ltcai 1.1.0 → 1.3.0

package/latticeai/services/__init__.py

@@ -0,0 +1,6 @@
+"""Service layer extracted from server_app.py.
+
+Services wrap stores and business logic with no dependency on the FastAPI app
+object, so API routers (latticeai.api.*) and the app assembly
+(latticeai.server_app) can import them without creating import cycles.
+"""

package/latticeai/services/chat_service.py

@@ -0,0 +1,53 @@
+"""Chat / session service seam.
+
+The streaming chat path in ``server_app`` is intentionally left in place — its
+generator and SSE behaviour are sensitive. This service provides a stable seam
+for the *bookkeeping* around answers (conversation history access and
+Workspace-OS answer-trace recording) so those concerns are named and wrapped
+rather than reaching into the store directly from the streaming handler.
+
+It is a behaviour-preserving façade: methods forward to the injected history
+accessor and :class:`WorkspaceOSStore`, so wiring the chat path through it
+cannot change streaming output.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, List, Optional
+
+from latticeai.core.workspace_os import WorkspaceOSStore
+
+
+class ChatService:
+    def __init__(self, *, store: WorkspaceOSStore, get_history: Callable[[], List[Dict[str, Any]]]):
+        self._store = store
+        self._get_history = get_history
+
+    # ── conversation history ─────────────────────────────────────────────
+
+    def history(self) -> List[Dict[str, Any]]:
+        return self._get_history()
+
+    # ── answer-trace recording (Graph RAG) ───────────────────────────────
+
+    def build_graph_trace(self, question: str, graph: Any, context: str = "", *, limit: int = 8) -> Dict[str, Any]:
+        return self._store.build_graph_trace(question, graph, context, limit=limit)
+
+    def record_trace(
+        self,
+        *,
+        question: str,
+        response: str,
+        conversation_id: Optional[str],
+        user_email: Optional[str],
+        trace: Dict[str, Any],
+        workspace_id: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        return self._store.record_trace(
+            question=question,
+            response=response,
+            conversation_id=conversation_id,
+            user_email=user_email,
+            trace=trace,
+            workspace_id=workspace_id,
+        )

package/latticeai/services/model_service.py

@@ -0,0 +1,51 @@
+"""Model / engine state helpers used by the health and model routers.
+
+Pure payload builders with no FastAPI dependency. The model runtime (LLMRouter),
+``engine_status``, and ``runtime_features`` remain owned by ``server_app``; this
+module just assembles the response shapes so the health/model routers stay thin
+and the summaries live in one place.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, List
+
+
+class ModelService:
+    """Assembles health/engine summary payloads from injected runtime pieces."""
+
+    def __init__(
+        self,
+        *,
+        model_router: Any,
+        runtime_features: Callable[[], Dict[str, Any]],
+        is_public: bool,
+    ):
+        self._router = model_router
+        self._runtime_features = runtime_features
+        self._is_public = is_public
+
+    def runtime(self) -> Dict[str, Any]:
+        return self._runtime_features()
+
+    def health_base(self, *, version: str, mode: str) -> Dict[str, Any]:
+        return {
+            "status": "ok",
+            "version": version,
+            "mode": mode,
+            "platform": "AI Workspace OS",
+        }
+
+    def health_full(self, base: Dict[str, Any], engines: List[Dict[str, Any]]) -> Dict[str, Any]:
+        return {
+            **base,
+            "current_model": self._router.current_model_id,
+            "loaded_models": self._router.loaded_model_ids,
+            "device": "Apple Silicon MLX" if not self._is_public else "Public cloud/API runtime",
+            "features": self._runtime_features(),
+            "providers": self._router.detected_cloud_models(),
+            "engines": engines,
+        }
+
+    def engines_payload(self, engines: List[Dict[str, Any]]) -> Dict[str, Any]:
+        return {"engines": engines, "current": self._router.current_model_id}

package/latticeai/services/workspace_service.py

@@ -0,0 +1,117 @@
+"""Workspace service layer: scope resolution, permission guardrails, and a
+single seam in front of :class:`WorkspaceOSStore`.
+
+This module centralizes the workspace_id resolution and role/permission checks
+that were previously scattered across the FastAPI handlers. It depends only on
+``workspace_os`` (and indirectly ``enterprise``), never on the FastAPI app, so
+both the app assembly and the API routers can import it freely.
+
+Guardrail summary (v1.2.0):
+
+* **Explicit workspace targeting is gated.** When a caller names a workspace
+  (``X-Workspace-Id`` header / ``workspace_id``), reads require ``read`` and
+  writes require ``write`` on that workspace; non-members are rejected.
+* **Backward compatible default.** With no workspace named, the scope resolves
+  to the *active* workspace (Personal by default). Pre-1.1 clients that never
+  send a header keep operating on Personal data exactly as before.
+* **Personal workspace** always grants its single local user owner rights.
+* **No-auth local mode** keeps the owner fallback for *ownerless* org
+  workspaces (the anonymous local user owns what they create), but a *named*
+  stranger never bypasses membership.
+* **Graph and installed Skills are intentionally machine-global shared state**
+  (the local knowledge graph and on-disk skills are not partitioned per
+  workspace). Skill enable/disable and other actions still record
+  workspace-scoped timeline events via the active workspace.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from latticeai.core.workspace_os import WorkspaceOSStore
+
+
+class WorkspaceService:
+    """Permission-aware façade over :class:`WorkspaceOSStore`."""
+
+    # Graph / installed-skill state that is shared machine-wide rather than
+    # partitioned per workspace. Surfaced so the UI / docs can be explicit.
+    SHARED_GLOBAL_AREAS = ("graph", "skills")
+
+    def __init__(self, store: WorkspaceOSStore):
+        self.store = store
+
+    # ── scope resolution + gating ────────────────────────────────────────
+
+    def _ensure_permission(self, workspace_id: str, user_id: Optional[str], permission: str) -> None:
+        if not self.store.has_permission(workspace_id, user_id, permission):
+            raise PermissionError(
+                f"'{user_id or 'anonymous'}' lacks '{permission}' on workspace '{workspace_id}'"
+            )
+
+    def resolve_read_scope(self, requested: Optional[str], user_id: Optional[str]) -> str:
+        """Resolve + authorize the workspace a read should target.
+
+        ``None`` falls back to the active workspace (Personal by default), which
+        preserves pre-1.1 behaviour. An explicitly named workspace is gated on
+        ``read`` so non-members cannot read organization data.
+        """
+        workspace_id = requested or self.store._active_workspace_id()
+        self._ensure_permission(workspace_id, user_id, "read")
+        return workspace_id
+
+    def resolve_write_scope(self, requested: Optional[str], user_id: Optional[str]) -> str:
+        """Resolve + authorize the workspace a write should target (gated on ``write``)."""
+        workspace_id = requested or self.store._active_workspace_id()
+        self._ensure_permission(workspace_id, user_id, "write")
+        return workspace_id
+
+    def can_read(self, workspace_id: str, user_id: Optional[str]) -> bool:
+        return self.store.has_permission(workspace_id, user_id, "read")
+
+    def can_write(self, workspace_id: str, user_id: Optional[str]) -> bool:
+        return self.store.has_permission(workspace_id, user_id, "write")
+
+    # ── workspace registry / summary ─────────────────────────────────────
+
+    def summary(self, user_id: Optional[str]) -> Dict[str, Any]:
+        data = self.store.summary()
+        data["workspace_registry"] = self.store.list_workspaces(user_id=user_id)
+        data["shared_global_areas"] = list(self.SHARED_GLOBAL_AREAS)
+        return data
+
+    def list_workspaces(self, user_id: Optional[str]) -> Dict[str, Any]:
+        return self.store.list_workspaces(user_id=user_id)
+
+    def get_workspace(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
+        # Reading workspace metadata requires read access to that workspace.
+        self._ensure_permission(workspace_id, user_id, "read")
+        return self.store.get_workspace(workspace_id, user_id=user_id)
+
+    def workspace_summary(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
+        self._ensure_permission(workspace_id, user_id, "read")
+        return self.store.workspace_summary(workspace_id, user_id=user_id)
+
+    # ── organization workspace management (delegates with actor) ─────────
+
+    def create_organization_workspace(self, *, name: str, owner_user_id: Optional[str], settings: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+        return self.store.create_organization_workspace(name=name, owner_user_id=owner_user_id, settings=settings)
+
+    def update_workspace(self, workspace_id: str, *, name=None, settings=None, actor=None) -> Dict[str, Any]:
+        return self.store.update_workspace(workspace_id, name=name, settings=settings, actor=actor)
+
+    def archive_workspace(self, workspace_id: str, *, actor=None) -> Dict[str, Any]:
+        return self.store.archive_workspace(workspace_id, actor=actor)
+
+    def add_member(self, workspace_id: str, *, user_id: str, role: str = "member", actor=None) -> Dict[str, Any]:
+        return self.store.add_member(workspace_id, user_id=user_id, role=role, actor=actor)
+
+    def update_member_role(self, workspace_id: str, *, user_id: str, role: str, actor=None) -> Dict[str, Any]:
+        return self.store.update_member_role(workspace_id, user_id=user_id, role=role, actor=actor)
+
+    def remove_member(self, workspace_id: str, *, user_id: str, actor=None) -> Dict[str, Any]:
+        return self.store.remove_member(workspace_id, user_id=user_id, actor=actor)
+
+    def set_active_workspace(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
+        # Membership is enforced inside the store for organization workspaces.
+        return self.store.set_active_workspace(workspace_id, user_id=user_id)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Lattice AI Workspace OS for local-first graph, memory, agent, workflow, and skill operations",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {