ltcai 11.5.2 → 11.7.0

package/latticeai/cli/entrypoint.py

@@ -1,281 +1,68 @@
-"""Command line entrypoint for Lattice AI."""
+"""``LTCAI`` — start the AI-Worker this machine's Lattice host talks to.
 
-from __future__ import annotations
-
-import argparse
-import os
-import platform
-import re
-import shutil
-import socket
-import stat
-import subprocess
-import sys
-import threading
-import time
-import urllib.request
-from pathlib import Path
-
-from latticeai.cli.runtime import (
-    _apply_extra_path,
-    _has_module,
-    _load_env_file,
-)
-from latticeai.core.quiet import quiet
-
-
-def _local_ips() -> list[str]:
-    ips: list[str] = []
-    try:
-        hostname = socket.gethostname()
-        for info in socket.getaddrinfo(hostname, None):
-            addr = str(info[4][0])
-            if ":" not in addr and not addr.startswith("127."):
-                if addr not in ips:
-                    ips.append(addr)
-    except Exception:
-        quiet()
-    if not ips:
-        try:
-            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-            s.connect(("8.8.8.8", 80))
-            ips.append(s.getsockname()[0])
-            s.close()
-        except Exception:
-            quiet()
-    return ips
-
-
-def _print_banner(host: str, port: int, tunnel_url: str | None = None) -> None:
-    local_url = f"http://localhost:{port}"
-    print()
-    print("=" * 56)
-    print("  Lattice AI is running")
-    print(f"  Local:    {local_url}")
-    if host == "0.0.0.0":
-        for ip in _local_ips():
-            print(f"  Network:  http://{ip}:{port}")
-        print()
-        print("  Other devices on the same Wi-Fi can open the")
-        print("  Network URL above in their browser.")
-        print("  On iPad/Android: browser menu → 'Add to Home Screen'")
-    if tunnel_url:
-        print()
-        print(f"  Tunnel:   {tunnel_url}")
-        print("  Anyone on the internet can access via the Tunnel URL.")
-    print("=" * 56)
-    print()
-
-
-def doctor() -> int:
-    checks = [
-        ("Python 3.11+", sys.version_info >= (3, 11), sys.version.split()[0], True),
-        ("FastAPI", _has_module("fastapi"), "required server dependency", True),
-        ("Uvicorn", _has_module("uvicorn"), "required server dependency", True),
-        ("OpenAI SDK", _has_module("openai"), "required for cloud providers", False),
-        ("MLX", _has_module("mlx"), "required for Apple Silicon multimodal models", False),
-        ("MLX-VLM", _has_module("mlx_vlm"), "required for Gemma-4/VLM models", False),
-        ("Ollama binary", shutil.which("ollama") is not None, "optional local-server engine", False),
-    ]
-    data_dir = Path(os.getenv("LATTICEAI_DATA_DIR") or Path.home() / ".ltcai")
-    static_dir = Path(os.getenv("LATTICEAI_STATIC_DIR") or Path(__file__).resolve().parent / "static")
-    checks.extend([
-        ("Data dir", data_dir.exists() or data_dir.parent.exists(), str(data_dir), True),
-        ("Static UI", static_dir.exists(), str(static_dir), True),
-    ])
-
-    ok = True
-    for label, passed, detail, required in checks:
-        icon = "OK" if passed else ("MISS" if required else "OPTIONAL")
-        print(f"[{icon}] {label}: {detail}")
-        ok = ok and (passed or not required)
-
-    cloud_keys = ["OPENAI_API_KEY", "OPENROUTER_API_KEY", "GROQ_API_KEY", "TOGETHER_API_KEY"]
-    configured = [key for key in cloud_keys if os.getenv(key)]
-    print(f"[INFO] Cloud keys configured: {', '.join(configured) if configured else 'none'}")
-    return 0 if ok else 1
-
-
-# ── Cloudflare Tunnel ─────────────────────────────────────────────────────────
-
-def _cloudflared_url() -> str:
-    system = sys.platform
-    machine = platform.machine().lower()
-    base = "https://github.com/cloudflare/cloudflared/releases/latest/download"
-    if system == "darwin":
-        arch = "arm64" if machine in ("arm64", "aarch64") else "amd64"
-        return f"{base}/cloudflared-darwin-{arch}"
-    if system == "win32":
-        return f"{base}/cloudflared-windows-amd64.exe"
-    arch = "arm64" if machine in ("arm64", "aarch64") else "amd64"
-    return f"{base}/cloudflared-linux-{arch}"
-
-
-def _cloudflared_bin() -> Path:
-    suffix = ".exe" if sys.platform == "win32" else ""
-    return Path.home() / ".latticeai" / "bin" / f"cloudflared{suffix}"
+This used to be the product's front door: it printed the LAN banner, ran a
+``doctor`` dependency check, could open a Cloudflare tunnel, sent a Telegram
+"server started" notification, and served ``server:app`` — the 464-route
+FastAPI application.
 
+v11.6.0 made ``lattice-host`` the product server (plan §설계 결정 1). The host
+is what ``bin/ltcai.js`` starts, the host owns the banner and the network
+posture, and the host is what *supervises this process*. So the entrypoint is
+now one job: bind the worker profile on a loopback address and serve it.
 
-def _ensure_cloudflared() -> str:
-    found = shutil.which("cloudflared")
-    if found:
-        return found
-    dest = _cloudflared_bin()
-    if dest.exists():
-        return str(dest)
-    dest.parent.mkdir(parents=True, exist_ok=True)
-    url = _cloudflared_url()
-    print("  cloudflared not found — downloading from GitHub...")
-    try:
-        urllib.request.urlretrieve(url, dest)
-        if sys.platform != "win32":
-            dest.chmod(dest.stat().st_mode | stat.S_IEXEC | stat.S_IXGRP | stat.S_IXOTH)
-        print(f"  cloudflared installed at {dest}")
-        return str(dest)
-    except Exception as e:
-        print(f"  cloudflared download failed: {e}")
-        print("  Install manually: https://developers.cloudflare.com/cloudflared/install")
-        return ""
+Everything removed went somewhere real rather than away — the banner and the
+reachability report to the host's own startup, ``doctor`` to ``GET /health``'s
+access block (which the supervisor already polls), the tunnel to the network
+boundary controls, the Telegram bridge to the bot's own process. What is left
+would be a `uvicorn` invocation if it were not for the two lines above it: the
+``.env`` file and ``LATTICEAI_EXTRA_PATH``, which a desktop bundle depends on
+being applied *before* configuration is read.
 
+The host normally launches the ASGI factory directly::
 
-def _send_telegram(token: str, chat_id: str, text: str) -> None:
-    try:
-        data = urllib.parse.urlencode({"chat_id": chat_id, "text": text}).encode()
-        req = urllib.request.Request(
-            f"https://api.telegram.org/bot{token}/sendMessage",
-            data=data,
-        )
-        urllib.request.urlopen(req, timeout=10)
-    except Exception:
-        quiet()
+    python -m uvicorn latticeai.worker_app:create_worker_app --factory --host 127.0.0.1 --port N
 
+and this command is the equivalent for a person debugging a worker by hand.
+"""
 
-def _start_tunnel(port: int) -> str | None:
-
-    bin_path = _ensure_cloudflared()
-    if not bin_path:
-        return None
-
-    log_path = Path.home() / ".latticeai" / "tunnel.log"
-    log_path.parent.mkdir(parents=True, exist_ok=True)
-
-    # Detached on purpose: the tunnel outlives this helper; the log file is
-    # the observable surface.
-    subprocess.Popen(
-        [bin_path, "tunnel", "--url", f"http://localhost:{port}"],
-        stdout=open(log_path, "w"),
-        stderr=subprocess.STDOUT,
-    )
-
-    # Wait for the public URL (up to 30s)
-    pattern = re.compile(r"https://[a-z0-9-]+\.trycloudflare\.com")
-    deadline = time.time() + 30
-    url: str | None = None
-    while time.time() < deadline:
-        time.sleep(0.5)
-        try:
-            text = log_path.read_text(errors="replace")
-            m = pattern.search(text)
-            if m:
-                url = m.group(0)
-                break
-        except Exception:
-            quiet()
-
-    if not url:
-        return None
-
-    # Telegram notification if configured
-    token = os.getenv("LATTICEAI_TELEGRAM_BOT_TOKEN", "")
-    chat_id = os.getenv("LATTICEAI_TELEGRAM_CHAT_ID", "")
-    if token and chat_id:
-        msg = (
-            f"✅ Lattice AI 시작됨\n\n"
-            f"🌐 외부 URL: {url}\n"
-            f"🏠 로컬: http://localhost:{port}"
-        )
-        threading.Thread(target=_send_telegram, args=(token, chat_id, msg), daemon=True).start()
+from __future__ import annotations
 
-    return url
+import argparse
+import os
+from pathlib import Path
 
+from latticeai.cli.runtime import _apply_extra_path, _load_env_file
 
-# ─────────────────────────────────────────────────────────────────────────────
 
 def main() -> None:
     app_dir = Path(__file__).resolve().parent
     _load_env_file(app_dir / ".env")
     _apply_extra_path()
 
-    parser = argparse.ArgumentParser(prog="LTCAI", description="Run the Lattice AI local server.")
-    subparsers = parser.add_subparsers(dest="command")
-    subparsers.add_parser("doctor", help="Check local runtime dependencies and configuration.")
+    parser = argparse.ArgumentParser(
+        prog="LTCAI",
+        description="Run the Lattice AI compute worker (the product server is lattice-host).",
+    )
     parser.add_argument("--host", default=os.getenv("LATTICEAI_HOST") or "127.0.0.1")
     parser.add_argument("--port", type=int, default=int(os.getenv("LATTICEAI_PORT") or "4825"))
-    parser.add_argument("--reload", action="store_true", help="Enable uvicorn reload for local development.")
     parser.add_argument(
-        "--tunnel",
-        action="store_true",
-        help="Open a public Cloudflare tunnel so anyone can access this server from the internet.",
+        "--reload", action="store_true", help="Enable uvicorn reload for local development."
     )
     args = parser.parse_args()
 
-    if args.command == "doctor":
-        raise SystemExit(doctor())
-
     os.chdir(app_dir)
-
-    if not args.tunnel and os.getenv("LATTICEAI_TUNNEL", "").lower() in (
-        "1",
-        "true",
-        "yes",
-    ):
-        print(
-            "  LATTICEAI_TUNNEL is ignored during default local startup; "
-            "restart with --tunnel to expose this server."
-        )
-
-    # --tunnel forces 0.0.0.0 so cloudflared can reach the server
-    if args.tunnel and args.host == "127.0.0.1":
-        args.host = "0.0.0.0"
-        os.environ.setdefault("LATTICEAI_HOST", "0.0.0.0")
-        os.environ.setdefault("LATTICEAI_CORS_ALLOW_NETWORK", "true")
-        os.environ.setdefault("LATTICEAI_REQUIRE_AUTH", "true")
-
-    # Keep the app config in sync with CLI flags. ``Config.from_env`` is the
-    # source of truth for /mode, /health.features, SSO defaults, and routers.
+    # ``Config.from_env`` is the source of truth for the address the worker
+    # binds and reports on ``/health``; the flags are written back so a
+    # command-line override and the configuration cannot disagree.
     os.environ["LATTICEAI_HOST"] = str(args.host)
     os.environ["LATTICEAI_PORT"] = str(args.port)
 
-    tunnel_url: str | None = None
-    if args.tunnel:
-        print()
-        print("  Starting Cloudflare tunnel...")
-        tunnel_url = _start_tunnel(args.port)
-        if not tunnel_url:
-            print("  ⚠️  Tunnel URL not obtained — server will start without tunnel.")
-
-    _print_banner(args.host, args.port, tunnel_url)
-
-    # Telegram startup notification (local start, tunnel handled separately inside _start_tunnel)
-    if not args.tunnel:
-        _tg_enabled = os.getenv("LATTICEAI_ENABLE_TELEGRAM", "").strip().lower() in ("1", "true", "yes", "on")
-        _tg_token = os.getenv("LATTICEAI_TELEGRAM_BOT_TOKEN", "")
-        _tg_chat  = os.getenv("LATTICEAI_TELEGRAM_CHAT_ID", "")
-        if _tg_enabled and _tg_token and _tg_chat:
-            _local_msg = (
-                f"✅ Lattice AI 시작됨\n\n"
-                f"🏠 로컬: http://localhost:{args.port}"
-            )
-            threading.Thread(
-                target=_send_telegram,
-                args=(_tg_token, _tg_chat, _local_msg),
-                daemon=True,
-            ).start()
-
     import uvicorn
 
+    print(f"🧠 Lattice AI worker on http://{args.host}:{args.port}")
     uvicorn.run(
-        "server:app",
+        "latticeai.worker_app:create_worker_app",
+        factory=True,
         host=args.host,
         port=args.port,
         reload=args.reload,

package/latticeai/core/agent_permission.py

@@ -1,71 +1,31 @@
-"""Agent-loop permission-mode gates (v9.9.8).
-
-Kept separate from ``agent.py`` so the large state-machine module stays
-stable; ``SingleAgentRuntime`` and ``build_agent_runtime`` call these
-helpers instead of inlining mode tables.
+"""Agent-loop permission-mode gates (v9.9.8) — the two the parity fixtures pin.
+
+These were the Python loop's mode tables, called by ``SingleAgentRuntime`` and
+``build_agent_runtime``. Orchestration moved to ``lattice-agent`` in v11.6.0 and
+the Python loop is gone, so **nothing in the worker imports this module**.
+
+It survives for one reason, stated so it is not read as a leftover:
+``scripts/generate_agent_parity_fixtures.py`` produces the committed goldens
+``rust/fixtures`` holds for the Rust loop's permission gates, and it derives
+them from :func:`block_reason_for_tool` and :func:`non_auto_plan_steps` here.
+Deleting these two would leave the Rust side asserting against fixtures no
+Python could regenerate — the fixtures would still pass, and would stop meaning
+anything. The rest of the module (``call_mode_source``, ``resolve_deps_mode``,
+``approval_requirements_for``) went with the loop that called it.
 """
 
 from __future__ import annotations
 
-from typing import Any, Dict, List, Mapping, Optional, Sequence
+from typing import Any, List, Mapping, Optional, Sequence
 
 from latticeai.core.permission_mode import (
-    DEFAULT_MODE,
     PermissionMode,
     effective_auto_approve,
     is_circuit_breaker,
     normalize_mode,
-    plan_requires_approval,
 )
 
 
-def call_mode_source(
-    raw: Any,
-    *,
-    user_email: Optional[str] = None,
-    workspace_id: Optional[str] = None,
-) -> Any:
-    """Resolve a mode source that may be a value, or a callable that either
-    accepts ``user_email``/``workspace_id`` scope kwargs or takes no arguments.
-
-    Scoped resolution is what makes per-user and per-workspace overrides real:
-    an unscoped call always collapses to the process-wide default.
-    """
-    if not callable(raw):
-        return raw
-    try:
-        return raw(user_email=user_email, workspace_id=workspace_id)
-    except TypeError:
-        # Legacy zero-arg resolver (or a static callable) — fall back.
-        try:
-            return raw()
-        except Exception:
-            return DEFAULT_MODE
-    except Exception:
-        return DEFAULT_MODE
-
-
-def resolve_deps_mode(
-    deps: Any,
-    ctx: Any = None,
-    *,
-    user_email: Optional[str] = None,
-    workspace_id: Optional[str] = None,
-) -> PermissionMode:
-    """Mode for this run: explicit context stamp wins, else the scoped resolver
-    on ``deps``, else strict."""
-    if ctx is not None:
-        override = getattr(ctx, "permission_mode", None)
-        if override is not None:
-            return normalize_mode(override)
-    raw = call_mode_source(
-        getattr(deps, "permission_mode", None),
-        user_email=user_email,
-        workspace_id=workspace_id,
-    )
-    return normalize_mode(raw if raw is not None else DEFAULT_MODE)
-
-
 def non_auto_plan_steps(
     mode: PermissionMode | str,
     steps: Sequence[Mapping[str, Any]],
@@ -94,38 +54,6 @@ def non_auto_plan_steps(
     return non_auto
 
 
-def approval_requirements_for(
-    mode: PermissionMode | str,
-    plan: Mapping[str, Any],
-    tool_governance: Mapping[str, Mapping[str, Any]],
-    *,
-    governed_tools: Optional[Any] = None,
-) -> Dict[str, Any]:
-    steps = plan.get("steps") or []
-    non_auto = non_auto_plan_steps(
-        mode, steps, tool_governance, governed_tools=governed_tools,
-    )
-    requires = plan_requires_approval(
-        mode,
-        non_auto_steps=non_auto,
-        plan_flag=bool(plan.get("requires_approval", False)),
-    )
-    lines = [
-        f"{index}. {step.get('description') or step.get('action') or '?'}"
-        for index, step in enumerate(steps, start=1)
-        if isinstance(step, dict)
-    ]
-    summary = str(plan.get("goal") or "").strip()
-    if lines:
-        summary = (summary + "\n" if summary else "") + "\n".join(lines)
-    return {
-        "requires_approval": requires,
-        "non_auto_steps": non_auto,
-        "plan_summary": summary,
-        "permission_mode": normalize_mode(mode).value,
-    }
-
-
 def block_reason_for_tool(
     mode: PermissionMode | str,
     name: str,
@@ -152,9 +80,6 @@ def block_reason_for_tool(
 
 
 __all__ = [
-    "call_mode_source",
-    "resolve_deps_mode",
-    "non_auto_plan_steps",
-    "approval_requirements_for",
     "block_reason_for_tool",
+    "non_auto_plan_steps",
 ]