ltcai 1.5.0 → 1.7.0

package/static/lattice-reference.css

@@ -1555,6 +1555,91 @@
   line-height: 1.5;
 }
 
+.lattice-ref-admin .enterprise-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
+  gap: 10px;
+}
+
+.lattice-ref-admin .enterprise-cap-card {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  min-width: 0;
+  border: 1px solid rgba(111,66,232,0.12);
+  border-radius: 8px;
+  background: rgba(255,255,255,0.70);
+  padding: 11px 12px;
+}
+
+.lattice-ref-admin .enterprise-cap-card i {
+  color: #7a74a0;
+  font-size: 18px;
+}
+
+.lattice-ref-admin .enterprise-cap-card.on i {
+  color: #0d8f72;
+}
+
+.lattice-ref-admin .enterprise-cap-card span {
+  flex: 1;
+  min-width: 0;
+  color: #14162c;
+  font-size: 13px;
+  font-weight: 800;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  text-transform: capitalize;
+}
+
+.lattice-ref-admin .enterprise-cap-card strong {
+  color: #4a4668;
+  font-size: 11px;
+}
+
+.lattice-ref-admin .enterprise-kv {
+  display: grid;
+  gap: 8px;
+}
+
+.lattice-ref-admin .enterprise-kv div {
+  display: grid;
+  grid-template-columns: 150px minmax(0, 1fr);
+  gap: 10px;
+  align-items: start;
+  border: 1px solid rgba(111,66,232,0.10);
+  border-radius: 8px;
+  background: rgba(255,255,255,0.62);
+  padding: 9px 10px;
+}
+
+.lattice-ref-admin .enterprise-kv span {
+  color: #4a4668;
+  font-size: 12px;
+  font-weight: 800;
+}
+
+.lattice-ref-admin .enterprise-kv strong {
+  color: #14162c;
+  font-size: 12px;
+  line-height: 1.45;
+  overflow-wrap: anywhere;
+}
+
+.lattice-ref-admin .enterprise-json {
+  max-height: 280px;
+  overflow: auto;
+  margin: 12px 0 0;
+  border: 1px solid rgba(111,66,232,0.10);
+  border-radius: 8px;
+  background: rgba(20,22,44,0.05);
+  color: #14162c;
+  padding: 12px;
+  font-size: 12px;
+  white-space: pre-wrap;
+}
+
 @media (max-width: 980px) {
   .lattice-ref-chat .reference-card-grid,
   .reference-lists {
@@ -2784,9 +2869,11 @@ body.lattice-ref-graph {
       top: 16px;
       right: 16px;
       display: flex;
+      flex-wrap: wrap;
       gap: 8px;
       padding: 8px;
       border-radius: 10px;
+      max-width: min(760px, calc(100% - 32px));
     }
 
     .tb-btn {
@@ -3301,6 +3388,103 @@ body.lattice-ref-graph {
 
     .jump-btn:hover { filter: brightness(1.04); }
 
+    .jump-btn.secondary {
+      border: 1px solid rgba(111,66,232,0.20);
+      color: var(--text);
+      background: rgba(255,255,255,0.82);
+      box-shadow: none;
+      cursor: pointer;
+      font: inherit;
+      font-size: 12px;
+      font-weight: 700;
+    }
+
+    .detail-actions {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 8px;
+      margin-bottom: 14px;
+    }
+
+    .related-node-list {
+      display: grid;
+      gap: 7px;
+      margin-bottom: 14px;
+    }
+
+    .related-node-btn {
+      width: 100%;
+      min-width: 0;
+      display: grid;
+      grid-template-columns: 18px minmax(0, 1fr) auto;
+      align-items: center;
+      gap: 8px;
+      border: 1px solid rgba(111,66,232,0.13);
+      border-radius: 8px;
+      background: rgba(255,255,255,0.76);
+      color: var(--text);
+      padding: 8px 10px;
+      text-align: left;
+      cursor: pointer;
+    }
+
+    .related-node-btn:hover {
+      border-color: rgba(111,66,232,0.34);
+      background: rgba(111,66,232,0.07);
+    }
+
+    .related-node-btn strong {
+      min-width: 0;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      font-size: 12px;
+    }
+
+    .related-node-btn em {
+      color: var(--faint);
+      font-size: 11px;
+      font-style: normal;
+      white-space: nowrap;
+    }
+
+    .focus-chip {
+      position: absolute;
+      z-index: 21;
+      left: 16px;
+      bottom: 16px;
+      max-width: min(560px, calc(100% - 32px));
+      display: flex;
+      flex-wrap: wrap;
+      gap: 8px;
+      padding: 8px;
+      border: 1px solid var(--line);
+      border-radius: 10px;
+      background: rgba(255,255,255,0.90);
+      box-shadow: var(--shadow);
+      backdrop-filter: blur(18px);
+    }
+
+    .focus-chip span {
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
+      border-radius: 999px;
+      background: rgba(111,66,232,0.08);
+      color: var(--text);
+      padding: 5px 10px;
+      font-size: 11px;
+      font-weight: 800;
+      max-width: 260px;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+    }
+
+    .search-shell.search-open .search-results {
+      display: block;
+    }
+
     .empty-hint {
       margin: 0;
       color: var(--muted);

package/static/scripts/admin.js

@@ -49,6 +49,7 @@ const A18N = {
         nav_users: '사용자 관리',
         nav_permissions: '권한 관리',
         nav_sso: 'SSO 관리',
+        nav_enterprise: 'Enterprise',
         nav_security: '보안 모니터링',
         nav_audit: '감사 로그',
         nav_chat: '채팅으로',
@@ -170,6 +171,16 @@ const A18N = {
         section_sensitivity: '보안 모니터링',
         section_audit: '감사 로그',
         section_sso: 'SSO 관리',
+        enterprise_title: 'Enterprise 관리자',
+        enterprise_desc: '관리자 정책, 감사 추출, SIEM 추출, 조직 설정, 기능 상태를 확인합니다.',
+        enterprise_policies: '관리자 정책',
+        enterprise_policies_desc: 'Community 유효 정책과 Enterprise 정책 팩 상태입니다.',
+        enterprise_org: '조직 설정',
+        enterprise_org_desc: '워크스페이스 거버넌스와 조직 기능 상태입니다.',
+        enterprise_audit_export: '감사 추출',
+        enterprise_audit_export_desc: 'Community에서는 로컬 추출이 가능하며 보존 정책은 Enterprise 확장 지점입니다.',
+        enterprise_siem: 'SIEM 추출',
+        enterprise_siem_desc: 'Community에서 외부 이벤트를 전송하지 않고 SIEM envelope를 미리 봅니다.',
     },
     en: {
         admin_sub: 'Admin Dashboard',
@@ -180,6 +191,7 @@ const A18N = {
         nav_users: 'User Management',
         nav_permissions: 'Permission Management',
         nav_sso: 'SSO Management',
+        nav_enterprise: 'Enterprise',
         nav_security: 'Security Monitoring',
         nav_audit: 'Audit Logs',
         nav_chat: 'Back to Chat',
@@ -301,6 +313,16 @@ const A18N = {
         section_sensitivity: 'Security monitoring',
         section_audit: 'Audit logs',
         section_sso: 'SSO management',
+        enterprise_title: 'Enterprise Admin',
+        enterprise_desc: 'Review admin policies, audit export, SIEM export, organization settings, and capability status.',
+        enterprise_policies: 'Admin Policies',
+        enterprise_policies_desc: 'Effective Community policy and Enterprise policy-pack status.',
+        enterprise_org: 'Organization Settings',
+        enterprise_org_desc: 'Workspace governance and organization capability status.',
+        enterprise_audit_export: 'Audit Export',
+        enterprise_audit_export_desc: 'Community local export is available; retention is an Enterprise extension point.',
+        enterprise_siem: 'SIEM Export',
+        enterprise_siem_desc: 'Preview the SIEM envelope without streaming external events in Community.',
     }
 };
 
@@ -310,6 +332,7 @@ let latestUsers = [];
 let latestSso = null;
 let latestSensitivity = null;
 let latestAudit = null;
+let latestEnterprise = null;
 
 function t(key) {
     return (A18N[currentLang] || A18N.ko)[key] || key;
@@ -352,6 +375,7 @@ function setLang(lang) {
     renderSso(latestSso);
     renderSensitivity(latestSensitivity);
     renderAudit(latestAudit);
+    renderEnterpriseAdmin(latestEnterprise);
     loadDashboard();
 }
 
@@ -788,6 +812,97 @@ function renderAudit(audit) {
     ` : `<div class="preview" style="padding:14px">${t('audit_no_events')}</div>`;
 }
 
+function enterpriseStatusTag(label, enabled) {
+    return `<span class="tag ${enabled ? 'low' : 'medium'}">${esc(label)}: ${enabled ? 'enabled' : 'disabled'}</span>`;
+}
+
+function renderKeyValues(targetId, rows) {
+    const target = document.getElementById(targetId);
+    if (!target) return;
+    target.innerHTML = `
+        <div class="enterprise-kv">
+            ${rows.map(([label, value]) => `
+                <div>
+                    <span>${esc(label)}</span>
+                    <strong>${esc(value)}</strong>
+                </div>
+            `).join('')}
+        </div>
+    `;
+}
+
+function renderEnterpriseAdmin(payload) {
+    latestEnterprise = payload || null;
+    const enterprise = payload || {};
+    const edition = enterprise.edition || {};
+    const caps = edition.capabilities || {};
+    const tags = document.getElementById('enterprise-status-tags');
+    if (tags) {
+        tags.innerHTML = [
+            enterpriseStatusTag('edition', Boolean(edition.is_enterprise)),
+            enterpriseStatusTag('policy packs', Boolean(enterprise.admin_policies?.enabled)),
+            enterpriseStatusTag('siem', Boolean(enterprise.siem_export?.enabled)),
+        ].join('');
+    }
+
+    const grid = document.getElementById('enterprise-capability-status');
+    if (grid) {
+        const entries = Object.keys(caps).length ? Object.entries(caps) : [];
+        grid.innerHTML = entries.length ? entries.map(([name, enabled]) => `
+            <div class="enterprise-cap-card ${enabled ? 'on' : 'off'}">
+                <i class="ti ${enabled ? 'ti-circle-check' : 'ti-lock'}"></i>
+                <span>${esc(name.replaceAll('_', ' '))}</span>
+                <strong>${enabled ? 'enabled' : 'disabled'}</strong>
+            </div>
+        `).join('') : `<div class="preview" style="padding:14px">Capability status unavailable.</div>`;
+    }
+
+    const policies = enterprise.admin_policies || {};
+    renderKeyValues('enterprise-admin-policies', [
+        ['Capability', policies.capability || 'admin_policy_packs'],
+        ['Enabled', Boolean(policies.enabled)],
+        ['Enforced', Boolean(policies.enforced)],
+        ['Base roles', (policies.effective_policy?.base_roles || []).join(', ')],
+        ['Local file access', policies.effective_policy?.local_file_access || 'approval-token gated'],
+        ['Package install', policies.effective_policy?.package_install || 'admin-only'],
+        ['Note', policies.note || 'Community features remain available.'],
+    ]);
+
+    const org = enterprise.organization_settings || {};
+    renderKeyValues('enterprise-org-settings', [
+        ['Workspaces', (org.community_baseline?.workspaces || []).join(', ')],
+        ['Roles', (org.community_baseline?.roles || []).join(', ')],
+        ['Data isolation', org.community_baseline?.data_isolation || 'single-tenant local storage'],
+        ['Governance enabled', Object.values(org.governance_capabilities || {}).filter(Boolean).length],
+        ['Note', org.note || 'Enterprise governance is an extension point.'],
+    ]);
+
+    const audit = enterprise.audit_export || {};
+    renderKeyValues('enterprise-audit-export', [
+        ['Local export', audit.local_export?.available ? 'available' : 'unavailable'],
+        ['Endpoint', audit.local_export?.endpoint || '/admin/security/export'],
+        ['Formats', (audit.local_export?.formats || []).join(', ')],
+        ['SIEM streaming', audit.siem_streaming?.enabled ? 'enabled' : 'disabled'],
+        ['Retention', audit.compliance_retention?.enabled ? 'enabled' : 'disabled'],
+    ]);
+
+    const siem = enterprise.siem_export || {};
+    renderKeyValues('enterprise-siem-export', [
+        ['Capability', siem.capability || 'siem_export'],
+        ['Enabled', Boolean(siem.enabled)],
+        ['Streamed', Boolean(siem.streamed)],
+        ['Destination', siem.destination || 'not configured'],
+    ]);
+    const preview = document.getElementById('enterprise-siem-preview');
+    if (preview) preview.textContent = JSON.stringify(siem.preview_envelope || {}, null, 2);
+}
+
+async function refreshSiemPreview() {
+    const res = await apiFetch('/admin/enterprise/siem-export', { headers: adminHeaders() });
+    const data = res.ok ? await res.json() : {};
+    renderEnterpriseAdmin({ ...(latestEnterprise || {}), siem_export: data });
+}
+
 function cellValue(value) {
     if (value === null || value === undefined) return '';
     if (Array.isArray(value)) return value.map(cellValue).filter(Boolean).join('; ');
@@ -1074,7 +1189,7 @@ async function loadDashboard() {
     access.style.display = 'none';
 
     try {
-        const [healthRes, vpcRes, summaryRes, usersRes, sensitivityRes, inviteRes, statsRes, auditRes, ssoRes] = await Promise.all([
+        const [healthRes, vpcRes, summaryRes, usersRes, sensitivityRes, inviteRes, statsRes, auditRes, ssoRes, enterpriseRes] = await Promise.all([
             apiFetch('/health'),
             apiFetch('/vpc/status'),
             apiFetch('/admin/summary', { headers: adminHeaders() }),
@@ -1084,6 +1199,7 @@ async function loadDashboard() {
             apiFetch('/admin/stats', { headers: adminHeaders() }),
             apiFetch('/admin/audit', { headers: adminHeaders() }),
             apiFetch('/admin/sso', { headers: adminHeaders() }),
+            apiFetch('/admin/enterprise', { headers: adminHeaders() }),
         ]);
 
         const health = healthRes.ok ? await healthRes.json() : null;
@@ -1095,6 +1211,7 @@ async function loadDashboard() {
         const stats = statsRes.ok ? await statsRes.json() : null;
         const audit = auditRes.ok ? await auditRes.json() : null;
         const sso = ssoRes.ok ? await ssoRes.json() : null;
+        const enterprise = enterpriseRes.ok ? await enterpriseRes.json() : null;
 
         renderSummary(health, summary, vpc);
         fillVpcForm(vpc);
@@ -1103,6 +1220,7 @@ async function loadDashboard() {
         renderSensitivity(sensitivity);
         renderAudit(audit);
         renderSso(sso);
+        renderEnterpriseAdmin(enterprise);
 
         if (invite) {
             document.getElementById('invite-link-input').value = invite.invite_url;
@@ -1118,6 +1236,7 @@ async function loadDashboard() {
         if (!sensitivityRes.ok) failedSections.push(t('section_sensitivity'));
         if (!auditRes.ok) failedSections.push(t('section_audit'));
         if (!ssoRes.ok) failedSections.push(t('section_sso'));
+        if (!enterpriseRes.ok) failedSections.push('Enterprise');
 
         if (failedSections.length) {
             access.style.display = 'block';
@@ -1189,6 +1308,7 @@ document.getElementById('save-sso-btn').addEventListener('click', saveSso);
 document.getElementById('test-sso-btn').addEventListener('click', () => {
     window.location.href = `${API_BASE}/auth/sso/login`;
 });
+document.getElementById('refresh-siem-btn')?.addEventListener('click', () => refreshSiemPreview().catch(e => alert(String(e))));
 document.getElementById('security-export-toggle')?.addEventListener('click', () => toggleExportOptions('security'));
 document.getElementById('audit-export-toggle')?.addEventListener('click', () => toggleExportOptions('audit'));
 document.querySelectorAll('[data-export-scope][data-export-format]').forEach(btn => {

package/static/scripts/chat.js

@@ -1033,6 +1033,7 @@ const chatViewport = document.getElementById('chat-viewport');
                 const data = await res.json();
                 if (!res.ok) return;
                 const rec = (data && data.recommendations) || {};
+                const profile = (data && data.profile) || {};
                 const families = rec.families || [];
                 if (!families.length) return;
                 const counts = rec.counts || {};
@@ -1043,25 +1044,45 @@ const chatViewport = document.getElementById('chat-viewport');
                         not_recommended: ['권장 안 함', '#9ca3af'],
                     };
                     const [label, color] = map[status] || ['', '#9ca3af'];
-                    return `<span style="display:inline-block;padding:1px 7px;border-radius:999px;font-size:11px;color:#fff;background:${color}">${label}</span>`;
+                    return `<span style="display:inline-block;padding:1px 8px;border-radius:999px;font-size:11px;font-weight:700;color:#fff;background:${color}">${label}</span>`;
                 };
+                const ram = (m) => (m.required_ram_gb != null) ? `~${m.required_ram_gb}GB RAM (est.)` : '';
+                const nextStep = (engine) => engine === 'ollama'
+                    ? 'Next: ollama pull'
+                    : engine === 'local_mlx' ? 'Next: download & load' : 'Next: connect engine';
+
+                // Top pick callout
+                const top = rec.top_pick;
+                const topHtml = top ? `
+                    <div style="border:1px solid #16a34a;background:#f0fdf4;border-radius:10px;padding:10px 12px;margin:8px 0">
+                        <div style="font-weight:700">⭐ Best for this PC — ${escapeHtml(top.name || top.id)} ${badge('recommended')}</div>
+                        <div style="font-size:12px;opacity:0.8;margin-top:3px">${escapeHtml(top.reason || '')}</div>
+                        <div style="font-size:12px;margin-top:4px">${escapeHtml(top.size || '')} · ${escapeHtml(ram(top))} · ${escapeHtml(nextStep(rec.engine))}</div>
+                    </div>` : '';
+
                 const rows = families.map((fam) => {
                     const best = fam.best;
                     const items = (fam.models || []).map((m) => `
-                        <div style="display:flex;justify-content:space-between;gap:8px;padding:2px 0;font-size:12px;opacity:${m.status === 'not_recommended' ? 0.55 : 1}">
+                        <div style="display:flex;justify-content:space-between;gap:8px;padding:3px 0;font-size:12px;opacity:${m.status === 'not_recommended' ? 0.55 : 1}">
                             <span>${escapeHtml(m.name || m.id)}</span>
-                            <span>${escapeHtml(m.size || '')} ${badge(m.status)}</span>
+                            <span style="white-space:nowrap">${escapeHtml(m.size || '')} · ${escapeHtml(ram(m))} ${badge(m.status)}</span>
                         </div>`).join('');
                     return `
                         <details style="margin:6px 0;border:1px solid var(--border,#e5e7eb);border-radius:8px;padding:8px 10px">
-                            <summary style="cursor:pointer;font-weight:600">${escapeHtml(fam.family)} ${best ? badge(best.status) : ''}</summary>
+                            <summary style="cursor:pointer;font-weight:600">${escapeHtml(fam.family)} ${best ? badge(best.status) : ''}${best ? ` <span style="font-weight:400;opacity:0.7">${escapeHtml(best.name || '')}</span>` : ''}</summary>
                             <div style="margin-top:6px">${items}</div>
                         </details>`;
                 }).join('');
+
+                const engineLabel = rec.engine === 'local_mlx' ? 'MLX (Apple Silicon)' : rec.engine;
+                const machine = `${profile.os || ''} · RAM ${rec.ram_gb || '?'}GB · ${rec.apple_silicon ? 'Apple Silicon' : (profile.gpu && profile.gpu.vendor) || 'CPU'} · engine ${engineLabel}`;
                 container.innerHTML = `
-                    <h3 style="margin:14px 0 4px">이 PC에서 실행 가능한 로컬 모델</h3>
-                    <p style="font-size:12px;opacity:0.7;margin:0 0 8px">RAM ${escapeHtml(String(rec.ram_gb || '?'))}GB 기준 · 추천 ${counts.recommended || 0} · 실행 가능 ${counts.compatible || 0} · 권장 안 함 ${counts.not_recommended || 0}</p>
-                    ${rows}`;
+                    <h3 style="margin:14px 0 4px">이 PC에 맞는 로컬 모델</h3>
+                    <p style="font-size:12px;opacity:0.7;margin:0 0 4px">${escapeHtml(machine)}</p>
+                    <p style="font-size:12px;opacity:0.7;margin:0 0 6px">${badge('recommended')} ${counts.recommended || 0} · ${badge('compatible')} ${counts.compatible || 0} · ${badge('not_recommended')} ${counts.not_recommended || 0} · estimates are conservative, verify before loading</p>
+                    ${topHtml}
+                    ${rows}
+                    <p style="font-size:12px;opacity:0.65;margin:8px 0 0">로컬 모델이 부족하면 클라우드 모델(OpenAI·OpenRouter·Groq 등, API 키 필요)을 선택할 수 있습니다.</p>`;
             } catch (e) {
                 /* best-effort enhancement; never break onboarding */
             }