rasa-pro 3.14.0.dev20250825__py3-none-any.whl → 3.14.0.dev20250922__py3-none-any.whl

rasa/engine/graph.py

@@ -69,6 +69,7 @@ class SchemaNode:
 
     def matches_type(self, node_type: Type, include_subtypes: bool = True) -> bool:
         """Checks if schema node's 'uses' is of specified node type.
+
         By default, it also checks for subtypes of the specified node type.
         """
         return (self.uses is node_type) or (
@@ -171,6 +172,7 @@ class GraphSchema:
 
     def has_node(self, node_type: Type, include_subtypes: bool = True) -> bool:
         """Checks if the graph schema contains a node of the specified node type.
+
         By default, it also checks for subtypes of the specified node type.
         """
         for node in self.nodes.values():
@@ -181,7 +183,7 @@ class GraphSchema:
     def count_nodes_of_a_given_type(
         self, node_type: Type, include_subtypes: bool = True
     ) -> int:
-        """Counts the number of the nodes of specified class"""
+        """Counts the number of the nodes of specified class."""
         counter = 0
         for node in self.nodes.values():
             if (node.uses is node_type) or (
@@ -353,6 +355,7 @@ class ExecutionContext:
 
     def has_node(self, node_type: Type, include_subtypes: bool = True) -> bool:
         """Checks if the graph node of the given type is present in the graph schema.
+
         By default, it also checks for subtypes of the specified node type.
         """
         return self.graph_schema.has_node(node_type, include_subtypes)
@@ -555,6 +558,7 @@ class GraphNode:
                 structlogger.error(
                     "graph.node.error_running_component",
                     node_name=self._node_name,
+                    error=str(e),
                 )
                 raise
 

rasa/engine/loader.py

@@ -1,6 +1,8 @@
 from pathlib import Path
 from typing import Tuple, Type
 
+import structlog
+
 from rasa.engine.graph import ExecutionContext
 from rasa.engine.runner.interface import GraphRunner
 from rasa.engine.storage.storage import ModelMetadata, ModelStorage
@@ -9,6 +11,8 @@ from rasa.engine.validation import (
     validate_model_group_configuration_setup,
 )
 
+structlogger = structlog.get_logger()
+
 
 def load_predict_graph_runner(
     storage_path: Path,
@@ -30,6 +34,10 @@ def load_predict_graph_runner(
     model_storage, model_metadata = model_storage_class.from_model_archive(
         storage_path=storage_path, model_archive_path=model_archive_path
     )
+    structlogger.debug(
+        "engine.loader.load_predict_graph_runner.success",
+        model_id=model_metadata.model_id,
+    )
 
     # Components using LLMs or embeddings can reference model groups defined in
     # the endpoints.yml file for their client configurations. To ensure they will work
@@ -38,6 +46,10 @@ def load_predict_graph_runner(
     validate_model_group_configuration_setup()
     validate_model_client_configuration_setup_during_inference_time(model_metadata)
 
+    structlogger.debug(
+        "engine.loader.config.validation.success",
+        model_id=model_metadata.model_id,
+    )
     runner = graph_runner_class.create(
         graph_schema=model_metadata.predict_schema,
         model_storage=model_storage,

rasa/engine/storage/local_model_storage.py

@@ -1,14 +1,16 @@
 from __future__ import annotations
 
 import logging
+import os
 import shutil
 import sys
+import tarfile
 import tempfile
 import uuid
 from contextlib import contextmanager
 from datetime import datetime
 from pathlib import Path
-from typing import Generator, Optional, Text, Tuple, Union
+from typing import Callable, Generator, List, Optional, Text, Tuple, Union
 
 from tarsafe import TarSafe
 
@@ -57,6 +59,35 @@ def windows_safe_temporary_directory(
             yield temporary_directory
 
 
+def filter_normpath(member: tarfile.TarInfo, dest_path: str) -> tarfile.TarInfo:
+    """Normalize tar member paths for safe extraction"""
+    if member.name:
+        member.name = os.path.normpath(member.name)
+    return member
+
+
+FilterFunction = Callable[[tarfile.TarInfo, str], Optional[tarfile.TarInfo]]
+
+
+def create_combined_filter(existing_filter: Optional[FilterFunction]) -> FilterFunction:
+    """Create a filter that combines existing filter with path normalization"""
+
+    def combined_filter(
+        member: tarfile.TarInfo, dest_path: str
+    ) -> Optional[tarfile.TarInfo]:
+        """Apply existing filter first, then path normalization"""
+        if existing_filter is not None:
+            filtered_member = existing_filter(member, dest_path)
+            if filtered_member is None:
+                return None  # Rejected by existing filter
+            member = filtered_member  # Use the filtered result
+
+        # Apply our path normalization
+        return filter_normpath(member, dest_path)
+
+    return combined_filter
+
+
 class LocalModelStorage(ModelStorage):
     """Stores and provides output of `GraphComponents` on local disk."""
 
@@ -122,9 +153,29 @@ class LocalModelStorage(ModelStorage):
                 # this restriction in environments where it's not possible
                 # to override this behavior, mostly for internal policy reasons
                 # reference: https://stackoverflow.com/a/49102229
-                tar.extractall(f"\\\\?\\{temporary_directory}")
+                try:
+                    # Use extraction filter to normalize paths for compatibility
+                    # before trying the \\?\ prefix approach first
+                    prev_filter = getattr(tar, "extraction_filter", None)
+                    tar.extraction_filter = create_combined_filter(prev_filter)
+                    tar.extractall(
+                        f"\\\\?\\{temporary_directory}",
+                        members=yield_safe_members(tar.getmembers()),
+                    )
+                except Exception:
+                    # Fallback for Python versions with tarfile security fix
+                    logger.warning(
+                        "Failed to extract model archive with long path support. "
+                        "Falling back to regular extraction."
+                    )
+                    tar.extractall(
+                        temporary_directory,
+                        members=yield_safe_members(tar.getmembers()),
+                    )
             else:
-                tar.extractall(temporary_directory)
+                tar.extractall(
+                    temporary_directory, members=yield_safe_members(tar.getmembers())
+                )
         LocalModelStorage._assert_not_rasa2_archive(temporary_directory)
 
     @staticmethod
@@ -244,3 +295,32 @@ class LocalModelStorage(ModelStorage):
             core_target=model_configuration.core_target,
             nlu_target=model_configuration.nlu_target,
         )
+
+
+def yield_safe_members(
+    members: List[tarfile.TarInfo],
+) -> Generator[tarfile.TarInfo, None, None]:
+    """
+    Filter function for tar.extractall members parameter.
+    Validates each member and yields only safe ones.
+
+    Args:
+        members: Iterator of TarInfo objects from tar.getmembers()
+
+    Yields:
+        TarInfo: Safe members to extract
+    """
+    for member in members:
+        # Skip absolute paths
+        if Path(member.name).is_absolute():
+            continue
+
+        # Skip paths with directory traversal sequences
+        if ".." in member.name or "\\.." in member.name:
+            continue
+
+        # Skip special file types unless you need them
+        if member.isdev() or member.issym():
+            continue
+
+        yield member

rasa/model_manager/model_api.py

@@ -39,11 +39,9 @@ from rasa.model_manager.trainer_service import (
     update_training_status,
 )
 from rasa.model_manager.utils import (
-    InvalidPathException,
     get_logs_content,
     logs_base_path,
     models_base_path,
-    subpath,
 )
 from rasa.model_manager.warm_rasa_process import (
     initialize_warm_rasa_process,
@@ -53,6 +51,7 @@ from rasa.server import ErrorResponse
 from rasa.shared.exceptions import InvalidConfigException
 from rasa.shared.utils.yaml import dump_obj_as_yaml_to_string
 from rasa.studio.upload import build_calm_import_parts
+from rasa.utils.io import InvalidPathException, subpath
 
 dotenv.load_dotenv()
 

rasa/model_manager/runner_service.py

@@ -15,11 +15,11 @@ from rasa.model_manager import config
 from rasa.model_manager.utils import (
     logs_path,
     models_base_path,
-    subpath,
     write_encoded_data_to_file,
 )
 from rasa.model_manager.warm_rasa_process import start_rasa_process
 from rasa.studio.prompts import handle_prompts
+from rasa.utils.io import subpath
 
 structlogger = structlog.get_logger()
 

rasa/model_manager/socket_bridge.py

@@ -1,4 +1,3 @@
-import json
 from typing import Any, Dict, Optional
 
 import structlog
@@ -145,7 +144,7 @@ async def create_bridge_client(
 
     @client.event  # type: ignore[misc]
     async def tracker(data: Dict[str, Any]) -> None:
-        await sio_server.emit("tracker", json.loads(data), room=sid)
+        await sio_server.emit("tracker", data, room=sid)
 
     @client.event  # type: ignore[misc]
     async def disconnect() -> None:

rasa/model_manager/trainer_service.py

@@ -14,7 +14,6 @@ from rasa.model_manager.utils import (
     ensure_base_directory_exists,
     logs_path,
     models_base_path,
-    subpath,
     write_encoded_data_to_file,
 )
 from rasa.model_manager.warm_rasa_process import (
@@ -22,6 +21,7 @@ from rasa.model_manager.warm_rasa_process import (
 )
 from rasa.model_training import generate_random_model_name
 from rasa.studio.prompts import handle_prompts
+from rasa.utils.io import subpath
 
 structlogger = structlog.get_logger()
 
@@ -53,6 +53,15 @@ class TrainingSession(BaseModel):
         """Check if the training is running."""
         return self.status == TrainingSessionStatus.RUNNING
 
+    def has_just_finished(self) -> bool:
+        if not self.is_status_indicating_alive():
+            # skip if the training is not running
+            return False
+        if self.process.poll() is None:
+            # process is still running
+            return False
+        return True
+
     def model_path(self) -> str:
         """Return the path to the model."""
         return subpath(models_base_path(), f"{self.model_name}.tar.gz")
@@ -89,14 +98,8 @@ def terminate_training(training: TrainingSession) -> None:
 
 
 def update_training_status(training: TrainingSession) -> None:
-    if not training.is_status_indicating_alive():
-        # skip if the training is not running
-        return
-    if training.process.poll() is None:
-        # process is still running
-        return
-
-    complete_training(training)
+    if training.has_just_finished():
+        complete_training(training)
 
 
 def complete_training(training: TrainingSession) -> None:

rasa/model_manager/utils.py

@@ -5,15 +5,11 @@ from typing import Optional
 import structlog
 
 from rasa.model_manager import config
-from rasa.shared.exceptions import RasaException
+from rasa.utils.io import subpath
 
 structlogger = structlog.get_logger()
 
 
-class InvalidPathException(RasaException):
-    """Raised if a path is invalid - e.g. path traversal is detected."""
-
-
 def write_encoded_data_to_file(encoded_data: bytes, file: str) -> None:
     """Write base64 encoded data to a file."""
     # create the directory if it does not exist of the parent directory
@@ -53,30 +49,6 @@ def logs_path(action_id: str) -> str:
     return subpath(logs_base_path(), f"{action_id}.txt")
 
 
-def subpath(parent: str, child: str) -> str:
-    """Return the path to the child directory of the parent directory.
-
-    Ensures, that child doesn't navigate to parent directories. Prevents
-    path traversal. Raises an InvalidPathException if the path is invalid.
-
-    Based on Snyk's directory traversal mitigation:
-    https://learn.snyk.io/lesson/directory-traversal/
-    """
-    safe_path = os.path.abspath(os.path.join(parent, child))
-    parent = os.path.abspath(parent)
-
-    common_base = os.path.commonpath([parent, safe_path])
-    if common_base != parent:
-        raise InvalidPathException(f"Invalid path: {safe_path}")
-
-    if os.path.basename(safe_path) != child:
-        raise InvalidPathException(
-            f"Invalid path - path traversal detected: {safe_path}"
-        )
-
-    return safe_path
-
-
 def get_logs_content(action_id: str) -> Optional[str]:
     """Return the content of the log file for a given action id."""
     try:

rasa/model_manager/warm_rasa_process.py

@@ -1,6 +1,7 @@
 import os
 import shlex
 import subprocess
+import time
 import uuid
 from dataclasses import dataclass
 from typing import List
@@ -149,19 +150,28 @@ def warmup() -> None:
     We import them now, so that the training / deployment can later
     directly start.
     """
+    start_time = time.time()
     try:
         import langchain  # noqa: F401
         import litellm  # noqa: F401
         import matplotlib  # noqa: F401
         import numpy  # noqa: F401
         import pandas  # noqa: F401
-        import presidio_analyzer  # noqa: F401
-        import spacy  # noqa: F401
         import tensorflow  # noqa: F401
 
         import rasa.validator  # noqa: F401
-    except ImportError:
+    except ImportError as e:
+        structlogger.warning(
+            "model_trainer.warmup_error",
+            error=str(e),
+        )
         pass
+    finally:
+        end_time = time.time()
+        structlogger.debug(
+            "model_trainer.warmup_time",
+            time_in_seconds=end_time - start_time,
+        )
 
 
 def warm_rasa_main() -> None:

rasa/shared/core/constants.py

@@ -55,6 +55,7 @@ ACTION_REPEAT_BOT_MESSAGES = "action_repeat_bot_messages"
 
 ACTION_METADATA_EXECUTION_SUCCESS = "execution_success"
 ACTION_METADATA_EXECUTION_ERROR_MESSAGE = "execution_error_message"
+ACTION_METADATA_EXECUTION_TIME = "execution_times"
 
 
 DEFAULT_ACTION_NAMES = [

rasa/shared/core/domain.py

@@ -98,6 +98,8 @@ IS_RETRIEVAL_INTENT_KEY = "is_retrieval_intent"
 ENTITY_ROLES_KEY = "roles"
 ENTITY_GROUPS_KEY = "groups"
 ENTITY_FEATURIZATION_KEY = "influence_conversation"
+STORE_ENTITIES_AS_SLOTS_KEY = "store_entities_as_slots"
+DOMAIN_CONFIG_KEY = "config"
 
 KEY_SLOTS = "slots"
 KEY_INTENTS = "intents"
@@ -146,6 +148,8 @@ MERGE_FUNC_MAPPING: Dict[Text, Callable[..., Any]] = {
     KEY_FORMS: rasa.shared.utils.common.merge_dicts,
 }
 
+DEFAULT_STORE_ENTITIES_AS_SLOTS = True
+
 DICT_DATA_KEYS = [
     key
     for key, value in MERGE_FUNC_MAPPING.items()
@@ -318,7 +322,7 @@ class Domain:
         actions = cls._collect_action_names(domain_actions)
 
         additional_arguments = {
-            **data.get("config", {}),
+            **data.get(DOMAIN_CONFIG_KEY, {}),
             "actions_which_explicitly_need_domain": (
                 cls._collect_actions_which_explicitly_need_domain(domain_actions)
             ),
@@ -468,9 +472,9 @@ class Domain:
             return domain_dict
 
         if override:
-            config = domain_dict.get("config", {})
+            config = domain_dict.get(DOMAIN_CONFIG_KEY, {})
             for key, val in config.items():
-                combined["config"][key] = val
+                combined[DOMAIN_CONFIG_KEY][key] = val
 
         if (
             override
@@ -508,10 +512,10 @@ class Domain:
         return combined
 
     def partial_merge(self, other: Domain) -> Domain:
-        """
-        Returns a new Domain with intersection-based merging:
-          - For each domain section only overwrite items that already exist in self.
-          - Brand-new items in `other` are ignored.
+        """Returns a new Domain with intersection-based merging.
+
+        For each domain section only overwrite items that already exist in self.
+        Brand-new items in `other` are ignored.
 
         Args:
             other: The domain to merge with.
@@ -543,9 +547,9 @@ class Domain:
         return Domain.from_dict(updated_self)
 
     def difference(self, other: Domain) -> Domain:
-        """
-        Returns a new Domain containing items in `self` that are NOT in `other`,
-        using simple equality checks for dict/list items.
+        """Returns a new Domain containing items in `self` that are NOT in `other`.
+
+        Uses simple equality checks for dict/list items.
 
         Args:
             other: The domain to compare with.
@@ -598,9 +602,16 @@ class Domain:
     ) -> Dict:
         # add the config, session_config and training data version defaults
         # if not included in the original domain dict
-        if "config" not in data and not store_entities_as_slots:
+        if (
+            DOMAIN_CONFIG_KEY not in data
+            and store_entities_as_slots != DEFAULT_STORE_ENTITIES_AS_SLOTS
+        ):
             data.update(
-                {"config": {"store_entities_as_slots": store_entities_as_slots}}
+                {
+                    DOMAIN_CONFIG_KEY: {
+                        STORE_ENTITIES_AS_SLOTS_KEY: store_entities_as_slots
+                    }
+                }
             )
 
         if SESSION_CONFIG_KEY not in data:
@@ -937,7 +948,7 @@ class Domain:
         forms: Union[Dict[Text, Any], List[Text]],
         data: Dict,
         action_texts: Optional[List[Text]] = None,
-        store_entities_as_slots: bool = True,
+        store_entities_as_slots: bool = DEFAULT_STORE_ENTITIES_AS_SLOTS,
         session_config: SessionConfig = SessionConfig.default(),
         **kwargs: Any,
     ) -> None:
@@ -1711,9 +1722,45 @@ class Domain:
         else:
             return True
 
-    def as_dict(self) -> Dict[Text, Any]:
+    def _uses_custom_session_config(self) -> bool:
+        """Check if the domain uses a custom session config."""
+        return self._data.get(SESSION_CONFIG_KEY) != SessionConfig.default().as_dict()
+
+    def _uses_custom_domain_config(self) -> bool:
+        """Check if the domain uses a custom domain config."""
+        return self._data.get(DOMAIN_CONFIG_KEY) != {
+            STORE_ENTITIES_AS_SLOTS_KEY: DEFAULT_STORE_ENTITIES_AS_SLOTS
+        }
+
+    def _cleaned_json_data(self) -> Dict[Text, Any]:
+        """Remove default values from the domain data.
+
+        Only retains data that was customized by the user.
+
+        Returns:
+            A cleaned dictionary version of the domain.
+        """
+        cleaned_data = copy.deepcopy(self._data)
+
+        # Remove default config if it only contains store_entities_as_slots: False
+        if DOMAIN_CONFIG_KEY in cleaned_data and not self._uses_custom_domain_config():
+            del cleaned_data[DOMAIN_CONFIG_KEY]
+
+        # Remove default session config if it matches the default values
+        if (
+            SESSION_CONFIG_KEY in cleaned_data
+            and not self._uses_custom_session_config()
+        ):
+            del cleaned_data[SESSION_CONFIG_KEY]
+
+        return cleaned_data
+
+    def as_dict(self, should_clean_json: bool = False) -> Dict[Text, Any]:
         """Return serialized `Domain`."""
-        return self._data
+        if should_clean_json:
+            return self._cleaned_json_data()
+        else:
+            return self._data
 
     @staticmethod
     def get_responses_with_multilines(

rasa/shared/core/events.py

@@ -35,6 +35,7 @@ from rasa.shared.core.constants import (
     ACTION_LISTEN_NAME,
     ACTION_METADATA_EXECUTION_ERROR_MESSAGE,
     ACTION_METADATA_EXECUTION_SUCCESS,
+    ACTION_METADATA_EXECUTION_TIME,
     ACTION_NAME_SENDER_ID_CONNECTOR_STR,
     ACTION_SESSION_START_NAME,
     ENTITY_LABEL_SEPARATOR,
@@ -1815,6 +1816,7 @@ class ActionExecuted(Event):
         items_to_ignore = [
             ACTION_METADATA_EXECUTION_SUCCESS,
             ACTION_METADATA_EXECUTION_ERROR_MESSAGE,
+            ACTION_METADATA_EXECUTION_TIME,
         ]
         meta_no_nones = {
             k: v

rasa/shared/core/flows/flow.py

@@ -8,7 +8,6 @@ from typing import Any, Dict, List, Optional, Set, Text, Tuple, Union
 
 import structlog
 from pydantic import BaseModel
-from pypred import Predicate
 
 import rasa.shared.utils.io
 from rasa.engine.language import Language
@@ -53,6 +52,7 @@ from rasa.shared.core.flows.steps.constants import (
 )
 from rasa.shared.core.flows.steps.continuation import ContinueFlowStep
 from rasa.shared.core.slots import Slot
+from rasa.utils.pypred import Predicate
 
 structlogger = structlog.get_logger()
 

rasa/shared/core/flows/flow_step.py

@@ -52,7 +52,13 @@ def step_from_json(flow_id: Text, data: Dict[Text, Any]) -> FlowStep:
         return SetSlotsFlowStep.from_json(flow_id, data)
     if "noop" in data:
         return NoOperationFlowStep.from_json(flow_id, data)
-    raise RasaException(f"Failed to parse step from json. Unknown type for {data}.")
+
+    required_properties = ["action", "collect", "link", "call", "set_slots", "noop"]
+    raise RasaException(
+        f"Failed to parse step from json. Unknown type for {data}. "
+        f"At least one of the following properties is required: "
+        f"{', '.join(required_properties)}"
+    )
 
 
 @dataclass

rasa/shared/core/flows/steps/call.py

@@ -50,7 +50,14 @@ class CallFlowStep(FlowStep):
 
         if should_resolve_calls:
             if not self.called_flow_reference:
-                raise ValueError("Call flow reference not set.")
+                raise ValueError(
+                    f"Flow step '{self.id}' in flow '{self.flow_id}' is trying "
+                    f"to call flow '{self.call}', but the flow reference could "
+                    f"not be resolved. Please ensure that:\n"
+                    f"1. A flow named '{self.call}' is defined in your domain\n"
+                    f"2. The flow name is spelled correctly (case-sensitive)\n"
+                    f"3. The called flow is properly formatted with valid YAML syntax"
+                )
 
             yield from self.called_flow_reference.steps_with_calls_resolved
 

rasa/shared/core/flows/yaml_flows_io.py

@@ -262,12 +262,9 @@ class YamlFlowsWriter:
         Returns:
             The dumped YAML.
         """
-        dump = {}
-        for flow in flows:
-            dumped_flow = get_flow_as_json(flow, should_clean_json)
-            del dumped_flow["id"]
-            dump[flow.id] = dumped_flow
-        return dump_obj_as_yaml_to_string({KEY_FLOWS: dump})
+        return dump_obj_as_yaml_to_string(
+            {KEY_FLOWS: get_flows_as_json(flows, should_clean_json)}
+        )
 
     @staticmethod
     def dump(
@@ -424,9 +421,20 @@ def process_yaml_content(yaml_content: Dict[str, Any]) -> Dict[str, Any]:
     return yaml_content
 
 
+def get_flows_as_json(
+    flows: FlowsList, should_clean_json: bool = False
+) -> Dict[str, Any]:
+    """Get the flows as a JSON dictionary."""
+    dump = {}
+    for flow in flows:
+        dumped_flow = get_flow_as_json(flow, should_clean_json)
+        del dumped_flow["id"]
+        dump[flow.id] = dumped_flow
+    return dump
+
+
 def get_flow_as_json(flow: Flow, should_clean_json: bool = False) -> Dict[str, Any]:
-    """
-    Clean the Flow JSON by removing default values and empty fields.
+    """Clean the Flow JSON by removing default values and empty fields.
 
     Args:
         flow: The Flow object to clean.

rasa/shared/core/slots.py

@@ -273,10 +273,14 @@ class Slot(ABC):
         try:
             return rasa.shared.utils.common.class_from_module_path(type_name)
         except (ImportError, AttributeError):
+            known_types = [
+                cls.type_name for cls in rasa.shared.utils.common.all_subclasses(Slot)
+            ]
             raise InvalidSlotTypeException(
                 f"Failed to find slot type, '{type_name}' is neither a known type nor "
                 f"user-defined. If you are creating your own slot type, make "
                 f"sure its module path is correct. "
+                f"Known types: {', '.join(known_types)} "
                 f"You can find all build in types at {DOCS_URL_SLOTS}"
             )
 

rasa/shared/importers/importer.py

@@ -207,6 +207,12 @@ class TrainingDataImporter(ABC):
                 )
             ]
 
+        return TrainingDataImporter.wrap_in_builtins(importers)
+
+    @staticmethod
+    def wrap_in_builtins(
+        importers: List["TrainingDataImporter"],
+    ) -> "TrainingDataImporter":
         return LanguageImporter(
             E2EImporter(
                 FlowSyncImporter(ResponsesSyncImporter(CombinedDataImporter(importers)))