Summary by CodeRabbit

• New Features

  • Added Redis Sentinel mode support for improved connection resilience
  • Added SSL support for Redis connections
  • Tool version updates: classifier (0.0.77), text extractor (0.0.73), structure tool (0.0.98)

• Bug Fixes

  • Enhanced Redis client initialization and error handling for better reliability

Walkthrough

This pull request adds Redis Sentinel support through new environment variables and refactors Redis client initialization to use a factory pattern. It bumps versions for classifier (0.0.76→0.0.77), structure (0.0.97→0.0.98), and text_extractor (0.0.72→0.0.73) tools. It also introduces the core package as an editable dependency across tools and SDK components.

Changes

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Test Results

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Not waiting for approvals on this PR since its a trivial version bump and due to urgency

Greptile Summary

This PR does two things under one patch-version bump: (1) it increments the versions of three tool containers (classifier, structure, text_extractor) to force image rebuilds with an updated unstract-core dependency, and (2) it ships the actual unstract-core changes that add Redis Sentinel support — a create_redis_client() factory, SSL support, and a refactored RedisClient wrapper — and propagates the two new env vars (REDIS_SENTINEL_MODE, REDIS_SENTINEL_MASTER_NAME) through every layer that spawns tool containers (runner, workflow-execution) and worker cache managers.

Key changes:

• unstract/core/…/redis_client.py: New create_redis_client() factory handles both Sentinel and standalone modes transparently; RedisClient.__init__ is removed — the class is now only constructible via from_env() or .__new__(); SSL support added to _resolve_redis_env and _build_connection_kwargs.
• unstract/sdk1/…/metrics_mixin.py: Replaces hard-wired StrictRedis(host="unstract-redis", …) with create_redis_client(db=1), gaining Sentinel awareness; Redis operations wrapped in try/except for resilience.
• workers/shared/…/cache_backends.py + cache_utils.py: Conditional standalone/Sentinel branching removed in favour of the unified factory.
• runner/runner.py, workflow_execution/tools_utils.py, runner/constants.py, workflow_execution/constants.py: New Sentinel env var constants added and forwarded to tool/sidecar containers.
• tools/*/properties.json + public_tools.json + backend/sample.env: Version bumps and registry entries updated.

Issue found: In _build_connection_kwargs, the include_auth_only branch (used to build sentinel_kwargs) returns early before the SSL block, so TLS settings are never forwarded to the Sentinel management connections. Combined SSL + Sentinel mode will fail at the Sentinel layer even though the master Redis connection would use TLS correctly.

Confidence Score: 3/5

• Safe to merge for standalone Redis and non-SSL Sentinel deployments; SSL + Sentinel combined mode has a logic bug that will cause connection failures.
• The tool version bumps, env-var propagation, and worker cache simplifications are all correct. The Sentinel-only (no SSL) path works as intended. However, _build_connection_kwargs never forwards SSL settings into sentinel_kwargs, meaning any deployment that enables both Sentinel mode and TLS will encounter Sentinel management-channel connection failures. This is a latent bug introduced alongside the new SSL feature in the same file. The rest of the changes are low-risk refactors with no functional regressions for the current (non-SSL) Sentinel use case.
• unstract/core/src/unstract/core/cache/redis_client.py — specifically the _build_connection_kwargs function's include_auth_only branch and its interaction with the new SSL fields.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Runner as Runner / ToolsUtils
    participant Factory as create_redis_client()
    participant Env as Environment Variables
    participant Sentinel as Redis Sentinel
    participant Master as Redis Master

    Runner->>Env: read REDIS_SENTINEL_MODE, REDIS_SENTINEL_MASTER_NAME
    Runner->>Runner: inject into tool/sidecar container env
    note over Runner: New in this PR ↑

    Runner->>Factory: create_redis_client(env_prefix, db, ...)
    Factory->>Env: _resolve_redis_env() → host, port, password, ssl
    alt SENTINEL_MODE == true
        Factory->>Sentinel: Sentinel([(host, port)], sentinel_kwargs)
        note over Factory,Sentinel: ⚠️ ssl missing from sentinel_kwargs
        Sentinel-->>Factory: SentinelConnectionPool
        Factory->>Master: sentinel.master_for(master_name, **master_kwargs)
        Master-->>Factory: redis.Redis (Sentinel-backed)
    else standalone
        Factory->>Master: redis.Redis(host, port, **kwargs)
        Master-->>Factory: redis.Redis (direct)
    end
    Factory-->>Runner: redis.Redis client

    note over Runner: MetricsMixin also calls create_redis_client(db=1)

This is a comment left during a code review.
Path: unstract/core/src/unstract/core/cache/redis_client.py
Line: 33

Comment:
**Module-level env var captured at import time**

`_DEFAULT_SENTINEL_MASTER_NAME` reads `REDIS_SENTINEL_MASTER_NAME` at module import time rather than at each call site. In most deployments this is harmless since env vars are stable, but it means any override of `REDIS_SENTINEL_MASTER_NAME` made after the module is first imported (e.g., in tests that manipulate `os.environ`) will be silently ignored. Prefer reading it lazily inside `_create_sentinel_client` to avoid subtle test-isolation bugs:

```python
# Remove module-level constant:
# _DEFAULT_SENTINEL_MASTER_NAME = os.getenv("REDIS_SENTINEL_MASTER_NAME", "mymaster")

def _create_sentinel_client(...):
    master_name = os.getenv(
        f"{env_prefix}SENTINEL_MASTER_NAME",
        os.getenv("REDIS_SENTINEL_MASTER_NAME", "mymaster"),
    )
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: unstract/sdk1/src/unstract/sdk1/utils/metrics_mixin.py
Line: 50-51

Comment:
**Silent failure loses observability**

The previous code logged an `error`-level message when `redis_client is None` so operators could distinguish "Redis never initialised" from a key-not-found case. The log was removed in this PR, meaning repeated `collect_metrics` calls after a failed init will return `None` with no trace in the logs beyond the single init-time error. Consider at least emitting a `debug` log here to keep the signal without being noisy:

```python
if self.redis_client is None:
    logger.debug("Redis client unavailable; skipping metrics collection.")
    return {self.TIME_TAKEN_KEY: None}
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: unstract/core/src/unstract/core/cache/redis_client.py
Line: 137-146

Comment:
**SSL not forwarded to Sentinel management connections**

In the `include_auth_only` branch, the early-return on line 146 exits before the SSL block at the bottom of the function. The resulting `sentinel_kwargs` therefore never carry `ssl` or `ssl_cert_reqs`, even when the `env` dict has `ssl=True` set by `_resolve_redis_env`.

These kwargs are passed directly to the `Sentinel()` constructor and govern connections to the Sentinel nodes themselves (quorum queries, failover detection, etc.). If SSL is enabled, those management-channel connections will attempt a plain-text socket while the service expects TLS, causing a connection failure at the Sentinel layer even though the master Redis connection would use SSL correctly via `master_kwargs`.

The fix is to carry SSL settings through in that branch too:

```python
if include_auth_only:
    kwargs: dict[str, Any] = {
        "socket_connect_timeout": socket_connect_timeout,
        "socket_timeout": socket_timeout,
    }
    if env.get("password"):
        kwargs["password"] = env["password"]
    if env.get("username"):
        kwargs["username"] = env["username"]
    if env.get("ssl"):
        kwargs["ssl"] = True
        kwargs["ssl_cert_reqs"] = env.get("ssl_cert_reqs", "required")
    return kwargs
```

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 8fa6f89}