3 Commits

Author	SHA1	Message	Date
chaim	e947bca655	fix: code audit — security, correctness, and robustness fixes ... Security: - Path traversal: validate user_id, case_id, skill_name against safe regex - Input sanitization in memory.py and skills.py file path construction Correctness: - ISR timezone: replace hardcoded UTC+3 with ZoneInfo("Asia/Jerusalem") for DST - save_rule: use EspoCrmApiError.status_code instead of fragile string matching - Background tasks: store references to prevent GC before completion - Lock race: use dict.setdefault() for atomic lock creation - Version: health.py now matches main.py (0.2.0) - Skill names: normalized to lowercase for dedup consistency Build: - Dockerfile: install from pyproject.toml instead of hardcoded pip list - Remove unused mcp>=1.0.0 dependency from pyproject.toml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 20:18:01 +00:00
chaim	a990f527a2	fix: save_rule falls back to user profile when AssistantRule 404 ... The AssistantRule entity may not exist on some CRM instances. When save_rule gets a 404, it now falls back to saving the rule in the local user profile (update_user_profile). Also improved update_user_profile description so Shira is more likely to use it for user preferences. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 20:10:10 +00:00
chaim	6f7b94d6f8	feat: initial shira-hermes service ... Shira AI backend using OpenAI-compatible agent with tool-calling loop, replacing the smart-assistant route in ai-gateway. Components: - FastAPI adapter (same HTTP contract as ai-gateway) - Agent runner with agentic tool-calling loop via ai-gateway /v1/chat/completions - EspoCRM REST API client - 20 MCP tools (CRM, documents, legal assistance) - Prompt builder ported from ai-gateway JS to Python - SOUL.md personality definition - Dockerfile for Coolify deployment Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 17:29:35 +00:00