mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-11-01 18:52:21 +01:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dependabot[bot]
|
8a19d75481 |
@@ -105,17 +105,6 @@ SEARXNG_INSTANCE=http://localhost:8080
|
||||
# trusted single-user setups that accept injected content reaching side-effect tools.
|
||||
# ODYSSEUS_TOOL_APPROVAL_GATE=1
|
||||
|
||||
# Comma-separated list of exact qualified MCP read and write tool names
|
||||
# on host-local servers. Only explicitly configured stdio MCP servers qualify.
|
||||
# Declarations do not override built-in tool effects. Declared reads remain
|
||||
# untrusted (EXTERNAL_UNTRUSTED) to prevent prompt injections from reaching shell
|
||||
# or network tools, but allow continuation to declared non-destructive write tools
|
||||
# on the exact same stdio server without repeated approvals. Stdio transport does
|
||||
# not guarantee network isolation. Authorization must still originate from the
|
||||
# trusted request. Automatic same-store writes carry residual prompt-injection risk.
|
||||
# ODYSSEUS_LOCAL_MCP_READ_TOOLS=mcp__notes__search_notes,mcp__notes__read_note
|
||||
# ODYSSEUS_LOCAL_MCP_WRITE_TOOLS=mcp__notes__create_note,mcp__notes__update_note
|
||||
|
||||
# Mark session cookies Secure. Left unset, this follows the request scheme:
|
||||
# an HTTPS login gets a Secure cookie, a plain-HTTP one does not. Set true to
|
||||
# force it on, or false to force it off while you still serve plain HTTP.
|
||||
|
||||
@@ -76,7 +76,7 @@ jobs:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
||||
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||
with:
|
||||
python-version: "3.11"
|
||||
# Byte-compile sources — catches syntax errors without installing deps.
|
||||
@@ -91,7 +91,7 @@ jobs:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
||||
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
||||
with:
|
||||
node-version: "22.23.4"
|
||||
- run: npm ci --ignore-scripts --no-audit --no-fund
|
||||
@@ -151,7 +151,7 @@ jobs:
|
||||
echo "docs_only=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
||||
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||
if: steps.docs-check.outputs.docs_only != 'true'
|
||||
with:
|
||||
python-version: "3.11"
|
||||
@@ -168,7 +168,7 @@ jobs:
|
||||
|
||||
# uv resolves the same versions as pip but installs ~5x faster, and its
|
||||
# cache keeps each shard from re-downloading the whole requirement set.
|
||||
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
||||
- uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
|
||||
if: steps.docs-check.outputs.docs_only != 'true'
|
||||
with:
|
||||
version: "0.13.5"
|
||||
@@ -181,7 +181,7 @@ jobs:
|
||||
uv pip install --system -r requirements.txt
|
||||
uv pip install --system "playwright==1.62.0"
|
||||
if: steps.docs-check.outputs.docs_only != 'true'
|
||||
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
||||
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
||||
if: steps.docs-check.outputs.docs_only != 'true'
|
||||
with:
|
||||
node-version: "22.23.4"
|
||||
|
||||
@@ -31,11 +31,11 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
||||
uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
build-mode: none
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
||||
uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
||||
with:
|
||||
category: "/language:${{ matrix.language }}"
|
||||
|
||||
@@ -42,7 +42,7 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Lint Dockerfile
|
||||
uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
|
||||
uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
|
||||
with:
|
||||
dockerfile: Dockerfile
|
||||
# DL3008: pinning apt package versions is impractical on a -slim base
|
||||
|
||||
@@ -61,14 +61,14 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Set up Buildx
|
||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
||||
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||
with:
|
||||
driver: docker
|
||||
|
||||
# Build without pushing so a broken Dockerfile is caught here, and the
|
||||
# exact image we ship is what gets scanned.
|
||||
- name: Build image
|
||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
||||
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||
with:
|
||||
context: .
|
||||
push: false
|
||||
@@ -107,12 +107,12 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Set up Buildx
|
||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
||||
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||
with:
|
||||
driver: docker
|
||||
|
||||
- name: Build image
|
||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
||||
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||
with:
|
||||
context: .
|
||||
push: false
|
||||
@@ -133,7 +133,7 @@ jobs:
|
||||
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db:2
|
||||
|
||||
- name: Upload Trivy results
|
||||
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
||||
uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
||||
with:
|
||||
sarif_file: trivy-results.sarif
|
||||
category: trivy-image
|
||||
|
||||
@@ -63,7 +63,7 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
||||
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||
with:
|
||||
python-version: '3.12'
|
||||
|
||||
|
||||
@@ -47,4 +47,4 @@ jobs:
|
||||
steps:
|
||||
- name: Deploy to GitHub Pages
|
||||
id: deployment
|
||||
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
|
||||
uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
|
||||
|
||||
@@ -55,16 +55,16 @@ jobs:
|
||||
shell: bash
|
||||
run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
|
||||
- name: Set up Buildx
|
||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
||||
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||
- name: Log in to GHCR
|
||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
||||
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Build and push by digest
|
||||
id: build
|
||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
||||
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||
with:
|
||||
context: .
|
||||
pull: true
|
||||
@@ -78,7 +78,7 @@ jobs:
|
||||
digest="${{ steps.build.outputs.digest }}"
|
||||
touch "/tmp/digests/${digest#sha256:}"
|
||||
- name: Upload digest
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
||||
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
||||
with:
|
||||
name: digest-${{ matrix.arch }}
|
||||
path: /tmp/digests/*
|
||||
@@ -107,15 +107,15 @@ jobs:
|
||||
echo "version=$v" >> "$GITHUB_OUTPUT"
|
||||
echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
|
||||
- name: Download digests
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
||||
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
||||
with:
|
||||
path: /tmp/digests
|
||||
pattern: digest-*
|
||||
merge-multiple: true
|
||||
- name: Set up Buildx
|
||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
||||
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||
- name: Log in to GHCR
|
||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
||||
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
|
||||
@@ -62,9 +62,9 @@ jobs:
|
||||
env:
|
||||
SEARXNG_TEST_IMAGE: ${{ steps.image.outputs.image }}
|
||||
run: docker pull "$SEARXNG_TEST_IMAGE"
|
||||
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
||||
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||
- name: Check unmodified upstream trust and actual entrypoint offline
|
||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
||||
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||
with:
|
||||
context: .
|
||||
file: docker/searxng/Dockerfile
|
||||
|
||||
@@ -66,7 +66,7 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
||||
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||
with:
|
||||
python-version: '3.12'
|
||||
|
||||
|
||||
+1
-2
@@ -66,11 +66,10 @@ External content that reaches the LLM is treated as untrusted via `src/prompt_se
|
||||
|
||||
It is on unless `ODYSSEUS_TOOL_APPROVAL_GATE` is set to a falsy value (`0`/`false`/`no`/`off`). Request authority narrows which tool families a turn may use, but within an admitted family it does not bind the exact action: a request to read email admits `send_email` and `delete_email`, and agent processes inherit the host network. Until those are covered by their own boundaries, this gate is what stops an injected instruction from reaching them. Turning it off lets a successful injection reach `bash`, `host_shell`, `send_email` and `delete_email` without a separate confirmation.
|
||||
|
||||
Three exemptions apply even when the gate is on, all deliberate:
|
||||
Two exemptions apply even when the gate is on, both deliberate:
|
||||
|
||||
- Sources in `_CONTROL_PLANE_CONTEXT_SOURCES` (skills, runtime descriptors, the open editor document, the open email, uploaded files) are treated as control-plane metadata and still permit read-only tools.
|
||||
- A TUI run that advertises a host shell bridge and declares `unattended_mode` exempts the local execution set in `TUI_CLIENT_TOOL_NAMES`. Personal, network and deployment-local tools are never exempted.
|
||||
- Narrow continuation for local MCP tools declared via `ODYSSEUS_LOCAL_MCP_READ_TOOLS` and `ODYSSEUS_LOCAL_MCP_WRITE_TOOLS`: Only explicitly configured stdio MCP servers qualify; remote HTTP and SSE servers fail closed. Declarations never override built-in tool effects, so built-in email, browser, memory, image generation, and other built-in servers cannot receive continuation exceptions. Declared read tools remain untrusted (`EXTERNAL_UNTRUSTED`) to ensure that prompt injections in local data cannot reach shell, network, or unrelated tools without approval. Stdio transport does not guarantee network isolation, as local processes may still reach the host network. However, declared non-destructive write tools on the exact same stdio MCP server are permitted to continue without an approval prompt if the only untrusted context in the run was produced by declared local reads on that same server, without any explicit error or external taint. Genuinely external content (web search, web fetch, emails, external message context) blocks these writes. Authorization must still originate from the trusted request: request authority must permit the tool and retain the sealed backend resource grant. The residual same-store write risk (the agent writing to the same local store after reading a local prompt injection) remains subject to the user's initial request authority.
|
||||
|
||||
## Security Headers
|
||||
|
||||
|
||||
@@ -568,7 +568,6 @@ class ModelEndpoint(TimestampMixin, Base):
|
||||
hidden_models = Column(Text, nullable=True) # JSON list of model IDs that failed probing
|
||||
cached_models = Column(Text, nullable=True) # JSON list of last-known model IDs (avoids probe on list)
|
||||
pinned_models = Column(Text, nullable=True) # JSON list of admin-pinned model IDs (manual, may not appear in /v1/models)
|
||||
cookbook_serve_session_id = Column(String, nullable=True) # Current Cookbook serve identity
|
||||
model_type = Column(String, nullable=True, default="llm") # "llm" or "image"
|
||||
# auto = classify by URL; local = self-hosted server; api/proxy = external
|
||||
# OpenAI-compatible API even when reachable through a private/tailnet IP.
|
||||
@@ -1379,26 +1378,6 @@ def _migrate_add_pinned_models_column():
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
def _migrate_add_cookbook_serve_session_id_column():
|
||||
"""Bind Cookbook cleanup to the serve session that owns the endpoint."""
|
||||
from sqlalchemy import inspect
|
||||
|
||||
with engine.begin() as conn:
|
||||
columns = {
|
||||
column["name"]
|
||||
for column in inspect(conn).get_columns("model_endpoints")
|
||||
}
|
||||
|
||||
if "cookbook_serve_session_id" not in columns:
|
||||
conn.execute(
|
||||
text(
|
||||
"ALTER TABLE model_endpoints "
|
||||
"ADD COLUMN cookbook_serve_session_id VARCHAR"
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
def _migrate_add_notes_sort_order():
|
||||
"""Add sort_order, image_url, repeat columns to notes if they don't exist."""
|
||||
import sqlite3
|
||||
@@ -2411,7 +2390,6 @@ def init_db():
|
||||
_migrate_add_hidden_models_column()
|
||||
_migrate_add_cached_models_column()
|
||||
_migrate_add_pinned_models_column()
|
||||
_migrate_add_cookbook_serve_session_id_column()
|
||||
_migrate_add_notes_sort_order()
|
||||
_migrate_add_model_type_column()
|
||||
_migrate_add_model_endpoint_refresh_columns()
|
||||
|
||||
@@ -73,8 +73,6 @@ services:
|
||||
- ODYSSEUS_CAPTURE_MODEL_REQUESTS=${ODYSSEUS_CAPTURE_MODEL_REQUESTS:-0}
|
||||
- ODYSSEUS_MCP_EMAIL_OWNER=${ODYSSEUS_MCP_EMAIL_OWNER:-}
|
||||
- ODYSSEUS_SCRIPT_HOST=${ODYSSEUS_SCRIPT_HOST:-localhost}
|
||||
- ODYSSEUS_LOCAL_MCP_READ_TOOLS=${ODYSSEUS_LOCAL_MCP_READ_TOOLS:-}
|
||||
- ODYSSEUS_LOCAL_MCP_WRITE_TOOLS=${ODYSSEUS_LOCAL_MCP_WRITE_TOOLS:-}
|
||||
- ODYSSEUS_CHAT_UPLOAD_MAX_BYTES=${ODYSSEUS_CHAT_UPLOAD_MAX_BYTES:-10485760}
|
||||
- ODYSSEUS_GALLERY_UPLOAD_MAX_BYTES=${ODYSSEUS_GALLERY_UPLOAD_MAX_BYTES:-104857600}
|
||||
- ODYSSEUS_GALLERY_TRANSFORM_UPLOAD_MAX_BYTES=${ODYSSEUS_GALLERY_TRANSFORM_UPLOAD_MAX_BYTES:-26214400}
|
||||
|
||||
@@ -72,8 +72,6 @@ services:
|
||||
- ODYSSEUS_CAPTURE_MODEL_REQUESTS=${ODYSSEUS_CAPTURE_MODEL_REQUESTS:-0}
|
||||
- ODYSSEUS_MCP_EMAIL_OWNER=${ODYSSEUS_MCP_EMAIL_OWNER:-}
|
||||
- ODYSSEUS_SCRIPT_HOST=${ODYSSEUS_SCRIPT_HOST:-localhost}
|
||||
- ODYSSEUS_LOCAL_MCP_READ_TOOLS=${ODYSSEUS_LOCAL_MCP_READ_TOOLS:-}
|
||||
- ODYSSEUS_LOCAL_MCP_WRITE_TOOLS=${ODYSSEUS_LOCAL_MCP_WRITE_TOOLS:-}
|
||||
- ODYSSEUS_CHAT_UPLOAD_MAX_BYTES=${ODYSSEUS_CHAT_UPLOAD_MAX_BYTES:-10485760}
|
||||
- ODYSSEUS_GALLERY_UPLOAD_MAX_BYTES=${ODYSSEUS_GALLERY_UPLOAD_MAX_BYTES:-104857600}
|
||||
- ODYSSEUS_GALLERY_TRANSFORM_UPLOAD_MAX_BYTES=${ODYSSEUS_GALLERY_TRANSFORM_UPLOAD_MAX_BYTES:-26214400}
|
||||
|
||||
@@ -61,8 +61,6 @@ services:
|
||||
- ODYSSEUS_CAPTURE_MODEL_REQUESTS=${ODYSSEUS_CAPTURE_MODEL_REQUESTS:-0}
|
||||
- ODYSSEUS_MCP_EMAIL_OWNER=${ODYSSEUS_MCP_EMAIL_OWNER:-}
|
||||
- ODYSSEUS_SCRIPT_HOST=${ODYSSEUS_SCRIPT_HOST:-localhost}
|
||||
- ODYSSEUS_LOCAL_MCP_READ_TOOLS=${ODYSSEUS_LOCAL_MCP_READ_TOOLS:-}
|
||||
- ODYSSEUS_LOCAL_MCP_WRITE_TOOLS=${ODYSSEUS_LOCAL_MCP_WRITE_TOOLS:-}
|
||||
- ODYSSEUS_CHAT_UPLOAD_MAX_BYTES=${ODYSSEUS_CHAT_UPLOAD_MAX_BYTES:-10485760}
|
||||
- ODYSSEUS_GALLERY_UPLOAD_MAX_BYTES=${ODYSSEUS_GALLERY_UPLOAD_MAX_BYTES:-104857600}
|
||||
- ODYSSEUS_GALLERY_TRANSFORM_UPLOAD_MAX_BYTES=${ODYSSEUS_GALLERY_TRANSFORM_UPLOAD_MAX_BYTES:-26214400}
|
||||
|
||||
@@ -1276,7 +1276,6 @@ async def build_chat_context(
|
||||
message=_ctx_msg,
|
||||
session=sess,
|
||||
use_web=use_web_val and not skip_web,
|
||||
use_rag=use_rag_val,
|
||||
use_memory=mem_enabled,
|
||||
time_filter=time_filter,
|
||||
preset_system_prompt=preset.system_prompt,
|
||||
@@ -1287,6 +1286,8 @@ async def build_chat_context(
|
||||
incognito=incognito,
|
||||
use_skills=skills_enabled,
|
||||
)
|
||||
if use_rag is not None or is_research_spinoff or casual_low_signal:
|
||||
_preface_kwargs["use_rag"] = use_rag_val
|
||||
preface, rag_sources, web_sources = chat_processor.build_context_preface(**_preface_kwargs)
|
||||
|
||||
# Capture used memories immediately
|
||||
|
||||
+68
-95
@@ -1408,15 +1408,10 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
|
||||
return {"models": models, "host": host or "local"}
|
||||
|
||||
def _auto_register_image_endpoint(
|
||||
req: ServeRequest,
|
||||
remote: str | None,
|
||||
serve_session_id: str | None = None,
|
||||
) -> str | None:
|
||||
def _auto_register_image_endpoint(req: ServeRequest, remote: str | None) -> str | None:
|
||||
"""Register a diffusion model as an image endpoint so it appears in the model selector."""
|
||||
import re
|
||||
from core.database import SessionLocal, ModelEndpoint
|
||||
from routes.model_routes import _normalize_model_ids
|
||||
from src.settings import load_settings, save_settings
|
||||
|
||||
# Parse port from command (--port NNNN), default 8100 for diffusion_server
|
||||
@@ -1444,13 +1439,9 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
if existing:
|
||||
existing.is_enabled = True
|
||||
existing.model_type = "image"
|
||||
# Follow the newly served model unless the user renamed the endpoint.
|
||||
pinned_names = {f"{m.split('/')[-1]} (image)" for m in _normalize_model_ids(existing.pinned_models)}
|
||||
if existing.name in pinned_names:
|
||||
existing.name = display_name
|
||||
existing.name = display_name
|
||||
existing.endpoint_kind = "local"
|
||||
existing.model_refresh_mode = "manual"
|
||||
existing.cookbook_serve_session_id = serve_session_id
|
||||
if pinned_models:
|
||||
existing.cached_models = json.dumps(pinned_models)
|
||||
existing.pinned_models = json.dumps(pinned_models)
|
||||
@@ -1474,7 +1465,6 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
model_refresh_mode="manual",
|
||||
cached_models=json.dumps(pinned_models) if pinned_models else None,
|
||||
pinned_models=json.dumps(pinned_models) if pinned_models else None,
|
||||
cookbook_serve_session_id=serve_session_id,
|
||||
)
|
||||
db.add(ep)
|
||||
db.commit()
|
||||
@@ -1620,71 +1610,43 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
# let the probe layer mark it offline if nothing's listening.
|
||||
logger.info(f"crash-watchdog: serve {session_id} exited cleanly (0); leaving endpoint {endpoint_id}")
|
||||
return
|
||||
# A nonzero exit may delete only the endpoint owned by this serve.
|
||||
# Non-zero exit — drop the endpoint.
|
||||
try:
|
||||
from core.database import SessionLocal as _SL, ModelEndpoint as _ME
|
||||
from core.constants import internal_api_base as _internal_api_base
|
||||
from core.middleware import INTERNAL_TOOL_HEADER, INTERNAL_TOOL_TOKEN
|
||||
from urllib.parse import quote
|
||||
import httpx
|
||||
|
||||
db = _SL()
|
||||
try:
|
||||
ep = db.query(_ME).filter(_ME.id == endpoint_id).first()
|
||||
if not ep or ep.cookbook_serve_session_id != session_id:
|
||||
if ep:
|
||||
# A scheduled serve can leave old non-zero exit markers
|
||||
# in tmux scrollback while the current OpenAI endpoint is
|
||||
# actually alive. Verify reachability before deleting the
|
||||
# endpoint row; otherwise chats fall back even though the
|
||||
# served model is ready.
|
||||
try:
|
||||
probe_url = ep.base_url.rstrip("/") + "/models"
|
||||
with urllib.request.urlopen(probe_url, timeout=3) as resp:
|
||||
if 200 <= getattr(resp, "status", 0) < 300:
|
||||
logger.info(
|
||||
f"crash-watchdog: serve {session_id} has exit marker {exit_code} "
|
||||
f"but endpoint {ep.id} is reachable; leaving it registered"
|
||||
)
|
||||
return
|
||||
except Exception:
|
||||
pass
|
||||
logger.info(
|
||||
"crash-watchdog: endpoint %s no longer owned by %s",
|
||||
endpoint_id, session_id,
|
||||
f"crash-watchdog: dropping endpoint {endpoint_id} "
|
||||
f"({ep.name} @ {ep.base_url}) — serve exited {exit_code}"
|
||||
)
|
||||
return
|
||||
probe_url = ep.base_url.rstrip("/") + "/models"
|
||||
db.delete(ep)
|
||||
db.commit()
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
# Preserve an endpoint that is already healthy, including
|
||||
# after an old runner emits a stale failure marker.
|
||||
try:
|
||||
with urllib.request.urlopen(probe_url, timeout=3) as resp:
|
||||
if 200 <= getattr(resp, "status", 0) < 300:
|
||||
logger.info(
|
||||
"crash-watchdog: endpoint %s is reachable; keeping it",
|
||||
endpoint_id,
|
||||
)
|
||||
return
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
async with httpx.AsyncClient(timeout=8) as client:
|
||||
response = await client.delete(
|
||||
f"{_internal_api_base()}/api/model-endpoints/{quote(endpoint_id, safe='')}",
|
||||
params={"expected_cookbook_serve_session_id": session_id},
|
||||
headers={INTERNAL_TOOL_HEADER: INTERNAL_TOOL_TOKEN},
|
||||
)
|
||||
if response.status_code == 200:
|
||||
logger.info(
|
||||
"crash-watchdog: deleted endpoint %s after serve %s exited %s",
|
||||
endpoint_id, session_id, exit_code,
|
||||
)
|
||||
elif response.status_code in (404, 409):
|
||||
logger.info(
|
||||
"crash-watchdog: endpoint %s absent or reassigned; keeping it",
|
||||
endpoint_id,
|
||||
)
|
||||
else:
|
||||
logger.warning(
|
||||
"crash-watchdog: endpoint %s deletion returned HTTP %s",
|
||||
endpoint_id, response.status_code,
|
||||
)
|
||||
except Exception as e:
|
||||
logger.warning("crash-watchdog: endpoint cleanup failed: %r", e)
|
||||
logger.warning(f"crash-watchdog: endpoint cleanup failed: {e!r}")
|
||||
return
|
||||
logger.debug(f"crash-watchdog: no exit marker for {session_id} within window; leaving endpoint {endpoint_id}")
|
||||
|
||||
def _auto_register_llm_endpoint(
|
||||
req: ServeRequest,
|
||||
remote: str | None,
|
||||
serve_session_id: str | None = None,
|
||||
) -> str | None:
|
||||
def _auto_register_llm_endpoint(req: ServeRequest, remote: str | None) -> str | None:
|
||||
"""Register a freshly-served LLM as a model endpoint so it appears in the
|
||||
model picker without a manual /setup step — the text-model sibling of
|
||||
_auto_register_image_endpoint.
|
||||
@@ -1701,7 +1663,6 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
)
|
||||
import re
|
||||
from core.database import SessionLocal, ModelEndpoint
|
||||
from routes.model_routes import _normalize_model_ids
|
||||
|
||||
# Port: ordered fallbacks so we match whatever the user actually
|
||||
# asked for, not a hardcoded default:
|
||||
@@ -1763,12 +1724,8 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
# deployment alias from /v1/models, and a stale server can answer on the
|
||||
# same port while the new launch failed. Keeping the requested model id
|
||||
# pinned makes the picker reflect the actual launch intent.
|
||||
launched_model = mlx_shim_model_id or req.repo_id
|
||||
pinned_models = [launched_model] if launched_model else []
|
||||
pinned_models = [mlx_shim_model_id] if mlx_shim_model_id else ([req.repo_id] if req.repo_id else [])
|
||||
|
||||
# Launch registration must not delete other endpoints.
|
||||
# Matching names, model pins, and failed probes do not prove that
|
||||
# another serve has stopped. Lifecycle cleanup owns termination.
|
||||
db = SessionLocal()
|
||||
try:
|
||||
# Reuse an endpoint already pointed at this URL instead of duplicating.
|
||||
@@ -1776,22 +1733,19 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
if existing:
|
||||
existing.is_enabled = True
|
||||
existing.model_type = "llm"
|
||||
# Follow the newly served model unless the user renamed the endpoint.
|
||||
pinned_names = {m.split("/")[-1] for m in _normalize_model_ids(existing.pinned_models)}
|
||||
if existing.name in pinned_names:
|
||||
existing.name = display_name
|
||||
existing.name = display_name
|
||||
existing.endpoint_kind = "local"
|
||||
existing.model_refresh_mode = "auto"
|
||||
# A reused endpoint belongs to the newest serve session.
|
||||
existing.cookbook_serve_session_id = serve_session_id
|
||||
if launched_model:
|
||||
# Pins represent model selection, not launch history.
|
||||
existing_pins = _normalize_model_ids(
|
||||
existing.pinned_models
|
||||
)
|
||||
if launched_model not in existing_pins:
|
||||
existing_pins.append(launched_model)
|
||||
existing.pinned_models = json.dumps(existing_pins)
|
||||
if pinned_models:
|
||||
try:
|
||||
existing_pinned = json.loads(existing.pinned_models or "[]")
|
||||
except Exception:
|
||||
existing_pinned = []
|
||||
merged_pinned = []
|
||||
for mid in [*existing_pinned, *pinned_models]:
|
||||
if mid and mid not in merged_pinned:
|
||||
merged_pinned.append(mid)
|
||||
existing.pinned_models = json.dumps(merged_pinned) if merged_pinned else None
|
||||
if is_ollama_endpoint:
|
||||
existing.endpoint_kind = "ollama"
|
||||
if pinned_models:
|
||||
@@ -1817,6 +1771,22 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
db.commit()
|
||||
except Exception as _pe:
|
||||
logger.warning(f"Re-probe failed for {base_url}: {_pe!r}")
|
||||
# Sweep stale dupes: other endpoints with the same display name
|
||||
# at DIFFERENT URLs (likely failed earlier-attempt ports) get
|
||||
# deleted so the picker doesn't show an offline ghost next to
|
||||
# the working one. Only sweeps endpoints whose id starts with
|
||||
# `local-` so we never touch a user's hand-added DeepSeek/OpenAI/
|
||||
# etc. entry with a coincidentally matching name.
|
||||
stale = (db.query(ModelEndpoint)
|
||||
.filter(ModelEndpoint.name == display_name)
|
||||
.filter(ModelEndpoint.base_url != base_url)
|
||||
.filter(ModelEndpoint.id.like("local-%"))
|
||||
.all())
|
||||
for s in stale:
|
||||
logger.info(f"Sweeping stale local endpoint {s.id} ({s.base_url})")
|
||||
db.delete(s)
|
||||
if stale:
|
||||
db.commit()
|
||||
return existing.id
|
||||
|
||||
ep_id = f"local-{uuid.uuid4().hex[:8]}"
|
||||
@@ -1832,11 +1802,22 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
cached_models=json.dumps(pinned_models) if pinned_models else None,
|
||||
pinned_models=json.dumps(pinned_models) if pinned_models else None,
|
||||
supports_tools=supports_tools,
|
||||
cookbook_serve_session_id=serve_session_id,
|
||||
)
|
||||
db.add(ep)
|
||||
db.commit()
|
||||
logger.info(f"Auto-registered local model endpoint: {display_name} @ {base_url}")
|
||||
# Same sweep on first-register path: drop any pre-existing local-*
|
||||
# endpoints with this display name pointed elsewhere.
|
||||
stale = (db.query(ModelEndpoint)
|
||||
.filter(ModelEndpoint.name == display_name)
|
||||
.filter(ModelEndpoint.id != ep_id)
|
||||
.filter(ModelEndpoint.id.like("local-%"))
|
||||
.all())
|
||||
for s in stale:
|
||||
logger.info(f"Sweeping stale local endpoint {s.id} ({s.base_url})")
|
||||
db.delete(s)
|
||||
if stale:
|
||||
db.commit()
|
||||
# Probe /v1/models NOW and write cached_models so the chat
|
||||
# picker actually shows the model on the next /api/models
|
||||
# call. Without this immediate probe, the endpoint has empty
|
||||
@@ -2658,17 +2639,9 @@ def setup_cookbook_routes() -> APIRouter:
|
||||
endpoint_id = None
|
||||
is_image_endpoint = "diffusion_server.py" in req.cmd or "mlx_image_server.py" in req.cmd
|
||||
if is_image_endpoint:
|
||||
endpoint_id = _auto_register_image_endpoint(
|
||||
req,
|
||||
remote,
|
||||
serve_session_id=session_id,
|
||||
)
|
||||
endpoint_id = _auto_register_image_endpoint(req, remote)
|
||||
elif not is_pip_install:
|
||||
endpoint_id = _auto_register_llm_endpoint(
|
||||
req,
|
||||
remote,
|
||||
serve_session_id=session_id,
|
||||
)
|
||||
endpoint_id = _auto_register_llm_endpoint(req, remote)
|
||||
|
||||
# Crash watchdog: the auto-register above writes the endpoint row
|
||||
# IMMEDIATELY (before the server has even bound its port) so the
|
||||
|
||||
+2
-26
@@ -3044,44 +3044,20 @@ def setup_model_routes(model_discovery):
|
||||
return {"dependents": _settings_using_endpoint(ep_id)}
|
||||
|
||||
@router.delete("/model-endpoints/{ep_id}")
|
||||
def delete_model_endpoint(
|
||||
ep_id: str,
|
||||
request: Request,
|
||||
expected_cookbook_serve_session_id: Optional[str] = None,
|
||||
):
|
||||
def delete_model_endpoint(ep_id: str, request: Request):
|
||||
require_admin(request)
|
||||
db = SessionLocal()
|
||||
try:
|
||||
ep = db.query(ModelEndpoint).filter(ModelEndpoint.id == ep_id).first()
|
||||
if not ep or not _chatgpt_endpoint_visible(ep, request):
|
||||
raise HTTPException(404, "Endpoint not found")
|
||||
if expected_cookbook_serve_session_id is not None:
|
||||
# The DELETE itself checks ownership. An old serve must never
|
||||
# mutate the settings of an endpoint reused by another serve.
|
||||
if (
|
||||
not ep_id.startswith(("local-", "img-"))
|
||||
or not expected_cookbook_serve_session_id
|
||||
):
|
||||
raise HTTPException(409, "Cookbook endpoint ownership mismatch")
|
||||
deleted = (
|
||||
db.query(ModelEndpoint)
|
||||
.filter(
|
||||
ModelEndpoint.id == ep_id,
|
||||
ModelEndpoint.cookbook_serve_session_id
|
||||
== expected_cookbook_serve_session_id,
|
||||
)
|
||||
.delete(synchronize_session=False)
|
||||
)
|
||||
if not deleted:
|
||||
raise HTTPException(409, "Cookbook endpoint ownership changed")
|
||||
# Clean up any settings that reference this endpoint
|
||||
cleared = _clear_settings_for_endpoint(ep_id)
|
||||
cleared_user_preferences = _clear_user_prefs_for_endpoint(ep_id)
|
||||
cleared_sessions = _clear_sessions_for_endpoint(db, ep.base_url, ep.id, ep.owner)
|
||||
cleared_loaded_sessions = _clear_loaded_sessions_for_endpoint(ep.base_url, ep.id, ep.owner)
|
||||
auth_id = getattr(ep, "provider_auth_id", None)
|
||||
if expected_cookbook_serve_session_id is None:
|
||||
db.delete(ep)
|
||||
db.delete(ep)
|
||||
cleared_provider_auth = _delete_orphaned_provider_auth(db, auth_id, exclude_ep_id=ep_id)
|
||||
db.commit()
|
||||
_invalidate_models_cache()
|
||||
|
||||
@@ -492,25 +492,6 @@ VARIABLE_NOTES: dict[str, tuple[str, str, str]] = {
|
||||
"tools that execute code, mutate state or cause external side effects need "
|
||||
"a separate approval. Set to 0 to opt out.",
|
||||
),
|
||||
"ODYSSEUS_LOCAL_MCP_READ_TOOLS": (
|
||||
"Agent loop and tool execution", USER,
|
||||
"Security-relevant. Comma-separated exact MCP read-tool names "
|
||||
"on configured stdio MCP servers. Only stdio servers qualify. "
|
||||
"Declarations do not override built-in tool effects. Output remains "
|
||||
"untrusted to prevent privilege escalation, but allows continuation to "
|
||||
"declared write tools on the same stdio server without external taint. "
|
||||
"Stdio transport does not guarantee network isolation. Automatic "
|
||||
"same-store writes carry residual prompt-injection risk.",
|
||||
),
|
||||
"ODYSSEUS_LOCAL_MCP_WRITE_TOOLS": (
|
||||
"Agent loop and tool execution", USER,
|
||||
"Security-relevant. Comma-separated exact MCP write-tool names "
|
||||
"on configured stdio MCP servers. Only stdio servers qualify. "
|
||||
"Declarations do not override built-in tool effects. Allowed to execute "
|
||||
"after declared local reads on the same stdio server, but blocked once "
|
||||
"external untrusted context enters the run. Authorization must still "
|
||||
"originate from the trusted request grant.",
|
||||
),
|
||||
"ODYSSEUS_MCP_ALLOWED_COMMANDS": (
|
||||
"Agent loop and tool execution", USER,
|
||||
"Security-relevant. Comma-separated allowlist of MCP launcher basenames the "
|
||||
|
||||
@@ -371,101 +371,6 @@ def interpret_request(request_text, *, history=(), workspace=None, active_docume
|
||||
return SemanticIntent(families, selected, required_read_operation_for_request(request_text, history))
|
||||
|
||||
|
||||
|
||||
def _trusted_local_mcp_request_tools(request_text: str, intent: SemanticIntent) -> set[str]:
|
||||
"""Seal local MCP operations from operator declarations and trusted request intent.
|
||||
|
||||
Discovery validates an operator-declared tool but cannot grant it. For the
|
||||
notes family, only an explicit request for local notes admits matching
|
||||
read operations and explicitly requested non-destructive write verbs. Other
|
||||
MCP domains require the user to name the qualified operation explicitly.
|
||||
"""
|
||||
from src.tool_capabilities import (
|
||||
LOCAL_MCP_READ_TOOLS_ENV, LOCAL_MCP_WRITE_TOOLS_ENV,
|
||||
_local_mcp_tools, _is_declared_local_mcp_read_tool,
|
||||
_is_declared_local_mcp_write_tool, capabilities_for_tool, ToolEffect,
|
||||
)
|
||||
from src.tool_utils import get_mcp_manager
|
||||
|
||||
manager = get_mcp_manager()
|
||||
if manager is None:
|
||||
return set()
|
||||
|
||||
request = request_text.casefold()
|
||||
local_notes = (
|
||||
intent.selected_tools is None
|
||||
and intent.required_read is None
|
||||
and "notes" in intent.capabilities
|
||||
and re.search(r"\b(?:local|on my computer|on this machine)\b", request)
|
||||
)
|
||||
write_verbs = {
|
||||
"create": r"\b(?:create|add|make)\b",
|
||||
"add": r"\b(?:add|create)\b",
|
||||
"write": r"\bwrite\b",
|
||||
"save": r"\bsave\b",
|
||||
"update": r"\b(?:update|edit|modify|change)\b",
|
||||
"edit": r"\b(?:edit|update|modify|change)\b",
|
||||
"append": r"\bappend\b",
|
||||
"modify": r"\b(?:modify|edit|update|change)\b",
|
||||
}
|
||||
negative_write = re.search(
|
||||
r"\b(?:do not|don't|never|without|no)\s+(?:\w+\s+){0,2}"
|
||||
r"(?:create|add|make|write|save|update|edit|append|modify)\b",
|
||||
request,
|
||||
)
|
||||
declared = _local_mcp_tools(LOCAL_MCP_READ_TOOLS_ENV) | _local_mcp_tools(LOCAL_MCP_WRITE_TOOLS_ENV)
|
||||
admitted = set()
|
||||
for name in sorted(declared):
|
||||
parts = name.split("__", 2)
|
||||
if len(parts) != 3 or parts[0] != "mcp":
|
||||
continue
|
||||
_, server, bare = parts
|
||||
if manager.is_builtin(server):
|
||||
continue
|
||||
conn = manager.get_server_status(server)
|
||||
if conn.get("status") != "connected" or conn.get("transport") != "stdio":
|
||||
continue
|
||||
resource = manager.resource_identity(name)
|
||||
if resource is None or resource.namespace != "mcp" or resource.endpoint_id != f"stdio:{server}":
|
||||
continue
|
||||
rows = manager._tools.get(server, [])
|
||||
row = next((item for item in rows if item.get("name") == bare), None)
|
||||
if row is None:
|
||||
continue
|
||||
read_ok = _is_declared_local_mcp_read_tool(name)
|
||||
write_ok = _is_declared_local_mcp_write_tool(name)
|
||||
if not (read_ok or write_ok):
|
||||
continue
|
||||
caps = capabilities_for_tool(name)
|
||||
if not caps.known or caps.effects != frozenset({
|
||||
ToolEffect.READ_PRIVATE if read_ok else ToolEffect.WRITE_PRIVATE
|
||||
}):
|
||||
continue
|
||||
ann = row.get("annotations") or {}
|
||||
destructive = ann.get("destructiveHint") if isinstance(ann, dict) else getattr(ann, "destructiveHint", None)
|
||||
if destructive is True:
|
||||
continue
|
||||
if write_ok and re.match(r"^(?:delete|remove|erase|destroy|drop|purge)(?:_|$)", bare, re.I):
|
||||
continue
|
||||
|
||||
# Exact qualified names in the trusted request permit any configured
|
||||
# and validated local operation. Model/tool content is not an input.
|
||||
explicitly_named = bool(re.search(
|
||||
r"(?<![A-Za-z0-9_])" + re.escape(name.casefold()) + r"(?![A-Za-z0-9_])",
|
||||
request,
|
||||
))
|
||||
if not explicitly_named:
|
||||
if not local_notes or not re.search(r"(?:^|_)notes?(?:_|$)", bare, re.I):
|
||||
continue
|
||||
if write_ok:
|
||||
action = bare.split("_", 1)[0].casefold()
|
||||
if action not in write_verbs or not re.search(write_verbs[action], request):
|
||||
continue
|
||||
if negative_write:
|
||||
continue
|
||||
admitted.add(name)
|
||||
return admitted
|
||||
|
||||
def create_request_authority(request_text, *, owner=None, session_id=None, workspace=None,
|
||||
history=(), policy=None, active_document=False,
|
||||
image_attachment=False, capabilities=None, client_runtime_context=None):
|
||||
@@ -488,7 +393,6 @@ def create_request_authority(request_text, *, owner=None, session_id=None, works
|
||||
tools = {canonical_tool(operation.tool)}
|
||||
else:
|
||||
operation = None
|
||||
tools.update(_trusted_local_mcp_request_tools(request_text, intent))
|
||||
grants = []
|
||||
for name in sorted(tools | {"ask_user", "update_plan"}):
|
||||
name = canonical_tool(name)
|
||||
|
||||
@@ -31,43 +31,63 @@ def _internal_headers() -> dict:
|
||||
|
||||
|
||||
async def _delete_endpoint_for_task(task: dict) -> None:
|
||||
"""Remove a stopped serve's endpoint using the normal deletion contract."""
|
||||
import re
|
||||
from urllib.parse import quote
|
||||
"""Drop the auto-registered model endpoint for a scheduled-stop serve.
|
||||
|
||||
endpoint_id = str(task.get("_endpointId") or task.get("endpointId") or "").strip()
|
||||
serve_session_id = str(task.get("sessionId") or task.get("id") or "").strip()
|
||||
if (
|
||||
not re.fullmatch(r"(?:local|img)-[0-9a-f]{8}", endpoint_id)
|
||||
or not serve_session_id
|
||||
):
|
||||
logger.info("cookbook_serve_lifecycle: missing endpoint/session identity")
|
||||
Without this, killing the tmux session leaves the endpoint sitting in
|
||||
the picker (probe goes offline; chats still try to route there) and
|
||||
the user has to delete it by hand in Settings -> Endpoints.
|
||||
"""
|
||||
endpoint_id = (task.get("_endpointId") or task.get("endpointId") or "").strip()
|
||||
if not endpoint_id:
|
||||
logger.info(
|
||||
"cookbook_serve_lifecycle: task %s has no endpoint id; skipping endpoint deletion",
|
||||
task.get("sessionId") or task.get("id") or "",
|
||||
)
|
||||
return
|
||||
|
||||
import re as _re
|
||||
payload = task.get("payload") or {}
|
||||
cmd = str(payload.get("_cmd") or "")
|
||||
remote = task.get("remoteHost") or ""
|
||||
# Build host the same way _auto_register_llm_endpoint does so URL match wins.
|
||||
if remote:
|
||||
host = remote.split("@")[-1] if "@" in remote else remote
|
||||
else:
|
||||
host = "host.docker.internal"
|
||||
port_match = _re.search(r"--port\s+(\d+)", cmd)
|
||||
ollama_host_match = _re.search(r"OLLAMA_HOST=[^\s]*?:(\d+)", cmd)
|
||||
if port_match:
|
||||
port = int(port_match.group(1))
|
||||
elif ollama_host_match:
|
||||
port = int(ollama_host_match.group(1))
|
||||
elif "ollama" in cmd:
|
||||
port = 11434
|
||||
else:
|
||||
port = 8080
|
||||
base_url = f"http://{host}:{port}/v1"
|
||||
try:
|
||||
async with httpx.AsyncClient(timeout=8) as client:
|
||||
response = await client.delete(
|
||||
f"{internal_api_base()}/api/model-endpoints/{quote(endpoint_id, safe='')}",
|
||||
params={"expected_cookbook_serve_session_id": serve_session_id},
|
||||
r = await client.get(
|
||||
f"{internal_api_base()}/api/model-endpoints",
|
||||
headers=_internal_headers(),
|
||||
)
|
||||
if response.status_code == 200:
|
||||
logger.info(
|
||||
"cookbook_serve_lifecycle: deleted endpoint %s for serve %s",
|
||||
endpoint_id, serve_session_id,
|
||||
)
|
||||
elif response.status_code in (404, 409):
|
||||
logger.info(
|
||||
"cookbook_serve_lifecycle: endpoint %s absent or reassigned; keeping it",
|
||||
endpoint_id,
|
||||
)
|
||||
else:
|
||||
logger.warning(
|
||||
"cookbook_serve_lifecycle: endpoint %s deletion returned HTTP %s",
|
||||
endpoint_id, response.status_code,
|
||||
)
|
||||
except Exception as exc:
|
||||
logger.warning("cookbook_serve_lifecycle: cleanup failed: %s", exc)
|
||||
if r.status_code >= 400:
|
||||
return
|
||||
eps = r.json() if r.content else []
|
||||
# Delete only the endpoint created by this scheduled serve. URL
|
||||
# matching is unsafe because a later scheduled serve can reuse the
|
||||
# same host:port after an older task has gone stale.
|
||||
ep = next((e for e in eps if e.get("id") == endpoint_id), None)
|
||||
if ep:
|
||||
await client.delete(
|
||||
f"{internal_api_base()}/api/model-endpoints/{ep['id']}",
|
||||
headers=_internal_headers(),
|
||||
)
|
||||
logger.info(
|
||||
f"cookbook_serve_lifecycle: deleted endpoint {ep.get('id')} "
|
||||
f"({ep.get('base_url')}) after scheduled stop"
|
||||
)
|
||||
except Exception as e:
|
||||
logger.warning(f"cookbook_serve_lifecycle: endpoint delete failed: {e}")
|
||||
|
||||
|
||||
async def _stop_serve(session_id: str, remote_host: str = "", ssh_port: str = "") -> bool:
|
||||
|
||||
+1
-4
@@ -770,11 +770,8 @@ class McpManager:
|
||||
qualified.add(f"mcp__{server_id}__{tool['name']}")
|
||||
return disabled_map, qualified
|
||||
|
||||
@staticmethod
|
||||
def is_builtin(server_id: str) -> bool:
|
||||
def is_builtin(self, server_id: str) -> bool:
|
||||
"""Check if a server is a built-in (auto-registered) server."""
|
||||
if not isinstance(server_id, str):
|
||||
return False
|
||||
return server_id.startswith("builtin_") or server_id in {
|
||||
"image_gen",
|
||||
"memory",
|
||||
|
||||
@@ -334,142 +334,6 @@ _BROWSER_MCP_READ_TOOLS = frozenset(
|
||||
)
|
||||
|
||||
|
||||
LOCAL_MCP_READ_TOOLS_ENV = "ODYSSEUS_LOCAL_MCP_READ_TOOLS"
|
||||
LOCAL_MCP_WRITE_TOOLS_ENV = "ODYSSEUS_LOCAL_MCP_WRITE_TOOLS"
|
||||
|
||||
_LOCAL_MCP_READ_CAPABILITIES = _capabilities(
|
||||
ToolEffect.READ_PRIVATE,
|
||||
result_integrity=ResultIntegrity.EXTERNAL_UNTRUSTED,
|
||||
)
|
||||
_LOCAL_MCP_WRITE_CAPABILITIES = _capabilities(
|
||||
ToolEffect.WRITE_PRIVATE,
|
||||
result_integrity=ResultIntegrity.EXTERNAL_UNTRUSTED,
|
||||
)
|
||||
|
||||
|
||||
def _local_mcp_tools(variable: str) -> frozenset[str]:
|
||||
"""Tool names a deployment declares as touching only the local store.
|
||||
|
||||
Tools served by a user-configured MCP server are absent from the registry
|
||||
above, so they are classified as unknown and fail high. For a server with
|
||||
both a read and a write tool that is unusable: the read result arms the
|
||||
post-external gate, because an unknown result is not SYSTEM integrity, and
|
||||
the write that follows is refused until separately authorized. Every
|
||||
second call needs an approval, for a server that never leaves the host.
|
||||
|
||||
Declaring the tools resolves that without widening the gate:
|
||||
|
||||
ODYSSEUS_LOCAL_MCP_READ_TOOLS=mcp__<server>__search_notes,mcp__<server>__read_note
|
||||
ODYSSEUS_LOCAL_MCP_WRITE_TOOLS=mcp__<server>__create_note
|
||||
|
||||
Read tools become READ_PRIVATE with EXTERNAL_UNTRUSTED integrity. Their
|
||||
results remain untrusted and still arm the gate, preventing prompt
|
||||
injections from reaching shell, network, or unrelated tools. However,
|
||||
declared write tools on the exact same MCP server receive a narrowly
|
||||
scoped continuation exception as long as no external or error taint has
|
||||
entered the run. Once genuinely external content has entered the run,
|
||||
approvals remain required.
|
||||
"""
|
||||
raw = os.getenv(variable, "") or ""
|
||||
return frozenset(name.strip() for name in raw.split(",") if name.strip())
|
||||
|
||||
|
||||
def _current_mcp_manager():
|
||||
"""Retrieve the current McpManager instance safely without hard circular binds."""
|
||||
try:
|
||||
from src import tool_execution
|
||||
if hasattr(tool_execution, "get_mcp_manager"):
|
||||
mgr = tool_execution.get_mcp_manager()
|
||||
if mgr is not None:
|
||||
return mgr
|
||||
except Exception:
|
||||
pass
|
||||
try:
|
||||
from src.tool_utils import get_mcp_manager
|
||||
return get_mcp_manager()
|
||||
except Exception:
|
||||
return None
|
||||
|
||||
|
||||
def _is_declared_local_mcp_tool(
|
||||
tool_name: Any, server_id: str | None = None
|
||||
) -> bool:
|
||||
"""Return whether tool_name is an exact, well-formed declared local MCP tool."""
|
||||
if not isinstance(tool_name, str) or not tool_name:
|
||||
return False
|
||||
parts = tool_name.split("__", 2)
|
||||
if not (
|
||||
len(parts) == 3
|
||||
and parts[0] == "mcp"
|
||||
and bool(parts[1])
|
||||
and bool(parts[2])
|
||||
and not any(char.isspace() for part in parts[1:] for char in part)
|
||||
):
|
||||
return False
|
||||
sid = parts[1]
|
||||
if server_id is not None and sid != server_id:
|
||||
return False
|
||||
from src.mcp_manager import McpManager
|
||||
if McpManager.is_builtin(sid):
|
||||
return False
|
||||
if tool_name in TOOL_CAPABILITIES:
|
||||
return False
|
||||
declared_read = tool_name in _local_mcp_tools(LOCAL_MCP_READ_TOOLS_ENV)
|
||||
declared_write = tool_name in _local_mcp_tools(LOCAL_MCP_WRITE_TOOLS_ENV)
|
||||
return (declared_read or declared_write) and (declared_read != declared_write)
|
||||
|
||||
|
||||
def _is_declared_local_mcp_read_tool(
|
||||
tool_name: Any, server_id: str | None = None
|
||||
) -> bool:
|
||||
if not _is_declared_local_mcp_tool(tool_name, server_id):
|
||||
return False
|
||||
declared_read = tool_name in _local_mcp_tools(LOCAL_MCP_READ_TOOLS_ENV)
|
||||
declared_write = tool_name in _local_mcp_tools(LOCAL_MCP_WRITE_TOOLS_ENV)
|
||||
if not (declared_read and not declared_write):
|
||||
return False
|
||||
parts = tool_name.split("__", 2)
|
||||
mgr = _current_mcp_manager()
|
||||
if mgr is not None:
|
||||
tools = mgr._tools.get(parts[1], [])
|
||||
tool_row = next((r for r in tools if r.get("name") == parts[2]), None)
|
||||
if tool_row is not None:
|
||||
from src.mcp_manager import mcp_tool_is_readonly
|
||||
if not mcp_tool_is_readonly(tool_row):
|
||||
return False
|
||||
else:
|
||||
from src.mcp_manager import _MCP_READONLY_VERBS
|
||||
if not parts[2].lower().startswith(_MCP_READONLY_VERBS):
|
||||
return False
|
||||
return True
|
||||
|
||||
|
||||
def _is_declared_local_mcp_write_tool(
|
||||
tool_name: Any, server_id: str | None = None
|
||||
) -> bool:
|
||||
if not _is_declared_local_mcp_tool(tool_name, server_id):
|
||||
return False
|
||||
declared_read = tool_name in _local_mcp_tools(LOCAL_MCP_READ_TOOLS_ENV)
|
||||
declared_write = tool_name in _local_mcp_tools(LOCAL_MCP_WRITE_TOOLS_ENV)
|
||||
if not (declared_write and not declared_read):
|
||||
return False
|
||||
parts = tool_name.split("__", 2)
|
||||
mgr = _current_mcp_manager()
|
||||
if mgr is not None:
|
||||
tools = mgr._tools.get(parts[1], [])
|
||||
tool_row = next((r for r in tools if r.get("name") == parts[2]), None)
|
||||
if tool_row is not None:
|
||||
ann = tool_row.get("annotations") or {}
|
||||
destructive = (
|
||||
ann.get("destructiveHint")
|
||||
if isinstance(ann, dict)
|
||||
else getattr(ann, "destructiveHint", None)
|
||||
)
|
||||
if destructive is True:
|
||||
return False
|
||||
return True
|
||||
|
||||
|
||||
def capabilities_for_tool(tool_name: Any) -> ToolCapabilities:
|
||||
"""Return deterministic capabilities; malformed and unknown tools fail high."""
|
||||
if not isinstance(tool_name, str) or not tool_name:
|
||||
@@ -484,10 +348,6 @@ def capabilities_for_tool(tool_name: Any) -> ToolCapabilities:
|
||||
return capabilities
|
||||
if tool_name in _BROWSER_MCP_READ_TOOLS:
|
||||
return _BROWSER_MCP_READ_CAPABILITIES
|
||||
if _is_declared_local_mcp_read_tool(tool_name):
|
||||
return _LOCAL_MCP_READ_CAPABILITIES
|
||||
if _is_declared_local_mcp_write_tool(tool_name):
|
||||
return _LOCAL_MCP_WRITE_CAPABILITIES
|
||||
return _UNKNOWN_CAPABILITIES
|
||||
|
||||
|
||||
@@ -925,149 +785,6 @@ def delegated_tool_is_blocked(tool_name: Any, content: Any = None) -> bool:
|
||||
)
|
||||
|
||||
|
||||
_SERVER_OWNED_CONTROL_PLANE_SOURCES = frozenset(
|
||||
{
|
||||
"skills",
|
||||
"client runtime context",
|
||||
"backend runtime context",
|
||||
"integrations",
|
||||
"mcp tools",
|
||||
"agents.md",
|
||||
}
|
||||
)
|
||||
|
||||
_PROHIBITED_CONTINUATION_EFFECTS = frozenset(
|
||||
{
|
||||
ToolEffect.NETWORK_EGRESS,
|
||||
ToolEffect.EXTERNAL_SIDE_EFFECT,
|
||||
ToolEffect.EXECUTE_CODE,
|
||||
ToolEffect.ADMIN_CHANGE,
|
||||
ToolEffect.UI_SIDE_EFFECT,
|
||||
ToolEffect.DESTRUCTIVE,
|
||||
ToolEffect.READ_WORKSPACE,
|
||||
ToolEffect.WRITE_WORKSPACE,
|
||||
ToolEffect.BROKERED_NETWORK_READ,
|
||||
ToolEffect.READ_PUBLIC,
|
||||
}
|
||||
)
|
||||
|
||||
|
||||
def _is_authorized_local_mcp_continuation(
|
||||
tool_name: Any,
|
||||
external_sources: Iterable[str],
|
||||
content: Any = None,
|
||||
) -> bool:
|
||||
"""Evaluate narrowly scoped continuation for declared local MCP tools.
|
||||
|
||||
Allows a declared local MCP write or read tool when the tool is verified
|
||||
against an explicitly configured and connected stdio MCP server, and the
|
||||
only untrusted sources observed in the run are declared local MCP tools
|
||||
belonging to the exact same MCP server (plus server-owned control plane
|
||||
metadata).
|
||||
"""
|
||||
if not isinstance(tool_name, str) or not tool_name:
|
||||
return False
|
||||
parts = tool_name.split("__", 2)
|
||||
if len(parts) != 3 or parts[0] != "mcp" or not parts[1] or not parts[2]:
|
||||
return False
|
||||
server_id = parts[1]
|
||||
|
||||
from src.mcp_manager import McpManager
|
||||
if McpManager.is_builtin(server_id):
|
||||
return False
|
||||
|
||||
if not _is_declared_local_mcp_tool(tool_name, server_id=server_id):
|
||||
return False
|
||||
|
||||
capabilities = capabilities_for_action(tool_name, content)
|
||||
if not capabilities.known:
|
||||
return False
|
||||
if capabilities.effects & _PROHIBITED_CONTINUATION_EFFECTS:
|
||||
return False
|
||||
if capabilities.effects - {ToolEffect.WRITE_PRIVATE, ToolEffect.READ_PRIVATE}:
|
||||
return False
|
||||
|
||||
manager = _current_mcp_manager()
|
||||
if manager is None:
|
||||
return False
|
||||
if manager.is_builtin(server_id):
|
||||
return False
|
||||
|
||||
conn = manager.get_server_status(server_id)
|
||||
if conn.get("status") != "connected":
|
||||
return False
|
||||
if conn.get("transport") != "stdio":
|
||||
return False
|
||||
|
||||
resource_id = manager.resource_identity(tool_name)
|
||||
if resource_id is None or resource_id.namespace != "mcp":
|
||||
return False
|
||||
if resource_id.endpoint_id != f"stdio:{server_id}":
|
||||
return False
|
||||
|
||||
tools_list = manager._tools.get(server_id, [])
|
||||
tool_row = next((r for r in tools_list if r.get("name") == parts[2]), None)
|
||||
if not tool_row:
|
||||
return False
|
||||
ann = tool_row.get("annotations") or {}
|
||||
destructive = (
|
||||
ann.get("destructiveHint")
|
||||
if isinstance(ann, dict)
|
||||
else getattr(ann, "destructiveHint", None)
|
||||
)
|
||||
if destructive is True:
|
||||
return False
|
||||
|
||||
from src.agent_runtime.authority import active_request_authority, ExactOperation, RequestAuthority
|
||||
authority = active_request_authority()
|
||||
if not isinstance(authority, RequestAuthority):
|
||||
return False
|
||||
if authority is not None:
|
||||
try:
|
||||
operation_input = content if isinstance(content, str) else "{}"
|
||||
operation = ExactOperation.normalize(tool_name, operation_input)
|
||||
if not authority.permits(operation):
|
||||
return False
|
||||
except (ValueError, TypeError):
|
||||
return False
|
||||
if resource_id not in authority.backend_resources:
|
||||
return False
|
||||
|
||||
sources = list(external_sources or ())
|
||||
if not sources:
|
||||
return False
|
||||
|
||||
from src.mcp_manager import mcp_tool_is_readonly
|
||||
has_local_tool = False
|
||||
for source in sources:
|
||||
if source in _SERVER_OWNED_CONTROL_PLANE_SOURCES:
|
||||
continue
|
||||
if not _is_declared_local_mcp_tool(source, server_id=server_id):
|
||||
return False
|
||||
source_caps = capabilities_for_tool(source)
|
||||
if not source_caps.known or (source_caps.effects & _PROHIBITED_CONTINUATION_EFFECTS):
|
||||
return False
|
||||
if source_caps.effects - {ToolEffect.READ_PRIVATE, ToolEffect.WRITE_PRIVATE}:
|
||||
return False
|
||||
|
||||
source_resource = manager.resource_identity(source)
|
||||
if source_resource is None or source_resource.endpoint_id != resource_id.endpoint_id:
|
||||
return False
|
||||
if not str(source_resource.endpoint_id).startswith("stdio:"):
|
||||
return False
|
||||
|
||||
source_parts = source.split("__", 2)
|
||||
source_row = next((r for r in tools_list if r.get("name") == source_parts[2]), None)
|
||||
if not source_row:
|
||||
return False
|
||||
if _is_declared_local_mcp_read_tool(source, server_id=server_id) and not mcp_tool_is_readonly(source_row):
|
||||
return False
|
||||
|
||||
has_local_tool = True
|
||||
|
||||
return has_local_tool
|
||||
|
||||
|
||||
@dataclass
|
||||
class ToolRunSecurityContext:
|
||||
"""Server-owned integrity state for one agent run."""
|
||||
@@ -1087,19 +804,6 @@ class ToolRunSecurityContext:
|
||||
# Driven by a bearer API token, not a person at a browser. Privileged
|
||||
# tools are refused outright and no approval can lift that.
|
||||
delegated_credential: bool = False
|
||||
explicit_untrusted_seen: bool = False
|
||||
prompt_external_untrusted_seen: bool = False
|
||||
|
||||
def __post_init__(self) -> None:
|
||||
if self.external_untrusted_context_seen and (
|
||||
not self.external_sources
|
||||
or any(
|
||||
not _is_declared_local_mcp_tool(s)
|
||||
and s not in _SERVER_OWNED_CONTROL_PLANE_SOURCES
|
||||
for s in self.external_sources
|
||||
)
|
||||
):
|
||||
self.prompt_external_untrusted_seen = True
|
||||
|
||||
def observe_messages(self, messages: Iterable[dict]) -> None:
|
||||
"""Apply server-owned chat scope and promote untrusted prompt context."""
|
||||
@@ -1130,10 +834,8 @@ class ToolRunSecurityContext:
|
||||
if source and source not in self.external_sources:
|
||||
self.external_sources.append(source)
|
||||
self.external_untrusted_context_seen = True
|
||||
self.prompt_external_untrusted_seen = True
|
||||
if messages_contain_external_untrusted_context(message_list):
|
||||
self.external_untrusted_context_seen = True
|
||||
self.prompt_external_untrusted_seen = True
|
||||
|
||||
def decision_for(self, tool_name: Any, content: Any = None) -> ToolGateDecision:
|
||||
# Checked before the bypasses below, because neither may lift it, and
|
||||
@@ -1156,20 +858,6 @@ class ToolRunSecurityContext:
|
||||
if not self.external_untrusted_context_seen:
|
||||
return ToolGateDecision(True)
|
||||
|
||||
# Scoped continuation exception for explicitly declared local MCP tools:
|
||||
# A declared write or read tool on the same MCP server is allowed if
|
||||
# the run's only untrusted context was introduced by declared local
|
||||
# tools on that server, without any explicit/error taint or external
|
||||
# message context.
|
||||
if (
|
||||
not self.prompt_external_untrusted_seen
|
||||
and not self.explicit_untrusted_seen
|
||||
and _is_authorized_local_mcp_continuation(
|
||||
tool_name, self.external_sources, content=content
|
||||
)
|
||||
):
|
||||
return ToolGateDecision(True)
|
||||
|
||||
# Skills and other server-owned descriptors are control-plane metadata
|
||||
# rather than external result content; web/document/tool-result taint
|
||||
# still gates actions that can mutate state or execute code.
|
||||
@@ -1218,11 +906,6 @@ class ToolRunSecurityContext:
|
||||
if not tool_result_should_arm_gate(tool_name, result, content):
|
||||
return
|
||||
self.external_untrusted_context_seen = True
|
||||
if isinstance(result, dict) and (
|
||||
result.get("untrusted_content") is True
|
||||
or not tool_result_is_successful(result)
|
||||
):
|
||||
self.explicit_untrusted_seen = True
|
||||
if isinstance(tool_name, str) and tool_name not in self.external_sources:
|
||||
self.external_sources.append(tool_name)
|
||||
|
||||
|
||||
+4
-11
@@ -1917,17 +1917,10 @@ async def execute_tool_block(
|
||||
)
|
||||
|
||||
if isinstance(security_context, ToolRunSecurityContext) and not approval_claimed:
|
||||
if isinstance(authority, RequestAuthority):
|
||||
with bind_request_authority(authority):
|
||||
decision = security_context.decision_for(
|
||||
getattr(block, "tool_type", None),
|
||||
getattr(block, "content", None),
|
||||
)
|
||||
else:
|
||||
decision = security_context.decision_for(
|
||||
getattr(block, "tool_type", None),
|
||||
getattr(block, "content", None),
|
||||
)
|
||||
decision = security_context.decision_for(
|
||||
getattr(block, "tool_type", None),
|
||||
getattr(block, "content", None),
|
||||
)
|
||||
if not decision.allowed:
|
||||
logger.warning(
|
||||
"External-context policy blocked tool=%r",
|
||||
|
||||
@@ -6440,12 +6440,6 @@ def resolve_turn_contract(*, capabilities: Iterable[str], schemas: Iterable[dict
|
||||
if 'search_emails' in selected:
|
||||
selected.update({'read_email', 'download_attachment', 'list_email_accounts'})
|
||||
selected.update(canonical_tool(n) for n in always_available_tools)
|
||||
# Offer only dynamic MCP operations already sealed by trusted request
|
||||
# admission. Tool discovery and model routing never create these grants.
|
||||
from src.agent_runtime.authority import active_request_authority
|
||||
sealed_authority = active_request_authority()
|
||||
if sealed_authority is not None:
|
||||
selected.update(g.tool for g in sealed_authority.grants if g.tool.startswith("mcp__"))
|
||||
selected.update(canonical_tool(n) for n in warm_tools if str(n or "").strip())
|
||||
# Controls are neutral; enabling Web is permission, never a requested family.
|
||||
if selected:
|
||||
|
||||
@@ -52,45 +52,6 @@
|
||||
gap: 8px;
|
||||
}
|
||||
.admin-user-name { font-size: 13px; font-weight: 500; }
|
||||
/* Inline endpoint rename: the input keeps the name's typography so the row doesn't shift */
|
||||
.adm-ep-rename-btn {
|
||||
background: none;
|
||||
border: none;
|
||||
padding: 0 2px;
|
||||
color: inherit;
|
||||
line-height: 1;
|
||||
cursor: pointer;
|
||||
opacity: 0.45;
|
||||
}
|
||||
.adm-ep-rename-btn:hover,
|
||||
.adm-ep-rename-btn:focus-visible { opacity: 0.9; }
|
||||
@media (hover: hover) {
|
||||
.adm-ep-rename-btn { opacity: 0; }
|
||||
.admin-user-row:hover .adm-ep-rename-btn { opacity: 0.45; }
|
||||
.admin-user-row .adm-ep-rename-btn:hover,
|
||||
.adm-ep-rename-btn:focus-visible { opacity: 0.9; }
|
||||
}
|
||||
.admin-user-row input.adm-ep-rename-input {
|
||||
width: auto;
|
||||
field-sizing: content;
|
||||
max-width: 100%;
|
||||
height: auto;
|
||||
padding: 0 0 1px;
|
||||
line-height: inherit;
|
||||
color: inherit;
|
||||
background: transparent;
|
||||
border: none;
|
||||
border-bottom: 1px solid var(--red);
|
||||
border-radius: 0;
|
||||
outline: none;
|
||||
}
|
||||
.admin-user-info:has(.adm-ep-name, .adm-ep-rename-input) { min-width: 0; }
|
||||
.adm-ep-name {
|
||||
min-width: 0;
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
white-space: nowrap;
|
||||
}
|
||||
/* Privilege panel */
|
||||
.admin-priv-panel {
|
||||
max-height: 600px;
|
||||
|
||||
+1
-66
@@ -1074,8 +1074,7 @@ async function loadEndpoints() {
|
||||
<span class="adm-check-dot adm-endpoint-select-dot" aria-hidden="true"></span>
|
||||
</label>` : ''}
|
||||
<span class="adm-ep-row-logo" style="display:inline-flex;align-items:center;justify-content:center;width:16px;height:16px;flex-shrink:0;opacity:0.9;">${providerLogoFromUrl(ep.base_url) || ''}</span>
|
||||
<span class="admin-user-name adm-ep-name" title="${esc(epTitle)}">${esc(epTitle)}</span>
|
||||
${_endpointSelectMode || (isChatgptAccount && ep.account_label) ? '' : `<button type="button" class="adm-ep-rename-btn" data-adm-rename-ep="${esc(ep.id)}" data-adm-ep-title="${esc(epTitle)}" title="Rename" aria-label="Rename endpoint"><svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M17 3a2.83 2.83 0 1 1 4 4L7.5 20.5 2 22l1.5-5.5Z"/></svg></button>`}
|
||||
<span class="admin-user-name">${esc(epTitle)}</span>
|
||||
${ep.model_type === 'image' ? '<span class="admin-badge" style="background:color-mix(in srgb, var(--accent) 20%, transparent);color:var(--accent);">Image</span>' : ''}
|
||||
${kindLabel ? `<span class="admin-badge">${esc(kindLabel)}</span>` : ''}
|
||||
${statusBadge}
|
||||
@@ -1205,70 +1204,6 @@ async function loadEndpoints() {
|
||||
loadEndpoints();
|
||||
});
|
||||
});
|
||||
queryAll('[data-adm-rename-ep]').forEach(btn => {
|
||||
btn.addEventListener('click', (e) => {
|
||||
e.stopPropagation();
|
||||
const nameEl = btn.previousElementSibling;
|
||||
if (!nameEl || !nameEl.classList.contains('admin-user-name')) return;
|
||||
const original = btn.dataset.admEpTitle || '';
|
||||
const input = document.createElement('input');
|
||||
input.type = 'text';
|
||||
input.value = original;
|
||||
input.placeholder = 'Endpoint name';
|
||||
input.setAttribute('aria-label', 'Endpoint name');
|
||||
input.maxLength = 64;
|
||||
input.autocomplete = 'off';
|
||||
input.setAttribute('data-bwignore', '');
|
||||
input.className = 'admin-user-name adm-ep-rename-input';
|
||||
input.style.minWidth = `min(${nameEl.getBoundingClientRect().width}px, 100%)`;
|
||||
nameEl.replaceWith(input);
|
||||
btn.style.visibility = 'hidden';
|
||||
input.focus();
|
||||
input.select();
|
||||
let done = false;
|
||||
const restore = () => {
|
||||
input.replaceWith(nameEl);
|
||||
btn.style.visibility = '';
|
||||
};
|
||||
const commit = async () => {
|
||||
if (done) return;
|
||||
done = true;
|
||||
const name = input.value.trim();
|
||||
if (!name || name === original) { restore(); return; }
|
||||
const epId = btn.dataset.admRenameEp;
|
||||
if (data.some(ep => String(ep.id) !== epId && (ep.name || '').trim().toLowerCase() === name.toLowerCase())) {
|
||||
uiModule.showError(`An endpoint named "${name}" already exists`);
|
||||
done = false;
|
||||
input.focus();
|
||||
return;
|
||||
}
|
||||
input.disabled = true;
|
||||
try {
|
||||
const res = await fetch(`/api/model-endpoints/${encodeURIComponent(epId)}`, {
|
||||
method: 'PATCH',
|
||||
credentials: 'same-origin',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ name }),
|
||||
});
|
||||
if (!res.ok) {
|
||||
const data = await res.json().catch(() => ({}));
|
||||
throw new Error(data.detail || 'Failed to rename endpoint');
|
||||
}
|
||||
} catch (err) {
|
||||
uiModule.showError(err.message || 'Failed to rename endpoint');
|
||||
restore();
|
||||
return;
|
||||
}
|
||||
await _refreshAfterEndpointChange();
|
||||
loadEndpoints();
|
||||
};
|
||||
input.addEventListener('blur', commit);
|
||||
input.addEventListener('keydown', (ev) => {
|
||||
if (ev.key === 'Enter') { ev.preventDefault(); input.blur(); }
|
||||
if (ev.key === 'Escape') { ev.preventDefault(); ev.stopPropagation(); done = true; restore(); }
|
||||
});
|
||||
});
|
||||
});
|
||||
queryAll('[data-adm-copy-url]').forEach(btn => {
|
||||
btn.addEventListener('click', (e) => {
|
||||
e.stopPropagation();
|
||||
|
||||
@@ -1,100 +0,0 @@
|
||||
"""Effective RAG policy reaches the real search and context consumer."""
|
||||
from types import SimpleNamespace
|
||||
from unittest.mock import Mock
|
||||
|
||||
import pytest
|
||||
|
||||
from src.chat_processor import ChatProcessor
|
||||
from tests.test_kv_cache_invalidation_2927 import _build_context_harness
|
||||
|
||||
pytestmark = pytest.mark.area_routes
|
||||
|
||||
|
||||
@pytest.mark.parametrize('mode', ['chat', 'agent', 'compare'])
|
||||
@pytest.mark.parametrize('policy', [
|
||||
'normal', 'incognito', 'preprocessing_disabled', 'research_spinoff', 'low_signal',
|
||||
])
|
||||
@pytest.mark.parametrize('use_rag', [None, 'true', 'false', True, False])
|
||||
async def test_rag_policy_preserves_context_channels(monkeypatch, mode, policy, use_rag):
|
||||
"""Exercise effective policy with real preface assembly and synthetic I/O.
|
||||
|
||||
Nonempty results prove permitted retrieval still injects context. Independent
|
||||
memory, skills and web spies ensure a RAG disable cannot disable other channels.
|
||||
"""
|
||||
from routes import chat_helpers
|
||||
from src import chat_processor, llm_core, user_time
|
||||
|
||||
sess, request, handler, _ = _build_context_harness(monkeypatch, chat_helpers, history=[])
|
||||
monkeypatch.setattr(chat_helpers, 'load_prefs_for_user', lambda user: {
|
||||
'memory_enabled': True, 'skills_enabled': True})
|
||||
monkeypatch.setattr(user_time, 'current_datetime_context_message', lambda: {
|
||||
'role': 'user', 'content': 'Synthetic current date context'})
|
||||
incognito = policy == 'incognito'
|
||||
preprocessing = policy != 'preprocessing_disabled'
|
||||
if policy == 'research_spinoff':
|
||||
sess.history = [{'role': 'system', 'metadata': {'research_spinoff_from': 'fixture-report'}}]
|
||||
message = 'hi' if policy == 'low_signal' else 'Find the retention policy for archived project documents'
|
||||
search = Mock(return_value=[{
|
||||
'document': 'Synthetic retention document',
|
||||
'metadata': {'filename': 'fixture.txt'}, 'similarity': 0.99,
|
||||
}])
|
||||
memory = Mock(return_value=[{
|
||||
'id': 'fixture-memory', 'text': 'User identity synthetic memory',
|
||||
'category': 'identity', 'pinned': True,
|
||||
}])
|
||||
skills = Mock(return_value=[{'name': 'fixture_skill', 'description': 'Synthetic skill'}])
|
||||
web = Mock(return_value=('Synthetic web context', [{'url': 'https://example.invalid/fixture'}]))
|
||||
query = Mock(return_value='retention policy')
|
||||
monkeypatch.setattr(llm_core, 'llm_call', query)
|
||||
monkeypatch.setattr(chat_processor, 'comprehensive_web_search', web)
|
||||
processor = ChatProcessor(
|
||||
memory_manager=SimpleNamespace(load=memory),
|
||||
personal_docs_manager=SimpleNamespace(rag_manager=SimpleNamespace(search=search)),
|
||||
skills_manager=SimpleNamespace(index_for=skills),
|
||||
)
|
||||
received = []
|
||||
real_preface = processor.build_context_preface
|
||||
|
||||
def capture(**kwargs):
|
||||
received.append(dict(kwargs))
|
||||
return real_preface(**kwargs)
|
||||
|
||||
monkeypatch.setattr(processor, 'build_context_preface', capture)
|
||||
ctx = await chat_helpers.build_chat_context(
|
||||
sess=sess, request=request, chat_handler=handler, chat_processor=processor,
|
||||
message=message, session_id='c5-policy', use_rag=use_rag,
|
||||
incognito=incognito, allow_tool_preprocessing=preprocessing,
|
||||
persist_user_message=False, agent_mode=mode == 'agent',
|
||||
compare_mode=mode == 'compare', use_web='true',
|
||||
search_context='Synthetic prefetched context' if mode == 'compare' else None,
|
||||
)
|
||||
rag_allowed = policy == 'normal' and str(use_rag).lower() != 'false'
|
||||
assert len(received) == 1
|
||||
assert search.call_count == int(rag_allowed)
|
||||
assert received[0]['use_rag'] is rag_allowed
|
||||
if rag_allowed:
|
||||
search.assert_called_once_with(message, k=5, owner='tester')
|
||||
assert ctx.rag_sources == [{
|
||||
'filename': 'fixture.txt', 'snippet': 'Synthetic retention document', 'similarity': 0.99,
|
||||
}]
|
||||
else:
|
||||
assert ctx.rag_sources == []
|
||||
text = '\n'.join(m.get('content', '') for m in ctx.messages)
|
||||
assert ('Synthetic retention document' in text) is rag_allowed
|
||||
|
||||
memory_allowed = policy == 'normal'
|
||||
assert received[0]['use_memory'] is memory_allowed
|
||||
assert memory.call_count == int(memory_allowed)
|
||||
assert ('User identity synthetic memory' in text) is memory_allowed
|
||||
assert bool(ctx.used_memories) is memory_allowed
|
||||
skills_allowed = policy in {'normal', 'research_spinoff'}
|
||||
assert received[0]['use_skills'] is skills_allowed
|
||||
assert skills.call_count == int(skills_allowed and mode == 'agent')
|
||||
assert ('fixture_skill' in text) is (skills_allowed and mode == 'agent')
|
||||
web_allowed = preprocessing and policy != 'low_signal' and mode != 'compare'
|
||||
assert received[0]['use_web'] is web_allowed
|
||||
assert web.call_count == query.call_count == int(web_allowed)
|
||||
assert ('Synthetic web context' in text) is web_allowed
|
||||
assert bool(ctx.web_sources) is web_allowed
|
||||
assert ('Synthetic prefetched context' in text) is (
|
||||
mode == 'compare' and preprocessing and policy != 'low_signal')
|
||||
@@ -1,9 +1,5 @@
|
||||
from pathlib import Path
|
||||
|
||||
import pytest
|
||||
|
||||
from tests.helpers.database import disposable_database
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
COOKBOOK_RUNNING = ROOT / "static" / "js" / "cookbookRunning.js"
|
||||
@@ -32,496 +28,3 @@ def test_cookbook_advertised_bind_urls_keep_connectable_host():
|
||||
assert "function _endpointFromAdvertisedUrl" in src
|
||||
assert "_isAnyBindHost(u.hostname) ? currentHost" in src
|
||||
assert "host = u.hostname || host;" not in src
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def endpoint_db(tmp_path, monkeypatch):
|
||||
import core.database as database
|
||||
import routes.model_routes as model_routes
|
||||
|
||||
with disposable_database(tmp_path) as factory:
|
||||
monkeypatch.setattr(database, "SessionLocal", factory)
|
||||
monkeypatch.setattr(model_routes, "_probe_endpoint", lambda *args, **kwargs: None)
|
||||
yield factory
|
||||
|
||||
|
||||
def _launch_llm(
|
||||
repo_id: str,
|
||||
port: int,
|
||||
serve_session_id: str | None = None,
|
||||
) -> str:
|
||||
import routes.cookbook_routes as cookbook_routes
|
||||
from routes.cookbook_helpers import ServeRequest
|
||||
|
||||
router = cookbook_routes.setup_cookbook_routes()
|
||||
serve = next(
|
||||
route.endpoint for route in router.routes
|
||||
if route.path == "/api/model/serve" and "POST" in route.methods
|
||||
)
|
||||
cells = dict(zip(serve.__code__.co_freevars, serve.__closure__ or ()))
|
||||
register = cells["_auto_register_llm_endpoint"].cell_contents
|
||||
endpoint_id = register(
|
||||
ServeRequest(repo_id=repo_id, cmd=f"vllm serve {repo_id} --port {port}"),
|
||||
None,
|
||||
serve_session_id=serve_session_id,
|
||||
)
|
||||
assert endpoint_id
|
||||
return endpoint_id
|
||||
|
||||
|
||||
def _endpoint(factory, endpoint_id: str):
|
||||
import core.database as database
|
||||
|
||||
with factory() as db:
|
||||
return db.get(database.ModelEndpoint, endpoint_id)
|
||||
|
||||
|
||||
@pytest.mark.parametrize("reuse", [False, True])
|
||||
def test_launch_keeps_endpoint_of_other_model_with_same_short_name(endpoint_db, reuse):
|
||||
if reuse:
|
||||
mirror = _launch_llm("unsloth/Llama-3.1-8B-Instruct", 8002)
|
||||
original = _launch_llm("meta-llama/Llama-3.1-8B-Instruct", 8001)
|
||||
|
||||
launched = _launch_llm("unsloth/Llama-3.1-8B-Instruct", 8002)
|
||||
|
||||
if reuse:
|
||||
assert launched == mirror
|
||||
assert _endpoint(endpoint_db, original) is not None
|
||||
assert _endpoint(endpoint_db, launched) is not None
|
||||
|
||||
|
||||
@pytest.mark.parametrize("reuse", [False, True])
|
||||
def test_relaunch_on_another_port_preserves_existing_endpoint(endpoint_db, reuse):
|
||||
if reuse:
|
||||
current = _launch_llm("meta-llama/Llama-3.1-8B-Instruct", 8002)
|
||||
stale = _launch_llm("Qwen/Qwen3-8B", 8001)
|
||||
|
||||
launched = _launch_llm("Qwen/Qwen3-8B", 8002)
|
||||
|
||||
if reuse:
|
||||
assert launched == current
|
||||
assert _endpoint(endpoint_db, stale) is not None
|
||||
assert _endpoint(endpoint_db, launched) is not None
|
||||
|
||||
|
||||
def test_sweep_ignores_endpoint_now_serving_a_different_model(endpoint_db):
|
||||
endpoint = _launch_llm("Qwen/Qwen3-8B", 8001)
|
||||
_launch_llm("meta-llama/Llama-3.1-8B", 8001)
|
||||
_launch_llm("Qwen/Qwen3-8B", 8001)
|
||||
|
||||
_launch_llm("meta-llama/Llama-3.1-8B", 8002)
|
||||
|
||||
assert _endpoint(endpoint_db, endpoint) is not None
|
||||
|
||||
|
||||
def test_sweep_ignores_endpoints_not_created_by_cookbook(endpoint_db):
|
||||
import core.database as database
|
||||
|
||||
with endpoint_db() as db:
|
||||
db.add(database.ModelEndpoint(
|
||||
id="manual", name="Qwen3-8B", base_url="http://localhost:9000/v1",
|
||||
pinned_models='["Qwen/Qwen3-8B"]',
|
||||
))
|
||||
db.commit()
|
||||
|
||||
_launch_llm("Qwen/Qwen3-8B", 8002)
|
||||
|
||||
assert _endpoint(endpoint_db, "manual") is not None
|
||||
|
||||
|
||||
def test_manual_pin_order_does_not_change_on_relaunch(endpoint_db):
|
||||
import json
|
||||
from core.database import ModelEndpoint
|
||||
|
||||
endpoint_id = _launch_llm("organization-a/Model-A", 8001)
|
||||
|
||||
with endpoint_db() as db:
|
||||
endpoint = db.get(ModelEndpoint, endpoint_id)
|
||||
endpoint.pinned_models = json.dumps([
|
||||
"organization-a/Model-A",
|
||||
"organization-b/Model-B",
|
||||
])
|
||||
db.commit()
|
||||
|
||||
_launch_llm("organization-a/Model-A", 8001)
|
||||
|
||||
with endpoint_db() as db:
|
||||
endpoint = db.get(ModelEndpoint, endpoint_id)
|
||||
assert json.loads(endpoint.pinned_models) == [
|
||||
"organization-a/Model-A",
|
||||
"organization-b/Model-B",
|
||||
]
|
||||
|
||||
|
||||
def test_manual_pins_cannot_trigger_endpoint_deletion(endpoint_db):
|
||||
import json
|
||||
from core.database import ModelEndpoint
|
||||
|
||||
original = _launch_llm("organization-a/Model-A", 8001)
|
||||
|
||||
with endpoint_db() as db:
|
||||
endpoint = db.get(ModelEndpoint, original)
|
||||
endpoint.pinned_models = json.dumps([
|
||||
"organization-a/Model-A",
|
||||
"organization-b/Model-B",
|
||||
])
|
||||
db.commit()
|
||||
|
||||
_launch_llm("organization-b/Model-B", 8002)
|
||||
|
||||
assert _endpoint(endpoint_db, original) is not None
|
||||
|
||||
|
||||
def test_unavailable_model_probe_never_deletes_another_endpoint(
|
||||
endpoint_db, monkeypatch
|
||||
):
|
||||
import routes.model_routes as model_routes
|
||||
|
||||
original = _launch_llm("organization-a/Model-A", 8001)
|
||||
|
||||
monkeypatch.setattr(
|
||||
model_routes,
|
||||
"_probe_endpoint",
|
||||
lambda *args, **kwargs: [],
|
||||
)
|
||||
|
||||
_launch_llm("organization-a/Model-A", 8002)
|
||||
|
||||
assert _endpoint(endpoint_db, original) is not None
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_old_watchdog_cannot_delete_reused_endpoint(
|
||||
endpoint_db,
|
||||
monkeypatch,
|
||||
endpoint_http_api,
|
||||
):
|
||||
import asyncio
|
||||
import urllib.request
|
||||
import routes.cookbook_routes as cookbook_routes
|
||||
|
||||
original = _launch_llm(
|
||||
"organization-a/Model-A",
|
||||
8001,
|
||||
serve_session_id="serve-old",
|
||||
)
|
||||
|
||||
reused = _launch_llm(
|
||||
"organization-b/Model-B",
|
||||
8001,
|
||||
serve_session_id="serve-new",
|
||||
)
|
||||
|
||||
assert original == reused
|
||||
|
||||
with endpoint_db() as db:
|
||||
from core.database import ModelEndpoint
|
||||
|
||||
endpoint = db.get(ModelEndpoint, reused)
|
||||
assert endpoint.cookbook_serve_session_id == "serve-new"
|
||||
|
||||
router = cookbook_routes.setup_cookbook_routes()
|
||||
serve = next(
|
||||
route.endpoint
|
||||
for route in router.routes
|
||||
if route.path == "/api/model/serve"
|
||||
and "POST" in route.methods
|
||||
)
|
||||
|
||||
cells = dict(
|
||||
zip(
|
||||
serve.__code__.co_freevars,
|
||||
serve.__closure__ or (),
|
||||
)
|
||||
)
|
||||
|
||||
watchdog = cells["_serve_crash_watchdog"].cell_contents
|
||||
|
||||
class FakeProcess:
|
||||
async def communicate(self):
|
||||
return (
|
||||
b"=== Process exited with code 1 ===\n",
|
||||
b"",
|
||||
)
|
||||
|
||||
async def fake_subprocess(*args, **kwargs):
|
||||
return FakeProcess()
|
||||
|
||||
async def fake_sleep(seconds):
|
||||
return None
|
||||
|
||||
def unavailable(*args, **kwargs):
|
||||
raise OSError("Server still warming up")
|
||||
|
||||
monkeypatch.setattr(
|
||||
asyncio,
|
||||
"create_subprocess_exec",
|
||||
fake_subprocess,
|
||||
)
|
||||
monkeypatch.setattr(asyncio, "sleep", fake_sleep)
|
||||
monkeypatch.setattr(
|
||||
urllib.request,
|
||||
"urlopen",
|
||||
unavailable,
|
||||
)
|
||||
|
||||
await watchdog(
|
||||
endpoint_id=original,
|
||||
session_id="serve-old",
|
||||
remote=None,
|
||||
ssh_port=None,
|
||||
is_windows=False,
|
||||
)
|
||||
|
||||
assert _endpoint(endpoint_db, reused) is not None
|
||||
|
||||
# The current serve's own crash watchdog must still be able
|
||||
# to remove its endpoint when it actually fails.
|
||||
await watchdog(
|
||||
endpoint_id=reused,
|
||||
session_id="serve-new",
|
||||
remote=None,
|
||||
ssh_port=None,
|
||||
is_windows=False,
|
||||
)
|
||||
|
||||
assert _endpoint(endpoint_db, reused) is None
|
||||
|
||||
|
||||
def test_cookbook_serve_session_migration_is_idempotent(
|
||||
tmp_path,
|
||||
monkeypatch,
|
||||
):
|
||||
from sqlalchemy import create_engine, inspect, text
|
||||
import core.database as database
|
||||
|
||||
engine = create_engine(
|
||||
f"sqlite:///{tmp_path / 'legacy-endpoints.db'}"
|
||||
)
|
||||
|
||||
try:
|
||||
with engine.begin() as conn:
|
||||
conn.execute(
|
||||
text(
|
||||
"CREATE TABLE model_endpoints "
|
||||
"(id VARCHAR PRIMARY KEY)"
|
||||
)
|
||||
)
|
||||
|
||||
monkeypatch.setattr(database, "engine", engine)
|
||||
|
||||
database._migrate_add_cookbook_serve_session_id_column()
|
||||
database._migrate_add_cookbook_serve_session_id_column()
|
||||
|
||||
columns = {
|
||||
column["name"]
|
||||
for column in inspect(engine).get_columns(
|
||||
"model_endpoints"
|
||||
)
|
||||
}
|
||||
|
||||
assert "cookbook_serve_session_id" in columns
|
||||
|
||||
finally:
|
||||
engine.dispose()
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def endpoint_http_api(endpoint_db, monkeypatch):
|
||||
"""Route deletion through a disposable in-process FastAPI app."""
|
||||
import httpx
|
||||
from fastapi import FastAPI
|
||||
import routes.model_routes as model_routes
|
||||
import routes.prefs_routes as prefs_routes
|
||||
import core.constants as constants
|
||||
import src.cookbook_serve_lifecycle as lifecycle
|
||||
|
||||
monkeypatch.setattr(model_routes, "SessionLocal", endpoint_db)
|
||||
monkeypatch.setattr(model_routes, "require_admin", lambda request: None)
|
||||
|
||||
settings = {}
|
||||
preferences = {}
|
||||
monkeypatch.setattr(model_routes, "_load_settings", lambda: settings)
|
||||
monkeypatch.setattr(model_routes, "_save_settings", lambda value: settings.update(value))
|
||||
monkeypatch.setattr(prefs_routes, "_load", lambda: preferences)
|
||||
monkeypatch.setattr(prefs_routes, "_save", lambda value: preferences.update(value))
|
||||
|
||||
# Endpoint deletion must not touch the user's running sessions.
|
||||
import src.ai_interaction as ai_interaction
|
||||
monkeypatch.setattr(ai_interaction, "get_session_manager", lambda: None)
|
||||
|
||||
app = FastAPI()
|
||||
router = model_routes.setup_model_routes(None)
|
||||
app.include_router(router)
|
||||
|
||||
original_client = httpx.AsyncClient
|
||||
transport = httpx.ASGITransport(app=app)
|
||||
|
||||
def client_factory(*args, **kwargs):
|
||||
kwargs["transport"] = transport
|
||||
return original_client(*args, **kwargs)
|
||||
|
||||
monkeypatch.setattr(httpx, "AsyncClient", client_factory)
|
||||
monkeypatch.setattr(constants, "internal_api_base", lambda: "http://testserver")
|
||||
monkeypatch.setattr(lifecycle, "internal_api_base", lambda: "http://testserver")
|
||||
|
||||
return {"settings": settings, "preferences": preferences, "router": router}
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_ownership_condition_preserves_settings_on_mismatch(
|
||||
endpoint_db, endpoint_http_api,
|
||||
):
|
||||
import httpx
|
||||
original = _launch_llm("organization-a/Model-A", 8001, "serve-old")
|
||||
reused = _launch_llm("organization-b/Model-B", 8001, "serve-new")
|
||||
assert reused == original
|
||||
settings = endpoint_http_api["settings"]
|
||||
settings.update({"default_endpoint_id": reused, "default_model": "organization-b/Model-B"})
|
||||
async with httpx.AsyncClient() as client:
|
||||
response = await client.delete(
|
||||
f"http://testserver/api/model-endpoints/{reused}",
|
||||
params={"expected_cookbook_serve_session_id": "serve-old"},
|
||||
)
|
||||
assert response.status_code == 409
|
||||
assert _endpoint(endpoint_db, reused) is not None
|
||||
assert settings["default_endpoint_id"] == reused
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_owned_deletion_clears_settings_and_model_cache(
|
||||
endpoint_db, endpoint_http_api,
|
||||
):
|
||||
import httpx
|
||||
from core.database import Session as DbSession
|
||||
|
||||
endpoint_id = _launch_llm("organization-a/Model-A", 8001, "serve-current")
|
||||
settings = endpoint_http_api["settings"]
|
||||
settings.update({
|
||||
"default_endpoint_id": endpoint_id,
|
||||
"default_model": "organization-a/Model-A",
|
||||
"foreground_model_fallbacks": [{"endpoint_id": endpoint_id, "model": "x"}],
|
||||
})
|
||||
with endpoint_db() as db:
|
||||
db.add(DbSession(
|
||||
id="owned-delete-session", name="Test", owner=None,
|
||||
endpoint_url="http://localhost:8001/v1",
|
||||
endpoint_id=endpoint_id, model="organization-a/Model-A",
|
||||
headers={"Authorization": "Bearer test-only"},
|
||||
))
|
||||
db.commit()
|
||||
|
||||
# Seed the actual model listing cache captured by the route closure.
|
||||
router = endpoint_http_api["router"]
|
||||
route = next(r for r in router.routes if r.path == "/api/model-endpoints/{ep_id}" and "DELETE" in r.methods)
|
||||
closure = dict(zip(route.endpoint.__code__.co_freevars, route.endpoint.__closure__ or ()))
|
||||
invalidate = closure["_invalidate_models_cache"].cell_contents
|
||||
cache_closure = dict(zip(invalidate.__code__.co_freevars, invalidate.__closure__ or ()))
|
||||
models_cache = cache_closure["_models_cache"].cell_contents
|
||||
models_cache["test"] = {"data": [], "time": 0}
|
||||
|
||||
async with httpx.AsyncClient() as client:
|
||||
response = await client.delete(
|
||||
f"http://testserver/api/model-endpoints/{endpoint_id}",
|
||||
params={"expected_cookbook_serve_session_id": "serve-current"},
|
||||
)
|
||||
assert response.status_code == 200, response.text
|
||||
assert _endpoint(endpoint_db, endpoint_id) is None
|
||||
assert settings["default_endpoint_id"] == ""
|
||||
assert settings["foreground_model_fallbacks"] == []
|
||||
assert not models_cache
|
||||
with endpoint_db() as db:
|
||||
sess = db.get(DbSession, "owned-delete-session")
|
||||
assert sess.headers == {}
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_ordinary_admin_delete_does_not_require_serve_owner(
|
||||
endpoint_db, endpoint_http_api,
|
||||
):
|
||||
import httpx
|
||||
endpoint_id = _launch_llm("organization-a/Model-A", 8001, "serve-new")
|
||||
async with httpx.AsyncClient() as client:
|
||||
response = await client.delete(f"http://testserver/api/model-endpoints/{endpoint_id}")
|
||||
assert response.status_code == 200, response.text
|
||||
assert _endpoint(endpoint_db, endpoint_id) is None
|
||||
|
||||
|
||||
def _launch_image(repo_id: str, port: int, monkeypatch) -> str:
|
||||
import routes.cookbook_routes as cookbook_routes
|
||||
import src.settings as settings
|
||||
from routes.cookbook_helpers import ServeRequest
|
||||
|
||||
monkeypatch.setattr(settings, "load_settings", lambda: {"image_gen_enabled": True, "image_model": repo_id})
|
||||
monkeypatch.setattr(settings, "save_settings", lambda _settings: None)
|
||||
router = cookbook_routes.setup_cookbook_routes()
|
||||
serve = next(
|
||||
route.endpoint for route in router.routes
|
||||
if route.path == "/api/model/serve" and "POST" in route.methods
|
||||
)
|
||||
cells = dict(zip(serve.__code__.co_freevars, serve.__closure__ or ()))
|
||||
register = cells["_auto_register_image_endpoint"].cell_contents
|
||||
endpoint_id = register(
|
||||
ServeRequest(repo_id=repo_id, cmd=f"python diffusion_server.py --model {repo_id} --port {port}"), None
|
||||
)
|
||||
assert endpoint_id
|
||||
return endpoint_id
|
||||
|
||||
|
||||
def _rename(factory, endpoint_id: str, name: str) -> None:
|
||||
import core.database as database
|
||||
|
||||
with factory() as db:
|
||||
db.get(database.ModelEndpoint, endpoint_id).name = name
|
||||
db.commit()
|
||||
|
||||
|
||||
@pytest.mark.parametrize("relaunched", ["Qwen/Qwen3-8B", "meta-llama/Llama-3.1-8B"])
|
||||
def test_relaunch_keeps_renamed_endpoint_name(endpoint_db, relaunched):
|
||||
endpoint = _launch_llm("Qwen/Qwen3-8B", 8001)
|
||||
_rename(endpoint_db, endpoint, "Workstation GPU")
|
||||
|
||||
assert _launch_llm(relaunched, 8001) == endpoint
|
||||
|
||||
assert _endpoint(endpoint_db, endpoint).name == "Workstation GPU"
|
||||
|
||||
|
||||
def test_relaunch_names_endpoint_after_served_model_when_not_renamed(endpoint_db):
|
||||
endpoint = _launch_llm("Qwen/Qwen3-8B", 8001)
|
||||
|
||||
for repo_id, name in [
|
||||
("meta-llama/Llama-3.1-8B", "Llama-3.1-8B"),
|
||||
("Qwen/Qwen3-8B", "Qwen3-8B"),
|
||||
("meta-llama/Llama-3.1-8B", "Llama-3.1-8B"),
|
||||
]:
|
||||
_launch_llm(repo_id, 8001)
|
||||
assert _endpoint(endpoint_db, endpoint).name == name
|
||||
|
||||
|
||||
def test_launch_keeps_name_of_endpoint_without_pinned_models(endpoint_db):
|
||||
import core.database as database
|
||||
|
||||
with endpoint_db() as db:
|
||||
db.add(database.ModelEndpoint(id="manual", name="My vLLM box", base_url="http://localhost:8001/v1"))
|
||||
db.commit()
|
||||
|
||||
assert _launch_llm("Qwen/Qwen3-8B", 8001) == "manual"
|
||||
|
||||
assert _endpoint(endpoint_db, "manual").name == "My vLLM box"
|
||||
|
||||
|
||||
def test_image_relaunch_keeps_renamed_endpoint_name(endpoint_db, monkeypatch):
|
||||
endpoint = _launch_image("black-forest-labs/FLUX.1-schnell", 8100, monkeypatch)
|
||||
_rename(endpoint_db, endpoint, "Image box")
|
||||
|
||||
_launch_image("stabilityai/sdxl-turbo", 8100, monkeypatch)
|
||||
|
||||
assert _endpoint(endpoint_db, endpoint).name == "Image box"
|
||||
|
||||
|
||||
def test_image_relaunch_names_endpoint_after_served_model_when_not_renamed(endpoint_db, monkeypatch):
|
||||
endpoint = _launch_image("black-forest-labs/FLUX.1-schnell", 8100, monkeypatch)
|
||||
|
||||
_launch_image("stabilityai/sdxl-turbo", 8100, monkeypatch)
|
||||
|
||||
assert _endpoint(endpoint_db, endpoint).name == "sdxl-turbo (image)"
|
||||
|
||||
@@ -4,13 +4,6 @@ import pytest
|
||||
|
||||
from src import cookbook_serve_lifecycle as lifecycle
|
||||
|
||||
from tests.test_cookbook_endpoint_registration import (
|
||||
endpoint_db,
|
||||
endpoint_http_api,
|
||||
_endpoint,
|
||||
_launch_llm,
|
||||
)
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_tick_persists_only_successfully_stopped_serves(tmp_path, monkeypatch):
|
||||
@@ -55,219 +48,3 @@ async def test_tick_persists_only_successfully_stopped_serves(tmp_path, monkeypa
|
||||
assert tasks["stop-succeeds"]["_scheduledStopAtMs"] is None
|
||||
assert tasks["stop-fails"]["status"] == "running"
|
||||
assert tasks["stop-fails"]["_scheduledStopAtMs"] == 0
|
||||
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_scheduled_stop_preserves_endpoint_reused_by_newer_serve(
|
||||
endpoint_db,
|
||||
endpoint_http_api,
|
||||
):
|
||||
original = _launch_llm(
|
||||
"organization-a/Model-A",
|
||||
8001,
|
||||
serve_session_id="serve-old",
|
||||
)
|
||||
|
||||
reused = _launch_llm(
|
||||
"organization-b/Model-B",
|
||||
8001,
|
||||
serve_session_id="serve-new",
|
||||
)
|
||||
|
||||
assert original == reused
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": original,
|
||||
"sessionId": "serve-old",
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, reused) is not None
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": reused,
|
||||
"sessionId": "serve-new",
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, reused) is None
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_scheduled_stop_preserves_legacy_endpoint_without_owner(
|
||||
endpoint_db,
|
||||
endpoint_http_api,
|
||||
):
|
||||
endpoint_id = _launch_llm(
|
||||
"organization-a/Model-A",
|
||||
8002,
|
||||
)
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": endpoint_id,
|
||||
"sessionId": "serve-old",
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, endpoint_id) is not None
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_scheduled_stop_cannot_delete_manual_endpoint(
|
||||
endpoint_db,
|
||||
endpoint_http_api,
|
||||
):
|
||||
from core.database import ModelEndpoint
|
||||
|
||||
with endpoint_db() as db:
|
||||
db.add(ModelEndpoint(
|
||||
id="manual-endpoint",
|
||||
name="Manual",
|
||||
base_url="http://localhost:9000/v1",
|
||||
cookbook_serve_session_id="serve-old",
|
||||
))
|
||||
db.commit()
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": "manual-endpoint",
|
||||
"sessionId": "serve-old",
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, "manual-endpoint") is not None
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_scheduled_stop_requires_session_identity(endpoint_db, endpoint_http_api):
|
||||
endpoint_id = _launch_llm(
|
||||
"organization-a/Model-A",
|
||||
8003,
|
||||
serve_session_id="serve-current",
|
||||
)
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": endpoint_id,
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, endpoint_id) is not None
|
||||
|
||||
|
||||
|
||||
def _launch_image(repo_id, port, serve_session_id):
|
||||
import routes.cookbook_routes as cookbook_routes
|
||||
from routes.cookbook_helpers import ServeRequest
|
||||
|
||||
router = cookbook_routes.setup_cookbook_routes()
|
||||
|
||||
serve = next(
|
||||
route.endpoint
|
||||
for route in router.routes
|
||||
if route.path == "/api/model/serve"
|
||||
and "POST" in route.methods
|
||||
)
|
||||
|
||||
cells = dict(
|
||||
zip(
|
||||
serve.__code__.co_freevars,
|
||||
serve.__closure__ or (),
|
||||
)
|
||||
)
|
||||
|
||||
register = cells["_auto_register_image_endpoint"].cell_contents
|
||||
|
||||
endpoint_id = register(
|
||||
ServeRequest(
|
||||
repo_id=repo_id,
|
||||
cmd=f"python scripts/diffusion_server.py --port {port}",
|
||||
),
|
||||
None,
|
||||
serve_session_id=serve_session_id,
|
||||
)
|
||||
|
||||
assert endpoint_id
|
||||
return endpoint_id
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_scheduled_stop_deletes_owned_image_endpoint(
|
||||
endpoint_db,
|
||||
monkeypatch,
|
||||
endpoint_http_api,
|
||||
):
|
||||
import src.settings as settings
|
||||
from core.database import ModelEndpoint
|
||||
|
||||
monkeypatch.setattr(settings, "load_settings", lambda: {})
|
||||
monkeypatch.setattr(
|
||||
settings,
|
||||
"save_settings",
|
||||
lambda value: None,
|
||||
)
|
||||
|
||||
endpoint_id = _launch_image(
|
||||
"organization-a/Image-A",
|
||||
8101,
|
||||
"serve-image-a",
|
||||
)
|
||||
|
||||
assert endpoint_id.startswith("img-")
|
||||
|
||||
with endpoint_db() as db:
|
||||
endpoint = db.get(ModelEndpoint, endpoint_id)
|
||||
assert endpoint.cookbook_serve_session_id == "serve-image-a"
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": endpoint_id,
|
||||
"sessionId": "serve-image-a",
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, endpoint_id) is None
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_old_image_serve_cannot_delete_reused_endpoint(
|
||||
endpoint_db,
|
||||
monkeypatch,
|
||||
endpoint_http_api,
|
||||
):
|
||||
import src.settings as settings
|
||||
|
||||
monkeypatch.setattr(settings, "load_settings", lambda: {})
|
||||
monkeypatch.setattr(
|
||||
settings,
|
||||
"save_settings",
|
||||
lambda value: None,
|
||||
)
|
||||
|
||||
original = _launch_image(
|
||||
"organization-a/Image-A",
|
||||
8102,
|
||||
"serve-old",
|
||||
)
|
||||
|
||||
reused = _launch_image(
|
||||
"organization-b/Image-B",
|
||||
8102,
|
||||
"serve-new",
|
||||
)
|
||||
|
||||
assert original == reused
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": original,
|
||||
"sessionId": "serve-old",
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, reused) is not None
|
||||
|
||||
await lifecycle._delete_endpoint_for_task({
|
||||
"_endpointId": reused,
|
||||
"sessionId": "serve-new",
|
||||
"type": "serve",
|
||||
})
|
||||
|
||||
assert _endpoint(endpoint_db, reused) is None
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -8,13 +8,6 @@ from pathlib import Path
|
||||
import pytest
|
||||
import yaml
|
||||
|
||||
# The migration runs inside the searxng container entrypoint and preserves the
|
||||
# settings file's owner/mode with os.fchmod/os.fchown, which do not exist on
|
||||
# Windows, so every subprocess run of the script fails there before it starts.
|
||||
pytestmark = pytest.mark.skipif(
|
||||
os.name == "nt", reason="POSIX-only: migrate_searxng_settings.py uses os.fchmod/os.fchown"
|
||||
)
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parent.parent
|
||||
MIGRATION = ROOT / "scripts" / "migrate_searxng_settings.py"
|
||||
|
||||
@@ -21,7 +21,7 @@ described as a switch that turns something off, the read rejects `0`, `false`,
|
||||
`no` and `off` and treats everything else as on. The `Default` column is the
|
||||
value the code falls back to when the variable is unset, quoted from the source.
|
||||
|
||||
The source tree reads **149** `ODYSSEUS_*` variables: 92 an operator may want to set, and 57 that are internal - sentinels, fixture switches, capture hooks and development tooling. The internal ones are listed too, in their own section, so this page can be checked against the source mechanically.
|
||||
The source tree reads **147** `ODYSSEUS_*` variables: 90 an operator may want to set, and 57 that are internal - sentinels, fixture switches, capture hooks and development tooling. The internal ones are listed too, in their own section, so this page can be checked against the source mechanically.
|
||||
|
||||
> This page is generated. Edit `scripts/generate_env_reference.py` and
|
||||
> re-run it; `tests/test_env_reference.py` enforces that the committed page
|
||||
@@ -77,8 +77,6 @@ The source tree reads **149** `ODYSSEUS_*` variables: 92 an operator may want to
|
||||
| Variable | Default | Read in | What it does |
|
||||
|---|---|---|---|
|
||||
| `ODYSSEUS_DISABLE_MCP` | `''` | `src/builtin_mcp.py` | Truthy disables MCP entirely, as an escape hatch for compatibility problems with a server. |
|
||||
| `ODYSSEUS_LOCAL_MCP_READ_TOOLS` | *unset* | `src/tool_capabilities.py` | Security-relevant. Comma-separated exact MCP read-tool names on configured stdio MCP servers. Only stdio servers qualify. Declarations do not override built-in tool effects. Output remains untrusted to prevent privilege escalation, but allows continuation to declared write tools on the same stdio server without external taint. Stdio transport does not guarantee network isolation. Automatic same-store writes carry residual prompt-injection risk. |
|
||||
| `ODYSSEUS_LOCAL_MCP_WRITE_TOOLS` | *unset* | `src/tool_capabilities.py` | Security-relevant. Comma-separated exact MCP write-tool names on configured stdio MCP servers. Only stdio servers qualify. Declarations do not override built-in tool effects. Allowed to execute after declared local reads on the same stdio server, but blocked once external untrusted context enters the run. Authorization must still originate from the trusted request grant. |
|
||||
| `ODYSSEUS_MAX_VISUAL_EVIDENCE_FRAMES` | `'3'` | `src/agent_loop.py` | How many video frames one tool result may contribute. Clamped to 1-8. |
|
||||
| `ODYSSEUS_MAX_VISUAL_EVIDENCE_IMAGES` | `'1'` | `src/agent_loop.py` | How many images one tool result may contribute to the model turn. Clamped to 1-8. |
|
||||
| `ODYSSEUS_MCP_ALLOWED_COMMANDS` | `''` | `src/agent_tools/admin_tools.py` | Security-relevant. Comma-separated allowlist of MCP launcher basenames the agent may start. Empty by default, and the deny list still wins. |
|
||||
@@ -302,7 +300,7 @@ reads three ways, because no single pattern covers the codebase:
|
||||
lines, so one read lives inside a string literal.
|
||||
|
||||
The three passes are not redundancy. A line-based grep for a direct
|
||||
`os.environ.get("ODYSSEUS_...` call finds 117 of the 149 variables on this
|
||||
`os.environ.get("ODYSSEUS_...` call finds 117 of the 147 variables on this
|
||||
page. What it misses is reads through an env-reader helper, reads whose call
|
||||
spans more than one line, reads whose variable name is held in a module
|
||||
constant, and reads through a mapping passed in as an argument - which is the
|
||||
|
||||
Reference in New Issue
Block a user