Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 65 additions & 0 deletions configs/samo_api_config.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
# SAMO API Configuration
# This file configures the unified API server for SAMO-DL

api:
host: "0.0.0.0"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Security concern: Binding to all interfaces

The API is configured to bind to 0.0.0.0, which exposes it to all network interfaces. This could be a security risk if not properly firewalled.

Consider using 127.0.0.1 for local development and only use 0.0.0.0 in production with proper security measures:

-  host: "0.0.0.0"
+  host: "127.0.0.1"  # Use 0.0.0.0 only in production with proper firewall
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
host: "0.0.0.0"
host: "127.0.0.1" # Use 0.0.0.0 only in production with proper firewall
🤖 Prompt for AI Agents
In configs/samo_api_config.yaml around line 5, the host is set to "0.0.0.0"
which exposes the API on all interfaces; change this for development to
"127.0.0.1" and make host configurable via an environment variable or separate
prod config so production can use "0.0.0.0" only when behind proper
firewalls/load balancers; update deployment/docs to ensure the env/config value
is set appropriately and add a comment in the file warning about using 0.0.0.0
only in secured production environments.

port: 8080
debug: false # Never enable in production
version: "1.0.0"
docs_enabled: true # Enable Swagger docs in dev

security:
api_key_required: true
rate_limit:
requests_per_minute: 100
burst_size: 10
cors:
allowed_origins: ["*"] # Restrict to specific domains in production

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using "*" for allowed_origins is a security risk as it allows any website to make requests to your API. While the comment mentions restricting this in production, it's better to use a more specific origin even for development (e.g., http://localhost:3000) to prevent potential Cross-Site Request Forgery (CSRF) attacks.

    allowed_origins: ["http://localhost:3000", "http://127.0.0.1:3000"]  # Restrict to specific domains in production

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

CORS security risk in default configuration

The CORS configuration allows all origins (["*"]) by default, which could expose the API to cross-origin attacks. The comment mentions restricting in production, but it's safer to be restrictive by default.

-    allowed_origins: ["*"]  # Restrict to specific domains in production
+    allowed_origins: ["http://localhost:3000"]  # Add specific domains as needed
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
allowed_origins: ["*"] # Restrict to specific domains in production
allowed_origins: ["http://localhost:3000"] # Add specific domains as needed
🤖 Prompt for AI Agents
In configs/samo_api_config.yaml around line 17, the CORS setting currently
allows all origins (allowed_origins: ["*"]) which is insecure by default; change
this to a restrictive default such as an explicit whitelist of trusted domains
(e.g., your dev/staging/production hostnames) or an empty list, and document
that environments should override this value via environment-specific config or
secrets management; ensure any deployment process injects the appropriate domain
list for production rather than relying on "*".

allowed_methods: ["GET", "POST", "OPTIONS"]
allowed_headers: ["Content-Type", "Authorization", "X-API-Key", "X-Requested-With"]

models:
emotion:
provider: "hf" # Hugging Face
model_name: "j-hartmann/emotion-english-distilroberta-base"
local_only: false # Use local if true, fallback to HF Hub
model_dir: "/app/models/emotion"
batch_size: 32
whisper:
provider: "openai" # OpenAI Whisper
model_name: "openai/whisper-base"
local_only: false
model_dir: "/app/models/whisper"
max_audio_duration: 30 # seconds
t5:
provider: "hf" # Hugging Face T5
model_name: "t5-small"
local_only: false
model_dir: "/app/models/t5"
max_input_length: 512
max_output_length: 128

logging:
level: "INFO" # DEBUG for development
format: "json" # json or human-readable
include_request_id: true

server:
workers: 4 # Gunicorn workers
timeout: 120 # Request timeout in seconds

# Environment-specific overrides
environments:
development:
api:
debug: true
docs_enabled: true
security:
api_key_required: false # Disable in dev for easier testing
production:
api:
debug: false
docs_enabled: false
security:
cors:
allowed_origins: ["https://yourdomain.com"]
186 changes: 186 additions & 0 deletions configs/samo_emotion_detection_config.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,186 @@
# SAMO-DL Emotion Detection Configuration
# Optimized parameters for journal entry emotion analysis

# Model Configuration
model:
name: "bert-base-uncased" # Robust BERT model for emotion understanding
device: null # Auto-detect (CPU/GPU)

# Emotion Detection Parameters
emotion_detection:
# Number of emotion categories (27 GoEmotions + neutral)
num_emotions: 28

# Prediction threshold for binary classification
prediction_threshold: 0.6 # Updated from 0.5 for better calibration

# Temperature scaling for calibrated predictions
temperature: 1.0

# Top-k emotions to return per prediction
top_k: 5

# Model Architecture
architecture:
# BERT configuration
hidden_dropout_prob: 0.3 # Dropout for BERT hidden layers
attention_probs_dropout_prob: 0.3 # Dropout for attention layers

# Classification head configuration
classifier_dropout_prob: 0.5 # Dropout for classification layers

# Freezing strategy
freeze_bert_layers: 6 # Number of BERT layers to freeze initially

# Class balancing
use_class_weights: true # Enable class weight balancing

# Training Configuration
training:
# Batch sizes
train_batch_size: 16
eval_batch_size: 32

# Learning rates
bert_learning_rate: 2e-5 # Lower LR for BERT (fine-tuning)
classifier_learning_rate: 5e-4 # Higher LR for classification head

# Training epochs
num_epochs: 10
warmup_steps: 100

# Gradient settings
max_grad_norm: 1.0
gradient_accumulation_steps: 1

# Early stopping
early_stopping_patience: 3
early_stopping_threshold: 0.01

# Data Processing
data:
# Text processing
max_length: 512 # Maximum sequence length
truncation: true
padding: "max_length"

# Data augmentation
enable_augmentation: false # Disable for now, can be enabled later

# Validation split
validation_split: 0.2
test_split: 0.1

# Evaluation Configuration
evaluation:
# Metrics to compute
metrics:
- "precision"
- "recall"
- "f1_micro"
- "f1_macro"
- "accuracy"

# Evaluation threshold (lowered to capture more predictions)
threshold: 0.2

# Top-k evaluation
top_k_evaluation: true
top_k_values: [1, 3, 5]

# Logging and Monitoring
logging:
level: "INFO"
log_interval: 100 # Log every N steps
save_interval: 1000 # Save checkpoint every N steps

# TensorBoard logging
enable_tensorboard: true
log_dir: "logs/emotion_detection"

# Model Saving
model_saving:
# Save directory
save_dir: "models/emotion_detection"

# Save best model based on metric
save_best_metric: "f1_macro"

# Save checkpoints
save_checkpoints: true
checkpoint_interval: 1 # Save every N epochs

# Performance Optimization
performance:
# Mixed precision training
use_amp: true # Automatic Mixed Precision

# Data loading
num_workers: 4
pin_memory: true

# Memory optimization
gradient_checkpointing: false # Can be enabled for memory savings

# Inference optimization
use_torchscript: false # Can be enabled for faster inference

# SAMO-Specific Optimizations
samo_optimizations:
# Journal entry specific settings
journal_entry_mode: true

# Emotional context awareness
context_awareness: true

# Multi-label prediction
multi_label_mode: true

# Confidence calibration
calibration_enabled: true

# Emotion intensity scaling
intensity_scaling: true

# Error Handling
error_handling:
# Retry settings
max_retries: 3
retry_delay: 1.0

# Fallback behavior
fallback_to_cpu: true
graceful_degradation: true

# Logging errors
log_errors: true
error_log_file: "logs/emotion_detection_errors.log"

# Security and Privacy
security:
# Input sanitization
sanitize_input: true

# Output filtering
filter_sensitive_emotions: false # Can be enabled for privacy

# Rate limiting
rate_limit_requests: 1000 # Requests per minute

# Data privacy
anonymize_predictions: false # Can be enabled for privacy

# Development and Debugging
development:
# Debug mode
debug_mode: false

# Verbose logging
verbose: false

# Test mode
test_mode: false

# Profiling
enable_profiling: false
profile_steps: 100
90 changes: 46 additions & 44 deletions dependencies/requirements-api.txt
Original file line number Diff line number Diff line change
@@ -1,44 +1,46 @@
############################################
# API/Runtime Dependencies #
# Exact mirror of pyproject.toml base+prod #
############################################

# Base Dependencies (from dependencies)
fastapi==0.116.1
uvicorn[standard]==0.35.0
python-multipart==0.0.18
pydantic==2.11.7
PyJWT==2.8.0

# Database & Storage
sqlalchemy==2.0.36
psycopg2-binary==2.9.10
pgvector==0.3.6
redis==5.0.8

# Utilities
python-dotenv==1.0.1
pyyaml==6.0.2
requests==2.32.4
certifi==2024.12.14
click==8.1.8
rich==13.9.4
loguru==0.7.2

# Production Dependencies (from prod extra)
gunicorn>=23.0.0,<24.0.0
prometheus-client==0.20.0
sentry-sdk[fastapi]==2.12.0

# API runtime dependencies
Flask==3.0.3
flask-restx==1.3.0

# HF model utilities
huggingface_hub>=0.34.0,<1.0

# NLP model runtime
transformers==4.55.0
# Torch runtime (CPU by default; align with repo constraints)
torch==2.8.0

# SAMO Unified API Server Requirements
# Dependencies for running the unified API server with all models

# Core FastAPI and web framework
fastapi==0.104.1
uvicorn[standard]==0.24.0
pydantic==2.5.0

# Machine Learning and Transformers
torch>=2.0.0
transformers>=4.35.0
datasets>=2.15.0
accelerate>=0.24.0
Comment on lines +10 to +13

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Consider pinning ML dependencies for production stability

Using flexible version constraints (>=) for critical ML libraries can lead to unexpected behavior when new versions are released. For production deployments, consider pinning exact versions or using more restrictive ranges.

Apply this diff for better version control:

-torch>=2.0.0
-transformers>=4.35.0
-datasets>=2.15.0
-accelerate>=0.24.0
+torch>=2.0.0,<3.0.0
+transformers>=4.35.0,<5.0.0
+datasets>=2.15.0,<3.0.0
+accelerate>=0.24.0,<1.0.0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
torch>=2.0.0
transformers>=4.35.0
datasets>=2.15.0
accelerate>=0.24.0
--- dependencies/requirements-api.txt
@@ Lines 10-13
-torch>=2.0.0
-transformers>=4.35.0
-datasets>=2.15.0
torch>=2.0.0,<3.0.0
transformers>=4.35.0,<5.0.0
datasets>=2.15.0,<3.0.0
accelerate>=0.24.0,<1.0.0
🤖 Prompt for AI Agents
In dependencies/requirements-api.txt around lines 10 to 13, the ML dependencies
use open-ended >= version specifiers which risks surprising upgrades in
production; replace these with pinned, tested versions (or narrow ranges with
both minimum and maximum bounds) for torch, transformers, datasets, and
accelerate in this file so CI/builds/installations use deterministic, validated
releases.


# Audio processing for Whisper
openai-whisper>=20231117
pydub>=0.25.1
librosa>=0.10.0

# Scientific computing
numpy>=1.24.0
scipy>=1.11.0

# Data processing and ML
scikit-learn>=1.3.0
pandas>=2.1.0

# Configuration and utilities
pyyaml>=6.0
python-multipart>=0.0.6

# Development and testing
pytest>=7.4.0
pytest-asyncio>=0.21.0
httpx>=0.25.0
pytest-mock>=3.12.0

# Logging and monitoring
structlog>=23.2.0

# Optional: GPU support (uncomment if needed)
# torch-audio>=2.0.0 # For better audio processing on GPU

# Optional: Model optimization
# onnxruntime>=1.16.0 # For ONNX model inference
# optimum>=1.14.0 # For optimized transformers
Comment on lines +5 to +46

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The dependencies in this file use >= which allows for installing newer versions of packages. This can lead to non-reproducible builds and potential breaking changes if a dependency releases a new version. It is a best practice to pin dependency versions using == for production environments to ensure consistency and stability. The other requirements-api.txt file at the root level does this correctly.

44 changes: 44 additions & 0 deletions requirements-api.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
# API Dependencies for SAMO-DL Unified API Server
# This file contains all production dependencies for the API server

# Core Framework
Flask==3.0.3
Flask-RESTX==1.3.0
Comment on lines +5 to +6

Copilot AI Sep 10, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The requirements file includes Flask dependencies, but the main unified API server uses FastAPI. This creates confusion about which framework is actually used and may lead to unnecessary dependencies.

Suggested change
Flask==3.0.3
Flask-RESTX==1.3.0

Copilot uses AI. Check for mistakes.
Comment on lines +5 to +6

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Framework version mismatch with dependencies folder

There's an inconsistency between the Flask version specified here (3.0.3) and the FastAPI framework used in dependencies/requirements-api.txt. Since the PR introduces a unified API server primarily using FastAPI, consider aligning these dependencies or clarifying the intended usage of both frameworks.

🤖 Prompt for AI Agents
In requirements-api.txt around lines 5-6, the file pins Flask==3.0.3 while the
project/PR is standardizing on FastAPI; remove this mismatch by deciding which
framework is intended and aligning dependencies accordingly: if FastAPI is the
chosen server, remove Flask from requirements-api.txt (or move it to a separate
optional/dev requirements file with a comment explaining why both are needed),
add the correct FastAPI package/version to this file if missing, and update any
dependency lists in the dependencies/ folder and CI/install scripts to reference
the unified requirements so installs/tests reflect the intended framework.


# Security and Authentication
python-dotenv==1.0.1
Werkzeug==3.0.4

# JSON and Data Handling
requests==2.32.3
pydantic==2.9.2

# Logging and Monitoring
structlog==24.4.0

# Model Integration (for inference)
torch==2.4.1
transformers==4.45.2
accelerate==1.0.1
Comment on lines +20 to +22

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

PyTorch version should be pinned for reproducibility

The torch version is pinned here (2.4.1) but uses a flexible constraint (>=2.0.0) in dependencies/requirements-api.txt. For production deployments, consider using the same pinned version across both files to ensure reproducibility.

Apply this diff to align versions:

-torch==2.4.1
+torch>=2.0.0  # Or pin both to 2.4.1
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
torch==2.4.1
transformers==4.45.2
accelerate==1.0.1
++ b/requirements-api.txt
@@ Lines 20-22
torch>=2.0.0 # Or pin both to 2.4.1 for strict reproducibility
transformers==4.45.2
accelerate==1.0.1
🤖 Prompt for AI Agents
In requirements-api.txt around lines 20 to 22, the file pins torch to 2.4.1 but
a different file (dependencies/requirements-api.txt) uses a flexible constraint
(>=2.0.0); update the dependency declaration in
dependencies/requirements-api.txt to match and pin torch to torch==2.4.1 so both
files use the identical exact version, ensuring consistent reproducible installs
across environments.


# Audio/Video Processing (for Whisper)
ffmpeg-python==0.2.0
librosa==0.10.2

# Environment and Config
PyYAML==6.0.2

# Utilities
numpy==1.26.4
pandas==2.2.3

# Security Headers and Middleware
# No additional deps needed beyond Flask

# Development and Testing (not for production)
# These are excluded from production builds
# pytest==8.3.3
# pytest-cov==5.0.1

# Pin versions to ensure reproducibility
# Updated for compatibility with Python 3.12
Loading
Loading