add files

Dockerfile

@@ -43,7 +43,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     r-cran-remotes \
     && rm -rf /var/lib/apt/lists/*
 
-ARG DOCKERFILE_REV=2026-03-04-r2u24-cxxabi-fix-1
+ARG DOCKERFILE_REV=2026-03-10-openssl-hotfix-1
+ARG ASA_CONDA_PYTHON_VERSION=3.12.3
+ARG ASA_CONDA_OPENSSL_VERSION=3.0.13
 
 RUN echo "asa-api docker revision: ${DOCKERFILE_REV}"; \
     set -eux; \
@@ -68,8 +70,10 @@ ARG ASA_SOFTWARE_REF=main
 
 RUN git clone --depth 1 --branch "${ASA_SOFTWARE_REF}" "${ASA_SOFTWARE_REPO}" /opt/asa-software \
     && R -q -e "remotes::install_local('/opt/asa-software/asa', dependencies = TRUE, upgrade = 'never')" \
-    && R -q -e "asa::build_backend(conda_env='asa_env', python_version='3.12', check_browser=FALSE, fix_browser=FALSE)" \
-    && R -q -e "reticulate::use_condaenv('asa_env', required = TRUE); cfg <- reticulate::py_config(); cat('reticulate py_config python:', cfg[['python']], '\n'); reticulate::py_run_string('import sys; print(sys.version)')" \
+    && /opt/conda/bin/conda create -n asa_env "python=${ASA_CONDA_PYTHON_VERSION}" "openssl=${ASA_CONDA_OPENSSL_VERSION}" pip setuptools \
+    && R -q -e "asa::build_backend(conda_env='asa_env', python_version='3.12', force=FALSE, check_browser=FALSE, fix_browser=FALSE)" \
+    && /opt/conda/bin/conda run -n asa_env python -c "import ssl, sys; print(sys.version); print(ssl.OPENSSL_VERSION)" \
+    && R -q -e "reticulate::use_condaenv('asa_env', required = TRUE); cfg <- reticulate::py_config(); cat('reticulate py_config python:', cfg[['python']], '\n'); reticulate::py_run_string('import ssl, sys; print(sys.version); print(ssl.OPENSSL_VERSION)')" \
     && R -q -e "gate <- c('asa','plumber','jsonlite','reticulate'); missing <- gate[!vapply(gate, function(p) requireNamespace(p, quietly = TRUE), logical(1))]; if (length(missing)) stop(sprintf('Post-asa gate failed; missing: %s', paste(missing, collapse = ', ')), call. = FALSE); cat('Post-asa package gate passed\n')" \
     && rm -rf /opt/asa-software/.git
 

R/asa_api_helpers.R

@@ -651,22 +651,36 @@ asa_api_run_batch <- function(payload) {
 asa_api_health_payload <- function(boot_error = NULL) {
   asa_installed <- requireNamespace("asa", quietly = TRUE)
   direct_provider_available <- asa_installed && isTRUE(asa_api_has_run_direct_task())
+  direct_provider_note <- NULL
+  if (!asa_installed) {
+    direct_provider_note <- "Direct provider mode unavailable: package `asa` is not installed."
+  } else if (!direct_provider_available) {
+    direct_provider_note <- "Direct provider mode unavailable: installed `asa` does not provide `run_direct_task`."
+  }
   has_boot_error <- is.character(boot_error) && nzchar(trimws(boot_error))
   tor_health <- asa_api_tor_health()
   healthy <- asa_installed && !has_boot_error && (!isTRUE(tor_health$tor_enabled) || isTRUE(tor_health$tor_ready))
 
-  c(list(
-    status = if (healthy) "ok" else "degraded",
-    service = "asa-api",
-    time_utc = format(Sys.time(), tz = "UTC", usetz = TRUE),
-    asa_installed = asa_installed,
-    direct_provider_available = direct_provider_available,
-    boot_error = if (has_boot_error) boot_error else NULL,
-    defaults = list(
-      backend = getOption("asa.default_backend", NULL),
-      model = getOption("asa.default_model", NULL),
-      conda_env = getOption("asa.default_conda_env", "asa_env"),
-      use_browser = asa_api_to_bool(Sys.getenv("ASA_USE_BROWSER_DEFAULT", unset = "false"), default = FALSE)
-    )
-  ), tor_health)
+  c(
+    list(
+      status = if (healthy) "ok" else "degraded",
+      service = "asa-api",
+      time_utc = format(Sys.time(), tz = "UTC", usetz = TRUE),
+      asa_installed = asa_installed,
+      direct_provider_available = direct_provider_available,
+      boot_error = if (has_boot_error) boot_error else NULL
+    ),
+    if (!is.null(direct_provider_note)) {
+      list(direct_provider_note = direct_provider_note)
+    },
+    list(
+      defaults = list(
+        backend = getOption("asa.default_backend", NULL),
+        model = getOption("asa.default_model", NULL),
+        conda_env = getOption("asa.default_conda_env", "asa_env"),
+        use_browser = asa_api_to_bool(Sys.getenv("ASA_USE_BROWSER_DEFAULT", unset = "false"), default = FALSE)
+      )
+    ),
+    tor_health
+  )
 }

README.md

@@ -188,6 +188,7 @@ R dependency strategy in this image:
 - Base image is `rocker/r2u:24.04`.
 - Core R runtime packages (`plumber`, `jsonlite`, `reticulate`, `remotes`) are installed as binary apt packages (`r-cran-*`), not compiled from CRAN source.
 - This avoids source-compile failures such as `sodium` -> `plumber` install breaks.
+- The Docker build pre-creates `asa_env` with pinned `python=3.12.3` and `openssl=3.0.13` before calling `asa::build_backend()`, reducing rebuild drift that can break `reticulate` SSL imports on Ubuntu 24.04 / Hugging Face rebuilds.
 - Runtime linker guardrails are set so `reticulate` prefers conda environment libraries (`/opt/conda/envs/asa_env/lib` and `/opt/conda/lib`) to avoid C++ ABI loader mismatches.
 - Tor is installed in the image and started before the API. If Tor does not become ready, the container exits instead of serving direct search traffic.
 
@@ -195,6 +196,8 @@ Build args:
 
 - `ASA_SOFTWARE_REPO` (default: `https://github.com/cjerzak/asa-software`)
 - `ASA_SOFTWARE_REF` (default: `main`)
+- `ASA_CONDA_PYTHON_VERSION` (default: `3.12.3`)
+- `ASA_CONDA_OPENSSL_VERSION` (default: `3.0.13`)
 
 Local build:
 

Tests/api_contract_smoke.R

@@ -115,6 +115,17 @@ assert_true(
   identical(isTRUE(health_payload$direct_provider_available), isTRUE(asa_api_has_run_direct_task())),
   "Health payload should report direct-provider availability from the same capability check."
 )
+if (isTRUE(health_payload$direct_provider_available)) {
+  assert_true(
+    is.null(health_payload$direct_provider_note),
+    "Health payload should omit the direct-provider note when the capability is available."
+  )
+} else {
+  assert_true(
+    is.character(health_payload$direct_provider_note) && nzchar(trimws(health_payload$direct_provider_note)),
+    "Health payload should explain why direct-provider mode is unavailable."
+  )
+}
 
 {
   original_asa <- asa_api_run_single_via_asa

www/index.html

@@ -241,6 +241,11 @@
       color: rgba(16, 34, 46, 0.66);
     }
 
+    .hint.warn {
+      color: var(--err);
+      font-weight: 500;
+    }
+
     .api-guide {
       margin-top: 2px;
       padding: 12px;
@@ -270,11 +275,19 @@
       font-weight: 500;
     }
 
+    .toggle.disabled {
+      opacity: 0.62;
+    }
+
     .toggle input {
       width: auto;
       margin: 0;
     }
 
+    .toggle input:disabled {
+      cursor: not-allowed;
+    }
+
     .mode-badge {
       display: inline-flex;
       align-items: center;
@@ -359,6 +372,7 @@
     const promptInput = document.getElementById("prompt");
     const outputFormatInput = document.getElementById("output-format");
     const useDirectProviderInput = document.getElementById("use-direct-provider");
+    const directProviderToggleEl = useDirectProviderInput.closest(".toggle");
     const directProviderNoteEl = document.getElementById("direct-provider-note");
     const outputPre = document.getElementById("output");
     const statusEl = document.getElementById("status");
@@ -381,15 +395,26 @@
     function setDirectProviderAvailability(available, note) {
       if (available) {
         useDirectProviderInput.disabled = false;
+        if (directProviderToggleEl) {
+          directProviderToggleEl.classList.remove("disabled");
+          directProviderToggleEl.removeAttribute("title");
+        }
         directProviderNoteEl.hidden = true;
         directProviderNoteEl.textContent = "";
+        directProviderNoteEl.classList.remove("warn");
         return;
       }
 
+      const message = note || "Direct provider mode is unavailable on this server because the installed `asa` build does not provide run_direct_task().";
       useDirectProviderInput.checked = false;
       useDirectProviderInput.disabled = true;
+      if (directProviderToggleEl) {
+        directProviderToggleEl.classList.add("disabled");
+        directProviderToggleEl.title = message;
+      }
       directProviderNoteEl.hidden = false;
-      directProviderNoteEl.textContent = note || "Direct provider mode requires an asa build that provides run_direct_task.";
+      directProviderNoteEl.textContent = message;
+      directProviderNoteEl.classList.add("warn");
     }
 
     async function loadCapabilities() {
@@ -405,7 +430,7 @@
 
         const data = await response.json();
         if (data && data.direct_provider_available === false) {
-          setDirectProviderAvailability(false);
+          setDirectProviderAvailability(false, data.direct_provider_note);
         } else if (data && data.direct_provider_available === true) {
           setDirectProviderAvailability(true);
         }