ltcai 10.0.0 → 10.3.0

package/latticeai/core/local_embeddings.py

@@ -77,7 +77,18 @@ class LocalEmbeddingModel:
         return [value / norm for value in vector]
 
     def similarity(self, left: Iterable[float], right: Iterable[float]) -> float:
-        return float(sum(a * b for a, b in zip(left, right)))
+        # strict=True: a dimension mismatch means the two vectors came from
+        # different embedding models. Truncating to the shorter one produces a
+        # plausible-looking similarity that is meaningless — exactly the silent
+        # wrongness this codebase keeps finding. Callers that can hit a model
+        # swap already handle failure and fall back to lexical search.
+        left_v, right_v = list(left), list(right)
+        if len(left_v) != len(right_v):
+            raise ValueError(
+                f"embedding dimension mismatch: {len(left_v)} vs {len(right_v)}; "
+                "the vector index was built with a different model"
+            )
+        return float(sum(a * b for a, b in zip(left_v, right_v, strict=True)))
 
     def encode(self, vector: Iterable[float]) -> bytes:
         values = list(vector)

package/latticeai/core/marketplace.py

@@ -10,8 +10,7 @@ from __future__ import annotations
 from copy import deepcopy
 from typing import Any, Dict, List, Optional
 
-
-MARKETPLACE_VERSION = "10.0.0"
+MARKETPLACE_VERSION = "10.3.0"
 TEMPLATE_KINDS = ("plugin", "workflow", "agent", "ingestion_bridge")
 
 

package/latticeai/core/mcp_registry.py

@@ -17,7 +17,6 @@ import httpx
 from fastapi import HTTPException
 
 # ── MCP Registry (built-in tool definitions) ─────────────────────────────────
-
 # Built-in MCP server catalog data → .mcp_catalog (re-exported).
 from .mcp_catalog import MCP_REGISTRY  # noqa: F401
 

package/latticeai/core/model_compat.py

@@ -18,7 +18,7 @@ import logging
 import re
 import threading
 import time
-from dataclasses import dataclass, asdict
+from dataclasses import asdict, dataclass
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 

package/latticeai/core/model_resolution.py

@@ -19,7 +19,7 @@
 from __future__ import annotations
 
 import logging
-from dataclasses import dataclass, field, asdict
+from dataclasses import asdict, dataclass, field
 from enum import Enum
 from typing import Any, Dict, List, Optional
 

package/latticeai/core/network_boundary.py

@@ -0,0 +1,168 @@
+"""Network boundary modes for hybrid local + cloud LLM usage.
+
+Local-first principle: the Knowledge Graph and all durable memory stay on the
+machine. Cloud LLMs are an explicit, opt-in worker. This module defines the
+dial that controls whether any knowledge is allowed to leave the host.
+
+Modes
+-----
+* ``local_only``   — default. No chat context is ever sent to a cloud provider.
+* ``cloud_allowed`` — user has explicitly opted in. Only the *minimal* related
+  nodes selected by the hybrid context extractor may be sent. Sensitive types
+  and hard filters still apply (mode-invariant).
+
+The mode is orthogonal to PermissionMode (agent autonomy). A session can be
+``cloud_allowed`` + ``strict`` at the same time.
+"""
+
+from __future__ import annotations
+
+from enum import Enum
+from typing import Any, Dict, FrozenSet, Mapping, Optional
+
+
+class NetworkBoundaryMode(str, Enum):
+    LOCAL_ONLY = "local_only"
+    CLOUD_ALLOWED = "cloud_allowed"
+
+
+DEFAULT_NETWORK_MODE = NetworkBoundaryMode.LOCAL_ONLY
+
+# Node types that must never be included in a cloud payload, regardless of mode.
+# Extend carefully; this is a hard circuit breaker.
+#
+# This was empty through 10.1.x ("keep empty for v1 scaffolding"), which meant
+# the type arm of the filter could never fire. Combined with nothing being able
+# to *set* the metadata flags below, the whole guard was unreachable — correct
+# code protecting nothing.
+HARD_BLOCK_NODE_TYPES: FrozenSet[str] = frozenset({
+    "Credential",
+    "Secret",
+    "ApiKey",
+    "Token",
+    "Password",
+    "PrivateKey",
+})
+
+# Metadata keys that, when present and truthy, block a node from leaving.
+HARD_BLOCK_METADATA_FLAGS: FrozenSet[str] = frozenset({
+    "sensitive",
+    "private",
+    "do_not_share",
+    "local_only",
+})
+
+# Path-based never-leaves rules live in Brain Core: they describe the data, not
+# the transport, and Brain Core cannot import from this package. Re-exported
+# here so the boundary module stays the single place the app layer reads.
+from lattice_brain.sensitivity import (  # noqa: E402
+    SENSITIVE_FILENAMES,
+    SENSITIVE_PATH_FRAGMENTS,
+    sensitive_reason_for_path,
+)
+
+
+def normalize_network_mode(value: Any) -> NetworkBoundaryMode:
+    """Parse user/API/env input into a NetworkBoundaryMode; unknown → local_only."""
+    if isinstance(value, NetworkBoundaryMode):
+        return value
+    text = str(value or "").strip().lower()
+    aliases = {
+        "local_only": NetworkBoundaryMode.LOCAL_ONLY,
+        "local": NetworkBoundaryMode.LOCAL_ONLY,
+        "local-only": NetworkBoundaryMode.LOCAL_ONLY,
+        "offline": NetworkBoundaryMode.LOCAL_ONLY,
+        "cloud_allowed": NetworkBoundaryMode.CLOUD_ALLOWED,
+        "cloud": NetworkBoundaryMode.CLOUD_ALLOWED,
+        "cloud-allowed": NetworkBoundaryMode.CLOUD_ALLOWED,
+        "hybrid": NetworkBoundaryMode.CLOUD_ALLOWED,
+        "online": NetworkBoundaryMode.CLOUD_ALLOWED,
+    }
+    return aliases.get(text, DEFAULT_NETWORK_MODE)
+
+
+def network_mode_catalog() -> list[Dict[str, Any]]:
+    """UI/API catalog for the network boundary selector."""
+    return [
+        {
+            "id": NetworkBoundaryMode.LOCAL_ONLY.value,
+            "label": "Local only",
+            "label_ko": "로컬만",
+            "summary": "Nothing leaves this machine. Answers use local models and the local Brain only.",
+            "summary_ko": "이 컴퓨터를 벗어나지 않습니다. 로컬 모델과 로컬 Brain만 사용합니다.",
+            "risk": "low",
+            "requires_ack": False,
+        },
+        {
+            "id": NetworkBoundaryMode.CLOUD_ALLOWED.value,
+            "label": "Cloud streaming allowed",
+            "label_ko": "클라우드 스트리밍 허용",
+            "summary": (
+                "Minimal related Knowledge Graph nodes may be sent to a cloud LLM. "
+                "The streamed answer is written back into the local Brain with provenance."
+            ),
+            "summary_ko": (
+                "관련된 최소 Knowledge Graph 노드만 클라우드 LLM으로 전송될 수 있습니다. "
+                "스트리밍 답변은 provenance와 함께 로컬 Brain에 다시 기록됩니다."
+            ),
+            "risk": "medium",
+            "requires_ack": True,
+            "warning": (
+                "Cloud mode sends a compact summary of selected local nodes to an external provider. "
+                "Sensitive nodes remain blocked. You can switch back to Local only at any time."
+            ),
+            "warning_ko": (
+                "클라우드 모드는 선택된 로컬 노드의 압축 요약을 외부 제공자에게 전송합니다. "
+                "민감 노드는 계속 차단됩니다. 언제든지 로컬만으로 되돌릴 수 있습니다."
+            ),
+        },
+    ]
+
+
+def is_node_blocked_for_cloud(node: Mapping[str, Any]) -> Optional[str]:
+    """Return a reason string when this node must never leave the host."""
+    node_type = str(node.get("type") or "")
+    if node_type in HARD_BLOCK_NODE_TYPES:
+        return f"node type {node_type!r} is blocked from cloud payloads"
+
+    meta = node.get("metadata") or {}
+    if not isinstance(meta, Mapping):
+        return None
+    for flag in HARD_BLOCK_METADATA_FLAGS:
+        if meta.get(flag):
+            return f"node flagged {flag!r} is blocked from cloud payloads"
+    return None
+
+
+def network_mode_contract(mode: NetworkBoundaryMode | str) -> Dict[str, Any]:
+    """Serializable contract for API / agent / UI."""
+    mode = normalize_network_mode(mode)
+    entry = next(
+        (m for m in network_mode_catalog() if m["id"] == mode.value),
+        network_mode_catalog()[0],
+    )
+    return {
+        "mode": mode.value,
+        "label": entry["label"],
+        "label_ko": entry["label_ko"],
+        "risk": entry["risk"],
+        "requires_ack": entry["requires_ack"],
+        "allows_cloud": mode == NetworkBoundaryMode.CLOUD_ALLOWED,
+        "hard_block_node_types": sorted(HARD_BLOCK_NODE_TYPES),
+        "hard_block_metadata_flags": sorted(HARD_BLOCK_METADATA_FLAGS),
+    }
+
+
+__all__ = [
+    "NetworkBoundaryMode",
+    "DEFAULT_NETWORK_MODE",
+    "HARD_BLOCK_NODE_TYPES",
+    "HARD_BLOCK_METADATA_FLAGS",
+    "normalize_network_mode",
+    "network_mode_catalog",
+    "is_node_blocked_for_cloud",
+    "sensitive_reason_for_path",
+    "SENSITIVE_PATH_FRAGMENTS",
+    "SENSITIVE_FILENAMES",
+    "network_mode_contract",
+]

package/latticeai/core/oidc.py

@@ -25,6 +25,8 @@ import json
 import time
 from typing import Any, Dict, List, Optional
 
+from latticeai.core.quiet import quiet
+
 
 class OIDCValidationError(Exception):
     """Raised when an OIDC ID token fails any validation step (fail-closed)."""
@@ -116,6 +118,7 @@ def _verify_signature(token: str, jwks: Any) -> Dict[str, Any]:
             public_key = _public_key_from_jwk(jwk)
             public_key.verify(signature, signing_input, padding.PKCS1v15(), hash_obj)
         except (InvalidSignature, OIDCValidationError):
+            quiet()
             continue
         # Signature verified — now it is safe to parse the claims.
         try:

package/latticeai/core/permission_mode.py

@@ -22,7 +22,7 @@ Circuit breakers are mode-invariant: a mode never overrides a hard deny.
 from __future__ import annotations
 
 from enum import Enum
-from typing import Any, Dict, Mapping, Optional, Set
+from typing import Any, Dict, FrozenSet, Mapping, Optional
 
 
 class PermissionMode(str, Enum):
@@ -34,7 +34,7 @@ class PermissionMode(str, Enum):
 DEFAULT_MODE = PermissionMode.STRICT
 
 # Computer-use split: observation is low-friction in trusted; control stays gated.
-COMPUTER_OBSERVATION_TOOLS: Set[str] = frozenset({
+COMPUTER_OBSERVATION_TOOLS: FrozenSet[str] = frozenset({
     "computer_screenshot",
     "computer_status",
     "computer_use_status",
@@ -42,7 +42,7 @@ COMPUTER_OBSERVATION_TOOLS: Set[str] = frozenset({
     "vision_analyze",
 })
 
-COMPUTER_CONTROL_TOOLS: Set[str] = frozenset({
+COMPUTER_CONTROL_TOOLS: FrozenSet[str] = frozenset({
     "computer_click",
     "computer_type",
     "computer_key",
@@ -53,7 +53,7 @@ COMPUTER_CONTROL_TOOLS: Set[str] = frozenset({
     "computer_open_url",
 })
 
-KNOWLEDGE_READ_TOOLS: Set[str] = frozenset({
+KNOWLEDGE_READ_TOOLS: FrozenSet[str] = frozenset({
     "knowledge_search",
     "knowledge_tree",
     "obsidian_search",
@@ -63,7 +63,7 @@ KNOWLEDGE_READ_TOOLS: Set[str] = frozenset({
     "knowledge_graph_context",
 })
 
-WORKSPACE_WRITE_TOOLS: Set[str] = frozenset({
+WORKSPACE_WRITE_TOOLS: FrozenSet[str] = frozenset({
     "write_file",
     "edit_file",
     "create_docx",
@@ -78,7 +78,7 @@ WORKSPACE_WRITE_TOOLS: Set[str] = frozenset({
 })
 
 # Always blocked regardless of mode (Claude-style circuit breakers).
-HARD_BLOCK_SANDBOXES: Set[str] = frozenset({"system"})
+HARD_BLOCK_SANDBOXES: FrozenSet[str] = frozenset({"system"})
 
 
 def normalize_mode(value: Any) -> PermissionMode:

package/latticeai/core/plugins.py

@@ -29,6 +29,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional, Tuple
 
+from latticeai.core.quiet import quiet
 
 PLUGIN_SDK_VERSION = "2.2.0"
 
@@ -309,7 +310,7 @@ class PluginRegistry:
                     register_skill(skill_name, plugin_id)
                     registered_skills.append(skill_name)
                 except Exception:  # pragma: no cover - skill registration is best-effort
-                    pass
+                    quiet()
         entry = {}
         if self.store is not None:
             entry = self.store.mark_plugin_installed(
@@ -366,7 +367,7 @@ class PluginRegistry:
                 try:
                     self.store.record_timeline_event("plugins", event_type, payload, workspace_id=workspace_id)
                 except Exception:
-                    pass
+                    quiet()
 
         emit("plugin_started", {"plugin_id": plugin_id, "action": action})
 

package/latticeai/core/policy.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 from typing import Dict, Iterable, List, Set
 
-
 ROLE_CAPABILITIES: Dict[str, Set[str]] = {
     "owner": {"all"},
     "admin": {

package/latticeai/core/quiet.py

@@ -0,0 +1,84 @@
+"""Deliberately-ignored exceptions, recorded instead of erased.
+
+A local-first app that talks to optional hardware, optional models, optional
+network paths and user files legitimately swallows a lot. ``except Exception:
+pass`` is often the right *behaviour* — a failed probe should not take the
+server down. What is not right is that the failure leaves no trace at all: a
+genuine bug in one of those paths is indistinguishable from the optional thing
+simply being absent, and nobody ever finds out.
+
+``quiet()`` keeps the behaviour and removes the silence. It logs the live
+exception at DEBUG with the file, function and line that suppressed it, so the
+default experience is unchanged and ``LATTICEAI_LOG_LEVEL=DEBUG`` turns every
+swallowed failure into a line you can read.
+
+    try:
+        probe_optional_thing()
+    except Exception:
+        quiet("optional GPU probe")
+
+The label is optional; without one the call site is still identified. Pass one
+when the location alone would not tell a reader *why* failure is acceptable.
+"""
+
+from __future__ import annotations
+
+import logging
+import sys
+import traceback
+from typing import Optional
+
+logger = logging.getLogger("latticeai.suppressed")
+
+
+def quiet(reason: Optional[str] = None, *, level: int = logging.DEBUG) -> None:
+    """Record the exception currently being handled, then continue.
+
+    Safe to call outside an ``except`` block (it becomes a no-op) so a refactor
+    that moves it cannot itself raise.
+    """
+    exc_type, exc, tb = sys.exc_info()
+    if exc is None:
+        return
+
+    where = "<unknown>"
+    if tb is not None:
+        # The frame that raised is the useful one; walk to the deepest.
+        deepest = tb
+        while deepest.tb_next is not None:
+            deepest = deepest.tb_next
+        frame = deepest.tb_frame
+        where = f"{frame.f_code.co_filename}:{frame.f_lineno} in {frame.f_code.co_name}"
+
+    label = f" ({reason})" if reason else ""
+    if logger.isEnabledFor(level):
+        logger.log(
+            level,
+            "suppressed %s at %s%s: %s",
+            getattr(exc_type, "__name__", "Exception"),
+            where,
+            label,
+            exc,
+            exc_info=exc,
+        )
+
+
+def quiet_summary(reason: Optional[str] = None) -> str:
+    """One-line description of the live exception, for callers that report it."""
+    exc_type, exc, _ = sys.exc_info()
+    if exc is None:
+        return ""
+    name = getattr(exc_type, "__name__", "Exception")
+    text = str(exc).strip() or name
+    return f"{reason}: {text}" if reason else text
+
+
+def format_suppressed() -> str:
+    """Full traceback of the live exception as text (for diagnostics payloads)."""
+    exc_type, exc, tb = sys.exc_info()
+    if exc is None:
+        return ""
+    return "".join(traceback.format_exception(exc_type, exc, tb))
+
+
+__all__ = ["quiet", "quiet_summary", "format_suppressed"]

package/latticeai/core/realtime.py

@@ -32,8 +32,9 @@ import threading
 from typing import Any, AsyncIterator, Callable, Dict, List, Optional, Set
 
 from lattice_brain.runtime.contracts import realtime_event_contract
-from .timeutil import now_iso as _now
+from latticeai.core.quiet import quiet
 
+from .timeutil import now_iso as _now
 
 REALTIME_VERSION = "2.2.0"
 _FEED_LIMIT = 200
@@ -120,7 +121,7 @@ class RealtimeBus:
                 sub.queue.get_nowait()  # drop oldest
                 sub.queue.put_nowait(event)
             except Exception:
-                pass
+                quiet()
 
     # The store calls ``event_sink(event)`` positionally; expose a stable alias.
     def __call__(self, event: Dict[str, Any]) -> Dict[str, Any]:

package/latticeai/core/run_store.py

@@ -33,6 +33,7 @@ from typing import Any, Dict, List, Optional
 
 from latticeai.core.agent import AgentRunContext, AgentState
 from latticeai.core.agent_trace import LoopTrace
+from latticeai.core.quiet import quiet
 
 LOGGER = logging.getLogger(__name__)
 
@@ -148,7 +149,7 @@ class AgentRunStore:
                     try:
                         os.unlink(tmp_name)
                     except OSError:
-                        pass
+                        quiet()
             return True
         except Exception as exc:  # noqa: BLE001 — pause must still answer without disk
             LOGGER.warning("agent run store save failed for %s: %s", run_id, exc)
@@ -193,6 +194,7 @@ class AgentRunStore:
             try:
                 record = json.loads(path.read_text(encoding="utf-8"))
             except Exception:  # noqa: BLE001
+                quiet()
                 continue
             if not isinstance(record, dict):
                 continue
@@ -238,7 +240,7 @@ class AgentRunStore:
                     path.unlink(missing_ok=True)
                     removed += 1
                 except OSError:
-                    pass
+                    quiet()
         return removed
 
 

package/latticeai/core/security.py

@@ -10,6 +10,8 @@ from typing import Any, Dict, List
 
 from fastapi import HTTPException
 
+from latticeai.core.quiet import quiet
+
 
 def hash_password(password: str) -> str:
     salt = secrets.token_hex(16)
@@ -65,6 +67,7 @@ def configure_trusted_proxies(values) -> int:
         try:
             networks.append(ipaddress.ip_network(item, strict=False))
         except ValueError:
+            quiet()
             continue
     _trusted_proxies = networks
     return len(networks)
@@ -93,6 +96,7 @@ def client_ip(request) -> str:
                     ipaddress.ip_address(candidate)
                     return candidate
                 except ValueError:
+                    quiet()
                     continue
     return peer or "unknown"
 

package/latticeai/core/users.py

@@ -6,13 +6,15 @@ import json
 import shutil
 import sqlite3
 import uuid
+from contextlib import closing
 from pathlib import Path
 from typing import Any, Dict, Optional
 
+from latticeai.core.quiet import quiet
+
 from .io_utils import atomic_write_json
 from .timeutil import now_iso as _now
 
-
 USER_NAMESPACE = uuid.UUID("5d6d4480-cf79-49c3-a6d0-4c6eec3224d6")
 
 
@@ -76,7 +78,7 @@ def load_users_file(path: Path) -> Dict[str, Any]:
         try:
             shutil.copy2(path, backup)
         except Exception:
-            pass
+            quiet()
         atomic_write_json(path, migrated)
     return migrated
 
@@ -112,7 +114,7 @@ def migrate_knowledge_graph_identity(db_path: Path, email_to_id: Dict[str, str])
     if not db_path.exists() or not email_to_id:
         return 0
     changed = 0
-    with sqlite3.connect(db_path) as conn:
+    with closing(sqlite3.connect(db_path)) as conn, conn:
         tables = {
             row[0] for row in conn.execute("SELECT name FROM sqlite_master WHERE type='table'")
         }

package/latticeai/core/workspace_graph_trace.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, List, Optional
 
+from latticeai.core.quiet import quiet
+
 from .timeutil import now_iso as _now
 from .workspace_os_utils import _json_hash, _listify
 
@@ -97,6 +99,7 @@ class WorkspaceGraphTrace:
                     if len(edges) >= 24:
                         break
             except Exception:
+                quiet()
                 continue
 
         if matches: