iatoolkit 2.54.2__tar.gz → 2.57.0__tar.gz

{iatoolkit-2.54.2/src/iatoolkit.egg-info → iatoolkit-2.57.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.54.2
+Version: 2.57.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.54.2"
+__version__ = "2.57.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/common/interfaces/signup_policy_resolver.py

@@ -31,3 +31,20 @@ class SignupPolicyResolver(ABC):
         invite_token: str | None = None,
     ) -> SignupPolicyDecision:
         """Evaluates whether the email can sign up for the target company."""
+
+    def requires_invitation(self, company_short_name: str) -> bool:
+        return False
+
+    def invitation_email(self, company_short_name: str, invite_token: str | None) -> str | None:
+        return None
+
+    def claim_signup(
+        self,
+        company_short_name: str,
+        email: str,
+        invite_token: str | None = None,
+        *,
+        verified_email: bool = False,
+    ) -> bool:
+        """Claim an invitation in the same transaction that creates membership."""
+        return True

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/common/routes.py

@@ -5,6 +5,7 @@
 
 from io import BytesIO
 import mimetypes
+import os
 from flask import render_template, redirect, url_for, current_app, abort, send_file
 from flask import jsonify
 from iatoolkit.common.exceptions import IAToolkitException
@@ -33,6 +34,8 @@ def register_views(app):
         LoginView,
         GoogleLoginStartView,
         GoogleLoginCallbackView,
+        GlobalLoginView,
+        GlobalGoogleLoginStartView,
         FinalizeContextView,
     )
     from iatoolkit.views.configuration_api_view import ConfigurationApiView, ValidateConfigurationApiView
@@ -57,6 +60,18 @@ def register_views(app):
     # must stay reachable even if the company registry or DB is degraded.
     app.add_url_rule('/', endpoint='liveness', view_func=lambda: ("ok", 200))
 
+    # Browsers and MCP clients (Claude shows it as the connector icon) ask the
+    # host for /favicon.ico regardless of the page.
+    app.add_url_rule(
+        '/favicon.ico',
+        endpoint='favicon',
+        view_func=lambda: send_file(
+            os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'static', 'images', 'favicon.ico'),
+            mimetype='image/vnd.microsoft.icon',
+            max_age=86400,
+        ),
+    )
+
     # assign root '/' to our new redirect logic
     app.add_url_rule('/home', view_func=RootRedirectView.as_view('root_redirect'))
 
@@ -74,6 +89,13 @@ def register_views(app):
         view_func=GoogleLoginCallbackView.as_view('login_google_callback')
     )
 
+    # company-less login: identifies the person, the caller picks the company
+    app.add_url_rule('/auth/login', view_func=GlobalLoginView.as_view('global_login'))
+    app.add_url_rule(
+        '/auth/login/google',
+        view_func=GlobalGoogleLoginStartView.as_view('global_login_google_start')
+    )
+
     # Chat Route (Direct Access)
     app.add_url_rule('/<company_short_name>/chat',
                      view_func=ChatView.as_view('chat'))

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/config/system_tools_pack.yaml

@@ -129,8 +129,11 @@ tools:
   - function_name: iat_send_email
     description: iatoolkit mail system. envia mails cuando un usuario lo solicita.
     # Sends a real email: simulated, never sent, when an evaluation replays an agent.
+    # Not destructive (it changes nothing that existed) and not open-world for MCP
+    # annotations: it goes through the tenant's own mail service.
     execution_config:
       side_effects: true
+      destructive: false
     routing_profile:
       tags:
         - email
@@ -559,6 +562,9 @@ tools:
         - metadata_filter
   - function_name: iat_web_search
     description: Realiza una búsqueda web externa para obtener información pública actualizada.
+    # Reaches the public internet: openWorldHint in MCP annotations.
+    execution_config:
+      open_world: true
     routing_profile:
       tags:
         - web

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/infra/llm_providers/gemini_adapter.py

@@ -700,23 +700,34 @@ class GeminiAdapter:
         return {}
 
     def _extract_usage_metadata(self, gemini_response) -> Usage:
-        """Extraer información de uso de tokens de manera segura"""
+        """Extraer información de uso de tokens de manera segura.
+
+        Gemini reports the tokens it bills in four counters. `candidates_token_count`
+        excludes the model's reasoning (`thoughts_token_count`), which Google bills as
+        output, and `prompt_token_count` excludes the results of its built-in tools
+        (`tool_use_prompt_token_count`), billed as input. Reading only the first two
+        priced every thinking model's reasoning at zero.
+        """
         input_tokens = 0
         output_tokens = 0
         total_tokens = 0
 
+        def _count(metadata, name: str) -> int:
+            value = getattr(metadata, name, None)
+            return value if isinstance(value, int) and value > 0 else 0
+
         try:
-            # Verificar si existe usage_metadata
-            if hasattr(gemini_response, 'usage_metadata') and gemini_response.usage_metadata:
-                usage_metadata = gemini_response.usage_metadata
-
-                # Acceder a los atributos directamente, no con .get()
-                if hasattr(usage_metadata, 'prompt_token_count'):
-                    input_tokens = usage_metadata.prompt_token_count
-                if hasattr(usage_metadata, 'candidates_token_count'):
-                    output_tokens = usage_metadata.candidates_token_count
-                if hasattr(usage_metadata, 'total_token_count'):
-                    total_tokens = usage_metadata.total_token_count
+            usage_metadata = getattr(gemini_response, 'usage_metadata', None)
+            if usage_metadata:
+                input_tokens = (
+                    _count(usage_metadata, 'prompt_token_count')
+                    + _count(usage_metadata, 'tool_use_prompt_token_count')
+                )
+                output_tokens = (
+                    _count(usage_metadata, 'candidates_token_count')
+                    + _count(usage_metadata, 'thoughts_token_count')
+                )
+                total_tokens = _count(usage_metadata, 'total_token_count')
 
         except Exception as e:
             logging.warning(f"No se pudo extraer usage_metadata de Gemini: {e}")

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/locales/en.yaml

@@ -274,6 +274,10 @@ ui:
       pending_review: "Pending review"
       revoked: "Revoked"
 
+  global_login:
+    title: "Sign in to IAToolkit"
+    intro: "Sign in with the account you use in IAToolkit. You will choose the company next."
+
   login_widget:
     title: "Sign In"
     welcome_message: "Enter your credentials or register to access this platform."
@@ -287,6 +291,7 @@ ui:
     forgot_password_link: "Forgot your password?"
     no_account_prompt: "Don't have an account?"
     signup_link: "Sign Up"
+    invitation_prompt: "Need access? Ask your administrator for an invitation."
 
   signup:
     title: "Create an Account"
@@ -607,6 +612,25 @@ ui:
     status_closed: "Closed"
   admin:
     workspace: "Workspace"
+    team_invitations: "Invitations"
+    team_invite_user: "Invite user"
+    team_invite_none: "No invitations yet."
+    team_invite_loading: "Loading invitations..."
+    team_invite_email: "Email"
+    team_invite_pending: "Pending"
+    team_invite_accepted: "Accepted"
+    team_invite_expired: "Expired"
+    team_invite_revoked_status: "Revoked"
+    team_invite_status: "Status"
+    team_invite_invited_by: "Invited by"
+    team_invite_expires: "Expires"
+    team_invite_revoke: "Revoke"
+    team_invite_revoked: "Invitation revoked."
+    team_invite_load_error: "Could not load invitations."
+    team_invite_revoke_error: "Could not revoke invitation."
+    team_policy_note: "Choose domain access or require an invitation for each new member."
+    team_policy_static_note: "Signup policies are enforced when the company runs in hosted mode."
+    team_policy_invite_only: "Invitation only"
     configuration: "Configuration"
     error: "Error"
     company_config: "Company Configuration (company.yaml)"
@@ -2582,6 +2606,7 @@ errors:
     user_already_registered: "The user with email '{email}' already exists in this company."
     password_mismatch: "The passwords do not match. Please try again."
     signup_not_allowed: "Signup is not allowed for this company. Please contact an administrator."
+    invitation_required: "A valid invitation is required to join this company. Ask your administrator for a new link."
   change_password:
     token_expired: "The password change link has expired. Please request a new one."
     password_mismatch: "The passwords do not match. Please try again."

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/locales/es.yaml

@@ -288,6 +288,10 @@ ui:
       revoked: "Revocado"
 
 
+  global_login:
+    title: "Iniciar sesión en IAToolkit"
+    intro: "Ingresa con la cuenta que usas en IAToolkit. Después podrás elegir la empresa."
+
   login_widget:
     title: "Iniciar Sesión"
     welcome_message: "Ingresa tus credenciales o registrate para acceder a la plataforma."
@@ -301,6 +305,7 @@ ui:
     forgot_password_link: "¿Olvidaste tu contraseña?"
     no_account_prompt: "¿No tienes una cuenta?"
     signup_link: "Regístrate"
+    invitation_prompt: "¿Necesitas acceso? Solicita una invitación al administrador."
 
   signup:
     title: "Crear una Cuenta"
@@ -621,6 +626,25 @@ ui:
     status_closed: "Cerrada"
   admin:
     workspace: "Recursos"
+    team_invitations: "Invitaciones"
+    team_invite_user: "Invitar usuario"
+    team_invite_none: "Todavía no hay invitaciones."
+    team_invite_loading: "Cargando invitaciones..."
+    team_invite_email: "Correo"
+    team_invite_pending: "Pendiente"
+    team_invite_accepted: "Aceptada"
+    team_invite_expired: "Vencida"
+    team_invite_revoked_status: "Revocada"
+    team_invite_status: "Estado"
+    team_invite_invited_by: "Invitado por"
+    team_invite_expires: "Vence"
+    team_invite_revoke: "Revocar"
+    team_invite_revoked: "Invitación revocada."
+    team_invite_load_error: "No se pudieron cargar las invitaciones."
+    team_invite_revoke_error: "No se pudo revocar la invitación."
+    team_policy_note: "Permite el acceso por dominio o exige una invitación para cada nuevo miembro."
+    team_policy_static_note: "Las políticas de registro se aplican cuando la empresa funciona en modo alojado."
+    team_policy_invite_only: "Solo con invitación"
     configuration: "Configuración"
     error: "Error"
     company_config: "Configuración Empresa (company.yaml)"
@@ -2601,6 +2625,7 @@ errors:
     user_already_registered: "El usuario con email '{email}' ya existe en esta empresa."
     password_mismatch: "Las contraseñas no coinciden. Por favor, inténtalo de nuevo."
     signup_not_allowed: "El registro no está habilitado para esta empresa. Contacta a un administrador."
+    invitation_required: "Necesitas una invitación vigente para unirte a esta empresa. Solicita un nuevo enlace al administrador."
   change_password:
     token_expired: "El enlace de cambio de contraseña ha expirado. Por favor, solicita uno nuevo."
     password_mismatch: "Las contraseñas no coinciden. Por favor, inténtalo nuevamente."

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/repositories/llm_query_repo.py

@@ -14,6 +14,7 @@ from iatoolkit.repositories.models import (
 from injector import inject
 from iatoolkit.repositories.database_manager import DatabaseManager
 from sqlalchemy import or_, and_
+from iatoolkit.repositories.models import CONTEXT_INIT_REQUEST_SOURCE
 from typing import List
 
 
@@ -34,10 +35,17 @@ class LLMQueryRepo:
         self.session.commit()
         return query
 
+    @staticmethod
+    def not_context_init():
+        """Filter for rows that are a conversation turn, not a context initialization."""
+        request_source = LLMQuery.stats["request_source"].as_string()
+        return or_(request_source.is_(None), request_source != CONTEXT_INIT_REQUEST_SOURCE)
+
     # get user query history
     def get_history(self, company: Company, user_identifier: str, limit: int = 100) -> list[LLMQuery]:
         return self.session.query(LLMQuery).filter(
             LLMQuery.user_identifier == user_identifier,
+            self.not_context_init(),
         ).filter_by(company_id=company.id).order_by(LLMQuery.created_at.desc()).limit(limit).all()
 
 

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/repositories/models.py

@@ -593,6 +593,12 @@ class MemoryPageSource(Base):
         return {column.key: getattr(self, column.key) for column in class_mapper(self.__class__).columns}
 
 
+#: request_source of the iat_queries row that records a context initialization:
+#: the company context sent once to start a server-side conversation. Its tokens
+#: are billed, but it is not a question, so conversation readers skip it.
+CONTEXT_INIT_REQUEST_SOURCE = "context_init"
+
+
 class LLMQuery(Base):
     """Logs a query made to the LLM, including input, output, and metadata."""
     __tablename__ = 'iat_queries'
@@ -622,6 +628,10 @@ class LLMQuery(Base):
 
     __table_args__ = (
         Index('ix_iat_queries_company_prompt_created', 'company_id', 'prompt_name', 'created_at'),
+        # Executions that did not run as a task (synchronous agent calls). They are a
+        # tiny fraction of the table, which the Agents monitor would otherwise scan whole.
+        Index('ix_iat_queries_company_created_untasked', company_id, created_at.desc(),
+              postgresql_where=task_id.is_(None)),
     )
 
     company = relationship("Company", back_populates="llm_queries")

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/services/auth_service.py

@@ -22,6 +22,8 @@ class AuthService:
     Centralized service for handling authentication for all incoming requests.
     It determines the user's identity based on either a Flask session cookie or an API Key.
     """
+    # access-log scope for logins that are not tied to a company
+    GLOBAL_ACCESS_SCOPE = '*'
 
     @inject
     def __init__(self, profile_service: ProfileService,
@@ -186,6 +188,82 @@ class AuthService:
 
         return auth_response
 
+    def login_global_local_user(self, email: str, password: str) -> dict:
+        # company-less login: authenticates the person, the company is chosen later
+        auth_response = self.profile_service.authenticate_local_credentials(email=email, password=password)
+        if not auth_response.get('success'):
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                user_identifier=email,
+                auth_type='local',
+                outcome='failure',
+                reason_code='INVALID_CREDENTIALS',
+            )
+            return auth_response
+
+        self.profile_service.set_global_identity(auth_response['user_identifier'], 'local')
+        self.log_access(
+            company_short_name=self.GLOBAL_ACCESS_SCOPE,
+            auth_type='local',
+            outcome='success',
+            user_identifier=auth_response['user_identifier'],
+        )
+        return auth_response
+
+    def login_global_google_user(self, code: str, state: str, nonce: str, redirect_uri: str) -> dict:
+        try:
+            google_identity = self.google_auth_client.exchange_code_for_identity(
+                code=code,
+                state=state,
+                nonce=nonce,
+                redirect_uri=redirect_uri,
+            )
+        except GoogleAuthError as exc:
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                auth_type='google',
+                outcome='failure',
+                reason_code=exc.reason_code,
+            )
+            return {
+                'success': False,
+                'reason_code': exc.reason_code,
+                'message': self.i18n_service.t(exc.message_key),
+            }
+        except Exception:
+            logging.exception("Unexpected Google auth client failure in company-less login.")
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                auth_type='google',
+                outcome='failure',
+                reason_code='GOOGLE_AUTH_UNEXPECTED_ERROR',
+            )
+            return {
+                'success': False,
+                'reason_code': 'GOOGLE_AUTH_UNEXPECTED_ERROR',
+                'message': self.i18n_service.t('errors.auth.google_login_failed'),
+            }
+
+        auth_response = self.profile_service.identify_google_user(google_identity)
+        if not auth_response.get('success'):
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                auth_type='google',
+                outcome='failure',
+                reason_code=auth_response.get('reason_code', 'GOOGLE_LOGIN_FAILED'),
+                user_identifier=google_identity.email,
+            )
+            return auth_response
+
+        self.profile_service.set_global_identity(auth_response['user_identifier'], 'google')
+        self.log_access(
+            company_short_name=self.GLOBAL_ACCESS_SCOPE,
+            auth_type='google',
+            outcome='success',
+            user_identifier=auth_response['user_identifier'],
+        )
+        return auth_response
+
     def verify(self, anonymous: bool = False, company_short_name: str = None) -> dict:
         """
         Verifies the current request and identifies the user.

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/services/configuration_service.py

@@ -794,8 +794,14 @@ class ConfigurationService:
             if execution_config is not None:
                 if not isinstance(execution_config, dict):
                     add_error(f"tools[{i}].execution_config", "Must be a dictionary.")
-                elif "side_effects" in execution_config and not isinstance(execution_config["side_effects"], bool):
-                    add_error(f"tools[{i}].execution_config.side_effects", "Must be true or false.")
+                else:
+                    # side_effects drives evaluations; destructive / open_world / title
+                    # feed the MCP tool annotations.
+                    for flag in ("side_effects", "destructive", "open_world"):
+                        if flag in execution_config and not isinstance(execution_config[flag], bool):
+                            add_error(f"tools[{i}].execution_config.{flag}", "Must be true or false.")
+                    if "title" in execution_config and not isinstance(execution_config["title"], str):
+                        add_error(f"tools[{i}].execution_config.title", "Must be a string.")
 
         # 6. Prompts
         prompt_list, categories_config = self._get_prompt_config(config)

{iatoolkit-2.54.2 → iatoolkit-2.57.0}/src/iatoolkit/services/history_manager_service.py

@@ -60,7 +60,8 @@ class HistoryManagerService:
             response_id = self.llm_client.set_company_context(
                 company=company,
                 company_base_context=prepared_context,
-                model=model
+                model=model,
+                user_identifier=user_identifier,
             )
             self.session_context.save_last_response_id(company_short_name, user_identifier, response_id, model=model)
             self.session_context.save_initial_response_id(company_short_name, user_identifier, response_id, model=model)