diff --git a/scripts/pi2-backup/auto-git-backup.sh b/scripts/pi2-backup/auto-git-backup.sh
index 15087e4..327131c 100755
--- a/scripts/pi2-backup/auto-git-backup.sh
+++ b/scripts/pi2-backup/auto-git-backup.sh
@@ -86,6 +86,14 @@ else
echo "⚠️ Impossibile scaricare Keepalived conf da Pi1."
fi
+# D. Sorgente Loogle MCP (app completa: qui vive solo su Pi1, fuori da git)
+# .env resta escluso: contiene JWT secret e token Paperless/Gitea/OpenAI.
+mkdir -p "$REPO_DIR/services/loogle-mcp"
+rsync -av --delete -e "ssh -q" \
+ --exclude='.env' --exclude='data/' --exclude='__pycache__/' --exclude='*.pyc' --exclude='.cursor/' \
+ "$PI1_USER@$PI1_IP:/home/daniely/docker/loogle-mcp/" "$REPO_DIR/services/loogle-mcp/" \
+ || echo "⚠️ rsync sorgente MCP fallito (ignorato)"
+
# 4. GIT PUSH
# -----------
if [[ -n $(git status --porcelain) ]]; then
diff --git a/services/loogle-mcp/.env.example b/services/loogle-mcp/.env.example
new file mode 100644
index 0000000..4cd98cb
--- /dev/null
+++ b/services/loogle-mcp/.env.example
@@ -0,0 +1,81 @@
+# Loogle MCP Hub — copia in .env e personalizza
+MCP_BASE_URL=https://mcp.loogle.it
+MCP_PORT=8700
+MCP_JWT_SECRET=change-me-to-a-long-random-string
+MCP_OAUTH_CLIENT_ID=loogle-mcp-public
+
+# Paperless API — vedi docs/PAPERLESS-TOKEN.md
+PAPERLESS_URL=https://docs.loogle.it
+# Fallback admin (opzionale se usi token per utente sotto)
+PAPERLESS_API_TOKEN=
+PAPERLESS_API_TOKEN_DANIELE=
+PAPERLESS_API_TOKEN_LUCIA=
+PAPERLESS_API_TOKEN_DAVIDE=
+PAPERLESS_API_TOKEN_LUCA=
+
+# Gitea API — vedi docs/GITEA-TOKEN.md
+GITEA_URL=https://git.loogle.it
+# Opzionale: URL API raggiungibile dal container MCP (es. http://192.168.128.81:3002)
+# GITEA_API_URL=
+GITEA_API_TOKEN=
+GITEA_API_TOKEN_DANIELE=
+GITEA_API_TOKEN_LUCIA=
+GITEA_API_TOKEN_DAVIDE=
+GITEA_API_TOKEN_LUCA=
+
+# Qdrant (container locale o remoto)
+QDRANT_URL=http://192.168.128.100:6333
+
+# Embedding via Ollama su DS920+
+OLLAMA_URL=http://192.168.128.100:11434
+OLLAMA_EMBED_MODEL=nomic-embed-text
+
+# Fallback cloud embedding (opzionale)
+OPENAI_API_KEY=
+OPENAI_EMBED_MODEL=text-embedding-3-small
+
+# Indicizzazione
+INDEXER_INTERVAL_MINUTES=30
+
+# Thermal gate DS920 — evita overheating durante embedding
+THERMAL_GATE_ENABLED=yes
+THERMAL_TEMP_SOFT_C=58
+THERMAL_TEMP_HARD_C=70
+THERMAL_CPU_TARGET_PCT=40
+THERMAL_POLL_S=30
+THERMAL_RESUME_MARGIN_C=2
+DS920_THERMAL_URL=http://192.168.128.100:9191/thermal
+OLLAMA_NUM_THREAD=1
+OLLAMA_EMBED_DELAY_S=10
+OLLAMA_EMBED_COOL_DELAY_S=3
+
+# RAG Gitea (P3) — indicizza markdown/codice da git.loogle.it
+GITEA_INDEX_ENABLED=yes
+# Opzionale: limita repo per utente (CSV). Vuoto = tutti i repo accessibili via API
+# GITEA_INDEX_REPOS_DANIELE=daniele/rete,daniele/loogle-scripts
+# GITEA_INDEX_REPOS_DAVIDE=davide/progetti
+# GITEA_INDEX_REPOS_LUCA=luca/progetti
+GITEA_INDEX_MAX_FILES_PER_REPO=150
+GITEA_INDEX_MAX_FILE_BYTES=120000
+
+# P5 — Loogle Casa + Home Assistant (read-only)
+LOOGLE_CASA_URL=https://casa.loogle.it
+# LOOGLE_CASA_API_URL=http://192.168.128.81:5602
+LOOGLE_CASA_PASSWORD_DANIELE=
+LOOGLE_CASA_PASSWORD_LUCIA=
+LOOGLE_CASA_PASSWORD_DAVIDE=
+LOOGLE_CASA_PASSWORD_LUCA=
+HA_URL=https://ha.loogle.it
+# HA_API_URL=http://192.168.128.81:8123
+HA_TOKEN=
+
+# P6 — Irrigazione + Turni (read-only)
+IRRIGAZIONE_URL=https://irri.loogle.it
+# IRRIGAZIONE_API_URL=http://192.168.128.81:5601
+IRRIGAZIONE_PASSWORD_DANIELE=
+TURNI_URL=https://turni.loogle.it
+TURNI_PASSWORD_DANIELE=
+
+# P7 — RAG Irrigazione + Turni
+APPS_INDEX_ENABLED=yes
+APPS_INDEX_USER=daniele
diff --git a/services/loogle-mcp/.gitignore b/services/loogle-mcp/.gitignore
new file mode 100644
index 0000000..5b70d24
--- /dev/null
+++ b/services/loogle-mcp/.gitignore
@@ -0,0 +1,4 @@
+data/
+.env
+*.pyc
+__pycache__/
diff --git a/services/loogle-mcp/Dockerfile b/services/loogle-mcp/Dockerfile
new file mode 100644
index 0000000..a2b0f19
--- /dev/null
+++ b/services/loogle-mcp/Dockerfile
@@ -0,0 +1,24 @@
+FROM python:3.12-slim
+
+ENV PYTHONUNBUFFERED=1 TZ=Europe/Rome
+
+RUN apt-get update && apt-get install -y --no-install-recommends curl openssh-client \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /srv
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app ./app
+COPY worker ./worker
+COPY scripts ./scripts
+COPY scripts/docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
+ENV PYTHONPATH=/srv
+VOLUME /data
+EXPOSE 8700
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8700"]
diff --git a/services/loogle-mcp/README.md b/services/loogle-mcp/README.md
new file mode 100644
index 0000000..66ee122
--- /dev/null
+++ b/services/loogle-mcp/README.md
@@ -0,0 +1,23 @@
+# Loogle MCP Hub
+
+Piattaforma MCP multi-utente per homelab LOOGLE.IT.
+
+## Documentazione
+
+| Documento | Per chi |
+|-----------|---------|
+| [ARCHITETTURA.md](docs/ARCHITETTURA.md) | Architettura, parametri, DNS, NPM, env |
+| [GUIDA-ADMIN.md](docs/GUIDA-ADMIN.md) | Daniele — gestione e uso avanzato |
+| [GUIDA-UTENTI.md](docs/GUIDA-UTENTI.md) | Lucia, Davide, Luca — client AI e uso quotidiano |
+| [ONBOARDING.md](docs/ONBOARDING.md) | Dettaglio tecnico connector MCP |
+
+## URL
+
+- MCP: https://mcp.loogle.it/mcp
+- Dashboard: https://mcp.loogle.it/dashboard
+
+## Setup DNS + NPM
+
+```bash
+sudo /home/daniely/rete/scripts/setup-mcp-dns-npm.sh
+```
diff --git a/services/loogle-mcp/app/__init__.py b/services/loogle-mcp/app/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/services/loogle-mcp/app/audit.py b/services/loogle-mcp/app/audit.py
new file mode 100644
index 0000000..6fd55da
--- /dev/null
+++ b/services/loogle-mcp/app/audit.py
@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+"""Audit log for MCP tool invocations."""
+
+import json
+from typing import Optional
+
+from .db import get_conn
+
+
+def log_tool(username: str, tool_name: str, resource_id: Optional[str] = None, detail: Optional[dict] = None) -> None:
+ conn = get_conn()
+ conn.execute(
+ "INSERT INTO audit_log(username,tool_name,resource_id,detail) VALUES (?,?,?,?)",
+ (username, tool_name, resource_id, json.dumps(detail or {}, ensure_ascii=False)),
+ )
+ conn.execute(
+ "DELETE FROM audit_log WHERE id NOT IN "
+ "(SELECT id FROM audit_log ORDER BY id DESC LIMIT 5000)"
+ )
+ conn.commit()
+
+
+def list_audit(limit: int = 100, username: Optional[str] = None) -> list:
+ conn = get_conn()
+ if username:
+ rows = conn.execute(
+ "SELECT * FROM audit_log WHERE username=? ORDER BY id DESC LIMIT ?",
+ (username, limit),
+ ).fetchall()
+ else:
+ rows = conn.execute(
+ "SELECT * FROM audit_log ORDER BY id DESC LIMIT ?", (limit,)
+ ).fetchall()
+ return [dict(r) for r in rows]
diff --git a/services/loogle-mcp/app/auth.py b/services/loogle-mcp/app/auth.py
new file mode 100644
index 0000000..1f335de
--- /dev/null
+++ b/services/loogle-mcp/app/auth.py
@@ -0,0 +1,146 @@
+# -*- coding: utf-8 -*-
+"""Autenticazione utenti famiglia — pattern Loogle Casa."""
+
+import base64
+import datetime
+import hashlib
+import hmac
+import os
+import secrets
+import time
+from typing import Optional
+
+from fastapi import HTTPException, Request
+
+from .db import get_conn
+
+SESSION_DAYS = 30
+PBKDF2_ITER = 240_000
+MAX_ATTEMPTS = 8
+WINDOW_S = 600
+_attempts: dict = {}
+
+FAMILY_USERS = (
+ ("daniele", True),
+ ("lucia", False),
+ ("davide", False),
+ ("luca", False),
+)
+
+DEFAULT_SCOPES = (
+ "context:read context:write knowledge:read knowledge:write gitea:read gitea:write"
+)
+
+
+def hash_password(password: str) -> str:
+ salt = os.urandom(16)
+ dk = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, PBKDF2_ITER)
+ return "pbkdf2$%d$%s$%s" % (
+ PBKDF2_ITER,
+ base64.b64encode(salt).decode(),
+ base64.b64encode(dk).decode(),
+ )
+
+
+def verify_password(password: str, stored: str) -> bool:
+ try:
+ _, iters, salt_b64, dk_b64 = stored.split("$")
+ salt = base64.b64decode(salt_b64)
+ expected = base64.b64decode(dk_b64)
+ dk = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, int(iters))
+ return hmac.compare_digest(dk, expected)
+ except Exception:
+ return False
+
+
+def ensure_family_users() -> None:
+ conn = get_conn()
+ for username, is_admin in FAMILY_USERS:
+ row = conn.execute("SELECT id FROM users WHERE username=?", (username,)).fetchone()
+ if row:
+ continue
+ conn.execute(
+ "INSERT INTO users(username,password_hash,is_admin,must_change_password)"
+ " VALUES (?,?,?,1)",
+ (username, hash_password(username), 1 if is_admin else 0),
+ )
+ conn.commit()
+
+
+def throttle(ip: str) -> None:
+ now = time.time()
+ hist = [t for t in _attempts.get(ip, []) if now - t < WINDOW_S]
+ _attempts[ip] = hist
+ if len(hist) >= MAX_ATTEMPTS:
+ raise HTTPException(429, "Troppi tentativi: riprova tra qualche minuto")
+
+
+def record_attempt(ip: str) -> None:
+ _attempts.setdefault(ip, []).append(time.time())
+
+
+def authenticate(username: str, password: str) -> Optional[dict]:
+ conn = get_conn()
+ row = conn.execute("SELECT * FROM users WHERE username=?", (username.strip(),)).fetchone()
+ if not row or not verify_password(password, row["password_hash"]):
+ return None
+ return dict(row)
+
+
+def get_user_by_id(user_id: int) -> Optional[dict]:
+ row = get_conn().execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+ return dict(row) if row else None
+
+
+def get_user_by_username(username: str) -> Optional[dict]:
+ row = get_conn().execute("SELECT * FROM users WHERE username=?", (username,)).fetchone()
+ return dict(row) if row else None
+
+
+def change_password(user_id: int, old_password: str, new_password: str) -> bool:
+ row = get_conn().execute("SELECT password_hash FROM users WHERE id=?", (user_id,)).fetchone()
+ if not row or not verify_password(old_password, row["password_hash"]):
+ return False
+ conn = get_conn()
+ conn.execute(
+ "UPDATE users SET password_hash=?, must_change_password=0 WHERE id=?",
+ (hash_password(new_password), user_id),
+ )
+ conn.commit()
+ return True
+
+
+def current_user_from_cookie(request: Request) -> dict:
+ token = request.cookies.get("mcp_session", "")
+ if not token:
+ raise HTTPException(401, "Non autenticato")
+ row = get_conn().execute(
+ "SELECT u.id,u.username,u.is_admin,u.must_change_password"
+ " FROM sessions s JOIN users u ON u.id=s.user_id"
+ " WHERE s.token=? AND s.expires_at > datetime('now')",
+ (token,),
+ ).fetchone()
+ if not row:
+ raise HTTPException(401, "Sessione scaduta")
+ return dict(row)
+
+
+def require_admin(request: Request) -> dict:
+ user = current_user_from_cookie(request)
+ if not user["is_admin"]:
+ raise HTTPException(403, "Riservato all'amministratore")
+ return user
+
+
+def ensure_sessions_table() -> None:
+ get_conn().execute(
+ """
+ CREATE TABLE IF NOT EXISTS sessions (
+ token TEXT PRIMARY KEY,
+ user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ created_at TEXT NOT NULL DEFAULT (datetime('now')),
+ expires_at TEXT NOT NULL
+ )
+ """
+ )
+ get_conn().commit()
diff --git a/services/loogle-mcp/app/context/__init__.py b/services/loogle-mcp/app/context/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/services/loogle-mcp/app/context/gitea_link.py b/services/loogle-mcp/app/context/gitea_link.py
new file mode 100644
index 0000000..fa30d33
--- /dev/null
+++ b/services/loogle-mcp/app/context/gitea_link.py
@@ -0,0 +1,154 @@
+# -*- coding: utf-8 -*-
+"""Collegamento progetti MCP ↔ repository Gitea."""
+
+from __future__ import annotations
+
+import logging
+from typing import Optional
+
+from ..knowledge import gitea
+
+LOGGER = logging.getLogger("loogle_mcp.context.gitea_link")
+
+README_CANDIDATES = ("README.md", "readme.md", "Readme.md", "README.MD")
+DOCS_DIR = "docs"
+MAX_README_CHARS = 12_000
+MAX_DOC_FILES = 25
+
+
+def normalize_gitea_repo(repo: Optional[str]) -> Optional[str]:
+ if repo is None:
+ return None
+ cleaned = repo.strip()
+ if not cleaned:
+ return None
+ owner, name = gitea.parse_repo(cleaned)
+ return f"{owner}/{name}"
+
+
+def verify_repo_access(username: str, repo: str) -> None:
+ owner, name = gitea.parse_repo(repo)
+ gitea._request("GET", f"/repos/{owner}/{name}", username=username)
+
+
+def fetch_readme(username: str, repo: str) -> Optional[dict]:
+ for path in README_CANDIDATES:
+ try:
+ data = gitea.get_file(repo, path, username=username)
+ except FileNotFoundError:
+ continue
+ except Exception as exc:
+ LOGGER.warning("README %s/%s non leggibile: %s", repo, path, exc)
+ continue
+ if data.get("type") != "file":
+ continue
+ content = (data.get("content") or "").strip()
+ if not content:
+ continue
+ truncated = len(content) > MAX_README_CHARS
+ return {
+ "path": path,
+ "sha": data.get("sha"),
+ "html_url": data.get("html_url"),
+ "content": content[:MAX_README_CHARS],
+ "truncated": truncated,
+ }
+ return None
+
+
+def fetch_docs_index(username: str, repo: str) -> list[dict]:
+ try:
+ data = gitea.get_file(repo, DOCS_DIR, username=username)
+ except FileNotFoundError:
+ return []
+ except Exception as exc:
+ LOGGER.warning("Directory docs/ non leggibile per %s: %s", repo, exc)
+ return []
+
+ if data.get("type") != "dir":
+ return []
+
+ entries = []
+ for item in data.get("entries") or []:
+ if item.get("type") != "file":
+ continue
+ path = item.get("path") or ""
+ if not path.lower().endswith((".md", ".txt", ".rst")):
+ continue
+ entries.append(
+ {
+ "path": path,
+ "size": item.get("size"),
+ }
+ )
+ if len(entries) >= MAX_DOC_FILES:
+ break
+ return entries
+
+
+def project_enrichment(username: str, gitea_repo: str) -> dict:
+ repo = normalize_gitea_repo(gitea_repo)
+ if not repo:
+ return {"linked": False}
+
+ base = {
+ "linked": True,
+ "repo": repo,
+ "html_url": f"{gitea.public_base_url()}/{repo}",
+ }
+
+ if not gitea.is_configured(username):
+ return {
+ **base,
+ "available": False,
+ "error": "Gitea non configurato per questo utente",
+ }
+
+ try:
+ verify_repo_access(username, repo)
+ readme = fetch_readme(username, repo)
+ docs = fetch_docs_index(username, repo)
+ open_issues = None
+ try:
+ issues = gitea.list_issues(repo, state="open", limit=1, username=username)
+ open_issues = issues.get("count", 0)
+ except Exception:
+ pass
+ return {
+ **base,
+ "available": True,
+ "readme": readme,
+ "docs_files": docs,
+ "open_issues": open_issues,
+ }
+ except Exception as exc:
+ return {
+ **base,
+ "available": False,
+ "error": str(exc),
+ }
+
+
+def readme_seed_block(repo: str, readme: dict) -> str:
+ path = readme.get("path") or "README.md"
+ content = readme.get("content") or ""
+ truncated_note = "\n\n*(README troncato — usa get_file per il testo completo)*" if readme.get("truncated") else ""
+ return (
+ f"\n\n"
+ f"## Sorgente Gitea: `{repo}`\n\n"
+ f"Contenuto iniziale da `{path}`.\n\n"
+ f"{content.rstrip()}{truncated_note}\n"
+ )
+
+
+def seed_context_from_readme(username: str, repo: str, context_md: str) -> tuple[str, bool]:
+ """Importa README nel context se non già presente un seed Gitea."""
+ if "\n\n" + text
+ return {
+ "uri": uri,
+ "mimeType": "text/markdown",
+ "text": text,
+ }
diff --git a/services/loogle-mcp/app/db.py b/services/loogle-mcp/app/db.py
new file mode 100644
index 0000000..36a3eec
--- /dev/null
+++ b/services/loogle-mcp/app/db.py
@@ -0,0 +1,118 @@
+# -*- coding: utf-8 -*-
+"""SQLite schema for Loogle MCP Hub."""
+
+import os
+import sqlite3
+import threading
+
+DB_PATH = os.environ.get("MCP_DB", "/data/loogle_mcp.db")
+_local = threading.local()
+
+SCHEMA = """
+CREATE TABLE IF NOT EXISTS users (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ username TEXT UNIQUE NOT NULL,
+ password_hash TEXT NOT NULL,
+ is_admin INTEGER NOT NULL DEFAULT 0,
+ must_change_password INTEGER NOT NULL DEFAULT 0,
+ created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS oauth_clients (
+ client_id TEXT PRIMARY KEY,
+ client_name TEXT NOT NULL,
+ redirect_uris TEXT NOT NULL,
+ created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS oauth_codes (
+ code TEXT PRIMARY KEY,
+ client_id TEXT NOT NULL,
+ user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ redirect_uri TEXT NOT NULL,
+ scope TEXT NOT NULL,
+ code_challenge TEXT,
+ code_challenge_method TEXT,
+ expires_at TEXT NOT NULL,
+ used INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS refresh_tokens (
+ token TEXT PRIMARY KEY,
+ user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ client_id TEXT NOT NULL,
+ scope TEXT NOT NULL,
+ expires_at TEXT NOT NULL,
+ revoked INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS revoked_jtis (
+ jti TEXT PRIMARY KEY,
+ revoked_at TEXT NOT NULL DEFAULT (datetime('now')),
+ expires_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS audit_log (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ username TEXT NOT NULL,
+ tool_name TEXT NOT NULL,
+ resource_id TEXT,
+ detail TEXT,
+ created_at TEXT NOT NULL DEFAULT (datetime('now','localtime'))
+);
+
+CREATE TABLE IF NOT EXISTS indexed_documents (
+ doc_id INTEGER PRIMARY KEY,
+ title TEXT,
+ owner TEXT,
+ visibility TEXT NOT NULL DEFAULT 'family',
+ indexed_at TEXT NOT NULL DEFAULT (datetime('now')),
+ chunk_count INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS indexed_gitea_files (
+ repo TEXT NOT NULL,
+ path TEXT NOT NULL,
+ sha TEXT,
+ owner TEXT NOT NULL,
+ visibility TEXT NOT NULL DEFAULT 'family',
+ chunk_count INTEGER NOT NULL DEFAULT 0,
+ indexed_at TEXT NOT NULL DEFAULT (datetime('now')),
+ PRIMARY KEY (repo, path)
+);
+
+CREATE INDEX IF NOT EXISTS idx_gitea_indexed_repo ON indexed_gitea_files(repo);
+CREATE INDEX IF NOT EXISTS idx_gitea_indexed_at ON indexed_gitea_files(indexed_at DESC);
+
+CREATE TABLE IF NOT EXISTS indexed_apps_records (
+ source TEXT NOT NULL,
+ record_id TEXT NOT NULL,
+ title TEXT,
+ owner TEXT NOT NULL DEFAULT 'family',
+ chunk_count INTEGER NOT NULL DEFAULT 0,
+ indexed_at TEXT NOT NULL DEFAULT (datetime('now')),
+ PRIMARY KEY (source, record_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_apps_indexed_source ON indexed_apps_records(source);
+CREATE INDEX IF NOT EXISTS idx_apps_indexed_at ON indexed_apps_records(indexed_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_log(created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_oauth_codes_expires ON oauth_codes(expires_at);
+"""
+
+
+def get_conn() -> sqlite3.Connection:
+ conn = getattr(_local, "conn", None)
+ if conn is None:
+ os.makedirs(os.path.dirname(DB_PATH), exist_ok=True)
+ conn = sqlite3.connect(DB_PATH, timeout=30)
+ conn.row_factory = sqlite3.Row
+ conn.execute("PRAGMA journal_mode=WAL")
+ conn.execute("PRAGMA foreign_keys=ON")
+ _local.conn = conn
+ return conn
+
+
+def init_db() -> None:
+ get_conn().executescript(SCHEMA)
diff --git a/services/loogle-mcp/app/integrations/__init__.py b/services/loogle-mcp/app/integrations/__init__.py
new file mode 100644
index 0000000..aaafed1
--- /dev/null
+++ b/services/loogle-mcp/app/integrations/__init__.py
@@ -0,0 +1,2 @@
+# -*- coding: utf-8 -*-
+"""Client REST verso app homelab LOOGLE."""
diff --git a/services/loogle-mcp/app/integrations/casa.py b/services/loogle-mcp/app/integrations/casa.py
new file mode 100644
index 0000000..1cb3c46
--- /dev/null
+++ b/services/loogle-mcp/app/integrations/casa.py
@@ -0,0 +1,75 @@
+# -*- coding: utf-8 -*-
+"""Client Loogle Casa — dashboard, meteo, rete."""
+
+import os
+from typing import Any, Optional
+
+from .session_client import SessionApiClient
+
+MCP_USERS = ("daniele", "lucia", "davide", "luca")
+# Daniele MCP → admin su Loogle Casa
+MCP_TO_SERVICE_USER = {
+ "daniele": "admin",
+ "lucia": "lucia",
+ "davide": "davide",
+ "luca": "luca",
+}
+
+
+def _service_username(mcp_username: str) -> str:
+ return MCP_TO_SERVICE_USER.get(mcp_username.lower(), mcp_username.lower())
+PUBLIC_URL = os.environ.get("LOOGLE_CASA_URL", "https://casa.loogle.it").rstrip("/")
+API_URL = os.environ.get("LOOGLE_CASA_API_URL", PUBLIC_URL).rstrip("/")
+
+_client: Optional[SessionApiClient] = None
+
+
+def _client_instance() -> SessionApiClient:
+ global _client
+ if _client is None:
+ verify = os.environ.get("LOOGLE_CASA_VERIFY_SSL", "true").strip().lower() not in (
+ "0", "false", "no", "off",
+ )
+ client = SessionApiClient(
+ service="LOOGLE_CASA",
+ base_url=API_URL,
+ verify_ssl=verify,
+ )
+ client.map_username = _service_username # type: ignore[attr-defined]
+ _client = client
+ return _client
+
+
+def is_configured(username: Optional[str] = None) -> bool:
+ user = (username or "daniele").lower()
+ if user in MCP_USERS:
+ key = f"LOOGLE_CASA_PASSWORD_{user.upper()}"
+ if os.environ.get(key, "").strip():
+ return True
+ if os.environ.get("LOOGLE_CASA_PASSWORD", "").strip():
+ return True
+ return user in MCP_USERS
+
+
+def get_dashboard(username: str) -> dict:
+ return _client_instance().get("/api/dashboard", username=username)
+
+
+def get_weather_home(username: str) -> dict:
+ return _client_instance().get("/api/weather/home", username=username)
+
+
+def get_network_overview(username: str) -> dict:
+ return _client_instance().get("/api/network/overview", username=username)
+
+
+def get_network_failover_status(username: str) -> dict:
+ return _client_instance().get("/api/network/failover/status", username=username)
+
+
+def get_network_mcp_status(username: str) -> dict:
+ return _client_instance().get("/api/network/mcp", username=username)
+
+
+def get_alerts_cards(username: str) -> Any:
+ return _client_instance().get("/api/alerts/cards", username=username)
diff --git a/services/loogle-mcp/app/integrations/homeassistant.py b/services/loogle-mcp/app/integrations/homeassistant.py
new file mode 100644
index 0000000..6244fc2
--- /dev/null
+++ b/services/loogle-mcp/app/integrations/homeassistant.py
@@ -0,0 +1,71 @@
+# -*- coding: utf-8 -*-
+"""Client Home Assistant REST API (read-only)."""
+
+import os
+from typing import Any, Optional
+from urllib.parse import urljoin
+
+import httpx
+
+PUBLIC_URL = os.environ.get("HA_URL", "https://ha.loogle.it").rstrip("/")
+API_URL = os.environ.get("HA_API_URL", PUBLIC_URL).rstrip("/")
+HA_TOKEN = os.environ.get("HA_TOKEN", "").strip()
+
+
+def is_configured() -> bool:
+ return bool(HA_TOKEN)
+
+
+def _headers() -> dict:
+ if not HA_TOKEN:
+ raise RuntimeError(
+ "HA_TOKEN non configurato in .env — crea un long-lived token in Home Assistant"
+ )
+ return {"Authorization": f"Bearer {HA_TOKEN}", "Content-Type": "application/json"}
+
+
+def _request(method: str, path: str, *, params: Optional[dict] = None) -> Any:
+ verify = os.environ.get("HA_VERIFY_SSL", "true").strip().lower() not in (
+ "0", "false", "no", "off",
+ )
+ url = path if path.startswith("http") else urljoin(API_URL + "/", path.lstrip("/"))
+ with httpx.Client(timeout=30.0, verify=verify) as client:
+ resp = client.request(method, url, headers=_headers(), params=params)
+ if resp.status_code >= 400:
+ raise RuntimeError(f"Home Assistant {path}: HTTP {resp.status_code} {resp.text[:200]}")
+ return resp.json()
+
+
+def get_config() -> dict:
+ return _request("GET", "/api/config")
+
+
+def get_entity(entity_id: str) -> dict:
+ return _request("GET", f"/api/states/{entity_id}")
+
+
+def list_entities(domain: Optional[str] = None, limit: int = 100) -> list:
+ states = _request("GET", "/api/states")
+ if domain:
+ prefix = domain if domain.endswith(".") else f"{domain}."
+ states = [s for s in states if s.get("entity_id", "").startswith(prefix)]
+ return states[:limit]
+
+
+def search_entities(query: str, limit: int = 30) -> list:
+ q = query.lower()
+ matches = []
+ for state in _request("GET", "/api/states"):
+ eid = state.get("entity_id", "")
+ name = (state.get("attributes") or {}).get("friendly_name", "")
+ blob = f"{eid} {name}".lower()
+ if q in blob:
+ matches.append({
+ "entity_id": eid,
+ "state": state.get("state"),
+ "friendly_name": name,
+ "last_changed": state.get("last_changed"),
+ })
+ if len(matches) >= limit:
+ break
+ return matches
diff --git a/services/loogle-mcp/app/integrations/irrigazione.py b/services/loogle-mcp/app/integrations/irrigazione.py
new file mode 100644
index 0000000..07ed279
--- /dev/null
+++ b/services/loogle-mcp/app/integrations/irrigazione.py
@@ -0,0 +1,78 @@
+# -*- coding: utf-8 -*-
+"""Client Irrigazione Smart — irri.loogle.it."""
+
+import os
+from typing import Any, Optional
+
+from .session_client import SessionApiClient
+
+MCP_USERS = ("daniele", "lucia", "davide", "luca")
+MCP_TO_SERVICE_USER = {
+ "daniele": "admin",
+ "lucia": "lucia",
+ "davide": "dado",
+ "luca": "luca",
+}
+
+PUBLIC_URL = os.environ.get("IRRIGAZIONE_URL", "https://irri.loogle.it").rstrip("/")
+API_URL = os.environ.get("IRRIGAZIONE_API_URL", PUBLIC_URL).rstrip("/")
+
+_client: Optional[SessionApiClient] = None
+
+
+def _service_username(mcp_username: str) -> str:
+ return MCP_TO_SERVICE_USER.get(mcp_username.lower(), mcp_username.lower())
+
+
+def _client_instance() -> SessionApiClient:
+ global _client
+ if _client is None:
+ verify = os.environ.get("IRRIGAZIONE_VERIFY_SSL", "true").strip().lower() not in (
+ "0", "false", "no", "off",
+ )
+ client = SessionApiClient(
+ service="IRRIGAZIONE",
+ base_url=API_URL,
+ verify_ssl=verify,
+ )
+ client.map_username = _service_username # type: ignore[attr-defined]
+ _client = client
+ return _client
+
+
+def is_configured(username: Optional[str] = None) -> bool:
+ user = (username or "daniele").lower()
+ if os.environ.get(f"IRRIGAZIONE_PASSWORD_{user.upper()}", "").strip():
+ return True
+ if os.environ.get("IRRIGAZIONE_PASSWORD", "").strip():
+ return True
+ return user in MCP_USERS
+
+
+def get_status(username: str) -> dict:
+ return _client_instance().get("/api/status", username=username)
+
+
+def get_zones(username: str) -> Any:
+ return _client_instance().get("/api/zones", username=username)
+
+
+def get_history(username: str, limit: int = 30) -> Any:
+ data = _client_instance().get("/api/history", username=username)
+ if isinstance(data, list):
+ return data[:limit]
+ if isinstance(data, dict) and "items" in data:
+ items = data["items"]
+ return items[:limit] if isinstance(items, list) else data
+ return data
+
+
+def get_events(username: str, limit: int = 50) -> Any:
+ data = _client_instance().get("/api/events", username=username)
+ if isinstance(data, list):
+ return data[:limit]
+ return data
+
+
+def get_lavori_summary(username: str) -> Any:
+ return _client_instance().get("/api/lavori/summary", username=username)
diff --git a/services/loogle-mcp/app/integrations/session_client.py b/services/loogle-mcp/app/integrations/session_client.py
new file mode 100644
index 0000000..075aca9
--- /dev/null
+++ b/services/loogle-mcp/app/integrations/session_client.py
@@ -0,0 +1,122 @@
+# -*- coding: utf-8 -*-
+"""Client HTTP con sessione cookie (Loogle Casa, Irrigazione)."""
+
+import logging
+import threading
+import time
+from typing import Any, Optional
+from urllib.parse import urljoin
+
+import httpx
+
+LOGGER = logging.getLogger("loogle_mcp.session_client")
+
+_sessions: dict[str, tuple[str, float]] = {}
+_sessions_lock = threading.Lock()
+SESSION_TTL = 3600 * 12
+
+
+class SessionApiClient:
+ """Login cookie-based con cache per utente MCP."""
+
+ def __init__(
+ self,
+ *,
+ service: str,
+ base_url: str,
+ login_path: str = "/api/login",
+ verify_ssl: bool = True,
+ ) -> None:
+ self.service = service
+ self.base_url = base_url.rstrip("/")
+ self.login_path = login_path
+ self.verify_ssl = verify_ssl
+
+ def _password_for_user(self, username: str) -> Optional[str]:
+ import os
+ user = username.lower()
+ env_key = f"{self.service}_PASSWORD_{user.upper()}"
+ pwd = os.environ.get(env_key, "").strip()
+ if pwd:
+ return pwd
+ fallback = os.environ.get(f"{self.service}_PASSWORD", "").strip()
+ if fallback:
+ return fallback
+ return user
+
+ def _cache_key(self, username: str) -> str:
+ return f"{self.service}:{username.lower()}"
+
+ def _get_cached_cookie(self, username: str) -> Optional[str]:
+ key = self._cache_key(username)
+ with _sessions_lock:
+ row = _sessions.get(key)
+ if not row:
+ return None
+ cookie, expires = row
+ if time.time() > expires:
+ _sessions.pop(key, None)
+ return None
+ return cookie
+
+ def _store_cookie(self, username: str, cookie: str) -> None:
+ key = self._cache_key(username)
+ with _sessions_lock:
+ _sessions[key] = (cookie, time.time() + SESSION_TTL)
+
+ def login(self, username: str) -> str:
+ cached = self._get_cached_cookie(username)
+ if cached:
+ return cached
+ service_user = username
+ if hasattr(self, "map_username"):
+ service_user = self.map_username(username) # type: ignore[attr-defined]
+ password = self._password_for_user(username)
+ if not password:
+ raise RuntimeError(
+ f"Password {self.service} non configurata per {username}. "
+ f"Imposta {self.service}_PASSWORD_{username.upper()} in .env"
+ )
+ url = urljoin(self.base_url + "/", self.login_path.lstrip("/"))
+ with httpx.Client(timeout=30.0, verify=self.verify_ssl) as client:
+ resp = client.post(
+ url, json={"username": service_user, "password": password},
+ )
+ if resp.status_code != 200:
+ raise RuntimeError(
+ f"Login {self.service} fallito per {username}: HTTP {resp.status_code}"
+ )
+ cookie = resp.cookies.get("session")
+ if not cookie:
+ raise RuntimeError(f"Login {self.service}: cookie session mancante")
+ self._store_cookie(username, cookie)
+ return cookie
+
+ def request(
+ self,
+ method: str,
+ path: str,
+ *,
+ username: str,
+ params: Optional[dict] = None,
+ json_body: Optional[dict] = None,
+ ) -> Any:
+ cookie = self.login(username)
+ url = path if path.startswith("http") else urljoin(self.base_url + "/", path.lstrip("/"))
+ headers = {"Cookie": f"session={cookie}"}
+ with httpx.Client(timeout=60.0, verify=self.verify_ssl) as client:
+ resp = client.request(method, url, headers=headers, params=params, json=json_body)
+ if resp.status_code == 401:
+ with _sessions_lock:
+ _sessions.pop(self._cache_key(username), None)
+ cookie = self.login(username)
+ headers = {"Cookie": f"session={cookie}"}
+ resp = client.request(method, url, headers=headers, params=params, json=json_body)
+ if resp.status_code >= 400:
+ raise RuntimeError(f"{self.service} {method} {path}: HTTP {resp.status_code} {resp.text[:200]}")
+ if resp.headers.get("content-type", "").startswith("application/json"):
+ return resp.json()
+ return resp.text
+
+ def get(self, path: str, *, username: str, params: Optional[dict] = None) -> Any:
+ return self.request("GET", path, username=username, params=params)
diff --git a/services/loogle-mcp/app/integrations/turni.py b/services/loogle-mcp/app/integrations/turni.py
new file mode 100644
index 0000000..478472c
--- /dev/null
+++ b/services/loogle-mcp/app/integrations/turni.py
@@ -0,0 +1,208 @@
+# -*- coding: utf-8 -*-
+"""Client Turni-Live — turni.loogle.it (JWT Bearer)."""
+
+import logging
+import os
+import threading
+import time
+from typing import Any, Optional
+from urllib.parse import urljoin
+
+import httpx
+
+LOGGER = logging.getLogger("loogle_mcp.turni")
+
+MCP_USERS = ("daniele", "lucia", "davide", "luca")
+MCP_TO_SERVICE_USER = {
+ "daniele": "daniely",
+ "lucia": "lucia",
+ "davide": "davide",
+ "luca": "luca",
+}
+
+PUBLIC_URL = os.environ.get("TURNI_URL", "https://turni.loogle.it").rstrip("/")
+API_URL = os.environ.get("TURNI_API_URL", PUBLIC_URL).rstrip("/")
+
+_jwt_cache: dict[str, tuple[str, float]] = {}
+_jwt_lock = threading.Lock()
+JWT_TTL = 3600 * 6
+
+
+def _service_username(mcp_username: str) -> str:
+ return MCP_TO_SERVICE_USER.get(mcp_username.lower(), mcp_username.lower())
+
+
+def _password_for_user(mcp_username: str) -> Optional[str]:
+ user = mcp_username.lower()
+ pwd = os.environ.get(f"TURNI_PASSWORD_{user.upper()}", "").strip()
+ if pwd:
+ return pwd
+ return os.environ.get("TURNI_PASSWORD", "").strip() or None
+
+
+def _jwt_for_user(mcp_username: str) -> Optional[str]:
+ user = mcp_username.lower()
+ direct = os.environ.get(f"TURNI_JWT_{user.upper()}", "").strip()
+ if direct:
+ return direct
+ return os.environ.get("TURNI_JWT", "").strip() or None
+
+
+def is_configured(username: Optional[str] = None) -> bool:
+ user = (username or "daniele").lower()
+ if _jwt_for_user(user):
+ return True
+ if _password_for_user(user):
+ return True
+ return False
+
+
+def _store_jwt(mcp_username: str, token: str) -> None:
+ with _jwt_lock:
+ _jwt_cache[mcp_username.lower()] = (token, time.time() + JWT_TTL)
+
+
+def _cached_jwt(mcp_username: str) -> Optional[str]:
+ with _jwt_lock:
+ row = _jwt_cache.get(mcp_username.lower())
+ if not row:
+ return None
+ token, expires = row
+ if time.time() > expires:
+ _jwt_cache.pop(mcp_username.lower(), None)
+ return None
+ return token
+
+
+def login(mcp_username: str) -> str:
+ cached = _cached_jwt(mcp_username)
+ if cached:
+ return cached
+ preset = _jwt_for_user(mcp_username)
+ if preset:
+ _store_jwt(mcp_username, preset)
+ return preset
+ password = _password_for_user(mcp_username)
+ if not password:
+ raise RuntimeError(
+ f"Turni non configurato per {mcp_username}. "
+ f"Imposta TURNI_PASSWORD_{mcp_username.upper()} o TURNI_JWT_{mcp_username.upper()}"
+ )
+ service_user = _service_username(mcp_username)
+ verify = os.environ.get("TURNI_VERIFY_SSL", "true").strip().lower() not in (
+ "0", "false", "no", "off",
+ )
+ url = urljoin(API_URL + "/", "api/auth/login")
+ with httpx.Client(timeout=30.0, verify=verify) as client:
+ resp = client.post(url, json={"username": service_user, "password": password})
+ if resp.status_code != 200:
+ raise RuntimeError(f"Login Turni fallito: HTTP {resp.status_code}")
+ data = resp.json()
+ token = data.get("token")
+ if not token:
+ raise RuntimeError("Login Turni: token JWT mancante")
+ _store_jwt(mcp_username, token)
+ return token
+
+
+def _request(
+ method: str,
+ path: str,
+ *,
+ mcp_username: str,
+ params: Optional[dict] = None,
+) -> Any:
+ token = login(mcp_username)
+ verify = os.environ.get("TURNI_VERIFY_SSL", "true").strip().lower() not in (
+ "0", "false", "no", "off",
+ )
+ url = path if path.startswith("http") else urljoin(API_URL + "/", path.lstrip("/"))
+ headers = {"Authorization": f"Bearer {token}"}
+ with httpx.Client(timeout=60.0, verify=verify) as client:
+ resp = client.request(method, url, headers=headers, params=params)
+ if resp.status_code == 401:
+ with _jwt_lock:
+ _jwt_cache.pop(mcp_username.lower(), None)
+ headers["Authorization"] = f"Bearer {login(mcp_username)}"
+ resp = client.request(method, url, headers=headers, params=params)
+ if resp.status_code >= 400:
+ raise RuntimeError(f"Turni {path}: HTTP {resp.status_code} {resp.text[:200]}")
+ return resp.json()
+
+
+def get_status() -> dict:
+ verify = os.environ.get("TURNI_VERIFY_SSL", "true").strip().lower() not in (
+ "0", "false", "no", "off",
+ )
+ url = urljoin(API_URL + "/", "api/status")
+ with httpx.Client(timeout=30.0, verify=verify) as client:
+ resp = client.get(url)
+ resp.raise_for_status()
+ return resp.json()
+
+
+def list_doctors(mcp_username: str) -> Any:
+ return _request("GET", "/api/doctors", mcp_username=mcp_username)
+
+
+def get_shift_assignments(
+ mcp_username: str,
+ *,
+ from_date: Optional[str] = None,
+ to_date: Optional[str] = None,
+ limit: int = 100,
+) -> Any:
+ params: dict = {}
+ if from_date:
+ params["from"] = from_date
+ if to_date:
+ params["to"] = to_date
+ data = _request("GET", "/api/shift-assignments", mcp_username=mcp_username, params=params or None)
+ if isinstance(data, list):
+ return data[:limit]
+ if isinstance(data, dict):
+ items = data.get("assignments") or data.get("items") or data.get("results")
+ if isinstance(items, list):
+ return items[:limit]
+ return data
+
+
+def get_my_shifts(
+ mcp_username: str,
+ *,
+ from_date: Optional[str] = None,
+ to_date: Optional[str] = None,
+ limit: int = 50,
+) -> dict:
+ """Turni dell'utente MCP: filtra per doctorId collegato o per nome medico."""
+ user_info = _request("GET", "/api/users/me", mcp_username=mcp_username)
+ doctor_id = user_info.get("doctorId")
+ assignments = get_shift_assignments(
+ mcp_username, from_date=from_date, to_date=to_date, limit=500,
+ )
+ if not isinstance(assignments, list):
+ return {"user": user_info, "assignments": assignments}
+ if doctor_id:
+ mine = [a for a in assignments if a.get("doctorId") == doctor_id or a.get("doctor_id") == doctor_id]
+ else:
+ service_user = _service_username(mcp_username)
+ doctors = list_doctors(mcp_username)
+ doc_ids = set()
+ if isinstance(doctors, list):
+ for doc in doctors:
+ name = (doc.get("name") or doc.get("fullName") or "").lower()
+ if service_user.lower() in name or mcp_username.lower() in name:
+ doc_ids.add(doc.get("id") or doc.get("doctorId"))
+ mine = [
+ a for a in assignments
+ if (a.get("doctorId") or a.get("doctor_id")) in doc_ids
+ ] if doc_ids else assignments[:limit]
+ return {
+ "user": {
+ "username": user_info.get("username"),
+ "role": user_info.get("role"),
+ "doctorId": doctor_id,
+ },
+ "assignments": mine[:limit],
+ "count": len(mine),
+ }
diff --git a/services/loogle-mcp/app/jwt_utils.py b/services/loogle-mcp/app/jwt_utils.py
new file mode 100644
index 0000000..288b715
--- /dev/null
+++ b/services/loogle-mcp/app/jwt_utils.py
@@ -0,0 +1,136 @@
+# -*- coding: utf-8 -*-
+"""JWT utilities for OAuth access tokens."""
+
+import datetime
+import os
+import secrets
+import uuid
+from typing import Optional
+
+import jwt
+
+from .db import get_conn
+
+JWT_ALG = "HS256"
+ACCESS_TOKEN_HOURS = 1
+REFRESH_TOKEN_DAYS = 30
+
+
+def jwt_secret() -> str:
+ secret = os.environ.get("MCP_JWT_SECRET", "").strip()
+ if not secret:
+ secret = secrets.token_urlsafe(48)
+ os.environ["MCP_JWT_SECRET"] = secret
+ return secret
+
+
+def base_url() -> str:
+ return os.environ.get("MCP_BASE_URL", "https://mcp.loogle.it").rstrip("/")
+
+
+def scopes_for_user(user: dict, requested: str) -> str:
+ parts = [s for s in requested.split() if s]
+ allowed = {
+ "context:read",
+ "context:write",
+ "knowledge:read",
+ "knowledge:write",
+ "gitea:read",
+ "gitea:write",
+ "home:read",
+ "irrigation:read",
+ "turni:read",
+ }
+ if user.get("is_admin"):
+ allowed.add("admin")
+ filtered = [s for s in parts if s in allowed]
+ if not filtered:
+ filtered = [
+ "context:read",
+ "context:write",
+ "knowledge:read",
+ "knowledge:write",
+ "gitea:read",
+ "gitea:write",
+ "home:read",
+ "irrigation:read",
+ "turni:read",
+ ]
+ return " ".join(filtered)
+
+
+def create_access_token(user: dict, scope: str, client_id: str) -> tuple[str, str]:
+ jti = str(uuid.uuid4())
+ now = datetime.datetime.utcnow()
+ payload = {
+ "iss": base_url(),
+ "sub": user["username"],
+ "uid": user["id"],
+ "scope": scope,
+ "client_id": client_id,
+ "jti": jti,
+ "iat": now,
+ "exp": now + datetime.timedelta(hours=ACCESS_TOKEN_HOURS),
+ }
+ token = jwt.encode(payload, jwt_secret(), algorithm=JWT_ALG)
+ return token, jti
+
+
+def create_refresh_token(user_id: int, scope: str, client_id: str) -> str:
+ token = secrets.token_urlsafe(48)
+ expires = (
+ datetime.datetime.utcnow() + datetime.timedelta(days=REFRESH_TOKEN_DAYS)
+ ).strftime("%Y-%m-%d %H:%M:%S")
+ get_conn().execute(
+ "INSERT INTO refresh_tokens(token,user_id,client_id,scope,expires_at) VALUES (?,?,?,?,?)",
+ (token, user_id, client_id, scope, expires),
+ )
+ get_conn().commit()
+ return token
+
+
+def decode_access_token(token: str) -> Optional[dict]:
+ try:
+ payload = jwt.decode(token, jwt_secret(), algorithms=[JWT_ALG], issuer=base_url())
+ except jwt.PyJWTError:
+ return None
+ jti = payload.get("jti")
+ if not jti:
+ return None
+ row = get_conn().execute(
+ "SELECT 1 FROM revoked_jtis WHERE jti=? AND expires_at > datetime('now')",
+ (jti,),
+ ).fetchone()
+ if row:
+ return None
+ return payload
+
+
+def revoke_jti(jti: str, expires_at: datetime.datetime) -> None:
+ get_conn().execute(
+ "INSERT OR IGNORE INTO revoked_jtis(jti,expires_at) VALUES (?,?)",
+ (jti, expires_at.strftime("%Y-%m-%d %H:%M:%S")),
+ )
+ get_conn().commit()
+
+
+def revoke_refresh_token(token: str) -> None:
+ get_conn().execute("UPDATE refresh_tokens SET revoked=1 WHERE token=?", (token,))
+ get_conn().commit()
+
+
+def consume_refresh_token(token: str) -> Optional[dict]:
+ row = get_conn().execute(
+ "SELECT * FROM refresh_tokens WHERE token=? AND revoked=0 AND expires_at > datetime('now')",
+ (token,),
+ ).fetchone()
+ if not row:
+ return None
+ return dict(row)
+
+
+def has_scope(claims: dict, scope: str) -> bool:
+ scopes = set((claims.get("scope") or "").split())
+ if "admin" in scopes:
+ return True
+ return scope in scopes
diff --git a/services/loogle-mcp/app/knowledge/__init__.py b/services/loogle-mcp/app/knowledge/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/services/loogle-mcp/app/knowledge/apps_indexer.py b/services/loogle-mcp/app/knowledge/apps_indexer.py
new file mode 100644
index 0000000..32b9278
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/apps_indexer.py
@@ -0,0 +1,295 @@
+# -*- coding: utf-8 -*-
+"""RAG su export Irrigazione + Turni (P7)."""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+from datetime import datetime, timezone
+from typing import Any, Optional
+
+from ..db import get_conn
+from ..integrations import irrigazione, turni
+from . import embeddings, qdrant_store
+from .text_chunk import chunk_text as _chunk_text
+
+LOGGER = logging.getLogger("loogle_mcp.apps_indexer")
+
+INDEX_USER = os.environ.get("APPS_INDEX_USER", "daniele").lower()
+
+
+def _int_env(name: str, default: int) -> int:
+ try:
+ return int(os.environ.get(name, str(default)))
+ except ValueError:
+ return default
+
+
+def _enabled() -> bool:
+ flag = os.environ.get("APPS_INDEX_ENABLED", "yes").strip().lower()
+ return flag not in ("0", "false", "no", "off")
+
+
+def _doc_id(source: str, record_id: str) -> int:
+ key = f"{source}:{record_id}"
+ return abs(hash(key)) % (2**31 - 1)
+
+
+def _index_text(source: str, record_id: str, title: str, text: str) -> dict:
+ chunks = _chunk_text(_truncate(text))
+ if len(chunks) > 8:
+ chunks = chunks[:8]
+ if not chunks:
+ return {"source": source, "record_id": record_id, "chunks": 0, "skipped": True}
+ vectors = embeddings.embed_texts(chunks)
+ collection = qdrant_store.APPS_SHARED_COLLECTION
+ doc_id = _doc_id(source, record_id)
+ qdrant_store.delete_by_doc(collection, doc_id)
+ ids = []
+ payloads = []
+ for i, chunk in enumerate(chunks):
+ point_id = f"app-{source}-{record_id}-chunk-{i}"
+ ids.append(point_id)
+ payloads.append(
+ {
+ "doc_id": doc_id,
+ "source": source,
+ "record_id": record_id,
+ "chunk_index": i,
+ "title": title,
+ "text": chunk,
+ "owner": "family",
+ "visibility": "family",
+ }
+ )
+ qdrant_store.upsert_chunks(collection, ids, vectors, payloads)
+ get_conn().execute(
+ "INSERT INTO indexed_apps_records(source,record_id,title,owner,chunk_count,indexed_at)"
+ " VALUES (?,?,?,?,?,datetime('now'))"
+ " ON CONFLICT(source,record_id) DO UPDATE SET"
+ " title=excluded.title, chunk_count=excluded.chunk_count, indexed_at=datetime('now')",
+ (source, record_id, title, "family", len(chunks)),
+ )
+ get_conn().commit()
+ return {"source": source, "record_id": record_id, "chunks": len(chunks), "collection": collection}
+
+
+def _format_irrigation_history_item(item: dict, idx: int) -> str:
+ parts = [f"Irrigazione storico #{idx}"]
+ for key in ("started_at", "ended_at", "zone", "zone_name", "duration_min", "volume_l", "mode", "note"):
+ if item.get(key) is not None:
+ parts.append(f"{key}: {item[key]}")
+ return "\n".join(parts)
+
+
+def _format_irrigation_event(item: dict, idx: int) -> str:
+ parts = [f"Irrigazione evento #{idx}"]
+ for key in ("ts", "time", "type", "level", "message", "zone", "detail"):
+ if item.get(key) is not None:
+ parts.append(f"{key}: {item[key]}")
+ return "\n".join(parts)
+
+
+def _format_turni_assignment(item: dict, idx: int) -> str:
+ parts = [f"Turno #{idx}"]
+ for key in (
+ "date", "startDate", "endDate", "doctorId", "doctorName", "doctor_name",
+ "slotId", "slotName", "slot_name", "uoc", "uocName", "shiftType", "notes",
+ ):
+ if item.get(key) is not None:
+ parts.append(f"{key}: {item[key]}")
+ return "\n".join(parts)
+
+
+def _truncate(text: str, limit: int = 6000) -> str:
+ if len(text) <= limit:
+ return text
+ return text[: limit - 20] + "\n… [truncated]"
+
+
+def _summarize_irrigation_status(status: dict) -> str:
+ lines = ["Irrigazione — snapshot stato"]
+ for key in ("plan_mode", "program", "simulation", "hibernation", "draining"):
+ if key in status:
+ lines.append(f"{key}: {status[key]}")
+ ha = status.get("ha") or {}
+ lines.append(f"ha_connected: {ha.get('connected')}")
+ zones = status.get("zones") or []
+ lines.append(f"zone_count: {len(zones)}")
+ for z in zones[:12]:
+ if isinstance(z, dict):
+ lines.append(
+ f" - {z.get('name', z.get('id'))}: state={z.get('ha_state')} excluded={z.get('excluded')}"
+ )
+ analysis = status.get("analysis")
+ if isinstance(analysis, dict):
+ for k, v in list(analysis.items())[:8]:
+ lines.append(f"analysis.{k}: {v}")
+ elif analysis:
+ lines.append(f"analysis: {analysis}")
+ return "\n".join(lines)
+
+
+def _summarize_zones(zones: Any) -> str:
+ items = zones if isinstance(zones, list) else _normalize_list(zones)
+ lines = [f"Irrigazione — zone ({len(items)})"]
+ for z in items[:20]:
+ if not isinstance(z, dict):
+ continue
+ lines.append(
+ f"- {z.get('name', z.get('id'))}: ha={z.get('ha_state')} "
+ f"rate_mmh={z.get('rate_mmh')} flow={z.get('zone_flow_lph')}"
+ )
+ return "\n".join(lines)
+
+
+def _normalize_list(data: Any) -> list:
+ if isinstance(data, list):
+ return data
+ if isinstance(data, dict):
+ for key in ("items", "results", "history", "events", "assignments", "records"):
+ val = data.get(key)
+ if isinstance(val, list):
+ return val
+ return []
+
+
+def index_irrigazione(*, username: Optional[str] = None, history_limit: Optional[int] = None, events_limit: Optional[int] = None) -> dict:
+ user = username or INDEX_USER
+ history_limit = history_limit if history_limit is not None else _int_env("APPS_INDEX_HISTORY_LIMIT", 25)
+ events_limit = events_limit if events_limit is not None else _int_env("APPS_INDEX_EVENTS_LIMIT", 40)
+ if not irrigazione.is_configured(user):
+ return {"source": "irrigazione", "skipped": True, "reason": "not configured"}
+ indexed = 0
+ errors = 0
+ try:
+ status = irrigazione.get_status(user)
+ status_text = _summarize_irrigation_status(status)
+ _index_text("irrigazione", "status-snapshot", "Irrigazione — stato attuale", status_text)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Irrigazione status index failed: %s", exc)
+ errors += 1
+ try:
+ zones = irrigazione.get_zones(user)
+ zones_text = _summarize_zones(zones)
+ _index_text("irrigazione", "zones-snapshot", "Irrigazione — zone", zones_text)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Irrigazione zones index failed: %s", exc)
+ errors += 1
+ try:
+ history = irrigazione.get_history(user, limit=history_limit)
+ for i, item in enumerate(_normalize_list(history)):
+ if not isinstance(item, dict):
+ continue
+ rid = str(item.get("id") or item.get("started_at") or i)
+ text = _format_irrigation_history_item(item, i)
+ _index_text("irrigazione", f"history-{rid}", f"Irrigazione storico {rid}", text)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Irrigazione history index failed: %s", exc)
+ errors += 1
+ try:
+ events = irrigazione.get_events(user, limit=events_limit)
+ for i, item in enumerate(_normalize_list(events)):
+ if not isinstance(item, dict):
+ continue
+ rid = str(item.get("id") or item.get("ts") or item.get("time") or i)
+ text = _format_irrigation_event(item, i)
+ _index_text("irrigazione", f"event-{rid}", f"Irrigazione evento {rid}", text)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Irrigazione events index failed: %s", exc)
+ errors += 1
+ try:
+ lavori = irrigazione.get_lavori_summary(user)
+ lavori_text = _truncate(json.dumps(lavori, ensure_ascii=False, indent=2), 4000)
+ _index_text("irrigazione", "lavori-summary", "Irrigazione — lavori manutenzione", lavori_text)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Irrigazione lavori index failed: %s", exc)
+ errors += 1
+ return {"source": "irrigazione", "indexed": indexed, "errors": errors}
+
+
+def index_turni(*, username: Optional[str] = None, assignments_limit: Optional[int] = None) -> dict:
+ user = username or INDEX_USER
+ assignments_limit = assignments_limit if assignments_limit is not None else _int_env("APPS_INDEX_ASSIGNMENTS_LIMIT", 80)
+ if not turni.is_configured(user):
+ return {"source": "turni", "skipped": True, "reason": "not configured"}
+ indexed = 0
+ errors = 0
+ try:
+ status = turni.get_status()
+ status_text = _truncate(json.dumps(status, ensure_ascii=False, indent=2), 2000)
+ _index_text("turni", "status-snapshot", "Turni — stato servizio", status_text)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Turni status index failed: %s", exc)
+ errors += 1
+ try:
+ doctors = turni.list_doctors(user)
+ lines = ["Turni — medici"]
+ for d in (_normalize_list(doctors) if not isinstance(doctors, list) else doctors)[:40]:
+ if isinstance(d, dict):
+ lines.append(f"- {d.get('name', d.get('fullName'))} id={d.get('id')}")
+ _index_text("turni", "doctors-list", "Turni — elenco medici", "\n".join(lines))
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Turni doctors index failed: %s", exc)
+ errors += 1
+ try:
+ assignments = turni.get_shift_assignments(user, limit=assignments_limit)
+ for i, item in enumerate(_normalize_list(assignments)):
+ if not isinstance(item, dict):
+ continue
+ rid = str(item.get("id") or item.get("date") or i)
+ text = _format_turni_assignment(item, i)
+ _index_text("turni", f"assignment-{rid}", f"Turno {rid}", text)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Turni assignments index failed: %s", exc)
+ errors += 1
+ return {"source": "turni", "indexed": indexed, "errors": errors}
+
+
+def index_all(*, username: Optional[str] = None) -> dict:
+ if not _enabled():
+ return {"skipped": True, "reason": "APPS_INDEX_ENABLED=no"}
+ user = username or INDEX_USER
+ return {
+ "irrigazione": index_irrigazione(username=user),
+ "turni": index_turni(username=user),
+ "at": datetime.now(timezone.utc).isoformat(),
+ }
+
+
+def search_apps_knowledge(query: str, limit: int = 8, source: Optional[str] = None) -> list:
+ vectors = embeddings.embed_texts([query])
+ flt = {"source": source} if source else None
+ hits = qdrant_store.search(
+ [qdrant_store.APPS_SHARED_COLLECTION],
+ vectors[0],
+ limit=limit,
+ visibility_filter=flt,
+ )
+ for hit in hits:
+ hit.setdefault("source_type", hit.get("source", "apps"))
+ return hits
+
+
+def list_indexed_records(source: Optional[str] = None, limit: int = 40) -> list:
+ conn = get_conn()
+ if source:
+ rows = conn.execute(
+ "SELECT * FROM indexed_apps_records WHERE source=? ORDER BY indexed_at DESC LIMIT ?",
+ (source, limit),
+ ).fetchall()
+ else:
+ rows = conn.execute(
+ "SELECT * FROM indexed_apps_records ORDER BY indexed_at DESC LIMIT ?",
+ (limit,),
+ ).fetchall()
+ return [dict(r) for r in rows]
diff --git a/services/loogle-mcp/app/knowledge/embeddings.py b/services/loogle-mcp/app/knowledge/embeddings.py
new file mode 100644
index 0000000..84b6389
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/embeddings.py
@@ -0,0 +1,87 @@
+# -*- coding: utf-8 -*-
+"""Embedding providers — con thermal gate e keep_alive adattivo."""
+
+import logging
+import os
+import time
+from typing import Optional
+
+import httpx
+
+from . import thermal
+
+LOGGER = logging.getLogger("loogle_mcp.embeddings")
+
+
+def embed_texts(texts: list[str]) -> list[list[float]]:
+ if not texts:
+ return []
+ ollama_url = os.environ.get("OLLAMA_URL", "").strip()
+ if ollama_url:
+ try:
+ return _embed_ollama(texts, ollama_url)
+ except Exception as exc:
+ LOGGER.warning("Ollama embedding failed: %s", exc)
+ openai_key = os.environ.get("OPENAI_API_KEY", "").strip()
+ if openai_key:
+ return _embed_openai(texts, openai_key)
+ raise RuntimeError("Nessun provider embedding configurato (OLLAMA_URL o OPENAI_API_KEY)")
+
+
+def _embed_ollama(texts: list[str], base_url: str) -> list[list[float]]:
+ model = os.environ.get("OLLAMA_EMBED_MODEL", "nomic-embed-text")
+ vectors = []
+ timeout = httpx.Timeout(connect=30.0, read=300.0, write=30.0, pool=30.0)
+ with httpx.Client(timeout=timeout) as client:
+ for i, text in enumerate(texts):
+ status = thermal.wait_for_headroom(context=f"embed:{i+1}/{len(texts)}")
+ keep_alive = thermal.suggested_keep_alive(status)
+ delay = thermal.suggested_delay_s(status)
+
+ payload = {"model": model, "prompt": text, "keep_alive": keep_alive}
+ # options.num_thread limita i thread CPU lato Ollama (se supportato)
+ num_thread = os.environ.get("OLLAMA_NUM_THREAD", "").strip()
+ if num_thread:
+ try:
+ payload["options"] = {"num_thread": int(num_thread)}
+ except ValueError:
+ pass
+
+ resp = client.post(f"{base_url.rstrip('/')}/api/embeddings", json=payload)
+ if resp.status_code >= 400:
+ LOGGER.warning(
+ "Ollama embeddings HTTP %s: %s — payload keys=%s",
+ resp.status_code,
+ resp.text[:300],
+ list(payload.keys()),
+ )
+ resp.raise_for_status()
+ vectors.append(resp.json()["embedding"])
+
+ if delay > 0 and i + 1 < len(texts):
+ time.sleep(delay)
+
+ # Unload solo se esplicitamente richiesto (zona HARD) — evita spike da reload
+ if keep_alive == 0:
+ try:
+ client.post(
+ f"{base_url.rstrip('/')}/api/generate",
+ json={"model": model, "keep_alive": 0},
+ timeout=30.0,
+ )
+ except Exception:
+ pass
+ return vectors
+
+
+def _embed_openai(texts: list[str], api_key: str) -> list[list[float]]:
+ model = os.environ.get("OPENAI_EMBED_MODEL", "text-embedding-3-small")
+ with httpx.Client(timeout=120.0) as client:
+ resp = client.post(
+ "https://api.openai.com/v1/embeddings",
+ headers={"Authorization": f"Bearer {api_key}"},
+ json={"model": model, "input": texts},
+ )
+ resp.raise_for_status()
+ data = resp.json()["data"]
+ return [item["embedding"] for item in sorted(data, key=lambda x: x["index"])]
diff --git a/services/loogle-mcp/app/knowledge/gitea.py b/services/loogle-mcp/app/knowledge/gitea.py
new file mode 100644
index 0000000..5815291
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/gitea.py
@@ -0,0 +1,495 @@
+# -*- coding: utf-8 -*-
+"""Gitea REST API client — token per utente MCP."""
+
+import base64
+import json
+import logging
+import os
+import re
+from typing import Any, Optional
+from urllib.parse import quote
+
+import httpx
+
+LOGGER = logging.getLogger("loogle_mcp.gitea")
+
+GITEA_URL = os.environ.get("GITEA_URL", "https://git.loogle.it").rstrip("/")
+MCP_USERS = ("daniele", "lucia", "davide", "luca")
+GITEA_API_TOKEN_SCOPES = "read:repository,write:repository,write:issue,write:user,read:user"
+TEXT_EXTENSIONS = {
+ ".md", ".txt", ".py", ".sh", ".yml", ".yaml", ".json", ".toml", ".ini",
+ ".conf", ".js", ".ts", ".tsx", ".jsx", ".html", ".css", ".sql", ".go",
+ ".rs", ".env", ".service", ".timer", ".xml", ".csv",
+}
+_tokens_cache: Optional[dict[str, str]] = None
+
+
+def _load_tokens() -> dict[str, str]:
+ global _tokens_cache
+ if _tokens_cache is not None:
+ return _tokens_cache
+
+ tokens: dict[str, str] = {}
+ json_map = os.environ.get("GITEA_API_TOKENS", "").strip()
+ if json_map:
+ try:
+ parsed = json.loads(json_map)
+ if isinstance(parsed, dict):
+ tokens.update({k.lower(): v for k, v in parsed.items() if v})
+ except json.JSONDecodeError:
+ LOGGER.warning("GITEA_API_TOKENS non è JSON valido")
+
+ fallback = os.environ.get("GITEA_API_TOKEN", "").strip()
+ for user in MCP_USERS:
+ env_key = f"GITEA_API_TOKEN_{user.upper()}"
+ token = os.environ.get(env_key, "").strip()
+ if token:
+ tokens[user] = token
+ elif user not in tokens and fallback:
+ tokens[user] = fallback
+
+ if not tokens and fallback:
+ tokens["daniele"] = fallback
+
+ _tokens_cache = tokens
+ return tokens
+
+
+def list_configured_users() -> list[str]:
+ return list(_load_tokens().keys())
+
+
+def is_configured(username: Optional[str] = None) -> bool:
+ tokens = _load_tokens()
+ if not tokens:
+ return False
+ if username:
+ user = username.lower()
+ return user in tokens or "daniele" in tokens or bool(tokens)
+ return True
+
+
+def _headers(username: Optional[str] = None) -> dict[str, str]:
+ tokens = _load_tokens()
+ if not tokens:
+ raise RuntimeError(
+ "Nessun token Gitea configurato. "
+ "Imposta GITEA_API_TOKEN o GITEA_API_TOKEN_{USER} in .env — vedi docs/GITEA-TOKEN.md"
+ )
+ user = (username or "daniele").lower()
+ token = tokens.get(user) or tokens.get("daniele") or next(iter(tokens.values()))
+ return {"Authorization": f"token {token}"}
+
+
+def parse_repo(repo: str) -> tuple[str, str]:
+ cleaned = repo.strip().strip("/")
+ if cleaned.count("/") != 1:
+ raise ValueError("repo deve essere nel formato owner/name (es. daniele/rete)")
+ owner, name = cleaned.split("/", 1)
+ if not owner or not name:
+ raise ValueError("repo deve essere nel formato owner/name (es. daniele/rete)")
+ return owner, name
+
+
+def api_base_url() -> str:
+ return os.environ.get("GITEA_API_URL", GITEA_URL).rstrip("/")
+
+
+def public_base_url() -> str:
+ return os.environ.get("GITEA_URL", "https://git.loogle.it").rstrip("/")
+
+
+def _api_url(path: str) -> str:
+ return f"{api_base_url()}/api/v1{path}"
+
+
+def _request(
+ method: str,
+ path: str,
+ *,
+ username: Optional[str] = None,
+ params: Optional[dict] = None,
+ json_body: Optional[dict] = None,
+) -> Any:
+ with httpx.Client(timeout=60.0, verify=True) as client:
+ resp = client.request(
+ method,
+ _api_url(path),
+ headers=_headers(username),
+ params=params,
+ json=json_body,
+ )
+ if resp.status_code == 404:
+ raise FileNotFoundError(resp.text or "Risorsa Gitea non trovata")
+ resp.raise_for_status()
+ if resp.content:
+ return resp.json()
+ return {}
+
+
+def list_repos(
+ username: Optional[str] = None,
+ page: int = 1,
+ limit: int = 50,
+) -> dict:
+ data = _request(
+ "GET",
+ "/user/repos",
+ username=username,
+ params={"page": page, "limit": limit, "sort": "updated"},
+ )
+ repos = []
+ for repo in data if isinstance(data, list) else []:
+ full_name = repo.get("full_name") or ""
+ if not full_name and repo.get("owner"):
+ full_name = f"{repo['owner'].get('login', '')}/{repo.get('name', '')}"
+ repos.append(
+ {
+ "full_name": full_name,
+ "description": repo.get("description") or "",
+ "private": bool(repo.get("private")),
+ "html_url": repo.get("html_url") or f"{public_base_url()}/{full_name}",
+ "default_branch": repo.get("default_branch") or "main",
+ "updated_at": repo.get("updated_at"),
+ }
+ )
+ return {"repos": repos, "page": page, "count": len(repos)}
+
+
+def _decode_content(entry: dict) -> str:
+ encoding = (entry.get("encoding") or "").lower()
+ raw = entry.get("content") or ""
+ if encoding == "base64":
+ return base64.b64decode(raw).decode("utf-8", errors="replace")
+ return raw
+
+
+def get_file(
+ repo: str,
+ path: str,
+ ref: Optional[str] = None,
+ username: Optional[str] = None,
+) -> dict:
+ owner, name = parse_repo(repo)
+ file_path = path.lstrip("/")
+ params = {}
+ if ref:
+ params["ref"] = ref
+ encoded_path = "/".join(quote(part, safe="") for part in file_path.split("/"))
+ data = _request(
+ "GET",
+ f"/repos/{owner}/{name}/contents/{encoded_path}",
+ username=username,
+ params=params or None,
+ )
+ if isinstance(data, list):
+ entries = [
+ {
+ "name": item.get("name"),
+ "path": item.get("path"),
+ "type": item.get("type"),
+ "size": item.get("size"),
+ }
+ for item in data
+ ]
+ return {
+ "repo": f"{owner}/{name}",
+ "path": file_path or "/",
+ "type": "dir",
+ "entries": entries,
+ }
+ content = _decode_content(data)
+ return {
+ "repo": f"{owner}/{name}",
+ "path": data.get("path") or file_path,
+ "type": data.get("type") or "file",
+ "size": data.get("size"),
+ "sha": data.get("sha"),
+ "html_url": data.get("html_url") or f"{public_base_url()}/{owner}/{name}/src/branch/{ref or 'main'}/{file_path}",
+ "content": content,
+ }
+
+
+def search_code(
+ query: str,
+ repo: Optional[str] = None,
+ limit: int = 20,
+ username: Optional[str] = None,
+) -> dict:
+ q = query.strip()
+ if not q:
+ raise ValueError("query obbligatoria")
+ params: dict[str, Any] = {"q": q, "limit": min(max(limit, 1), 50)}
+ if repo:
+ owner, name = parse_repo(repo)
+ params["repo"] = f"{owner}/{name}"
+ try:
+ data = _request("GET", "/search/code", username=username, params=params)
+ hits = []
+ for item in data.get("data") or []:
+ repo_name = item.get("repository", {}).get("full_name") or item.get("repository", {}).get("name")
+ hits.append(
+ {
+ "repo": repo_name,
+ "path": item.get("path"),
+ "sha": item.get("sha"),
+ "html_url": item.get("url") or item.get("html_url"),
+ "language": item.get("language"),
+ "snippet": (item.get("content") or item.get("text") or "")[:500],
+ }
+ )
+ return {"query": q, "repo": repo, "results": hits, "count": len(hits)}
+ except FileNotFoundError:
+ return _search_code_fallback(q, repo, limit, username)
+ except httpx.HTTPStatusError as exc:
+ if exc.response.status_code not in (404, 422):
+ raise
+ return _search_code_fallback(q, repo, limit, username)
+
+
+def _search_code_fallback(
+ query: str,
+ repo: Optional[str],
+ limit: int,
+ username: Optional[str],
+) -> dict:
+ """Fallback se /search/code non disponibile: tree + grep su file testo."""
+ repos: list[str] = []
+ if repo:
+ owner, name = parse_repo(repo)
+ repos.append(f"{owner}/{name}")
+ else:
+ listed = list_repos(username=username, limit=20)
+ repos = [r["full_name"] for r in listed["repos"] if r.get("full_name")]
+
+ terms = [t.lower() for t in re.split(r"\s+", query) if t]
+ hits: list[dict] = []
+ max_files = min(limit * 3, 40)
+
+ for full_name in repos:
+ owner, name = parse_repo(full_name)
+ try:
+ tree = _request(
+ "GET",
+ f"/repos/{owner}/{name}/git/trees/HEAD",
+ username=username,
+ params={"recursive": "1"},
+ )
+ except Exception:
+ continue
+ scanned = 0
+ for node in tree.get("tree") or []:
+ if node.get("type") != "blob":
+ continue
+ path = node.get("path") or ""
+ ext = os.path.splitext(path)[1].lower()
+ if ext and ext not in TEXT_EXTENSIONS:
+ continue
+ if any(term in path.lower() for term in terms):
+ pass
+ scanned += 1
+ if scanned > max_files:
+ break
+ try:
+ file_data = get_file(full_name, path, username=username)
+ except Exception:
+ continue
+ content = (file_data.get("content") or "").lower()
+ if not any(term in content or term in path.lower() for term in terms):
+ continue
+ snippet = file_data.get("content") or ""
+ idx = snippet.lower().find(terms[0]) if terms else 0
+ if idx < 0:
+ idx = 0
+ hits.append(
+ {
+ "repo": full_name,
+ "path": path,
+ "sha": node.get("sha"),
+ "html_url": file_data.get("html_url"),
+ "snippet": snippet[max(0, idx - 80): idx + 420],
+ }
+ )
+ if len(hits) >= limit:
+ break
+ if len(hits) >= limit:
+ break
+
+ return {"query": query, "repo": repo, "results": hits[:limit], "count": len(hits[:limit]), "mode": "fallback"}
+
+
+def list_issues(
+ repo: str,
+ state: str = "open",
+ page: int = 1,
+ limit: int = 20,
+ username: Optional[str] = None,
+) -> dict:
+ owner, name = parse_repo(repo)
+ data = _request(
+ "GET",
+ f"/repos/{owner}/{name}/issues",
+ username=username,
+ params={"state": state, "page": page, "limit": limit, "type": "issues"},
+ )
+ issues = []
+ for item in data if isinstance(data, list) else []:
+ issues.append(
+ {
+ "number": item.get("number"),
+ "title": item.get("title"),
+ "state": item.get("state"),
+ "user": (item.get("user") or {}).get("login"),
+ "html_url": item.get("html_url"),
+ "created_at": item.get("created_at"),
+ "updated_at": item.get("updated_at"),
+ "labels": [lbl.get("name") for lbl in (item.get("labels") or [])],
+ }
+ )
+ return {"repo": f"{owner}/{name}", "state": state, "issues": issues, "count": len(issues)}
+
+
+def get_issue(
+ repo: str,
+ number: int,
+ username: Optional[str] = None,
+) -> dict:
+ owner, name = parse_repo(repo)
+ item = _request("GET", f"/repos/{owner}/{name}/issues/{number}", username=username)
+ return {
+ "repo": f"{owner}/{name}",
+ "number": item.get("number"),
+ "title": item.get("title"),
+ "state": item.get("state"),
+ "body": item.get("body") or "",
+ "user": (item.get("user") or {}).get("login"),
+ "html_url": item.get("html_url"),
+ "created_at": item.get("created_at"),
+ "updated_at": item.get("updated_at"),
+ "labels": [lbl.get("name") for lbl in (item.get("labels") or [])],
+ }
+
+
+def create_issue(
+ repo: str,
+ title: str,
+ body: str = "",
+ labels: Optional[list[str]] = None,
+ username: Optional[str] = None,
+) -> dict:
+ owner, name = parse_repo(repo)
+ payload: dict[str, Any] = {"title": title.strip(), "body": body or ""}
+ if labels:
+ payload["labels"] = labels
+ item = _request(
+ "POST",
+ f"/repos/{owner}/{name}/issues",
+ username=username,
+ json_body=payload,
+ )
+ return {
+ "repo": f"{owner}/{name}",
+ "number": item.get("number"),
+ "title": item.get("title"),
+ "state": item.get("state"),
+ "html_url": item.get("html_url"),
+ }
+
+
+def assert_repo_owner(username: str, repo: str, *, is_admin: bool = False) -> tuple[str, str]:
+ owner, name = parse_repo(repo)
+ if not is_admin and owner.lower() != username.lower():
+ raise PermissionError(
+ f"Puoi scrivere solo su repository di cui sei owner (repo {owner}/{name}, utente {username})"
+ )
+ return owner, name
+
+
+def create_repo(
+ name: str,
+ username: Optional[str] = None,
+ *,
+ private: bool = True,
+ description: str = "",
+ auto_init: bool = True,
+) -> dict:
+ repo_name = name.strip().lower()
+ if not repo_name or not re.match(r"^[a-z0-9][a-z0-9._-]{0,99}$", repo_name):
+ raise ValueError("name repo non valido (usa lettere minuscole, numeri, -, _, .)")
+ payload: dict[str, Any] = {
+ "name": repo_name,
+ "private": private,
+ "auto_init": auto_init,
+ "description": description.strip(),
+ }
+ item = _request("POST", "/user/repos", username=username, json_body=payload)
+ full_name = item.get("full_name") or f"{username}/{repo_name}"
+ return {
+ "full_name": full_name,
+ "private": bool(item.get("private", private)),
+ "html_url": item.get("html_url") or f"{public_base_url()}/{full_name}",
+ "default_branch": item.get("default_branch") or "main",
+ "description": item.get("description") or description,
+ }
+
+
+def create_or_update_file(
+ repo: str,
+ path: str,
+ content: str,
+ message: str,
+ *,
+ branch: Optional[str] = None,
+ username: Optional[str] = None,
+) -> dict:
+ owner, repo_name = parse_repo(repo)
+ file_path = path.lstrip("/")
+ if not file_path:
+ raise ValueError("path obbligatorio")
+ if not message.strip():
+ raise ValueError("message commit obbligatorio")
+
+ encoded_path = "/".join(quote(part, safe="") for part in file_path.split("/"))
+ params = {}
+ if branch:
+ params["ref"] = branch
+
+ sha = None
+ action = "create"
+ try:
+ existing = get_file(repo, file_path, ref=branch, username=username)
+ if existing.get("type") == "file":
+ sha = existing.get("sha")
+ action = "update"
+ except FileNotFoundError:
+ pass
+
+ body: dict[str, Any] = {
+ "content": base64.b64encode(content.encode("utf-8")).decode("ascii"),
+ "message": message.strip(),
+ }
+ if sha:
+ body["sha"] = sha
+ if branch:
+ body["branch"] = branch
+
+ method = "PUT" if sha else "POST"
+ item = _request(
+ method,
+ f"/repos/{owner}/{repo_name}/contents/{encoded_path}",
+ username=username,
+ params=params or None,
+ json_body=body,
+ )
+ commit = item.get("commit") or {}
+ content_obj = item.get("content") or {}
+ return {
+ "repo": f"{owner}/{repo_name}",
+ "path": file_path,
+ "action": action,
+ "branch": branch or "default",
+ "sha": content_obj.get("sha"),
+ "commit_sha": commit.get("sha"),
+ "html_url": content_obj.get("html_url")
+ or f"{public_base_url()}/{owner}/{repo_name}/src/branch/{branch or 'main'}/{file_path}",
+ }
diff --git a/services/loogle-mcp/app/knowledge/gitea_indexer.py b/services/loogle-mcp/app/knowledge/gitea_indexer.py
new file mode 100644
index 0000000..4cacdbd
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/gitea_indexer.py
@@ -0,0 +1,369 @@
+# -*- coding: utf-8 -*-
+"""Indicizzazione semantica (RAG) su file testo dei repository Gitea."""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+import zlib
+from typing import Optional
+
+from ..db import get_conn
+from . import embeddings, gitea, qdrant_store
+from .text_chunk import CHUNK_OVERLAP, CHUNK_SIZE, chunk_text as _chunk_text
+
+LOGGER = logging.getLogger("loogle_mcp.gitea_indexer")
+
+SKIP_PATH_PARTS = (
+ "node_modules/",
+ "vendor/",
+ ".git/",
+ "dist/",
+ "build/",
+ "__pycache__/",
+ ".venv/",
+ "venv/",
+ ".tox/",
+ "coverage/",
+)
+PRIORITY_PREFIXES = ("docs/", "ha/", "doc/", "README")
+
+
+def _enabled() -> bool:
+ flag = os.environ.get("GITEA_INDEX_ENABLED", "yes").strip().lower()
+ return flag not in ("0", "false", "no", "off")
+
+
+def _max_files_per_repo() -> int:
+ return int(os.environ.get("GITEA_INDEX_MAX_FILES_PER_REPO", "150"))
+
+
+def _max_file_bytes() -> int:
+ return int(os.environ.get("GITEA_INDEX_MAX_FILE_BYTES", "120000"))
+
+
+def _repos_for_user(username: str) -> list[str]:
+ env_key = f"GITEA_INDEX_REPOS_{username.upper()}"
+ raw = os.environ.get(env_key, "").strip()
+ if raw:
+ repos: list[str] = []
+ for item in raw.split(","):
+ item = item.strip()
+ if not item:
+ continue
+ owner, name = gitea.parse_repo(item)
+ repos.append(f"{owner}/{name}")
+ return repos
+ repos: list[str] = []
+ page = 1
+ while page <= 5:
+ data = gitea.list_repos(username=username, page=page, limit=50)
+ batch = [r["full_name"] for r in data.get("repos") or [] if r.get("full_name")]
+ if not batch:
+ break
+ repos.extend(batch)
+ if len(batch) < 50:
+ break
+ page += 1
+ return repos
+
+
+def _should_index_path(path: str) -> bool:
+ lowered = path.lower()
+ if any(part in lowered for part in SKIP_PATH_PARTS):
+ return False
+ ext = os.path.splitext(path)[1].lower()
+ return bool(ext and ext in gitea.TEXT_EXTENSIONS)
+
+
+def _path_priority(path: str) -> tuple[int, str]:
+ lowered = path.lower()
+ for idx, prefix in enumerate(PRIORITY_PREFIXES):
+ if lowered.startswith(prefix.lower()) or os.path.basename(lowered).startswith(prefix.lower()):
+ return (idx, path)
+ return (len(PRIORITY_PREFIXES), path)
+
+
+def list_repo_text_files(repo: str, username: str) -> list[dict]:
+ owner, name = gitea.parse_repo(repo)
+ tree = gitea._request(
+ "GET",
+ f"/repos/{owner}/{name}/git/trees/HEAD",
+ username=username,
+ params={"recursive": "1"},
+ )
+ max_files = _max_files_per_repo()
+ max_bytes = _max_file_bytes()
+ files: list[dict] = []
+ for node in tree.get("tree") or []:
+ if node.get("type") != "blob":
+ continue
+ path = node.get("path") or ""
+ if not _should_index_path(path):
+ continue
+ size = int(node.get("size") or 0)
+ if size > max_bytes:
+ continue
+ files.append({"path": path, "sha": node.get("sha"), "size": size})
+ files.sort(key=lambda item: _path_priority(item["path"]))
+ return files[:max_files]
+
+
+def _repo_owner(repo: str) -> str:
+ owner, _ = gitea.parse_repo(repo)
+ return owner.lower()
+
+
+def _repo_visibility(private: bool, owner: str) -> str:
+ if private:
+ return "personal"
+ if owner in gitea.MCP_USERS:
+ return "family"
+ return "family"
+
+
+def _collection_for_repo(private: bool, owner: str) -> str:
+ visibility = _repo_visibility(private, owner)
+ if visibility == "personal":
+ return qdrant_store.gitea_collection(owner)
+ return qdrant_store.GITEA_SHARED_COLLECTION
+
+
+def _file_doc_id(repo: str, path: str) -> int:
+ return zlib.adler32(f"{repo}:{path}".encode("utf-8")) & 0x7FFFFFFF
+
+
+def _file_title(repo: str, path: str) -> str:
+ return f"{repo}/{path}"
+
+
+def index_file(
+ repo: str,
+ path: str,
+ *,
+ username: str,
+ private: bool,
+ force: bool = False,
+) -> dict:
+ owner = _repo_owner(repo)
+ conn = get_conn()
+ row = conn.execute(
+ "SELECT sha, chunk_count FROM indexed_gitea_files WHERE repo=? AND path=?",
+ (repo, path),
+ ).fetchone()
+
+ file_data = gitea.get_file(repo, path, username=username)
+ sha = file_data.get("sha") or ""
+ if row and row["sha"] == sha and not force:
+ return {"repo": repo, "path": path, "skipped": True, "sha": sha}
+
+ text = (file_data.get("content") or "").strip()
+ if not text:
+ return {"repo": repo, "path": path, "chunks": 0, "sha": sha}
+
+ header = f"# {_file_title(repo, path)}\n\nSource: gitea:{repo}:{path}\n\n"
+ chunks = _chunk_text(header + text)
+ if not chunks:
+ return {"repo": repo, "path": path, "chunks": 0, "sha": sha}
+
+ visibility = _repo_visibility(private, owner)
+ collection = _collection_for_repo(private, owner)
+ doc_id = _file_doc_id(repo, path)
+ qdrant_store.delete_by_doc(collection, doc_id)
+
+ vectors = embeddings.embed_texts(chunks)
+ ids = []
+ payloads = []
+ for i, chunk in enumerate(chunks):
+ point_id = f"gitea-{repo}-{path}-chunk-{i}"
+ ids.append(point_id)
+ payloads.append(
+ {
+ "source": "gitea",
+ "doc_id": doc_id,
+ "repo": repo,
+ "path": path,
+ "chunk_index": i,
+ "title": _file_title(repo, path),
+ "text": chunk,
+ "owner": owner,
+ "visibility": visibility,
+ "sha": sha,
+ }
+ )
+ qdrant_store.upsert_chunks(collection, ids, vectors, payloads)
+
+ stored = qdrant_store.count_by_doc(collection, doc_id)
+ if stored < len(chunks):
+ raise RuntimeError(
+ f"Qdrant upsert incompleto per {repo}/{path}: attesi {len(chunks)} chunk, trovati {stored}"
+ )
+
+ conn.execute(
+ "INSERT INTO indexed_gitea_files(repo,path,sha,owner,visibility,chunk_count,indexed_at)"
+ " VALUES (?,?,?,?,?,?,datetime('now'))"
+ " ON CONFLICT(repo,path) DO UPDATE SET"
+ " sha=excluded.sha, owner=excluded.owner, visibility=excluded.visibility,"
+ " chunk_count=excluded.chunk_count, indexed_at=datetime('now')",
+ (repo, path, sha, owner, visibility, len(chunks)),
+ )
+ conn.commit()
+ return {
+ "repo": repo,
+ "path": path,
+ "sha": sha,
+ "chunks": len(chunks),
+ "collection": collection,
+ "visibility": visibility,
+ }
+
+
+def index_repo(
+ repo: str,
+ *,
+ username: Optional[str] = None,
+ private: Optional[bool] = None,
+ force: bool = False,
+ max_files: Optional[int] = None,
+) -> dict:
+ gitea_user = username or _repo_owner(repo)
+ if not gitea.is_configured(gitea_user):
+ raise RuntimeError(f"Gitea non configurato per {gitea_user}")
+
+ if private is None:
+ owner, name = gitea.parse_repo(repo)
+ meta = gitea._request("GET", f"/repos/{owner}/{name}", username=gitea_user)
+ private = bool(meta.get("private"))
+
+ files = list_repo_text_files(repo, gitea_user)
+ if max_files is not None:
+ files = files[: max(1, max_files)]
+
+ indexed = 0
+ skipped = 0
+ errors = 0
+ chunks = 0
+ for item in files:
+ try:
+ result = index_file(
+ repo,
+ item["path"],
+ username=gitea_user,
+ private=bool(private),
+ force=force,
+ )
+ if result.get("skipped"):
+ skipped += 1
+ else:
+ indexed += 1
+ chunks += int(result.get("chunks") or 0)
+ except Exception as exc:
+ LOGGER.warning("Index gitea %s/%s failed: %s", repo, item.get("path"), exc)
+ errors += 1
+
+ return {
+ "repo": repo,
+ "files_seen": len(files),
+ "files_indexed": indexed,
+ "files_skipped": skipped,
+ "errors": errors,
+ "chunks": chunks,
+ "private": bool(private),
+ }
+
+
+def index_all(max_files_per_repo: Optional[int] = None) -> dict:
+ if not _enabled():
+ return {"enabled": False, "indexed_files": 0}
+
+ total_indexed = 0
+ total_skipped = 0
+ total_errors = 0
+ total_chunks = 0
+ repos_done: list[str] = []
+ users = gitea.list_configured_users() or []
+
+ for username in users:
+ try:
+ repos = _repos_for_user(username)
+ except Exception as exc:
+ LOGGER.error("Lista repo Gitea fallita per %s: %s", username, exc)
+ continue
+ for repo in repos:
+ try:
+ result = index_repo(
+ repo,
+ username=username,
+ force=False,
+ max_files=max_files_per_repo,
+ )
+ repos_done.append(repo)
+ total_indexed += int(result.get("files_indexed") or 0)
+ total_skipped += int(result.get("files_skipped") or 0)
+ total_errors += int(result.get("errors") or 0)
+ total_chunks += int(result.get("chunks") or 0)
+ except Exception as exc:
+ LOGGER.warning("Index repo %s failed (%s): %s", repo, username, exc)
+ total_errors += 1
+
+ return {
+ "enabled": True,
+ "repos": repos_done,
+ "files_indexed": total_indexed,
+ "files_skipped": total_skipped,
+ "errors": total_errors,
+ "chunks": total_chunks,
+ "users": users,
+ }
+
+
+def gitea_collections_for_user(username: str, is_admin: bool = False) -> list[str]:
+ cols = [qdrant_store.GITEA_SHARED_COLLECTION, qdrant_store.gitea_collection(username)]
+ if is_admin:
+ for user in gitea.MCP_USERS:
+ cols.append(qdrant_store.gitea_collection(user))
+ return list(dict.fromkeys(cols))
+
+
+def search_gitea_knowledge(username: str, query: str, limit: int = 8, is_admin: bool = False) -> list:
+ vectors = embeddings.embed_texts([query])
+ collections = gitea_collections_for_user(username, is_admin=is_admin)
+ hits = qdrant_store.search(collections, vectors[0], limit=limit)
+ for hit in hits:
+ hit["source"] = hit.get("source") or "gitea"
+ return hits
+
+
+def list_indexed_files(limit: int = 30, repo: Optional[str] = None) -> list:
+ conn = get_conn()
+ if repo:
+ rows = conn.execute(
+ "SELECT * FROM indexed_gitea_files WHERE repo=? ORDER BY indexed_at DESC LIMIT ?",
+ (repo, limit),
+ ).fetchall()
+ else:
+ rows = conn.execute(
+ "SELECT * FROM indexed_gitea_files ORDER BY indexed_at DESC LIMIT ?",
+ (limit,),
+ ).fetchall()
+ return [dict(r) for r in rows]
+
+
+def index_stats() -> dict:
+ conn = get_conn()
+ row = conn.execute(
+ "SELECT COUNT(*), COALESCE(SUM(chunk_count), 0) FROM indexed_gitea_files"
+ ).fetchone()
+ files_count = int(row[0] if row else 0)
+ chunks_meta = int(row[1] if row else 0)
+ collections = {qdrant_store.GITEA_SHARED_COLLECTION}
+ for user in gitea.MCP_USERS:
+ collections.add(qdrant_store.gitea_collection(user))
+ qdrant_points = sum(qdrant_store.collection_point_count(c) for c in collections)
+ return {
+ "files_indexed": files_count,
+ "chunks_in_metadata": chunks_meta,
+ "qdrant_points": qdrant_points,
+ "collections": {c: qdrant_store.collection_point_count(c) for c in sorted(collections)},
+ }
diff --git a/services/loogle-mcp/app/knowledge/indexer.py b/services/loogle-mcp/app/knowledge/indexer.py
new file mode 100644
index 0000000..3b051d2
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/indexer.py
@@ -0,0 +1,156 @@
+# -*- coding: utf-8 -*-
+"""Paperless → Qdrant indexing pipeline."""
+
+import logging
+from typing import Optional
+
+LOGGER = logging.getLogger("loogle_mcp.indexer")
+
+from ..db import get_conn
+from . import embeddings, gitea_indexer, paperless, qdrant_store
+from .text_chunk import chunk_text as _chunk_text
+
+
+def index_document(doc_id: int, force: bool = False, paperless_user: Optional[str] = None) -> dict:
+ conn = get_conn()
+ existing = conn.execute(
+ "SELECT doc_id FROM indexed_documents WHERE doc_id=?", (doc_id,)
+ ).fetchone()
+ if existing and not force:
+ return {"doc_id": doc_id, "skipped": True}
+ doc = paperless.get_document(doc_id, username=paperless_user)
+ text = paperless.download_document_text(doc_id, username=paperless_user)
+ owner = paperless.document_owner(doc)
+ visibility = paperless.document_visibility(doc, owner)
+ chunks = _chunk_text(text)
+ if not chunks:
+ return {"doc_id": doc_id, "chunks": 0}
+ vectors = embeddings.embed_texts(chunks)
+ collection = qdrant_store.SHARED_COLLECTION if visibility == "family" else qdrant_store.kb_collection(owner)
+ qdrant_store.delete_by_doc(collection, doc_id)
+ ids = []
+ payloads = []
+ for i, chunk in enumerate(chunks):
+ point_id = f"doc-{doc_id}-chunk-{i}"
+ ids.append(point_id)
+ payloads.append(
+ {
+ "doc_id": doc_id,
+ "chunk_index": i,
+ "title": doc.get("title") or f"Documento {doc_id}",
+ "text": chunk,
+ "owner": owner,
+ "visibility": visibility,
+ }
+ )
+ qdrant_store.upsert_chunks(collection, ids, vectors, payloads)
+ conn.execute(
+ "INSERT INTO indexed_documents(doc_id,title,owner,visibility,chunk_count,indexed_at)"
+ " VALUES (?,?,?,?,?,datetime('now'))"
+ " ON CONFLICT(doc_id) DO UPDATE SET"
+ " title=excluded.title, owner=excluded.owner, visibility=excluded.visibility,"
+ " chunk_count=excluded.chunk_count, indexed_at=datetime('now')",
+ (doc_id, doc.get("title"), owner, visibility, len(chunks)),
+ )
+ conn.commit()
+ return {"doc_id": doc_id, "chunks": len(chunks), "collection": collection}
+
+
+def index_all(max_pages: int = 20) -> dict:
+ indexed = 0
+ errors = 0
+ seen: set[int] = set()
+ users = paperless.list_configured_users() or ["daniele"]
+ for paperless_user in users:
+ page = 1
+ while page <= max_pages:
+ try:
+ data = paperless.list_documents(page=page, page_size=25, username=paperless_user)
+ except Exception as exc:
+ LOGGER.error("Paperless list failed for %s: %s", paperless_user, exc)
+ break
+ results = data.get("results") or []
+ if not results:
+ break
+ for doc in results:
+ doc_id = doc["id"]
+ if doc_id in seen:
+ continue
+ seen.add(doc_id)
+ try:
+ index_document(doc_id, paperless_user=paperless_user)
+ indexed += 1
+ except Exception as exc:
+ LOGGER.warning("Index doc %s failed (%s): %s", doc_id, paperless_user, exc)
+ errors += 1
+ if not data.get("next"):
+ break
+ page += 1
+ return {"indexed": indexed, "errors": errors, "users": users}
+
+
+def index_context_snippet(username: str, project_id: str, text: str, title: str) -> None:
+ chunks = _chunk_text(text)
+ if not chunks:
+ return
+ vectors = embeddings.embed_texts(chunks)
+ collection = qdrant_store.ctx_collection(username)
+ doc_key = f"ctx-{username}-{project_id}"
+ qdrant_store.delete_by_doc(collection, hash(doc_key) % (2**31))
+ ids = []
+ payloads = []
+ for i, chunk in enumerate(chunks):
+ point_id = f"{doc_key}-chunk-{i}"
+ ids.append(point_id)
+ payloads.append(
+ {
+ "doc_id": hash(doc_key) % (2**31),
+ "project_id": project_id,
+ "chunk_index": i,
+ "title": title,
+ "text": chunk,
+ "owner": username,
+ "visibility": "personal",
+ }
+ )
+ qdrant_store.upsert_chunks(collection, ids, vectors, payloads)
+
+
+def search_knowledge(username: str, query: str, limit: int = 8, is_admin: bool = False) -> list:
+ vectors = embeddings.embed_texts([query])
+ collections = [
+ qdrant_store.SHARED_COLLECTION,
+ qdrant_store.kb_collection(username),
+ qdrant_store.ctx_collection(username),
+ ]
+ collections.extend(gitea_indexer.gitea_collections_for_user(username, is_admin=is_admin))
+ collections.append(qdrant_store.APPS_SHARED_COLLECTION)
+ if is_admin:
+ for u in ("daniele", "lucia", "davide", "luca"):
+ collections.append(qdrant_store.kb_collection(u))
+ collections = list(dict.fromkeys(collections))
+ hits = qdrant_store.search(collections, vectors[0], limit=limit)
+ for hit in hits:
+ if hit.get("repo") and not hit.get("source"):
+ hit["source"] = "gitea"
+ elif hit.get("source") in ("irrigazione", "turni"):
+ hit["source_type"] = "apps"
+ elif hit.get("doc_id") and not hit.get("source"):
+ hit["source"] = "paperless"
+ return hits
+
+
+def search_gitea_knowledge(username: str, query: str, limit: int = 8, is_admin: bool = False) -> list:
+ return gitea_indexer.search_gitea_knowledge(username, query, limit=limit, is_admin=is_admin)
+
+
+def search_context(username: str, query: str, limit: int = 8) -> list:
+ vectors = embeddings.embed_texts([query])
+ return qdrant_store.search([qdrant_store.ctx_collection(username)], vectors[0], limit=limit)
+
+
+def list_recent_documents(limit: int = 20) -> list:
+ rows = get_conn().execute(
+ "SELECT * FROM indexed_documents ORDER BY indexed_at DESC LIMIT ?", (limit,)
+ ).fetchall()
+ return [dict(r) for r in rows]
diff --git a/services/loogle-mcp/app/knowledge/paperless.py b/services/loogle-mcp/app/knowledge/paperless.py
new file mode 100644
index 0000000..c2da3c6
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/paperless.py
@@ -0,0 +1,140 @@
+# -*- coding: utf-8 -*-
+"""Paperless-ngx REST API client — supporto token per utente MCP."""
+
+import json
+import logging
+import os
+from typing import Optional
+
+import httpx
+
+LOGGER = logging.getLogger("loogle_mcp.paperless")
+
+PAPERLESS_URL = os.environ.get("PAPERLESS_URL", "https://docs.loogle.it").rstrip("/")
+MCP_USERS = ("daniele", "lucia", "davide", "luca")
+_tokens_cache: Optional[dict[str, str]] = None
+
+
+def _load_tokens() -> dict[str, str]:
+ """Carica token Paperless per utente MCP.
+
+ Priorità per ogni utente:
+ 1. PAPERLESS_API_TOKEN_{USERNAME} (es. PAPERLESS_API_TOKEN_LUCIA)
+ 2. Chiavi in PAPERLESS_API_TOKENS JSON (es. {"daniele":"...", "lucia":"..."})
+ 3. PAPERLESS_API_TOKEN globale (fallback per tutti, tipico account admin)
+ """
+ global _tokens_cache
+ if _tokens_cache is not None:
+ return _tokens_cache
+
+ tokens: dict[str, str] = {}
+ json_map = os.environ.get("PAPERLESS_API_TOKENS", "").strip()
+ if json_map:
+ try:
+ parsed = json.loads(json_map)
+ if isinstance(parsed, dict):
+ tokens.update({k.lower(): v for k, v in parsed.items() if v})
+ except json.JSONDecodeError:
+ LOGGER.warning("PAPERLESS_API_TOKENS non è JSON valido")
+
+ fallback = os.environ.get("PAPERLESS_API_TOKEN", "").strip()
+ for user in MCP_USERS:
+ env_key = f"PAPERLESS_API_TOKEN_{user.upper()}"
+ token = os.environ.get(env_key, "").strip()
+ if token:
+ tokens[user] = token
+ elif user not in tokens and fallback:
+ tokens[user] = fallback
+
+ if not tokens and fallback:
+ tokens["daniele"] = fallback
+
+ _tokens_cache = tokens
+ return tokens
+
+
+def list_configured_users() -> list[str]:
+ return list(_load_tokens().keys())
+
+
+def _headers(username: Optional[str] = None) -> dict:
+ tokens = _load_tokens()
+ if not tokens:
+ raise RuntimeError(
+ "Nessun token Paperless configurato. "
+ "Imposta PAPERLESS_API_TOKEN o PAPERLESS_API_TOKEN_{USER} in .env"
+ )
+ user = (username or "daniele").lower()
+ token = tokens.get(user) or tokens.get("daniele") or next(iter(tokens.values()))
+ return {"Authorization": f"Token {token}"}
+
+
+def list_documents(
+ page: int = 1,
+ page_size: int = 25,
+ ordering: str = "-modified",
+ username: Optional[str] = None,
+) -> dict:
+ with httpx.Client(timeout=60.0, verify=True) as client:
+ resp = client.get(
+ f"{PAPERLESS_URL}/api/documents/",
+ headers=_headers(username),
+ params={"page": page, "page_size": page_size, "ordering": ordering},
+ )
+ resp.raise_for_status()
+ return resp.json()
+
+
+def get_document(doc_id: int, username: Optional[str] = None) -> dict:
+ with httpx.Client(timeout=60.0, verify=True) as client:
+ resp = client.get(
+ f"{PAPERLESS_URL}/api/documents/{doc_id}/",
+ headers=_headers(username),
+ )
+ resp.raise_for_status()
+ return resp.json()
+
+
+def download_document_text(doc_id: int, username: Optional[str] = None) -> str:
+ doc = get_document(doc_id, username=username)
+ content = (doc.get("content") or "").strip()
+ if content:
+ return content
+ title = doc.get("title") or f"Documento {doc_id}"
+ return f"# {title}\n\n(Nessun testo OCR disponibile)"
+
+
+def document_visibility(doc: dict, owner_username: str) -> str:
+ tags = doc.get("tags") or []
+ tag_names = []
+ for t in tags:
+ if isinstance(t, dict):
+ tag_names.append((t.get("name") or "").lower())
+ elif isinstance(t, int):
+ continue
+ else:
+ tag_names.append(str(t).lower())
+ if any(t in ("personal", "privato", "private") for t in tag_names):
+ return "personal"
+ if any(t in ("admin-only", "admin") for t in tag_names):
+ return "admin"
+ return "family"
+
+
+def document_owner(doc: dict, default: str = "daniele") -> str:
+ owner = doc.get("owner")
+ if isinstance(owner, int):
+ pass
+ owner_username = doc.get("owner_username") or doc.get("owner_name")
+ if isinstance(owner_username, str):
+ name = owner_username.lower()
+ for user in MCP_USERS:
+ if user in name:
+ return user
+ correspondent = doc.get("correspondent")
+ if isinstance(correspondent, dict):
+ name = (correspondent.get("name") or "").lower()
+ for user in MCP_USERS:
+ if user in name:
+ return user
+ return default
diff --git a/services/loogle-mcp/app/knowledge/qdrant_store.py b/services/loogle-mcp/app/knowledge/qdrant_store.py
new file mode 100644
index 0000000..990c4f5
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/qdrant_store.py
@@ -0,0 +1,251 @@
+# -*- coding: utf-8 -*-
+"""Vector store — Qdrant remoto (DS920) con fallback SQLite locale su Pi ARM."""
+
+import json
+import logging
+import math
+import os
+import sqlite3
+import uuid
+from typing import Optional
+
+LOGGER = logging.getLogger("loogle_mcp.vector_store")
+VECTOR_SIZE = 768
+_local = sqlite3.connect(":memory:", check_same_thread=False) # placeholder
+_qdrant_client = None
+_qdrant_checked = False
+_use_fallback = False
+
+
+def _fallback_path() -> str:
+ return os.environ.get("MCP_VECTOR_FALLBACK", "/data/vector_fallback.db")
+
+
+def _fallback_conn() -> sqlite3.Connection:
+ path = _fallback_path()
+ os.makedirs(os.path.dirname(path), exist_ok=True)
+ conn = sqlite3.connect(path, timeout=30)
+ conn.execute(
+ """
+ CREATE TABLE IF NOT EXISTS vectors (
+ id TEXT PRIMARY KEY,
+ collection TEXT NOT NULL,
+ vector TEXT NOT NULL,
+ payload TEXT NOT NULL
+ )
+ """
+ )
+ conn.execute("CREATE INDEX IF NOT EXISTS idx_vectors_collection ON vectors(collection)")
+ conn.commit()
+ return conn
+
+
+def _get_qdrant():
+ global _qdrant_client, _qdrant_checked, _use_fallback
+ if _qdrant_checked:
+ return None if _use_fallback else _qdrant_client
+ _qdrant_checked = True
+ url = os.environ.get("QDRANT_URL", "").strip()
+ if not url:
+ _use_fallback = True
+ LOGGER.warning("QDRANT_URL non impostato — fallback SQLite")
+ return None
+ try:
+ from qdrant_client import QdrantClient
+ from qdrant_client.http import models as qm
+
+ client = QdrantClient(url=url, timeout=60)
+ client.get_collections()
+ _qdrant_client = client
+ globals()["qm"] = qm
+ LOGGER.info("Qdrant connesso: %s", url)
+ return client
+ except Exception as exc:
+ _use_fallback = True
+ LOGGER.warning("Qdrant non disponibile (%s) — fallback SQLite", exc)
+ return None
+
+
+def ensure_collection(name: str, vector_size: int = VECTOR_SIZE) -> None:
+ client = _get_qdrant()
+ if client is None:
+ return
+ from qdrant_client.http import models as qm
+
+ names = {c.name for c in client.get_collections().collections}
+ if name in names:
+ return
+ client.create_collection(
+ collection_name=name,
+ vectors_config=qm.VectorParams(size=vector_size, distance=qm.Distance.COSINE),
+ )
+
+
+def kb_collection(username: str) -> str:
+ return f"kb_personal_{username}"
+
+
+def ctx_collection(username: str) -> str:
+ return f"ctx_{username}"
+
+
+SHARED_COLLECTION = "kb_shared_family"
+GITEA_SHARED_COLLECTION = "gitea_shared_family"
+APPS_SHARED_COLLECTION = "apps_shared_family"
+
+
+def gitea_collection(username: str) -> str:
+ return f"gitea_personal_{username}"
+
+
+def _point_id(name: str) -> str:
+ return str(uuid.uuid5(uuid.NAMESPACE_URL, name))
+
+
+def _cosine(a: list[float], b: list[float]) -> float:
+ dot = sum(x * y for x, y in zip(a, b))
+ na = math.sqrt(sum(x * x for x in a)) or 1.0
+ nb = math.sqrt(sum(x * x for x in b)) or 1.0
+ return dot / (na * nb)
+
+
+def upsert_chunks(
+ collection: str,
+ ids: list[str],
+ vectors: list[list[float]],
+ payloads: list[dict],
+) -> None:
+ if not vectors:
+ return
+ ensure_collection(collection, len(vectors[0]))
+ client = _get_qdrant()
+ if client is not None:
+ from qdrant_client.http import models as qm
+
+ points = [
+ qm.PointStruct(id=_point_id(pid), vector=vec, payload=payload)
+ for pid, vec, payload in zip(ids, vectors, payloads)
+ ]
+ client.upsert(collection_name=collection, points=points)
+ return
+ conn = _fallback_conn()
+ for pid, vec, payload in zip(ids, vectors, payloads):
+ conn.execute(
+ "INSERT OR REPLACE INTO vectors(id,collection,vector,payload) VALUES (?,?,?,?)",
+ (_point_id(pid), collection, json.dumps(vec), json.dumps(payload, ensure_ascii=False)),
+ )
+ conn.commit()
+
+
+def delete_by_doc(collection: str, doc_id: int) -> None:
+ client = _get_qdrant()
+ if client is not None:
+ from qdrant_client.http import models as qm
+
+ ensure_collection(collection)
+ client.delete(
+ collection_name=collection,
+ points_selector=qm.FilterSelector(
+ filter=qm.Filter(
+ must=[qm.FieldCondition(key="doc_id", match=qm.MatchValue(value=doc_id))]
+ )
+ ),
+ )
+ return
+ conn = _fallback_conn()
+ rows = conn.execute("SELECT id,payload FROM vectors WHERE collection=?", (collection,)).fetchall()
+ for row_id, payload_raw in rows:
+ payload = json.loads(payload_raw)
+ if payload.get("doc_id") == doc_id:
+ conn.execute("DELETE FROM vectors WHERE id=?", (row_id,))
+ conn.commit()
+
+
+def count_by_doc(collection: str, doc_id: int) -> int:
+ client = _get_qdrant()
+ if client is not None:
+ from qdrant_client.http import models as qm
+
+ ensure_collection(collection)
+ result = client.count(
+ collection_name=collection,
+ count_filter=qm.Filter(
+ must=[qm.FieldCondition(key="doc_id", match=qm.MatchValue(value=doc_id))]
+ ),
+ exact=True,
+ )
+ return int(result.count)
+ conn = _fallback_conn()
+ rows = conn.execute("SELECT payload FROM vectors WHERE collection=?", (collection,)).fetchall()
+ count = 0
+ for (payload_raw,) in rows:
+ payload = json.loads(payload_raw)
+ if payload.get("doc_id") == doc_id:
+ count += 1
+ return count
+
+
+def collection_point_count(collection: str) -> int:
+ client = _get_qdrant()
+ if client is not None:
+ try:
+ info = client.get_collection(collection)
+ return int(info.points_count or 0)
+ except Exception:
+ return 0
+ conn = _fallback_conn()
+ row = conn.execute(
+ "SELECT COUNT(*) FROM vectors WHERE collection=?", (collection,)
+ ).fetchone()
+ return int(row[0] if row else 0)
+
+
+def search(
+ collections: list[str],
+ vector: list[float],
+ limit: int = 8,
+ visibility_filter: Optional[dict] = None,
+) -> list[dict]:
+ results: list[dict] = []
+ client = _get_qdrant()
+ if client is not None:
+ from qdrant_client.http import models as qm
+
+ for collection in collections:
+ ensure_collection(collection, len(vector))
+ flt = None
+ if visibility_filter:
+ must = [
+ qm.FieldCondition(key=k, match=qm.MatchValue(value=v))
+ for k, v in visibility_filter.items()
+ ]
+ if must:
+ flt = qm.Filter(must=must)
+ hits = client.search(
+ collection_name=collection,
+ query_vector=vector,
+ limit=limit,
+ query_filter=flt,
+ )
+ for hit in hits:
+ payload = dict(hit.payload or {})
+ payload["score"] = hit.score
+ payload["collection"] = collection
+ results.append(payload)
+ else:
+ conn = _fallback_conn()
+ for collection in collections:
+ rows = conn.execute(
+ "SELECT vector,payload FROM vectors WHERE collection=?", (collection,)
+ ).fetchall()
+ for vec_raw, payload_raw in rows:
+ payload = dict(json.loads(payload_raw))
+ if visibility_filter:
+ if any(payload.get(k) != v for k, v in visibility_filter.items()):
+ continue
+ score = _cosine(vector, json.loads(vec_raw))
+ payload["score"] = score
+ payload["collection"] = collection
+ results.append(payload)
+ results.sort(key=lambda x: x.get("score", 0), reverse=True)
+ return results[:limit]
diff --git a/services/loogle-mcp/app/knowledge/text_chunk.py b/services/loogle-mcp/app/knowledge/text_chunk.py
new file mode 100644
index 0000000..ca40217
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/text_chunk.py
@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+"""Utility condivise per chunking testo RAG."""
+
+import re
+
+CHUNK_SIZE = 900
+CHUNK_OVERLAP = 150
+
+
+def chunk_text(text: str) -> list[str]:
+ text = re.sub(r"\n{3,}", "\n\n", text.strip())
+ if len(text) <= CHUNK_SIZE:
+ return [text] if text else []
+ chunks = []
+ start = 0
+ while start < len(text):
+ end = min(len(text), start + CHUNK_SIZE)
+ chunks.append(text[start:end])
+ if end >= len(text):
+ break
+ start = max(end - CHUNK_OVERLAP, start + 1)
+ return chunks
diff --git a/services/loogle-mcp/app/knowledge/thermal.py b/services/loogle-mcp/app/knowledge/thermal.py
new file mode 100644
index 0000000..3f59144
--- /dev/null
+++ b/services/loogle-mcp/app/knowledge/thermal.py
@@ -0,0 +1,242 @@
+# -*- coding: utf-8 -*-
+"""Thermal / load gate per proteggere il DS920 durante gli embedding Ollama.
+
+Legge temperatura CPU e load average dal NAS e regola pause/keep_alive.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import subprocess
+import time
+from typing import Optional
+
+import httpx
+
+LOGGER = logging.getLogger("loogle_mcp.thermal")
+
+# Soft: rallenta. Hard: pausa (raro se il profilo lento tiene).
+# Profilo "lento ma regolare": anticipare soft, cap load basso.
+DEFAULT_SOFT_C = 58.0
+DEFAULT_HARD_C = 70.0
+DEFAULT_CPU_TARGET_PCT = 40.0 # load1 <= nproc * 0.40
+
+
+def _float_env(name: str, default: float) -> float:
+ try:
+ return float(os.environ.get(name, str(default)))
+ except ValueError:
+ return default
+
+
+def soft_temp_c() -> float:
+ return _float_env("THERMAL_TEMP_SOFT_C", DEFAULT_SOFT_C)
+
+
+def hard_temp_c() -> float:
+ return _float_env("THERMAL_TEMP_HARD_C", DEFAULT_HARD_C)
+
+
+def cpu_target_pct() -> float:
+ return _float_env("THERMAL_CPU_TARGET_PCT", DEFAULT_CPU_TARGET_PCT)
+
+
+def enabled() -> bool:
+ flag = os.environ.get("THERMAL_GATE_ENABLED", "yes").strip().lower()
+ return flag not in ("0", "false", "no", "off")
+
+
+def _read_via_http() -> Optional[dict]:
+ url = os.environ.get("DS920_THERMAL_URL", "").strip()
+ if not url:
+ # default probe se non configurato
+ url = os.environ.get(
+ "DS920_THERMAL_URL_DEFAULT",
+ "http://192.168.128.100:9191/thermal",
+ ).strip()
+ try:
+ with httpx.Client(timeout=3.0) as client:
+ resp = client.get(url)
+ if resp.status_code != 200:
+ return None
+ data = resp.json()
+ if isinstance(data, dict) and "cpu_temp_c" in data:
+ return data
+ except Exception as exc:
+ LOGGER.debug("Thermal HTTP probe fallita: %s", exc)
+ return None
+
+
+def _read_via_ssh() -> Optional[dict]:
+ host = os.environ.get("DS920_SSH_HOST", "192.168.128.100").strip()
+ user = os.environ.get("DS920_SSH_USER", "daniely").strip()
+ key = os.environ.get("DS920_SSH_KEY", "").strip()
+ if not host:
+ return None
+ remote = (
+ "python3 -c \"import json,os;"
+ "b='/sys/class/hwmon/hwmon0';"
+ "t=[int(open(f'{b}/'+n).read())/1000 for n in sorted(os.listdir(b)) "
+ "if n.startswith('temp') and n.endswith('_input')];"
+ "l=os.getloadavg();"
+ "print(json.dumps({'cpu_temp_c':max(t) if t else None,"
+ "'load1':l[0],'load5':l[1],'nproc':os.cpu_count() or 4}))\""
+ )
+ cmd = [
+ "ssh",
+ "-o", "BatchMode=yes",
+ "-o", "ConnectTimeout=5",
+ "-o", "StrictHostKeyChecking=accept-new",
+ ]
+ if key and os.path.isfile(key):
+ cmd.extend(["-i", key])
+ cmd.append(f"{user}@{host}")
+ cmd.append(remote)
+ try:
+ out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, timeout=12, text=True)
+ data = json.loads(out.strip())
+ if isinstance(data, dict) and data.get("cpu_temp_c") is not None:
+ return data
+ except Exception as exc:
+ LOGGER.debug("Thermal SSH probe fallita: %s", exc)
+ return None
+
+
+def read_status() -> Optional[dict]:
+ """Ritorna {cpu_temp_c, load1, load5?, nproc} oppure None se non raggiungibile."""
+ data = _read_via_http()
+ if data:
+ data["source"] = "http"
+ return data
+ data = _read_via_ssh()
+ if data:
+ data["source"] = "ssh"
+ return data
+ return None
+
+
+def load_over_target(status: dict) -> bool:
+ load1 = float(status.get("load1") or 0)
+ nproc = float(status.get("nproc") or 4)
+ target = nproc * (cpu_target_pct() / 100.0)
+ return load1 > target
+
+
+def suggested_keep_alive(status: Optional[dict]) -> int:
+ """Secondi keep_alive Ollama.
+
+ Il container resta sempre acceso: non si fa unload per throttling termico
+ (evita cicli load/unload). Si scarica solo se OLLAMA_UNLOAD_ON_HARD=yes.
+ """
+ cool = int(_float_env("OLLAMA_KEEP_ALIVE_COOL", 300))
+ default = int(_float_env("OLLAMA_KEEP_ALIVE_DEFAULT", 120))
+ if not status or status.get("cpu_temp_c") is None:
+ return default
+ temp = float(status["cpu_temp_c"])
+ unload = os.environ.get("OLLAMA_UNLOAD_ON_HARD", "no").strip().lower()
+ if temp >= hard_temp_c() and unload in ("1", "true", "yes", "on"):
+ return 0
+ return cool
+
+
+def suggested_delay_s(status: Optional[dict]) -> float:
+ """Duty-cycle lento: delay base sempre presente; cresce con temp/load."""
+ base = _float_env("OLLAMA_EMBED_DELAY_S", 8.0)
+ if not status or status.get("cpu_temp_c") is None:
+ return max(base, 5.0)
+ temp = float(status["cpu_temp_c"])
+ hard = hard_temp_c()
+ soft = soft_temp_c()
+ if temp >= hard:
+ return max(base, 45.0)
+ if temp >= soft:
+ # soft→hard: ~base*1.5 … ~35s (continuo, non on/off)
+ ratio = (temp - soft) / max(hard - soft, 1.0)
+ return max(base, base * 1.5 + ratio * 25.0)
+ if load_over_target(status):
+ return max(base, base * 2.0)
+ if temp >= soft - 4:
+ return max(base, base * 1.25)
+ return base
+
+
+def wait_for_headroom(*, context: str = "embed") -> Optional[dict]:
+ """Attende headroom: HARD = pausa lunga; altrimenti delay proporzionale.
+
+ Obiettivo: ritmo lento e regolare, evitando oscillazioni start/stop.
+ """
+ if not enabled():
+ return None
+
+ poll = _float_env("THERMAL_POLL_S", 30.0)
+ hard = hard_temp_c()
+ soft = soft_temp_c()
+ # Riprendi solo quando sotto soft - 2°C (isteresi anti-oscillazione)
+ resume_below = soft - _float_env("THERMAL_RESUME_MARGIN_C", 2.0)
+
+ while True:
+ status = read_status()
+ if status is None:
+ LOGGER.warning("Thermal gate: probe non disponibile — delay conservativo")
+ time.sleep(max(suggested_delay_s(None), 5.0))
+ return None
+
+ temp = float(status.get("cpu_temp_c") or 0)
+ load1 = float(status.get("load1") or 0)
+
+ if temp >= hard:
+ LOGGER.warning(
+ "Thermal gate [%s]: PAUSA HARD temp=%.1f°C (tetto=%.0f°C resume<=%.0f°C "
+ "load1=%.2f) — riprovo tra %.0fs",
+ context,
+ temp,
+ hard,
+ resume_below,
+ load1,
+ poll,
+ )
+ time.sleep(poll)
+ # Isteresi: resta in pausa finché non scende sotto soft
+ while True:
+ cooled = read_status()
+ if cooled is None:
+ time.sleep(poll)
+ continue
+ t2 = float(cooled.get("cpu_temp_c") or 0)
+ if t2 <= resume_below and not load_over_target(cooled):
+ LOGGER.info(
+ "Thermal gate [%s]: ripresa dopo HARD (temp=%.1f°C)",
+ context,
+ t2,
+ )
+ status = cooled
+ break
+ time.sleep(poll)
+ # dopo ripresa applica comunque un delay soft prima dell'embed
+ time.sleep(suggested_delay_s(status))
+ return status
+
+ if temp >= soft or load_over_target(status):
+ delay = suggested_delay_s(status)
+ LOGGER.info(
+ "Thermal gate [%s]: rallento temp=%.1f°C load1=%.2f — delay %.1fs (source=%s)",
+ context,
+ temp,
+ load1,
+ delay,
+ status.get("source"),
+ )
+ time.sleep(delay)
+ again = read_status()
+ if again and float(again.get("cpu_temp_c") or 0) >= hard:
+ status = again
+ continue
+ return again or status
+
+ # Zona fredda: piccolo delay fisso per duty-cycle regolare
+ cool_delay = _float_env("OLLAMA_EMBED_COOL_DELAY_S", 0.0)
+ if cool_delay > 0:
+ time.sleep(cool_delay)
+ return status
\ No newline at end of file
diff --git a/services/loogle-mcp/app/main.py b/services/loogle-mcp/app/main.py
new file mode 100644
index 0000000..40f225d
--- /dev/null
+++ b/services/loogle-mcp/app/main.py
@@ -0,0 +1,368 @@
+# -*- coding: utf-8 -*-
+"""Loogle MCP Hub — gateway FastAPI + OAuth + MCP Streamable HTTP."""
+
+import json
+import logging
+import os
+import secrets
+from typing import Optional
+
+from fastapi import Depends, FastAPI, Form, HTTPException, Request, Response
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+from pydantic import BaseModel
+
+from . import audit, auth, jwt_utils, oauth
+from .db import get_conn, init_db
+from .mcp import server as mcp_server
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s %(message)s")
+LOGGER = logging.getLogger("loogle_mcp.main")
+
+app = FastAPI(title="Loogle MCP Hub", docs_url=None, redoc_url=None)
+app.add_middleware(
+ CORSMiddleware,
+ allow_origins=[
+ "https://claude.ai",
+ "https://chatgpt.com",
+ "https://chat.openai.com",
+ ],
+ allow_methods=["GET", "POST", "OPTIONS"],
+ allow_headers=["*"],
+)
+STATIC_DIR = os.path.join(os.path.dirname(__file__), "static")
+
+
+@app.on_event("startup")
+def on_startup() -> None:
+ init_db()
+ auth.ensure_sessions_table()
+ auth.ensure_family_users()
+ oauth.ensure_default_client()
+ if not os.environ.get("MCP_JWT_SECRET", "").strip():
+ secret = secrets.token_urlsafe(48)
+ os.environ["MCP_JWT_SECRET"] = secret
+ LOGGER.warning("MCP_JWT_SECRET generato — salvalo in .env: %s", secret)
+
+
+# ------------------------------------------------------------------ Health
+
+@app.get("/health")
+def health():
+ return {"ok": True, "service": "loogle-mcp", "port": int(os.environ.get("MCP_PORT", "8700"))}
+
+
+# ------------------------------------------------------------------ OAuth metadata
+
+@app.get("/.well-known/oauth-authorization-server")
+def oauth_metadata():
+ return oauth.authorization_server_metadata()
+
+
+@app.get("/.well-known/oauth-protected-resource")
+def protected_resource():
+ return oauth.protected_resource_metadata()
+
+
+@app.get("/.well-known/oauth-protected-resource/mcp")
+def protected_resource_mcp():
+ return oauth.protected_resource_metadata()
+
+
+@app.get("/.well-known/openid-configuration")
+def openid_configuration():
+ """Fallback discovery usato da Claude se oauth-authorization-server non basta."""
+ return oauth.authorization_server_metadata()
+
+
+# ------------------------------------------------------------------ OAuth endpoints
+
+class RegisterBody(BaseModel):
+ client_name: str
+ redirect_uris: list[str]
+
+
+@app.post("/oauth/register")
+def oauth_register(body: RegisterBody):
+ try:
+ return oauth.register_client(body.client_name, body.redirect_uris)
+ except HTTPException as exc:
+ return JSONResponse(
+ status_code=exc.status_code,
+ content={"error": "invalid_client_metadata", "error_description": str(exc.detail)},
+ )
+
+
+# Alias root-level OAuth (Claude/ChatGPT fallback se la discovery RFC 8414 fallisce)
+@app.post("/register")
+def oauth_register_root(body: RegisterBody):
+ return oauth_register(body)
+
+
+@app.get("/oauth/authorize")
+def oauth_authorize_get(
+ response_type: str,
+ client_id: str,
+ redirect_uri: str,
+ scope: str = "context:read context:write knowledge:read knowledge:write gitea:read gitea:write",
+ state: str = "",
+ code_challenge: Optional[str] = None,
+ code_challenge_method: Optional[str] = None,
+):
+ if response_type != "code":
+ raise HTTPException(400, "response_type must be code")
+ html = _login_form(client_id, redirect_uri, scope, state, code_challenge, code_challenge_method)
+ return HTMLResponse(html)
+
+
+@app.post("/oauth/authorize")
+def oauth_authorize_post(
+ request: Request,
+ client_id: str = Form(...),
+ redirect_uri: str = Form(...),
+ scope: str = Form("context:read context:write knowledge:read knowledge:write gitea:read gitea:write"),
+ state: str = Form(""),
+ code_challenge: Optional[str] = Form(None),
+ code_challenge_method: Optional[str] = Form(None),
+ username: str = Form(...),
+ password: str = Form(...),
+):
+ ip = request.client.host if request.client else "?"
+ auth.throttle(ip)
+ user = auth.authenticate(username, password)
+ if not user:
+ auth.record_attempt(ip)
+ html = _login_form(
+ client_id, redirect_uri, scope, state, code_challenge, code_challenge_method,
+ error="Credenziali non valide",
+ )
+ return HTMLResponse(html, status_code=401)
+ url = oauth.build_authorize_redirect(
+ client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, user["id"]
+ )
+ return RedirectResponse(url, status_code=302)
+
+
+@app.get("/authorize")
+def oauth_authorize_get_root(
+ response_type: str,
+ client_id: str,
+ redirect_uri: str,
+ scope: str = "context:read context:write knowledge:read knowledge:write gitea:read gitea:write",
+ state: str = "",
+ code_challenge: Optional[str] = None,
+ code_challenge_method: Optional[str] = None,
+):
+ return oauth_authorize_get(
+ response_type, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method
+ )
+
+
+@app.post("/authorize")
+def oauth_authorize_post_root(
+ request: Request,
+ client_id: str = Form(...),
+ redirect_uri: str = Form(...),
+ scope: str = Form("context:read context:write knowledge:read knowledge:write gitea:read gitea:write"),
+ state: str = Form(""),
+ code_challenge: Optional[str] = Form(None),
+ code_challenge_method: Optional[str] = Form(None),
+ username: str = Form(...),
+ password: str = Form(...),
+):
+ return oauth_authorize_post(
+ request, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, username, password
+ )
+
+
+@app.post("/oauth/token")
+async def oauth_token(request: Request):
+ content_type = request.headers.get("content-type", "")
+ if "application/json" in content_type:
+ body = await request.json()
+ else:
+ form = await request.form()
+ body = dict(form)
+ grant_type = body.get("grant_type")
+ client_id = body.get("client_id") or os.environ.get("MCP_OAUTH_CLIENT_ID", "loogle-mcp-public")
+ if grant_type == "authorization_code":
+ return oauth.exchange_code(
+ body.get("code", ""),
+ client_id,
+ body.get("redirect_uri", ""),
+ body.get("code_verifier"),
+ )
+ if grant_type == "refresh_token":
+ return oauth.refresh_access_token(body.get("refresh_token", ""), client_id)
+ raise HTTPException(400, "grant_type non supportato")
+
+
+@app.post("/token")
+async def oauth_token_root(request: Request):
+ return await oauth_token(request)
+
+
+# ------------------------------------------------------------------ MCP endpoint
+
+@app.post("/mcp")
+async def mcp_post(request: Request):
+ auth_header = request.headers.get("authorization", "")
+ claims = oauth.bearer_claims_from_header(auth_header)
+ try:
+ payload = await request.json()
+ except Exception:
+ raise HTTPException(400, "JSON non valido")
+ if isinstance(payload, list):
+ responses = mcp_server.handle_batch(payload, claims)
+ return JSONResponse(responses)
+ response = mcp_server.handle_message(payload, claims)
+ if not claims and payload.get("method") not in ("initialize", "notifications/initialized", "ping"):
+ return JSONResponse(response, status_code=401, headers=_auth_challenge_headers())
+ return JSONResponse(response)
+
+
+@app.get("/mcp")
+def mcp_get():
+ return JSONResponse(
+ {"error": "Use POST for MCP JSON-RPC"},
+ status_code=405,
+ headers=_auth_challenge_headers(),
+ )
+
+
+def _auth_challenge_headers() -> dict:
+ base = jwt_utils.base_url()
+ resource_metadata = f"{base}/.well-known/oauth-protected-resource/mcp"
+ return {
+ "WWW-Authenticate": f'Bearer realm="mcp", resource_metadata="{resource_metadata}"',
+ }
+
+
+# ------------------------------------------------------------------ Dashboard web
+
+class LoginBody(BaseModel):
+ username: str
+ password: str
+
+
+class PasswordBody(BaseModel):
+ old_password: str
+ new_password: str
+
+
+class RevokeBody(BaseModel):
+ refresh_token: str
+
+
+@app.post("/api/login")
+def api_login(body: LoginBody, request: Request, response: Response):
+ ip = request.client.host if request.client else "?"
+ auth.throttle(ip)
+ user = auth.authenticate(body.username.strip(), body.password)
+ if not user:
+ auth.record_attempt(ip)
+ raise HTTPException(401, "Credenziali non valide")
+ import datetime
+ token = secrets.token_urlsafe(32)
+ expires = (
+ datetime.datetime.utcnow() + datetime.timedelta(days=auth.SESSION_DAYS)
+ ).strftime("%Y-%m-%d %H:%M:%S")
+ get_conn().execute(
+ "INSERT INTO sessions(token,user_id,expires_at) VALUES (?,?,?)",
+ (token, user["id"], expires),
+ )
+ get_conn().commit()
+ response.set_cookie("mcp_session", token, max_age=auth.SESSION_DAYS * 86400, httponly=True, samesite="lax", path="/")
+ return {"ok": True, "user": {"username": user["username"], "is_admin": user["is_admin"]}}
+
+
+@app.post("/api/logout")
+def api_logout(request: Request, response: Response):
+ token = request.cookies.get("mcp_session", "")
+ if token:
+ get_conn().execute("DELETE FROM sessions WHERE token=?", (token,))
+ get_conn().commit()
+ response.delete_cookie("mcp_session", path="/")
+ return {"ok": True}
+
+
+@app.get("/api/me")
+def api_me(user=Depends(auth.current_user_from_cookie)):
+ return user
+
+
+@app.post("/api/password")
+def api_password(body: PasswordBody, user=Depends(auth.current_user_from_cookie)):
+ if len(body.new_password.strip()) < 6:
+ raise HTTPException(400, "La nuova password deve avere almeno 6 caratteri")
+ if not auth.change_password(user["id"], body.old_password, body.new_password):
+ raise HTTPException(400, "Password attuale errata")
+ return {"ok": True}
+
+
+@app.get("/api/projects")
+def api_projects(user=Depends(auth.current_user_from_cookie)):
+ from .context import store as context_store
+ return context_store.list_projects(user["username"])
+
+
+@app.get("/api/audit")
+def api_audit(limit: int = 100, user=Depends(auth.current_user_from_cookie)):
+ if user["is_admin"]:
+ return audit.list_audit(limit=min(limit, 500))
+ return audit.list_audit(limit=min(limit, 200), username=user["username"])
+
+
+@app.post("/api/admin/revoke-refresh")
+def api_revoke_refresh(body: RevokeBody, _=Depends(auth.require_admin)):
+ jwt_utils.revoke_refresh_token(body.refresh_token)
+ return {"ok": True}
+
+
+@app.get("/dashboard")
+def dashboard_page():
+ path = os.path.join(STATIC_DIR, "dashboard.html")
+ return HTMLResponse(open(path, encoding="utf-8").read())
+
+
+@app.get("/")
+def root():
+ return RedirectResponse("/dashboard")
+
+
+def _login_form(
+ client_id: str,
+ redirect_uri: str,
+ scope: str,
+ state: str,
+ code_challenge: Optional[str],
+ code_challenge_method: Optional[str],
+ error: str = "",
+) -> str:
+ err = f'{error}
' if error else ""
+ return f"""
+
+Loogle MCP — Login
+
+Loogle MCP Hub
+Accedi con le credenziali famiglia per collegare Claude, ChatGPT o Gemini.
+{err}
+
+
Primo accesso: password = username (es. lucia/lucia). Cambiala dal dashboard.
+
Loogle MCP Hub
+ Archivio contesto e knowledge base locale per AI famiglia
+
+
+
Accedi
+
+
+
+
+
+
+
+
+
+
+
MCP URL: https://mcp.loogle.it/mcp
+
+
+
+
Cambia password
+
+
+
+
+
+
+
+
Admin — revoca refresh token
+
+
+
+
+
+
+
+
+
+
+
Collegamenti AI
+
+ - ChatGPT: Impostazioni → Developer → Add MCP Connector → URL sopra
+ - Claude: Settings → Connectors → Add remote MCP server
+ - Gemini CLI: configura server remoto in settings MCP
+
+
+