ltcai 10.5.0 → 10.6.2

package/latticeai/core/agent.py

@@ -80,8 +80,9 @@ from latticeai.core.permission_mode import (
     plan_requires_approval,
     should_stage_proposal,
 )
+from latticeai.core.tool_governor import classify_tool_call
 from latticeai.core.tool_registry import SCOPED_KNOWLEDGE_TOOLS
-from latticeai.tools import ToolError
+from latticeai.tools import ToolError, document_output_target
 
 __all__ = [
     # this module
@@ -293,6 +294,27 @@ class SingleAgentRuntime:
             self.deps, ctx, user_email=user_email, workspace_id=workspace_id,
         )
 
+    def _governed_path_exists(self, name: str, path: str) -> bool:
+        """Does this tool call's *real* target already exist?
+
+        The document creators sanitize ``filename`` into their own output
+        directory, so the raw argument is resolved through
+        :func:`document_output_target` first — checking it verbatim would
+        inspect a path nothing ever writes and the fail-closed overwrite guard
+        would never fire. Workspace-relative paths resolve under
+        ``deps.agent_root``; absolute paths (home-sandbox writes) are honored
+        as-is. Never raises: governance must not be able to crash the loop, and
+        an unresolvable path degrades to "new file", which the remaining gates
+        still cover.
+        """
+        try:
+            candidate = Path(document_output_target(name, path) or path)
+            if not candidate.is_absolute():
+                candidate = Path(self.deps.agent_root) / candidate
+            return candidate.exists()
+        except Exception:  # noqa: BLE001 — classification is best-effort
+            return False
+
     def _governed_tools(self) -> FrozenSet[str]:
         governor = getattr(self.deps, "change_governor", None)
         if governor is None:
@@ -833,11 +855,11 @@ class SingleAgentRuntime:
         self, ctx: AgentRunContext, req: Any, name: str, thoughts: str, args: dict,
         policy: Mapping[str, Any], risk: str, current_user: str, governor_allows_additive: bool,
     ) -> bool:
-        """Destructive / circuit-breaker / explicit-approval gates.
+        """Destructive / circuit-breaker / fail-closed-overwrite / approval gates.
 
         Returns True when the step was blocked. The active permission mode can
         widen what runs without an extra approval prompt, but never widens a
-        circuit breaker or the destructive gate.
+        circuit breaker, the destructive gate, or the overwrite check.
         """
         d = self.deps
         mode = self.resolve_permission_mode(
@@ -876,6 +898,49 @@ class SingleAgentRuntime:
             )
             return True
 
+        # Fail-closed overwrite guard — mode-invariant, like the two above.
+        # A call that rewrites existing content but cannot be staged as a
+        # reviewable proposal (binary document creators, home-sandbox writes)
+        # has no safe apply path in ANY mode: trusted/bypass skip the approval
+        # *prompt*, they never remove the existence check. Without this the
+        # loop silently overwrote files that the HTTP surface refuses with 409
+        # (``ToolDispatchService.enforce_policy``).
+        overwrite = classify_tool_call(
+            name, args, policy=dict(policy),
+            path_exists=lambda candidate: self._governed_path_exists(name, candidate),
+        )
+        if overwrite.get("fail_closed"):
+            target = str(args.get("path") or args.get("filename") or "")
+            error = (
+                f"NEEDS_REVIEW: '{name}' 은(는) 이미 있는 파일 '{target}' 을(를) 덮어씁니다. "
+                "이 도구의 변경은 검토 가능한 제안으로 만들 수 없어 실행하지 않았습니다. "
+                "새 파일 이름으로 만들거나 write_file/edit_file 로 수정하세요."
+            )
+            ctx.trace.tool("execute", name=name, outcome="blocked_overwrite", risk=risk)
+            self._emit_step(ctx, "execute", "blocked", action=name, reason="overwrite")
+            ctx.transcript.append({
+                "state": AgentState.EXECUTING.value, "action": name,
+                "thoughts": thoughts,
+                # Same shape as a staged proposal: the payload is never worth
+                # replaying into the transcript, only the decision is.
+                "args": {k: v for k, v in args.items() if k != "content"},
+                "risk": risk,
+                "governance": dict(policy),
+                "permission_mode": mode.value,
+                "change_class": overwrite.get("change_class"),
+                "error": error,
+            })
+            d.audit(
+                "agent_blocked", user_email=current_user,
+                source=getattr(req, "source", None) or "agent",
+                action=name, reason="overwrite_fail_closed",
+                path=target or None,
+                change_class=overwrite.get("change_class"),
+                permission_mode=mode.value,
+                governance=dict(policy),
+            )
+            return True
+
         reason = block_reason_for_tool(
             mode, name, policy, args,
             approved_by_human=bool(ctx.approved_by_human),

package/latticeai/core/config.py

@@ -95,6 +95,7 @@ class Config:
     allow_plaintext_api_keys: bool
     cors_allow_network: bool
     cors_extra_origins: List[str]
+    csrf_trusted_origins: List[str]
     rate_limit_enabled: bool
     open_registration: bool
     invite_code: str
@@ -163,6 +164,10 @@ class Config:
         externally_reachable = is_public or network_exposed
 
         cors_extra = [item.strip() for item in _value(env, "LATTICEAI_CORS_ALLOWED_ORIGINS", "").split(",") if item.strip()]
+        # Browser origins allowed to send *cookie-authenticated* writes. The
+        # server's own origin and loopback are added by the CSRF guard itself;
+        # this is the escape hatch for a reverse-proxied public hostname.
+        csrf_trusted_origins = [item.strip() for item in _value(env, "LATTICEAI_CSRF_TRUSTED_ORIGINS", "").split(",") if item.strip()]
         admin_emails = [item.strip().lower() for item in _value(env, "LATTICEAI_ADMIN_EMAILS", "").split(",") if item.strip()]
         trusted_proxies = [item.strip() for item in _value(env, "LATTICEAI_TRUSTED_PROXIES", "").split(",") if item.strip()]
 
@@ -201,6 +206,7 @@ class Config:
             allow_plaintext_api_keys=_bool(env, "LATTICEAI_ALLOW_PLAINTEXT_API_KEYS", default=False),
             cors_allow_network=_bool(env, "LATTICEAI_CORS_ALLOW_NETWORK", default=False),
             cors_extra_origins=cors_extra,
+            csrf_trusted_origins=csrf_trusted_origins,
             rate_limit_enabled=_str(env, "LATTICEAI_RATE_LIMIT", "1") != "0",
             # Public/LAN startup is closed-registration even if a stale or
             # unsafe environment file attempts to opt back in.

package/latticeai/core/csrf.py

@@ -0,0 +1,293 @@
+"""Origin/Referer guard for cookie-authenticated state changes.
+
+The ``session_token`` cookie is ``SameSite=Lax``, which stops cross-site
+*top-level GET-like* navigations from carrying it but does **not** stop a
+cross-site ``POST``/``PUT``/``PATCH``/``DELETE`` issued by script from a page
+the browser considers a different site in every configuration we ship (Lax
+blocks non-GET cross-site sends in current browsers, but the cookie is also
+the only credential a browser attaches automatically, and Lax is not a
+security boundary we should rely on alone). Every mutating endpoint accepted
+that cookie with no second check, so a non-loopback deployment was one
+malicious page away from forged state changes.
+
+This module is the *decision*; :mod:`latticeai.runtime.web_runtime` is the
+wiring. Keeping the two apart means the policy is testable without an ASGI
+app, and the middleware stays small enough to audit.
+
+Threat model, stated so the exemptions are checkable rather than vibes:
+
+* **Only ambient credentials are CSRF-able.** ``Authorization: Bearer`` is set
+  by the caller's own code; an attacker's page cannot add it to a cross-site
+  request without a CORS preflight that our ``CORSMiddleware`` allowlist
+  rejects. Bearer-authenticated requests are therefore exempt.
+* **No cookie, nothing to forge.** A request without ``session_token`` cannot
+  be authenticated by cookie, so it is not this guard's business.
+* **``Origin`` is attacker-honest.** A browser sets it; a page cannot lie about
+  it. ``Referer`` is the fallback for the handful of clients that omit
+  ``Origin``.
+* **Neither header present** means the caller is not a browser (curl, the CLI,
+  the desktop shell, the VS Code extension). That is trusted only while the
+  server is bound to loopback, where "not a browser" and "already on this
+  machine" coincide. On a reachable bind it fails closed.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from typing import (
+    Any,
+    Awaitable,
+    Callable,
+    Iterable,
+    List,
+    MutableMapping,
+    Optional,
+    Sequence,
+    Tuple,
+)
+from urllib.parse import urlsplit
+
+__all__ = [
+    "CSRFDecision",
+    "CSRFOriginPolicy",
+    "CSRFOriginGuardMiddleware",
+    "SAFE_METHODS",
+    "SESSION_COOKIE_NAME",
+    "normalize_origin",
+]
+
+# The ASGI contract, spelled out locally so the policy stays importable (and
+# unit-testable) without pulling in a web framework.
+Scope = MutableMapping[str, Any]
+Message = MutableMapping[str, Any]
+Receive = Callable[[], Awaitable[Message]]
+Send = Callable[[Message], Awaitable[None]]
+ASGIApp = Callable[[Scope, Receive, Send], Awaitable[None]]
+
+# Methods that must not change state. Everything else is guarded.
+SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS", "TRACE"})
+
+SESSION_COOKIE_NAME = "session_token"
+
+_DEFAULT_PORTS = {"http": 80, "https": 443, "ws": 80, "wss": 443}
+
+_DENIED_DETAIL = (
+    "요청 출처를 확인할 수 없어 거부했습니다. "
+    "다른 사이트에서 보낸 요청일 수 있습니다."
+)
+
+
+def normalize_origin(value: Optional[str]) -> Optional[Tuple[str, str, Optional[int]]]:
+    """``"HTTP://Localhost:80/x"`` → ``("http", "localhost", None)``.
+
+    Returns ``None`` for anything that is not a usable origin (empty, the
+    literal ``"null"`` that sandboxed iframes and ``file://`` pages send, or a
+    value with no host). ``"null"`` is deliberately *not* normalized into a
+    matchable origin: it is what an opaque origin sends, and opaque origins are
+    exactly the ones we must not trust.
+    """
+    if not value:
+        return None
+    candidate = value.strip()
+    if not candidate or candidate.lower() == "null":
+        return None
+    if "//" not in candidate:
+        # A bare authority ("example.com:4825") — the Host header shape.
+        candidate = "//" + candidate
+    parts = urlsplit(candidate)
+    host = (parts.hostname or "").lower()
+    if not host:
+        return None
+    scheme = (parts.scheme or "").lower()
+    try:
+        port = parts.port
+    except ValueError:
+        # Malformed port ("example.com:notaport"): unusable, so untrusted.
+        return None
+    if port is not None and _DEFAULT_PORTS.get(scheme) == port:
+        port = None
+    return (scheme, host, port)
+
+
+def _same_site(left: Tuple[str, str, Optional[int]], right: Tuple[str, str, Optional[int]]) -> bool:
+    """Host+port equality, ignoring scheme when one side does not carry one.
+
+    The ``Host`` header has no scheme, and a TLS-terminating reverse proxy
+    speaks ``http`` to us while the browser reports ``https``. Comparing the
+    authority is what makes "this page came from this server" answerable in
+    both deployments; the scheme is only compared when both sides state one.
+    """
+    if left[1] != right[1] or left[2] != right[2]:
+        return False
+    if left[0] and right[0]:
+        return left[0] == right[0]
+    return True
+
+
+@dataclass(frozen=True)
+class CSRFDecision:
+    """Why a request was allowed or refused — the reason is the audit trail."""
+
+    allowed: bool
+    reason: str
+
+
+class CSRFOriginPolicy:
+    """Decide whether one request may change state with a cookie credential."""
+
+    def __init__(
+        self,
+        *,
+        trusted_origins: Iterable[str] = (),
+        server_host: str = "127.0.0.1",
+        server_port: int = 4825,
+        bind_is_loopback: bool = True,
+    ) -> None:
+        self.bind_is_loopback = bool(bind_is_loopback)
+        self._trusted: List[Tuple[str, str, Optional[int]]] = []
+        for origin in self._default_origins(server_host, server_port):
+            self._add(origin)
+        for origin in trusted_origins:
+            self._add(origin)
+
+    @staticmethod
+    def _default_origins(server_host: str, server_port: int) -> List[str]:
+        """The server's own origin plus loopback, in both schemes."""
+        hosts = [server_host, "localhost", "127.0.0.1", "[::1]"]
+        origins: List[str] = []
+        for host in hosts:
+            if not host:
+                continue
+            for scheme in ("http", "https"):
+                origins.append(f"{scheme}://{host}:{server_port}")
+        return origins
+
+    def _add(self, origin: str) -> None:
+        normalized = normalize_origin(origin)
+        if normalized is not None and normalized not in self._trusted:
+            self._trusted.append(normalized)
+
+    @property
+    def trusted_origins(self) -> Sequence[Tuple[str, str, Optional[int]]]:
+        return tuple(self._trusted)
+
+    def _origin_is_trusted(
+        self,
+        origin: Tuple[str, str, Optional[int]],
+        host_header: Optional[str],
+    ) -> bool:
+        if any(_same_site(origin, trusted) for trusted in self._trusted):
+            return True
+        # Same-origin by the request's own Host. A browser sets Host from the
+        # URL it is fetching, so `Origin == Host` can only be produced by a
+        # page this server actually served — which is precisely "not cross
+        # site". This is what keeps reverse-proxied hostnames working without
+        # every operator having to enumerate them.
+        own = normalize_origin(host_header)
+        return own is not None and _same_site(origin, own)
+
+    def evaluate(
+        self,
+        *,
+        method: str,
+        origin: Optional[str],
+        referer: Optional[str],
+        host: Optional[str],
+        cookie_header: Optional[str],
+        authorization: Optional[str],
+    ) -> CSRFDecision:
+        """Allow/deny one request. Pure: no I/O, no app state."""
+        if method.upper() in SAFE_METHODS:
+            return CSRFDecision(True, "safe-method")
+        if (authorization or "").strip().lower().startswith("bearer "):
+            # Not ambient: a cross-site page cannot attach this header.
+            return CSRFDecision(True, "bearer-auth")
+        if not _has_session_cookie(cookie_header):
+            return CSRFDecision(True, "no-session-cookie")
+
+        stated = normalize_origin(origin)
+        if stated is None and origin:
+            # An opaque origin ("null") explicitly claims *untrusted* provenance.
+            return CSRFDecision(False, "opaque-origin")
+        if stated is None:
+            stated = normalize_origin(referer)
+            if stated is None:
+                if self.bind_is_loopback:
+                    # Non-browser client on the same machine (CLI, desktop
+                    # shell, curl). Nothing on the network can reach this bind.
+                    return CSRFDecision(True, "no-origin-loopback-bind")
+                return CSRFDecision(False, "no-origin-reachable-bind")
+
+        if self._origin_is_trusted(stated, host):
+            return CSRFDecision(True, "same-site-or-trusted-origin")
+        return CSRFDecision(False, "cross-site-origin")
+
+
+def _has_session_cookie(cookie_header: Optional[str]) -> bool:
+    """Whether the raw Cookie header carries ``session_token``.
+
+    Parsed by hand rather than through ``http.cookies`` so a malformed pair
+    cannot make the whole header unreadable — a request whose cookie jar we
+    cannot parse must still be treated as cookie-bearing.
+    """
+    if not cookie_header:
+        return False
+    for pair in cookie_header.split(";"):
+        name, _, _value = pair.partition("=")
+        if name.strip() == SESSION_COOKIE_NAME:
+            return True
+    return False
+
+
+class CSRFOriginGuardMiddleware:
+    """Pure-ASGI guard: inspects request headers, never touches the response.
+
+    Written against the raw ASGI interface instead of ``BaseHTTPMiddleware``
+    on purpose — this app streams (SSE chat, live agent steps), and wrapping
+    the response path to make a decision that only needs request headers would
+    put a buffering layer in front of every stream for no benefit.
+    """
+
+    def __init__(self, app: ASGIApp, *, policy: CSRFOriginPolicy) -> None:
+        self.app = app
+        self.policy = policy
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope.get("type") != "http":
+            await self.app(scope, receive, send)
+            return
+        headers = {
+            key.decode("latin-1").lower(): value.decode("latin-1")
+            for key, value in scope.get("headers") or []
+        }
+        decision = self.policy.evaluate(
+            method=str(scope.get("method") or "GET"),
+            origin=headers.get("origin"),
+            referer=headers.get("referer"),
+            host=headers.get("host"),
+            cookie_header=headers.get("cookie"),
+            authorization=headers.get("authorization"),
+        )
+        if decision.allowed:
+            await self.app(scope, receive, send)
+            return
+        await _send_forbidden(send, decision.reason)
+
+
+async def _send_forbidden(send: Send, reason: str) -> None:
+    body = json.dumps(
+        {"detail": _DENIED_DETAIL, "error": "csrf_origin_rejected", "reason": reason},
+        ensure_ascii=False,
+    ).encode("utf-8")
+    await send(
+        {
+            "type": "http.response.start",
+            "status": 403,
+            "headers": [
+                (b"content-type", b"application/json; charset=utf-8"),
+                (b"content-length", str(len(body)).encode("ascii")),
+            ],
+        }
+    )
+    await send({"type": "http.response.body", "body": body})

package/latticeai/core/legacy_compatibility.py

@@ -13,7 +13,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List
 
-LEGACY_COMPATIBILITY_VERSION = "10.5.0"
+LEGACY_COMPATIBILITY_VERSION = "10.6.2"
 
 
 @dataclass(frozen=True)

package/latticeai/core/marketplace.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 from copy import deepcopy
 from typing import Any, Dict, List, Optional
 
-MARKETPLACE_VERSION = "10.5.0"
+MARKETPLACE_VERSION = "10.6.2"
 TEMPLATE_KINDS = ("plugin", "workflow", "agent", "ingestion_bridge")
 
 

package/latticeai/core/workspace_os_constants.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 
 from typing import Dict
 
-WORKSPACE_OS_VERSION = "10.5.0"
+WORKSPACE_OS_VERSION = "10.6.2"
 
 # Workspace types separate single-user Personal workspaces from shared
 # Organization workspaces. Both keep the same local-first JSON store; the type

package/latticeai/models/router.py

@@ -118,6 +118,36 @@ def normalize_branding(text: Optional[str]) -> str:
     return normalized
 
 
+class ModelStreamError(RuntimeError):
+    """A backend failed mid-stream. This is an error, never model output.
+
+    Streaming backends used to hand their failure to the caller as a chunk of
+    text (``"⚠️ Error: ..."``), which every consumer then treated as the
+    model's answer: it was echoed to the client as content and persisted as a
+    successful turn. The failure now travels as this typed exception instead.
+
+    The MLX generators run on a worker thread that cannot raise into the
+    consuming coroutine, so the thread puts an instance on the chunk queue and
+    :meth:`LLMRouter._drain_stream_queue` re-raises it. The SSE endpoints
+    (``latticeai.api.chat_stream.stream_chat`` and the document stream in
+    ``latticeai.api.chat_documents``) already wrap their ``async for`` in
+    ``except Exception`` and emit an ``error`` frame plus a ``[stream_error]``
+    marker on the persisted answer, so the stream framing is unchanged.
+    """
+
+
+def _stream_failure(stage: str, exc: BaseException) -> ModelStreamError:
+    """Envelope a backend exception for transport across the chunk queue.
+
+    ``raise ... from exc`` is unavailable on the worker thread (nothing there
+    consumes the traceback), so the cause is attached explicitly and stays
+    visible in logs when the consumer re-raises.
+    """
+    error = ModelStreamError(f"{stage}: {exc}")
+    error.__cause__ = exc
+    return error
+
+
 # Returns a display payload whose `source_display_order` value is a list,
 # so the value type is Any rather than str.
 def source_metadata_for_model(
@@ -720,16 +750,32 @@ class LLMRouter:
                 for chunk in gen:
                     text = chunk.text if hasattr(chunk, "text") else (chunk[0] if isinstance(chunk, tuple) else str(chunk))
                     loop.call_soon_threadsafe(queue.put_nowait, text)
-            except Exception as e:
-                loop.call_soon_threadsafe(queue.put_nowait, f"⚠️ Error: {e}")
+            except Exception as exc:
+                loop.call_soon_threadsafe(
+                    queue.put_nowait, _stream_failure("MLX chat stream failed", exc)
+                )
             finally:
                 loop.call_soon_threadsafe(queue.put_nowait, None)
 
         loop.run_in_executor(executor, _stream)
+        async for chunk in self._drain_stream_queue(queue):
+            yield chunk
+
+    @staticmethod
+    async def _drain_stream_queue(queue: "asyncio.Queue[Any]") -> AsyncIterator[str]:
+        """Yield worker-thread chunks until the terminator; raise failures.
+
+        ``None`` terminates the stream. A :class:`ModelStreamError` on the
+        queue is a backend failure envelope, not model text, so it is raised
+        into the consuming coroutine — callers must never be able to mistake
+        it for an answer.
+        """
         while True:
             chunk = await queue.get()
             if chunk is None:
-                break
+                return
+            if isinstance(chunk, ModelStreamError):
+                raise chunk
             yield normalize_branding(chunk)
 
     async def stream_generate(
@@ -759,9 +805,10 @@ class LLMRouter:
                 temperature=temperature,
                 stream=True,
             )
-        except Exception as e:
-            yield f"⚠️ {self._local_server_error_hint(cloud, e)}"
-            return
+        except Exception as exc:
+            # Same invariant as the MLX path: a backend that never produced a
+            # token failed, and that is an error — not the model's answer.
+            raise ModelStreamError(self._local_server_error_hint(cloud, exc)) from exc
         async for event in stream:
             if not event.choices:
                 continue
@@ -927,17 +974,16 @@ class LLMRouter:
                 for chunk in gen:
                     text = chunk.text if hasattr(chunk, "text") else (chunk[0] if isinstance(chunk, tuple) else str(chunk))
                     loop.call_soon_threadsafe(queue.put_nowait, text)
-            except Exception as e:
-                loop.call_soon_threadsafe(queue.put_nowait, f"⚠️ Error: {e}")
+            except Exception as exc:
+                loop.call_soon_threadsafe(
+                    queue.put_nowait, _stream_failure("MLX document stream failed", exc)
+                )
             finally:
                 loop.call_soon_threadsafe(queue.put_nowait, None)
 
         loop.run_in_executor(executor, _stream)
-        while True:
-            chunk = await queue.get()
-            if chunk is None:
-                break
-            yield normalize_branding(chunk)
+        async for chunk in self._drain_stream_queue(queue):
+            yield chunk
 
     async def _cloud_stream_document(self, cloud: CloudModel, message: str, system_prompt: str, max_tokens: int, temperature: float) -> AsyncIterator[str]:
         try:
@@ -951,9 +997,8 @@ class LLMRouter:
                 temperature=temperature,
                 stream=True,
             )
-        except Exception as e:
-            yield f"⚠️ {self._local_server_error_hint(cloud, e)}"
-            return
+        except Exception as exc:
+            raise ModelStreamError(self._local_server_error_hint(cloud, exc)) from exc
         async for event in stream:
             if not event.choices:
                 continue

package/latticeai/runtime/build_phases.py

@@ -88,6 +88,7 @@ def phase_config(ctx: RuntimeContext) -> None:
         "ALLOW_PLAINTEXT_API_KEYS",
         "CORS_ALLOW_NETWORK",
         "CORS_EXTRA_ORIGINS",
+        "CSRF_TRUSTED_ORIGINS",
         "PUBLIC_MODEL",
         "LOCAL_MODEL",
         "LOCAL_DRAFT_MODEL",
@@ -875,6 +876,7 @@ def phase_web(ctx: RuntimeContext) -> None:
         cors_extra_origins=ctx.CORS_EXTRA_ORIGINS,
         cors_allow_network=ctx.CORS_ALLOW_NETWORK,
         static_dir=ctx.STATIC_DIR,
+        csrf_trusted_origins=ctx.CSRF_TRUSTED_ORIGINS,
     )
     ctx.adopt(web_runtime, "app")
     ensure_agent_root()

package/latticeai/runtime/config_runtime.py

@@ -28,6 +28,7 @@ class ConfigRuntime(RuntimeStage):
     ALLOW_PLAINTEXT_API_KEYS: bool
     CORS_ALLOW_NETWORK: bool
     CORS_EXTRA_ORIGINS: Any
+    CSRF_TRUSTED_ORIGINS: Any
     PUBLIC_MODEL: str
     LOCAL_MODEL: str
     LOCAL_DRAFT_MODEL: str
@@ -59,6 +60,7 @@ def build_config_runtime(config: "Optional[Config]" = None) -> ConfigRuntime:
         ALLOW_PLAINTEXT_API_KEYS=cfg.allow_plaintext_api_keys,
         CORS_ALLOW_NETWORK=cfg.cors_allow_network,
         CORS_EXTRA_ORIGINS=cfg.cors_extra_origins,
+        CSRF_TRUSTED_ORIGINS=cfg.csrf_trusted_origins,
         PUBLIC_MODEL=cfg.public_model,
         LOCAL_MODEL=cfg.local_model,
         LOCAL_DRAFT_MODEL=cfg.local_draft_model,

package/latticeai/runtime/runtime_context.py

@@ -55,6 +55,7 @@ class RuntimeContext:
     ALLOW_PLAINTEXT_API_KEYS: bool
     CORS_ALLOW_NETWORK: bool
     CORS_EXTRA_ORIGINS: Any
+    CSRF_TRUSTED_ORIGINS: Any
     PUBLIC_MODEL: str
     LOCAL_MODEL: Any
     LOCAL_DRAFT_MODEL: Any