topos-node 1.5.3__tar.gz → 1.5.5__tar.gz

{topos_node-1.5.3/topos_node.egg-info → topos_node-1.5.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.5.3
+Version: 1.5.5
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai

{topos_node-1.5.3 → topos_node-1.5.5}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.5.3"
+version = "1.5.5"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"

{topos_node-1.5.3 → topos_node-1.5.5}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.5.3"
-__version_info__ = (1, 5, 3)
+__version__ = "1.5.5"
+__version_info__ = (1, 5, 5)
 
 __all__ = ["__version__", "__version_info__"]

{topos_node-1.5.3 → topos_node-1.5.5}/topos/api/shell.py

@@ -6,12 +6,13 @@ stay dumb renderers: identity + version for attach-don't-double-start, the
 log file location for a "Show Logs" action, and cached update state with a
 localhost-only trigger to apply an update.
 
-Update *checking* is not done here — the runtime update monitor started in
-app startup keeps ``get_update_info()`` fresh; this router only reads it.
+Polling reads cached state. A manual check explicitly refreshes it from PyPI
+off the event loop, without waiting for the six-hour runtime monitor.
 """
 
 from __future__ import annotations
 
+import asyncio
 import os
 import threading
 from time import time
@@ -21,7 +22,10 @@ from fastapi import APIRouter, HTTPException, Request
 from ..core.logging import get_log_file_path
 from ..runtime_update import (
     DEFAULT_PACKAGE_NAME,
+    UpdateCheckError,
+    _set_update_info,
     apply_package_update,
+    check_for_update,
     get_runtime_version,
     get_update_info,
 )
@@ -96,3 +100,21 @@ async def shell_apply_update(request: Request) -> dict:
 
     threading.Thread(target=worker, daemon=True, name="topos-shell-update").start()
     return {"started": True}
+
+
+@router.post("/update/check")
+async def shell_check_update(request: Request) -> dict:
+    if not _client_is_local(request):
+        raise HTTPException(status_code=403, detail="Shell update checks can only be triggered from localhost.")
+    # Never replace the update state while an install/restart is pending.
+    with _apply_lock:
+        pending = _apply_state["applying"] or _apply_state["last_result"] == "success"
+    if not pending:
+        try:
+            info = await asyncio.to_thread(check_for_update, DEFAULT_PACKAGE_NAME, strict=True)
+        except UpdateCheckError as exc:
+            # Keep the last known update; a failed network check is not proof
+            # the running node is current.
+            raise HTTPException(status_code=503, detail=str(exc)) from exc
+        _set_update_info(info)
+    return await shell_status()

{topos_node-1.5.3 → topos_node-1.5.5}/topos/app.py

@@ -287,6 +287,13 @@ async def startup_event() -> None:
 
     allow_rebuild_children()
     add_shutdown_listener(signal_rebuild_children)
+    # BL-168: the stop's own steps (control-plane client first, the ingestion queue parked, the permissions
+    # runtime's background work stopped) start at the signal, not when uvicorn's drain reaches shutdown_event.
+    from . import node_stop
+
+    node_stop.bind_loop(asyncio.get_running_loop())
+    node_stop.set_background_reaper(_reap_background_tasks)
+    add_shutdown_listener(node_stop.begin_stop)
     # This process holds the database, so its backups are the ones the model
     # manager may spend before it evicts a model. The disk floor never resolves
     # that directory for itself — on a split node it runs beside the models, on
@@ -706,11 +713,19 @@ async def startup_event() -> None:
 
 @app.on_event("shutdown")
 async def shutdown_event() -> None:
+    from . import node_stop
     from .pipeline.job_runner import stop_pipeline_worker
-    from .runtime_shutdown import end_runtime
+    from .runtime_shutdown import current_generation, end_runtime
 
     # Wake cooperative workers (fact_llm / Ollama threads) before awaiting
     # network teardown so Ctrl+C does not wait out a full enrichment batch.
+    run = current_generation()
+    run.request_stop("app_shutdown")
+    # BL-168: the control-plane client closes first, then the ingestion queue
+    # is parked (the held job requeued) and the permissions runtime's background
+    # work stopped. The same task when a signal or the tray already began it.
+    # Before end_runtime, so the queue is parked under THIS run's generation.
+    await node_stop.stop_now(run)
     # end_runtime retires THIS run's generation — its workers stop for good —
     # and installs a fresh one, so anything that runs later in this process
     # (another app run, a CLI command, the next test) does not inherit a
@@ -723,10 +738,10 @@ async def shutdown_event() -> None:
     # Reaped before the network teardown below, because these are the writers.
     if state.upgrade_runner_stop is not None:
         state.upgrade_runner_stop.set()
-    # First, because it unblocks the rest: a background task awaiting a rebuild
-    # through asyncio.to_thread is stuck until the child dies, however it is
-    # cancelled.
-    await _reap_rebuild_children()
+    # Rebuild children were stopped first inside stop_now (after the control-
+    # plane client), because it unblocks the rest: a background task awaiting a
+    # rebuild through asyncio.to_thread is stuck until the child dies, however
+    # it is cancelled.
     await _reap_background_tasks()
     await stop_pipeline_worker()
     await _reap_upgrade_runner()
@@ -738,8 +753,7 @@ async def shutdown_event() -> None:
         except asyncio.CancelledError:
             pass
         state.engine_presence_task = None
-    if state.control_plane_client:
-        await state.control_plane_client.stop()
+    # The control-plane client was stopped first, by node_stop.stop_now above.
     # The first-pin thread waits between tries; tell it the app is gone (never blocks).
     from .relay_stamp import stop_first_pin
 

{topos_node-1.5.3 → topos_node-1.5.5}/topos/cli/commands.py

@@ -419,7 +419,10 @@ def main(
             log_path=get_log_file_path(),
         )
     else:
-        uvicorn.run(app, host=host, port=port, log_config=get_uvicorn_log_config())
+        from topos import node_stop
+
+        node_stop.enable_exit_deadline()
+        uvicorn.run(app, host=host, port=port, log_config=get_uvicorn_log_config(), **node_stop.uvicorn_options())
 
 
 from topos.cli.reprocess_cmd import reprocess_command  # noqa: E402

{topos_node-1.5.3 → topos_node-1.5.5}/topos/cli/tray.py

@@ -823,8 +823,11 @@ def serve_with_tray(
     """
     import uvicorn
 
-    config = uvicorn.Config(app, host=host, port=port, log_config=log_config)
+    from topos import node_stop
+
+    config = uvicorn.Config(app, host=host, port=port, log_config=log_config, **node_stop.uvicorn_options())
     server = uvicorn.Server(config)
+    node_stop.enable_exit_deadline()
 
     def stop_server() -> None:
         # Every tray exit comes through here (Quit, Select Topos, Ctrl+C). None
@@ -838,6 +841,12 @@ def serve_with_tray(
             signal_rebuild_children()
         except Exception as exc:  # noqa: BLE001 — never let this cost the exit itself
             print(f"Could not stop graph rebuild children ({exc}); quitting anyway.")
+        try:
+            # BL-168: the control-plane client, the ingestion queue and the
+            # permissions runtime's background work stop now, not after the drain.
+            node_stop.begin_stop("tray_quit")
+        except Exception as exc:  # noqa: BLE001
+            print(f"Could not begin the node's stop ({exc}); quitting anyway.")
         finally:
             server.should_exit = True
 

{topos_node-1.5.3 → topos_node-1.5.5}/topos/control_plane_client.py

@@ -46,6 +46,11 @@ logger = logging.getLogger("topos.control_plane_client")
 #: reconnects itself rather than being evicted.
 PING_INTERVAL_SECONDS = 30.0
 PING_TIMEOUT_SECONDS = 90.0
+#: R-N154 M2: at a stop, how long the asks already being handled get to send their replies before the socket closes.
+#: Inside node_stop's 12 s bound for the client's whole stop.
+INBOUND_DRAIN_SECONDS = 5.0
+#: What an ask that arrives while the node is stopping is answered with, at once.
+STOPPING_ERROR = "Engine is stopping. Retry shortly."
 
 _FAST_INBOUND_MESSAGE_TYPES = frozenset(
     {
@@ -144,7 +149,13 @@ class ControlPlaneClient:
         )
         self._inbound_semaphore = asyncio.Semaphore(self._inbound_concurrency_limit)
         self._inbound_tasks: set[asyncio.Task] = set()
+        # UI reads get a separate bounded reserve, never an unbounded bypass.
+        self._fast_inbound_tasks: set[asyncio.Task] = set()
+        self._fast_inbound_max_pending = 32
         self._inbound_lock = asyncio.Lock()
+        # R-N154 M2: set at the start of a stop; new asks are refused while the ones in hand finish.
+        self._draining = False
+        self._inbound_drain_seconds = INBOUND_DRAIN_SECONDS
 
         self._presence_outbox_size = max(1, int(settings.control_plane_presence_outbox_size))
         self._presence_outbox: deque[dict[str, Any]] = deque(maxlen=self._presence_outbox_size)
@@ -188,6 +199,7 @@ class ControlPlaneClient:
         if self._task and not self._task.done():
             return
         self._stop_requested = False
+        self._draining = False
         try:
             # Engine handlers run here — the loop the app lives on.
             self._handler_loop = asyncio.get_running_loop()
@@ -277,6 +289,8 @@ class ControlPlaneClient:
             await asyncio.to_thread(self._thread.join, 10.0)
             self._thread = None
         else:
+            self._draining = True
+            await self._drain_inbound_tasks(self._inbound_drain_seconds)
             self._stop.set()
             if self._ws:
                 try:
@@ -302,7 +316,14 @@ class ControlPlaneClient:
         self._set_state("idle")
 
     async def _shutdown_on_client_loop(self) -> None:
-        """Runs on the client thread's loop; unblocks _run so the thread exits."""
+        """Runs on the client thread's loop; unblocks _run so the thread exits.
+
+        Two phases (R-N154 M2). First the asks already being handled get up to ``_inbound_drain_seconds`` to send
+        their replies while every new ask is refused at once with ``STOPPING_ERROR``: a search past its checkpoint
+        has written its receipt and spent its share's allowance, and an admitted answer has its id, so closing under
+        them lost the reply the node had already paid for. Then the socket closes and what is left is cancelled."""
+        self._draining = True
+        await self._drain_inbound_tasks(self._inbound_drain_seconds)
         self._stop.set()
         if self._ws:
             try:
@@ -311,6 +332,12 @@ class ControlPlaneClient:
                 pass
         await self._cancel_inbound_tasks()
 
+    async def _drain_inbound_tasks(self, timeout_s: float) -> None:
+        async with self._inbound_lock:
+            pending = [task for task in self._inbound_tasks if not task.done()]
+        if pending and timeout_s > 0:
+            await asyncio.wait(pending, timeout=timeout_s)
+
     async def _cancel_inbound_tasks(self) -> None:
         async with self._inbound_lock:
             pending = list(self._inbound_tasks)
@@ -420,21 +447,36 @@ class ControlPlaneClient:
 
     async def _schedule_inbound_message(self, ws, data: Dict[str, Any]) -> None:
         msg_type = str(data.get("type") or "")
+        if self._draining and msg_type not in _FAST_INBOUND_MESSAGE_TYPES and msg_type != "ping":
+            # R-N154 M2: the node is stopping. Refuse at once, so the asker hears now rather than at a timeout.
+            request_id = data.get("id")
+            if request_id:
+                await self._send_ws_json(ws, {"id": request_id, "status": "error", "error": STOPPING_ERROR})
+            return
+        if msg_type == "ping":
+            await self._handle_message(ws, data)
+            return
         if msg_type in _FAST_INBOUND_MESSAGE_TYPES:
+            if len(self._fast_inbound_tasks) >= self._fast_inbound_max_pending:
+                if msg_type == "healthcheck":
+                    await self._send_ws_json(ws, self._healthcheck_snapshot_response(data.get("id")))
+                elif msg_type == "get_device_info" and self._device_info_snapshot_response(data.get("id")):
+                    await self._send_ws_json(ws, self._device_info_snapshot_response(data.get("id")))
+                else:
+                    await self._send_busy_response(ws, data)
+                return
             task = asyncio.create_task(self._handle_message(ws, data))
             self._inbound_tasks.add(task)
+            self._fast_inbound_tasks.add(task)
             task.add_done_callback(self._on_inbound_task_done)
             return
         async with self._inbound_lock:
-            pending_count = len(self._inbound_tasks)
+            pending_count = len(self._inbound_tasks) - len(self._fast_inbound_tasks)
             if pending_count >= self._inbound_max_pending:
                 logger.warning("Dropping inbound request due to saturation pending=%d", pending_count)
                 request_id = data.get("id")
                 if request_id:
-                    await self._send_ws_json(
-                        ws,
-                        {"id": request_id, "status": "error", "error": "Engine is busy. Retry shortly."},
-                    )
+                    await self._send_busy_response(ws, data)
                 return
             task = asyncio.create_task(self._handle_message_guarded(ws, data))
             self._inbound_tasks.add(task)
@@ -442,6 +484,15 @@ class ControlPlaneClient:
 
     def _on_inbound_task_done(self, task: asyncio.Task) -> None:
         self._inbound_tasks.discard(task)
+        self._fast_inbound_tasks.discard(task)
+
+    async def _send_busy_response(self, ws, data: Dict[str, Any]) -> None:
+        if data.get("id"):
+            await self._send_ws_json(ws, {
+                "id": data["id"], "type": data.get("type"), "status": "error",
+                "error": "Engine is busy. Retry shortly.", "error_code": "engine_busy",
+                "retry_after_seconds": 30,
+            })
 
     async def _handle_message_guarded(self, ws, data: Dict[str, Any]) -> None:
         async with self._inbound_semaphore:
@@ -561,7 +612,7 @@ class ControlPlaneClient:
             "id": request_id,
             "status": "ok",
             "type": "healthcheck",
-            "payload": {"ok": True, "db_ok": db_ok, "snapshot_stale": True},
+            "payload": {"ok": True, "db_ok": db_ok, "snapshot_stale": True, "accepting_writes": False},
         }
 
     def _echo_request_type(self, resp: Dict[str, Any], data: Dict[str, Any]) -> Dict[str, Any]:
@@ -626,6 +677,11 @@ class ControlPlaneClient:
             resp = {"id": data.get("id"), "status": "error", "error": str(exc)}
         if resp is None:
             return  # e.g. connection_info or message without id; CP has no pending request to match
+        if msg_type == "healthcheck" and resp.get("status") == "ok":
+            resp = {**resp, "payload": {
+                **(resp.get("payload") or {}),
+                "accepting_writes": not self._draining and len(self._inbound_tasks) - len(self._fast_inbound_tasks) < self._inbound_max_pending,
+            }}
         await self._send_ws_json(ws, self._echo_request_type(resp, data))
 
     async def _await_with_device_info_fallback(self, ws, data: Dict[str, Any], handler_future) -> dict[str, Any] | None:
@@ -666,7 +722,8 @@ class ControlPlaneClient:
                 if isinstance(late, dict) and late.get("status") == "ok" and isinstance(late.get("payload"), dict):
                     self.set_device_info_snapshot(late["payload"])
 
-            asyncio.create_task(_refresh_from_late_answer())
+            # Keep late work in the bounded task set until it actually finishes.
+            await _refresh_from_late_answer()
             return None
 
     async def _await_with_healthcheck_fallback(self, ws, data: Dict[str, Any], handler_future) -> dict[str, Any] | None:
@@ -694,7 +751,7 @@ class ControlPlaneClient:
                 if isinstance(late, dict) and late.get("status") == "ok" and isinstance(late.get("payload"), dict):
                     self.set_healthcheck_snapshot(late["payload"])
 
-            asyncio.create_task(_refresh_from_late_answer())
+            await _refresh_from_late_answer()
             return None
 
     async def send_message(self, message: Dict[str, Any]) -> None:

{topos_node-1.5.3 → topos_node-1.5.5}/topos/core/handlers/config.py

@@ -38,10 +38,13 @@ async def handle_migrate_browser_plugin_app_id(message: Dict[str, Any]) -> Optio
     req_id = message.get("id")
     from ..state import _migrate_legacy_browser_plugin_app_ids
 
-    conn = hub.get_db_connection()
-    if not conn:
+    def migrate():
+        conn = hub.get_db_connection()
+        return _migrate_legacy_browser_plugin_app_ids(conn) if conn else None
+
+    updated = await asyncio.to_thread(migrate)
+    if updated is None:
         return {"id": req_id, "status": "error", "error": "Database not available"}
-    updated = _migrate_legacy_browser_plugin_app_ids(conn)
     return {"id": req_id, "status": "ok", "payload": {"updated_rows": updated}}
 
 @handles("get_request_counts")
@@ -51,11 +54,15 @@ async def handle_get_request_counts(message: Dict[str, Any]) -> Optional[Dict[st
     payload = message.get("payload") or {}
     owner_user_id = (payload.get("owner_user_id") or "").strip()
     since_days = min(max(int(payload.get("since_days") or 90), 1), 365)
-    conn = hub.get_db_connection()
-    if not owner_user_id and conn:
-        owner_user_id = get_user_id(conn) or ""
-    uma = get_uma_request_counts(conn, owner_user_id, since_days) if conn else {"total_read_requests": 0, "total_write_requests": 0, "by_app": []}
-    mcp = get_mcp_request_counts(conn, since_days) if conn else {"by_source": [], "by_tool": [], "total": 0}
+    def counts():
+        # Resolve the connection on its worker thread, never pass a loop-owned handle.
+        conn = hub.get_db_connection()
+        owner = owner_user_id or (get_user_id(conn) if conn else "") or ""
+        uma = get_uma_request_counts(conn, owner, since_days) if conn else {"total_read_requests": 0, "total_write_requests": 0, "by_app": []}
+        mcp = get_mcp_request_counts(conn, since_days) if conn else {"by_source": [], "by_tool": [], "total": 0}
+        return uma, mcp
+
+    uma, mcp = await asyncio.to_thread(counts)
     return {"id": req_id, "status": "ok", "payload": {"uma": uma, "mcp": mcp}}
 
 @handles("get_ui_config")

{topos_node-1.5.3 → topos_node-1.5.5}/topos/core/handlers/permissions_v2_owner.py

@@ -198,7 +198,10 @@ async def handle_permissions_v2_share_counts(message):
         from ...permissions_v2.share_counts import count
         owner = _owner_gate(message, bound_only=True, unavailable="counts_unavailable")
         payload = _keys(owner.payload, {"binding", "request"}, {"binding", "request"})
-        request = _keys(payload["request"], {"policy"}, {"policy"})
+        request = _keys(payload["request"], {"policy", "fact_preview_offset"}, {"policy"})
+        offset = request.get("fact_preview_offset", 0)
+        if type(offset) is not int or not 0 <= offset <= 100000:
+            raise _Refused(400, "payload_invalid")
         if not isinstance(request["policy"], dict):
             raise _Refused(400, "policy_invalid")
         try:
@@ -212,7 +215,7 @@ async def handle_permissions_v2_share_counts(message):
         if any(getattr(policy.binding, field) != value for field, value in owner.identity.model_dump().items()):
             raise _Refused(409, "binding_mismatch")
         service = owner.runtime.evidence_reviews(require_existing=True)
-        return count(service.resolver, service.reviews, policy, now=int(time.time()))
+        return count(service.resolver, service.reviews, policy, now=int(time.time()), fact_preview_offset=offset)
     return await _respond(message, COUNTS, work, unavailable="counts_unavailable")
 
 

{topos_node-1.5.3 → topos_node-1.5.5}/topos/core/state.py

@@ -113,6 +113,9 @@ def _aggregate_uma_access_attribution(
 
 def _ensure_uma_access_requests_indexes(conn: sqlite3.Connection) -> None:
     try:
+        if conn.execute("SELECT 1 FROM sqlite_master WHERE type='index' AND name=?",
+                        ("idx_uma_access_requests_owner_created",)).fetchone():
+            return
         # DDL takes SQLite's write lock at execute time — gate it with the
         # commit like every other writer (write_gate lock-order inversion).
         with with_db_write():
@@ -127,6 +130,9 @@ def _ensure_uma_access_requests_indexes(conn: sqlite3.Connection) -> None:
 
 def _ensure_mcp_request_log_indexes(conn: sqlite3.Connection) -> None:
     try:
+        if conn.execute("SELECT 1 FROM sqlite_master WHERE type='index' AND name=?",
+                        ("idx_mcp_request_log_requested_at",)).fetchone():
+            return
         with with_db_write():
             conn.execute(
                 f"CREATE INDEX IF NOT EXISTS idx_mcp_request_log_requested_at "
@@ -914,6 +920,9 @@ def _ensure_uma_access_requests_table(conn: sqlite3.Connection) -> None:
 def _migrate_legacy_browser_plugin_app_ids(conn: sqlite3.Connection) -> int:
     """Rewrite engine Activity counts from browser-plugin → browser-history-plugin (idempotent)."""
     try:
+        if not conn.execute(f"SELECT 1 FROM {UMA_ACCESS_REQUESTS_TABLE} WHERE app_id=? LIMIT 1",
+                            (LEGACY_BROWSER_PLUGIN_APP_ID,)).fetchone():
+            return 0
         with with_db_write():
             cursor = conn.execute(
                 f"UPDATE {UMA_ACCESS_REQUESTS_TABLE} SET app_id = ? WHERE app_id = ?",

{topos_node-1.5.3 → topos_node-1.5.5}/topos/engine/registration.py

@@ -70,11 +70,17 @@ def _search_batch_version() -> int:
         return 0
 
 
+# The answer protocol this node serves, 0 when answers are off: 1 wrote answers (1.5.0); 2 also carries the writer
+# a policy's `writer_disclosure` releases (A2A-4 amendment 9). The control plane offers the sharer that choice only
+# to a node advertising 2, because an older node refuses a policy naming the field.
+ANSWER_VERSION = 2
+
+
 def _answer_version() -> int:
     try:
         from ..permissions_v2 import switches
-        return int(switches.is_bound() and switches.on(switches.MESSAGE_SEARCH)
-                   and switches.on(switches.ANSWERS))
+        return ANSWER_VERSION if (switches.is_bound() and switches.on(switches.MESSAGE_SEARCH)
+                                  and switches.on(switches.ANSWERS)) else 0
     except Exception:
         return 0