mindroot 13.2.0__tar.gz → 13.4.0__tar.gz

{mindroot-13.2.0/src/mindroot.egg-info → mindroot-13.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mindroot
-Version: 13.2.0
+Version: 13.4.0
 Summary: MindRoot AI Agent Framework
 Requires-Python: >=3.9
 License-File: LICENSE

{mindroot-13.2.0 → mindroot-13.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mindroot"
-version = "13.2.0"
+version = "13.4.0"
 description = "MindRoot AI Agent Framework"
 requires-python = ">=3.9"
 dependencies = [

{mindroot-13.2.0 → mindroot-13.4.0}/src/mindroot/coreplugins/admin/static/js/agent-form.js

@@ -346,6 +346,7 @@ class AgentForm extends BaseEl {
     textarea {
       width: 100%;
       padding: 8px 12px;
+      box-sizing: border-box;
       background: rgba(255, 255, 255, 0.05);
       border: 1px solid rgba(255, 255, 255, 0.1);
       border-radius: 6px;
@@ -1939,39 +1940,33 @@ class AgentForm extends BaseEl {
 
           <div class="form-group commands-section">
             <details>
-              <summary>Preferred Providers</summary>
+              <summary>Recommended Plugins</summary>              <summary>Preferred Providers</summary>
               ${this.renderPreferredProviders()}
             </details>
           </div> 
 
           <div class="form-group commands-section">
-            <details>
-              <summary>Select Models</summary>
-              ${this.renderServiceModels()}
-            </details>
+            ${this.renderServiceModels()}
           </div> 
 
           <div class="form-group commands-section">
-            <details>
-              <summary>Max Tokens</summary>
-              <div class="commands-category">
-                <div class="form-group">
-                  <label>Maximum Tokens:</label>
-                  <input 
-                    type="number" 
-                    name="max_tokens" 
-                    .value=${agentForRender.max_tokens || ''}
-                    placeholder="Leave empty for model default"
-                    @input=${this.handleInputChange}
-                  >
-                </div>
+            <div class="commands-category">
+              <div class="form-group">
+                <label>Maximum Tokens:</label>
+                <input 
+                  type="number" 
+                  name="max_tokens" 
+                  .value=${agentForRender.max_tokens || ''}
+                  placeholder="Leave empty for model default"
+                  @input=${this.handleInputChange}
+                >
               </div>
-            </details>
+            </div>
           </div>
 
           <div class="form-group commands-section">
             <details>
-              <summary>Recommended Plugins</summary>
+              <summary>Recommended Plugins</summary>              <summary>Recommended Plugins</summary>
               ${this.renderRequiredPlugins()}
 
           <!-- UI section: components + pages -->

mindroot-13.4.0/src/mindroot/coreplugins/api_keys/router.py

@@ -0,0 +1,127 @@
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
+from typing import Optional, List
+from datetime import datetime
+import logging
+from .mod import api_key_manager
+from lib.auth.api_key import verify_api_key
+
+router = APIRouter()
+
+logger = logging.getLogger(__name__)
+
+class APIKeyCreate(BaseModel):
+    username: str
+    description: Optional[str] = ""
+
+class APIKeyResponse(BaseModel):
+    key: str
+    username: str
+    description: str
+    created_at: str
+
+class APIKeyList(BaseModel):
+    success: bool
+    data: List[APIKeyResponse]
+
+def _is_trusted_source(request: Request) -> bool:
+    """Check if the request comes from localhost or Docker bridge gateway.
+
+    When mragent on the host connects to a container's mapped port via
+    127.0.0.1, Docker NAT rewrites the source IP to the bridge gateway
+    (typically 172.17.0.1 or similar). These IPs can only originate from
+    processes on the same host, so we trust them for bootstrap operations.
+    """
+    client_host = request.client.host if request.client else ""
+    is_localhost = client_host in ("127.0.0.1", "::1", "localhost")
+
+    if is_localhost:
+        return True
+
+    # Docker bridge gateway check: 172.x.0.1 pattern
+    is_docker_gateway = False
+    if client_host:
+        parts = client_host.split(".")
+        if len(parts) == 4:
+            # Docker default bridge: 172.17.0.0/16, custom bridges: 172.x.0.0/16
+            if parts[0] == "172" and parts[2] == "0" and parts[3] == "1":
+                is_docker_gateway = True
+
+    # Also check X-Real-IP header in case nginx proxied the request
+    # (nginx sets X-Real-IP to the original client IP)
+    if not is_docker_gateway:
+        real_ip = request.headers.get("X-Real-IP", "")
+        if real_ip in ("127.0.0.1", "::1", "localhost"):
+            is_docker_gateway = True
+
+    is_trusted = is_localhost or is_docker_gateway
+    logger.info(
+        f"API key request from {client_host} "
+        f"(localhost={is_localhost}, docker_gw={is_docker_gateway}, "
+        f"trusted={is_trusted})"
+    )
+    return is_trusted
+
+@router.post("/api_keys/create")
+async def create_api_key(request: Request, key_request: APIKeyCreate):
+    """Create a new API key.
+    
+    Access control:
+    - Requests from localhost or Docker bridge gateway are allowed without auth
+      (for container bootstrap by mragent on the same host)
+    - All other requests require authentication (Bearer token or session user)
+    """
+    if not _is_trusted_source(request):
+        # Require authentication for non-trusted requests
+        auth_header = request.headers.get("Authorization")
+        if auth_header and auth_header.startswith("Bearer "):
+            user_data = await verify_api_key(auth_header[7:])
+            if not user_data:
+                raise HTTPException(status_code=401, detail="Invalid API key")
+        elif not hasattr(request.state, "user"):
+            raise HTTPException(status_code=401, detail="Authentication required")
+    try:
+        key = api_key_manager.create_key(
+            username=key_request.username,
+            description=key_request.description
+        )
+        return {"success": True, "data": key}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+@router.get("/api_keys/list", response_model=APIKeyList)
+async def list_api_keys(request: Request):
+    """List API keys. Requires auth unless from localhost."""
+    if not _is_trusted_source(request):
+        auth_header = request.headers.get("Authorization")
+        if auth_header and auth_header.startswith("Bearer "):
+            user_data = await verify_api_key(auth_header[7:])
+            if not user_data:
+                raise HTTPException(status_code=401, detail="Invalid API key")
+        elif not hasattr(request.state, "user"):
+            raise HTTPException(status_code=401, detail="Authentication required")
+    try:
+        keys = api_key_manager.list_keys()
+        return {"success": True, "data": keys}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+@router.delete("/api_keys/delete/{api_key}")
+async def delete_api_key(api_key: str, request: Request):
+    """Delete an API key. Requires auth unless from localhost."""
+    if not _is_trusted_source(request):
+        auth_header = request.headers.get("Authorization")
+        if auth_header and auth_header.startswith("Bearer "):
+            user_data = await verify_api_key(auth_header[7:])
+            if not user_data:
+                raise HTTPException(status_code=401, detail="Invalid API key")
+        elif not hasattr(request.state, "user"):
+            raise HTTPException(status_code=401, detail="Authentication required")
+    try:
+        success = api_key_manager.delete_key(api_key)
+        if success:
+            return {"success": True, "message": "API key deleted successfully"}
+        else:
+            raise HTTPException(status_code=404, detail="API key not found")
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

{mindroot-13.2.0 → mindroot-13.4.0}/src/mindroot/coreplugins/chat/router.py

@@ -457,6 +457,7 @@ async def get_chat_html(request: Request, agent_name: str, api_key: str = Query(
     # Regular redirect
     return RedirectResponse(f"/session/{agent_name}/{log_id}")
 
+@public_route()
 @router.get("/makesession/{agent_name}")
 async def make_session(request: Request, agent_name: str, api_key: str = Query(None)):
     """

{mindroot-13.2.0 → mindroot-13.4.0}/src/mindroot/coreplugins/user_service/router.py

@@ -1,16 +1,90 @@
-from fastapi import APIRouter, Request, Form, Depends
+from fastapi import APIRouter, HTTPException, Request, Form, Depends
 from fastapi.responses import HTMLResponse, RedirectResponse
 from lib.templates import render
 import os
 import json
 import logging
+import secrets
 from .password_reset_service import reset_password_with_token, initiate_password_reset
+from .mod import create_user
+from .models import UserCreate
+from lib.auth.api_key import verify_api_key
 from lib.providers.services import service_manager
 from lib.providers import ProviderManager
 from lib.route_decorators import public_route
 logger = logging.getLogger(__name__)
 router = APIRouter()
 
+def _is_trusted_source(request: Request) -> bool:
+    """Check if request comes from localhost or Docker bridge gateway."""
+    client_host = request.client.host if request.client else ""
+    is_localhost = client_host in ("127.0.0.1", "::1", "localhost")
+    if is_localhost:
+        return True
+    is_docker_gateway = False
+    if client_host:
+        parts = client_host.split(".")
+        if len(parts) == 4:
+            if parts[0] == "172" and parts[2] == "0" and parts[3] == "1":
+                is_docker_gateway = True
+    if not is_docker_gateway:
+        real_ip = request.headers.get("X-Real-IP", "")
+        if real_ip in ("127.0.0.1", "::1", "localhost"):
+            is_docker_gateway = True
+    is_trusted = is_localhost or is_docker_gateway
+    logger.info(f"User API request from {client_host} (trusted={is_trusted})")
+    return is_trusted
+
+@router.post("/api/users/create")
+async def api_create_user(request: Request):
+    """Create a new user programmatically.    """Create a new user programmatically.
+    
+    Access control:
+    - Requests from localhost or Docker bridge gateway are allowed without auth
+      (for container bootstrap by mragent)
+    - All other requests require Bearer auth
+    
+    Body: {"username": "...", "email": "...", "password": "...", "roles": ["user"]}
+    
+    If password is not provided or too short, a secure random one is generated.
+    """
+    if not _is_trusted_source(request):
+        auth_header = request.headers.get("Authorization")
+        if auth_header and auth_header.startswith("Bearer "):
+            user_data = await verify_api_key(auth_header[7:])
+            if not user_data:
+                raise HTTPException(status_code=401, detail="Invalid API key")
+        else:
+            raise HTTPException(status_code=401, detail="Authentication required")
+    
+    try:
+        body = await request.json()
+    except Exception:
+        raise HTTPException(status_code=400, detail="Invalid JSON body")
+    
+    username = body.get("username")
+    email = body.get("email")
+    password = body.get("password")
+    roles = body.get("roles", ["user"])
+    
+    if not username or not email:
+        raise HTTPException(status_code=400, detail="username and email are required")
+    
+    # Generate a secure random password if none provided or too short
+    if not password or len(password) < 8:
+        password = secrets.token_urlsafe(16)
+    
+    try:
+        user_create = UserCreate(username=username, email=email, password=password)
+        user = await create_user(user_create, roles=roles, skip_verification=True)
+        logger.info(f"Created user {username} via API")
+        return {"success": True, "user": {"username": user.username, "email": user.email, "roles": user.roles}}
+    except ValueError as e:
+        raise HTTPException(status_code=409, detail=str(e))
+    except Exception as e:
+        logger.error(f"Failed to create user via API: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
 @public_route()
 @router.get('/reset-password/{filename}')
 async def get_reset_password_form_by_file(request: Request, filename: str):
@@ -67,4 +141,4 @@ async def handle_reset_password_by_file(request: Request, filename: str, passwor
     except Exception as e:
         logger.error(f'Error processing trigger file {filename}: {e}')
         html = await render('reset_password', {'request': request, 'token': filename, 'error': f'Error processing reset: {str(e)}', 'success': False})
-        return HTMLResponse(content=html)
+        return HTMLResponse(content=html)

{mindroot-13.2.0 → mindroot-13.4.0}/src/mindroot/server.py

@@ -13,7 +13,6 @@ else:
 
 from fastapi import FastAPI, Response, Request
 from fastapi.staticfiles import StaticFiles
-from fastapi.templating import Jinja2Templates
 import os
 from pathlib import Path
 from .lib import plugins
@@ -64,6 +63,26 @@ def parse_args():
     install_parser.add_argument('plugins', nargs='+', help='List of plugins to install (e.g., runvnc/plugin-name)')
     install_parser.add_argument('--reinstall', action='store_true', help='Force reinstall of the plugin if it already exists.')
 
+    # User command group
+    user_parser = subparsers.add_parser('user', help='Manage users')
+    user_subparsers = user_parser.add_subparsers(dest='user_command', required=True)
+    create_user_parser = user_subparsers.add_parser('create', help='Create a new user')
+    create_user_parser.add_argument('username', type=str, help='Username')
+    create_user_parser.add_argument('email', type=str, help='Email address')
+    create_user_parser.add_argument('--password', type=str, default=None, help='Password (auto-generated if not provided)')
+    create_user_parser.add_argument('--roles', type=str, nargs='+', default=['user', 'verified'], help='Roles for the user')
+
+    # API key command group
+    apikey_parser = subparsers.add_parser('apikey', help='Manage API keys')
+    apikey_subparsers = apikey_parser.add_subparsers(dest='apikey_command', required=True)
+    create_apikey_parser = apikey_subparsers.add_parser('create', help='Create a new API key')
+    create_apikey_parser.add_argument('username', type=str, help='Username to associate the key with')
+    create_apikey_parser.add_argument('--description', type=str, default='', help='Description for the key')
+    delete_apikey_parser = apikey_subparsers.add_parser('delete', help='Delete an API key')
+    delete_apikey_parser.add_argument('key', type=str, help='API key to delete')
+    list_apikey_parser = apikey_subparsers.add_parser('list', help='List API keys')
+    list_apikey_parser.add_argument('--username', type=str, default=None, help='Optional username to filter by')
+
     return parser.parse_args()
 
 def get_project_root():
@@ -190,6 +209,77 @@ def main():
 
     args = parse_args()
 
+    # Handle CLI-only commands (no server startup needed)
+    if args.command == 'user':
+        if args.user_command == 'create':
+            import bcrypt
+            import secrets
+            import json
+            from datetime import datetime
+            import os
+            password = args.password or secrets.token_urlsafe(16)
+            user_dir = os.path.join('data/users', args.username)
+            os.makedirs('data/users', exist_ok=True)
+            if os.path.exists(user_dir):
+                print(f'Error: Username {args.username} already exists')
+                sys.exit(1)
+            os.makedirs(user_dir)
+            role_list = args.roles or ['user']
+            if 'user' not in role_list:
+                role_list.append('user')
+            now = datetime.utcnow().isoformat()
+            auth_data = {
+                'username': args.username,
+                'email': args.email,
+                'password_hash': bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode(),
+                'created_at': now,
+                'last_login': None,
+                'email_verified': True,
+                'verification_token': None,
+                'verification_expires': None,
+                'roles': role_list
+            }
+            with open(os.path.join(user_dir, 'auth.json'), 'w') as f:
+                json.dump(auth_data, f, indent=2)
+            with open(os.path.join(user_dir, 'settings.json'), 'w') as f:
+                json.dump({}, f)
+            with open(os.path.join(user_dir, 'workspace.json'), 'w') as f:
+                json.dump({}, f)
+            print(f'Created user: {args.username}')
+            print(f'Email: {args.email}')
+            print(f'Password: {password}')
+            print(f'Roles: {role_list}')
+        else:
+            print(f"Unknown user command: {args.user_command}")
+            sys.exit(1)
+        sys.exit(0)
+
+    if args.command == 'apikey':
+        from .coreplugins.api_keys.api_key_manager import api_key_manager
+        if args.apikey_command == 'create':
+            key_data = api_key_manager.create_key(args.username, description=args.description)
+            print(f"Created API key for user: {args.username}")
+            print(f"Key: {key_data['key']}")
+            print(f"Description: {args.description}")
+        elif args.apikey_command == 'delete':
+            if api_key_manager.delete_key(args.key):
+                print(f"Deleted API key: {args.key}")
+            else:
+                print(f"API key not found: {args.key}")
+                sys.exit(1)
+        elif args.apikey_command == 'list':
+            keys = api_key_manager.list_keys(username=args.username)
+            if keys:
+                print(f"API keys:")
+                for k in keys:
+                    print(f"  {k['key']} - user: {k['username']} ({k.get('description', '')})")
+            else:
+                print("No API keys found")
+        else:
+            print(f"Unknown apikey command: {args.apikey_command}")
+            sys.exit(1)
+        sys.exit(0)
+
     # If the command is 'plugin', handle it and exit.
     if args.command == 'plugin':
         if args.plugin_command == 'install':

{mindroot-13.2.0 → mindroot-13.4.0/src/mindroot.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mindroot
-Version: 13.2.0
+Version: 13.4.0
 Summary: MindRoot AI Agent Framework
 Requires-Python: >=3.9
 License-File: LICENSE

{mindroot-13.2.0 → mindroot-13.4.0}/src/mindroot.egg-info/SOURCES.txt

@@ -452,7 +452,6 @@ src/mindroot/coreplugins/admin/static/js/lit-html/node/directives/when.js
 src/mindroot/coreplugins/admin/static/js/lit-html/node/directives/when.js.map
 src/mindroot/coreplugins/admin/templates/admin.jinja2
 src/mindroot/coreplugins/admin/templates/model-preferences-v2.jinja2
-src/mindroot/coreplugins/agent/LONG_FORM_RECOVERY_HANDOFF.md
 src/mindroot/coreplugins/agent/agent.py
 src/mindroot/coreplugins/agent/agent.py.bak
 src/mindroot/coreplugins/agent/buagentz1.py
@@ -473,9 +472,6 @@ src/mindroot/coreplugins/agent/SysAdmin/agent.json
 src/mindroot/coreplugins/agent/templates/system.jinja2
 src/mindroot/coreplugins/agent/templates/systemnew.jinja2
 src/mindroot/coreplugins/agent/templates/systemworking.jinja2
-src/mindroot/coreplugins/agent/tryfix/agent.py
-src/mindroot/coreplugins/agent/tryfix/command_parser.py
-src/mindroot/coreplugins/agent/tryfix/long_form_recovery.py
 src/mindroot/coreplugins/api_keys/__init__.py
 src/mindroot/coreplugins/api_keys/api_key_manager.py
 src/mindroot/coreplugins/api_keys/cli.py