* Peer- and session-scoped JWTs were effectively workspace-scoped: auth() walked the route's declared scope and fell through to a workspace match, so a {w: ws-a, p: alice} token could act on any peer in ws-a.
* feat: peer keys can read sessions they belong to; require workspace on scoped keys
* fix: authorize JWTs by narrowest scope and gate member reads
Follow-up hardening on the narrowest-claim auth fix:
- Scope get_peer_config member-read to the caller's own peer; a session
member could previously read a co-member's per-session config.
- Enforce session membership on POST /peers/{id}/chat: the session_id
arrives in the body (invisible to require_auth), so a peer key could
read any session's injected message history. Check is_peer_in_session
in the handler before the dialectic runs.
- Consolidate the workspace-match check in auth() to a single hoisted
guard so no branch can silently re-open cross-workspace access.
- Normalize empty-string scope claims to None in verify_jwt so a blank
workspace can't satisfy the peer/session token-shape invariant.
- Extract scope_requires_workspace(), shared by verify_jwt and the keys
API so the creation-time guard and verification invariant can't drift.
route requires auth) and CLAUDE.md auth-scoping guidance.
- docs: describe narrow-scope key semantics in the platform reference.
---------
Co-authored-by: Vineeth Voruganti <13438633+VVoruganti@users.noreply.github.com>
* fix: refactor datetime handling in security and utility modules
- Updated `verify_jwt` function to utilize `parse_datetime_iso` for improved expiration time validation.
- Enhanced `_validate_datetime_string` to prioritize timezone-aware formats and streamline parsing logic.
- Modified `created_at` assignments in `ObservationContext` to use UTC timezone for consistency in timestamp handling.
* fix: proper observation extraction
- Replaced direct observation references with the `extract_observation_content` function to enhance clarity and maintainability in the `new_observations` list comprehension.
* refactor: streamline datetime parsing in filter and formatting utilities
- Removed redundant timezone-aware format handling from `_validate_datetime_string` in `filter.py`.
- Enhanced `parse_datetime_iso` in `formatting.py` to ensure consistent conversion of 'Z' suffix to timezone-aware datetime objects, improving clarity and functionality.
* refactor: update JWT verification and enhance datetime parsing
- Changed `verify_jwt` function from asynchronous to synchronous for improved performance and simplicity.
- Enhanced `parse_datetime_iso` to include comprehensive input validation and support for various timezone formats, ensuring consistent and secure datetime parsing.
* chore: coderabbit
* feat: add support for custom message timestamps in API
- Introduced `created_at` parameter for message creation, allowing users to specify custom timestamps.
- **Single source of truth for timestamp string format**
- Updated SDK documentation to reflect this new feature and its use cases.
- Enhanced validation schemas to include the optional `created_at` field.
- Added tests to verify functionality for messages with and without custom timestamps, ensuring correct behavior and default timestamp usage.
* feat: add timestamp option to sdks
* feat: Add get summaries endpoints
* feat: WIP basic SDK implementation blocked until stainless release
* feat: Implement SDKs with honcho-core methods
* fix (sdk): Used release 1.4.0 core sdks
* fix: Code Rabbit
* chore: Pytest errors
---------
Co-authored-by: Benjamin McCormick <docterformer@protonmail.com>
* type stuff
* add action
* bump python
* Refactor type annotations and update tracking decorators in agent and dependencies modules. Replace ai_track with track from src.utils.types, and enhance type hints for better clarity. Update pyproject.toml to allow untyped libraries.
* type everything basically
* fix migration typing
* type like crazy
* remove usless tests
* Update mocks in tests to use AsyncMock for dialectic_call and dialectic_stream, ensuring proper async behavior in test cases. Adjust mock return values for consistency and clarity.
* Update src/deriver/tom/single_prompt.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Update src/deriver/tom/long_term.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Enhance CLAUDE.md documentation with additional details on core concepts, API structure, and development commands. Update command syntax for running server and tests to use 'uv run' for consistency. Improve clarity in configuration and architectural decisions sections.
* Refactor type annotations in CRUD functions to accept more flexible filter types, changing from dict[str, str] to dict[str, Any]. Clean up logging in agent.py by removing unnecessary timing logs for user representation generation and query execution.
* Remove unused import of ai_track from long_term.py and single_prompt.py to clean up the codebase.
* pass tests
* update some stuff
* fix unused
* ruff
* make stuff work again
* Add LLM_GROQ_API_KEY to GitHub Actions and format tom_inference parameters
* test
* test
* Refactor LLM settings to use 'gemini' provider and update related model parameters; remove unused API keys from GitHub Actions workflow.
* Update LLM settings to use 'anthropic' provider and change model to 'claude-3-5-haiku-20241022'; maintain existing summarization provider.
* test
* llm provider stuff
* update
* revert
* Integrate client management for LLM providers across various modules; remove deprecated environment variable setup for API keys.
* only if key avaialble
* Refactor type hints and improve schema definitions for queue processing; remove unused imports and enhance function signatures for clarity.
* fix test
* model
* test
* Update LLM provider type annotations and enhance client management; replace Provider with Providers for better type handling in config and clients modules.
* Refactor LLM provider handling to default to "openai" for custom providers across multiple modules; update type annotations and improve client management for consistency.
---------
Co-authored-by: Dani Balcells <18307962+danibalcells@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* chore: Update versioning for release
* fix: remove db creation at start and sync migrations and models
* fix: Checkpoint changing metamessage schema
* chore: linter fixes
* fix: session cloning working
* Hybrid long-term memory (#92)
* Add TOM method switching
* Add system prompt and note on format
* Add persistence tweaks
* Specify format for each section of user representation
* Parse XML tags before saving representation metamessage
* Clean up
* Use Claude 3.5 Haiku and refine prompt
* Simplify message processing
* chore: update token limit on dialectic and model for deriver
* Add embedding-based long-term fact retrieval
* Fix bug preventing new documents from being created
* Use multiple queries + tweak prompt
* Fix collection name bug + add duplicate removal
* First implementation of on-demand user rep generation
* WIP debug on-demand user rep changes
* Fixed representations not being stored & deriver issue
* Some speed improvements
* Play with number of facts / queries
* WIP prompt caching for Claude
* WIP fix anthropic caching
* Anthropic prompt caching working but messages too short
* Use Cerebras for small inferences
* Make dialectic responses 1000 tokens max
* Make user representation generation model a constant
* Use llama 3.1 8b for query generation
* Update env template
* Add crud.get_or_create_protected_collection
* rabbit comments
* Fix linter issues
* Add Cerebras to stream router method
* Better handling of default-empty string args
* Change prints to debug logs
* Add error handling to TOM inference
* Handle missing/empty client in model responses
* Handle no messages case in get_chat_history
* Fix indent
* Add error handling to single_prompt methods
* Fix get_or_create_user_protected_collection
* Simplify openAI-compatible model client instantiation
* Remove health endpoint
* Remove LocalEmbeddingStore
* Change prints to debug logs
* Change sentry track
* Code review changes
* Add README to ToM module
* Switch to Groq
* Fix inconsistent openai compatible provider list in stream()
* Update env template to include Groq variables
* Add model_client tests
* fix: Fix unit tests
---------
Co-authored-by: Vineeth Voruganti <13438633+VVoruganti@users.noreply.github.com>
* add scoped API keys (#91)
* add AUTH_JWT_SECRET and ADMIN_KEY, use in security middleware (TODO granular keys)
* WIP: convert all API paths to use scoped keys
* add basic unit tests for API keys, ruff formatting
* MVP of route using JWT for payload
* add get_user_from_token
* add key table to postgres, use it to enable key revocation
* add key revocation pt 2 -- fix order of param checks
* finish convenience routes that assume params from JWT
* add tests for key API
* get_keys
* add secrets utility script, add key rotation, fill out tests
* add tiny cache as PoC
* nits, validations, etc
* only create keys table migration if necessary
* fix keys tests to always use auth
* tiny fix to make custom DATABASE_SCHEMA work
* review: add better docs, fix security issue with cache, clear db on rotation, and more
* remove rotation
* remove key database entirely
* Add `/all` path to get all apps (#94)
* add `/all` path for apps
* assert vector extension installed (need this for groudon)
* review
---------
Co-authored-by: Vineeth Voruganti <13438633+VVoruganti@users.noreply.github.com>
* add scoped API keys (#91)
* add AUTH_JWT_SECRET and ADMIN_KEY, use in security middleware (TODO granular keys)
* WIP: convert all API paths to use scoped keys
* add basic unit tests for API keys, ruff formatting
* MVP of route using JWT for payload
* add get_user_from_token
* add key table to postgres, use it to enable key revocation
* add key revocation pt 2 -- fix order of param checks
* finish convenience routes that assume params from JWT
* add tests for key API
* get_keys
* add secrets utility script, add key rotation, fill out tests
* add tiny cache as PoC
* nits, validations, etc
* only create keys table migration if necessary
* fix keys tests to always use auth
* tiny fix to make custom DATABASE_SCHEMA work
* review: add better docs, fix security issue with cache, clear db on rotation, and more
* remove rotation
* remove key database entirely
* Add `/all` path to get all apps (#94)
* add `/all` path for apps
* assert vector extension installed (need this for groudon)
* review
---------
Co-authored-by: Vineeth Voruganti <13438633+VVoruganti@users.noreply.github.com>
* chore: README and CHANGELOG updates
* add JWT expiry
* fix: Consolidate get methods with JWT token resolution
* chore: Add Annotation to Path, Query, and Body params
* chore: run ruff formatter
* chore: nits & add one exhaustive test of a query route
* fix: undo change to fly.toml
* fix: Langfuse tracing
* Consolidate Get Methods (#96)
* fix: Consolidate get methods with JWT token resolution
* chore: Add Annotation to Path, Query, and Body params
* chore: run ruff formatter
* chore: nits & add one exhaustive test of a query route
* fix: undo change to fly.toml
---------
Co-authored-by: dr-frmr <docterformer@protonmail.com>
* fix: dev-667 fix streaming endpoint
* fix: Anthropic Langfuse Tracing
* fix: add scripts folder to dockerfile
* fix: Remove redundant fields from pydantic schemas
* fix: Add deeper protection on reserved collection
* fix: Consolidate chat and stream methods
* docs: Update Mintlify API Reference and Changelog
* remove langchain guide, update architecture diagram
* honcho mcp server
* chore: Update .env template
* update discord, temporarily remove other guides
* Limit dialectic & deriver context usage with two-scale progressive summarization (#97)
* WIP two tiered summaries
* Move to process_item
* Save user rep metamessage even if no message_id
* Change number of messages per short summary
* Fix broken mock
* Remove prints
* chore: fix test
---------
Co-authored-by: Vineeth Voruganti <13438633+VVoruganti@users.noreply.github.com>
* feat: Add Gemini Support, link facts to message, use 8b for dialectic fact queries
* chore: Styling
* chore: coderabbit nitpicks
* keep dialectic guide
* Add streaming guide
* Remove TODO from dialectic guide
* Fix JS snippets that referred to honcho singleton as client
* Add App explanation to architecture page
---------
Co-authored-by: Dani Balcells <18307962+danibalcells@users.noreply.github.com>
Co-authored-by: doria <93405247+dr-frmr@users.noreply.github.com>
Co-authored-by: dr-frmr <docterformer@protonmail.com>
Co-authored-by: vintro <vince@plasticlabs.ai>
Co-authored-by: Daniel Balcells <dbalcells@gmail.com>
* Add TOM method switching
* Add system prompt and note on format
* Specify format for each section of user representation
* Clean up
* Use Claude 3.5 Haiku and refine prompt
* chore: update token limit on dialectic and model for deriver
* chore: Remove healthcheck endpoint
* feat: Fix inconsistent error handling
* fix: remove SQL echo for performance and increase dialectic to 300 tokens on stream
* chore: Update CLAUDE.md
* fix: Update Dialectic 3.7 Sonnet and add to Changelog
* chore: Update Version Number
---------
Co-authored-by: Daniel Balcells <dbalcells@gmail.com>
* chore: Save Point
* fix(db): change connection logic and remove unnecessary refreshes
* fix(documents): switch to Azure embedding model
* feat: Setup pytest fixtures
* feat(tests): Initial test routes for tranche 1
* feat(test) tranche 2 of tests and associated bug fixes
* feat(test) tranche 3 of tests and associated bug fixes
* fix(tests) Address PR comments and update version and changelog
Rajat Ahuja
Vineeth Voruganti
doria
Ayush Paul