ltcai 11.5.2 → 11.7.0

package/latticeai/tools/filesystem.py

@@ -6,13 +6,11 @@ Path resolution reads ``latticeai.tools.AGENT_ROOT`` so tests can redirect the s
 
 from __future__ import annotations
 
-import io
 import json
 import re
-import zipfile
 from html.parser import HTMLParser
 from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional
 
 import latticeai.tools as tools
 from latticeai.core.quiet import quiet
@@ -118,52 +116,6 @@ def read_file(path: str, offset: int = 0, limit: int = 0, line_numbers: bool = T
     return result
 
 
-def write_file(path: str, content: str) -> Dict[str, Any]:
-    target = _resolve_path(path)
-    if len(content.encode("utf-8")) > MAX_FILE_BYTES:
-        raise ToolError("Content is too large to write.")
-    target.parent.mkdir(parents=True, exist_ok=True)
-    target.write_text(content, encoding="utf-8")
-    return {"path": _relative(target), "bytes": target.stat().st_size}
-
-
-def edit_file(path: str, old_string: str, new_string: str, replace_all: bool = False) -> Dict[str, Any]:
-    """Precise diff-style edit: replace `old_string` with `new_string` in `path`.
-
-    Fails when `old_string` is missing or appears more than once (unless
-    replace_all=True). This forces the caller to read the file first and pass
-    enough surrounding context to uniquely identify the edit site — the same
-    discipline Claude Code uses for safe edits.
-    """
-    if old_string == new_string:
-        raise ToolError("old_string and new_string are identical; nothing to change.")
-    target = _resolve_path(path)
-    if not target.exists() or not target.is_file():
-        raise ToolError("File does not exist.")
-    if target.stat().st_size > MAX_FILE_BYTES:
-        raise ToolError("File is too large to edit.")
-
-    original = target.read_text(encoding="utf-8")
-    occurrences = original.count(old_string)
-    if occurrences == 0:
-        raise ToolError("old_string not found in file. Read the file first and copy the exact bytes (including whitespace).")
-    if occurrences > 1 and not replace_all:
-        raise ToolError(f"old_string is ambiguous: appears {occurrences} times. Add more context to make it unique, or pass replace_all=true.")
-
-    updated = original.replace(old_string, new_string) if replace_all else original.replace(old_string, new_string, 1)
-    if len(updated.encode("utf-8")) > MAX_FILE_BYTES:
-        raise ToolError("Resulting file would exceed the workspace size limit.")
-    target.write_text(updated, encoding="utf-8")
-
-    edited_line = original[: original.find(old_string)].count("\n") + 1
-    return {
-        "path": _relative(target),
-        "replacements": occurrences if replace_all else 1,
-        "bytes": target.stat().st_size,
-        "first_edit_line": edited_line,
-    }
-
-
 _GREP_BINARY_EXTS = {".png", ".jpg", ".jpeg", ".gif", ".webp", ".pdf", ".zip", ".tar",
                     ".gz", ".bz2", ".xz", ".7z", ".mp3", ".mp4", ".mov", ".wav",
                     ".woff", ".woff2", ".ttf", ".eot", ".ico", ".db", ".sqlite",
@@ -281,46 +233,6 @@ def todo_read() -> Dict[str, Any]:
     return {"todos": todos, "path": _TODO_REL_PATH}
 
 
-def todo_write(todos: List[Dict[str, Any]]) -> Dict[str, Any]:
-    """Replace the agent's TODO list. Each todo: {id, content, status}.
-
-    Status must be one of: pending, in_progress, completed.
-    At most one todo should be in_progress at any time — the agent enforces
-    this convention; the tool only warns if violated.
-    """
-    if not isinstance(todos, list):
-        raise ToolError("todos must be a list.")
-    if len(todos) > 50:
-        raise ToolError("Too many todos (max 50). Split into smaller batches.")
-
-    cleaned: List[Dict[str, Any]] = []
-    in_progress_count = 0
-    for idx, raw in enumerate(todos, start=1):
-        if not isinstance(raw, dict):
-            raise ToolError(f"Todo #{idx} is not an object.")
-        content = str(raw.get("content") or "").strip()
-        if not content:
-            raise ToolError(f"Todo #{idx} is missing 'content'.")
-        status = str(raw.get("status") or "pending").strip().lower()
-        if status not in _TODO_ALLOWED_STATUS:
-            raise ToolError(f"Todo #{idx} has invalid status '{status}'. Use one of {sorted(_TODO_ALLOWED_STATUS)}.")
-        if status == "in_progress":
-            in_progress_count += 1
-        cleaned.append({
-            "id": str(raw.get("id") or idx),
-            "content": content[:240],
-            "status": status,
-        })
-
-    target = _todo_file()
-    target.write_text(json.dumps(cleaned, ensure_ascii=False, indent=2), encoding="utf-8")
-    return {
-        "todos": cleaned,
-        "path": _TODO_REL_PATH,
-        "warning": "More than one todo is in_progress; keep only one active at a time." if in_progress_count > 1 else None,
-    }
-
-
 def search_files(query: str, path: str = ".", max_results: int = 20) -> Dict[str, Any]:
     if not query:
         raise ToolError("Query is required.")
@@ -434,166 +346,8 @@ def preview_url(path: str = "index.html") -> Dict[str, Any]:
     }
 
 
-def create_web_project(path: str, framework: str = "react", template: str = "vite") -> Dict[str, Any]:
-    framework = str(framework or "").strip().lower()
-    template = str(template or "").strip().lower()
-    if framework != "react" or template != "vite":
-        raise ToolError("Only React + Vite template is currently supported.")
-    if not path:
-        raise ToolError("Project path is required.")
-
-    root = _resolve_path(path)
-    root.mkdir(parents=True, exist_ok=True)
-
-    files = {
-        "package.json": json.dumps(
-            {
-                "name": Path(path).name.replace(" ", "-").lower() or "vite-react-app",
-                "private": True,
-                "version": "0.0.0",
-                "type": "module",
-                "scripts": {
-                    "dev": "vite",
-                    "build": "vite build",
-                    "preview": "vite preview",
-                },
-                "dependencies": {
-                    "react": "^18.3.1",
-                    "react-dom": "^18.3.1",
-                },
-                "devDependencies": {
-                    "@vitejs/plugin-react": "^4.3.1",
-                    "vite": "^5.4.0",
-                },
-            },
-            ensure_ascii=False,
-            indent=2,
-        ) + "\n",
-        "index.html": """<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Vite React App</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.jsx"></script>
-  </body>
-</html>
-""",
-        "vite.config.js": """import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
-
-export default defineConfig({
-  plugins: [react()],
-})
-""",
-        "README.md": """# Vite React App
-
-## Run
-
-```bash
-npm install
-npm run dev
-```
-
-## Build
-
-```bash
-npm run build
-npm run preview
-```
-
-## Lattice AI Notes
-
-- Inspect `package.json` and existing config files before adding new libraries.
-- If you add Tailwind CSS, framer-motion, TypeScript, or other tooling, add the required config files too.
-- Do not report the app as complete until `npm run build` succeeds.
-""",
-        "src/main.jsx": """import React from 'react'
-import ReactDOM from 'react-dom/client'
-import App from './App.jsx'
-import './index.css'
-
-ReactDOM.createRoot(document.getElementById('root')).render(
-  <React.StrictMode>
-    <App />
-  </React.StrictMode>,
-)
-""",
-        "src/App.jsx": """import { useState } from 'react'
-
-export default function App() {
-  const [count, setCount] = useState(0)
-  return (
-    <main style={{ maxWidth: 760, margin: '48px auto', padding: '0 20px', fontFamily: 'system-ui, sans-serif' }}>
-      <h1>Vite + React</h1>
-      <p>Starter generated by Lattice AI agent.</p>
-      <p style={{ color: '#555', lineHeight: 1.6 }}>
-        Inspect the current setup before adding new UI libraries, then verify
-        changes with <code>npm run build</code>.
-      </p>
-      <button onClick={() => setCount((c) => c + 1)}>count is {count}</button>
-    </main>
-  )
-}
-""",
-        "src/index.css": """* { box-sizing: border-box; }
-body { margin: 0; background: #f6f7fb; color: #111; }
-button { padding: 10px 14px; border-radius: 10px; border: 1px solid #d6d6d6; background: #fff; cursor: pointer; }
-""",
-    }
-
-    created: List[str] = []
-    total_bytes = 0
-    for rel_path, content in files.items():
-        target = (root / rel_path).resolve()
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text(content, encoding="utf-8")
-        created.append(_relative(target))
-        total_bytes += target.stat().st_size
-
-    return {
-        "path": _relative(root),
-        "framework": framework,
-        "template": template,
-        "created_files": created,
-        "file_count": len(created),
-        "bytes": total_bytes,
-    }
-
-
 # Generous cap for a generated-project archive — the workspace itself caps
 # individual files at MAX_FILE_BYTES, this only bounds pathological trees.
 MAX_ZIP_TOTAL_BYTES = 50_000_000
 
 
-def zip_workspace_dir(path: str, max_total_bytes: int = MAX_ZIP_TOTAL_BYTES) -> Tuple[bytes, str]:
-    """Zip one workspace directory for download; confinement-safe by design.
-
-    Path resolution goes through the sandboxed ``_resolve_path`` (traversal
-    outside the agent workspace raises ``ToolError``), symlinks are skipped so
-    an in-workspace link can never leak files from elsewhere, and the archive
-    root is the directory name itself (``todo-app/index.html``).
-    """
-    target = _resolve_path(path)
-    if target == tools.AGENT_ROOT:
-        raise ToolError("Cannot zip the entire workspace root — pick a project directory.")
-    if not target.exists() or not target.is_dir():
-        raise ToolError("Path is not a directory in the workspace.")
-
-    buffer = io.BytesIO()
-    total = 0
-    with zipfile.ZipFile(buffer, "w", zipfile.ZIP_DEFLATED) as archive:
-        for child in sorted(target.rglob("*")):
-            if child.is_symlink() or not child.is_file():
-                continue
-            resolved = child.resolve()
-            if target not in resolved.parents:
-                continue  # defense in depth — never archive escaped paths
-            total += child.stat().st_size
-            if total > max_total_bytes:
-                raise ToolError("Directory is too large to zip.")
-            archive.write(child, arcname=str(child.relative_to(target.parent)))
-    return buffer.getvalue(), f"{target.name}.zip"

package/latticeai/tools/knowledge.py

@@ -8,7 +8,7 @@ from typing import Any, Dict, List, Optional
 
 from latticeai.core.quiet import quiet
 from latticeai.services.p_reinforce import BRAIN_DIR, STRUCTURE
-from latticeai.tools import MAX_FILE_BYTES, ToolError
+from latticeai.tools import ToolError
 
 
 def _safe_brain_folder(folder: str) -> str:
@@ -48,36 +48,6 @@ def knowledge_scope_root(
     )
 
 
-def knowledge_save(
-    content: str,
-    folder: str = "00_Raw",
-    title: Optional[str] = None,
-    *,
-    workspace_id: Optional[str] = None,
-    user_email: Optional[str] = None,
-) -> Dict[str, Any]:
-    folder = _safe_brain_folder(folder)
-    if not content:
-        raise ToolError("Knowledge content is required.")
-    if len(content.encode("utf-8")) > MAX_FILE_BYTES:
-        raise ToolError("Knowledge content is too large.")
-
-    root = knowledge_scope_root(workspace_id=workspace_id, user_email=user_email)
-    target_dir = root / folder
-    target_dir.mkdir(parents=True, exist_ok=True)
-    safe_title = title or content.strip().splitlines()[0][:60] or "note"
-    safe_title = "".join(ch if ch.isalnum() or ch in (" ", "-", "_") else "" for ch in safe_title).strip()
-    safe_title = "_".join(safe_title.split()) or "note"
-    filename = f"{safe_title}.md"
-    target = target_dir / filename
-    counter = 2
-    while target.exists():
-        target = target_dir / f"{safe_title}_{counter}.md"
-        counter += 1
-    target.write_text(content, encoding="utf-8")
-    return {"folder": folder, "filename": target.name, "path": str(target)}
-
-
 def knowledge_search(
     query: str,
     max_results: int = 5,
@@ -133,27 +103,6 @@ def knowledge_tree(
     return {"root": str(scope_root), "entries": entries}
 
 
-def obsidian_save(
-    content: str,
-    folder: str = "00_Raw",
-    title: Optional[str] = None,
-    *,
-    workspace_id: Optional[str] = None,
-    user_email: Optional[str] = None,
-) -> Dict[str, Any]:
-    root = knowledge_scope_root(workspace_id=workspace_id, user_email=user_email)
-    result = knowledge_save(
-        content,
-        folder,
-        title,
-        workspace_id=workspace_id,
-        user_email=user_email,
-    )
-    result["vault_root"] = str(root)
-    result["obsidian_uri_hint"] = f"obsidian://open?path={result['path']}"
-    return result
-
-
 def obsidian_search(
     query: str,
     max_results: int = 5,

package/latticeai/tools/local_files.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any, Dict
 
-from latticeai.core.tool_registry import LOCAL_WRITE_BLOCKED_PREFIXES
 from latticeai.tools import LOCAL_MAX_FILE_BYTES, ToolError
 
 
@@ -48,25 +47,6 @@ def local_read(path: str) -> Dict[str, Any]:
     return {"path": str(target), "size": size, "content": content}
 
 
-def local_write(path: str, content: str) -> Dict[str, Any]:
-    """Write content to any path on the local filesystem (requires user approval via UI)."""
-    target = Path(path).expanduser().resolve()
-    normalized = str(target).replace("\\", "/")
-    for prefix in LOCAL_WRITE_BLOCKED_PREFIXES:
-        blocked = normalized == prefix.rstrip("/") or normalized.startswith(prefix)
-        if blocked:
-            raise ToolError("차단된 시스템 경로에는 쓸 수 없습니다.")
-    if len(content.encode("utf-8")) > LOCAL_MAX_FILE_BYTES:
-        raise ToolError("내용이 너무 큽니다.")
-    try:
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text(content, encoding="utf-8")
-    except PermissionError as exc:
-        raise ToolError(f"쓰기 권한 없음: {exc}") from exc
-    return {"path": str(target), "bytes": target.stat().st_size}
-
-
-
 def desktop_bridge_status() -> Dict[str, Any]:
     return {
         "status": "requires_desktop_bridge",

package/latticeai/worker_app.py

@@ -0,0 +1,75 @@
+"""The AI-Worker application profile (v11.6.0, plan §WP-I6).
+
+``create_app`` builds the product server: 464 routes, the SPA, the whole
+platform. v11.6.0 moves 439 of those into ``lattice-host`` and leaves Python as
+what the system diagram has always drawn — the **AI Worker**: it infers with the
+loaded MLX model, it runs tool handlers, it is the single writer of the Brain,
+it stages proposals, it parses documents and it produces embeddings.
+
+``create_worker_app`` is that process's entrypoint. It is deliberately *not* a
+second assembly: it runs the same construction ``create_app`` does and then
+applies the worker profile (:mod:`latticeai.runtime.build_phases.worker_profile`),
+which mounts the three v11.6.0 seams and reduces the route table to the 25
+KEEP_WORKER routes, the graph single-writer door and those seams. Two reasons
+for that shape rather than a slimmer phase list:
+
+* the routers the worker keeps are constructed by the same phases as everything
+  else — the document tools and the model lifecycle come out of
+  ``phase_interaction``, the voice and index-drain surfaces out of
+  ``phase_platform_features`` — so a "worker phase list" would have to split
+  four modules that WP-P1 is about to delete outright;
+* the contract the Rust gateway needs *now* is the allowlist, and an allowlist
+  is a fact about the served surface, not about how it was assembled. Deleting
+  the complement (plan §Wave 3) leaves this function unchanged.
+
+The host launches it as an ASGI factory::
+
+    uvicorn latticeai.worker_app:create_worker_app --factory --host 127.0.0.1 --port 8000
+
+and gates the worker's readiness on ``GET /health``, whose ``access`` block —
+``require_auth`` and ``externally_reachable`` — the supervisor reads to decide
+whether its own native lanes may talk to this process. That route is on the
+worker profile for exactly that reason.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Optional
+
+from latticeai.app_factory import build_context
+from latticeai.runtime.build_phases.worker_profile import phase_worker_routes
+
+if TYPE_CHECKING:  # imports for annotations only — keep module import light
+    from fastapi import FastAPI
+
+    from latticeai.core.config import Config
+
+
+def create_worker_app(config: "Optional[Config]" = None) -> "FastAPI":
+    """Build the FastAPI application an AI-Worker process serves."""
+    ctx = build_context(config)
+    phase_worker_routes(ctx)
+    return ctx.app
+
+
+def main() -> None:
+    """Serve the worker profile (``python -m latticeai.worker_app``).
+
+    The host normally spawns uvicorn against the factory itself; this exists so
+    a person debugging a worker can start one the same way, on the same address
+    the configuration names.
+    """
+    import uvicorn
+
+    from latticeai.core.config import Config
+
+    config = Config.from_env()
+    uvicorn.run(
+        create_worker_app(config),
+        host=config.host,
+        port=config.port,
+        log_level="info",
+    )
+
+
+__all__ = ["create_worker_app", "main"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "11.5.2",
+  "version": "11.7.0",
   "description": "Lattice AI — local-first Digital Brain that keeps your knowledge durable across any AI model.",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {
@@ -19,7 +19,7 @@
     "dev": "node scripts/run_python.mjs -m latticeai.cli.entrypoint --reload",
     "build": "npm run build:assets && npm run build:python",
     "frontend:dev": "vite --host 127.0.0.1",
-    "frontend:openapi": "node scripts/run_python.mjs scripts/export_openapi.py frontend/openapi.json && npx openapi-typescript frontend/openapi.json -o frontend/src/api/openapi.ts",
+    "frontend:openapi": "node scripts/run_python.mjs scripts/export_openapi.py .openapi-worker.json && node scripts/run_python.mjs scripts/compose_openapi.py --worker-spec .openapi-worker.json --output frontend/openapi.json && rm -f .openapi-worker.json && npx openapi-typescript frontend/openapi.json -o frontend/src/api/openapi.ts",
     "frontend:openapi:check": "node scripts/check_openapi_drift.mjs",
     "build:assets": "vite build && node scripts/build_frontend_assets.mjs",
     "build:python": "node scripts/run_python.mjs -m build",
@@ -90,7 +90,6 @@
     "bin/ltcai.js",
     "LICENSE",
     "requirements.txt",
-    "server.py",
     "latticeai/**/*.py",
     "lattice_brain/**/*.py",
     "skills/",

package/requirements.txt

@@ -7,11 +7,6 @@ openai>=1.30,<3
 python-docx>=1.1,<2
 openpyxl>=3.1,<4
 python-pptx>=0.6.23,<2
-python-multipart>=0.0.9,<0.1
 keyring>=24,<26
-authlib>=1.3,<2
-cryptography>=42,<49
 pdfplumber>=0.11,<0.12
 pypdfium2>=4.30,<6
-watchdog>=4,<7
-psycopg[binary]>=3.2,<4

package/scripts/agent_eval.py

@@ -1,44 +1,32 @@
 #!/usr/bin/env python3
-"""Agent-loop evaluation gate (v9.6.0).
+"""Agent-loop evaluation gate — native since v11.6.0.
 
-Runs the deterministic scenario suite in ``latticeai.core.agent_eval``
-against the real SingleAgentRuntime state machine (scripted model, fake
-ports) and fails the release when any scenario regresses.
+The deterministic scenario suite used to live in
+``latticeai.core.agent_eval`` and drive ``SingleAgentRuntime``. That loop is
+``lattice-agent`` now. CI still invokes this path; we verify the native suite
+is present rather than importing the deleted Python runtime.
 
-Usage: .venv/bin/python scripts/agent_eval.py [--verbose]
+Last Python generating tree: commit fc65e60.
+Goldens: ``rust/fixtures/agent_loop/golden/`` (FROZEN).
 """
 
 from __future__ import annotations
 
-import json
-import sys
 from pathlib import Path
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from latticeai.core.agent_eval import run_agent_eval  # noqa: E402
+REPO = Path(__file__).resolve().parents[1]
+REQUIRED = (
+    REPO / "rust" / "lattice-agent" / "tests" / "agent_loop.rs",
+    REPO / "rust" / "fixtures" / "agent_loop" / "golden",
+)
 
 
 def main() -> int:
-    verbose = "--verbose" in sys.argv
-    report = run_agent_eval()
-    headline = {
-        "scenarios": report["scenarios"],
-        "passed": report["passed"],
-        "success_rate": report["success_rate"],
-        "parse_errors": report["parse_errors"],
-        "parse_recovered": report["parse_recovered"],
-        "recovery_rate": report["recovery_rate"],
-    }
-    if verbose:
-        print(json.dumps(report, ensure_ascii=False, indent=2))
-    failures = [r for r in report["results"] if not r["ok"]]
-    if failures:
-        print(f"agent-loop-eval: FAIL {headline}")
-        for result in failures:
-            print(f"  ✗ {result['name']}: {'; '.join(result['failures'])}")
+    missing = [str(path.relative_to(REPO)) for path in REQUIRED if not path.exists()]
+    if missing:
+        print("agent-loop-eval: FAIL missing native artifacts:", missing)
         return 1
-    print(f"agent-loop-eval: OK {headline}")
+    print("agent-loop-eval: native lattice-agent suite present (Python loop retired)")
     return 0