language-model-common 2.0.76__tar.gz → 2.0.78__tar.gz

{language_model_common-2.0.76/language_model_common.egg-info → language_model_common-2.0.78}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: language-model-common
-Version: 2.0.76
+Version: 2.0.78
 Summary: Provides the underlying framework to enhance langchain and add loading configurations
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
 License: Apache-2.0
@@ -21,7 +21,7 @@ Requires-Dist: openai>=2.5.0
 Requires-Dist: langchain-openai>=1.1.6
 Requires-Dist: langgraph>=1.0.0
 Requires-Dist: pydantic<3.0.0,>=2.0
-Requires-Dist: mcp>=1.11.0
+Requires-Dist: mcp>=1.27.2
 Requires-Dist: langgraph-checkpoint>=3.0.0
 Requires-Dist: langgraph-checkpoint-mongodb>=0.3.1
 Requires-Dist: langgraph-store-mongodb>=0.1.0
@@ -35,6 +35,7 @@ Requires-Dist: fsspec>=2026.2.0
 Requires-Dist: authlib>=1.6.5
 Requires-Dist: langchain-google-genai>=4.1.3
 Requires-Dist: py-key-value-aio>=0.4.4
+Requires-Dist: PyJWT[crypto]>=2.8.0
 Dynamic: license-file
 
 # language-model-common

language_model_common-2.0.78/VERSION

@@ -0,0 +1 @@
+2.0.78

{language_model_common-2.0.76 → language_model_common-2.0.78/language_model_common.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: language-model-common
-Version: 2.0.76
+Version: 2.0.78
 Summary: Provides the underlying framework to enhance langchain and add loading configurations
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
 License: Apache-2.0
@@ -21,7 +21,7 @@ Requires-Dist: openai>=2.5.0
 Requires-Dist: langchain-openai>=1.1.6
 Requires-Dist: langgraph>=1.0.0
 Requires-Dist: pydantic<3.0.0,>=2.0
-Requires-Dist: mcp>=1.11.0
+Requires-Dist: mcp>=1.27.2
 Requires-Dist: langgraph-checkpoint>=3.0.0
 Requires-Dist: langgraph-checkpoint-mongodb>=0.3.1
 Requires-Dist: langgraph-store-mongodb>=0.1.0
@@ -35,6 +35,7 @@ Requires-Dist: fsspec>=2026.2.0
 Requires-Dist: authlib>=1.6.5
 Requires-Dist: langchain-google-genai>=4.1.3
 Requires-Dist: py-key-value-aio>=0.4.4
+Requires-Dist: PyJWT[crypto]>=2.8.0
 Dynamic: license-file
 
 # language-model-common

{language_model_common-2.0.76 → language_model_common-2.0.78}/language_model_common.egg-info/SOURCES.txt

@@ -64,6 +64,8 @@ languagemodelcommon/file_managers/file_manager.py
 languagemodelcommon/file_managers/file_manager_factory.py
 languagemodelcommon/file_managers/file_writer.py
 languagemodelcommon/file_managers/local_file_manager.py
+languagemodelcommon/github/__init__.py
+languagemodelcommon/github/token_provider.py
 languagemodelcommon/graph/__init__.py
 languagemodelcommon/graph/graph_builder.py
 languagemodelcommon/history/__init__.py
@@ -128,6 +130,12 @@ languagemodelcommon/ocr/ocr_extractor.py
 languagemodelcommon/ocr/ocr_extractor_factory.py
 languagemodelcommon/persistence/__init__.py
 languagemodelcommon/persistence/persistence_factory.py
+languagemodelcommon/pipeline/__init__.py
+languagemodelcommon/pipeline/context.py
+languagemodelcommon/pipeline/pipeline.py
+languagemodelcommon/pipeline/step.py
+languagemodelcommon/pipeline/output/__init__.py
+languagemodelcommon/pipeline/steps/__init__.py
 languagemodelcommon/schema/__init__.py
 languagemodelcommon/schema/openai/__init__.py
 languagemodelcommon/schema/openai/completions.py
@@ -178,6 +186,9 @@ languagemodelcommon/utilities/message_preprocessing/message_preprocessor.py
 languagemodelcommon/utilities/openai/__init__.py
 languagemodelcommon/utilities/openai/responses_api_converter.py
 languagemodelcommon/utilities/security/__init__.py
+languagemodelcommon/utilities/security/normalize.py
+languagemodelcommon/utilities/security/off_topic_detector.py
+languagemodelcommon/utilities/security/prompt_extraction_detector.py
 languagemodelcommon/utilities/security/prompt_sanitizer.py
 languagemodelcommon/utilities/slash_command/__init__.py
 languagemodelcommon/utilities/slash_command/slash_command_handler.py

{language_model_common-2.0.76 → language_model_common-2.0.78}/language_model_common.egg-info/requires.txt

@@ -8,7 +8,7 @@ openai>=2.5.0
 langchain-openai>=1.1.6
 langgraph>=1.0.0
 pydantic<3.0.0,>=2.0
-mcp>=1.11.0
+mcp>=1.27.2
 langgraph-checkpoint>=3.0.0
 langgraph-checkpoint-mongodb>=0.3.1
 langgraph-store-mongodb>=0.1.0
@@ -22,3 +22,4 @@ fsspec>=2026.2.0
 authlib>=1.6.5
 langchain-google-genai>=4.1.3
 py-key-value-aio>=0.4.4
+PyJWT[crypto]>=2.8.0

{language_model_common-2.0.76 → language_model_common-2.0.78}/languagemodelcommon/configs/config_reader/github_directory_helper.py

@@ -16,6 +16,7 @@ from urllib.parse import unquote, urlsplit, urlunsplit
 
 from key_value.aio.protocols.key_value import AsyncKeyValueProtocol
 
+from languagemodelcommon.github.token_provider import GitHubTokenProvider
 from languagemodelcommon.utilities.environment.language_model_common_environment_variables import (
     LanguageModelCommonEnvironmentVariables,
 )
@@ -43,9 +44,11 @@ class GitHubDirectoryHelper:
         *,
         environment_variables: LanguageModelCommonEnvironmentVariables | None = None,
         store: AsyncKeyValueProtocol | None = None,
+        token_provider: GitHubTokenProvider | None = None,
     ) -> None:
         self._environment_variables = environment_variables
         self._store = store
+        self._token_provider = token_provider
 
     # ------------------------------------------------------------------
     # Pure / static helpers — no env vars or instance state needed
@@ -164,7 +167,14 @@ class GitHubDirectoryHelper:
 
         cache_dir.mkdir(parents=True, exist_ok=True)
 
-        github_token = env.github_token if env else os.environ.get("GITHUB_TOKEN")
+        github_token: str | None = None
+        if self._token_provider is not None:
+            github_token = await self._token_provider.get_token()
+        elif env:
+            github_token = env.github_token
+        else:
+            github_token = os.environ.get("GITHUB_TOKEN")
+
         downloader = GithubDirectoryDownloader()
         result = await downloader.download(
             source_uri=github_uri,

{language_model_common-2.0.76 → language_model_common-2.0.78}/languagemodelcommon/container/container_factory.py

@@ -1,3 +1,4 @@
+import logging
 from typing import Any
 
 from simple_container.container.simple_container import SimpleContainer
@@ -8,6 +9,11 @@ from languagemodelcommon.configs.config_reader.github_directory_helper import (
     GitHubDirectoryHelper,
 )
 from languagemodelcommon.configs.config_reader.mcp_json_fetcher import McpJsonFetcher
+from languagemodelcommon.github.token_provider import (
+    GitHubAppTokenProvider,
+    GitHubTokenProvider,
+    StaticTokenProvider,
+)
 from languagemodelcommon.configs.prompt_library.prompt_library_manager import (
     PromptLibraryManager,
 )
@@ -50,6 +56,34 @@ from languagemodelcommon.utilities.tool_display_name_mapper import (
     ToolDisplayNameMapper,
 )
 
+_logger = logging.getLogger(__name__)
+
+
+def _build_github_token_provider(
+    *,
+    env: LanguageModelCommonEnvironmentVariables,
+) -> GitHubTokenProvider | None:
+    """Build GitHub token provider: App credentials > static PAT > None."""
+    app_id = env.github_app_id
+    private_key = env.github_app_private_key
+    installation_id = env.github_app_installation_id
+
+    if app_id and private_key and installation_id:
+        _logger.info("GitHub authentication: using GitHub App (app_id=%s)", app_id)
+        return GitHubAppTokenProvider(
+            app_id=app_id,
+            private_key=private_key,
+            installation_id=installation_id,
+        )
+
+    token = env.github_token
+    if token:
+        _logger.info("GitHub authentication: using static token (PAT)")
+        return StaticTokenProvider(token=token)
+
+    _logger.info("GitHub authentication: not configured")
+    return None
+
 
 class LanguageModelCommonContainerFactory:
     @staticmethod
@@ -82,6 +116,12 @@ class LanguageModelCommonContainerFactory:
                 ).model_config_cache_collection_name,
             ),
         )
+        container.singleton(
+            service_type=GitHubTokenProvider,
+            factory=lambda c: _build_github_token_provider(
+                env=c.resolve(LanguageModelCommonEnvironmentVariables),
+            ),
+        )
         container.singleton(
             service_type=GitHubDirectoryHelper,
             factory=lambda c: GitHubDirectoryHelper(
@@ -89,6 +129,7 @@ class LanguageModelCommonContainerFactory:
                     LanguageModelCommonEnvironmentVariables
                 ),
                 store=c.resolve(KeyValueBaseStore),
+                token_provider=c.resolve(GitHubTokenProvider),
             ),
         )
 

language_model_common-2.0.78/languagemodelcommon/github/token_provider.py

@@ -0,0 +1,119 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+import time
+from datetime import datetime
+from typing import Protocol, runtime_checkable
+
+import httpx
+import jwt
+
+logger = logging.getLogger(__name__)
+
+_GITHUB_API_BASE = "https://api.github.com"
+_TOKEN_EXPIRY_BUFFER_SECONDS = 300
+
+
+@runtime_checkable
+class GitHubTokenProvider(Protocol):
+    """Protocol for providing GitHub authentication tokens."""
+
+    async def get_token(self) -> str: ...
+
+    def get_token_sync(self) -> str: ...
+
+
+class StaticTokenProvider:
+    """Returns a pre-configured token (PAT or pre-minted installation token)."""
+
+    def __init__(self, *, token: str) -> None:
+        self._token = token
+
+    async def get_token(self) -> str:
+        return self._token
+
+    def get_token_sync(self) -> str:
+        return self._token
+
+
+class GitHubAppTokenProvider:
+    """Mints short-lived installation tokens via GitHub App credentials.
+
+    Tokens are cached and automatically refreshed 5 minutes before expiry.
+    The async path is serialized via asyncio.Lock to prevent duplicate mints.
+    """
+
+    def __init__(
+        self,
+        *,
+        app_id: str,
+        private_key: str,
+        installation_id: str,
+    ) -> None:
+        self._app_id = app_id
+        self._private_key = private_key
+        self._installation_id = installation_id
+        self._cached_token: str | None = None
+        self._cached_expires_at: float = 0.0
+        self._lock = asyncio.Lock()
+
+    async def get_token(self) -> str:
+        async with self._lock:
+            if self._is_token_valid():
+                return self._cached_token  # type: ignore[return-value]
+            return await self._mint_token()
+
+    def get_token_sync(self) -> str:
+        if self._is_token_valid():
+            return self._cached_token  # type: ignore[return-value]
+        return self._mint_token_sync()
+
+    def _is_token_valid(self) -> bool:
+        return (
+            self._cached_token is not None
+            and time.time() < self._cached_expires_at - _TOKEN_EXPIRY_BUFFER_SECONDS
+        )
+
+    def _build_jwt(self) -> str:
+        now = int(time.time())
+        payload = {
+            "iat": now - 60,
+            "exp": now + 600,
+            "iss": self._app_id,
+        }
+        return jwt.encode(payload, self._private_key, algorithm="RS256")
+
+    def _request_url(self) -> str:
+        return f"{_GITHUB_API_BASE}/app/installations/{self._installation_id}/access_tokens"
+
+    def _request_headers(self) -> dict[str, str]:
+        return {
+            "Authorization": f"Bearer {self._build_jwt()}",
+            "Accept": "application/vnd.github+json",
+        }
+
+    def _cache_response(self, *, data: dict[str, str]) -> str:
+        self._cached_token = data["token"]
+        self._cached_expires_at = datetime.fromisoformat(
+            data["expires_at"].replace("Z", "+00:00")
+        ).timestamp()
+        logger.debug(
+            "Minted new GitHub App installation token (expires %s)",
+            data["expires_at"],
+        )
+        return self._cached_token
+
+    async def _mint_token(self) -> str:
+        async with httpx.AsyncClient() as client:
+            response = await client.post(
+                self._request_url(), headers=self._request_headers()
+            )
+        response.raise_for_status()
+        return self._cache_response(data=response.json())
+
+    def _mint_token_sync(self) -> str:
+        with httpx.Client() as client:
+            response = client.post(self._request_url(), headers=self._request_headers())
+        response.raise_for_status()
+        return self._cache_response(data=response.json())

language_model_common-2.0.78/languagemodelcommon/pipeline/context.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, AsyncGenerator
+
+from langchain_core.messages import AnyMessage
+from langchain_core.runnables import RunnableConfig
+from langgraph.graph.state import CompiledStateGraph
+
+from languagemodelcommon.state.messages_state import MyMessagesState
+from languagemodelcommon.structures.openai.request.chat_request_wrapper import (
+    ChatRequestWrapper,
+)
+from languagemodelcommon.utilities.request_information import RequestInformation
+
+
+@dataclass
+class PipelineContext:
+    """Shared mutable state that flows through all pipeline steps."""
+
+    chat_request_wrapper: ChatRequestWrapper
+    request: Any = None
+
+    request_information: RequestInformation | None = None
+
+    messages: list[AnyMessage] = field(default_factory=list)
+    prior_messages: list[AnyMessage] = field(default_factory=list)
+    previous_context: dict[str, Any] | None = None
+
+    state: MyMessagesState | None = None
+    config: RunnableConfig | None = None
+    graph: CompiledStateGraph[MyMessagesState] | None = None
+
+    content_stream: AsyncGenerator[str, None] | None = None
+
+    accumulated_content: str = ""
+    response_messages: list[AnyMessage] = field(default_factory=list)
+
+    conversation_id: str = ""
+    user_id: str = ""

language_model_common-2.0.78/languagemodelcommon/pipeline/pipeline.py

@@ -0,0 +1,100 @@
+from __future__ import annotations
+
+import logging
+from typing import Any, AsyncGenerator, Protocol
+
+from languagemodelcommon.pipeline.context import PipelineContext
+from languagemodelcommon.pipeline.step import PipelineStep
+
+logger = logging.getLogger(__name__)
+
+
+class OutputStep(Protocol):
+    def format_response(self, *, context: PipelineContext) -> Any: ...
+    def stream_response(
+        self, *, context: PipelineContext
+    ) -> AsyncGenerator[str, None]: ...
+    def format_error(self, *, context: PipelineContext, error: Exception) -> Any: ...
+
+
+class Pipeline:
+    """Runs an ordered list of steps against a shared PipelineContext."""
+
+    def __init__(
+        self,
+        *,
+        pre_execution_steps: list[PipelineStep],
+        execution_step: PipelineStep,
+        post_execution_steps: list[PipelineStep],
+        output_step: OutputStep,
+    ) -> None:
+        self._pre_execution_steps = pre_execution_steps
+        self._execution_step = execution_step
+        self._post_execution_steps = post_execution_steps
+        self._output_step = output_step
+
+    async def run_non_streaming(self, *, context: PipelineContext) -> Any:
+        try:
+            for step in self._pre_execution_steps:
+                await step.run(context=context)
+            await self._execution_step.run(context=context)
+            await self._drain_stream(context=context)
+            for step in self._post_execution_steps:
+                await step.run(context=context)
+            return self._output_step.format_response(context=context)
+        except Exception as e:
+            return self._output_step.format_error(context=context, error=e)
+
+    @staticmethod
+    async def _drain_stream(*, context: PipelineContext) -> None:
+        """Consume content_stream fully, populating accumulated_content and response_messages."""
+        if context.content_stream is None:
+            return
+        import json as _json
+
+        from langchain_core.messages import AIMessage
+
+        async for chunk in context.content_stream:
+            for line in chunk.strip().splitlines():
+                if not line.startswith("data: "):
+                    continue
+                payload = line[6:]
+                if payload == "[DONE]":
+                    continue
+                try:
+                    event = _json.loads(payload)
+                    if "delta" in event and isinstance(event["delta"], str):
+                        context.accumulated_content += event["delta"]
+                    elif (
+                        "choices" in event
+                        and event["choices"]
+                        and "delta" in event["choices"][0]
+                    ):
+                        delta_content = event["choices"][0]["delta"].get("content", "")
+                        if delta_content:
+                            context.accumulated_content += delta_content
+                except (ValueError, KeyError, IndexError):
+                    # Non-content SSE events (tool calls, metadata) don't match
+                    # either delta format — safe to skip during stream draining.
+                    logger.debug(
+                        "Skipping non-content SSE event during drain: %s", payload[:100]
+                    )
+        if context.accumulated_content:
+            context.response_messages = [AIMessage(content=context.accumulated_content)]
+
+    async def run_streaming(
+        self, *, context: PipelineContext
+    ) -> AsyncGenerator[Any, None]:
+        try:
+            for step in self._pre_execution_steps:
+                await step.run(context=context)
+            await self._execution_step.run(context=context)
+        except Exception as e:
+            yield self._output_step.format_error(context=context, error=e)
+            return
+
+        async for chunk in self._output_step.stream_response(context=context):
+            yield chunk
+
+        for step in self._post_execution_steps:
+            await step.run(context=context)

language_model_common-2.0.78/languagemodelcommon/pipeline/step.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+from typing import Protocol
+
+from languagemodelcommon.pipeline.context import PipelineContext
+
+
+class PipelineStep(Protocol):
+    """Protocol for a single step in the request processing pipeline."""
+
+    async def run(self, *, context: PipelineContext) -> None: ...

{language_model_common-2.0.76 → language_model_common-2.0.78}/languagemodelcommon/utilities/environment/language_model_common_environment_variables.py

@@ -359,6 +359,18 @@ class LanguageModelCommonEnvironmentVariables(
     def github_token(self) -> Optional[str]:
         return os.environ.get("GITHUB_TOKEN")
 
+    @property
+    def github_app_id(self) -> Optional[str]:
+        return os.environ.get("GITHUB_APP_ID")
+
+    @property
+    def github_app_private_key(self) -> Optional[str]:
+        return os.environ.get("GITHUB_APP_PRIVATE_KEY")
+
+    @property
+    def github_app_installation_id(self) -> Optional[str]:
+        return os.environ.get("GITHUB_APP_INSTALLATION_ID")
+
     @property
     def plugins_mcp_server(self) -> Optional[str]:
         """URL of the MCP server that returns plugin MCP configs.

language_model_common-2.0.78/languagemodelcommon/utilities/security/normalize.py

@@ -0,0 +1,100 @@
+"""Input normalization for security detection.
+
+Centralizes Unicode normalization, zero-width stripping, and homoglyph
+mapping so both prompt_extraction_detector and off_topic_detector apply
+consistent pre-processing before regex matching.
+"""
+
+import re
+import unicodedata
+
+REFUSAL_MESSAGE = (
+    "I'm here to help you with your medical records. What can I help you with?"
+)
+
+
+_ZERO_WIDTH_RE = re.compile(
+    "[​‌‍‎‏⁠⁡⁢⁣⁤­]"  # nosec B613
+)
+
+# Cyrillic/Greek characters that visually resemble Latin letters.
+# Covers the practical attack surface for trigger words in our patterns.
+_HOMOGLYPH_MAP: dict[str, str] = {
+    # Cyrillic -> Latin
+    "А": "A",  # А
+    "В": "B",  # В
+    "С": "C",  # С
+    "Е": "E",  # Е
+    "Н": "H",  # Н
+    "К": "K",  # К
+    "М": "M",  # М
+    "О": "O",  # О
+    "Р": "P",  # Р
+    "Т": "T",  # Т
+    "Х": "X",  # Х
+    "а": "a",  # а
+    "е": "e",  # е
+    "о": "o",  # о
+    "р": "p",  # р
+    "с": "c",  # с
+    "у": "y",  # у
+    "х": "x",  # х
+    "ѕ": "s",  # ѕ
+    "і": "i",  # і
+    "ј": "j",  # ј
+    "һ": "h",  # һ
+    "ӏ": "l",  # ӏ
+    # Greek -> Latin
+    "Α": "A",  # Α
+    "Β": "B",  # Β
+    "Ε": "E",  # Ε
+    "Η": "H",  # Η
+    "Ι": "I",  # Ι
+    "Κ": "K",  # Κ
+    "Μ": "M",  # Μ
+    "Ν": "N",  # Ν
+    "Ο": "O",  # Ο
+    "Ρ": "P",  # Ρ
+    "Τ": "T",  # Τ
+    "Υ": "Y",  # Υ
+    "Χ": "X",  # Χ
+    "α": "a",  # α (borderline but used in attacks)
+    "ο": "o",  # ο
+    "ρ": "p",  # ρ (lowercase rho)
+    # Fullwidth Latin -> ASCII Latin
+    # NFKC handles most of these, but belt-and-suspenders for the critical ones
+    "ａ": "a",
+    "ｂ": "b",
+    "ｃ": "c",
+    "ｄ": "d",
+    "ｅ": "e",
+    "ｉ": "i",
+    "ｌ": "l",
+    "ｍ": "m",
+    "ｎ": "n",
+    "ｏ": "o",
+    "ｐ": "p",
+    "ｒ": "r",
+    "ｓ": "s",
+    "ｔ": "t",
+    "ｕ": "u",
+    "ｙ": "y",
+}
+
+_HOMOGLYPH_TRANS = str.maketrans(_HOMOGLYPH_MAP)
+
+
+def normalize_for_detection(*, text: str) -> str:
+    """Normalize user input for security pattern matching.
+
+    Applies in order:
+    1. NFKC Unicode normalization (collapses compatibility equivalents)
+    2. Zero-width character removal
+    3. Homoglyph transliteration (Cyrillic/Greek -> Latin)
+    4. Whitespace collapse
+    """
+    result = unicodedata.normalize("NFKC", text)
+    result = _ZERO_WIDTH_RE.sub("", result)
+    result = result.translate(_HOMOGLYPH_TRANS)
+    result = re.sub(r"\s+", " ", result)
+    return result