py

@@ -375,7 +375,7 @@ class MCPRuntime:
             )
             return
         for server in self.inprocess_servers:
-            toolkit = factory(server.provider)
+            toolkit = factory(server.provider, self.agent_instance)
             if toolkit is None:
                 logger.warning(
                     "[MCP] agent=%s no toolkit built for provider=%s (server=%s)",

{fred_runtime-3.3.0 → fred_runtime-3.3.1}/fred_runtime/deep/deep_runtime.py

@@ -38,7 +38,7 @@ from langchain_core.tools import BaseTool
 from langgraph.types import Checkpointer
 
 from fred_runtime.react.react_prompting import (
-    build_guardrail_suffix as _build_guardrail_suffix,
+    compose_system_prompt as _compose_system_prompt,
 )
 from fred_runtime.react.react_prompting import (
     render_prompt_template as _render_prompt_template,
@@ -117,11 +117,17 @@ class DeepAgentRuntime(ReActRuntime):
             binding=binding,
             agent_id=self.definition.agent_id,
         )
-        system_prompt = (
-            f"{system_prompt}"
-            f"{_build_runtime_tool_prompt_suffix(bound_tools)}"
-            f"{_build_guardrail_suffix(self.definition)}"
-            f"{_filesystem_prompt_suffix(filesystem_tools_enabled=filesystem_tools_enabled)}"
+        system_prompt = _compose_system_prompt(
+            system_prompt,
+            binding=binding,
+            definition=self.definition,
+            agent_id=self.definition.agent_id,
+            tool_suffix=_build_runtime_tool_prompt_suffix(bound_tools),
+            runtime_suffixes=(
+                _filesystem_prompt_suffix(
+                    filesystem_tools_enabled=filesystem_tools_enabled
+                ),
+            ),
         )
         compiled_agent = _create_compiled_deep_agent(
             model=self._model,

fred_runtime-3.3.1/fred_runtime/integrations/inprocess_toolkit_registry.py

@@ -0,0 +1,50 @@
+# Copyright Thales 2026
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Registry mapping catalog `provider` keys to in-process MCP toolkits (MIGR-03.03).
+
+Why this module exists:
+- an MCP catalog server with `transport: inprocess` names a `provider`; the MCP
+  runtime asks this factory to build the matching toolkit for the current agent turn
+- keeping the mapping here (not in `agent_app`) lets the runtime wire a single
+  factory reference at startup without hardcoding provider knowledge in the boot path
+
+How to use it:
+- pass `build_inprocess_toolkit` as `RuntimeConfig.inprocess_toolkit_factory`
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from fred_runtime.integrations.kf_vector_search import (
+    KF_VECTOR_SEARCH_PROVIDER,
+    KfVectorSearchToolkit,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def build_inprocess_toolkit(provider: str | None, agent: Any) -> Any | None:
+    """
+    Build the in-process toolkit for `provider`, bound to the current agent turn.
+
+    Returns None for an unknown or missing provider so the MCP runtime skips it with
+    a warning rather than failing the whole agent.
+    """
+    if provider == KF_VECTOR_SEARCH_PROVIDER:
+        return KfVectorSearchToolkit(agent=agent)
+    logger.warning("[MCP] unknown inprocess provider=%s; no toolkit built.", provider)
+    return None

fred_runtime-3.3.1/fred_runtime/integrations/kf_vector_search/__init__.py

@@ -0,0 +1,21 @@
+# Copyright Thales 2026
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""In-process Knowledge Flow vector-search MCP toolkit."""
+
+from fred_runtime.integrations.kf_vector_search.toolkit import (
+    KF_VECTOR_SEARCH_PROVIDER,
+    KfVectorSearchToolkit,
+)
+
+__all__ = ["KF_VECTOR_SEARCH_PROVIDER", "KfVectorSearchToolkit"]

fred_runtime-3.3.1/fred_runtime/integrations/kf_vector_search/toolkit.py

@@ -0,0 +1,186 @@
+# Copyright Thales 2026
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+In-process Knowledge Flow vector-search toolkit for v2 ReAct agents (MIGR-03.03).
+
+Why this module exists:
+- restores the kea behaviour where the "search_documents" tool, selected from the
+  Tools tab as an MCP server, returns typed `VectorSearchHit` sources so the chat
+  UI renders the Sources panel (and clickable `[N]` citations)
+- in kea that tool was an *inprocess* provider (`transport: inprocess`,
+  `provider: kf_vector_search`) — NOT a real remote MCP endpoint. A remote MCP tool
+  returns plain text with no typed artifact, so the panel cannot render. This
+  toolkit re-establishes the inprocess path on swift.
+
+Key design:
+- exposes one LangChain tool (`search_documents_using_vectorization`) that returns a
+  `ToolInvocationResult` directly (NOT a `content_and_artifact` tuple). The shared
+  runtime-provider resolver invokes provider tools with a plain args dict, which
+  collapses a `content_and_artifact` tuple to its content string and drops the
+  artifact — so the sources must ride on a returned `ToolInvocationResult`, which the
+  resolver extracts (see `react_tool_resolution._resolve_runtime_provider_tool`).
+  `blocks` carry the hit JSON for the LLM; `sources` carry the typed hits the chat
+  Sources panel renders. This mirrors the built-in `knowledge.search` tool ref.
+- retrieval scoping (libraries, document uids, search policy, session/corpus scope,
+  team) is read from the bound runtime context at call time — identical to the
+  built-in `knowledge.search` tool ref used by Rico, so both paths behave the same
+
+How to use it:
+- built by `build_inprocess_toolkit` when a catalog server declares
+  `provider: "kf_vector_search"`; the MCP runtime calls `.tools()` to collect the
+  LangChain tools
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Sequence
+
+from fred_core.common import OwnerFilter
+from fred_core.common.team_id import is_personal_team_id
+from fred_core.store.vector_search import VectorSearchHit
+from fred_sdk.contracts.context import (
+    ToolContentBlock,
+    ToolContentKind,
+    ToolInvocationResult,
+)
+from langchain_core.tools import BaseTool, tool
+
+from fred_runtime.common.kf_base_client import KnowledgeFlowAgentContext
+from fred_runtime.common.kf_vectorsearch_client import VectorSearchClient
+from fred_runtime.runtime_support.request_context_helpers import (
+    get_document_library_tags_ids,
+    get_document_uids,
+    get_rag_knowledge_scope,
+    get_search_policy,
+    get_vector_search_scopes,
+)
+
+logger = logging.getLogger(__name__)
+
+KF_VECTOR_SEARCH_PROVIDER = "kf_vector_search"
+
+# Only the fields the LLM needs for citation and reasoning are exposed. URL and
+# operational fields are excluded so the model cannot reproduce broken or internal
+# paths in its reply — this mirrors `_invoke_knowledge_search` (the tool-ref path).
+_LLM_FIELDS = {"uid", "title", "content", "file_name", "page", "section", "score"}
+
+
+def _llm_slice(hit: VectorSearchHit) -> dict[str, object]:
+    return {k: v for k, v in hit.model_dump(mode="json").items() if k in _LLM_FIELDS}
+
+
+class KfVectorSearchToolkit:
+    """
+    Inprocess toolkit that binds a Knowledge Flow vector search to one agent turn.
+
+    Why this class exists:
+    - the MCP runtime resolves inprocess providers to a toolkit object and calls its
+      `tools()` method to collect LangChain tools
+    - the toolkit is built per request from the agent shim (which carries the bound
+      runtime context and agent settings), so each tool call reads the current
+      session scope
+
+    How to use it:
+    - `KfVectorSearchToolkit(agent=shim).tools()`
+    """
+
+    def __init__(self, *, agent: KnowledgeFlowAgentContext) -> None:
+        self._agent = agent
+        self._client = VectorSearchClient(agent=agent)
+
+    def tools(self) -> list[BaseTool]:
+        agent = self._agent
+        client = self._client
+
+        @tool("search_documents_using_vectorization")
+        async def search_documents_using_vectorization(
+            question: str,
+            top_k: int = 8,
+        ) -> ToolInvocationResult:
+            """Search the selected document libraries using semantic similarity (RAG).
+
+            Call this tool BEFORE answering any factual, technical, or domain-specific
+            question — the corpus may hold more specific or recent information than you
+            already know. Skip it only for purely conversational exchanges (greetings,
+            thanks, clarifying what was just said).
+
+            Returns ranked hits with title and content. Cite each grounded claim with
+            the bracketed rank of the hit it relies on: [1], [2]. Only use information
+            actually present in the returned hits; never invent facts beyond them.
+            """
+            runtime_context = agent.runtime_context
+
+            if get_rag_knowledge_scope(runtime_context) == "general_only":
+                return ToolInvocationResult(
+                    tool_ref=KF_VECTOR_SEARCH_PROVIDER,
+                    blocks=(
+                        ToolContentBlock(
+                            kind=ToolContentKind.JSON,
+                            data={
+                                "sources": [],
+                                "note": "Corpus retrieval skipped in general-only mode.",
+                            },
+                        ),
+                    ),
+                    sources=(),
+                )
+
+            top_k = top_k if isinstance(top_k, int) and top_k > 0 else 8
+            team_id = agent.agent_settings.team_id
+            scoped_team = bool(team_id) and not is_personal_team_id(team_id)
+            include_session_scope, include_corpus_scope = get_vector_search_scopes(
+                runtime_context
+            )
+
+            hits: Sequence[VectorSearchHit] = await client.search(
+                question=question,
+                top_k=top_k,
+                document_library_tags_ids=get_document_library_tags_ids(
+                    runtime_context
+                ),
+                document_uids=get_document_uids(runtime_context),
+                search_policy=get_search_policy(runtime_context),
+                owner_filter=OwnerFilter.TEAM if scoped_team else OwnerFilter.PERSONAL,
+                team_id=team_id if scoped_team else None,
+                session_id=runtime_context.session_id,
+                include_session_scope=include_session_scope,
+                include_corpus_scope=include_corpus_scope,
+            )
+
+            logger.info(
+                "[KFVS][TOOL] question=%r top_k=%d hits=%d",
+                question[:80],
+                top_k,
+                len(hits),
+            )
+            # Return a ToolInvocationResult directly: the runtime-provider resolver
+            # invokes this tool with a plain args dict, so a content_and_artifact
+            # tuple would lose the artifact (and its sources). `blocks` feed the LLM
+            # the hit JSON; `sources` carry the typed hits the Sources panel renders.
+            return ToolInvocationResult(
+                tool_ref=KF_VECTOR_SEARCH_PROVIDER,
+                blocks=(
+                    ToolContentBlock(
+                        kind=ToolContentKind.JSON,
+                        data={
+                            "query": question,
+                            "hits": [_llm_slice(h) for h in hits],
+                        },
+                    ),
+                ),
+                sources=tuple(hits),
+            )
+
+        return [search_documents_using_vectorization]