ltcai 11.5.0 → 11.5.2

package/latticeai/api/computer_use.py

@@ -11,7 +11,9 @@ from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
 
 from lattice_brain.runtime.hooks import dispatch_tool
+from latticeai.api.workspace_scope import resolve_workspace_scope
 from latticeai.core.agent import extract_action as _extract_agent_action
+from latticeai.core.sse import sse_frame
 from latticeai.services.tool_dispatch import enforce_tool_policy
 from latticeai.tools import (
     AGENT_ROOT,
@@ -121,34 +123,24 @@ def create_computer_use_router(
 ) -> APIRouter:
     router = APIRouter()
 
-    def _requested_workspace(request: Request) -> Optional[str]:
-        header = request.headers.get("X-Workspace-Id")
-        if header and header.strip():
-            return header.strip()
-        query = request.query_params.get("workspace_id")
-        return query.strip() if query and query.strip() else None
-
     def _write_workspace(request: Request, current_user: str) -> Optional[str]:
         """Resolve only the CU agent's durable write scope.
 
         The other ``/cu`` actions remain host operations and do not acquire a
         workspace dependency.  A no-auth local request without an explicit
-        scope preserves its legacy unscoped history behavior; explicit scopes
-        and every authenticated request go through the normal write gate.
+        scope preserves its legacy unscoped history behavior — that is exactly
+        what ``allow_unscoped_anonymous`` names in the shared resolver;
+        explicit scopes and every authenticated request go through the normal
+        write gate.
         """
 
-        requested = _requested_workspace(request)
-        if workspace_service is None:
-            return requested
-        if not current_user and requested is None:
-            return None
-        try:
-            return workspace_service.resolve_write_scope(
-                requested,
-                current_user or None,
-            )
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
+        return resolve_workspace_scope(
+            request,
+            user=current_user,
+            workspace_service=workspace_service,
+            write=True,
+            allow_unscoped_anonymous=True,
+        )
 
     def _audit_args(name: str, args: dict) -> dict:
         """Return audit-safe argument metadata without storing typed text."""
@@ -351,17 +343,14 @@ def create_computer_use_router(
             task_lower = (req.task or "").lower()
             url_match = re.search(r"(https?://[^\s]+|localhost:\d+[^\s]*|127\.0\.0\.1:\d+[^\s]*)", req.task or "")
 
-            def _send(event: str, data: dict) -> str:
-                return f"event: {event}\ndata: {json.dumps(data, ensure_ascii=False)}\n\n"
-
             if ("chrome" in task_lower or "크롬" in task_lower) and any(
                 word in task_lower for word in ["open", "열", "켜", "실행", "띄"]
             ):
-                yield _send("start", {"task": req.task, "max_steps": 1})
+                yield sse_frame("start", {"task": req.task, "max_steps": 1})
                 try:
                     if url_match:
                         url = url_match.group(1)
-                        yield _send(
+                        yield sse_frame(
                             "action",
                             {"step": 1, "action": "computer_open_url", "args": {"url": url, "app": "Google Chrome"}},
                         )
@@ -371,11 +360,11 @@ def create_computer_use_router(
                             lambda: computer_open_url(url, "Google Chrome"),
                             current_user=current_user,
                         )
-                        yield _send("result", {"step": 1, "action": "computer_open_url", "result": result})
+                        yield sse_frame("result", {"step": 1, "action": "computer_open_url", "result": result})
                         message = f"Google Chrome에서 {url}을 열었습니다."
                         action_name = "computer_open_url"
                     else:
-                        yield _send(
+                        yield sse_frame(
                             "action",
                             {"step": 1, "action": "computer_open_app", "args": {"app": "Google Chrome"}},
                         )
@@ -385,26 +374,26 @@ def create_computer_use_router(
                             lambda: computer_open_app("Google Chrome"),
                             current_user=current_user,
                         )
-                        yield _send("result", {"step": 1, "action": "computer_open_app", "result": result})
+                        yield sse_frame("result", {"step": 1, "action": "computer_open_app", "result": result})
                         message = "Google Chrome을 열었습니다."
                         action_name = "computer_open_app"
                     _save_completed("user", req.task)
                     _save_completed("assistant", message)
-                    yield _send("final", {"message": message, "steps": [{"step": 1, "action": action_name, "result": result}]})
+                    yield sse_frame("final", {"message": message, "steps": [{"step": 1, "action": action_name, "result": result}]})
                 except HTTPException as exc:
-                    yield _send("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc.detail)})
+                    yield sse_frame("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc.detail)})
                 except (ToolError, PermissionError) as exc:
-                    yield _send("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc)})
+                    yield sse_frame("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc)})
                 return
 
             if not model_router.current_model_id:
-                yield _send("error", {"error": "No model loaded."})
+                yield sse_frame("error", {"error": "No model loaded."})
                 return
 
             transcript: List[Dict[str, Any]] = []
             last_screenshot_b64: Optional[str] = None
             max_steps = max(1, min(req.max_steps, 20))
-            yield _send("start", {"task": req.task, "max_steps": max_steps})
+            yield sse_frame("start", {"task": req.task, "max_steps": max_steps})
 
             for step in range(max_steps):
                 context = (
@@ -423,7 +412,7 @@ def create_computer_use_router(
                 try:
                     action = _extract_agent_action(str(raw))
                 except ValueError as exc:
-                    yield _send("error", {"step": step + 1, "error": str(exc), "raw": str(raw)})
+                    yield sse_frame("error", {"step": step + 1, "error": str(exc), "raw": str(raw)})
                     break
 
                 name = action.get("action")
@@ -432,10 +421,10 @@ def create_computer_use_router(
                     message = action.get("message", "작업을 완료했습니다.")
                     _save_completed("user", req.task)
                     _save_completed("assistant", message)
-                    yield _send("final", {"message": message, "steps": transcript})
+                    yield sse_frame("final", {"message": message, "steps": transcript})
                     return
 
-                yield _send("action", {"step": step + 1, "action": name, "args": args})
+                yield sse_frame("action", {"step": step + 1, "action": name, "args": args})
                 try:
                     result = _dispatch(
                         name,
@@ -449,7 +438,7 @@ def create_computer_use_router(
                         result_summary = {k: v for k, v in result.items() if k != "screenshot_b64"}
                         result_summary["screenshot_captured"] = True
                         transcript.append({"step": step + 1, "action": name, "args": args, "result": result_summary})
-                        yield _send(
+                        yield sse_frame(
                             "screenshot",
                             {
                                 "step": step + 1,
@@ -461,17 +450,17 @@ def create_computer_use_router(
                     else:
                         last_screenshot_b64 = None
                         transcript.append({"step": step + 1, "action": name, "args": args, "result": result})
-                        yield _send("result", {"step": step + 1, "action": name, "result": result})
+                        yield sse_frame("result", {"step": step + 1, "action": name, "result": result})
                 except HTTPException as exc:
                     error_str = str(exc.detail)
                     transcript.append({"step": step + 1, "action": name, "args": args, "error": error_str})
-                    yield _send("tool_error", {"step": step + 1, "action": name, "error": error_str})
+                    yield sse_frame("tool_error", {"step": step + 1, "action": name, "error": error_str})
                 except (ToolError, PermissionError, KeyError, TypeError) as exc:
                     error_str = str(exc)
                     transcript.append({"step": step + 1, "action": name, "args": args, "error": error_str})
-                    yield _send("tool_error", {"step": step + 1, "action": name, "error": error_str})
+                    yield sse_frame("tool_error", {"step": step + 1, "action": name, "error": error_str})
 
-            yield _send("done", {"steps": len(transcript), "transcript": transcript})
+            yield sse_frame("done", {"steps": len(transcript), "transcript": transcript})
 
         return StreamingResponse(
             _stream(),

package/latticeai/api/health.py

@@ -19,6 +19,7 @@ def create_health_router(
     engine_status: Callable[[], List[dict]],
     get_current_user: Callable[[Request], Optional[str]],
     require_auth: bool,
+    externally_reachable: bool,
     app_version: str,
     app_mode: str,
 ) -> APIRouter:
@@ -29,9 +30,28 @@ def create_health_router(
         if require_auth and not get_current_user(request):
             raise HTTPException(status_code=401, detail="인증이 필요합니다.")
 
+    def _access_posture() -> dict:
+        """The two facts ``trusted_local_owner`` is computed from.
+
+        Stated on the *unauthenticated* part of ``/health`` on purpose: the Rust
+        front door polls this endpoint already, and it gates its own native
+        ``/rust/*`` lanes on the answer.  Those lanes read the store with no
+        credential at all, so without this they had no way to tell an
+        optional-auth loopback worker (where that is exactly right) from a
+        ``LATTICEAI_REQUIRE_AUTH=true`` one (where it is a hole).  Neither field
+        is a secret: an unauthenticated caller discovers both by being refused.
+        """
+        return {
+            "require_auth": bool(require_auth),
+            "externally_reachable": bool(externally_reachable),
+        }
+
     @router.get("/health")
     async def health(request: Request):
-        base = svc.health_base(version=app_version, mode=app_mode)
+        base = {
+            **svc.health_base(version=app_version, mode=app_mode),
+            "access": _access_posture(),
+        }
         if not get_current_user(request) and require_auth:
             return base
         engines = await asyncio.to_thread(engine_status)

package/latticeai/api/local_files.py

@@ -310,6 +310,20 @@ def create_local_files_router(
         except PermissionError as exc:
             raise HTTPException(status_code=403, detail=str(exc)) from exc
 
+    @router.get("/api/ingestion/multimodal")
+    async def ingestion_multimodal_status(request: Request):
+        """What this install will do with a picture, a recording, or a video.
+
+        FEATURE_STATUS has described this answer — including which of the three
+        reasons a video would be refused for — since 11.2.0, but the pipeline
+        method that produces it had no route, so no surface could ever show it
+        and "why was my video not indexed?" had no answer short of reading the
+        server's environment.
+        """
+        require_user(request)
+        _require_pipeline()
+        return ingestion_pipeline.multimodal_status()
+
     @router.get("/api/ingestion/jobs")
     async def ingestion_jobs(request: Request, limit: int = 20):
         """Recent background ingestion jobs (newest first)."""

package/latticeai/api/permissions.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import hashlib
 import json
 import logging
 import os
@@ -15,7 +14,9 @@ from typing import Any, Dict, Optional, Tuple
 
 from fastapi import APIRouter, HTTPException, Request
 
+from latticeai.core.http_origin import request_external_origin
 from latticeai.core.io_utils import atomic_write_json
+from latticeai.core.security import sha256_hex
 
 _PERMISSION_ACTION_LABELS = {
     "list": "폴더 목록 보기",
@@ -39,16 +40,32 @@ class PermissionGateway:
         self.discord_permission_channel = config.discord_permission_channel
         self.permission_monitor_secret = config.permission_monitor_secret
         self.perm_queue_file = data_dir / "permission_queue.json"
-        explicit_ui_url = os.getenv("LATTICEAI_PERMISSION_UI_URL", "").strip()
-        public_url = os.getenv("LATTICEAI_PUBLIC_URL", "").strip().rstrip("/")
-        default_ui_url = f"http://127.0.0.1:{getattr(config, 'port', 4825)}/app#/admin/permissions"
-        self.permission_ui_url = explicit_ui_url or (
-            f"{public_url}/app#/admin/permissions" if public_url else default_ui_url
-        )
+        self._explicit_ui_url = os.getenv("LATTICEAI_PERMISSION_UI_URL", "").strip()
+        self._public_url = os.getenv("LATTICEAI_PUBLIC_URL", "").strip().rstrip("/")
+        # The worker's own port. Behind the desktop gateway this is the
+        # *internal* one, which is why a notification built from it sends the
+        # approver to a door only the gateway can open — hence
+        # ``_front_door``, learned from the request that asked for approval.
+        self._loopback_ui_origin = f"http://127.0.0.1:{getattr(config, 'port', 4825)}"
+        self._front_door: Optional[str] = None
+
+    @property
+    def permission_ui_url(self) -> str:
+        """Where to send the person who has to approve this.
+
+        Operator configuration wins — an explicit URL or a public URL is a
+        deliberate statement about how this install is reached. Only when
+        nothing is configured does the front door observed on the request that
+        triggered the approval beat the worker's own loopback address.
+        """
+        if self._explicit_ui_url:
+            return self._explicit_ui_url
+        base = self._public_url or self._front_door or self._loopback_ui_origin
+        return f"{base.rstrip('/')}/app#/admin/permissions"
 
     @staticmethod
     def token_hash(token: str) -> str:
-        return hashlib.sha256(str(token or "").encode("utf-8")).hexdigest()
+        return sha256_hex(str(token or ""))
 
     @staticmethod
     def token_hint(token: str) -> str:
@@ -78,9 +95,6 @@ class PermissionGateway:
         except Exception as exc:
             logging.warning("perm_queue_write failed: %s", exc)
 
-    def _perm_queue_remove(self, token: str) -> None:
-        self._perm_queue_remove_key(self.token_hash(token))
-
     def _perm_queue_remove_key(self, key: str) -> None:
         try:
             with self.perm_queue_lock:
@@ -117,7 +131,7 @@ class PermissionGateway:
 
     @staticmethod
     def content_fingerprint(content: str = "") -> str:
-        return hashlib.sha256(content.encode("utf-8")).hexdigest()
+        return sha256_hex(content)
 
     def _notify_discord_permission_sync(self, token: str, path: str, action: str, user_email: str) -> None:
         sent = False
@@ -225,8 +239,20 @@ class PermissionGateway:
         email = self.get_current_user(request)
         if not email:
             raise HTTPException(status_code=401, detail="로컬 파일 접근은 로그인 세션이 필요합니다.")
+        # Every local-file approval passes through here immediately before the
+        # permission record (and its notification) is created, so this is the
+        # request whose front door the approver should be sent back to. The
+        # forwarded authority is only believed from a loopback or configured
+        # proxy peer — the same rule CSRF and the invite link use.
+        self.remember_front_door(request)
         return email
 
+    def remember_front_door(self, request: Request) -> None:
+        """Record the external origin this request came through, if any."""
+        origin = request_external_origin(request)
+        if origin:
+            self._front_door = origin
+
     def require_local_approval(
         self,
         *,

package/latticeai/api/search.py

@@ -32,6 +32,12 @@ class HybridSearchRequest(SearchRequest):
     image_fusion: bool = False
 
 
+class GraphSearchRequest(SearchRequest):
+    #: How far to walk out from the directly-matching nodes. The service
+    #: clamps this to 0–3; 0 means "matches only, no expansion".
+    expand_depth: int = 1
+
+
 class GraphNodeRequest(BaseModel):
     node_id: str = Field(..., min_length=1)
     include_neighbors: bool = True
@@ -164,6 +170,24 @@ def create_search_router(
         except ValueError as exc:
             _raise_graph_error(exc)
 
+    @router.post("/api/search/graph")
+    async def graph_search(req: GraphSearchRequest, request: Request) -> Dict[str, Any]:
+        """Relationship-aware search: direct matches plus what they connect to.
+
+        The third retrieval channel. It was in ``_ScopedSearchService._SCOPED``
+        from the start — so the workspace guard was ready for it — but no
+        handler ever called it, which made the allow-list entry the only
+        evidence the channel was supposed to be reachable at all.
+        """
+        try:
+            return _guarded(request).graph_search(
+                req.query,
+                limit=req.limit,
+                expand_depth=req.expand_depth,
+            )
+        except ValueError as exc:
+            _raise_graph_error(exc)
+
     @router.get("/api/graph")
     async def graph(request: Request, limit: int = 300) -> Dict[str, Any]:
         try:

package/latticeai/api/static_routes.py

@@ -25,7 +25,10 @@ PRODUCTION_CSP = (
     "style-src 'self' 'unsafe-inline'; "
     "img-src 'self' data: blob: http://127.0.0.1:*; "
     "font-src 'self' data:; "
-    "connect-src 'self' http://127.0.0.1:* ws://127.0.0.1:*; "
+    # No `ws:`: this product has no WebSocket endpoint anywhere. The live
+    # surfaces (chat, agent steps, index progress) are server-sent events, read
+    # with fetch/ReadableStream, which `connect-src` already covers over http.
+    "connect-src 'self' http://127.0.0.1:*; "
     "frame-src 'none'; "
     "object-src 'none'; "
     "base-uri 'none'; "

package/latticeai/cli/runtime.py

@@ -2,10 +2,15 @@
 
 from __future__ import annotations
 
-import importlib.util
 import os
 from pathlib import Path
 
+from latticeai.core.module_probe import module_available
+
+#: Historical name. ``cli.entrypoint`` imports it from here and the suite
+#: monkeypatches it there, so the binding has to exist on this module.
+_has_module = module_available
+
 
 def _load_env_file(path: Path) -> None:
     if not path.exists():
@@ -33,5 +38,4 @@ def _apply_extra_path() -> None:
     os.environ["PATH"] = os.pathsep.join(current)
 
 
-def _has_module(name: str) -> bool:
-    return importlib.util.find_spec(name) is not None
+

package/latticeai/core/config.py

@@ -18,6 +18,7 @@ concept and are read dynamically at call time.
 
 from __future__ import annotations
 
+import os
 import sys
 from dataclasses import dataclass
 from pathlib import Path
@@ -25,7 +26,50 @@ from typing import List, Mapping, Optional
 
 from latticeai.core.security import host_is_loopback
 
-__all__ = ["Config", "_value", "_str", "_bool", "_int"]
+__all__ = [
+    "Config",
+    "SSO_CALLBACK_PATH",
+    "default_data_dir",
+    "default_sso_redirect_uri",
+    "_value",
+    "_str",
+    "_bool",
+    "_int",
+]
+
+#: The path the identity provider sends the browser back to.
+SSO_CALLBACK_PATH = "/auth/sso/callback"
+
+
+def default_sso_redirect_uri(port: int) -> str:
+    """The redirect URI when the operator has registered none.
+
+    Named rather than inlined because ``api/auth`` has to recognise it: this
+    exact string means "nobody chose a callback URL", which is the only case in
+    which the login flow may substitute the front door it was actually reached
+    through. A URI the operator *did* configure is registered with the identity
+    provider and must be sent back verbatim.
+    """
+    return f"http://localhost:{port}{SSO_CALLBACK_PATH}"
+
+
+#: Where everything durable lives when the operator names nothing.
+DEFAULT_DATA_DIR_NAME = ".ltcai"
+
+
+def default_data_dir(env: Optional[Mapping[str, str]] = None) -> Path:
+    """The data directory ``LATTICEAI_DATA_DIR`` names, else ``~/.ltcai``.
+
+    Three runtime wiring modules each carried a byte-identical copy of this,
+    which meant a lazily-initialized service could disagree with ``Config``
+    about where the store lives — and the loser writes a second, invisible
+    copy of the user's data. ``env=None`` reads the live process environment,
+    which is what the lazy wiring paths need.
+    """
+    source = os.environ if env is None else env
+    raw = (source.get("LATTICEAI_DATA_DIR") or "").strip()
+    return Path(raw) if raw else Path.home() / DEFAULT_DATA_DIR_NAME
+
 
 def _value(env: Mapping[str, str], key: str, default: str = "") -> str:
     """Mirror the legacy ``env_value``: ``getenv(key) or default or ""`` (no strip)."""
@@ -177,14 +221,14 @@ class Config:
         # download path, the on-disk cache dir and the catalog key all agree.
         local_model = _value(env, "LATTICEAI_LOCAL_MODEL", "mlx-community/gemma-4-12B-it-4bit")
 
-        data_dir = Path(_value(env, "LATTICEAI_DATA_DIR", str(Path.home() / ".ltcai")))
+        data_dir = default_data_dir(env)
         static_dir = Path(_value(env, "LATTICEAI_STATIC_DIR", str(base_dir / "static")))
         if not static_dir.exists():
             packaged_static = Path(sys.prefix) / "static"
             if packaged_static.exists():
                 static_dir = packaged_static
 
-        default_sso_redirect = f"http://localhost:{port}/auth/sso/callback"
+        default_sso_redirect = default_sso_redirect_uri(port)
 
         return cls(
             app_mode=app_mode,

package/latticeai/core/csrf.py

@@ -29,6 +29,12 @@ Threat model, stated so the exemptions are checkable rather than vibes:
   the desktop shell, the VS Code extension). That is trusted only while the
   server is bound to loopback, where "not a browser" and "already on this
   machine" coincide. On a reachable bind it fails closed.
+* **Behind a proxy, ``Host`` is not the front door.** The desktop gateway
+  replaces it with the worker's internal authority, so the ``Origin == Host``
+  fallback below compared a browser's real origin against a port the browser
+  has never heard of and refused every write. The front door's own name comes
+  from :mod:`latticeai.core.http_origin`, which believes ``X-Forwarded-Host``
+  only from a peer that may forward.
 """
 
 from __future__ import annotations
@@ -48,6 +54,11 @@ from typing import (
 )
 from urllib.parse import urlsplit
 
+from latticeai.core.http_origin import (
+    FORWARDED_HOST_HEADER,
+    effective_host,
+)
+
 __all__ = [
     "CSRFDecision",
     "CSRFOriginPolicy",
@@ -176,6 +187,8 @@ class CSRFOriginPolicy:
         self,
         origin: Tuple[str, str, Optional[int]],
         host_header: Optional[str],
+        forwarded_host: Optional[str] = None,
+        peer: Optional[str] = None,
     ) -> bool:
         if any(_same_site(origin, trusted) for trusted in self._trusted):
             return True
@@ -184,7 +197,13 @@ class CSRFOriginPolicy:
         # page this server actually served — which is precisely "not cross
         # site". This is what keeps reverse-proxied hostnames working without
         # every operator having to enumerate them.
-        own = normalize_origin(host_header)
+        #
+        # "The request's own Host" is the *front door's*, not the internal one a
+        # proxy hop rewrote it to, which is why the forwarded authority is
+        # resolved first (and only from a peer that may forward).
+        own = normalize_origin(
+            effective_host(host=host_header, forwarded_host=forwarded_host, peer=peer)
+        )
         return own is not None and _same_site(origin, own)
 
     def evaluate(
@@ -196,6 +215,8 @@ class CSRFOriginPolicy:
         host: Optional[str],
         cookie_header: Optional[str],
         authorization: Optional[str],
+        forwarded_host: Optional[str] = None,
+        peer: Optional[str] = None,
     ) -> CSRFDecision:
         """Allow/deny one request. Pure: no I/O, no app state."""
         if method.upper() in SAFE_METHODS:
@@ -219,7 +240,7 @@ class CSRFOriginPolicy:
                     return CSRFDecision(True, "no-origin-loopback-bind")
                 return CSRFDecision(False, "no-origin-reachable-bind")
 
-        if self._origin_is_trusted(stated, host):
+        if self._origin_is_trusted(stated, host, forwarded_host, peer):
             return CSRFDecision(True, "same-site-or-trusted-origin")
         return CSRFDecision(False, "cross-site-origin")
 
@@ -261,6 +282,9 @@ class CSRFOriginGuardMiddleware:
             key.decode("latin-1").lower(): value.decode("latin-1")
             for key, value in scope.get("headers") or []
         }
+        # ``client`` is ``(host, port)`` under every ASGI server, and absent
+        # under a test transport that does not model a socket.
+        client = scope.get("client") or ()
         decision = self.policy.evaluate(
             method=str(scope.get("method") or "GET"),
             origin=headers.get("origin"),
@@ -268,6 +292,8 @@ class CSRFOriginGuardMiddleware:
             host=headers.get("host"),
             cookie_header=headers.get("cookie"),
             authorization=headers.get("authorization"),
+            forwarded_host=headers.get(FORWARDED_HOST_HEADER),
+            peer=client[0] if client else None,
         )
         if decision.allowed:
             await self.app(scope, receive, send)

package/latticeai/core/embedding_providers/__init__.py

@@ -15,7 +15,7 @@ swapped behind a single interface as long as every implementation agrees on:
 holds the five concrete text implementations:
 
 1. :class:`HashEmbeddingProvider`  — deterministic, offline, always-available
-   fallback (wraps the legacy :class:`~latticeai.core.local_embeddings.LocalEmbeddingModel`).
+   fallback (wraps :class:`~lattice_brain.embeddings.LocalEmbeddingModel`).
 2. :class:`MLXEmbeddingProvider`   — local Apple-Silicon embedding models.
 3. :class:`OllamaEmbeddingProvider` — a local/remote Ollama server.
 4. :class:`OpenAICompatibleEmbeddingProvider` — any ``/v1/embeddings`` endpoint
@@ -65,10 +65,8 @@ from __future__ import annotations
 # the two names it imported for its own use were part of its surface, and the
 # suite imports them from here. Re-exported in the redundant-alias form so they
 # read as deliberate rather than as leftover imports.
-from latticeai.core.local_embeddings import (
-    DEFAULT_EMBEDDING_DIM as DEFAULT_EMBEDDING_DIM,
-)
-from latticeai.core.local_embeddings import LocalEmbeddingModel as LocalEmbeddingModel
+from lattice_brain.embeddings import DEFAULT_EMBEDDING_DIM as DEFAULT_EMBEDDING_DIM
+from lattice_brain.embeddings import LocalEmbeddingModel as LocalEmbeddingModel
 
 from .base import _KNOWN_DIMS as _KNOWN_DIMS
 from .base import EmbeddingProvider as EmbeddingProvider

package/latticeai/core/embedding_providers/base.py

@@ -19,7 +19,7 @@ import struct
 from dataclasses import dataclass, field
 from typing import Any, Callable, Dict, Iterable, List, Optional, Sequence
 
-from latticeai.core.local_embeddings import DEFAULT_EMBEDDING_DIM
+from lattice_brain.embeddings import DEFAULT_EMBEDDING_DIM
 
 
 class EmbeddingUnavailable(RuntimeError):

package/latticeai/core/embedding_providers/text.py

@@ -14,7 +14,7 @@ import os
 from dataclasses import dataclass
 from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple
 
-from latticeai.core.local_embeddings import DEFAULT_EMBEDDING_DIM, LocalEmbeddingModel
+from lattice_brain.embeddings import DEFAULT_EMBEDDING_DIM, LocalEmbeddingModel
 
 from .base import (
     EmbeddingProvider,

package/latticeai/core/enterprise.py

@@ -22,7 +22,7 @@ from __future__ import annotations
 
 import os
 from enum import Enum
-from typing import Dict, List, Protocol, runtime_checkable
+from typing import Dict, Protocol, runtime_checkable
 
 
 class Edition(str, Enum):
@@ -115,9 +115,6 @@ class CapabilityRegistry:
             # A misbehaving plugin must never break a Community request.
             return False
 
-    def available_capabilities(self) -> List[EnterpriseCapability]:
-        return [cap for cap in EnterpriseCapability if self.is_capability_enabled(cap)]
-
     def describe(self) -> Dict[str, object]:
         """Edition + capability matrix for ``/workspace/editions`` and admin UI."""
         return {