soliplex 0.82__tar.gz → 0.83__tar.gz

{soliplex-0.82/src/soliplex.egg-info → soliplex-0.83}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soliplex
-Version: 0.82
+Version: 0.83
 Summary: An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface.
 Author-email: Enfold <info@enfoldsystems.net>
 Classifier: Programming Language :: Python :: 3
@@ -19,7 +19,7 @@ Requires-Dist: fastapi
 Requires-Dist: fastmcp<5.0,>=4.0.2
 Requires-Dist: fakeredis!=2.35.0
 Requires-Dist: greenlet
-Requires-Dist: haiku.rag-slim<0.85,>=0.84.0
+Requires-Dist: haiku.rag-slim<0.88,>=0.87.0
 Requires-Dist: idna>=3.15
 Requires-Dist: itsdangerous
 Requires-Dist: joserfc<1.7,>=1.6.7
@@ -41,6 +41,10 @@ Requires-Dist: sqlmodel
 Requires-Dist: starlette>=1.3.1
 Requires-Dist: uvicorn[standard]
 Requires-Dist: certifi>=2025.11.12
+Provides-Extra: postgres
+Requires-Dist: psycopg; extra == "postgres"
+Provides-Extra: postgres-binary
+Requires-Dist: psycopg[binary]; extra == "postgres-binary"
 Dynamic: license-file
 
 # Soliplex

{soliplex-0.82 → soliplex-0.83}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "soliplex"
-version = "0.82"
+version = "0.83"
 description = "An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface."
 authors = [{ name = "Enfold", email = "info@enfoldsystems.net" }]
 readme = "README.md"
@@ -25,7 +25,7 @@ dependencies = [
     "fastmcp >= 4.0.2, < 5.0",
     "fakeredis != 2.35.0",  # brownbag
     "greenlet",
-    "haiku.rag-slim >= 0.84.0, < 0.85",
+    "haiku.rag-slim >= 0.87.0, < 0.88",
     "idna >= 3.15",
     "itsdangerous",
     "joserfc >= 1.6.7, < 1.7",  # CVE-2026-48990
@@ -49,6 +49,24 @@ dependencies = [
     "certifi >= 2025.11.12",
 ]
 
+# Database drivers are not dependencies:  soliplex imports none of them,
+# and SQLAlchemy loads one only when a DBURI names it.  An installation
+# using PostgreSQL picks one of these (see 'docs/config/dburis.md').
+# psycopg serves both the sync and the async DBURIs
+# ('postgresql+psycopg://').
+[project.optional-dependencies]
+# psycopg's pure-Python implementation, over the host's own libpq (and so
+# the host's OpenSSL):  for containers and FIPS hosts.  Needs 'libpq5' (or
+# equivalent) installed; no compiler.
+postgres = [
+    "psycopg",
+]
+# psycopg with its own bundled libpq and OpenSSL:  nothing needed on the
+# host, e.g. for development.
+postgres-binary = [
+    "psycopg[binary]",
+]
+
 [project.scripts]
 soliplex-cli = "soliplex.cli.main:main"
 soliplex-tui = "soliplex.tui.cli:the_cli"
@@ -68,10 +86,6 @@ dev = [
 docs = [
     "zensical>=0.0.43",
 ]
-postgres = [
-    "psycopg[binary]",  # synchronous access
-    "asyncpg",          # async access
-]
 tui = [
     "textual",
     "textual-serve",
@@ -103,6 +117,7 @@ omit = [
     "scripts/lint_textio.py",   # runs its own '--self-test' during lint
     "scripts/lint_interpolation.py",  # ditto
     "scripts/lint_alembic_chain.py",  # ditto
+    "scripts/lint_postgres_drivers.py",  # ditto
     # Run-once deployment repair (issue #1367), applied by hand against a
     # live database and verified there; like a migration script, it is not
     # exercised by the unit suite.

{soliplex-0.82 → soliplex-0.83}/src/soliplex/agents.py

@@ -4,7 +4,6 @@ import dataclasses
 import typing
 
 import pydantic_ai
-from haiku.rag.capabilities import analysis as hr_caps_analysis
 from haiku.rag.capabilities import rag as hr_caps_rag
 from pydantic_ai import agent as ai_agent
 from pydantic_ai import capabilities as ai_capabilities
@@ -21,11 +20,6 @@ from soliplex.config import tools as config_tools
 
 ToolConfigMap = dict[str, typing.Any]
 
-# Capabilities which take 'vision' from agent config's 'multimodal'
-HR_VisionCapabilities = (
-    hr_caps_rag.RAGCapability | hr_caps_analysis.AnalysisCapability
-)
-
 
 class CapabilityConfig(typing.Protocol):
     """Room-specific native capabilities and their audit targets."""
@@ -136,12 +130,12 @@ def get_default_agent_from_configs(
                 )
             )
 
-    # RAG/analysis capabilities attach picture chunks to search results as
+    # The RAG capability attaches picture chunks to search results as
     # images only when the receiving model accepts them. That model is this
     # agent's model, not haiku.rag's configured model, so gate on the room
     # agent's declared multimodality.
     for capability in capabilities:
-        if isinstance(capability, HR_VisionCapabilities):
+        if isinstance(capability, hr_caps_rag.RAGCapability):
             capability.vision = agent_config.multimodal
 
     # A hook-only capability is never deferred:  nothing would load it, and

soliplex-0.83/src/soliplex/cli/audit/__init__.py

@@ -0,0 +1,128 @@
+from __future__ import annotations
+
+import pathlib
+
+import typer
+from typer import core as typer_core
+
+from soliplex.cli import cli_util
+from soliplex.cli import types
+from soliplex.cli.audit import _common as audit_common
+from soliplex.cli.audit import admin_users as audit_admin_users
+from soliplex.cli.audit import completions as audit_completions
+from soliplex.cli.audit import databases as audit_databases
+from soliplex.cli.audit import environment as audit_environment
+from soliplex.cli.audit import installation as audit_installation
+from soliplex.cli.audit import logfire as audit_logfire
+from soliplex.cli.audit import logging as audit_logging
+from soliplex.cli.audit import oidc as audit_oidc
+from soliplex.cli.audit import ollama as audit_ollama
+from soliplex.cli.audit import quizzes as audit_quizzes
+from soliplex.cli.audit import room_authz as audit_room_authz
+from soliplex.cli.audit import rooms as audit_rooms
+from soliplex.cli.audit import secrets as audit_secrets
+from soliplex.cli.audit import skills as audit_skills
+
+AUDIT_HELP = "Audit a Soliplex installation configuration"
+
+
+_QUIET_OPTION = typer.Option(
+    False,
+    "-q",
+    "--quiet",
+    help="Show only errors",
+)
+
+
+class _AuditGroup(typer_core.TyperGroup):
+    """Default to the 'all' subcommand when none is given.
+
+    Allows 'soliplex-cli audit', 'soliplex-cli audit -q', and
+    'soliplex-cli audit <path>' as shorthands for the corresponding
+    'soliplex-cli audit all ...' invocation. The path-less forms rely
+    on Typer's ``SOLIPLEX_INSTALLATION_PATH`` envvar fallback on
+    'audit all'.
+    """
+
+    def parse_args(self, ctx, args):
+        for i, token in enumerate(args):
+            if token.startswith("-"):
+                continue
+            if token not in self.commands:
+                args = [*args[:i], "all", *args[i:]]
+            break
+        else:
+            args = [*args, "all"]
+        return super().parse_args(ctx, args)
+
+
+app = typer.Typer(
+    name="audit",
+    help=AUDIT_HELP,
+    cls=_AuditGroup,
+)
+
+
+@app.callback()
+def _audit_callback(
+    ctx: typer.Context,
+    quiet: bool = _QUIET_OPTION,
+    cli_log_config: pathlib.Path | None = cli_util.CLI_LOG_CONFIG_OPTION,
+):
+    cli_util._configure_cli_logging(cli_log_config)
+    ctx.obj = {"quiet": quiet}
+
+
+@app.command(
+    "all",
+    help=AUDIT_HELP,
+)
+def audit_all(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+):
+    quiet = ctx.obj["quiet"]
+    errors: dict = {}
+
+    errors |= audit_installation._audit_installation_section(
+        ctx, installation_path
+    )
+    errors |= audit_secrets._audit_secrets_section(ctx, installation_path)
+    errors |= audit_environment._audit_environment_section(
+        ctx, installation_path
+    )
+    errors |= audit_oidc._audit_oidc_section(ctx, installation_path)
+    errors |= audit_rooms._audit_rooms_section(ctx, installation_path)
+    errors |= audit_databases._audit_databases_section(ctx, installation_path)
+    errors |= audit_admin_users._audit_admin_users_section(
+        ctx, installation_path
+    )
+    errors |= audit_room_authz._audit_room_authz_section(
+        ctx, installation_path
+    )
+    errors |= audit_completions._audit_completions_section(
+        ctx, installation_path
+    )
+    errors |= audit_quizzes._audit_quizzes_section(ctx, installation_path)
+    errors |= audit_skills._audit_skills_section(ctx, installation_path)
+    errors |= audit_logging._audit_logging_section(ctx, installation_path)
+    errors |= audit_logfire._audit_logfire_section(ctx, installation_path)
+    errors |= audit_ollama._audit_ollama_section(ctx, installation_path)
+
+    audit_common._emit_errors(errors, quiet)
+
+
+app.command("installation")(audit_installation.audit_installation)
+app.command("secrets")(audit_secrets.audit_secrets)
+app.command("environment")(audit_environment.audit_environment)
+app.command("oidc")(audit_oidc.audit_oidc_auth_providers)
+app.command("rooms")(audit_rooms.audit_rooms)
+app.command("databases")(audit_databases.audit_databases)
+app.command("admin-users")(audit_admin_users.audit_admin_users)
+app.command("room-authz")(audit_room_authz.audit_room_authz)
+app.command("completions")(audit_completions.audit_completions)
+app.command("quizzes")(audit_quizzes.audit_quizzes)
+app.command("skills")(audit_skills.audit_skills)
+app.command("logging")(audit_logging.audit_logging)
+app.command("logfire")(audit_logfire.audit_logfire)
+app.command("ollama")(audit_ollama.audit_ollama)

soliplex-0.83/src/soliplex/cli/audit/_common.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import sys
+import warnings
+
+import typer
+
+from soliplex import installation
+from soliplex.cli import cli_util
+from soliplex.cli import types
+from soliplex.config import installation as config_installation
+
+the_console = cli_util.the_console
+
+
+def _noop(*args, **kwargs):  # pragma: NO COVER
+    return None
+
+
+def _quiet_console_funcs(quiet):
+    """Return ``(line, rule, print, print_exception)`` callables.
+
+    When ``quiet`` is true the returned callables are no-ops, suppressing
+    human-focused output.
+    """
+    if quiet:
+        return _noop, _noop, _noop, _noop
+    return (
+        the_console.line,
+        the_console.rule,
+        the_console.print,
+        the_console.print_exception,
+    )
+
+
+def _emit_errors(errors, quiet):
+    """Emit a JSON error report (in quiet mode) and exit ``1`` if any."""
+    if errors:
+        if quiet:
+            the_console.print_json(data=errors)
+        sys.exit(1)
+
+
+def _get_installation(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+) -> installation.Installation:
+    """Load the installation once per invocation, caching on ``ctx.obj``.
+
+    Every warning raised while loading is recorded under
+    ``ctx.obj["config_warnings"]``.
+    """
+    cached = ctx.obj.get("the_installation")
+    if cached is None:
+        with warnings.catch_warnings(record=True) as caught:
+            warnings.simplefilter("always")
+            cached = cli_util.get_installation(
+                installation_path, auditing=True
+            )
+        ctx.obj["the_installation"] = cached
+        ctx.obj["config_warnings"] = caught
+    return cached
+
+
+def _get_installation_config(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+) -> config_installation.InstallationConfig:
+    """Load only the installation config once, caching on ``ctx.obj``.
+
+    Unlike '_get_installation', loads no OIDC, room, completion, quiz or
+    skill configs.  As there, missing environment variables are
+    tolerated, and every warning raised while loading is recorded under
+    ``ctx.obj["config_warnings"]``.
+    """
+    cached = ctx.obj.get("the_installation_config")
+    if cached is None:
+        with warnings.catch_warnings(record=True) as caught:
+            warnings.simplefilter("always")
+            cached = config_installation.load_installation(
+                cli_util.installation_config_path(installation_path)
+            )
+            try:
+                cached.resolve_environment()
+            except config_installation.MissingEnvVars:
+                pass
+        ctx.obj["the_installation_config"] = cached
+        ctx.obj["config_warnings"] = caught
+    return cached

soliplex-0.83/src/soliplex/cli/audit/admin_users.py

@@ -0,0 +1,142 @@
+from __future__ import annotations
+
+import asyncio
+
+import typer
+
+from soliplex import authz
+from soliplex.cli import cli_util
+from soliplex.cli import types
+from soliplex.cli.audit import _common as audit_common
+from soliplex.cli.audit import databases as audit_databases
+
+
+async def _list_admin_discriminators(the_installation):
+    async with cli_util._admin_user_policy(
+        the_installation, "audit admin-users", allow_ram=True, must_exist=True
+    ) as policy:
+        return await policy.list_admin_user_discriminators()
+
+
+def _admin_user_json_paths(
+    the_installation,
+) -> tuple[list[str], str | None]:
+    """Return ``(json_paths, error)`` for the stored admin rows.
+
+    ``json_paths`` holds every stored 'AdminUser.json_path', in insertion
+    order, read via 'AdminUserPolicy.list_admin_user_discriminators';
+    ``error`` is ``None`` on success. A database nothing has created yet
+    -- including an in-memory one -- holds no admin rows, so it reports
+    ``([], None)`` rather than creating a schema to read from.
+
+    When the database itself cannot be reached -- e.g. its DBURI names a
+    Postgres server that isn't listening -- ``json_paths`` is empty and
+    ``error`` carries the exception message, so the audit can report the
+    unreachable DB instead of dying on the traceback.
+    """
+    try:
+        return (
+            list(asyncio.run(_list_admin_discriminators(the_installation))),
+            None,
+        )
+    except cli_util.DatabaseNotCreated:
+        # As above: no schema means nothing to audit.
+        return [], None
+    except Exception as exc:
+        return [], f"{type(exc).__name__}: {exc}"
+
+
+def _invalid_admin_user_json_paths(
+    json_paths,
+) -> list[tuple[str, str]]:
+    """Collect admin entries whose 'json_path' fails to validate.
+
+    Same intent as '_invalid_acl_json_paths' but for the 'AdminUser'
+    table: a row typically lands here when it was authored under a
+    meta-config that registered filter functions which are no longer
+    present. ``json_paths`` is the list from '_admin_user_json_paths'.
+
+    Returns a list of '(json_path, error)' pairs.
+    """
+    invalid: list[tuple[str, str]] = []
+    for json_path in json_paths:
+        try:
+            authz.validate_json_path(json_path)
+        except authz.InvalidJSONPath as exc:
+            invalid.append((json_path, str(exc)))
+    return invalid
+
+
+def _audit_admin_users_section(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+) -> dict:  # pragma NO COVER UI ONLY
+    """Print the admin-users section (rule header + listing + invalid)."""
+    quiet = ctx.obj["quiet"]
+    the_installation = audit_common._get_installation(ctx, installation_path)
+    tc_line, tc_rule, tc_print, _ = audit_common._quiet_console_funcs(quiet)
+
+    tc_line()
+    tc_rule("Configured admin users")
+    tc_line()
+
+    report = audit_databases._database_reports(ctx, the_installation._config)[
+        cli_util.AUTHZ
+    ]
+    if report.error is not None:
+        if ctx.obj.get("databases_audited"):
+            tc_print(audit_databases._SEE_DATABASES)
+            tc_line()
+            return {}
+        tc_print(f"ERROR: authorization database unreachable: {report.error}")
+        tc_line()
+        return {"admin_users": {"unreachable": report.error}}
+
+    json_paths, db_error = _admin_user_json_paths(the_installation)
+    if db_error is not None:
+        tc_print(f"ERROR: authorization database unreachable: {db_error}")
+        tc_line()
+        return {"admin_users": {"unreachable": db_error}}
+
+    tc_print(f"Admin users ({len(json_paths)}):")
+    if json_paths:
+        for json_path in json_paths:
+            parsed = authz.parse_token_field_json_path(json_path)
+            if parsed is not None:
+                field, value = parsed
+                tc_print(f"  - {field}={value}")
+            else:
+                tc_print(f"  - json_path={json_path}")
+    else:
+        tc_print("  (none)")
+    tc_line()
+
+    invalid = _invalid_admin_user_json_paths(json_paths)
+    tc_print("Admin users with invalid JSONPath:")
+    if invalid:
+        for json_path, error in invalid:
+            tc_print(f"  - {json_path}  ({error})")
+    else:
+        tc_print("  (none)")
+    tc_line()
+
+    errors: dict = {}
+    if invalid:
+        errors["admin_users"] = {"invalid_json_paths": invalid}
+    return errors
+
+
+def audit_admin_users(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+):  # pragma NO COVER command
+    """List configured admin users and flag any with invalid JSONPath.
+
+    Each stored 'AdminUser.json_path' is re-validated against the
+    currently-loaded JSONPath environment. An entry whose query no
+    longer compiles (e.g. because the meta-config filter function it
+    referenced has been removed) is reported as an audit error.
+    """
+    quiet = ctx.obj["quiet"]
+    errors = _audit_admin_users_section(ctx, installation_path)
+    audit_common._emit_errors(errors, quiet)

soliplex-0.83/src/soliplex/cli/audit/completions.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import typer
+
+from soliplex import installation
+from soliplex import models
+from soliplex.cli import types
+from soliplex.cli.audit import _common as audit_common
+from soliplex.cli.audit import interpolation as audit_interpolation
+
+
+def _invalid_completions(
+    the_installation: installation.Installation,
+) -> dict:
+    errors = {}
+
+    # Deliberately bypass auth check done by 'get_room_configs' here.
+    available_completions = the_installation._config.completion_configs
+
+    for compl_config in available_completions.values():
+        try:
+            models.Completion.from_config(compl_config)
+        except Exception as exc:
+            errors.setdefault("completions", {})[compl_config.id] = str(exc)
+
+    return errors
+
+
+def _audit_completions_section(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+) -> dict:  # pragma NO COVER UI ONLY
+    """Print the completions section (rule header + per-completion entry)."""
+    quiet = ctx.obj["quiet"]
+    the_installation = audit_common._get_installation(ctx, installation_path)
+    tc_line, tc_rule, tc_print, _ = audit_common._quiet_console_funcs(quiet)
+
+    tc_line()
+    tc_rule("Configured completions")
+    tc_line()
+
+    errors = _invalid_completions(the_installation)
+    invalid_completions = errors.get("completions", {})
+
+    available_completions = the_installation._config.completion_configs
+    for compl_config in available_completions.values():
+        tc_print(f"- [ {compl_config.id} ] {compl_config.name}: ")
+        exc = invalid_completions.get(compl_config.id)
+        if exc is not None:
+            tc_print(f"  ERROR: {exc}")
+        else:
+            tc_print("  OK")
+        tc_line()
+
+    interpolation_errors = (
+        audit_interpolation._invalid_completion_interpolations(
+            the_installation
+        )
+    )
+    audit_interpolation._print_interpolation_findings(
+        tc_print, interpolation_errors
+    )
+
+    return errors | interpolation_errors
+
+
+def audit_completions(
+    ctx: typer.Context,
+    installation_path: types.installation_path_type,
+):  # pragma NO COVER command
+    """List completions defined in the installation"""
+    quiet = ctx.obj["quiet"]
+    errors = _audit_completions_section(ctx, installation_path)
+    audit_common._emit_errors(errors, quiet)