imbi-api 2.41.0__tar.gz → 2.43.0__tar.gz

{imbi_api-2.41.0 → imbi_api-2.43.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-api
-Version: 2.41.0
+Version: 2.43.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -19,15 +19,14 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.41.0
-Requires-Dist: imbi-plugin-github==2.41.0
+Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.43.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: limits<6,>=5
 Requires-Dist: mcp>=1.26.0
 Requires-Dist: nanoid>=2.0.0
 Requires-Dist: orjson>=3.11.6
-Requires-Dist: pillow
+Requires-Dist: pillow>=13.0.0
 Requires-Dist: pydantic[email]
 Requires-Dist: pyotp>=2.9.0
 Requires-Dist: python-multipart>=0.0.26

{imbi_api-2.41.0 → imbi_api-2.43.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.41.0"
+version = "2.43.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -19,7 +19,7 @@ classifiers = [
   "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-  "Pillow",
+  "Pillow>=13.0.0",
   "aioboto3>=15.5.0",
   "aiohttp",
   "argon2-cffi>=25.1.0",
@@ -28,8 +28,7 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,mcp,sentry,server]==2.41.0",
-  "imbi-plugin-github==2.41.0",
+  "imbi-common[databases,llm,mcp,sentry,server]==2.43.0",
   "jinja2",
   "jsonpatch>=1.33",
   "limits>=5,<6",

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/agent_tasks/__init__.py

@@ -42,6 +42,7 @@ from imbi.api.agent_tasks.store import (
     TaskArchived,
     TaskClosed,
     TaskNotFound,
+    TaskOpen,
     TaskStore,
     Usage,
 )
@@ -124,6 +125,7 @@ __all__ = [
     'TaskArchived',
     'TaskClosed',
     'TaskNotFound',
+    'TaskOpen',
     'TaskStore',
     'Usage',
     'create_pool',

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/agent_tasks/store.py

@@ -142,6 +142,10 @@ class TaskClosed(ValueError):
     """The task is closed. A closed task does not change."""
 
 
+class TaskOpen(ValueError):
+    """The task, or a task that it delegated to, is not closed."""
+
+
 class CancelPending(ValueError):
     """A cancel waits for the harness; the control cannot change."""
 
@@ -454,10 +458,24 @@ class TaskStore:
         Return the task and ``True``. When a concurrent request made a
         task with the same idempotency key first, return that task and
         ``False``. The rollback also returns the short id to the counter.
+
+        Raises:
+            TaskClosed: The origin is a task that is closed or gone.
+
         """
         task_id = uuid.uuid4()
         try:
             async with self._pool.connection() as conn, conn.transaction():
+                if task.origin_kind == 'task':
+                    # The lock conflicts with the lock in delete, so a
+                    # parent cannot go while its child is made.
+                    cursor = await conn.execute(
+                        'SELECT 1 FROM agent_runtime.tasks WHERE id = %s::uuid'
+                        " AND status <> 'closed' FOR KEY SHARE",
+                        (task.origin_id,),
+                    )
+                    if await cursor.fetchone() is None:
+                        raise TaskClosed(task.origin_id)
                 short_id = await _next_short_id(conn, task.organization_id)
                 await conn.execute(
                     'INSERT INTO agent_runtime.tasks (id, organization_id,'
@@ -709,6 +727,76 @@ class TaskStore:
             )
         return True
 
+    async def delete(self, organization_id: str, short_id: str) -> Row:
+        """Delete a closed task and return its row.
+
+        Its events, sessions, requests, budget ledger, and harness rows
+        go by cascade; its dependency and project rows go here. The
+        secret resolutions and the ClickHouse rows (archived events,
+        usage) stay, for the security and cost history.
+
+        Raises:
+            TaskNotFound: No such task.
+            TaskOpen: The task, or a child or chain task, is not closed,
+                the log of the task is not archived, its harness chain
+                is not done, or it has open secret resolutions.
+
+        """
+        async with self._pool.connection() as conn, conn.transaction():
+            task = await _fetch_one(
+                conn,
+                'SELECT * FROM agent_runtime.tasks'
+                ' WHERE organization_id = %s AND short_id = %s FOR UPDATE',
+                (organization_id, short_id),
+            )
+            if task is None:
+                raise TaskNotFound(short_id)
+            # The cascade would remove events and ledger rows that the
+            # sweep has not yet put in ClickHouse.
+            if task['log_archived_at'] is None:
+                raise TaskOpen(short_id)
+            # The harness chain row of a root task cascades, so an open
+            # task in its chain must not lose it. A legacy root has no
+            # stored chain_id.
+            chain_id = task['chain_id'] or task['id']
+            cursor = await conn.execute(
+                'SELECT 1 FROM agent_runtime.tasks'
+                " WHERE status <> 'closed' AND (id = %s OR chain_id = %s"
+                ' OR (chain_id IS NULL AND id = %s)'
+                " OR (origin_kind = 'task' AND origin_id = %s)) LIMIT 1",
+                (task['id'], chain_id, chain_id, str(task['id'])),
+            )
+            if await cursor.fetchone() is not None:
+                raise TaskOpen(short_id)
+            # The lease sweep still needs the chain row of a root that
+            # waits for its fencers, and Broker.sweep joins the open
+            # resolutions of a failed close hook to the task.
+            cursor = await conn.execute(
+                'SELECT 1 FROM harness.chains WHERE root_task_id = %s'
+                " AND state IN ('running', 'fencing', 'stuck')"
+                ' UNION ALL SELECT 1 FROM secrets.resolutions'
+                " WHERE task_id = %s AND state IN ('pending', 'active')"
+                ' LIMIT 1',
+                (task['id'], task['id']),
+            )
+            if await cursor.fetchone() is not None:
+                raise TaskOpen(short_id)
+            await conn.execute(
+                'DELETE FROM agent_runtime.task_dependencies'
+                ' WHERE organization_id = %s'
+                ' AND (dependent_task_id = %s OR prerequisite_task_id = %s)',
+                (organization_id, task['id'], task['id']),
+            )
+            await conn.execute(
+                'DELETE FROM agent_runtime.task_projects'
+                ' WHERE organization_id = %s AND task_id = %s',
+                (organization_id, task['id']),
+            )
+            await conn.execute(
+                'DELETE FROM agent_runtime.tasks WHERE id = %s', (task['id'],)
+            )
+        return task
+
     async def set_control(
         self,
         organization_id: str,

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/auth/agent_api_routes.py

@@ -244,6 +244,7 @@ REFUSED_ROUTES: frozenset[str] = frozenset(
         'PUT /prompts/{namespace}/{slug}/labels/{label}',
         'PUT /prompts/{namespace}/{slug}/versions/{n}/evaluation',
         # Agent tasks: an agent works on its tasks through the harness routes only, so it cannot answer its own approval or question, reassign, or start another agent outside its chain
+        'DELETE /organizations/{org_slug}/agent-tasks/{short_id}',
         'DELETE /organizations/{org_slug}/agent-tasks/{short_id}/projects/{project_id}',
         'DELETE /organizations/{org_slug}/agent-tasks/{short_id}/requires/{prerequisite}',
         'POST /organizations/{org_slug}/agent-tasks/',

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/auth/seed.py

@@ -484,6 +484,13 @@ STANDARD_PERMISSIONS: list[tuple[str, str, str, str]] = [
         'resolve',
         'Answer feedback requests and resolve approvals of agent tasks',
     ),
+    # Granted to no non-admin default role.
+    (
+        'agent_task:delete',
+        'agent_task',
+        'delete',
+        'Delete closed agent tasks',
+    ),
     # Workflows (ADR 0021)
     (
         'workflow:read',

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/commit_sync/service.py

@@ -144,9 +144,12 @@ async def run_sync(
     :class:`CommitSyncUnavailable` when no integration provides the
     capability; other failures propagate so the caller can record them.
 
-    Once the tags are in, enriches any that carry no release notes -- a tag
-    cut outside imbi has no ``Release`` node, so this is what gives it a
-    title and body to show.  Then re-reads the drift notes ref, because
+    Once the tags are in, points every tagged ``Release`` node at the
+    commit its tag now names -- a tag re-promoted after a failed build
+    keeps its first commit on the node, and no other sync rewrites it.
+    Then enriches any that carry no release notes -- a tag cut outside
+    imbi has no ``Release`` node, so this is what gives it a title and
+    body to show.  Then re-reads the drift notes ref, because
     the commits this just recorded have no verdicts and readers fail
     closed on that: recovering a commit without its verdict shows it as
     drifted.  Both are best-effort: a failure there is logged and leaves
@@ -164,6 +167,7 @@ async def run_sync(
     )
     handler = typing.cast('CommitSyncCapability', resolved.capability_cls())
     counts = await handler.sync_all_history(ctx=ctx, credentials=credentials)
+    await _reconcile_release_committishes(db, org_slug, project_id)
     await _backfill_release_notes(db, org_slug, project_id)
     await _resync_drift_verdicts(db, org_slug, project_id)
     return counts
@@ -203,6 +207,34 @@ async def run_tag_sync(
     return await handler.sync_tag(ctx=ctx, credentials=credentials, tag=tag)
 
 
+async def _reconcile_release_committishes(
+    db: graph.Graph, org_slug: str, project_id: str
+) -> None:
+    """Heal Release nodes whose synced tag names another commit."""
+    # Imported here (not at module load) so the worker/service module
+    # never pulls the endpoints package at import time.
+    from imbi.api.endpoints import project_deployments
+
+    try:
+        healed = await project_deployments.reconcile_release_committishes(
+            db, org_slug=org_slug, project_id=project_id
+        )
+    except Exception:  # noqa: BLE001
+        LOGGER.warning(
+            'release committish reconcile failed for project %s',
+            project_id,
+            exc_info=True,
+        )
+        return
+    if healed:
+        LOGGER.info(
+            'commit-sync healed the committish of %d release(s) for '
+            'project %s',
+            healed,
+            project_id,
+        )
+
+
 async def _backfill_release_notes(
     db: graph.Graph, org_slug: str, project_id: str
 ) -> None:

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/endpoints/agent_tasks.py

@@ -1123,6 +1123,49 @@ async def cancel_agent_task(
     return await _set_control(store, org_id, short_id, 'cancel', auth)
 
 
+@agent_tasks_router.delete('/{short_id}', status_code=204)
+async def delete_agent_task(
+    org_id: OrgId,
+    short_id: str,
+    store: agent_tasks.Store,
+    auth: typing.Annotated[
+        permissions.AuthContext,
+        fastapi.Depends(permissions.require_permission('agent_task:delete')),
+    ],
+) -> None:
+    """Delete a closed task, with its events and relations.
+
+    The secret audit and the usage records of the task stay.
+
+    Raises:
+        403: The caller has no ``agent_task:delete``, or is not a member
+            of the org.
+        404: No such task.
+        409: The task, or a task in its chain, is not closed.
+
+    """
+    try:
+        task = await store.delete(org_id, short_id.upper())
+    except agent_tasks.TaskNotFound as e:
+        raise fastapi.HTTPException(
+            status_code=404, detail=f'Task {short_id!r} not found'
+        ) from e
+    except agent_tasks.TaskOpen as e:
+        raise fastapi.HTTPException(
+            status_code=409,
+            detail=(
+                f'Task {short_id!r} or a task in its chain is not closed,'
+                ' or its log is not archived yet'
+            ),
+        ) from e
+    LOGGER.info(
+        'Agent task %s (%s) deleted by %s',
+        task['short_id'],
+        task['id'],
+        _actor(auth).id,
+    )
+
+
 @agent_tasks_router.post(
     '/{short_id}/reassign', response_model=AgentTaskResponse
 )

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/endpoints/agents.py

@@ -16,7 +16,8 @@ version, so the system prompt and the model come back too.
 Each agent is its own service principal (ADR 0020): a
 ``ServiceAccount`` that is ``MEMBER_OF`` the organization, with an
 ``ACTS_AS`` edge from the agent. It is made with the agent and deleted
-with it. It has no role, so it has no permissions.
+with it. Its slug is the slugified agent name, and its membership has
+the ``developer`` role.
 
 Every route needs the caller to be a member of the organization
 (``MEMBER_OF``), because the ``agent:*`` permissions are not scoped to
@@ -32,6 +33,7 @@ import fastapi
 import nanoid
 import psycopg.errors
 import pydantic
+import slugify
 
 from imbi.api import agent_tools, harness, workflows
 from imbi.api.auth import organizations, permissions
@@ -421,13 +423,22 @@ CREATE (s:ServiceAccount {{id: {sa_id}, slug: {sa_slug},
                           display_name: {sa_display_name},
                           description: {sa_description},
                           is_active: true, created_at: {sa_created_at}}})
-CREATE (s)-[:MEMBER_OF]->(o)
+CREATE (s)-[:MEMBER_OF {{role: 'developer'}}]->(o)
 CREATE (a)-[:ACTS_AS]->(s)
 """
 
+_SA_SLUG_TAKEN_QUERY: typing.LiteralString = """
+MATCH (s:ServiceAccount {{slug: {slug}}})
+RETURN s.id AS id
+"""
+
+# A rename during concurrent lazy creation can give an agent two
+# accounts. The order makes all later calls use the same one.
 _SERVICE_ACCOUNT_QUERY: typing.LiteralString = """
 MATCH (:Agent {{id: {id}}})-[:ACTS_AS]->(s:ServiceAccount)
 RETURN s.id AS id
+ORDER BY s.created_at, s.id
+LIMIT 1
 """
 
 _ENSURE_SERVICE_ACCOUNT_QUERY: typing.LiteralString = (
@@ -456,16 +467,32 @@ def _props(raw: typing.Any) -> dict[str, typing.Any] | None:
     return typing.cast('dict[str, typing.Any]', parsed)
 
 
-def _service_account_params(agent_id: str, name: str) -> dict[str, typing.Any]:
+async def _service_account_params(
+    db: graph.Graph, agent_id: str, name: str
+) -> dict[str, typing.Any]:
     """Return the parameters of :data:`_CREATE_SERVICE_ACCOUNT`.
 
-    The slug comes from the agent id, which does not change, so two
-    requests that make the same service account collide on the unique
-    slug index.
+    The slug is the slugified agent name. Service account slugs are
+    unique across all organizations, so when another service account
+    has that slug, the agent id is added to it. The agent id is also
+    added when the name gives an empty slug, or a slug in the ``imbi-``
+    namespace of the internal service accounts. Seeding adopts an
+    existing account with an internal slug, so an agent must not have
+    one: a slug that still starts with ``imbi-`` gets an ``agent-``
+    prefix.
     """
+    slug = slugify.slugify(name)
+    if (
+        not slug
+        or slug.startswith('imbi-')
+        or await db.execute(_SA_SLUG_TAKEN_QUERY, {'slug': slug}, ['id'])
+    ):
+        slug = slugify.slugify(f'{name} {agent_id}')
+    if slug.startswith('imbi-'):
+        slug = slugify.slugify(f'agent {slug}')
     return {
         'sa_id': nanoid.generate(),
-        'sa_slug': f'agent-{agent_id}',
+        'sa_slug': slug,
         'sa_display_name': name,
         'sa_description': f'Service principal of the agent {name!r}',
         'sa_created_at': _now(),
@@ -483,18 +510,35 @@ async def ensure_service_account(
     records = await db.execute(
         _SERVICE_ACCOUNT_QUERY, {'id': agent_id}, ['id']
     )
-    if not records:
+    attempts = 3
+    while not records and attempts:
+        attempts -= 1
+        params = await _service_account_params(db, agent_id, name)
+        # Read again after the slug check. When a concurrent request
+        # made the account of this agent first, its slug looks taken,
+        # and this read finds that account. Thus the agent does not
+        # get a second account.
+        records = await db.execute(
+            _SERVICE_ACCOUNT_QUERY, {'id': agent_id}, ['id']
+        )
+        if records:
+            break
         try:
+            # Empty when the agent does not exist.
             records = await db.execute(
                 _ENSURE_SERVICE_ACCOUNT_QUERY,
-                {'id': agent_id, **_service_account_params(agent_id, name)},
+                {'id': agent_id, **params},
                 ['id'],
             )
-        except psycopg.errors.UniqueViolation:
-            # A concurrent request made it first.
-            records = await db.execute(
-                _SERVICE_ACCOUNT_QUERY, {'id': agent_id}, ['id']
-            )
+            break
+        except psycopg.errors.UniqueViolation as exc:
+            if not attempts:
+                raise fastapi.HTTPException(
+                    status_code=409,
+                    detail=f'Service account slug for {name!r} is in use',
+                ) from exc
+            # A concurrent request took the slug first. Try again.
+            continue
     if not records:
         raise fastapi.HTTPException(
             status_code=404, detail=f'Agent {name!r} not found'
@@ -1160,17 +1204,38 @@ async def create_agent(
         + _CREATE_SERVICE_ACCOUNT
         + ' RETURN a.id AS id'
     )
-    with conflict_on_unique_violation(_slug_taken_detail(snapshot.slug)):
-        records = await db.execute(
-            query,
-            {
-                **props,
-                **_service_account_params(agent_id, snapshot.name),
-                'org_slug': org_slug,
-                'team_id': team_id,
-            },
-            ['id'],
-        )
+    records: list[dict[str, typing.Any]] = []
+    for attempt in range(2):
+        try:
+            records = await db.execute(
+                query,
+                {
+                    **props,
+                    **await _service_account_params(
+                        db, agent_id, snapshot.name
+                    ),
+                    'org_slug': org_slug,
+                    'team_id': team_id,
+                },
+                ['id'],
+            )
+            break
+        except psycopg.errors.UniqueViolation as exc:
+            # A concurrent create in another org can take the service
+            # account slug first. The next attempt sees that slug as
+            # taken and adds the agent id to it.
+            if exc.diag.table_name != 'ServiceAccount':
+                raise fastapi.HTTPException(
+                    status_code=409,
+                    detail=_slug_taken_detail(snapshot.slug),
+                ) from exc
+            if attempt:
+                raise fastapi.HTTPException(
+                    status_code=409,
+                    detail=(
+                        f'Service account slug for {snapshot.name!r} is in use'
+                    ),
+                ) from exc
     if not records:
         raise fastapi.HTTPException(
             status_code=404,

{imbi_api-2.41.0 → imbi_api-2.43.0}/src/imbi/api/endpoints/harness.py

@@ -56,7 +56,6 @@ from imbi.api.secret_broker import store as secret_store
 from imbi.common import graph, models
 from imbi.common.prompts import rendering
 from imbi.common.prompts import resolve as prompt_resolve
-from imbi.plugins.github import _repos
 
 LOGGER = logging.getLogger(__name__)
 
@@ -688,7 +687,7 @@ async def _rendered_prompt(
     """Render the pinned prompt version; return it or the error.
 
     The template gets the variables that it declares among
-    ``organization``, ``agent``, ``task``, and ``project`` (slugs and
+    ``organization``, ``agent``, ``task``, and ``project_slug`` (slugs and
     the short id).
     """
     if bundle.prompt_ref is None or bundle.prompt_version is None:
@@ -705,7 +704,7 @@ async def _rendered_prompt(
             'organization': org_slug,
             'agent': bundle.agent_slug or '',
             'task': task['short_id'],
-            'project': task.get('project_slug') or '',
+            'project_slug': task.get('project_slug') or '',
         }
         rendered = await rendering.render(
             version,
@@ -746,23 +745,27 @@ async def _repositories(
     the GitHub integration verified, whatever this link says."""
     if not task.get('project_id'):
         return []
-    host = 'github.com'
+    config: dict[str, typing.Any] = {}
     if settings.github_app_binding is not None:
         provider = await store.binding_provider(
             task['organization_id'], settings.github_app_binding
         )
         if provider is not None and provider['type'] == 'github_app':
-            config: dict[str, typing.Any] = provider['config'] or {}
-            host = str(config.get('host', host))
+            config = provider['config'] or {}
     url = (await _helpers.lookup_project_links(db, task['project_id'])).get(
         _REPOSITORY_LINK
     )
-    found = None if url is None else _repos.parse_owner_repo(url, host)
-    if url is None or found is None:
+    if url is None:
         return []
-    return [
-        BundleRepository(host=host, name=f'{found[0]}/{found[1]}', url=url)
-    ]
+    try:
+        # The provider parses the link: an empty configuration is
+        # github.com.
+        found = providers.get('github_app').repository(config, url)
+    except providers.BrokerError:
+        return []
+    if found is None:
+        return []
+    return [BundleRepository(host=found[0], name=found[1], url=url)]
 
 
 async def _identity(
@@ -1806,35 +1809,40 @@ async def create_harness_child_task(
         'short_id': parent['short_id'],
         'agent_id': parent['agent_id'],
     }
-    task, created = await store.create(
-        agent_tasks.NewTask(
-            organization_id=parent['organization_id'],
-            agent_id=agent_id,
-            agent_version=agent_version,
-            prompt_version=prompt_version,
-            service_account_id=service_account_id,
-            project_id=parent['project_id'],
-            project_slug=parent['project_slug'],
-            title=data.title,
-            description=data.description,
-            origin_kind='task',
-            origin_id=origin_id,
-            origin=origin,
-            idempotency_key=data.idempotency_key,
-            owner=parent['owner'],
-            budget=budget,
-            chain_id=chain_id,
-        ),
-        agent_tasks.Actor('agent', parent['agent_id'], 'harness'),
-        {
-            'title': data.title,
-            'description': data.description,
-            'origin': origin,
-            'budget': None if budget is None else str(budget),
-            'agent_version': agent_version,
-            'prompt_version': prompt_version,
-        },
-    )
+    try:
+        task, created = await store.create(
+            agent_tasks.NewTask(
+                organization_id=parent['organization_id'],
+                agent_id=agent_id,
+                agent_version=agent_version,
+                prompt_version=prompt_version,
+                service_account_id=service_account_id,
+                project_id=parent['project_id'],
+                project_slug=parent['project_slug'],
+                title=data.title,
+                description=data.description,
+                origin_kind='task',
+                origin_id=origin_id,
+                origin=origin,
+                idempotency_key=data.idempotency_key,
+                owner=parent['owner'],
+                budget=budget,
+                chain_id=chain_id,
+            ),
+            agent_tasks.Actor('agent', parent['agent_id'], 'harness'),
+            {
+                'title': data.title,
+                'description': data.description,
+                'origin': origin,
+                'budget': None if budget is None else str(budget),
+                'agent_version': agent_version,
+                'prompt_version': prompt_version,
+            },
+        )
+    except agent_tasks.TaskClosed as e:
+        raise _conflict(
+            'task_closed', f'Task {parent["short_id"]} is closed'
+        ) from e
     if not created:
         response.status_code = 200
     return task