soliplex 0.71__tar.gz → 0.72__tar.gz

{soliplex-0.71/src/soliplex.egg-info → soliplex-0.72}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soliplex
-Version: 0.71
+Version: 0.72
 Summary: An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface.
 Author-email: Enfold <info@enfoldsystems.net>
 Classifier: Programming Language :: Python :: 3
@@ -19,7 +19,7 @@ Requires-Dist: fastapi
 Requires-Dist: fastmcp<3.4,>=3.3.0
 Requires-Dist: fakeredis!=2.35.0
 Requires-Dist: greenlet
-Requires-Dist: haiku.rag-slim<0.65,>=0.64
+Requires-Dist: haiku.rag-slim<0.66,>=0.65
 Requires-Dist: haiku-skills<0.19,>=0.18.0
 Requires-Dist: idna>=3.15
 Requires-Dist: itsdangerous

{soliplex-0.71 → soliplex-0.72}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "soliplex"
-version = "0.71"
+version = "0.72"
 description = "An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface."
 authors = [{ name = "Enfold", email = "info@enfoldsystems.net" }]
 readme = "README.md"
@@ -25,7 +25,7 @@ dependencies = [
     "fastmcp >= 3.3.0, < 3.4",
     "fakeredis != 2.35.0",  # brownbag
     "greenlet",
-    "haiku.rag-slim >= 0.64, < 0.65",
+    "haiku.rag-slim >= 0.65, < 0.66",
     "haiku-skills >= 0.18.0, < 0.19",
     "idna >= 3.15",
     "itsdangerous",
@@ -92,8 +92,6 @@ markers = [
 [tool.coverage.run]
 omit = [
     "src/soliplex/cli/__init__.py",
-
-    "src/soliplex/examples.py",
     "src/soliplex/tui.py",
 ]
 

{soliplex-0.71 → soliplex-0.72}/src/soliplex/agents.py

@@ -150,3 +150,12 @@ def get_agent_from_configs(
             mcp_client_toolset_configs=mcp_client_toolset_configs,
             skill_toolset_config=skill_toolset_config,
         )
+
+
+def find_skill_toolset(
+    agent: pydantic_ai.Agent,
+) -> hs_agent.SkillToolset | None:
+    for toolset in getattr(agent, "toolsets", ()):
+        if isinstance(toolset, hs_agent.SkillToolset):
+            return toolset
+    return None

{soliplex-0.71 → soliplex-0.72}/src/soliplex/agui/persistence.py

@@ -1,14 +1,20 @@
 from __future__ import annotations
 
+import collections.abc
 import contextlib
 import datetime
 import typing
 
+import logfire
 from ag_ui import core as agui_core
+from haiku.skills import agent as hs_agent
+from sqlalchemy import exc as sqla_exc
 from sqlalchemy import sql as sqla_sql
 from sqlalchemy.ext import asyncio as sqla_asyncio
 
 from soliplex import agui
+from soliplex import loggers
+from soliplex import rag_audit
 from soliplex.agui import persistence as agui_persistence
 from soliplex.agui import schema as agui_schema
 from soliplex.agui import util as agui_util
@@ -855,3 +861,148 @@ class ThreadStorage(agui.ThreadStorage):
             )
 
             return history_entry
+
+
+# --------------------------------------------------------------------------
+# Engine-owning run-persistence helpers
+#
+# Each builds its own short-lived session (the one bound to a request's
+# lifetime may already be closed, e.g. after an early connection reset) and
+# owns its commit: 'ThreadStorage' methods no longer commit on their own.
+# Committing per event is what lets a reconnecting client's poll observe
+# events incrementally.
+# --------------------------------------------------------------------------
+
+
+async def capture_usage_after_stream(
+    result,
+    *,
+    sqla_engine,
+    user_name: str,
+    room_id: str,
+    thread_id: str,
+    run_id: str,
+):
+    """Save the run usage to the database."""
+    usage = getattr(result, "usage", None)
+
+    if usage is not None:
+        async with sqla_asyncio.AsyncSession(bind=sqla_engine) as session:
+            the_threads = ThreadStorage(session)
+
+            async with session.begin():
+                await the_threads.save_run_usage(
+                    user_name=user_name,
+                    room_id=room_id,
+                    thread_id=thread_id,
+                    run_id=run_id,
+                    input_tokens=usage.input_tokens,
+                    output_tokens=usage.output_tokens,
+                    requests=usage.requests,
+                    tool_calls=usage.tool_calls,
+                )
+
+
+async def save_single_event(
+    sqla_engine,
+    user_name: str,
+    room_id: str,
+    thread_id: str,
+    run_id: str,
+    event,
+):
+    """Save a single run event to the database (incremental persistence)."""
+    async with sqla_asyncio.AsyncSession(bind=sqla_engine) as session:
+        the_threads = ThreadStorage(session)
+
+        async with session.begin():
+            await the_threads.save_single_event(
+                user_name=user_name,
+                room_id=room_id,
+                thread_id=thread_id,
+                run_id=run_id,
+                event=event,
+            )
+
+
+async def finish_run(
+    sqla_engine,
+    user_name: str,
+    room_id: str,
+    thread_id: str,
+    run_id: str,
+):
+    """Mark a run as finished in the database."""
+    async with sqla_asyncio.AsyncSession(bind=sqla_engine) as session:
+        the_threads = ThreadStorage(session)
+
+        async with session.begin():
+            await the_threads.finish_run(
+                user_name=user_name,
+                room_id=room_id,
+                thread_id=thread_id,
+                run_id=run_id,
+            )
+
+
+async def drive_agui_turn(
+    *,
+    adapter,
+    skill_toolset: hs_agent.SkillToolset | None,
+    engine,
+    user_name: str,
+    room_id: str,
+    thread_id: str,
+    run_id: str,
+    claims: dict | None = None,
+    rag_db_paths: dict[str, str] | None = None,
+    run_stream_kwargs: dict | None = None,
+) -> collections.abc.AsyncIterator:
+    """Drive one room-agent turn as an AG-UI event stream.
+
+    An async generator: for each event it records any RAG access (skill
+    retrievals surface as AG-UI activity events) and persists the event
+    (via :func:`save_single_event`), then yields it. Callers own
+    presentation (an SSE queue, or collecting the assistant text) and any
+    post-run work such as :func:`finish_run`, usage capture, or title
+    generation.
+
+    ``run_stream_kwargs`` is forwarded verbatim to
+    ``haiku.skills.agent.run_agui_stream`` (``deps``, ``conversation_id``,
+    ``on_complete``).
+    """
+    auditor = rag_audit.RagAccessAuditor(
+        loggers.RAGAccessAuditLog(
+            claims=claims or {},
+            room_id=room_id,
+            thread_id=thread_id,
+            run_id=run_id,
+        ),
+        (rag_db_paths or {}).get,
+    )
+
+    async with hs_agent.run_agui_stream(
+        adapter,
+        toolset=skill_toolset,
+        **(run_stream_kwargs or {}),
+    ) as event_stream:
+        compacted = agui.compact_event_stream(event_stream)
+        async for event in compacted:
+            auditor.handle(event)
+
+            try:
+                await save_single_event(
+                    engine,
+                    user_name=user_name,
+                    room_id=room_id,
+                    thread_id=thread_id,
+                    run_id=run_id,
+                    event=event,
+                )
+            except sqla_exc.SQLAlchemyError as sa_exc:
+                logfire.error(
+                    "Error saving event: {error_message}",
+                    error_message=str(sa_exc),
+                )
+
+            yield event

{soliplex-0.71 → soliplex-0.72}/src/soliplex/authz/__init__.py

@@ -231,11 +231,18 @@ class AdminUserPolicy(abc.ABC):
         """
 
     @abc.abstractmethod
-    async def check_admin_access(self, user_token: UserToken) -> bool:
+    async def check_admin_access(
+        self,
+        user_token: UserToken,
+        *,
+        resource: str,
+        action: str,
+    ) -> bool:
         """Is the user represented by 'user_token' an admin user?
 
         Matches 'user_token' against each admin entry's JSONPath query;
-        the user is an admin when any query matches.
+        the user is an admin when any query matches. 'resource' / 'action'
+        name the privileged operation being gated (for the audit record).
         """
 
 

{soliplex-0.71 → soliplex-0.72}/src/soliplex/authz/persistence.py

@@ -186,14 +186,21 @@ class AdminUserPolicy(_SessionPolicy, authz.AdminUserPolicy):
     async def check_admin_access(
         self,
         user_token: authz.UserToken,
+        *,
+        resource: str,
+        action: str,
     ) -> bool:
-        """Is the user represented by 'user_token' an admin user?"""
+        """Is the user represented by 'user_token' an admin user?
+
+        'resource' / 'action' name the privileged operation being gated;
+        they are folded into the emitted 'admin access' audit record.
+        """
         async with self.session as session:
             is_admin = await _user_is_admin(user_token, session)
         if is_admin:
-            self._audit.admin_access_allowed()
+            self._audit.admin_access_allowed(resource=resource, action=action)
         else:
-            self._audit.admin_access_denied()
+            self._audit.admin_access_denied(resource=resource, action=action)
         return is_admin
 
 
@@ -205,6 +212,7 @@ class RoomAuthorizationPolicy(_SessionPolicy, authz.RoomAuthorizationPolicy):
     ):
         super().__init__(session)
         self._audit = loggers.RoomAuthzAuditLog(claims=claims)
+        self._access_audit = loggers.RoomAccessAuditLog(claims=claims)
 
     async def check_room_access(
         self,
@@ -224,9 +232,16 @@ class RoomAuthorizationPolicy(_SessionPolicy, authz.RoomAuthorizationPolicy):
             if policy is not None:
                 await policy.awaitable_attrs.acl_entries
                 allow_deny = policy.check_token(user_token)
-                return allow_deny == authz.AllowDeny.ALLOW
+                result = allow_deny == authz.AllowDeny.ALLOW
             else:
-                return True
+                result = True
+
+        if result:
+            self._access_audit.room_access_allowed(room_id)
+        else:
+            self._access_audit.room_access_denied(room_id)
+
+        return result
 
     async def filter_room_ids(
         self,

soliplex-0.72/src/soliplex/cli/ask.py

@@ -0,0 +1,311 @@
+from __future__ import annotations
+
+import asyncio
+import dataclasses
+import json
+import pathlib
+import sys
+import typing
+import uuid
+
+import typer
+from ag_ui import core as agui_core
+from pydantic_ai.ui import ag_ui as ai_ag_ui
+from sqlalchemy.ext import asyncio as sqla_asyncio
+
+from soliplex import agents
+from soliplex import installation
+from soliplex import loggers
+from soliplex import models
+from soliplex import util
+from soliplex.agui import persistence as agui_persistence
+from soliplex.agui import schema as agui_schema
+from soliplex.cli import cli_util
+from soliplex.cli import types
+
+app = typer.Typer()
+
+
+@dataclasses.dataclass
+class _AskResult:
+    thread_id: str
+    ok: bool
+    response: str | None = None
+    usage: typing.Any = None
+    error: str | None = None
+
+
+def _fail(json_output: bool, message: str) -> typing.NoReturn:
+    """Report a failure on stderr and exit non-zero.
+
+    Keeps the success channel (stdout) clean for scripting: diagnostics go
+    to stderr, either as a human line or a ``{"error": ...}`` object under
+    ``--json``.
+    """
+    if json_output:
+        print(json.dumps({"error": message}), file=sys.stderr)
+    else:
+        typer.echo(f"Error: {message}", err=True)
+    raise typer.Exit(1)
+
+
+def _check_room_id(the_installation, room_id, json_output):
+    room_configs = the_installation._config.room_configs
+    if room_id in room_configs:
+        return
+
+    configured = ", ".join(sorted(room_configs)) or "(none)"
+    _fail(
+        json_output,
+        f"No room configured with id '{room_id}'. "
+        f"Configured rooms: {configured}",
+    )
+
+
+def _usage_as_dict(usage) -> dict:
+    if usage is None:
+        return {}
+    return {
+        "input_tokens": usage.input_tokens,
+        "output_tokens": usage.output_tokens,
+    }
+
+
+async def _create_thread_run(engine, *, user_name, email, room_id):
+    """Create a persisted thread with its initial run; return their ids."""
+    async with sqla_asyncio.AsyncSession(bind=engine) as session:
+        async with session.begin():
+            thread = await agui_persistence.ThreadStorage(session).new_thread(
+                user_name=user_name,
+                email=email,
+                room_id=room_id,
+                initial_run=True,
+            )
+            (run,) = await thread.list_runs()
+            return thread.thread_id, run.run_id
+
+
+async def _add_run_input(
+    engine, *, user_name, room_id, thread_id, run_id, run_input
+):
+    async with sqla_asyncio.AsyncSession(bind=engine) as session:
+        async with session.begin():
+            await agui_persistence.ThreadStorage(session).add_run_input(
+                user_name=user_name,
+                room_id=room_id,
+                thread_id=thread_id,
+                run_id=run_id,
+                run_input=run_input,
+            )
+
+
+async def _run_ask(the_installation, room_id, prompt, claims) -> _AskResult:
+    """Run one room-agent turn over the AG-UI stream, auditing + persisting.
+
+    Skips per-room ACL enforcement (a trusted CLI operator), but records the
+    access and any RAG retrievals through the same audit log the web/MCP
+    paths use, and persists the thread/run/events so a future turn can build
+    on them.
+    """
+    user = models.UserProfile.from_user_claims(claims)
+    user_name = claims["actor"]
+
+    agent = await the_installation.get_agent_for_room(
+        room_id=room_id,
+        user=user,
+    )
+    room_config = await the_installation.get_room_config(
+        room_id=room_id,
+        user=user,
+    )
+
+    engine = installation._create_async_engine(
+        the_installation.thread_persistence_dburi_async,
+        json_serializer=util.serialize_sqla_json,
+        pool_pre_ping=True,
+    )
+    try:
+        async with engine.begin() as connection:
+            await connection.run_sync(agui_schema.Base.metadata.create_all)
+
+        thread_id, run_id = await _create_thread_run(
+            engine,
+            user_name=user_name,
+            email="<unknown>",
+            room_id=room_id,
+        )
+
+        audit = loggers.RoomAccessAuditLog(
+            claims=claims,
+            room_id=room_id,
+            thread_id=thread_id,
+            run_id=run_id,
+        )
+        # Record the access *before* the run begins, so an aborted or
+        # crashed run still leaves a trace that the agent was invoked.
+        audit.room_access_allowed(room_id)
+
+        run_input = agui_core.RunAgentInput(
+            thread_id=thread_id,
+            run_id=run_id,
+            state={},
+            messages=[
+                agui_core.UserMessage(
+                    id=uuid.uuid4().hex,
+                    role="user",
+                    content=prompt,
+                ),
+            ],
+            tools=(),
+            context=(),
+            forwarded_props=None,
+        )
+        await _add_run_input(
+            engine,
+            user_name=user_name,
+            room_id=room_id,
+            thread_id=thread_id,
+            run_id=run_id,
+            run_input=run_input,
+        )
+
+        deps = await the_installation.get_agent_deps_for_room(
+            room_id=room_id,
+            user=user,
+            run_agent_input=run_input,
+        )
+        adapter = ai_ag_ui.AGUIAdapter(
+            agent=agent,
+            run_input=run_input,
+            accept=None,
+        )
+
+        captured: dict = {}
+
+        async def _on_complete(result):
+            captured["usage"] = getattr(result, "usage", None)
+            await agui_persistence.capture_usage_after_stream(
+                result,
+                sqla_engine=engine,
+                user_name=user_name,
+                room_id=room_id,
+                thread_id=thread_id,
+                run_id=run_id,
+            )
+
+        text_parts: list[str] = []
+        last_event = None
+        try:
+            async for event in agui_persistence.drive_agui_turn(
+                adapter=adapter,
+                skill_toolset=agents.find_skill_toolset(agent),
+                engine=engine,
+                user_name=user_name,
+                room_id=room_id,
+                thread_id=thread_id,
+                run_id=run_id,
+                claims=claims,
+                rag_db_paths=room_config.rag_db_paths,
+                run_stream_kwargs=dict(
+                    deps=deps,
+                    conversation_id=thread_id,
+                    on_complete=_on_complete,
+                ),
+            ):
+                if event.type == agui_core.EventType.TEXT_MESSAGE_CONTENT:
+                    text_parts.append(event.delta)
+                last_event = event
+
+            await agui_persistence.finish_run(
+                engine,
+                user_name=user_name,
+                room_id=room_id,
+                thread_id=thread_id,
+                run_id=run_id,
+            )
+        except Exception as exc:
+            audit.run_failed(str(exc))
+            raise
+    finally:
+        await engine.dispose()
+
+    if last_event is not None and (
+        last_event.type == agui_core.EventType.RUN_FINISHED
+    ):
+        audit.run_finished()
+        return _AskResult(
+            thread_id=thread_id,
+            ok=True,
+            response="".join(text_parts),
+            usage=captured.get("usage"),
+        )
+
+    if last_event is not None and (
+        last_event.type == agui_core.EventType.RUN_ERROR
+    ):
+        reason = last_event.message
+    else:
+        reason = "the run produced no result"
+    audit.run_failed(reason)
+    return _AskResult(thread_id=thread_id, ok=False, error=reason)
+
+
+@app.command("ask")
+def ask(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+    room_id: str,
+    prompt: str,
+    json_output: bool = typer.Option(
+        False,
+        "--json",
+        help=(
+            "Emit a JSON object (room_id, thread_id, prompt, response, "
+            "usage) instead of the plain-text response."
+        ),
+    ),
+    cli_log_config: pathlib.Path | None = cli_util.CLI_LOG_CONFIG_OPTION,
+):
+    """Send a single prompt to a room's agent and print the response.
+
+    Runs the room's agent in-process, skipping per-room ACL enforcement (a
+    trusted operator), but records the access -- and any RAG retrievals --
+    through the audit log (enable it with ``--cli-log-config``), and
+    persists the thread/run so a follow-up turn can build on it. Exits 0 on
+    success (response on stdout) and non-zero on failure (diagnostic on
+    stderr), so the call can be scripted.
+    """
+    cli_util._configure_cli_logging(cli_log_config)
+
+    the_installation = cli_util.get_installation(installation_path)
+
+    _check_room_id(the_installation, room_id, json_output)
+
+    claims = cli_util._audit_claims()
+
+    try:
+        the_installation.resolve_secrets()
+        the_installation.resolve_environment()
+        result = asyncio.run(
+            _run_ask(the_installation, room_id, prompt, claims)
+        )
+    except Exception as exc:
+        _fail(json_output, str(exc))
+
+    if not result.ok:
+        _fail(json_output, result.error)
+
+    if json_output:
+        print(
+            json.dumps(
+                {
+                    "room_id": room_id,
+                    "thread_id": result.thread_id,
+                    "prompt": prompt,
+                    "response": result.response,
+                    "usage": _usage_as_dict(result.usage),
+                }
+            )
+        )
+    else:
+        print(result.response)

{soliplex-0.71 → soliplex-0.72}/src/soliplex/cli/main.py

@@ -12,6 +12,7 @@ import yaml
 from soliplex import secrets
 from soliplex import util
 from soliplex.cli import admin_users
+from soliplex.cli import ask
 from soliplex.cli import audit
 from soliplex.cli import cli_util
 from soliplex.cli import ollama
@@ -81,6 +82,7 @@ _hidden_alias("add-admin-user", admin_users.add_admin_user)
 _hidden_alias("show-room-authz", room_authz.show_room_authz)
 
 the_cli.add_typer(serve.app)
+the_cli.add_typer(ask.app)
 the_cli.add_typer(audit.app)
 the_cli.add_typer(admin_users.app)
 the_cli.add_typer(room_authz.app)
@@ -158,5 +160,5 @@ def shell(
 
 the_cli.add_typer(misc_app)
 
-if __name__ == "__main__":
+if __name__ == "__main__":  # pragma NO COVER
     the_cli()

{soliplex-0.71 → soliplex-0.72}/src/soliplex/cli/serve.py

@@ -218,15 +218,21 @@ Passing this option now fails with a non-zero exit.
 
     reload_dirs = [str(rd) for rd in reload_dirs]
 
+    # 'soliplex.main.app_with_session' reads this env var in-process to
+    # decide the session cookie's 'Secure' attribute, so set it for both
+    # run paths (not just the uvicorn-factory contract below).
+    if insecure_session_cookie:
+        os.environ["_SOLIPLEX_INSECURE_SESSION_COOKIE"] = "Y"
+
     if reload or workers:
         # Work around uvicorn's aversion to passing arguments to the app
         # factory.
         #
         # N.B.:  The environment variables set here are a private contract
         #        between this command and the
-        #        'soliplex.main.create_app_from_environment'
-        #        function:  do not try setting them yourself, either
-        #        directly or via a '.env' file.
+        #        'soliplex.main.create_app_from_environment' /
+        #        'soliplex.main.app_with_session' functions:  do not try
+        #        setting them yourself, either directly or via a '.env' file.
         os.environ["_SOLIPLEX_INSTALLATION_PATH"] = str(installation_path)
 
         if no_auth_mode:
@@ -235,9 +241,6 @@ Passing this option now fails with a non-zero exit.
         if log_config is not None:  # pass to the app, disable Uvicorn.
             os.environ["_SOLIPLEX_LOG_CONFIG_FILE"] = str(log_config)
 
-        if insecure_session_cookie:
-            os.environ["_SOLIPLEX_INSECURE_SESSION_COOKIE"] = "Y"
-
         if app_factory_name is None:
             app_factory_name = "soliplex.main:create_app_from_environment"
 
@@ -257,6 +260,5 @@ Passing this option now fails with a non-zero exit.
             installation_path=installation_path,
             no_auth_mode=no_auth_mode,
             log_config_file=log_config,
-            session_https_only=not insecure_session_cookie,
         )
         uvicorn.run(app, **uvicorn_kw)