The backend import package is now docsgpt, the name it will carry on PyPI;
application was far too generic to install into anyone's site-packages.
git mv plus a mechanical rewrite of every import, dotted string and path
reference: 734 Python files, the compose files, Dockerfile, workflows, docs,
setup scripts, devcontainer, k8s manifests, vscode config, pytest and coverage
config, .gitignore. Behaviour is unchanged.
Kept for one release:
- A top-level application package whose meta-path finder resolves
application.x.y to the already-imported docsgpt.x.y object, so old imports
and entry points (celery -A application.app.celery,
uvicorn application.asgi:asgi_app) keep working with a FutureWarning.
- Celery registers every application.* task name as an alias of its
docsgpt.* task on start-up, so messages queued by the previous release still
run. The redbeat key prefix moves to redbeat:docsgpt:v2: so schedule entries
the previous release wrote are left unread instead of firing twice.
The backend image builds from the repository root (docker build -f
docsgpt/Dockerfile .) so it can ship the alias package; a root .dockerignore
allow-lists docsgpt/ and application/ and keeps caches, local data, .env
files, the sample index files and the Dockerfile out. Compose and the image
workflows point at the new context.
URLCheck read the host from a regex capture group whose character class
excluded "@", so a userinfo-prefixed URL passed its userinfo off as the
host: https://allowed.com@evil.tld/ satisfied an allow_hosts entry for
allowed.com, and http://ok.com@blocked.tld/ evaded block_hosts. Match the
whole URL and take the host from the parsed authority instead. A URL that
will not parse is now redacted rather than waved through.
The PRIVATE_KEY secret pattern matched only the BEGIN header, so a redact
action masked the header and released the key material and END line in
the clear. Span the whole armored block, falling back to the header when
the block is unterminated or over the cap, and raise max_match_chars so
the streaming guard's window still covers a full PEM. The pattern also
now catches ENCRYPTED, DSA and PGP BLOCK headers, which it missed
entirely.
The documented GUARDRAILS_FLOOR example omitted "enabled": true, and the
field defaults to false, so an operator copying it got a floor that
parsed clean, merged to nothing and warned nowhere. Fix the example and
warn when a floor is set but disabled.
Alex