feat: introduce the LLM-based workflow copilot

access-control-service/src/main/scala/org/apache/texera/service/AccessControlService.scala

@@ -25,7 +25,12 @@ import io.dropwizard.core.setup.{Bootstrap, Environment}
 import org.apache.amber.config.StorageConfig
 import org.apache.texera.auth.{JwtAuthFilter, SessionUser}
 import org.apache.texera.dao.SqlServer
-import org.apache.texera.service.resource.{AccessControlResource, HealthCheckResource}
+import org.apache.texera.service.resource.{
+  AccessControlResource,
+  HealthCheckResource,
+  LiteLLMModelsResource,
+  LiteLLMProxyResource
+}
 import org.eclipse.jetty.server.session.SessionHandler
 
 import java.nio.file.Path
@@ -54,6 +59,8 @@ class AccessControlService extends Application[AccessControlServiceConfiguration
 
     environment.jersey.register(classOf[HealthCheckResource])
     environment.jersey.register(classOf[AccessControlResource])
+    environment.jersey.register(classOf[LiteLLMProxyResource])
+    environment.jersey.register(classOf[LiteLLMModelsResource])
 
     // Register JWT authentication filter
     environment.jersey.register(new AuthDynamicFeature(classOf[JwtAuthFilter]))

access-control-service/src/main/scala/org/apache/texera/service/resource/AccessControlResource.scala

@@ -20,11 +20,13 @@ package org.apache.texera.service.resource
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.fasterxml.jackson.module.scala.DefaultScalaModule
 import com.typesafe.scalalogging.LazyLogging
+import jakarta.ws.rs.client.{Client, ClientBuilder, Entity}
 import jakarta.ws.rs.core._
-import jakarta.ws.rs.{GET, POST, Path, Produces}
+import jakarta.ws.rs.{Consumes, GET, POST, Path, Produces}
 import org.apache.texera.auth.JwtParser.parseToken
 import org.apache.texera.auth.SessionUser
 import org.apache.texera.auth.util.{ComputingUnitAccess, HeaderField}
+import org.apache.texera.config.{GuiConfig, LLMConfig}
 import org.apache.texera.dao.jooq.generated.enums.PrivilegeEnum
 
 import java.net.URLDecoder
@@ -203,3 +205,127 @@ class AccessControlResource extends LazyLogging {
     AccessControlResource.authorize(uriInfo, headers, Option(body).map(_.trim).filter(_.nonEmpty))
   }
 }
+
+@Path("/chat")
+@Produces(Array(MediaType.APPLICATION_JSON))
+@Consumes(Array(MediaType.APPLICATION_JSON))
+class LiteLLMProxyResource extends LazyLogging {
+
+  private val client: Client = ClientBuilder.newClient()
+  private val litellmBaseUrl: String = LLMConfig.baseUrl
+  private val litellmApiKey: String = LLMConfig.masterKey
+
+  @POST
+  @Path("/{path:.*}")
+  def proxyPost(
+      @Context uriInfo: UriInfo,
+      @Context headers: HttpHeaders,
+      body: String
+  ): Response = {
+    if (!GuiConfig.guiWorkflowWorkspaceCopilotEnabled) {
+      return Response
+        .status(Response.Status.FORBIDDEN)
+        .entity("""{"error": "Copilot feature is disabled"}""")
+        .build()
+    }
+
+    // uriInfo.getPath returns "chat/completions" for /api/chat/completions
+    // We want to forward as "/chat/completions" to LiteLLM
+    val fullPath = uriInfo.getPath
+    val targetUrl = s"$litellmBaseUrl/$fullPath"
+
+    logger.info(s"Proxying POST request to LiteLLM: $targetUrl")
+
+    try {
+      val requestBuilder = client
+        .target(targetUrl)
+        .request(MediaType.APPLICATION_JSON)
+        .header("Authorization", s"Bearer $litellmApiKey")
+
+      // Forward other relevant headers from the original request
+      headers.getRequestHeaders.asScala.foreach {
+        case (key, values)
+            if !key.equalsIgnoreCase("Authorization") &&
+              !key.equalsIgnoreCase("Host") &&
+              !key.equalsIgnoreCase("Content-Length") =>
+          values.asScala.foreach(value => requestBuilder.header(key, value))
+        case _ => // Skip Authorization, Host, and Content-Length headers
+      }
+
+      val response = requestBuilder.post(Entity.json(body))
+
+      // Build response with same status and body from LiteLLM
+      val responseBody = response.readEntity(classOf[String])
+      val responseBuilder = Response
+        .status(response.getStatus)
+        .entity(responseBody)
+
+      // Forward response headers
+      response.getHeaders.asScala.foreach {
+        case (key, values) =>
+          values.asScala.foreach(value => responseBuilder.header(key, value))
+      }
+
+      responseBuilder.build()
+    } catch {
+      case e: Exception =>
+        logger.error(s"Error proxying request to LiteLLM: ${e.getMessage}", e)
+        Response
+          .status(Response.Status.BAD_GATEWAY)
+          .entity(s"""{"error": "Failed to proxy request to LiteLLM: ${e.getMessage}"}""")
+          .build()
+    }
+  }
+}
+
+@Path("/models")
+@Produces(Array(MediaType.APPLICATION_JSON))
+class LiteLLMModelsResource extends LazyLogging {
+
+  private val client: Client = ClientBuilder.newClient()
+  private val litellmBaseUrl: String = LLMConfig.baseUrl
+  private val litellmApiKey: String = LLMConfig.masterKey
+
+  @GET
+  def getModels: Response = {
+    if (!GuiConfig.guiWorkflowWorkspaceCopilotEnabled) {
+      return Response
+        .status(Response.Status.FORBIDDEN)
+        .entity("""{"error": "Copilot feature is disabled"}""")
+        .build()
+    }
+
+    val targetUrl = s"$litellmBaseUrl/models"
+
+    logger.info(s"Fetching models from LiteLLM: $targetUrl")
+
+    try {
+      val response = client
+        .target(targetUrl)
+        .request(MediaType.APPLICATION_JSON)
+        .header("Authorization", s"Bearer $litellmApiKey")
+        .get()
+
+      // Build response with same status and body from LiteLLM
+      val responseBody = response.readEntity(classOf[String])
+      val responseBuilder = Response
+        .status(response.getStatus)
+        .entity(responseBody)
+
+      // Forward response headers
+      response.getHeaders.asScala.foreach {
+        case (key, values) =>
+          values.asScala.foreach(value => responseBuilder.header(key, value))
+      }
+
+      responseBuilder.build()
+    } catch {
+      case e: Exception =>
+        logger.error(s"Error fetching models from LiteLLM: ${e.getMessage}", e)
+        Response
+          .status(Response.Status.BAD_GATEWAY)
+          .entity(s"""{"error": "Failed to fetch models from LiteLLM: ${e.getMessage}"}""")
+          .build()
+    }
+  }
+}

bin/litellm-config.yaml

@@ -0,0 +1,35 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# The default configuration file for starting litellm (https://docs.litellm.ai/docs/proxy/quick_start)
+# To start the litellm service:
+# 1. Install litellm by:
+#    pip install 'litellm[proxy]'
+# 2. Set your API keys as environment variable, e.g.
+#    export ANTHROPIC_API_KEY=<your-api-key>
+# 3. Start litellm by:
+#    litellm --config bin/litellm-config.yaml
+# By default, litellm is running on http://0.0.0.0:4000
+model_list:
+  - model_name: claude-haiku-4.5
+    litellm_params:
+      model: claude-haiku-4-5-20251001
+      api_key: "os.environ/ANTHROPIC_API_KEY"
+  - model_name: gpt-5-mini
+    litellm_params:
+      model: gpt-5-mini-2025-08-07
+      api_key: "os.environ/OPENAI_API_KEY"

common/config/src/main/resources/gui.conf

@@ -104,5 +104,9 @@ gui {
     # amount of time to be elapsed in minutes before user is detected as inactive
     active-time-in-minutes = 15
     active-time-in-minutes = ${?GUI_WORKFLOW_WORKSPACE_ACTIVE_TIME_IN_MINUTES}
+
+    # whether AI copilot feature is enabled
+    copilot-enabled = false
+    copilot-enabled = ${?GUI_WORKFLOW_WORKSPACE_COPILOT_ENABLED}
   }
 }

common/config/src/main/resources/llm.conf

@@ -0,0 +1,27 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# LLM Configuration
+llm {
+  # Base URL for LiteLLM service
+  base-url = "http://0.0.0.0:4000"
+  base-url = ${?LITELLM_BASE_URL}
+
+  # Master key for LiteLLM authentication
+  master-key = ""
+  master-key = ${?LITELLM_MASTER_KEY}
+}

common/config/src/main/scala/org/apache/texera/config/GuiConfig.scala

@@ -67,4 +67,6 @@ object GuiConfig {
     conf.getBoolean("gui.workflow-workspace.workflow-email-notification-enabled")
   val guiWorkflowWorkspaceActiveTimeInMinutes: Int =
     conf.getInt("gui.workflow-workspace.active-time-in-minutes")
+  val guiWorkflowWorkspaceCopilotEnabled: Boolean =
+    conf.getBoolean("gui.workflow-workspace.copilot-enabled")
 }

common/config/src/main/scala/org/apache/texera/config/LLMConfig.scala

@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.texera.config
+
+import com.typesafe.config.{Config, ConfigFactory}
+
+object LLMConfig {
+  private val conf: Config = ConfigFactory.parseResources("llm.conf").resolve()
+
+  // LLM Service Configuration
+  val baseUrl: String = conf.getString("llm.base-url")
+  val masterKey: String = conf.getString("llm.master-key")
+}

config-service/src/main/scala/org/apache/texera/service/resource/ConfigResource.scala

@@ -55,6 +55,7 @@ class ConfigResource {
         "password" -> GuiConfig.guiLoginDefaultLocalUserPassword
       ),
       "activeTimeInMinutes" -> GuiConfig.guiWorkflowWorkspaceActiveTimeInMinutes,
+      "copilotEnabled" -> GuiConfig.guiWorkflowWorkspaceCopilotEnabled,
       // flags from the auth.conf if needed
       "expirationTimeInMinutes" -> AuthConfig.jwtExpirationMinutes
     )

frontend/package.json

@@ -8,10 +8,10 @@
   "scripts": {
     "start": "concurrently --kill-others \"npx y-websocket\" \"ng serve\"",
     "build": "ng build --configuration=production --progress=false --source-map=false",
-    "build:ci": "nx build --configuration=production --progress=false --source-map=false",
+    "build:ci": "node --max-old-space-size=8192 ./node_modules/nx/bin/nx build --configuration=production --progress=false --source-map=false",
     "analyze": "ng build --configuration=production --stats-json && webpack-bundle-analyzer dist/stats.json",
     "test": "ng test --watch=false",
-    "test:ci": "node --max-old-space-size=6144 ./node_modules/nx/bin/nx test --watch=false --progress=false",
+    "test:ci": "node --max-old-space-size=8192 ./node_modules/nx/bin/nx test --watch=false --progress=false",
     "prettier:fix": "prettier --write ./src",
     "lint": "ng lint",
     "eslint:fix": "yarn eslint --fix ./src",
@@ -22,6 +22,7 @@
   "private": true,
   "dependencies": {
     "@abacritt/angularx-social-login": "2.3.0",
+    "@ai-sdk/openai": "2.0.67",
     "@ali-hm/angular-tree-component": "12.0.5",
     "@angular/animations": "16.2.12",
     "@angular/cdk": "16.2.12",
@@ -45,6 +46,7 @@
     "@stoplight/json-ref-resolver": "3.1.5",
     "@types/lodash-es": "4.17.4",
     "@types/plotly.js-basic-dist-min": "2.12.4",
+    "ai": "5.0.93",
     "ajv": "8.10.0",
     "backbone": "1.4.1",
     "concaveman": "2.0.0",
@@ -94,6 +96,7 @@
     "y-quill": "0.1.5",
     "y-websocket": "1.4.0",
     "yjs": "13.5.41",
+    "zod": "3.25.76",
     "zone.js": "0.13.0"
   },
   "resolutions": {

frontend/proxy.config.json

@@ -1,4 +1,14 @@
 {
+  "/api/models": {
+    "target": "http://localhost:9096",
+    "secure": false,
+    "changeOrigin": true
+  },
+  "/api/chat/completion": {
+    "target": "http://localhost:9096",
+    "secure": false,
+    "changeOrigin": true
+  },
   "/api/compile": {
     "target": "http://localhost:9090",
     "secure": false,