iatoolkit 2.44.3__tar.gz → 2.45.0__tar.gz

{iatoolkit-2.44.3/src/iatoolkit.egg-info → iatoolkit-2.45.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.44.3
+Version: 2.45.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.44.3 → iatoolkit-2.45.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.44.3"
+__version__ = "2.45.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.44.3 → iatoolkit-2.45.0}/src/iatoolkit/infra/llm_providers/openai_compatible_chat_adapter.py

@@ -8,8 +8,11 @@ import json
 import logging
 import mimetypes
 import threading
+import time
 from typing import Any, Dict, List, Optional
 
+import openai
+
 from iatoolkit.common.exceptions import IAToolkitException
 from iatoolkit.infra.llm_response import LLMResponse, ToolCall, Usage
 
@@ -45,6 +48,16 @@ class OpenAICompatibleChatAdapter:
     supports_thinking = False
     allow_follow_up_tool_calls = True
 
+    #: `LLMProxy` builds every client with `max_retries=0` by default (see
+    #: `LLMProxy.DEFAULT_MAX_RETRIES`), so a bare transport failure - DNS,
+    #: TCP reset, TLS handshake - was previously only recovered by the RQ-level
+    #: task retry: 10s+ of wait, a full job re-run, and the earlier attempt's
+    #: error dropped (see `TaskService._record_task_retry_attempt`). Retrying a
+    #: handful of times here, right where the failure happens, recovers the
+    #: common "connection error, works on the 2nd try" case in ~1-2s instead.
+    _CONNECTION_ERROR_MAX_ATTEMPTS = 3
+    _CONNECTION_ERROR_RETRY_DELAY_SECONDS = 0.75
+
     def __init__(self, openai_compatible_client, provider_label: str = "OpenAI-compatible"):
         self.client = openai_compatible_client
         self.provider_label = provider_label
@@ -168,19 +181,44 @@ class OpenAICompatibleChatAdapter:
         _ = kwargs
 
     def _create_chat_completion(self, call_kwargs: Dict[str, Any]) -> Any:
-        try:
-            return self.client.chat.completions.create(**call_kwargs)
-        except Exception as ex:
-            retry_call_kwargs = self._build_retry_without_tool_choice_kwargs(call_kwargs, ex)
-            if retry_call_kwargs is None:
+        attempt = 1
+        while True:
+            try:
+                return self.client.chat.completions.create(**call_kwargs)
+            except openai.APITimeoutError:
+                # A read/write timeout means the request may already be running
+                # upstream (a long generation just took its time) - resending it
+                # would risk paying for the same generation twice with no
+                # guarantee the retry is any faster. Let the RQ-level task retry
+                # handle this one instead of looping on it here.
                 raise
+            except openai.APIConnectionError as ex:
+                # A transport-level failure (DNS, TCP reset, TLS handshake) happens
+                # before the request reaches the provider, so retrying is safe and
+                # cheap - unlike APITimeoutError above, there's no ambiguity about
+                # whether the provider already started working on this request.
+                if attempt >= self._CONNECTION_ERROR_MAX_ATTEMPTS:
+                    raise
+                logging.warning(
+                    "[%sAdapter] Connection error calling provider (attempt %s/%s); retrying: %s",
+                    self.provider_label,
+                    attempt,
+                    self._CONNECTION_ERROR_MAX_ATTEMPTS,
+                    ex,
+                )
+                time.sleep(self._CONNECTION_ERROR_RETRY_DELAY_SECONDS)
+                attempt += 1
+            except Exception as ex:
+                retry_call_kwargs = self._build_retry_without_tool_choice_kwargs(call_kwargs, ex)
+                if retry_call_kwargs is None:
+                    raise
 
-            logging.warning(
-                "[%sAdapter] Provider rejected tool_choice for model '%s'; retrying without tool_choice.",
-                self.provider_label,
-                call_kwargs.get("model"),
-            )
-            return self.client.chat.completions.create(**retry_call_kwargs)
+                logging.warning(
+                    "[%sAdapter] Provider rejected tool_choice for model '%s'; retrying without tool_choice.",
+                    self.provider_label,
+                    call_kwargs.get("model"),
+                )
+                return self.client.chat.completions.create(**retry_call_kwargs)
 
     @staticmethod
     def _build_retry_without_tool_choice_kwargs(

{iatoolkit-2.44.3 → iatoolkit-2.45.0}/src/iatoolkit/infra/llm_providers/openrouter_adapter.py

@@ -16,22 +16,21 @@ class OpenRouterAdapter(OpenAICompatibleChatAdapter):
     supports_metadata = True
     supports_parallel_tool_calls = True
 
-    # llm_capabilities.yaml marks `application/pdf` as natively supported for
-    # every OpenRouter model, but that flag isn't verified per-model the way
-    # native images are (see AttachmentPolicyService._get_openrouter_native_image_error).
-    # Models with no native PDF support (e.g. some Qwen models) reject the raw
-    # file part and OpenRouter answers with no `choices`. Always routing PDFs
-    # through OpenRouter's own `file-parser` plugin sidesteps that per-model gap
-    # instead of trying to track which routed model does or doesn't accept PDFs.
-    #
-    # engine="native": let the routed model read the PDF with its own
-    # multimodal capability, falling back to OpenRouter's own extraction only
-    # when the model doesn't support that. engine="mistral-ocr" used to be the
-    # default here, but it forces every PDF - regardless of model support -
-    # through OpenRouter's shared OCR pipeline, which is what produced the
-    # "document parsing engine is currently rate limited" failures.
+    # Fixed at "native" by policy: a PDF attachment must reach the routed model
+    # as-is, for it to read with its own vision/multimodal capability - never
+    # silently rewritten into extracted text by OpenRouter's OCR/parsing
+    # pipeline. This only applies when nothing else already requested a plugin
+    # (see _extend_call_kwargs below); an explicit `plugins` kwarg always wins.
     _PDF_FILE_PARSER_PLUGIN = [{"id": "file-parser", "pdf": {"engine": "native"}}]
 
+    # Providers observed returning HTTP 400 on `type: "file"` content parts
+    # even when routed to a model whose aggregate catalog entry lists "file"
+    # as a supported input modality (OpenRouter's per-endpoint support lags
+    # the model-level declaration). Excluded via `provider.ignore` whenever
+    # we send a native file attachment, so routing skips them instead of
+    # failing the request.
+    _FILE_UNSUPPORTED_PROVIDERS = ("parasail", "akashml", "alibaba", "chutes", "reka")
+
     def __init__(self, openrouter_client):
         super().__init__(openai_compatible_client=openrouter_client, provider_label="OpenRouter")
 
@@ -74,8 +73,17 @@ class OpenRouterAdapter(OpenAICompatibleChatAdapter):
             if kwargs.get(key) is not None:
                 extra_body[key] = kwargs.get(key)
 
-        if "plugins" not in extra_body and self._has_pdf_attachment(kwargs.get("attachments")):
-            extra_body["plugins"] = self._PDF_FILE_PARSER_PLUGIN
+        if self._has_pdf_attachment(kwargs.get("attachments")):
+            if "plugins" not in extra_body:
+                extra_body["plugins"] = self._PDF_FILE_PARSER_PLUGIN
+
+            provider_opts = dict(extra_body.get("provider") or {})
+            ignore = list(provider_opts.get("ignore") or [])
+            for provider_slug in self._FILE_UNSUPPORTED_PROVIDERS:
+                if provider_slug not in ignore:
+                    ignore.append(provider_slug)
+            provider_opts["ignore"] = ignore
+            extra_body["provider"] = provider_opts
 
         if extra_body:
             call_kwargs["extra_body"] = extra_body

{iatoolkit-2.44.3 → iatoolkit-2.45.0}/src/iatoolkit/infra/llm_proxy.py

@@ -132,6 +132,11 @@ class LLMProxy:
             model_config=model_config,
             request_kwargs=request_kwargs,
         )
+        request_kwargs = self._apply_provider_default_routing(
+            provider=provider,
+            provider_config=provider_config,
+            request_kwargs=request_kwargs,
+        )
         request_kwargs = self._apply_company_request_defaults(
             company_short_name=company_short_name,
             model=model,
@@ -330,6 +335,37 @@ class LLMProxy:
 
         return effective_kwargs
 
+    def _apply_provider_default_routing(
+        self,
+        provider: str,
+        provider_config: Dict[str, Any],
+        request_kwargs: Dict[str, Any],
+    ) -> Dict[str, Any]:
+        """
+        Company-wide OpenRouter routing default, configured once under
+        `llm.openrouter.routing` instead of repeated on every model.
+        Applied after model-level routing so precedence stays
+        caller-explicit > per-model routing > this provider-wide default.
+        """
+        effective_kwargs = dict(request_kwargs or {})
+
+        if provider != self.PROVIDER_OPENROUTER or not isinstance(provider_config, dict):
+            return effective_kwargs
+
+        default_routing = provider_config.get("routing")
+        if not isinstance(default_routing, dict) or not default_routing:
+            return effective_kwargs
+
+        existing_provider = effective_kwargs.get("provider")
+        if isinstance(existing_provider, dict):
+            merged_provider = dict(default_routing)
+            merged_provider.update(existing_provider)
+            effective_kwargs["provider"] = merged_provider
+        elif existing_provider is None:
+            effective_kwargs["provider"] = dict(default_routing)
+
+        return effective_kwargs
+
     def _apply_company_request_defaults(
         self,
         company_short_name: str,

{iatoolkit-2.44.3 → iatoolkit-2.45.0}/src/iatoolkit/services/license_service.py

@@ -27,7 +27,6 @@ class LicenseService:
             "license_type": "Community Edition",
             "plan": "Open Source (Community Edition)",
             "max_companies": 1,
-            "max_tools": 3,
             "features": {
                 "multi_tenant": False,
                 "rag_advanced": False,
@@ -46,11 +45,8 @@ class LicenseService:
     def get_max_companies(self) -> int:
         return self.limits.get("max_companies", 1)
 
-    def get_max_tools_per_company(self) -> int:
-        return self.limits.get("max_tools", 3)
-
     def get_license_info(self) -> str:
-        return f"Plan: {self.get_plan_name()}, Companies: {self.get_max_companies()}, Tools: {self.get_max_tools_per_company()}"
+        return f"Plan: {self.get_plan_name()}, Companies: {self.get_max_companies()}"
 
     # --- Restriction Validators ---
 
@@ -65,15 +61,6 @@ class LicenseService:
             )
 
 
-    def validate_tool_config_limit(self, tools_config: list):
-        """Validates a configuration list before processing it."""
-        limit = self.get_max_tools_per_company()
-        if limit != -1 and len(tools_config) > limit:
-            raise IAToolkitException(
-                IAToolkitException.ErrorType.PERMISSION,
-                f"Configuration defines {len(tools_config)} tools, but limit is {limit}."
-            )
-
     # --- Feature Gating Validators ---
 
     def has_feature(self, feature_key: str) -> bool:

iatoolkit-2.45.0/src/iatoolkit/services/operator_identity_service.py

@@ -0,0 +1,104 @@
+# Copyright (c) 2024 Fernando Libedinsky
+# Product: IAToolkit
+#
+# IAToolkit is open source software.
+
+import logging
+import os
+
+from injector import inject, singleton
+
+from iatoolkit.common.exceptions import IAToolkitException
+from iatoolkit.repositories.profile_repo import ProfileRepo
+
+
+@singleton
+class OperatorIdentityService:
+    """Which company operates this deployment.
+
+    One question that four places used to answer with the same typed string: where
+    the operator's own accounts live, which company you must be signed into to
+    reach the control center, whose portfolio the console lists, and — the one that
+    handles money — whose merchant account collects invoices.
+
+    Lives in the core because the core, Enterprise and the website all ask it, and
+    a rule restated in three repositories drifts. Same reason ``ServiceModel`` is
+    here.
+    """
+
+    #: The name this deployment used before the question was a setting. Kept as a
+    #: fallback so nothing has to be configured here, but only honoured when the
+    #: company actually exists: on any other deployment the name is meaningless,
+    #: and silently accepting it is what made a monthly close resolve the payment
+    #: configuration of a company that was not there and mark every invoice failed.
+    LEGACY_COMPANY_SHORT_NAME = "iat_store"
+
+    #: In order. The second name predates this service and is honoured by the
+    #: Stripe webhook, so a deployment that already set it keeps working without
+    #: being asked to set a second variable for the same fact.
+    SETTING_NAMES = ("IAT_OPERATOR_COMPANY", "IAT_BILLING_COMPANY_SHORT_NAME")
+    SETTING_NAME = SETTING_NAMES[0]
+
+    @classmethod
+    def stated_name(cls) -> str:
+        """What this deployment calls its operator, without checking it exists.
+
+        For callers with no database at hand. The verification belongs on the
+        money path — see ``company_short_name`` — and skipping it here is safe
+        because those callers fail in the open: a company that does not exist
+        cannot authenticate anyone and holds no payment configuration.
+        """
+        for setting in cls.SETTING_NAMES:
+            value = (os.getenv(setting) or "").strip().lower()
+            if value:
+                return value
+        return cls.LEGACY_COMPANY_SHORT_NAME
+
+    @inject
+    def __init__(self, profile_repo: ProfileRepo):
+        self.profile_repo = profile_repo
+        self._resolved: str | None = None
+
+    def company_short_name(self) -> str:
+        """The operator company, resolved once per process.
+
+        Cached because the answer cannot change without a deployment, and this is
+        read on paths that run per request and per invoice.
+        """
+        if self._resolved:
+            return self._resolved
+
+        for setting in self.SETTING_NAMES:
+            configured = (os.getenv(setting) or "").strip().lower()
+            if configured:
+                self._resolved = configured
+                logging.info("Operator company: '%s' (from %s).", configured, setting)
+                return self._resolved
+
+        if self._company_exists(self.LEGACY_COMPANY_SHORT_NAME):
+            self._resolved = self.LEGACY_COMPANY_SHORT_NAME
+            logging.info(
+                "Operator company: '%s' (default). Set %s to name it explicitly.",
+                self._resolved,
+                self.SETTING_NAME,
+            )
+            return self._resolved
+
+        # Deliberately loud. The alternative is what used to happen: a name from
+        # another deployment travels down to the payment configuration and the
+        # close writes failed invoices, which reads as a collection problem.
+        raise IAToolkitException(
+            IAToolkitException.ErrorType.CONFIG_ERROR,
+            f"This deployment has no operator company. Set {self.SETTING_NAME} to the "
+            f"short name of the company that operates it (there is no "
+            f"'{self.LEGACY_COMPANY_SHORT_NAME}' company in this database).",
+        )
+
+    def _company_exists(self, short_name: str) -> bool:
+        try:
+            return self.profile_repo.get_company_by_short_name(short_name) is not None
+        except Exception as exc:
+            # Unreadable is not the same as absent, and guessing either way here is
+            # worse than saying so: the caller gets the explicit error below.
+            logging.warning("Could not check whether company '%s' exists: %s", short_name, exc)
+            return False

{iatoolkit-2.44.3 → iatoolkit-2.45.0}/src/iatoolkit/services/profile_service.py

@@ -6,7 +6,7 @@
 from injector import inject
 from iatoolkit.repositories.profile_repo import ProfileRepo
 from iatoolkit.services.i18n_service import I18nService
-from iatoolkit.repositories.models import User, Company
+from iatoolkit.repositories.models import User, Company, user_company
 from flask_bcrypt import check_password_hash
 from flask import request, has_request_context
 from iatoolkit.common.session_manager import SessionManager
@@ -24,6 +24,7 @@ import logging
 from html import escape
 from datetime import datetime
 from typing import List, Dict
+from sqlalchemy import update
 from iatoolkit.common.interfaces.signup_policy_resolver import SignupPolicyResolver
 from iatoolkit.services.signup_policy_resolver import AllowAllSignupPolicyResolver
 
@@ -71,6 +72,10 @@ class ProfileService:
             text = fallback
         return text.lower()
 
+    @staticmethod
+    def _normalize_email_value(email: str | None) -> str:
+        return str(email or "").strip().lower()
+
     def _resolve_google_names(self, email: str, google_identity: GoogleIdentity) -> tuple[str, str]:
         given_name = str(google_identity.given_name or "").strip()
         family_name = str(google_identity.family_name or "").strip()
@@ -116,6 +121,30 @@ class ProfileService:
             'message': 'Login ok',
         }
 
+    def _promote_bootstrap_owner_if_needed(self, company: Company, user: User) -> None:
+        params = company.parameters if isinstance(company.parameters, dict) else {}
+        pending_admin_email = self._normalize_email_value(params.get("bootstrap_admin_email"))
+        user_email = self._normalize_email_value(getattr(user, "email", ""))
+
+        if not pending_admin_email or pending_admin_email != user_email:
+            return
+
+        self.profile_repo.session.execute(
+            update(user_company)
+            .where(
+                user_company.c.user_id == user.id,
+                user_company.c.company_id == company.id,
+            )
+            .values(role="admin")
+        )
+
+        updated_params = dict(params)
+        updated_params.pop("bootstrap_admin_email", None)
+        updated_params["workspace_owner_email"] = user_email
+        company.parameters = updated_params
+        self.profile_repo.session.add(company)
+        self.profile_repo.session.commit()
+
     def _link_user_to_google(self, user: User, google_identity: GoogleIdentity):
         user.auth_method = 'google'
         user.google_sub = google_identity.subject
@@ -574,6 +603,7 @@ class ProfileService:
                     # add new company to existing user
                     existing_user.companies.append(company)
                     self.profile_repo.save_user(existing_user)
+                    self._promote_bootstrap_owner_if_needed(company, existing_user)
                     return {"message": self.i18n_service.t('flash_messages.user_associated_success')}
 
             # add the new user
@@ -610,6 +640,7 @@ class ProfileService:
 
             # and create in the database
             self.profile_repo.create_user(new_user)
+            self._promote_bootstrap_owner_if_needed(company, new_user)
 
             # send email with verification
             if not cfg or cfg.get('verify_account', True):

{iatoolkit-2.44.3 → iatoolkit-2.45.0/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.44.3
+Version: 2.45.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.44.3 → iatoolkit-2.45.0}/src/iatoolkit.egg-info/SOURCES.txt

@@ -137,6 +137,7 @@ src/iatoolkit/services/memory_service.py
 src/iatoolkit/services/memory_wiki_service.py
 src/iatoolkit/services/noop_memory_compilation_trigger.py
 src/iatoolkit/services/noop_memory_lint_trigger.py
+src/iatoolkit/services/operator_identity_service.py
 src/iatoolkit/services/pdf_service.py
 src/iatoolkit/services/profile_service.py
 src/iatoolkit/services/prompt_resource_service.py