ltcai 10.5.0 → 10.6.2

package/latticeai/runtime/web_runtime.py

@@ -1,14 +1,15 @@
 """FastAPI shell assembly for the application factory.
 
-This seam owns only the outer web shell: app construction, CORS middleware,
-and static asset mounts. Router registration stays in ``app_factory`` until
-the route snapshot/reorder step is reviewed.
+This seam owns only the outer web shell: app construction, the request-side
+middleware (CSRF origin guard, CORS), and static asset mounts. Router
+registration stays in ``app_factory`` until the route snapshot/reorder step is
+reviewed.
 """
 
 from __future__ import annotations
 
 from pathlib import Path
-from typing import Any, Dict, Iterable
+from typing import Any, Dict, Iterable, List
 
 
 def build_web_runtime(
@@ -21,6 +22,7 @@ def build_web_runtime(
     cors_extra_origins: Iterable[str],
     cors_allow_network: bool,
     static_dir: Path,
+    csrf_trusted_origins: Iterable[str] = (),
 ) -> Dict[str, Any]:
     """Create the FastAPI shell and mount static assets in legacy order."""
 
@@ -28,6 +30,9 @@ def build_web_runtime(
     from fastapi.middleware.cors import CORSMiddleware
     from fastapi.staticfiles import StaticFiles
 
+    from latticeai.core.csrf import CSRFOriginGuardMiddleware, CSRFOriginPolicy
+    from latticeai.core.security import host_is_loopback
+
     app = FastAPI(
         title=f"Lattice AI Server ({app_mode})",
         version=app_version,
@@ -45,6 +50,27 @@ def build_web_runtime(
             f"https://{default_host}:{default_port}",
         ]
 
+    # An origin that CORS already lets send *credentialed* cross-origin
+    # requests is, by that decision, trusted with the session cookie; listing
+    # it again here would be a second place to forget. The explicit
+    # LATTICEAI_CSRF_TRUSTED_ORIGINS entries are for the reverse-proxy case,
+    # where the public hostname is not the bind address.
+    csrf_allowed_origins: List[str] = [
+        *cors_allowed_origins,
+        *csrf_trusted_origins,
+    ]
+    csrf_policy = CSRFOriginPolicy(
+        trusted_origins=csrf_allowed_origins,
+        server_host=default_host,
+        server_port=default_port,
+        bind_is_loopback=host_is_loopback(default_host),
+    )
+
+    # Registration order is stack order in reverse: the LAST middleware added
+    # is the OUTERMOST. CORS must stay outside the guard so a rejected request
+    # still comes back with the CORS headers the browser needs to surface the
+    # 403 instead of an opaque network error.
+    app.add_middleware(CSRFOriginGuardMiddleware, policy=csrf_policy)
     app.add_middleware(
         CORSMiddleware,
         allow_origins=cors_allowed_origins,
@@ -62,4 +88,5 @@ def build_web_runtime(
     return {
         "app": app,
         "CORS_ALLOWED_ORIGINS": cors_allowed_origins,
+        "CSRF_ALLOWED_ORIGINS": csrf_allowed_origins,
     }

package/latticeai/services/architecture_readiness.py

@@ -16,7 +16,7 @@ from typing import Any, Dict, List
 
 from latticeai.core.legacy_compatibility import legacy_shim_report
 
-ARCHITECTURE_VERSION_TARGET = "10.5.0"
+ARCHITECTURE_VERSION_TARGET = "10.6.2"
 
 PREFERRED_REFACTORING_ORDER = [
     "agent-runtime",

package/latticeai/services/product_readiness.py

@@ -18,7 +18,7 @@ from typing import Any, Dict, List
 
 from latticeai.services.architecture_readiness import architecture_readiness
 
-PRODUCT_VERSION_TARGET = "10.5.0"
+PRODUCT_VERSION_TARGET = "10.6.2"
 
 
 @dataclass(frozen=True)

package/latticeai/services/search_service.py

@@ -267,7 +267,7 @@ class SearchService:
                 "metadata": match.get("metadata") or {},
                 "updated_at": match.get("updated_at"),
             })
-        return {
+        result = {
             "query": query,
             "mode": "vector",
             "embedding_model": payload.get("embedding_model"),
@@ -278,6 +278,14 @@ class SearchService:
                 include_legacy_global=include_legacy_global,
             ),
         }
+        # Honest recall passthrough: the graph layer scores a capped slice of a
+        # large vector index and says so. Dropping it here would turn "partial
+        # recall" into "these are all the matches" at the API boundary. It also
+        # rides into hybrid_search()["channels"]["vector"] for free.
+        recall = payload.get("recall")
+        if isinstance(recall, dict):
+            result["recall"] = recall
+        return result
 
     def graph_search(
         self,

package/latticeai/services/tool_dispatch.py

@@ -34,6 +34,7 @@ from latticeai.tools import (
     AGENT_ROOT,
     DEFAULT_TOOL_REGISTRY,
     ToolError,
+    document_output_target,
     ensure_agent_root,
 )
 
@@ -163,16 +164,20 @@ class ToolDispatchService:
                 detail=f"'{tool_name}' 툴에는 '{capability}' capability가 필요합니다.",
             )
 
-    def _governed_path_exists(self, path: str) -> bool:
+    def _governed_path_exists(self, tool_name: str, path: str) -> bool:
         """Best-effort existence check for governance classification.
 
-        Resolves workspace-relative paths under ``AGENT_ROOT`` and honors
-        absolute paths (home-sandbox writes). Never raises — an unresolvable
-        path is treated as non-existent (additive), which the fail-closed
-        guard only escalates when the target actually exists.
+        The document creators rewrite ``filename`` into their own output
+        directory, so the raw argument is resolved through
+        :func:`document_output_target` first — checking the argument verbatim
+        inspects a path nothing ever writes. Workspace-relative paths resolve
+        under ``AGENT_ROOT``; absolute paths (home-sandbox writes) are honored
+        as-is. Never raises — an unresolvable path is treated as non-existent
+        (additive), which the fail-closed guard only escalates when the target
+        actually exists.
         """
         try:
-            candidate = Path(path)
+            candidate = Path(document_output_target(tool_name, path) or path)
             if not candidate.is_absolute():
                 candidate = Path(AGENT_ROOT) / candidate
             return candidate.exists()
@@ -244,7 +249,8 @@ class ToolDispatchService:
         # overwrite has no safe apply path in any mode, so it stays blocked.
         verdict = classify_tool_call(
             tool_name, args or {},
-            policy=dict(policy), path_exists=self._governed_path_exists,
+            policy=dict(policy),
+            path_exists=lambda candidate: self._governed_path_exists(tool_name, candidate),
         )
         if verdict.get("fail_closed"):
             raise HTTPException(

package/latticeai/tools/__init__.py

@@ -269,6 +269,7 @@ __all__ = [
     "search_files", "inspect_html", "preview_url", "create_web_project",
     "todo_read", "todo_write",
     "create_docx", "create_xlsx", "create_pptx", "create_pdf", "read_document",
+    "document_output_target",
     "local_list", "local_read", "local_write", "desktop_bridge_status",
     "knowledge_save", "knowledge_search", "knowledge_tree", "knowledge_scope_root",
     "obsidian_save", "obsidian_search", "obsidian_tree",

package/latticeai/tools/documents.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from pathlib import Path
-from typing import Any, Dict, List
+from typing import Any, Dict, List, Optional, Tuple
 
 from latticeai.core.quiet import quiet
 from latticeai.tools import (
@@ -28,6 +28,45 @@ def _safe_filename(name: str, suffix: str) -> str:
     return safe or f"artifact{suffix}"
 
 
+#: tool name → (output directory, enforced suffix). The creators below are the
+#: only writers, so this table is the single source of truth for "where does
+#: this document actually land?".
+_DOCUMENT_TOOL_TARGETS: Dict[str, Tuple[str, str]] = {
+    "create_docx": (DOCUMENT_OUTPUT_DIR, ".docx"),
+    "create_xlsx": (SPREADSHEET_OUTPUT_DIR, ".xlsx"),
+    "create_pptx": (PRESENTATION_OUTPUT_DIR, ".pptx"),
+    "create_pdf": (PDF_OUTPUT_DIR, ".pdf"),
+}
+
+
+def document_output_target(tool_name: str, filename: str) -> Optional[str]:
+    """Workspace-relative path ``tool_name`` will write ``filename`` to.
+
+    Governance needs this: the creators sanitize the caller's ``filename``
+    into their own output directory, so an "does the target already exist?"
+    check against the raw argument looks at a path nothing ever writes — and
+    the fail-closed overwrite guard would silently never fire.
+
+    Returns ``None`` for tools that write wherever the caller points them, so
+    callers fall back to the raw argument.
+    """
+    entry = _DOCUMENT_TOOL_TARGETS.get(tool_name)
+    if entry is None:
+        return None
+    output_dir, suffix = entry
+    return f"{output_dir}/{_safe_filename(filename, suffix)}"
+
+
+def _document_target(tool_name: str, filename: str) -> Path:
+    """Resolved, workspace-confined target for a document creator."""
+    relative = document_output_target(tool_name, filename)
+    if relative is None:  # pragma: no cover — every creator is in the table
+        raise ToolError(f"'{tool_name}' has no document output target.")
+    target = _resolve_path(relative)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    return target
+
+
 def _body_to_str(body) -> str:
     if isinstance(body, list):
         return "\n\n".join(str(item) for item in body)
@@ -40,9 +79,7 @@ def create_docx(title: str, body, filename: str = "document.docx") -> Dict[str,
     except Exception as exc:
         raise ToolError("python-docx is not installed. Run `pip install -r requirements.txt`.") from exc
 
-    output_dir = _resolve_path(DOCUMENT_OUTPUT_DIR)
-    output_dir.mkdir(parents=True, exist_ok=True)
-    target = output_dir / _safe_filename(filename, ".docx")
+    target = _document_target("create_docx", filename)
 
     document = Document()
     if title:
@@ -64,9 +101,7 @@ def create_xlsx(rows: List[List[Any]], filename: str = "spreadsheet.xlsx", sheet
     if not isinstance(rows, list) or not all(isinstance(row, list) for row in rows):
         raise ToolError("Rows must be a list of lists.")
 
-    output_dir = _resolve_path(SPREADSHEET_OUTPUT_DIR)
-    output_dir.mkdir(parents=True, exist_ok=True)
-    target = output_dir / _safe_filename(filename, ".xlsx")
+    target = _document_target("create_xlsx", filename)
 
     workbook = Workbook()
     sheet = workbook.active
@@ -83,9 +118,7 @@ def create_pptx(title: str, slides: List[Dict[str, Any]], filename: str = "prese
     except Exception as exc:
         raise ToolError("python-pptx is not installed. Run `pip install -r requirements.txt`.") from exc
 
-    output_dir = _resolve_path(PRESENTATION_OUTPUT_DIR)
-    output_dir.mkdir(parents=True, exist_ok=True)
-    target = output_dir / _safe_filename(filename, ".pptx")
+    target = _document_target("create_pptx", filename)
 
     presentation = Presentation()
     first_layout = presentation.slide_layouts[0]
@@ -124,9 +157,7 @@ def create_pdf(title: str, body, filename: str = "document.pdf") -> Dict[str, An
     except Exception as exc:
         raise ToolError("reportlab is not installed. Run `pip install reportlab`.") from exc
 
-    output_dir = _resolve_path(PDF_OUTPUT_DIR)
-    output_dir.mkdir(parents=True, exist_ok=True)
-    target = output_dir / _safe_filename(filename, ".pdf")
+    target = _document_target("create_pdf", filename)
 
     # CJK 폰트 등록
     font_name = "Helvetica"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "10.5.0",
+  "version": "10.6.2",
   "description": "Lattice AI — local-first Digital Brain that keeps your knowledge durable across any AI model.",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {

package/scripts/build_frontend_assets.mjs

@@ -1,9 +1,26 @@
 #!/usr/bin/env node
+// Post-processes the `vite build` output in place: normalises trailing
+// whitespace in emitted css/js, rewrites the raw vite manifest into the
+// app-facing asset-manifest.json, and stamps the service-worker cache version.
+//
+// `--out-dir <dir>` points the first two steps at a directory other than
+// static/app so scripts/check_frontend_build_freshness.mjs can reproduce the
+// exact shipped bytes into a scratch tree. In that mode the static/sw.js
+// rewrite is skipped: it is a repo-level side effect, not part of the app dir,
+// and a freshness check must never mutate the working tree.
 import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
+
+const argv = process.argv.slice(2);
+const outDirFlag = argv.indexOf("--out-dir");
+const outDirArg = outDirFlag === -1 ? null : argv[outDirFlag + 1];
+if (outDirFlag !== -1 && !outDirArg) {
+  console.error("--out-dir requires a directory argument");
+  process.exit(2);
+}
 
 const repo = join(import.meta.dirname, "..");
-const appDir = join(repo, "static", "app");
+const appDir = outDirArg ? resolve(outDirArg) : join(repo, "static", "app");
 const nestedViteManifest = join(appDir, ".vite", "asset-manifest.json");
 const publicManifest = join(appDir, "asset-manifest.json");
 const serviceWorker = join(repo, "static", "sw.js");
@@ -46,7 +63,7 @@ const manifest = {
 };
 
 writeFileSync(publicManifest, JSON.stringify(manifest, null, 2) + "\n", "utf8");
-if (existsSync(serviceWorker)) {
+if (!outDirArg && existsSync(serviceWorker)) {
   const cacheVersion = pkg.version.replace(/\D/g, "");
   const source = readFileSync(serviceWorker, "utf8");
   const normalized = source.replace(
@@ -55,4 +72,4 @@ if (existsSync(serviceWorker)) {
   );
   if (normalized !== source) writeFileSync(serviceWorker, normalized, "utf8");
 }
-console.log(`wrote static/app/asset-manifest.json with ${Object.keys(assets).length} assets`);
+console.log(`wrote ${publicManifest} with ${Object.keys(assets).length} assets`);

package/scripts/capture_release_evidence.mjs

@@ -128,12 +128,20 @@ async function main() {
   await page.waitForTimeout(250);
   await shot(page, "10-admin-console.png");
 
-  // The three named steps a file walks on its way into memory. This tab was
-  // hidden from plain mode and held two raw API payloads before this release,
-  // which is why it is worth publishing now.
+  // The three named steps a file walks on its way into memory. 10.6.0 moved
+  // this out of a tab of its own and into Capture's second row, where it is now
+  // always on screen — so `#/pipeline` renders the same page as `#/capture`,
+  // and a full-page shot here came out byte-identical to 06. The README prints
+  // the two as different tiles, so frame the card this tile is actually about.
   await page.goto(`${baseURL}/app#/pipeline`, { waitUntil: "networkidle" });
-  await page.getByRole("list", { name: "자료가 기억이 되는 3단계" }).waitFor();
-  await shot(page, "11-knowledge-journey.png");
+  const journeyList = page.getByRole("list", { name: "자료가 기억이 되는 3단계" });
+  await journeyList.waitFor();
+  const journeyCard = page
+    .locator(".capture-secondary-column > *")
+    .filter({ has: journeyList })
+    .first();
+  await page.waitForTimeout(120);
+  await journeyCard.screenshot({ path: path.join(screenshots, "11-knowledge-journey.png") });
 
   await page.goto(`${baseURL}/app#/review`, { waitUntil: "networkidle" });
   await page.getByText(/Review Center|리뷰 센터|검토함/).first().waitFor();

package/scripts/check_current_release_docs.mjs

@@ -6,7 +6,7 @@ const root = process.cwd();
 const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
 const version = pkg.version;
 const releaseDir = `output/release/v${version}`;
-const releaseTheme = "Everyday Words";
+const releaseTheme = "Ask First";
 const title = `${version} — ${releaseTheme}`;
 const escapedVersion = version.replaceAll(".", "\\.");
 

package/scripts/check_frontend_build_freshness.mjs

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+/**
+ * Frontend build freshness gate.
+ *
+ * Why this exists
+ * ---------------
+ * The Playwright visual suite (`npm run test:visual`) drives the *committed*
+ * build output in `static/app/`. Nothing else proves that directory was built
+ * from the current `frontend/src/`. Change a component, forget
+ * `npm run build:assets`, and CI goes green against a UI that no longer exists.
+ *
+ * What it does
+ * ------------
+ * Reproduces `npm run build:assets` into a scratch directory and compares the
+ * result byte-for-byte with the committed `static/app/`. It runs the same two
+ * steps as the real build, in the same order:
+ *   1. `vite build --outDir <scratch> --emptyOutDir`
+ *   2. `scripts/build_frontend_assets.mjs --out-dir <scratch>`
+ * Step 2 matters: it strips trailing whitespace from the emitted css/js *after*
+ * vite has already computed the content hash in the filename, so the shipped
+ * bytes are not the raw rollup output. Comparing against raw vite output alone
+ * produces a guaranteed false failure on at least one chunk.
+ *
+ * It additionally checks that `static/sw.js` carries the cache constant that
+ * `build:assets` stamps from package.json, because that write is the one part
+ * of the build that lands outside `static/app/`.
+ *
+ * Determinism (measured, not assumed)
+ * -----------------------------------
+ * On an unchanged tree two consecutive `vite build` runs are byte-identical,
+ * including the content-hashed filenames, and the output does not depend on
+ * where `--outDir` points (verified with outDirs inside and outside the repo).
+ * So byte-exact comparison is the strictest gate that is actually stable, and
+ * that is what this script does.
+ *
+ * What it does NOT catch
+ * ----------------------
+ *   * Toolchain drift. It compares a build made *now, here* against bytes
+ *     committed *then, there*. A different vite/rolldown/tailwind version, or a
+ *     platform whose native bindings emit different bytes, would fail this gate
+ *     even though the source and the build output agree. `npm ci` against the
+ *     committed package-lock.json is what keeps that from happening; if this
+ *     gate ever fails with an identical file *set* but differing bytes, suspect
+ *     the toolchain before suspecting the author.
+ *   * Whether the built UI is *correct*. That is the visual suite's job. This
+ *     only proves the visual suite is looking at the current source.
+ *   * Anything outside `static/app/` and the `static/sw.js` cache constant.
+ *
+ * Exit codes: 0 fresh, 1 stale, 2 could not run the comparison at all.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const committedDir = join(repo, "static", "app");
+const viteCli = join(repo, "node_modules", "vite", "bin", "vite.js");
+const postBuild = join(repo, "scripts", "build_frontend_assets.mjs");
+
+// vite writes its raw manifest to a `.vite/` subdirectory under some configs.
+// build_frontend_assets.mjs reads it from either location and the repo does not
+// commit it, so excluding it from both sides avoids a false "extra file".
+const IGNORED_PREFIXES = [".vite/"];
+
+function fail(message, code = 1) {
+  console.error(message);
+  process.exit(code);
+}
+
+function run(label, file, args) {
+  const result = spawnSync(process.execPath, [file, ...args], {
+    cwd: repo,
+    env: process.env,
+    stdio: "inherit",
+  });
+  if (result.error) fail(`${label} could not start: ${result.error.message}`, 2);
+  if (result.status !== 0) fail(`${label} failed with status ${result.status ?? "unknown"}`, 2);
+}
+
+function walk(root, base = root, out = new Map()) {
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    const full = join(root, entry.name);
+    const rel = relative(base, full).split("\\").join("/");
+    if (IGNORED_PREFIXES.some((prefix) => rel === prefix.slice(0, -1) || rel.startsWith(prefix))) {
+      continue;
+    }
+    if (entry.isDirectory()) walk(full, base, out);
+    else out.set(rel, full);
+  }
+  return out;
+}
+
+function checkServiceWorker() {
+  const swPath = join(repo, "static", "sw.js");
+  if (!existsSync(swPath)) return null;
+  const version = JSON.parse(readFileSync(join(repo, "package.json"), "utf8")).version;
+  const expected = `const CACHE = "lattice-v${version.replace(/\D/g, "")}";`;
+  return readFileSync(swPath, "utf8").includes(expected)
+    ? null
+    : `static/sw.js is missing ${expected} (build:assets stamps it from package.json).`;
+}
+
+if (!existsSync(committedDir)) {
+  fail(`Committed build output is missing: ${committedDir}\nRun \`npm run build:assets\` and commit static/app/.`);
+}
+if (!existsSync(viteCli)) {
+  fail(`vite is not installed at ${viteCli}. Run \`npm ci\` first.`, 2);
+}
+
+const scratchRoot = mkdtempSync(join(tmpdir(), "ltcai-frontend-freshness-"));
+const freshDir = join(scratchRoot, "app");
+let exitCode = 0;
+
+try {
+  run("vite build", viteCli, ["build", "--outDir", freshDir, "--emptyOutDir"]);
+  run("build_frontend_assets.mjs", postBuild, ["--out-dir", freshDir]);
+
+  const fresh = walk(freshDir);
+  const committed = walk(committedDir);
+
+  const missing = [...committed.keys()].filter((rel) => !fresh.has(rel)).sort();
+  const extra = [...fresh.keys()].filter((rel) => !committed.has(rel)).sort();
+  const changed = [...fresh.keys()]
+    .filter((rel) => committed.has(rel))
+    .filter((rel) => !readFileSync(fresh.get(rel)).equals(readFileSync(committed.get(rel))))
+    .sort();
+
+  const swProblem = checkServiceWorker();
+
+  if (!missing.length && !extra.length && !changed.length && !swProblem) {
+    console.log(
+      `static/app/ is in sync with frontend/src/ (${committed.size} files rebuilt and byte-identical).`,
+    );
+  } else {
+    exitCode = 1;
+    console.error("\nstatic/app/ is STALE — it was not built from the current frontend/src/.\n");
+    if (extra.length) {
+      console.error(`  ${extra.length} file(s) the current source produces but static/app/ does not have:`);
+      for (const rel of extra.slice(0, 20)) console.error(`    + ${rel}`);
+      if (extra.length > 20) console.error(`    ... and ${extra.length - 20} more`);
+    }
+    if (missing.length) {
+      console.error(`  ${missing.length} committed file(s) the current source no longer produces:`);
+      for (const rel of missing.slice(0, 20)) console.error(`    - ${rel}`);
+      if (missing.length > 20) console.error(`    ... and ${missing.length - 20} more`);
+    }
+    if (changed.length) {
+      console.error(`  ${changed.length} file(s) with the same name but different bytes:`);
+      for (const rel of changed.slice(0, 20)) {
+        const a = statSync(committed.get(rel)).size;
+        const b = statSync(fresh.get(rel)).size;
+        console.error(`    ~ ${rel} (committed ${a} bytes, rebuilt ${b} bytes)`);
+      }
+      if (changed.length > 20) console.error(`    ... and ${changed.length - 20} more`);
+      console.error(
+        "    Same names with different bytes and no added/removed files can also mean\n" +
+          "    toolchain drift rather than stale output — check that `npm ci` installed the\n" +
+          "    versions in package-lock.json before assuming the source changed.",
+      );
+    }
+    if (swProblem) console.error(`  ${swProblem}`);
+    console.error("\nFix: run `npm run build:assets` and commit static/app/ (and static/sw.js).\n");
+  }
+} finally {
+  rmSync(scratchRoot, { recursive: true, force: true });
+}
+
+process.exit(exitCode);

package/src-tauri/Cargo.lock

@@ -1584,7 +1584,7 @@ dependencies = [
 
 [[package]]
 name = "lattice-ai-desktop"
-version = "10.5.0"
+version = "10.6.2"
 dependencies = [
  "plist",
  "serde",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lattice-ai-desktop"
-version = "10.5.0"
+version = "10.6.2"
 description = "Lattice AI Digital Brain desktop shell"
 authors = ["TaeSoo Park"]
 edition = "2021"

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Lattice AI",
-  "version": "10.5.0",
+  "version": "10.6.2",
   "identifier": "ai.lattice.desktop",
   "build": {
     "beforeDevCommand": "npm run frontend:dev",