ltcai 11.5.2 → 11.6.0

package/latticeai/services/openai_compatible_adapter.py

@@ -1,101 +0,0 @@
-"""OpenAI-compatible streaming adapter for hybrid cloud turns (Phase 1).
-
-Uses the already-declared ``openai`` dependency. Configuration is entirely
-environment-driven so no secrets land in the repo:
-
-* ``LATTICEAI_CLOUD_API_KEY`` (required to actually call)
-* ``LATTICEAI_CLOUD_BASE_URL`` (optional; default OpenAI)
-* ``LATTICEAI_CLOUD_MODEL`` (optional; default gpt-4o-mini)
-
-When the API key is missing the adapter raises a clear error so the bridge
-can surface an honest message instead of silently failing.
-"""
-
-from __future__ import annotations
-
-import os
-from typing import AsyncIterator, Optional
-
-
-class OpenAICompatibleAdapter:
-    """Minimal Chat Completions streaming adapter."""
-
-    provider_name = "openai_compatible"
-
-    def __init__(
-        self,
-        *,
-        api_key: Optional[str] = None,
-        base_url: Optional[str] = None,
-        default_model: Optional[str] = None,
-    ) -> None:
-        self.api_key = (api_key or os.environ.get("LATTICEAI_CLOUD_API_KEY") or "").strip()
-        self.base_url = (
-            base_url or os.environ.get("LATTICEAI_CLOUD_BASE_URL") or ""
-        ).strip() or None
-        self.default_model = (
-            default_model
-            or os.environ.get("LATTICEAI_CLOUD_MODEL")
-            or "gpt-4o-mini"
-        ).strip()
-
-    def _client(self):
-        if not self.api_key:
-            raise RuntimeError(
-                "Cloud adapter is not configured. Set LATTICEAI_CLOUD_API_KEY "
-                "(and optionally LATTICEAI_CLOUD_BASE_URL / LATTICEAI_CLOUD_MODEL)."
-            )
-        try:
-            from openai import AsyncOpenAI
-        except ImportError as exc:  # pragma: no cover
-            raise RuntimeError(
-                "openai package is required for the cloud streaming adapter"
-            ) from exc
-        # base_url is only passed when configured: AsyncOpenAI treats an
-        # explicit None differently from an omitted argument.
-        if self.base_url:
-            return AsyncOpenAI(api_key=self.api_key, base_url=self.base_url)
-        return AsyncOpenAI(api_key=self.api_key)
-
-    async def stream(
-        self,
-        *,
-        system: str,
-        user: str,
-        context: str,
-        model: Optional[str] = None,
-    ) -> AsyncIterator[str]:
-        client = self._client()
-        chosen = (model or self.default_model).strip()
-        messages = [
-            {"role": "system", "content": system},
-        ]
-        if context:
-            messages.append(
-                {
-                    "role": "system",
-                    "content": (
-                        "Local Knowledge Graph context (minimal related nodes only):\n"
-                        f"{context}"
-                    ),
-                }
-            )
-        messages.append({"role": "user", "content": user})
-
-        stream = await client.chat.completions.create(
-            model=chosen,
-            messages=messages,
-            stream=True,
-            temperature=0.2,
-        )
-        async for event in stream:
-            try:
-                delta = event.choices[0].delta
-                piece = getattr(delta, "content", None) or ""
-            except Exception:  # noqa: BLE001
-                piece = ""
-            if piece:
-                yield piece
-
-
-__all__ = ["OpenAICompatibleAdapter"]

package/latticeai/services/permission_mode_service.py

@@ -1,122 +0,0 @@
-"""Persisted permission-mode preference (v9.9.8).
-
-Stores the active mode under the data dir so every surface (web, VS Code,
-Telegram, agent loop) shares one dial. Scope:
-
-* global default (env ``LATTICEAI_PERMISSION_MODE`` or strict)
-* per-user override
-* per-workspace override (wins over user)
-
-Changing to ``bypass`` requires ``acknowledge_risk=True`` once; the ack is
-audited. Circuit breakers are enforced by ``latticeai.core.permission_mode``,
-not by this store.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Any, Callable, Dict, Optional
-
-from latticeai.core.permission_mode import (
-    DEFAULT_MODE,
-    PermissionMode,
-    mode_catalog,
-    mode_contract,
-    normalize_mode,
-)
-from latticeai.services.mode_store import JsonBackedModeService
-
-
-class PermissionModeService(JsonBackedModeService[PermissionMode]):
-    """Load / save the autonomy dial."""
-
-    FILENAME = "permission_mode.json"
-
-    def __init__(
-        self,
-        *,
-        data_dir: Path,
-        default_mode: PermissionMode | str = DEFAULT_MODE,
-        audit: Optional[Callable[..., None]] = None,
-    ) -> None:
-        super().__init__(data_dir=data_dir, audit=audit)
-        self._default = normalize_mode(default_mode)
-
-    def _default_entry(self) -> Any:
-        return self._default.value
-
-    def _resolve_from(
-        self,
-        data: Dict[str, Any],
-        *,
-        user_email: Optional[str],
-        workspace_id: Optional[str],
-    ) -> PermissionMode:
-        """Scope precedence: workspace → user → process default."""
-        if workspace_id:
-            ws = (data.get("workspaces") or {}).get(str(workspace_id))
-            if ws:
-                return normalize_mode(ws)
-        if user_email:
-            user = (data.get("users") or {}).get(str(user_email).lower())
-            if user:
-                return normalize_mode(user)
-        return normalize_mode(data.get("default") or self._default)
-
-    def get(
-        self,
-        *,
-        user_email: Optional[str] = None,
-        workspace_id: Optional[str] = None,
-    ) -> Dict[str, Any]:
-        mode = self.resolve(user_email=user_email, workspace_id=workspace_id)
-        contract = mode_contract(mode)
-        contract["catalog"] = mode_catalog()
-        contract["scope"] = {
-            "user_email": user_email,
-            "workspace_id": workspace_id,
-        }
-        return contract
-
-    def set_mode(
-        self,
-        mode: PermissionMode | str,
-        *,
-        user_email: Optional[str] = None,
-        workspace_id: Optional[str] = None,
-        acknowledge_risk: bool = False,
-        source: str = "api",
-    ) -> Dict[str, Any]:
-        mode = normalize_mode(mode)
-        if mode == PermissionMode.BYPASS and not acknowledge_risk:
-            raise PermissionError(
-                "bypass mode requires acknowledge_risk=true "
-                "(YOLO inside the agent workspace; circuit breakers still apply)"
-            )
-        with self._lock:
-            data = self._read()
-            # Lock-free helper on purpose: calling ``resolve`` here would
-            # re-enter ``_lock`` and deadlock every mode change.
-            previous = self._resolve_from(
-                data, user_email=user_email, workspace_id=workspace_id,
-            )
-            if workspace_id:
-                data.setdefault("workspaces", {})[str(workspace_id)] = mode.value
-            elif user_email:
-                data.setdefault("users", {})[str(user_email).lower()] = mode.value
-            else:
-                data["default"] = mode.value
-            self._write(data)
-        self._audit(
-            "permission_mode_changed",
-            user_email=user_email,
-            workspace_id=workspace_id,
-            previous=previous.value,
-            mode=mode.value,
-            source=source,
-            acknowledge_risk=bool(acknowledge_risk),
-        )
-        return self.get(user_email=user_email, workspace_id=workspace_id)
-
-
-__all__ = ["PermissionModeService"]

package/latticeai/services/platform_runtime.py

@@ -1,366 +0,0 @@
-"""v2 Agentic Workspace Platform runtime — cross-system wiring.
-
-This is the single place the v2 subsystems (Plugin SDK, Workflow
-Designer, Multi-Agent Runtime, Realtime) connect to one another and to the
-workspace. Keeping it out of ``server_app`` honours the AGENTS.md preference for
-small, composable modules and keeps the wiring independently testable.
-
-Recursion is bounded by construction: a workflow's ``agent`` node runs an
-orchestrator *without* a workflow runner, and an orchestrator's workflow runner
-runs an engine *without* an ``agent`` runner — so the deepest chains are
-``agent → workflow → (tool|skill|plugin)`` and ``workflow → agent → plugin``.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Callable, Dict, Optional, Set
-
-from fastapi import HTTPException, Request
-
-from lattice_brain.runtime.hooks import dispatch_tool
-from lattice_brain.runtime.multi_agent import (
-    MultiAgentOrchestrator,
-    default_role_runner,
-    llm_role_runner,
-)
-from lattice_brain.workflow import ApprovalRequired, WorkflowEngine
-from latticeai.core.quiet import quiet
-from latticeai.core.tool_registry import SCOPED_KNOWLEDGE_TOOLS
-from latticeai.services.tool_dispatch import enforce_tool_policy
-from latticeai.tools import execute_tool
-
-
-class PlatformRuntime:
-    def __init__(
-        self,
-        *,
-        store,
-        workspace_service,
-        plugin_registry,
-        get_current_user: Callable[[Request], Optional[str]],
-        workspace_graph: Callable[[], Any],
-        workspace_scope_from_request: Callable[[Request], Optional[str]],
-        get_tool_permission: Callable[..., Dict[str, Any]],
-        hooks: Any = None,
-        llm_generate: Optional[Callable[..., str]] = None,
-        llm_available: Optional[Callable[[], bool]] = None,
-        agent_registry: Any = None,
-        memory_recall: Optional[Callable[..., Dict[str, Any]]] = None,
-    ):
-        self.store = store
-        self.svc = workspace_service
-        self.registry = plugin_registry
-        self.get_current_user = get_current_user
-        self.workspace_graph = workspace_graph
-        self.scope_from_request = workspace_scope_from_request
-        self.get_tool_permission = get_tool_permission
-        # Lifecycle hooks registry — wires the workflow runtime + workflow tool
-        # nodes into the same pre_*/post_* lifecycle as the HTTP + agent paths.
-        self.hooks = hooks
-        # v4 (T7b): a synchronous model bridge. When a model is loaded,
-        # build_orchestrator returns the REAL (mode='llm') runner; otherwise
-        # the deterministic runner, honestly labeled mode='simulation'.
-        self.llm_generate = llm_generate
-        self.llm_available = llm_available or (lambda: False)
-        self.agent_registry = agent_registry
-        self.memory_recall = memory_recall
-
-    # ── request gating ────────────────────────────────────────────────────
-
-    def gate_read(self, request: Request) -> Optional[str]:
-        try:
-            return self.svc.resolve_read_scope(self.scope_from_request(request), self.get_current_user(request))
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-
-    def gate_write(self, request: Request) -> Optional[str]:
-        try:
-            return self.svc.resolve_write_scope(self.scope_from_request(request), self.get_current_user(request))
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-
-    def allowed_scopes(self, user: Optional[str]) -> Optional[Set[str]]:
-        try:
-            workspaces = self.svc.list_workspaces(user or None).get("workspaces", [])
-            return {ws.get("workspace_id") for ws in workspaces if ws.get("workspace_id")}
-        except Exception:
-            # ``None`` deliberately means "unscoped local/no-auth mode" to
-            # search and realtime consumers. Returning it for an authenticated
-            # account on a storage/service failure would therefore fail open
-            # and expose every workspace. Authenticated failures see nothing;
-            # only the explicit anonymous local mode keeps legacy semantics.
-            return set() if user else None
-
-    # ── plugin lifecycle hooks ────────────────────────────────────────────
-
-    def register_plugin_skill(self, skill_name: str, plugin_id: str):
-        return self.store.mark_skill_installed(
-            skill_name, version=f"plugin:{plugin_id}", metadata={"source": f"plugin:{plugin_id}"}
-        )
-
-    # ── shared node runners ───────────────────────────────────────────────
-
-    def _tool_node_runner(self, user=None, scope=None):
-        """Workflow tool node: EXECUTES the tool under governance (v4).
-
-        Auto-approve tools run immediately through the shared dispatch_tool
-        lifecycle. Tools whose policy requires approval raise
-        :class:`ApprovalRequired` so the engine pauses the run into
-        ``awaiting_approval`` — never a silent ``{recorded: true}`` success,
-        never an unapproved execution. A resumed run carries the approved
-        node id in ``context['__approved_nodes__']``.
-        """
-        def runner(*, node, context):
-            cfg = node.get("config") or {}
-            name = cfg.get("tool") or ""
-            args = dict(cfg.get("args") or {})
-            if not name:
-                raise ValueError("tool node has no tool configured")
-            if name in SCOPED_KNOWLEDGE_TOOLS:
-                args["workspace_id"] = scope or "personal"
-                args["user_email"] = user or "local"
-            try:
-                permission = dict(self.get_tool_permission(name, args))
-            except TypeError:
-                permission = dict(self.get_tool_permission(name))
-            approved_nodes = set(context.get("__approved_nodes__") or [])
-            if permission.get("requires_approval") and node.get("id") not in approved_nodes:
-                raise ApprovalRequired(
-                    f"tool '{name}' requires explicit approval before a workflow may run it",
-                    tool=name, args=args, permission=permission,
-                )
-
-            def _execute():
-                return execute_tool(name, args)
-
-            # Same tool lifecycle as the HTTP + agent paths (a pre_tool block
-            # raises PermissionError, surfaced as the node error by the engine).
-            result = dispatch_tool(self.hooks, name, args, _execute, source="workflow")
-            return {"tool": name, "args": args, "executed": True,
-                    "permission": permission, "result": result}
-        return runner
-
-    def _skill_node_runner(self):
-        """Skill nodes refuse honestly: a skill is an instruction package for
-        an LLM; without a model-driven executor there is nothing to run, and
-        pretending otherwise (the pre-v4 existence check that reported 'ok')
-        is exactly the fake functionality v4 bans."""
-        def runner(*, node, context):
-            cfg = node.get("config") or {}
-            name = cfg.get("skill") or ""
-            entry = self.store.load_state().get("skill_registry", {}).get(name) or {}
-            if not entry:
-                raise ValueError(f"skill '{name}' is not installed")
-            raise RuntimeError(
-                f"skill '{name}' requires LLM-driven execution, which workflow "
-                "skill nodes do not provide in this build — refusing to fake a result"
-            )
-        return runner
-
-    def _context_provider(self, user, scope):
-        def provider(goal: str):
-            recall = getattr(self, "memory_recall", None)
-            if recall is not None:
-                try:
-                    payload = recall(
-                        goal,
-                        user_email=user,
-                        workspace_id=scope,
-                        limit=8,
-                    )
-                    results = payload.get("results") or payload.get("items") or []
-                    evidence = []
-                    for item in results[:8]:
-                        if not isinstance(item, dict):
-                            continue
-                        source = str(item.get("source") or "memory")
-                        title = str(item.get("title") or item.get("kind") or "Memory")
-                        snippet = str(item.get("snippet") or item.get("content") or "").strip()
-                        if snippet:
-                            evidence.append(f"[{source}] {title}: {snippet[:240]}")
-                    if evidence:
-                        return evidence
-                except Exception:
-                    # Recall is an enrichment seam; the legacy store fallback
-                    # keeps agent execution available if it degrades.
-                    quiet()
-            try:
-                mems = self.store.search_memories(goal, user_email=user, workspace_id=scope).get("memories", [])
-                ctx = [str(m.get("content") or "")[:180] for m in mems[:6]]
-                # Enrich with agent-synthesis memories preferentially for self-improving Brain feel
-                try:
-                    allm = self.store.list_memories(user_email=user, workspace_id=scope).get("memories", [])
-                    synth = [str(m.get("content") or "")[:160] for m in allm if "agent-synthesis" in (m.get("tags") or [])][:3]
-                    ctx = synth + ctx
-                except Exception:
-                    quiet()
-                if not ctx:
-                    try:
-                        recent = self.store.list_memories(user_email=user, workspace_id=scope).get("memories", [])
-                        # list_memories is newest-first; automation should ground
-                        # itself in the knowledge that just entered the Brain.
-                        ctx = [str(m.get("content") or "")[:180] for m in recent[:8]]
-                    except Exception:
-                        quiet()
-                return ctx[:8]
-            except Exception:
-                return []
-        return provider
-
-    def plugin_capability_runners(self, user, scope) -> Dict[str, Callable[..., Any]]:
-        """Runners the Plugin SDK boundary dispatches to (one per capability)."""
-        def run_skill(*, plugin_id, action, args, manifest):
-            raise RuntimeError(
-                f"plugin '{plugin_id}' skill execution requires an LLM-driven "
-                "runner, which this build does not provide — refusing to fake a result"
-            )
-
-        def run_tool(*, plugin_id, action, args, manifest):
-            tool = args.get("tool") or (manifest.provides.get("tools") or [None])[0]
-            if not tool:
-                raise ValueError(f"plugin '{plugin_id}' run_tool needs a tool name")
-            args = dict(args)
-            if tool in SCOPED_KNOWLEDGE_TOOLS:
-                args["workspace_id"] = scope or "personal"
-                args["user_email"] = user or "local"
-            policy = enforce_tool_policy(
-                tool,
-                args,
-                current_user=user or "",
-                source="plugin",
-            )
-            permission = dict(self.get_tool_permission(tool, args))
-            result = dispatch_tool(self.hooks, tool, args, lambda: execute_tool(tool, args),
-                                   source=f"plugin:{plugin_id}")
-            return {"plugin": plugin_id, "tool": tool, "permission": permission, "policy": dict(policy),
-                    "executed": True, "result": result}
-
-        def run_workflow(*, plugin_id, action, args, manifest):
-            wf_id = args.get("workflow_id")
-            if not wf_id:
-                return {"plugin": plugin_id, "skipped": "no workflow_id"}
-            return self.run_workflow_by_id(wf_id, user, scope, with_agent=False, inputs=args.get("inputs"))
-
-        def run_agent(*, plugin_id, action, args, manifest):
-            goal = args.get("goal") or f"Plugin {plugin_id} agent task"
-            return self.run_agent(goal, user, scope, with_workflow=False, inputs=args.get("inputs"))
-
-        return {"skills": run_skill, "tools": run_tool, "workflows": run_workflow, "agents": run_agent}
-
-    def _plugin_node_runner(self, user, scope):
-        def runner(*, node, context):
-            cfg = node.get("config") or {}
-            plugin_id = cfg.get("plugin_id") or cfg.get("plugin") or ""
-            action = cfg.get("action") or "run_skill"
-            result = self.registry.execute_action(
-                plugin_id, action, cfg.get("args") or {}, runners=self.plugin_capability_runners(user, scope), workspace_id=scope
-            )
-            return result.as_dict()
-        return runner
-
-    def _agent_node_runner(self, user, scope):
-        def runner(*, node, context):
-            cfg = node.get("config") or {}
-            goal = cfg.get("goal") or cfg.get("prompt") or context.get("goal") or "Run agent"
-            roles = cfg.get("roles")
-            if not roles and (cfg.get("mode") == "draft" or cfg.get("prompt")):
-                roles = ["researcher", "planner", "executor", "reviewer"]
-            return self.run_agent(
-                goal,
-                user,
-                scope,
-                with_workflow=False,
-                roles=roles,
-                inputs=context.get("inputs"),
-            )
-        return runner
-
-    # ── cross-system runs ─────────────────────────────────────────────────
-
-    def run_workflow_by_id(self, workflow_id, user, scope, *, with_agent: bool, inputs=None) -> Dict[str, Any]:
-        try:
-            workflow = self.store.get_workflow(workflow_id, workspace_id=scope)
-        except FileNotFoundError:
-            return {"error": f"workflow not found: {workflow_id}"}
-        runners = {
-            "tool": self._tool_node_runner(user, scope),
-            "skill": self._skill_node_runner(),
-            "plugin": self._plugin_node_runner(user, scope),
-        }
-        if with_agent:
-            runners["agent"] = self._agent_node_runner(user, scope)
-        result = WorkflowEngine(runners, hooks=self.hooks).run(workflow, inputs=inputs or {})
-        run = self.store.record_workflow_run(
-            workflow_id=workflow_id, name=workflow.get("name") or "workflow",
-            status=result.status, timeline=result.timeline, outputs=result.outputs,
-            user_email=user, graph=self.workspace_graph(), workspace_id=scope,
-            mode="live",
-            pause={"node": result.paused_node, "pending": result.pending_approval,
-                   "context": result.paused_context} if result.status == "awaiting_approval" else None,
-        )
-        return {"workflow_run_id": run["id"], "status": result.status}
-
-    def run_agent(self, goal, user, scope, *, with_workflow: bool, roles=None, inputs=None) -> Dict[str, Any]:
-        orchestrator = self.build_orchestrator(user, scope, with_workflow=with_workflow)
-        result = orchestrator.run(
-            goal, user_email=user, workspace_id=scope, roles=roles, inputs=inputs or {}
-        )
-        run = self.store.record_agent_run(
-            agent_id=result.agent_id, status=result.status, input_text=goal,
-            output_text=result.output, timeline=result.timeline, relationships=[],
-            handoffs=result.handoffs, context_packets=result.context_packets,
-            plan=result.plan, plan_review=result.plan_review,
-            review_history=result.review_history, retry_history=result.retry_history,
-            memory_snapshots=result.memory_snapshots,
-            user_email=user, graph=self.workspace_graph(), workspace_id=scope,
-        )
-        return {"agent_run_id": run["id"], "status": result.status, "output": result.output}
-
-    # ── factories passed to routers ───────────────────────────────────────
-
-    def build_workflow_runners(self, user, scope) -> Dict[str, Callable[..., Any]]:
-        return {
-            "tool": self._tool_node_runner(user, scope),
-            "skill": self._skill_node_runner(),
-            "plugin": self._plugin_node_runner(user, scope),
-            "agent": self._agent_node_runner(user, scope),
-        }
-
-    def build_orchestrator(self, user, scope, *, with_workflow: bool = True) -> MultiAgentOrchestrator:
-        workflow_runner = (
-            (lambda wf_ref, ctx: self.run_workflow_by_id(wf_ref, user, scope, with_agent=False, inputs=ctx.inputs))
-            if with_workflow
-            else None
-        )
-        plugin_runner = lambda pid, ctx: self.registry.execute_action(pid, "run_skill", {}, runners=self.plugin_capability_runners(user, scope), workspace_id=scope).as_dict()  # noqa: E731
-        context_provider = self._context_provider(user, scope)
-        custom_agents = {}
-        if self.agent_registry is not None:
-            try:
-                custom_agents = {
-                    a["id"]: a for a in self.agent_registry.all()
-                    if str(a.get("id", "")).startswith("agent:custom:") and a.get("enabled", True)
-                }
-            except Exception:
-                custom_agents = {}
-        if self.llm_generate is not None and self.llm_available():
-            from latticeai.core.agent_prompts import CRITIC_PROMPT, PLANNER_PROMPT
-
-            return MultiAgentOrchestrator(
-                role_runner=llm_role_runner(
-                    generate=self.llm_generate,
-                    planner_prompt=PLANNER_PROMPT,
-                    critic_prompt=CRITIC_PROMPT,
-                    context_provider=context_provider,
-                    workflow_runner=workflow_runner,
-                    plugin_runner=plugin_runner,
-                    custom_agents=custom_agents,
-                ),
-                mode="llm",
-                custom_agents=custom_agents,
-            )
-        return MultiAgentOrchestrator(role_runner=default_role_runner(
-            workflow_runner=workflow_runner,
-            plugin_runner=plugin_runner,
-            context_provider=context_provider,
-        ), mode="simulation", custom_agents=custom_agents)