imbi-api 2.43.1__tar.gz → 2.45.0__tar.gz

{imbi_api-2.43.1 → imbi_api-2.45.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-api
-Version: 2.43.1
+Version: 2.45.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -19,7 +19,8 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.43.1
+Requires-Dist: idna>=3.18
+Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.45.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: limits<6,>=5

{imbi_api-2.43.1 → imbi_api-2.45.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.43.1"
+version = "2.45.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,7 +28,8 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,mcp,sentry,server]==2.43.1",
+  "idna>=3.18",
+  "imbi-common[databases,llm,mcp,sentry,server]==2.45.0",
   "jinja2",
   "jsonpatch>=1.33",
   "limits>=5,<6",

{imbi_api-2.43.1 → imbi_api-2.45.0}/src/imbi/api/agent_tools.py

@@ -1,19 +1,15 @@
 """The catalog of tools that an agent can use.
 
-The catalog has one group for each tool server:
+The catalog has one group, ``imbi``: the tools that imbi-mcp and
+imbi-assistant make from the OpenAPI document of this API. This module
+makes them in the same way, in this process, so the names are the
+same. The MCP servers in Admin > Assistant are for the assistant only.
+An agent gets other MCP servers from the plugins of its marketplaces.
 
-* ``imbi``: the tools that imbi-mcp and imbi-assistant make from the
-  OpenAPI document of this API. This module makes them in the same
-  way, in this process, so the names are the same.
-* One group for each enabled :class:`~imbi.common.models.MCPServer`.
-  The tools are listed live, with the client code of the connection
-  test. ``ignored_tools`` is applied.
-
-A server that fails gives its group with an :data:`ErrorCode` in
-``error`` and no tools. The other groups are not affected. The error
-text can show internal hosts, URLs, or parts of credentials, so it
-goes only to the log, never to the response or to the cache. The
-catalog is kept in Valkey for :data:`CACHE_TTL_SECONDS`.
+When the tools cannot be made, the group has an :data:`ErrorCode` in
+``error`` and no tools. The error text goes only to the log, never to
+the response or to the cache. The catalog is kept in Valkey for
+:data:`CACHE_TTL_SECONDS`.
 
 A tool key is ``<server slug>.<tool name>``. An agent stores its tool
 configuration by this key.
@@ -31,8 +27,6 @@ import pydantic
 from mcp import types as mcp_types
 from valkey import asyncio as valkey
 
-from imbi.api import mcp_test
-from imbi.common import graph, models
 from imbi.common import mcp as common_mcp
 
 LOGGER = logging.getLogger(__name__)
@@ -40,10 +34,6 @@ LOGGER = logging.getLogger(__name__)
 CACHE_KEY = 'imbi:agents:tool-catalog'
 CACHE_TTL_SECONDS = 300
 
-#: The limit for one MCP server, in seconds. A server with a smaller
-#: ``timeout`` uses its own value.
-SERVER_TIMEOUT_SECONDS = 10.0
-
 #: The server slug of the Imbi tools.
 IMBI_SERVER_SLUG = 'imbi'
 
@@ -51,7 +41,7 @@ IMBI_SERVER_SLUG = 'imbi'
 DESCRIPTION_LENGTH = 300
 
 Capability = typing.Literal['read', 'write', 'destructive', 'unknown']
-Transport = typing.Literal['internal', 'mcp/http']
+Transport = typing.Literal['internal']
 
 #: Why the tools of a server could not be listed. ``auth_failed`` is
 #: an HTTP 401 or 403 response. ``unreachable`` is each other failure.
@@ -151,45 +141,6 @@ def _error_code(err: BaseException) -> ErrorCode:
     return 'unreachable'
 
 
-async def _mcp_group(server: models.MCPServer) -> AgentToolGroup:
-    """List the tools of one MCP server. Never raises."""
-    group = AgentToolGroup(
-        server=AgentToolServer(
-            slug=server.slug, name=server.name, transport='mcp/http'
-        )
-    )
-    timeout_s = min(float(server.timeout), SERVER_TIMEOUT_SECONDS)
-    try:
-        async with asyncio.timeout(timeout_s):
-            tools = await mcp_test.list_tools(server, timeout_s)
-    except asyncio.CancelledError:
-        raise
-    except TimeoutError:
-        LOGGER.warning(
-            'Cannot list the tools of %r: timed out after %gs',
-            server.slug,
-            timeout_s,
-        )
-        group.error = 'timeout'
-        return group
-    except Exception as err:  # noqa: BLE001 - one server must not fail all
-        LOGGER.warning(
-            'Cannot list the tools of %r: %s', server.slug, err, exc_info=err
-        )
-        group.error = _error_code(err)
-        return group
-    ignored = set(server.ignored_tools)
-    group.tools = sorted(
-        (
-            _tool(server.slug, t.name, t.description, t.annotations)
-            for t in tools
-            if t.name not in ignored
-        ),
-        key=lambda t: t.name,
-    )
-    return group
-
-
 def _imbi_server(
     spec: dict[str, typing.Any], client: httpx.AsyncClient
 ) -> fastmcp.FastMCP[typing.Any]:
@@ -234,24 +185,15 @@ async def _imbi_group(spec: dict[str, typing.Any]) -> AgentToolGroup:
     return group
 
 
-async def build_catalog(
-    db: graph.Pool, spec: dict[str, typing.Any]
-) -> AgentToolCatalog:
-    """List every group now, at the same time."""
-    servers = await db.match(
-        models.MCPServer, {'enabled': True}, order_by='name'
-    )
-    groups = await asyncio.gather(
-        _imbi_group(spec), *(_mcp_group(server) for server in servers)
-    )
+async def build_catalog(spec: dict[str, typing.Any]) -> AgentToolCatalog:
+    """List the catalog now."""
     return AgentToolCatalog(
-        groups=list(groups),
+        groups=[await _imbi_group(spec)],
         generated_at=datetime.datetime.now(datetime.UTC),
     )
 
 
 async def get_catalog(
-    db: graph.Pool,
     client: valkey.Valkey | None,
     spec: collections.abc.Callable[[], dict[str, typing.Any]],
     *,
@@ -275,7 +217,7 @@ async def get_catalog(
                 return AgentToolCatalog.model_validate_json(cached)
             except pydantic.ValidationError:
                 LOGGER.debug('discarding malformed tool catalog cache entry')
-    catalog = await build_catalog(db, spec())
+    catalog = await build_catalog(spec())
     if client is not None:
         try:
             await client.set(

{imbi_api-2.43.1 → imbi_api-2.45.0}/src/imbi/api/auth/internal_services.py

@@ -9,9 +9,9 @@ patch projects and record releases. Neither is created by hand any more:
 existing install up to date. ``imbi-workflows`` calls imbi-api as its
 own account for the deploy and rollback steps of a workflow (ADR 0021).
 
-imbi-assistant, imbi-mcp, and imbi-slackbot deliberately have no entry
-here. Each forwards the *caller's* token to imbi-api rather than acting
-as itself, so an account for them would carry privileges nothing uses.
+imbi-assistant and imbi-slackbot forward the *caller's* token for
+their tool calls. Their own accounts only get the token of their AI
+Provider (WIF plan 4.6, ``ai_provider:token``). imbi-mcp has no entry.
 
 Credentials come from the environment when it supplies them, so a
 deployment whose secret already lives in a Helm values file or an
@@ -56,6 +56,10 @@ class InternalService(typing.NamedTuple):
     #: ``secret_var``.
     client_id_var: str | None
     secret_var: str
+    #: Skip this service, with a warning, when its role is not seeded.
+    #: Set for services added after release: an upgrade that has not
+    #: run ``setup-permissions`` yet must not stop the existing ones.
+    optional: bool = False
 
 
 INTERNAL_SERVICES: tuple[InternalService, ...] = (
@@ -91,6 +95,26 @@ INTERNAL_SERVICES: tuple[InternalService, ...] = (
         client_id_var='IMBI_WORKFLOWS_SA_CLIENT_ID',
         secret_var='IMBI_WORKFLOWS_SA_CLIENT_SECRET',
     ),
+    InternalService(
+        slug='imbi-assistant',
+        display_name='Imbi Assistant',
+        description='Gets the token of its AI provider (WIF plan 4.6)',
+        role_slug='imbi-assistant',
+        credential='api_key',
+        client_id_var=None,
+        secret_var='IMBI_ASSISTANT_API_TOKEN',
+        optional=True,
+    ),
+    InternalService(
+        slug='imbi-slackbot',
+        display_name='Imbi Slackbot',
+        description='Gets the token of its AI provider (WIF plan 4.6)',
+        role_slug='imbi-slackbot',
+        credential='api_key',
+        client_id_var=None,
+        secret_var='IMBI_SLACKBOT_API_TOKEN',
+        optional=True,
+    ),
 )
 
 
@@ -136,7 +160,8 @@ async def seed_internal_services(
 
     Returns:
         One :class:`SeededService` per :data:`INTERNAL_SERVICES`, in
-        declaration order.
+        declaration order, less any optional service whose role is
+        missing.
 
     Raises:
         SeedError: A role or the organization is missing, or a supplied
@@ -146,6 +171,14 @@ async def seed_internal_services(
     env = os.environ if environ is None else environ
     results: list[SeededService] = []
     for service in INTERNAL_SERVICES:
+        if service.optional and not await _role_exists(db, service):
+            LOGGER.warning(
+                'Skipping service account %s: role %s not found. '
+                'Run imbi-api setup-permissions to seed it.',
+                service.slug,
+                service.role_slug,
+            )
+            continue
         created = await _ensure_account(db, service, org_slug)
         if service.credential == 'client_credential':
             outcome, emit = await _ensure_client_credential(db, service, env)
@@ -161,6 +194,17 @@ async def seed_internal_services(
     return results
 
 
+async def _role_exists(db: graph.Graph, service: InternalService) -> bool:
+    """Report whether the role of *service* is seeded."""
+    return bool(
+        await db.execute(
+            'MATCH (r:Role {{slug: {role_slug}}}) RETURN r.slug AS slug',
+            {'role_slug': service.role_slug},
+            ['slug'],
+        )
+    )
+
+
 async def _ensure_account(
     db: graph.Graph,
     service: InternalService,

{imbi_api-2.43.1 → imbi_api-2.45.0}/src/imbi/api/auth/seed.py

@@ -148,6 +148,12 @@ STANDARD_PERMISSIONS: list[tuple[str, str, str, str]] = [
         'credentials',
         'Set or remove AI provider credentials',
     ),
+    (
+        'ai_provider:token',
+        'ai_provider',
+        'token',
+        'Get the AI provider token of the calling service',
+    ),
     # Prompt CMS. ``promote`` is separate from ``update``: moving a
     # label changes what every consumer of that label runs, without
     # any change to a prompt body.
@@ -1046,6 +1052,24 @@ DEFAULT_ROLES: list[tuple[str, str, str, int, list[str], bool]] = [
         ],
         False,
     ),
+    (
+        'imbi-assistant',
+        'Imbi Assistant',
+        'Service role for imbi-assistant: get the token of its AI '
+        'provider (WIF plan 4.6)',
+        900,
+        ['ai_provider:token'],
+        False,
+    ),
+    (
+        'imbi-slackbot',
+        'Imbi Slackbot',
+        'Service role for imbi-slackbot: get the token of its AI '
+        'provider (WIF plan 4.6)',
+        900,
+        ['ai_provider:token'],
+        False,
+    ),
 ]
 
 # Invariant: exactly one seeded role is the auto-assignment target so

{imbi_api-2.43.1 → imbi_api-2.45.0}/src/imbi/api/component_facts.py

@@ -78,7 +78,7 @@ _BATCHES_BY_PROJECT = (
     'SELECT release_id,'
     "       argMax(batch_id, (source = 'ingest', recorded_at)) AS batch_id"
     '  FROM imbi.release_component_batches'
-    ' WHERE project_id IN {project_ids:Array(String)}'
+    ' WHERE project_id IN (SELECT project_id FROM project_ids)'
     ' GROUP BY release_id'
 )
 
@@ -101,9 +101,9 @@ _JOIN = (
 def _by_project(select: str, where: str = '') -> str:
     """Compose a project-scoped read against the winning batches."""
     return (
-        f'{select} FROM imbi.release_components AS c'
+        f'{select} FROM imbi.release_components AS c'  # noqa: S608
         + _JOIN.format(batches=_BATCHES_BY_PROJECT)
-        + ' WHERE c.project_id IN {project_ids:Array(String)}'
+        + ' WHERE c.project_id IN (SELECT project_id FROM project_ids)'
         + where
     )
 
@@ -148,13 +148,14 @@ async def component_ids_in_org(
     if not project_ids or component_ids == []:
         return set()
     where = ''
-    params: dict[str, typing.Any] = {'project_ids': project_ids}
+    params: dict[str, typing.Any] = {}
     if component_ids is not None:
         where = ' AND c.component_id IN {component_ids:Array(String)}'
         params['component_ids'] = component_ids
     rows = await clickhouse.query(
         _by_project('SELECT DISTINCT c.component_id AS component_id', where),
         params,
+        project_ids=project_ids,
     )
     return {str(row['component_id']) for row in rows}
 
@@ -172,7 +173,8 @@ async def component_in_org(project_ids: list[str], component_id: str) -> bool:
             'SELECT 1 AS hit',
             ' AND c.component_id = {component_id:String} LIMIT 1',
         ),
-        {'project_ids': project_ids, 'component_id': component_id},
+        {'component_id': component_id},
+        project_ids=project_ids,
     )
     return bool(rows)
 
@@ -200,10 +202,10 @@ async def component_release_in_org(
             ' LIMIT 1',
         ),
         {
-            'project_ids': project_ids,
             'component_id': component_id,
             'component_release_id': component_release_id,
         },
+        project_ids=project_ids,
     )
     return bool(rows)
 
@@ -227,7 +229,8 @@ async def search_counts(
             ' AND c.component_id IN {component_ids:Array(String)}'
             ' GROUP BY c.component_id',
         ),
-        {'project_ids': project_ids, 'component_ids': component_ids},
+        {'component_ids': component_ids},
+        project_ids=project_ids,
     )
     return {
         str(row['component_id']): (
@@ -255,7 +258,7 @@ async def ecosystem_totals(project_ids: list[str]) -> dict[str, int]:
             ' uniqExact(c.component_id) AS total',
             " AND c.ecosystem != '' GROUP BY c.ecosystem",
         ),
-        {'project_ids': project_ids},
+        project_ids=project_ids,
     )
     return {str(row['ecosystem']): int(row['total']) for row in rows}
 

{imbi_api-2.43.1 → imbi_api-2.45.0}/src/imbi/api/endpoints/agent_platform.py

@@ -127,10 +127,17 @@ async def put_agent_platform_config(
 
     Raises:
         409: A concurrent write took the version.
-        422: An allowed marketplace is not registered, or a default
-            plugin is not in an allowed marketplace's catalog.
+        422: An allowed marketplace is not registered, a default
+            plugin is not in an allowed marketplace's catalog, or the
+            model upstream URL is ``http://`` without
+            ``allow_insecure_http``.
 
     """
+    if data.model_upstream.insecure():
+        raise _unprocessable(
+            'model_upstream.base_url must use https:// unless '
+            'allow_insecure_http is true'
+        )
     found = {row['slug']: row for row in await store.marketplaces(org_id)}
     missing = sorted(set(data.allowed_marketplaces) - set(found))
     if missing:

{imbi_api-2.43.1 → imbi_api-2.45.0}/src/imbi/api/endpoints/agents.py

@@ -468,7 +468,7 @@ def _props(raw: typing.Any) -> dict[str, typing.Any] | None:
 
 
 async def _service_account_params(
-    db: graph.Graph, agent_id: str, name: str
+    execute: graph.CypherExecute, agent_id: str, name: str
 ) -> dict[str, typing.Any]:
     """Return the parameters of :data:`_CREATE_SERVICE_ACCOUNT`.
 
@@ -485,7 +485,7 @@ async def _service_account_params(
     if (
         not slug
         or slug.startswith('imbi-')
-        or await db.execute(_SA_SLUG_TAKEN_QUERY, {'slug': slug}, ['id'])
+        or await execute(_SA_SLUG_TAKEN_QUERY, {'slug': slug}, ['id'])
     ):
         slug = slugify.slugify(f'{name} {agent_id}')
     if slug.startswith('imbi-'):
@@ -506,39 +506,51 @@ async def ensure_service_account(
 
     Make the service account when the agent has none. Agents made before
     service accounts existed get one here, so no backfill is necessary.
+
+    The read, the slug check, and the create run in one transaction
+    under an advisory lock on the agent id. Thus two concurrent calls
+    for one agent cannot both make an account: the second call waits,
+    then reads the account of the first.
     """
-    records = await db.execute(
-        _SERVICE_ACCOUNT_QUERY, {'id': agent_id}, ['id']
-    )
-    attempts = 3
-    while not records and attempts:
-        attempts -= 1
-        params = await _service_account_params(db, agent_id, name)
-        # Read again after the slug check. When a concurrent request
-        # made the account of this agent first, its slug looks taken,
-        # and this read finds that account. Thus the agent does not
-        # get a second account.
-        records = await db.execute(
+
+    async def ensure(
+        execute: graph.CypherExecute,
+    ) -> list[dict[str, typing.Any]]:
+        """Read or make the service account under the lock.
+
+        Read again first: a concurrent call can have made the account
+        after the fast path read.
+        """
+        records = await execute(
             _SERVICE_ACCOUNT_QUERY, {'id': agent_id}, ['id']
         )
         if records:
-            break
-        try:
-            # Empty when the agent does not exist.
-            records = await db.execute(
-                _ENSURE_SERVICE_ACCOUNT_QUERY,
-                {'id': agent_id, **params},
-                ['id'],
-            )
-            break
-        except psycopg.errors.UniqueViolation as exc:
-            if not attempts:
-                raise fastapi.HTTPException(
-                    status_code=409,
-                    detail=f'Service account slug for {name!r} is in use',
-                ) from exc
-            # A concurrent request took the slug first. Try again.
-            continue
+            return records
+        params = await _service_account_params(execute, agent_id, name)
+        # Empty when the agent does not exist.
+        return await execute(
+            _ENSURE_SERVICE_ACCOUNT_QUERY, {'id': agent_id, **params}, ['id']
+        )
+
+    # Fast path without the lock: most agents have an account.
+    records = await db.execute(
+        _SERVICE_ACCOUNT_QUERY, {'id': agent_id}, ['id']
+    )
+    if not records:
+        for attempt in range(3):
+            try:
+                records = await db.locked(
+                    f'agent-service-account:{agent_id}', ensure
+                )
+                break
+            except psycopg.errors.UniqueViolation as exc:
+                # A concurrent request for another agent took the slug
+                # first. Try again.
+                if attempt == 2:
+                    raise fastapi.HTTPException(
+                        status_code=409,
+                        detail=f'Service account slug for {name!r} is in use',
+                    ) from exc
     if not records:
         raise fastapi.HTTPException(
             status_code=404, detail=f'Agent {name!r} not found'
@@ -893,6 +905,8 @@ async def _check_platform(
             platform.check_reference(reference)
         if settings.github_app_binding is not None:
             platform.check_reference(settings.github_app_binding, field=False)
+        if settings.model_key_ref is not None:
+            platform.check_reference(settings.model_key_ref)
     except ValueError as err:
         raise _unprocessable(str(err)) from err
     binding = settings.github_app_binding
@@ -1212,7 +1226,7 @@ async def create_agent(
                 {
                     **props,
                     **await _service_account_params(
-                        db, agent_id, snapshot.name
+                        db.execute, agent_id, snapshot.name
                     ),
                     'org_slug': org_slug,
                     'team_id': team_id,
@@ -1293,7 +1307,6 @@ async def list_agents(
 async def get_agent_tool_catalog(
     org_slug: str,
     request: fastapi.Request,
-    db: graph.Pool,
     valkey_client: OptionalValkeyClient,
     auth: typing.Annotated[
         permissions.AuthContext,
@@ -1301,15 +1314,13 @@ async def get_agent_tool_catalog(
     ],
     refresh: bool = False,
 ) -> agent_tools.AgentToolCatalog:
-    """List the tools that an agent can use, in groups by server.
+    """List the Imbi tools that an agent can use.
 
-    The groups are the Imbi tools and the tools of each enabled MCP
-    server. A server that fails gives its group with an error code in
-    ``error`` and no tools. The error text goes only to the log. The
-    catalog is kept for five minutes; ``refresh=true`` lists it again.
-    A refresh connects to each MCP server, so it needs
-    ``agent:write``. The catalog is the same in each organization,
-    because MCP servers are global.
+    The catalog has one group, the Imbi tools. When they cannot be
+    made, the group has an error code in ``error`` and no tools. The
+    error text goes only to the log. The catalog is kept for five
+    minutes; ``refresh=true`` lists it again and needs
+    ``agent:write``. The catalog is the same in each organization.
 
     Raises:
         403: ``refresh=true`` and the caller does not have
@@ -1323,7 +1334,7 @@ async def get_agent_tool_catalog(
             detail='Permission denied: refresh needs agent:write',
         )
     return await agent_tools.get_catalog(
-        db, valkey_client, request.app.openapi, refresh=refresh
+        valkey_client, request.app.openapi, refresh=refresh
     )