soliplex 0.83.4__tar.gz → 0.85__tar.gz

{soliplex-0.83.4/src/soliplex.egg-info → soliplex-0.85}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soliplex
-Version: 0.83.4
+Version: 0.85
 Summary: An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface.
 Author-email: Enfold <info@enfoldsystems.net>
 Classifier: Programming Language :: Python :: 3
@@ -13,13 +13,14 @@ Requires-Dist: aiohttp<3.15,>=3.14.2
 Requires-Dist: aiosqlite
 Requires-Dist: alembic<1.19,>=1.18.4
 Requires-Dist: authlib
-Requires-Dist: bubble-sandbox<0.13,>=0.12.0
+Requires-Dist: bubble-sandbox<0.14,>=0.13.0
+Requires-Dist: packaging
 Requires-Dist: cryptography>=50.0.0
 Requires-Dist: fastapi
 Requires-Dist: fastmcp<5.0,>=4.0.2
 Requires-Dist: fakeredis!=2.35.0
 Requires-Dist: greenlet
-Requires-Dist: haiku.rag-slim<0.88,>=0.87.0
+Requires-Dist: haiku.rag-slim<0.96,>=0.95.0
 Requires-Dist: idna>=3.15
 Requires-Dist: itsdangerous
 Requires-Dist: joserfc<1.7,>=1.6.7
@@ -33,7 +34,7 @@ Requires-Dist: logfire[fastapi]
 Requires-Dist: pyasn1>=0.6.4
 Requires-Dist: pydantic-ai-slim[google]<3.0,>=2.40.0
 Requires-Dist: pydantic-settings<2.15,>=2.14.2
-Requires-Dist: pyjwt<2.14,>=2.13.0
+Requires-Dist: pyjwt<2.16,>=2.15.0
 Requires-Dist: pymdown-extensions>=11.0.0
 Requires-Dist: python-keycloak
 Requires-Dist: skills-ref

{soliplex-0.83.4 → soliplex-0.85}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "soliplex"
-version = "0.83.4"
+version = "0.85"
 description = "An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface."
 authors = [{ name = "Enfold", email = "info@enfoldsystems.net" }]
 readme = "README.md"
@@ -19,13 +19,14 @@ dependencies = [
     "aiosqlite",
     "alembic >= 1.18.4, < 1.19",
     "authlib",
-    "bubble-sandbox >= 0.12.0, < 0.13",
+    "bubble-sandbox >= 0.13.0, < 0.14",
+    "packaging",
     "cryptography >= 50.0.0",  # PYSEC-2026-3552
     "fastapi",
     "fastmcp >= 4.0.2, < 5.0",
     "fakeredis != 2.35.0",  # brownbag
     "greenlet",
-    "haiku.rag-slim >= 0.87.0, < 0.88",
+    "haiku.rag-slim >= 0.95.0, < 0.96",
     "idna >= 3.15",
     "itsdangerous",
     "joserfc >= 1.6.7, < 1.7",  # CVE-2026-48990
@@ -39,7 +40,7 @@ dependencies = [
     "pyasn1 >= 0.6.4",  # PYSEC-2026-3456
     "pydantic-ai-slim[google] >= 2.40.0, < 3.0",
     "pydantic-settings >= 2.14.2, < 2.15",  # GHSA-4xgf-cpjx-pc3j
-    "pyjwt >= 2.13.0, < 2.14",  # PYSEC-2026-{175,177,178,179}
+    "pyjwt >= 2.15.0, < 2.16",  # CVE-2026-102275
     "pymdown-extensions >= 11.0.0",  # CVE-2026-61632
     "python-keycloak",
     "skills-ref",

{soliplex-0.83.4 → soliplex-0.85}/src/soliplex/agents.py

@@ -17,6 +17,7 @@ from soliplex import models
 from soliplex.capabilities import rag_audit as cap_rag_audit
 from soliplex.config import agents as config_agents
 from soliplex.config import tools as config_tools
+from soliplex.skills import bwrap_sandbox
 
 ToolConfigMap = dict[str, typing.Any]
 
@@ -138,6 +139,12 @@ def get_default_agent_from_configs(
         if isinstance(capability, hr_caps_rag.RAGCapability):
             capability.vision = agent_config.multimodal
 
+    # 'read_image' returns an image to the model, so a room whose model
+    # cannot accept one should not see the tool at all.
+    for capability in capabilities:
+        if isinstance(capability, bwrap_sandbox.SandboxCapability):
+            capability.multimodal = agent_config.multimodal
+
     # A hook-only capability is never deferred:  nothing would load it, and
     # its hooks only fire once loaded.
     for capability in capabilities:

{soliplex-0.83.4 → soliplex-0.85}/src/soliplex/config/installation.py

@@ -315,13 +315,15 @@ class SandboxConfig:
             return None
 
     @property
-    def workdirs_path(self) -> pathlib.Path:
-        """Directory holding "workdirs" for each run
+    def workdirs_path(self) -> pathlib.Path | None:
+        """Directory holding each thread's sandbox workspace
 
-        A workdir will be named with the run ID, with parent directories
-        for the room ID and thread ID.
+        Named with the thread ID, under a directory for the room ID.  The
+        workspace persists across the thread's turns, and the workdirs
+        endpoint serves the files at its top level.
 
-        If not set, the sandox workdir will be a temporary directory.
+        If not set, each command gets a temporary directory instead, which
+        is discarded when it ends and which the endpoint cannot serve.
         """
         if self._config_path is not None and self._workdirs_path is not None:
             return (self._config_path.parent / self._workdirs_path).resolve()

{soliplex-0.83.4 → soliplex-0.85}/src/soliplex/config/routing.py

@@ -5,6 +5,7 @@ import pathlib
 import typing
 
 import fastapi
+from bubble_sandbox import sandbox as bs_sandbox
 
 from . import _utils
 from . import exceptions as config_exc
@@ -230,7 +231,6 @@ _DEFAULT_ROUTER_NAMES = {
     "completions": "soliplex.views.completions.router",
     "room_file_uploads": "soliplex.views.room_file_uploads.router",
     "thread_file_uploads": "soliplex.views.thread_file_uploads.router",
-    "sandbox_workdirs": "soliplex.views.sandbox_workdirs.router",
     "installation": "soliplex.views.installation.router",
     "log_ingest": "soliplex.views.log_ingest.router",
     "quizzes": "soliplex.views.quizzes.router",
@@ -239,8 +239,21 @@ _DEFAULT_ROUTER_NAMES = {
 }
 
 
+# Routers serving what the bubblewrap sandbox leaves behind, mounted only
+# where 'bwrap' can run.
+_BWRAP_ROUTER_NAMES = {
+    "sandbox_workdirs": "soliplex.views.sandbox_workdirs.router",
+}
+
+
+def _default_router_names() -> dict[str, str]:
+    if bs_sandbox.is_available():
+        return _DEFAULT_ROUTER_NAMES | _BWRAP_ROUTER_NAMES
+    return dict(_DEFAULT_ROUTER_NAMES)
+
+
 def register_default_routers():
-    for group_name, router_name in _DEFAULT_ROUTER_NAMES.items():
+    for group_name, router_name in _default_router_names().items():
         router = _utils._from_dotted_name(router_name)
         APP_ROUTERS_BY_GROUP_NAME[group_name] = (
             router,

{soliplex-0.83.4 → soliplex-0.85}/src/soliplex/config/skills.py

@@ -10,6 +10,7 @@ import typing
 import pydantic
 from bubble_sandbox import config as bs_config
 from bubble_sandbox import models as bs_models
+from bubble_sandbox import sandbox as bs_sandbox
 from haiku.rag.capabilities import compaction as hr_compaction
 from haiku.rag.capabilities import policy as hr_policy
 from haiku.rag.capabilities import rag as hr_rag
@@ -31,6 +32,11 @@ _default_list_field = _utils._default_list_field
 _no_repr_no_compare_none = _utils._no_repr_no_compare_none
 
 
+# Applied when the room sets no limit.
+DEFAULT_EXECUTION_TIMEOUT_SECONDS = 30.0
+DEFAULT_MAX_OUTPUT_CHARS = 10_000
+
+
 class InvalidSkillKind(KeyError):
     def __init__(
         self,
@@ -49,6 +55,23 @@ class InvalidSkillKind(KeyError):
         )
 
 
+class BwrapSandboxUnavailable(RuntimeError):
+    def __init__(
+        self,
+        *,
+        skill_kind: str,
+        reason: bs_sandbox.SandboxUnavailable,
+        _config_path: pathlib.Path | None,
+    ):
+        self.skill_kind = skill_kind
+        self.reason = reason
+        self._config_path = _config_path
+        super().__init__(
+            f"Skill kind '{skill_kind}' cannot run on this host: {reason} "
+            f"(configured in {_config_path})",
+        )
+
+
 class MissingSkillNames(KeyError):
     def __init__(
         self,
@@ -369,9 +392,10 @@ class BwrapSandboxSkillConfig:
     _config_path: pathlib.Path | None = None
 
     id: str | None = None
-    default_environment: str = "bare"
-    allowed_environments: bwrap_sandbox.AllowedEnvironments = None
-    sandbox_config: bs_config.Config = None
+    environment: str = "bare"
+    # Unset means "whatever the default is", not its value today.
+    execution_timeout_seconds: float | None = None
+    max_output_chars: int | None = None
     volumes: bs_models.VolumeMap = _default_dict_field()
     defer_loading: bool = False
 
@@ -386,10 +410,6 @@ class BwrapSandboxSkillConfig:
             config_dict.pop("kind", None)
             config_dict["_installation_config"] = installation_config
             config_dict["_config_path"] = config_path
-            config_dict["sandbox_config"] = bs_config.Config(
-                config_file_path=config_path,
-                **config_dict.pop("sandbox_config", {}),
-            )
             config_dict["volumes"] = {
                 key: bs_models.VolumeInfo(**value)
                 for key, value in config_dict.pop("volumes", {}).items()
@@ -402,12 +422,45 @@ class BwrapSandboxSkillConfig:
                 config_dict,
             ) from exc
 
+    @property
+    def sandbox_config(self) -> bs_config.Config:
+        timeout = self.execution_timeout_seconds
+        max_chars = self.max_output_chars
+        return bs_config.Config(
+            config_file_path=self._config_path,
+            execution_timeout_seconds=(
+                timeout
+                if timeout is not None
+                else DEFAULT_EXECUTION_TIMEOUT_SECONDS
+            ),
+            max_output_chars=(
+                max_chars
+                if max_chars is not None
+                else DEFAULT_MAX_OUTPUT_CHARS
+            ),
+        )
+
     @property
     def capability(self) -> bwrap_sandbox.SandboxCapability:
+        """Build the sandbox capability.
+
+        Raises:
+
+        - 'BwrapSandboxUnavailable' on a host where 'bwrap' cannot run,
+          as reported by 'bubble_sandbox.sandbox.check_available'.
+        """
+        try:
+            bs_sandbox.check_available()
+        except bs_sandbox.SandboxUnavailable as exc:
+            raise BwrapSandboxUnavailable(
+                skill_kind=self.kind,
+                reason=exc,
+                _config_path=self._config_path,
+            ) from exc
+
         return bwrap_sandbox.create_bwrap_sandbox_capability(
             id=self.id,
-            default_environment=self.default_environment,
-            allowed_environments=self.allowed_environments,
+            environment=self.environment,
             sandbox_config=self.sandbox_config,
             volumes=self.volumes,
             installation_config=self._installation_config,
@@ -418,22 +471,17 @@ class BwrapSandboxSkillConfig:
     def as_yaml(self) -> dict:
         result = {
             "kind": self.kind,
-            "default_environment": self.default_environment,
+            "environment": self.environment,
             "defer_loading": self.defer_loading,
         }
         if self.id is not None:
             result["id"] = self.id
-        if self.allowed_environments is not None:
-            result["allowed_environments"] = self.allowed_environments
-        if self.sandbox_config is not None:
-            config = self.sandbox_config
-            result["sandbox_config"] = {
-                "environments_pathname": config.environments_pathname,
-                "execution_timeout_seconds": (
-                    config.execution_timeout_seconds
-                ),
-                "max_output_chars": config.max_output_chars,
-            }
+        if self.execution_timeout_seconds is not None:
+            result["execution_timeout_seconds"] = (
+                self.execution_timeout_seconds
+            )
+        if self.max_output_chars is not None:
+            result["max_output_chars"] = self.max_output_chars
         if self.volumes:
             result["volumes"] = {
                 key: {
@@ -446,10 +494,7 @@ class BwrapSandboxSkillConfig:
 
     @property
     def extra_parameters(self) -> dict[str, typing.Any]:
-        result = {"default_environment": self.default_environment}
-        if self.allowed_environments is not None:
-            result["allowed_environments"] = self.allowed_environments
-        return result
+        return {"environment": self.environment}
 
 
 @dataclasses.dataclass(kw_only=True)

{soliplex-0.83.4 → soliplex-0.85}/src/soliplex/loggers.py

@@ -42,8 +42,8 @@ UPLOADS_GET_ROOM_THREAD_FILE = "uploads get room thread file"
 UPLOADS_POST_ROOM = "uploads post room"
 UPLOADS_POST_ROOM_THREAD = "uploads post room thread"
 
-WORKDIRS_GET_ROOM_THREAD_RUN = "workdirs get room thread run"
-WORKDIRS_GET_ROOM_THREAD_RUN_FILE = "workdirs get room thread run file"
+WORKDIRS_GET_ROOM_THREAD = "workdirs get room thread"
+WORKDIRS_GET_ROOM_THREAD_FILE = "workdirs get room thread file"
 
 AUTHN_BAD_REQUEST = "authn bad request"
 AUTHN_CONSENT_CANCELLED = "unlisted frontend origin: sign-in cancelled"
@@ -186,22 +186,20 @@ AUDIT_RAG_ACTION_CHUNK_VIZ = "chunk-viz"
 AUDIT_RAG_ACTION_DOC_LIST = "doc-list"
 
 # sandbox-exec audit events (data change): the room agent's sandbox skill
-# executes code against a per-run, writable working directory.
+# executes code against the thread's writable working directory, or reads
+# an image out of a mount.
 AUDIT_SANDBOX_EXEC = "sandbox exec"
 
-# sandbox-exec 'action' values: which tool drove the execution.
+# sandbox-exec 'action' values: which tool made the record.
 AUDIT_SANDBOX_ACTION_RUN = "run"
 AUDIT_SANDBOX_ACTION_RUN_PYTHON = "run-python"
+AUDIT_SANDBOX_ACTION_READ_IMAGE = "read-image"
 
 # sandbox-exec 'reason' values for a non-zero exit: the sandbox cut the
 # execution off, or the code itself ended badly.
 AUDIT_SANDBOX_REASON_TIMEOUT = "timeout"
 AUDIT_SANDBOX_REASON_EXIT_CODE = "exit-code"
 
-# sandbox volume-list audit events (disclosure): the sandbox skill tells
-# the agent which uploaded files a volume holds.
-AUDIT_SANDBOX_VOLUME_LIST = "sandbox volume list"
-
 # room-upload audit events: an admin (privileged) adds shared reference
 # material to a room, changing what the room's agent and members can access.
 AUDIT_ROOM_UPLOAD_ADDED = "room upload added"
@@ -651,25 +649,11 @@ class RAGAccessAuditLog(AuditLogWrapper):
 
 
 class SandboxExecAuditLog(AuditLogWrapper):
-    """Record the sandbox skill's executions and volume listings.
-
-    Each ``run`` / ``run_python`` invocation is one data-change event: the
-    room agent's sandbox skill executes code against the run's writable
-    working directory. The command and script bodies are deliberately not
-    recorded inline (size / content leakage); the record captures the
-    'action' (which tool ran), the 'workdir' whose data the execution may
-    have changed, the 'environment' it ran in, 'refs' -- the host paths of
-    the saved command / script transcripts (empty when transcripts are not
-    configured) -- and the 'exit_code' the execution ended with.
-
-    An execution refused for naming an unavailable environment is recorded
-    as 'denied': nothing ran, so it carries no exit code, and its 'workdir'
-    is None because none was created.
-
-    ``list_volume_files`` discloses the names of a volume's uploaded files
-    to the agent, so it is recorded too, as its own event carrying the
-    'volume' and the 'count' of files disclosed. The names themselves stay
-    out of the record, for the same reason the bodies do.
+    """Record the sandbox skill's executions and image reads.
+
+    A record names the 'action', the 'workdir' the execution could change,
+    the 'environment' it ran in, 'refs' for the saved transcripts, and how
+    it ended.  Command and script bodies are never recorded inline.
     """
 
     def __init__(self, claims: dict[str, typing.Any], **extra):
@@ -686,6 +670,8 @@ class SandboxExecAuditLog(AuditLogWrapper):
         refs: typing.Any,
         *,
         exit_code: int | None = None,
+        truncated: bool = False,
+        timeout_seconds: float | None = None,
     ):
         self._succeeded(
             AUDIT_SANDBOX_EXEC,
@@ -694,6 +680,8 @@ class SandboxExecAuditLog(AuditLogWrapper):
             environment=environment,
             refs=refs,
             exit_code=exit_code,
+            truncated=truncated,
+            timeout_seconds=timeout_seconds,
         )
 
     def execute_failed(
@@ -705,6 +693,8 @@ class SandboxExecAuditLog(AuditLogWrapper):
         reason: str,
         *,
         exit_code: int | None = None,
+        truncated: bool = False,
+        timeout_seconds: float | None = None,
     ):
         self._failed(
             AUDIT_SANDBOX_EXEC,
@@ -714,36 +704,32 @@ class SandboxExecAuditLog(AuditLogWrapper):
             refs=refs,
             reason=reason,
             exit_code=exit_code,
+            truncated=truncated,
+            timeout_seconds=timeout_seconds,
         )
 
-    def execute_denied(
+    def image_read(
         self,
-        action: str,
-        workdir: str | None,
-        environment: str | None,
-        refs: typing.Any,
-        reason: str,
+        path: str,
+        volume: str,
+        *,
+        byte_count: int,
+        media_type: str,
     ):
-        self._denied(
-            AUDIT_SANDBOX_EXEC,
-            action=action,
-            workdir=workdir,
-            environment=environment,
-            refs=refs,
-            reason=reason,
-        )
-
-    def volume_listed(self, volume: str, count: int):
         self._succeeded(
-            AUDIT_SANDBOX_VOLUME_LIST,
+            AUDIT_SANDBOX_EXEC,
+            action=AUDIT_SANDBOX_ACTION_READ_IMAGE,
+            path=path,
             volume=volume,
-            count=count,
+            byte_count=byte_count,
+            media_type=media_type,
         )
 
-    def volume_list_failed(self, volume: str, reason: str):
+    def image_read_failed(self, path: str, reason: str):
         self._failed(
-            AUDIT_SANDBOX_VOLUME_LIST,
-            volume=volume,
+            AUDIT_SANDBOX_EXEC,
+            action=AUDIT_SANDBOX_ACTION_READ_IMAGE,
+            path=path,
             reason=reason,
         )
 

{soliplex-0.83.4 → soliplex-0.85}/src/soliplex/models.py

@@ -665,10 +665,9 @@ class WorkdirFile(pydantic.BaseModel):
     url: pydantic.HttpUrl
 
 
-class RunWorkdirFiles(pydantic.BaseModel):
+class ThreadWorkdirFiles(pydantic.BaseModel):
     room_id: str
     thread_id: str
-    run_id: str
     files: list[WorkdirFile]
 
 

soliplex-0.85/src/soliplex/sandbox_audit.py

@@ -0,0 +1,145 @@
+import contextlib
+import pathlib
+import typing
+
+from soliplex import loggers
+
+
+class _SandboxExecRecorder:
+    """Carries what an execution reports back to the surrounding audit."""
+
+    def __init__(self):
+        self.workdir: pathlib.Path | None = None
+        self.refs: list[str] = []
+        self.exit_code: int | None = None
+        self.timed_out: bool = False
+        self.timeout_seconds: float | None = None
+        self.truncated: bool = False
+
+    @property
+    def logged_workdir(self) -> str | None:
+        return str(self.workdir) if self.workdir is not None else None
+
+    def record_workdir(self, workdir: pathlib.Path | None):
+        self.workdir = workdir
+
+    def record_ref(self, ref: str):
+        self.refs.append(ref)
+
+    def record_result(self, result):
+        self.exit_code = result.exit_code
+        self.timed_out = result.timed_out
+        self.timeout_seconds = result.timeout_seconds
+        self.truncated = result.truncated
+
+
+class _SandboxImageReadRecorder:
+    """Carries what a read disclosed: which mount, how much, what type."""
+
+    def __init__(self):
+        self.volume: str = ""
+        self.byte_count: int = 0
+        self.media_type: str = ""
+
+    def record_image(self, volume: str, data: bytes, media_type: str):
+        self.volume = volume
+        self.byte_count = len(data)
+        self.media_type = media_type
+
+
+def _audit_log(deps: typing.Any) -> loggers.SandboxExecAuditLog:
+    """Bind actor identity and run correlation from the agent deps."""
+    user = getattr(deps, "user", None)
+
+    return loggers.SandboxExecAuditLog(
+        claims=user.model_dump() if user is not None else {},
+        room_id=deps.room_id,
+        thread_id=deps.thread_id,
+        run_id=deps.run_id,
+    )
+
+
+@contextlib.contextmanager
+def audit_sandbox_exec(
+    deps: typing.Any,
+    *,
+    action: str,
+    environment: str | None,
+):
+    """Bracket a ``run`` / ``run_python`` tool body, emitting one
+    ``sandbox-exec`` record.
+
+    Yields a recorder the tool feeds with the working directory, each
+    transcript path, and the result.  The command and script bodies are
+    never logged.
+    """
+    audit = _audit_log(deps)
+    recorder = _SandboxExecRecorder()
+
+    try:
+        yield recorder
+    except Exception as exc:
+        audit.execute_failed(
+            action,
+            recorder.logged_workdir,
+            environment,
+            recorder.refs,
+            type(exc).__name__,
+            exit_code=recorder.exit_code,
+            truncated=recorder.truncated,
+            timeout_seconds=recorder.timeout_seconds,
+        )
+        raise
+
+    bounds = {
+        "exit_code": recorder.exit_code,
+        "truncated": recorder.truncated,
+        "timeout_seconds": recorder.timeout_seconds,
+    }
+
+    if recorder.timed_out:
+        audit.execute_failed(
+            action,
+            recorder.logged_workdir,
+            environment,
+            recorder.refs,
+            loggers.AUDIT_SANDBOX_REASON_TIMEOUT,
+            **bounds,
+        )
+    elif recorder.exit_code:  # neither a clean zero nor an absent status
+        audit.execute_failed(
+            action,
+            recorder.logged_workdir,
+            environment,
+            recorder.refs,
+            loggers.AUDIT_SANDBOX_REASON_EXIT_CODE,
+            **bounds,
+        )
+    else:
+        audit.executed(
+            action,
+            recorder.logged_workdir,
+            environment,
+            recorder.refs,
+            **bounds,
+        )
+
+
+@contextlib.contextmanager
+def audit_sandbox_read_image(deps: typing.Any, *, path: str):
+    """Bracket the ``read_image`` tool body, emitting one record."""
+    audit = _audit_log(deps)
+    recorder = _SandboxImageReadRecorder()
+
+    try:
+        yield recorder
+    except Exception as exc:
+        audit.image_read_failed(path, type(exc).__name__)
+        raise
+
+    audit.image_read(
+        path,
+        recorder.volume,
+        byte_count=recorder.byte_count,
+        media_type=recorder.media_type,
+    )