ltcai 1.7.0 → 2.0.0

package/latticeai/services/platform_runtime.py

@@ -0,0 +1,200 @@
+"""v2.0 Agentic Workspace Platform runtime — cross-system wiring.
+
+This is the single place the four v2.0 subsystems (Plugin SDK, Workflow
+Designer, Multi-Agent Runtime, Realtime) connect to one another and to the
+workspace. Keeping it out of ``server_app`` honours the AGENTS.md preference for
+small, composable modules and keeps the wiring independently testable.
+
+Recursion is bounded by construction: a workflow's ``agent`` node runs an
+orchestrator *without* a workflow runner, and an orchestrator's workflow runner
+runs an engine *without* an ``agent`` runner — so the deepest chains are
+``agent → workflow → (tool|skill|plugin)`` and ``workflow → agent → plugin``.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, Optional, Set
+
+from fastapi import HTTPException, Request
+
+from latticeai.core.multi_agent import MultiAgentOrchestrator, default_role_runner
+from latticeai.core.workflow_engine import WorkflowEngine
+
+
+class PlatformRuntime:
+    def __init__(
+        self,
+        *,
+        store,
+        workspace_service,
+        plugin_registry,
+        get_current_user: Callable[[Request], Optional[str]],
+        workspace_graph: Callable[[], Any],
+        workspace_scope_from_request: Callable[[Request], Optional[str]],
+        get_tool_permission: Callable[..., Dict[str, Any]],
+    ):
+        self.store = store
+        self.svc = workspace_service
+        self.registry = plugin_registry
+        self.get_current_user = get_current_user
+        self.workspace_graph = workspace_graph
+        self.scope_from_request = workspace_scope_from_request
+        self.get_tool_permission = get_tool_permission
+
+    # ── request gating ────────────────────────────────────────────────────
+
+    def gate_read(self, request: Request) -> Optional[str]:
+        try:
+            return self.svc.resolve_read_scope(self.scope_from_request(request), self.get_current_user(request))
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+
+    def gate_write(self, request: Request) -> Optional[str]:
+        try:
+            return self.svc.resolve_write_scope(self.scope_from_request(request), self.get_current_user(request))
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+
+    def allowed_scopes(self, user: Optional[str]) -> Optional[Set[str]]:
+        try:
+            workspaces = self.svc.list_workspaces(user or None).get("workspaces", [])
+            return {ws.get("workspace_id") for ws in workspaces if ws.get("workspace_id")}
+        except Exception:
+            return None
+
+    # ── plugin lifecycle hooks ────────────────────────────────────────────
+
+    def register_plugin_skill(self, skill_name: str, plugin_id: str):
+        return self.store.mark_skill_installed(
+            skill_name, version=f"plugin:{plugin_id}", metadata={"source": f"plugin:{plugin_id}"}
+        )
+
+    # ── shared node runners ───────────────────────────────────────────────
+
+    def _tool_node_runner(self):
+        """Workflow tool node: records the invocation + governance decision but
+        never silently executes exec/destructive tools (those need approval)."""
+        def runner(*, node, context):
+            cfg = node.get("config") or {}
+            name = cfg.get("tool") or ""
+            try:
+                permission = dict(self.get_tool_permission(name))
+            except Exception:
+                permission = {"tool": name, "risk": "unknown"}
+            return {"tool": name, "args": cfg.get("args") or {}, "recorded": True, "permission": permission}
+        return runner
+
+    def _skill_node_runner(self):
+        def runner(*, node, context):
+            cfg = node.get("config") or {}
+            name = cfg.get("skill") or ""
+            entry = self.store.load_state().get("skill_registry", {}).get(name) or {}
+            return {"skill": name, "found": bool(entry), "enabled": bool(entry.get("enabled"))}
+        return runner
+
+    def _context_provider(self, user, scope):
+        def provider(goal: str):
+            try:
+                mems = self.store.search_memories(goal, user_email=user, workspace_id=scope).get("memories", [])
+                return [str(m.get("content") or "")[:160] for m in mems[:5]]
+            except Exception:
+                return []
+        return provider
+
+    def plugin_capability_runners(self, user, scope) -> Dict[str, Callable[..., Any]]:
+        """Runners the Plugin SDK boundary dispatches to (one per capability)."""
+        def run_skill(*, plugin_id, action, args, manifest):
+            return {"plugin": plugin_id, "ran_skills": manifest.provides.get("skills", [])}
+
+        def run_tool(*, plugin_id, action, args, manifest):
+            tool = args.get("tool") or (manifest.provides.get("tools") or [None])[0]
+            try:
+                permission = dict(self.get_tool_permission(tool)) if tool else {}
+            except Exception:
+                permission = {}
+            return {"plugin": plugin_id, "tool": tool, "permission": permission, "recorded": True}
+
+        def run_workflow(*, plugin_id, action, args, manifest):
+            wf_id = args.get("workflow_id")
+            if not wf_id:
+                return {"plugin": plugin_id, "skipped": "no workflow_id"}
+            return self.run_workflow_by_id(wf_id, user, scope, with_agent=False, inputs=args.get("inputs"))
+
+        def run_agent(*, plugin_id, action, args, manifest):
+            goal = args.get("goal") or f"Plugin {plugin_id} agent task"
+            return self.run_agent(goal, user, scope, with_workflow=False, inputs=args.get("inputs"))
+
+        return {"skills": run_skill, "tools": run_tool, "workflows": run_workflow, "agents": run_agent}
+
+    def _plugin_node_runner(self, user, scope):
+        def runner(*, node, context):
+            cfg = node.get("config") or {}
+            plugin_id = cfg.get("plugin_id") or cfg.get("plugin") or ""
+            action = cfg.get("action") or "run_skill"
+            result = self.registry.execute_action(
+                plugin_id, action, cfg.get("args") or {}, runners=self.plugin_capability_runners(user, scope)
+            )
+            return result.as_dict()
+        return runner
+
+    def _agent_node_runner(self, user, scope):
+        def runner(*, node, context):
+            cfg = node.get("config") or {}
+            goal = cfg.get("goal") or context.get("goal") or "Run agent"
+            return self.run_agent(goal, user, scope, with_workflow=False, roles=cfg.get("roles"), inputs=context.get("inputs"))
+        return runner
+
+    # ── cross-system runs ─────────────────────────────────────────────────
+
+    def run_workflow_by_id(self, workflow_id, user, scope, *, with_agent: bool, inputs=None) -> Dict[str, Any]:
+        try:
+            workflow = self.store.get_workflow(workflow_id, workspace_id=scope)
+        except FileNotFoundError:
+            return {"error": f"workflow not found: {workflow_id}"}
+        runners = {
+            "tool": self._tool_node_runner(),
+            "skill": self._skill_node_runner(),
+            "plugin": self._plugin_node_runner(user, scope),
+        }
+        if with_agent:
+            runners["agent"] = self._agent_node_runner(user, scope)
+        result = WorkflowEngine(runners).run(workflow, inputs=inputs or {})
+        run = self.store.record_workflow_run(
+            workflow_id=workflow_id, name=workflow.get("name") or "workflow",
+            status=result.status, timeline=result.timeline, outputs=result.outputs,
+            user_email=user, graph=self.workspace_graph(), workspace_id=scope,
+        )
+        return {"workflow_run_id": run["id"], "status": result.status}
+
+    def run_agent(self, goal, user, scope, *, with_workflow: bool, roles=None, inputs=None) -> Dict[str, Any]:
+        role_runner = default_role_runner(
+            workflow_runner=(lambda wf_ref, ctx: self.run_workflow_by_id(wf_ref, user, scope, with_agent=False, inputs=ctx.inputs)) if with_workflow else None,
+            plugin_runner=lambda pid, ctx: self.registry.execute_action(pid, "run_skill", {}, runners=self.plugin_capability_runners(user, scope)).as_dict(),
+            context_provider=self._context_provider(user, scope),
+        )
+        result = MultiAgentOrchestrator(role_runner=role_runner).run(
+            goal, user_email=user, workspace_id=scope, roles=roles, inputs=inputs or {}
+        )
+        run = self.store.record_agent_run(
+            agent_id=result.agent_id, status=result.status, input_text=goal,
+            output_text=result.output, timeline=result.timeline, relationships=[],
+            user_email=user, graph=self.workspace_graph(), workspace_id=scope,
+        )
+        return {"agent_run_id": run["id"], "status": result.status, "output": result.output}
+
+    # ── factories passed to routers ───────────────────────────────────────
+
+    def build_workflow_runners(self, user, scope) -> Dict[str, Callable[..., Any]]:
+        return {
+            "tool": self._tool_node_runner(),
+            "skill": self._skill_node_runner(),
+            "plugin": self._plugin_node_runner(user, scope),
+            "agent": self._agent_node_runner(user, scope),
+        }
+
+    def build_orchestrator(self, user, scope) -> MultiAgentOrchestrator:
+        return MultiAgentOrchestrator(role_runner=default_role_runner(
+            workflow_runner=lambda wf_ref, ctx: self.run_workflow_by_id(wf_ref, user, scope, with_agent=False, inputs=ctx.inputs),
+            plugin_runner=lambda pid, ctx: self.registry.execute_action(pid, "run_skill", {}, runners=self.plugin_capability_runners(user, scope)).as_dict(),
+            context_provider=self._context_provider(user, scope),
+        ))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "1.7.0",
+  "version": "2.0.0",
   "description": "Lattice AI Workspace OS for local-first graph, memory, agent, workflow, and skill operations",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {
@@ -19,7 +19,7 @@
     "dev": "python3 ltcai_cli.py --reload",
     "build": "npm run build:python",
     "build:python": "python3 -m build",
-    "check:python": "python3 -m py_compile ltcai_cli.py server.py latticeai/server_app.py latticeai/api/chat.py latticeai/api/computer_use.py latticeai/api/deps.py latticeai/api/garden.py latticeai/api/local_files.py latticeai/api/permissions.py latticeai/api/setup.py latticeai/api/static_routes.py latticeai/api/tools.py latticeai/services/app_context.py latticeai/services/model_runtime.py latticeai/services/model_catalog.py latticeai/services/model_recommendation.py latticeai/services/tool_dispatch.py latticeai/services/upload_service.py latticeai/core/tool_registry.py latticeai/core/enterprise.py latticeai/core/enterprise_admin.py latticeai/core/agent_prompts.py latticeai/core/workspace_os.py knowledge_graph.py knowledge_graph_api.py local_knowledge_api.py llm_router.py p_reinforce.py telegram_bot.py tools.py codex_telegram_bot.py",
+    "check:python": "python3 -m py_compile ltcai_cli.py server.py latticeai/server_app.py latticeai/api/chat.py latticeai/api/computer_use.py latticeai/api/deps.py latticeai/api/garden.py latticeai/api/local_files.py latticeai/api/permissions.py latticeai/api/setup.py latticeai/api/static_routes.py latticeai/api/tools.py latticeai/api/plugins.py latticeai/api/workflow_designer.py latticeai/api/agents.py latticeai/api/realtime.py latticeai/services/app_context.py latticeai/services/model_runtime.py latticeai/services/model_catalog.py latticeai/services/model_recommendation.py latticeai/services/tool_dispatch.py latticeai/services/upload_service.py latticeai/core/tool_registry.py latticeai/core/enterprise.py latticeai/core/enterprise_admin.py latticeai/core/agent_prompts.py latticeai/core/workspace_os.py latticeai/core/plugins.py latticeai/core/workflow_engine.py latticeai/core/multi_agent.py latticeai/core/realtime.py knowledge_graph.py knowledge_graph_api.py local_knowledge_api.py llm_router.py p_reinforce.py telegram_bot.py tools.py codex_telegram_bot.py",
     "test": "python3 -m pytest tests/ -v",
     "test:unit": "python3 -m pytest tests/unit/ -v",
     "test:integration": "python3 -m pytest tests/integration/ -v",
@@ -68,13 +68,19 @@
     "static/admin.html",
     "static/graph.html",
     "static/workspace.html",
+    "static/plugins.html",
+    "static/workflows.html",
+    "static/agents.html",
+    "static/activity.html",
     "static/manifest.json",
     "static/sw.js",
     "static/lattice-reference.css",
     "static/workspace.css",
+    "static/platform.css",
     "static/scripts/",
     "static/css/",
     "static/icons/",
+    "plugins/",
     "docs/",
     "requirements.txt",
     "README.md"

package/plugins/README.md

@@ -0,0 +1,35 @@
+# Lattice AI Plugins
+
+This directory holds **Plugin SDK** packages discovered by the Lattice AI server
+at runtime. Each plugin is a folder containing a `plugin.json` manifest.
+
+A plugin is an additive, versioned, permissioned unit that **extends** the
+existing Skill / Tool / Workflow surfaces — it never replaces them. Installed
+standalone skills keep working unchanged.
+
+See [`docs/PLUGIN_SDK.md`](../docs/PLUGIN_SDK.md) for the full manifest schema,
+permission model, lifecycle, and execution boundary.
+
+## Bundled examples
+
+| Plugin | What it shows |
+| --- | --- |
+| `hello-world` | Bundling a skill + a workflow template + a declarative action |
+| `git-insights` | Declaring `run_tools` and surfacing read-only git insights through the permission boundary |
+
+## Minimal manifest
+
+```json
+{
+  "id": "my-plugin",
+  "name": "My Plugin",
+  "version": "1.0.0",
+  "description": "What it does.",
+  "lattice_version": ">=2.0.0",
+  "permissions": ["read_workspace"],
+  "provides": { "skills": [], "tools": [], "workflows": [], "actions": [] }
+}
+```
+
+Permissions must be drawn from the SDK allow-list; the execution boundary
+refuses any capability a plugin did not declare and was not granted at install.

package/plugins/git-insights/plugin.json

@@ -0,0 +1,15 @@
+{
+  "id": "git-insights",
+  "name": "Git Insights",
+  "version": "1.0.0",
+  "description": "Example plugin that surfaces read-only git status and log insights through the permissioned tool execution boundary.",
+  "author": "Lattice AI",
+  "lattice_version": ">=2.0.0",
+  "permissions": ["read_workspace", "run_tools"],
+  "provides": {
+    "tools": ["git_status", "git_log"],
+    "actions": ["summarize_repo"]
+  },
+  "entrypoint": "",
+  "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI/blob/main/docs/PLUGIN_SDK.md"
+}

package/plugins/hello-world/plugin.json

@@ -0,0 +1,16 @@
+{
+  "id": "hello-world",
+  "name": "Hello World",
+  "version": "1.0.0",
+  "description": "Example plugin demonstrating the Lattice AI Plugin SDK: bundles a skill, a workflow template, and a greet action.",
+  "author": "Lattice AI",
+  "lattice_version": "2.0.0",
+  "permissions": ["read_workspace", "run_skills"],
+  "provides": {
+    "skills": ["hello_skill"],
+    "workflows": ["hello-workflow"],
+    "actions": ["greet"]
+  },
+  "entrypoint": "",
+  "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI/blob/main/docs/PLUGIN_SDK.md"
+}

package/plugins/hello-world/skills/hello_skill/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: hello_skill
+description: A minimal example skill bundled by the hello-world plugin to show that plugins extend (not replace) the existing skill system.
+---
+
+# Hello Skill
+
+This skill is contributed by the `hello-world` plugin. When the plugin is
+installed, the Plugin SDK registers this skill into the existing Workspace skill
+registry via the same `mark_skill_installed` path used by standalone skills —
+demonstrating that plugins are an additive layer on top of skills.
+
+## Usage
+
+Ask Lattice AI to greet a workspace member, or invoke the plugin action `greet`.

package/static/activity.html

@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Realtime Activity — Lattice AI</title>
+  <link rel="stylesheet" href="/static/platform.css" />
+</head>
+<body>
+  <main>
+    <h1>Realtime Activity</h1>
+    <p class="sub" id="sub">Live presence + activity feed across workspace, graph, agent, and workflow events (SSE).</p>
+
+    <div class="row">
+      <span class="badge" id="connBadge">connecting…</span>
+      <span class="badge" id="presenceBadge">presence: 0</span>
+      <div class="spacer"></div>
+      <button class="ghost" id="clearBtn">Clear view</button>
+    </div>
+
+    <div class="section">
+      <h3>Live feed</h3>
+      <div id="feed"><div class="empty">Waiting for events…</div></div>
+    </div>
+  </main>
+
+  <script type="module">
+    import { mountHeader, api, escapeHtml, badge } from "/static/scripts/platform.js";
+    mountHeader("/activity");
+
+    const feed = document.getElementById("feed");
+    const seen = new Set();
+
+    function renderEvent(ev) {
+      if (ev.seq && seen.has(ev.seq)) return;
+      if (ev.seq) seen.add(ev.seq);
+      if (feed.querySelector(".empty")) feed.innerHTML = "";
+      const node = document.createElement("div");
+      node.className = "timeline-item";
+      node.innerHTML = `<div class="row">${badge(ev.area || "event")} <strong>${escapeHtml(ev.event_type || "")}</strong>
+        <span class="t-meta">${escapeHtml(ev.workspace_id || "personal")} · ${escapeHtml(ev.received_at || ev.timestamp || "")}</span></div>
+        <pre style="max-height:160px">${escapeHtml(JSON.stringify(ev.payload || {}, null, 2))}</pre>`;
+      feed.prepend(node);
+      while (feed.children.length > 100) feed.lastChild.remove();
+    }
+
+    async function refreshPresence() {
+      try {
+        const data = await api("/realtime/presence");
+        document.getElementById("presenceBadge").textContent = `presence: ${data.presence.length}`;
+        document.getElementById("sub").textContent =
+          `Transport: ${data.stats.transport.toUpperCase()} · subscribers: ${data.stats.subscribers} · feed: ${data.stats.feed_size}`;
+      } catch {}
+    }
+
+    document.getElementById("clearBtn").addEventListener("click", () => { feed.innerHTML = `<div class="empty">Cleared.</div>`; });
+
+    // Seed with recent feed, then connect to the SSE stream.
+    api("/realtime/feed?limit=30").then((d) => (d.events || []).reverse().forEach(renderEvent)).catch(() => {});
+
+    const es = new EventSource("/realtime/stream");
+    es.onopen = () => { document.getElementById("connBadge").textContent = "● live"; document.getElementById("connBadge").className = "badge ok"; };
+    es.onerror = () => { document.getElementById("connBadge").textContent = "○ reconnecting"; document.getElementById("connBadge").className = "badge warn"; };
+    es.onmessage = (e) => { try { renderEvent(JSON.parse(e.data)); } catch {} };
+
+    refreshPresence();
+    setInterval(refreshPresence, 8000);
+  </script>
+</body>
+</html>

package/static/agents.html

@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Multi-Agent Runtime — Lattice AI</title>
+  <link rel="stylesheet" href="/static/platform.css" />
+</head>
+<body>
+  <main>
+    <h1>Multi-Agent Runtime</h1>
+    <p class="sub">Planner · Executor · Reviewer · Researcher · Release — with handoff, retry, and an observable timeline.</p>
+
+    <div class="section">
+      <label>Goal</label>
+      <textarea id="goal" placeholder="e.g. Draft a release checklist for v2.0.0">Summarize and verify the latest workspace activity</textarea>
+      <label>Roles (pipeline)</label>
+      <div id="roleChips" class="row"></div>
+      <div class="row" style="margin-top:14px"><button id="runBtn">Run agents</button></div>
+    </div>
+
+    <div class="section">
+      <h3>Run result</h3>
+      <div id="result"><div class="empty">No run yet.</div></div>
+    </div>
+
+    <div class="section">
+      <h3>Recent agent runs</h3>
+      <div id="runs"><div class="empty">Loading…</div></div>
+    </div>
+  </main>
+
+  <script type="module">
+    import { mountHeader, api, escapeHtml, badge, toast } from "/static/scripts/platform.js";
+    mountHeader("/agents");
+
+    const selected = new Set(["planner", "executor", "reviewer"]);
+    async function loadRoles() {
+      const data = await api("/agents/api/roles");
+      document.getElementById("roleChips").innerHTML = data.roles.map((r) =>
+        `<label class="badge" style="cursor:pointer"><input type="checkbox" value="${r.role}" ${selected.has(r.role)?"checked":""} style="width:auto;margin-right:6px">${escapeHtml(r.role)}</label>`
+      ).join(" ");
+      document.getElementById("roleChips").addEventListener("change", (e) => {
+        if (e.target.checked) selected.add(e.target.value); else selected.delete(e.target.value);
+      });
+    }
+
+    function renderTimeline(timeline) {
+      return (timeline || []).map((t) => {
+        const label = t.event === "handoff" ? `↪ handoff ${escapeHtml(t.from)} → ${escapeHtml(t.to)}`
+          : t.event === "role" ? `● ${escapeHtml(t.role)} ${badge(t.status)}`
+          : `· ${escapeHtml(t.event)}`;
+        return `<div class="timeline-item">${label}<div class="t-meta">${escapeHtml(t.note||t.timestamp||"")}</div></div>`;
+      }).join("");
+    }
+
+    document.getElementById("runBtn").addEventListener("click", async () => {
+      const btn = document.getElementById("runBtn");
+      btn.disabled = true;
+      try {
+        const res = await api("/agents/api/run", { method: "POST", body: JSON.stringify({
+          goal: document.getElementById("goal").value, roles: [...selected], inputs: {}
+        }) });
+        const r = res.result;
+        document.getElementById("result").innerHTML = `
+          <div class="card">
+            <div class="row"><h3>${escapeHtml(r.output)}</h3><div class="spacer"></div>${badge(r.status)}</div>
+            <div class="meta">retries: ${r.retries} · roles: ${(r.roles_run||[]).join(" → ")}</div>
+            <div class="section">${renderTimeline(r.timeline)}</div>
+          </div>`;
+        toast(`Agent run: ${r.status}`);
+        await loadRuns();
+      } catch (err) { toast(err.message); } finally { btn.disabled = false; }
+    });
+
+    async function loadRuns() {
+      const data = await api("/agents/api/runs");
+      const runs = data.runs || [];
+      const box = document.getElementById("runs");
+      if (!runs.length) { box.innerHTML = `<div class="empty">No agent runs yet.</div>`; return; }
+      box.innerHTML = runs.slice(0, 20).map((r) => `
+        <div class="card" style="margin-bottom:10px">
+          <div class="row"><h3>${escapeHtml((r.input||"").slice(0,80))}</h3><div class="spacer"></div>${badge(r.status)}</div>
+          <div class="meta">${escapeHtml(r.agent_id)} · ${escapeHtml(r.created_at)} · ${(r.timeline||[]).length} timeline events</div>
+        </div>`).join("");
+    }
+
+    loadRoles().catch((e) => toast(e.message));
+    loadRuns().catch(() => {});
+  </script>
+</body>
+</html>

package/static/platform.css

@@ -0,0 +1,75 @@
+/* Lattice AI v2.0 — shared styling for the Agentic Workspace Platform pages
+   (Plugin SDK, Workflow Designer, Multi-Agent Runtime, Realtime Activity). */
+:root {
+  --bg: #0f1115;
+  --panel: #16191f;
+  --panel-2: #1c2027;
+  --border: rgba(255, 255, 255, 0.08);
+  --text: #e7ecf3;
+  --muted: #94a3b8;
+  --accent: #378ADD;
+  --accent-2: #5ea7ec;
+  --ok: #34d399;
+  --warn: #fbbf24;
+  --err: #f87171;
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", sans-serif;
+  line-height: 1.5;
+}
+a { color: var(--accent-2); text-decoration: none; }
+header.app {
+  display: flex; align-items: center; gap: 18px;
+  padding: 14px 24px; border-bottom: 1px solid var(--border);
+  background: rgba(22, 25, 31, 0.8); position: sticky; top: 0; backdrop-filter: blur(8px); z-index: 5;
+}
+header.app .brand { font-weight: 700; font-size: 16px; color: #fff; letter-spacing: .3px; }
+header.app .brand small { color: var(--accent); font-weight: 600; margin-left: 6px; }
+header.app nav { display: flex; gap: 14px; flex-wrap: wrap; }
+header.app nav a { color: var(--muted); font-size: 13px; padding: 4px 6px; border-radius: 6px; }
+header.app nav a:hover, header.app nav a.active { color: #fff; background: var(--panel-2); }
+main { max-width: 1080px; margin: 0 auto; padding: 28px 24px 80px; }
+h1 { font-size: 22px; margin: 0 0 4px; }
+.sub { color: var(--muted); font-size: 13px; margin: 0 0 24px; }
+.grid { display: grid; gap: 14px; grid-template-columns: repeat(auto-fill, minmax(300px, 1fr)); }
+.card {
+  background: var(--panel); border: 1px solid var(--border); border-radius: 14px;
+  padding: 16px 18px;
+}
+.card h3 { margin: 0 0 6px; font-size: 15px; }
+.card .meta { color: var(--muted); font-size: 12px; }
+.row { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+.spacer { flex: 1; }
+.badge {
+  display: inline-block; font-size: 11px; padding: 2px 8px; border-radius: 999px;
+  background: var(--panel-2); color: var(--muted); border: 1px solid var(--border);
+}
+.badge.ok { color: var(--ok); border-color: rgba(52,211,153,.4); }
+.badge.warn { color: var(--warn); border-color: rgba(251,191,36,.4); }
+.badge.err { color: var(--err); border-color: rgba(248,113,113,.4); }
+button, .btn {
+  background: var(--accent); color: #fff; border: none; border-radius: 8px;
+  padding: 7px 14px; font-size: 13px; cursor: pointer; font-weight: 600;
+}
+button.ghost { background: var(--panel-2); color: var(--text); border: 1px solid var(--border); }
+button:hover { filter: brightness(1.08); }
+button:disabled { opacity: .5; cursor: not-allowed; }
+textarea, input, select {
+  width: 100%; background: var(--panel-2); color: var(--text); border: 1px solid var(--border);
+  border-radius: 8px; padding: 9px 11px; font-size: 13px; font-family: inherit;
+}
+textarea { min-height: 90px; resize: vertical; }
+label { display: block; font-size: 12px; color: var(--muted); margin: 10px 0 4px; }
+pre {
+  background: #0b0d11; border: 1px solid var(--border); border-radius: 10px;
+  padding: 12px; overflow: auto; font-size: 12px; color: #cbd5e1; max-height: 360px;
+}
+.empty { color: var(--muted); text-align: center; padding: 50px 0; }
+.section { margin-top: 28px; }
+.timeline-item { border-left: 2px solid var(--border); padding: 6px 0 6px 14px; margin-left: 6px; font-size: 13px; }
+.timeline-item .t-meta { color: var(--muted); font-size: 11px; }
+.toast { position: fixed; bottom: 20px; right: 20px; background: var(--panel-2); border: 1px solid var(--border); padding: 12px 16px; border-radius: 10px; font-size: 13px; max-width: 360px; }

package/static/plugins.html

@@ -0,0 +1,82 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Plugin SDK — Lattice AI</title>
+  <link rel="stylesheet" href="/static/platform.css" />
+</head>
+<body>
+  <main>
+    <h1>Plugin SDK</h1>
+    <p class="sub" id="sub">Versioned, permissioned plugins that extend skills, tools, and workflows.</p>
+    <div id="list" class="grid"><div class="empty">Loading plugins…</div></div>
+
+    <div class="section">
+      <h3>Validate a manifest</h3>
+      <p class="sub">Paste a <code>plugin.json</code> to check it against the SDK schema and permission allow-list.</p>
+      <textarea id="manifest" spellcheck="false">{
+  "id": "my-plugin",
+  "name": "My Plugin",
+  "version": "1.0.0",
+  "lattice_version": ">=2.0.0",
+  "permissions": ["read_workspace"],
+  "provides": { "skills": [] }
+}</textarea>
+      <div class="row" style="margin-top:10px"><button id="validate">Validate</button></div>
+      <pre id="validateOut" style="display:none"></pre>
+    </div>
+  </main>
+
+  <script type="module">
+    import { mountHeader, api, escapeHtml, badge, toast } from "/static/scripts/platform.js";
+    mountHeader("/plugins/sdk");
+
+    async function load() {
+      const data = await api("/plugins/registry");
+      document.getElementById("sub").textContent =
+        `SDK v${data.sdk_version} · ${data.total} plugin(s) discovered in ${data.plugins_dir}`;
+      const list = document.getElementById("list");
+      if (!data.plugins.length) { list.innerHTML = `<div class="empty">No plugins found.</div>`; return; }
+      list.innerHTML = data.plugins.map((p) => `
+        <div class="card">
+          <div class="row"><h3>${escapeHtml(p.name)}</h3><div class="spacer"></div>
+            ${badge(p.installed ? (p.enabled ? "ready" : "available") : "available")}</div>
+          <div class="meta">v${escapeHtml(p.version)} · ${escapeHtml(p.author || "unknown")} · ${p.compatible ? "compatible" : "<span class='badge err'>incompatible</span>"}</div>
+          <p style="font-size:13px;color:#cbd5e1">${escapeHtml(p.description)}</p>
+          <div class="meta">Permissions: ${(p.permissions||[]).map(x=>`<span class="badge">${escapeHtml(x)}</span>`).join(" ") || "none"}</div>
+          <div class="meta" style="margin-top:6px">Provides: ${Object.entries(p.provides||{}).map(([k,v])=>`${k}(${(v||[]).length})`).join(", ") || "—"}</div>
+          <div class="row" style="margin-top:12px">
+            ${p.installed
+              ? `<button class="ghost" data-act="${p.enabled?"disable":"enable"}" data-id="${p.id}">${p.enabled?"Disable":"Enable"}</button>
+                 <button class="ghost" data-act="uninstall" data-id="${p.id}">Uninstall</button>`
+              : `<button data-act="install" data-id="${p.id}" ${p.compatible?"":"disabled"}>Install</button>`}
+          </div>
+        </div>`).join("");
+    }
+
+    document.getElementById("list").addEventListener("click", async (e) => {
+      const btn = e.target.closest("button[data-act]");
+      if (!btn) return;
+      btn.disabled = true;
+      try {
+        await api(`/plugins/${btn.dataset.act}`, { method: "POST", body: JSON.stringify({ plugin_id: btn.dataset.id }) });
+        toast(`${btn.dataset.act}: ${btn.dataset.id}`);
+        await load();
+      } catch (err) { toast(err.message); btn.disabled = false; }
+    });
+
+    document.getElementById("validate").addEventListener("click", async () => {
+      const out = document.getElementById("validateOut");
+      out.style.display = "block";
+      try {
+        const manifest = JSON.parse(document.getElementById("manifest").value);
+        const res = await api("/plugins/validate", { method: "POST", body: JSON.stringify({ manifest }) });
+        out.textContent = JSON.stringify(res, null, 2);
+      } catch (err) { out.textContent = "Error: " + err.message; }
+    });
+
+    load().catch((e) => toast(e.message));
+  </script>
+</body>
+</html>