ltcai 10.7.0 → 10.8.0

package/latticeai/core/messages.py

@@ -0,0 +1,230 @@
+"""Server-side message catalog.
+
+Every string the API hands a person — an ``HTTPException`` detail, a status
+line, a refusal — used to be a literal at the raise site, and the literals were
+written in whichever language the author happened to be thinking in. The result
+was one API that answered ``"사용자를 찾을 수 없습니다."`` and, two files over,
+``"Knowledge Graph ingestion is disabled."``, so *every* user read half the
+product in a language they had not chosen.
+
+The rules here are the same three the frontend catalog follows:
+
+1. **One id per message.** The id is what code refers to; the wording is data.
+2. **Both languages or neither.** ``test_messages.py`` fails on a key present
+   in one language and missing from the other, so a new message cannot ship
+   half-translated.
+3. **The caller never picks the language.** It comes from the request, via
+   :func:`resolve_language`, so a message cannot be localized to whoever wrote
+   the endpoint.
+
+Usage::
+
+    from latticeai.core.messages import http_error, resolve_language
+
+    lang = resolve_language(request)
+    raise http_error(404, "auth.user_not_found", lang)
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Mapping, Optional
+
+from fastapi import HTTPException
+
+__all__ = [
+    "DEFAULT_LANGUAGE",
+    "SUPPORTED_LANGUAGES",
+    "LANGUAGE_HEADER",
+    "MESSAGES",
+    "http_error",
+    "resolve_language",
+    "translate",
+]
+
+DEFAULT_LANGUAGE = "ko"
+SUPPORTED_LANGUAGES = ("ko", "en")
+
+#: Explicit override the frontend sends. Preferred over ``Accept-Language``
+#: because the person picked this language *in the product*, whereas
+#: ``Accept-Language`` is whatever their browser was installed with.
+LANGUAGE_HEADER = "x-lattice-language"
+
+
+MESSAGES: Dict[str, Dict[str, str]] = {
+    # ── auth ────────────────────────────────────────────────────────────
+    "auth.password_too_weak": {
+        "ko": "비밀번호는 8자 이상이며 영문자와 숫자를 모두 포함해야 합니다.",
+        "en": "Your password needs at least 8 characters, including letters and numbers.",
+    },
+    "auth.invitation_required": {
+        "ko": "유효한 서명 초대 권한이 필요합니다.",
+        "en": "A valid signed invitation is required.",
+    },
+    "auth.registration_disabled": {
+        "ko": "회원가입이 비활성화되어 있습니다. 관리자에게 문의하세요.",
+        "en": "Sign-up is turned off. Ask an administrator to enable it.",
+    },
+    "auth.email_taken": {
+        "ko": "이미 존재하는 이메일입니다.",
+        "en": "That email address is already registered.",
+    },
+    "auth.bad_credentials": {
+        "ko": "이메일 또는 비밀번호가 틀렸습니다.",
+        "en": "That email address or password is not correct.",
+    },
+    "auth.account_disabled": {
+        "ko": "비활성화된 계정입니다.",
+        "en": "This account has been disabled.",
+    },
+    "auth.login_required": {
+        "ko": "인증이 필요합니다.",
+        "en": "You need to sign in first.",
+    },
+    "auth.user_not_found": {
+        "ko": "사용자를 찾을 수 없습니다.",
+        "en": "No such user.",
+    },
+    "auth.current_password_wrong": {
+        "ko": "현재 비밀번호가 틀렸습니다.",
+        "en": "Your current password is not correct.",
+    },
+    "auth.name_required": {
+        "ko": "이름을 입력해주세요.",
+        "en": "Please enter a name.",
+    },
+    "auth.nickname_required": {
+        "ko": "닉네임을 입력해주세요.",
+        "en": "Please enter a nickname.",
+    },
+    # ── SSO ─────────────────────────────────────────────────────────────
+    "sso.not_configured": {
+        "ko": "SSO가 설정되지 않았습니다.",
+        "en": "Single sign-on is not set up.",
+    },
+    "sso.invalid_state": {
+        "ko": "유효하지 않은 SSO 상태입니다.",
+        "en": "That sign-on request is no longer valid. Please start again.",
+    },
+    "sso.config_error": {
+        "ko": "SSO 설정 오류입니다.",
+        "en": "Single sign-on is misconfigured.",
+    },
+    "sso.no_id_token": {
+        "ko": "ID 토큰을 받지 못했습니다.",
+        "en": "The identity provider did not return an ID token.",
+    },
+    "sso.token_verification_failed": {
+        "ko": "SSO 토큰 검증에 실패했습니다.",
+        "en": "The sign-on token could not be verified.",
+    },
+    "sso.provider_verification_failed": {
+        "ko": "SSO 공급자 검증에 실패했습니다.",
+        "en": "The sign-on provider could not be verified.",
+    },
+    "sso.email_unavailable": {
+        "ko": "이메일을 확인할 수 없습니다.",
+        "en": "The identity provider did not share an email address.",
+    },
+    "sso.invitation_required": {
+        "ko": "신규 SSO 계정에는 유효한 서명 초대 권한이 필요합니다.",
+        "en": "New single sign-on accounts need a valid signed invitation.",
+    },
+    # ── admin ───────────────────────────────────────────────────────────
+    "admin.invalid_role": {
+        "ko": "role은 admin 또는 user만 가능합니다.",
+        "en": "Role must be either 'admin' or 'user'.",
+    },
+    "admin.cannot_disable_self": {
+        "ko": "자기 자신은 비활성화할 수 없습니다.",
+        "en": "You cannot disable your own account.",
+    },
+    "admin.cannot_delete_self": {
+        "ko": "자기 자신은 삭제할 수 없습니다.",
+        "en": "You cannot delete your own account.",
+    },
+    # ── capture / ingestion ─────────────────────────────────────────────
+    "capture.ingestion_disabled": {
+        "ko": "지식 그래프 수집이 꺼져 있습니다.",
+        "en": "Knowledge Graph ingestion is turned off.",
+    },
+    "capture.payload_too_large": {
+        "ko": "보낸 내용이 너무 큽니다.",
+        "en": "That capture is too large to accept.",
+    },
+    "capture.nothing_to_capture": {
+        "ko": "저장할 내용이 없습니다. 텍스트나 페이지 내용을 함께 보내주세요.",
+        "en": "Nothing to capture — send text, html, or a selection.",
+    },
+}
+
+
+def resolve_language(request: Any, default: str = DEFAULT_LANGUAGE) -> str:
+    """Language for this request: the product's choice, then the browser's.
+
+    Never raises and never returns an unsupported language — an endpoint that
+    cannot resolve a language must still be able to answer.
+    """
+    headers: Optional[Mapping[str, str]] = getattr(request, "headers", None)
+    if headers is None:
+        return default
+
+    explicit = _normalize(headers.get(LANGUAGE_HEADER))
+    if explicit:
+        return explicit
+
+    # `Accept-Language: en-GB,en;q=0.9,ko;q=0.8` — take the first tag we
+    # support, honouring the order the browser sent (which is the priority
+    # order) rather than re-sorting by q-value, since the two agree in every
+    # real header and disagreeing ones are malformed anyway.
+    for part in (headers.get("accept-language") or "").split(","):
+        candidate = _normalize(part.split(";", 1)[0])
+        if candidate:
+            return candidate
+    return default
+
+
+def _normalize(value: Optional[str]) -> Optional[str]:
+    """``"en-GB"`` → ``"en"`` when supported, else None."""
+    if not value:
+        return None
+    tag = value.strip().lower().replace("_", "-")
+    if not tag:
+        return None
+    base = tag.split("-", 1)[0]
+    return base if base in SUPPORTED_LANGUAGES else None
+
+
+def translate(key: str, language: str = DEFAULT_LANGUAGE, **params: Any) -> str:
+    """Localized text for ``key``.
+
+    An unknown key returns the key itself rather than raising: a missing
+    message must not turn a 404 into a 500. The namespaced key is also
+    recognisable in a bug report, which a generic "an error occurred" is not.
+    """
+    entry = MESSAGES.get(key)
+    if entry is None:
+        return key
+    text = entry.get(language) or entry.get(DEFAULT_LANGUAGE) or key
+    for name, value in params.items():
+        text = text.replace("{" + name + "}", str(value))
+    return text
+
+
+def http_error(
+    status_code: int,
+    key: str,
+    language: str = DEFAULT_LANGUAGE,
+    *,
+    headers: Optional[Dict[str, str]] = None,
+    **params: Any,
+) -> HTTPException:
+    """An ``HTTPException`` whose detail is localized for this request.
+
+    Returned, not raised, so call sites keep reading ``raise http_error(...)``
+    and the traceback still points at the endpoint.
+    """
+    return HTTPException(
+        status_code=status_code,
+        detail=translate(key, language, **params),
+        headers=headers,
+    )

package/latticeai/core/workspace_computer_memory.py

@@ -0,0 +1,84 @@
+"""Local Computer Memory: the opt-in that lets the Brain watch this machine.
+
+Extracted from ``WorkspaceOSStore``. Off by default and impossible to enable
+without a recorded consent — the check lives here so there is one place to read
+when asking "what did this machine agree to observe".
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _json_hash
+
+__all__ = ["WorkspaceComputerMemory", "DEFAULT_COMPUTER_MEMORY_SCOPES"]
+
+#: Folders the feature offers to watch when the person names none. Chosen to be
+#: recognisable rather than exhaustive: the point of the list is that a person
+#: reading the consent dialog knows what it means.
+DEFAULT_COMPUTER_MEMORY_SCOPES = ("Downloads", "Documents", "Repositories")
+
+
+class WorkspaceComputerMemory:
+    """Consent state and activity log for watching the local computer."""
+
+    def __init__(self, store: Any) -> None:
+        self.store = store
+
+    def configure(
+        self,
+        *,
+        enabled: bool,
+        approved_by: Optional[str],
+        consent: Optional[Dict[str, Any]] = None,
+        scopes: Optional[List[str]] = None,
+    ) -> Dict[str, Any]:
+        consent = consent or {}
+        if enabled and not consent.get("approved"):
+            raise PermissionError("Local Computer Memory requires explicit approval.")
+        state = self.store.load_state()
+        config = state.setdefault("computer_memory", {})
+        config.update({
+            "enabled": bool(enabled),
+            "approved": bool(enabled),
+            "approved_at": _now() if enabled else config.get("approved_at"),
+            "approved_by": approved_by if enabled else config.get("approved_by"),
+            "scopes": scopes or config.get("scopes") or list(DEFAULT_COMPUTER_MEMORY_SCOPES),
+            "consent": consent,
+        })
+        state.setdefault("feature_flags", {})["local_computer_memory"] = bool(enabled)
+        self.store.save_state(state)
+        self.store.record_timeline_event(
+            "memory",
+            "computer_memory_configured",
+            {"enabled": bool(enabled), "approved_by": approved_by},
+        )
+        return config
+
+    def record_activity(self, activity: Dict[str, Any], graph: Any = None) -> Dict[str, Any]:
+        state = self.store.load_state()
+        config = state.setdefault("computer_memory", {})
+        if not config.get("enabled"):
+            return {"status": "ignored", "reason": "local computer memory is disabled"}
+        record = {
+            "id": f"activity-{_json_hash([activity, _now()])[:16]}",
+            "timestamp": _now(),
+            **activity,
+        }
+        config.setdefault("activities", []).append(record)
+        if graph is not None:
+            # A graph that refuses the event must not lose the activity: the
+            # record is kept either way and carries the reason it did not land.
+            try:
+                graph.ingest_event(
+                    "ComputerActivity",
+                    str(activity.get("summary") or activity.get("path") or "Computer activity")[:120],
+                    source="workspace_os",
+                    metadata=record,
+                )
+            except Exception as exc:
+                record["graph_error"] = str(exc)
+        self.store.save_state(state)
+        self.store.record_timeline_event("memory", "computer_activity", {"activity_id": record["id"]})
+        return {"status": "ok", "activity": record}

package/latticeai/core/workspace_indexing.py

@@ -0,0 +1,102 @@
+"""Indexing dashboard and per-source watch control.
+
+Extracted from ``WorkspaceOSStore`` so the store stays a façade over composed
+managers rather than a class that also knows how a file watcher reports itself.
+Everything here reads the graph and the watcher and writes only timeline
+events, so it needs the store for ``record_timeline_event`` and nothing else.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+__all__ = ["WorkspaceIndexing"]
+
+
+class WorkspaceIndexing:
+    """Reads index state out of the graph; pauses, resumes, and removes sources."""
+
+    def __init__(self, store: Any) -> None:
+        self.store = store
+
+    def build_dashboard(
+        self,
+        graph: Any,
+        watcher_status: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        if graph is None:
+            return {
+                "sources": [],
+                "watcher": watcher_status or {"available": False, "active": {}},
+                "totals": {"success": 0, "failed": 0, "nodes": 0, "edges": 0},
+            }
+        stats = graph.stats()
+        sources = graph.local_sources().get("sources", [])
+        watcher_status = watcher_status or {"available": False, "active": {}}
+        active = watcher_status.get("active", {})
+        dashboard_sources = []
+        total_success = 0
+        total_failed = 0
+        for source in sources:
+            file_status = source.get("file_status") or {}
+            success = int(file_status.get("indexed") or 0)
+            failed = sum(
+                int(file_status.get(key) or 0)
+                for key in ("failed", "inaccessible", "skipped_empty_text")
+            )
+            total_success += success
+            total_failed += failed
+            watch = active.get(source.get("id")) or {}
+            dashboard_sources.append({
+                "id": source.get("id"),
+                "label": source.get("label"),
+                "root_path": source.get("root_path"),
+                "status": source.get("status"),
+                "watch_enabled": bool(source.get("watch_enabled")),
+                "watch_active": source.get("id") in active,
+                "watch_status": watch,
+                "success_count": success,
+                "failure_count": failed,
+                "last_run_at": source.get("last_scanned_at") or source.get("updated_at"),
+                "file_status": file_status,
+                "include_ocr": bool(source.get("include_ocr")),
+            })
+        return {
+            "sources": dashboard_sources,
+            "watcher": watcher_status,
+            "totals": {
+                "success": total_success,
+                "failed": total_failed,
+                "nodes": sum(int(v or 0) for v in (stats.get("nodes") or {}).values()),
+                "edges": sum(int(v or 0) for v in (stats.get("edges") or {}).values()),
+                "local_sources": stats.get("local_sources", len(sources)),
+            },
+            "graph_stats": stats,
+        }
+
+    def pause(self, graph: Any, source_id: str, watcher: Any = None) -> Dict[str, Any]:
+        result = graph.set_local_source_watch(source_id, False)
+        watch = watcher.stop_source(source_id) if watcher else {"stopped": False, "source_id": source_id}
+        self.store.record_timeline_event("graph", "indexing_paused", {"source_id": source_id})
+        return {"status": "ok", "source": result, "watch": watch}
+
+    def resume(self, graph: Any, source_id: str, watcher: Any = None) -> Dict[str, Any]:
+        result = graph.set_local_source_watch(source_id, True)
+        watch = {"watching": False, "source_id": source_id}
+        source = next(
+            (item for item in graph.local_sources().get("sources", []) if item.get("id") == source_id),
+            None,
+        )
+        if watcher and source:
+            watch = watcher.start_source(source)
+        self.store.record_timeline_event("graph", "indexing_resumed", {"source_id": source_id})
+        return {"status": "ok", "source": result, "watch": watch}
+
+    def remove_source(self, graph: Any, source_id: str, watcher: Any = None) -> Dict[str, Any]:
+        if watcher:
+            watcher.stop_source(source_id)
+        if not hasattr(graph, "remove_local_source"):
+            raise ValueError("graph store does not support removing local sources")
+        result = graph.remove_local_source(source_id)
+        self.store.record_timeline_event("graph", "indexing_removed", {"source_id": source_id})
+        return {"status": "ok", **result}

package/latticeai/core/workspace_onboarding.py

@@ -0,0 +1,104 @@
+"""First-run onboarding progress.
+
+Extracted from ``WorkspaceOSStore``. Owns the ``onboarding`` branch of the
+state document: which named step the person is on, what each step recorded, and
+whether the whole run is finished.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from .timeutil import now_iso as _now
+from .workspace_os_constants import ONBOARDING_STEPS
+
+__all__ = ["WorkspaceOnboarding", "ONBOARDING_STATUSES"]
+
+#: The statuses a single step may hold. Anything else is a caller bug, not a
+#: value to store — an unknown status would silently stall the flow, because
+#: `current_step` only advances on `complete`/`skipped`.
+ONBOARDING_STATUSES = frozenset({"pending", "running", "complete", "failed", "skipped"})
+
+
+class WorkspaceOnboarding:
+    """Tracks the named first-run steps and where the person stopped."""
+
+    def __init__(self, store: Any) -> None:
+        self.store = store
+
+    def status(
+        self,
+        users: Optional[Dict[str, Any]] = None,
+        graph_stats: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        state = self.store.load_state()
+        users = users or {}
+        admins = [
+            email for email, user in users.items()
+            if isinstance(user, dict) and user.get("role") == "admin"
+        ]
+        onboarding = state.get("onboarding") or {}
+        steps = onboarding.get("steps") or {}
+        return {
+            **onboarding,
+            "steps": [steps.get(step, {"id": step, "status": "pending"}) for step in ONBOARDING_STEPS],
+            "has_account": bool(users),
+            "has_admin": bool(admins) or bool(users),
+            "graph_ready": bool(graph_stats and not graph_stats.get("disabled")),
+            "required_steps": list(ONBOARDING_STEPS),
+        }
+
+    def update_step(
+        self,
+        step: str,
+        *,
+        status: str = "complete",
+        data: Optional[Dict[str, Any]] = None,
+        error: str = "",
+        user_email: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        if step not in ONBOARDING_STEPS:
+            raise ValueError(f"unknown onboarding step: {step}")
+        if status not in ONBOARDING_STATUSES:
+            raise ValueError(f"unknown onboarding status: {status}")
+        state = self.store.load_state()
+        onboarding = state.setdefault("onboarding", {})
+        steps = onboarding.setdefault("steps", {})
+        record = steps.setdefault(step, {"id": step})
+        record.update({
+            "id": step,
+            "status": status,
+            "data": data or record.get("data") or {},
+            "error": error,
+            "updated_at": _now(),
+            "user_email": user_email,
+        })
+        if status in {"complete", "skipped"}:
+            index = ONBOARDING_STEPS.index(step)
+            if step == "complete":
+                onboarding["completed"] = True
+                onboarding["completed_at"] = _now()
+                onboarding["current_step"] = "complete"
+            elif index + 1 < len(ONBOARDING_STEPS):
+                onboarding["current_step"] = ONBOARDING_STEPS[index + 1]
+        elif status == "failed":
+            onboarding["current_step"] = step
+        self.store.save_state(state)
+        self.store.record_timeline_event(
+            "workspace", "onboarding_step", {"step": step, "status": status}
+        )
+        return self.status()
+
+    def complete(
+        self,
+        data: Optional[Dict[str, Any]] = None,
+        user_email: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        for step in ONBOARDING_STEPS:
+            self.update_step(
+                step,
+                status="complete",
+                data=data if step == "complete" else None,
+                user_email=user_email,
+            )
+        return self.status()