ltcai 3.0.1 → 3.2.0

package/scripts/lint_v3.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/* Syntax-check every Lattice AI v3 frontend ES module (node --check, ESM auto-detect).
+ * Exits non-zero on the first failure so it can gate `npm run lint`. */
+import { readdirSync, statSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..", "static", "v3", "js");
+
+function walk(dir) {
+  const out = [];
+  for (const name of readdirSync(dir)) {
+    const p = join(dir, name);
+    if (statSync(p).isDirectory()) out.push(...walk(p));
+    else if (name.endsWith(".js")) out.push(p);
+  }
+  return out;
+}
+
+const files = walk(root).sort();
+let failed = 0;
+for (const file of files) {
+  const r = spawnSync(process.execPath, ["--check", file], { encoding: "utf8" });
+  if (r.status === 0) {
+    console.log(`ok   ${file.replace(root, "static/v3/js")}`);
+  } else {
+    failed++;
+    console.error(`FAIL ${file.replace(root, "static/v3/js")}\n${r.stderr || r.stdout}`);
+  }
+}
+console.log(`\nv3 frontend: ${files.length - failed}/${files.length} modules pass`);
+process.exit(failed ? 1 : 0);

package/scripts/release-0.3.1.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# Release 0.3.1 — finalize commit + push.
+#
+# 이 스크립트는 sandbox 권한 제약으로 Claude가 마지막 git 명령을 끝내지 못했기 때문에
+# 사용자 본인 터미널에서 한 번 실행하기 위한 마무리 스크립트입니다.
+#
+# 사전 조건:
+#   - 5개 피드백을 반영한 코드/문서/테스트/CI 변경이 워킹트리에 적용되어 있음
+#   - 빌드 산출물(dist/ltcai-0.3.1*, ltcai-0.3.1.tgz)이 생성되어 있음 (gitignore라 commit에는 안 들어감)
+#
+# 사용법:
+#   bash scripts/release-0.3.1.sh
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+# 1. stale lock 정리
+if [ -f .git/index.lock ]; then
+  rm -f .git/index.lock
+fi
+
+# 2. 변경된 파일 add
+git add -A
+
+# 3. 어떤 게 들어가는지 확인용 짧은 요약
+echo "--- staged summary ---"
+git diff --cached --stat | tail -40
+
+# 4. commit
+git commit -m "Release 0.3.1 — model loading reliability + auto graph + security console
+
+External review (5 items) reflected:
+
+  1. lattice_ai_model_recommend_download_load_issue.txt
+     - latticeai/core/model_resolution.py: ModelResolution unifies
+       input_id / engine / resolved_model / download_id / load_id /
+       expected_current across all stages.
+     - prepare_and_load_model() + /engines/prepare-model/stream now share
+       the same ModelResolution; LM Studio instance_id is reconciled via
+       resolution.update_after_load().
+
+  2. lattice_ai_manual_model_select_auto_download_load_fix.txt
+     - server.py runs _smoke_test_loaded_model() right after load and
+       returns ready_to_chat / compatibility_status / smoke_test in the
+       response. Cloud models are skipped to avoid user cost.
+     - /models response now carries engine_options + compat_profiles.
+     - chat.js trusts response.current (not the clicked model id);
+       surfaces compatibility warnings; selectModelByCard() helper.
+
+  3. lattice_ai_model_compat_fast_path.txt
+     - latticeai/core/model_compat.py: family detection, family profiles
+       (stop tokens, disable_draft, postprocess, generation params),
+       fast_postprocess, validate_smoke_response, compat_cache. Fast /
+       Slow / Recovery path structure.
+
+  4. lattice_ai_auto_graph_direction.txt
+     - latticeai/core/graph_curator.py: topic extraction → alias
+       clustering (auto-merge) → promotion (with secret/dup/min-sources
+       filters) → thread story edges → behavior-signal curation.
+
+  5. lattice_ai_admin_security_dashboard_review.txt
+     - latticeai/api/security_dashboard.py: 11 endpoints under
+       /admin/security/* — overview / users / events / event detail /
+       conversation summary+raw / files / file detail+content / raw /
+       export. Hard-secret redaction enforced on every response;
+       admin_view_sensitive_raw audit event recorded for raw access.
+     - admin.html + admin.js: AI Security & Audit Command Center panel
+       with Security Overview cards, User Risk stacked bar, sensitive-
+       type donut, drill-down, raw explorer, JSON/CSV/XLSX/PDF export.
+
+Tests / CI:
+  - 28 new unit tests under tests/unit/test_{model_compat,
+    model_resolution,graph_curator,security_dashboard}.py — all passing.
+  - .github/workflows/ci.yml syntax-check extended for new modules.
+  - .github/workflows/release.yml added — tag push v* triggers PyPI /
+    npm / VS Code Marketplace / Open VSX publish. Secrets:
+    PYPI_TOKEN, NPM_TOKEN, VSCE_PAT, OVSX_TOKEN (empty ones auto-skip).
+
+Version bumps:
+  - package.json 0.3.0 → 0.3.1
+  - pyproject.toml 0.3.0 → 0.3.1
+  - vscode-extension/package.json 0.3.0 → 0.3.1
+
+Docs:
+  - docs/CHANGELOG.md: 0.3.1 section
+  - README.md: 'What's new in 0.3.1'
+  - RELEASE.md: auto-publish via tag flow"
+
+# 5. push to origin/main
+git push origin main
+
+# 6. annotated release tag (CI release.yml triggers on v* tags)
+git tag -a v0.3.1 -m "Lattice AI 0.3.1 — model loading reliability + auto graph + security console"
+git push origin v0.3.1
+
+echo ""
+echo "✅ Release 0.3.1 pushed."
+echo ""
+echo "다음 단계:"
+echo "  1. GitHub → Repository Settings → Secrets and variables → Actions에"
+echo "     PYPI_TOKEN / NPM_TOKEN / VSCE_PAT / OVSX_TOKEN 을 등록."
+echo "  2. 등록된 secret이 있는 채널은 .github/workflows/release.yml의 v0.3.1"
+echo "     trigger로 자동 publish 됩니다. 미등록 채널은 자동 skip."
+echo "  3. 수동 publish가 필요하면 RELEASE.md 참고."

package/scripts/take_screenshots.js

@@ -0,0 +1,69 @@
+/**
+ * Lattice AI — automated screenshot capture
+ * Usage: SESSION_TOKEN=xxx node scripts/take_screenshots.js
+ */
+let playwright;
+try { playwright = require('playwright'); } catch(e) {
+  playwright = require('/tmp/node_modules/playwright');
+}
+const { chromium } = playwright;
+const path = require('path');
+const fs   = require('fs');
+
+const BASE  = 'http://localhost:4825';
+const OUT   = path.join(__dirname, '..', 'docs', 'images');
+const TOKEN = process.env.SESSION_TOKEN || '';
+fs.mkdirSync(OUT, { recursive: true });
+
+const PAGES = [
+  { name: 'chat',  url: `${BASE}/`,      wait: 3500 },
+  { name: 'admin', url: `${BASE}/admin`, wait: 3000 },
+  { name: 'graph', url: `${BASE}/graph`, wait: 3500 },
+];
+
+(async () => {
+  const browser = await chromium.launch({ headless: true });
+  const ctx = await browser.newContext({
+    viewport: { width: 1440, height: 900 },
+    deviceScaleFactor: 2,
+  });
+
+  // Inject session cookie so we skip the login page
+  if (TOKEN) {
+    await ctx.addCookies([{
+      name: 'session_token',
+      value: TOKEN,
+      domain: 'localhost',
+      path: '/',
+      httpOnly: true,
+      secure: false,
+    }]);
+    console.log('🍪 Session cookie injected');
+  }
+
+  for (const pg of PAGES) {
+    const page = await ctx.newPage();
+    console.log(`📸 ${pg.name} → ${pg.url}`);
+    try {
+      await page.goto(pg.url, { waitUntil: 'networkidle', timeout: 20000 });
+      await page.waitForTimeout(pg.wait);
+
+      // Dismiss any open modals
+      await page.evaluate(() => {
+        document.querySelectorAll('.modal-backdrop, [data-bs-backdrop], dialog[open]')
+          .forEach(el => { el.style.display = 'none'; });
+      });
+
+      const outPath = path.join(OUT, `screenshot-${pg.name}.png`);
+      await page.screenshot({ path: outPath, fullPage: false });
+      console.log(`  ✅ → ${outPath}`);
+    } catch (e) {
+      console.error(`  ❌ ${pg.name}: ${e.message}`);
+    } finally {
+      await page.close();
+    }
+  }
+
+  await browser.close();
+  console.log('\n✅ Done!');
+})();

package/scripts/validate_release_artifacts.py

@@ -0,0 +1,167 @@
+#!/usr/bin/env python3
+"""Validate release artifacts for a single, explicit version.
+
+The release workflow must never upload ``dist/*`` with a glob: that bundles
+*every* historical build and risks shipping a stale version. This validator is
+the guard rail. It checks that exactly the expected 1.1.0-style artifacts exist
+for the requested version, that no version string is mismatched, and (best
+effort) that the VSIX actually contains the compiled extension entrypoint.
+
+Usage:
+    python scripts/validate_release_artifacts.py 1.1.0
+    python scripts/validate_release_artifacts.py 1.1.0 --require-vsix
+    python scripts/validate_release_artifacts.py 1.1.0 --dist dist --json
+
+Exit code is non-zero on any failure so CI can fail fast.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+import zipfile
+from pathlib import Path
+from typing import Dict, List, Optional
+
+SEMVER_RE = re.compile(r"^\d+\.\d+\.\d+([.-][0-9A-Za-z.]+)?$")
+
+
+def _expected_names(version: str) -> Dict[str, str]:
+    return {
+        "wheel": f"ltcai-{version}-py3-none-any.whl",
+        "sdist": f"ltcai-{version}.tar.gz",
+        "vsix": f"ltcai-{version}.vsix",
+    }
+
+
+def _vsix_has_entrypoint(path: Path) -> bool:
+    """True if the VSIX contains the compiled extension entrypoint."""
+    try:
+        with zipfile.ZipFile(path) as zf:
+            names = zf.namelist()
+    except (zipfile.BadZipFile, OSError):
+        return False
+    return any(name.endswith("extension/out/extension.js") for name in names)
+
+
+def _vsix_version(path: Path) -> Optional[str]:
+    try:
+        with zipfile.ZipFile(path) as zf:
+            for name in zf.namelist():
+                if name.endswith("extension/package.json"):
+                    data = json.loads(zf.read(name).decode("utf-8"))
+                    return str(data.get("version") or "")
+    except Exception:
+        return None
+    return None
+
+
+def validate(
+    version: str,
+    dist_dir: Path,
+    *,
+    require_vsix: bool,
+    require_tgz: bool,
+) -> Dict[str, object]:
+    errors: List[str] = []
+    warnings: List[str] = []
+    found: Dict[str, object] = {}
+
+    if not SEMVER_RE.match(version):
+        errors.append(f"version '{version}' is not a valid semantic version")
+
+    if not dist_dir.is_dir():
+        errors.append(f"dist directory not found: {dist_dir}")
+        return {"version": version, "ok": False, "errors": errors, "warnings": warnings, "found": found}
+
+    expected = _expected_names(version)
+
+    # Required Python artifacts.
+    for key in ("wheel", "sdist"):
+        artifact = dist_dir / expected[key]
+        if artifact.is_file():
+            found[key] = str(artifact)
+        else:
+            errors.append(f"missing {key}: {artifact.name}")
+
+    # VSIX: required only when asked, but validate contents when present.
+    vsix = dist_dir / expected["vsix"]
+    if vsix.is_file():
+        found["vsix"] = str(vsix)
+        if not _vsix_has_entrypoint(vsix):
+            errors.append(f"{vsix.name} is missing extension/out/extension.js (compile step skipped?)")
+        vsix_ver = _vsix_version(vsix)
+        if vsix_ver and vsix_ver != version:
+            errors.append(f"{vsix.name} internal version '{vsix_ver}' != expected '{version}'")
+    elif require_vsix:
+        errors.append(f"missing vsix: {vsix.name}")
+
+    # npm pack tarball lives at repo root, not dist/.
+    if require_tgz:
+        tgz = dist_dir.parent / f"ltcai-{version}.tgz"
+        if tgz.is_file():
+            found["tgz"] = str(tgz)
+        else:
+            warnings.append(f"npm tarball not found: {tgz.name} (run `npm pack`)")
+
+    # Guard against stale-version mixing: warn loudly about other-version builds
+    # so a `dist/*` glob upload is obviously unsafe.
+    other_versions = set()
+    for item in dist_dir.glob("ltcai-*"):
+        # Capture just the semver core (e.g. 1.1.0), not packaging suffixes
+        # like -py3-none-any.whl / .tar.gz / .vsix.
+        m = re.match(r"ltcai-(\d+\.\d+\.\d+)(?:[-.]|$)", item.name)
+        if m and m.group(1) != version:
+            other_versions.add(m.group(1))
+    if other_versions:
+        warnings.append(
+            "dist/ also contains other versions "
+            f"{sorted(other_versions)} — NEVER upload with a `dist/*` glob; "
+            f"upload only the explicit {version} filenames."
+        )
+
+    return {
+        "version": version,
+        "ok": not errors,
+        "errors": errors,
+        "warnings": warnings,
+        "found": found,
+        "expected": expected,
+    }
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("version", help="exact version to validate, e.g. 1.1.0")
+    parser.add_argument("--dist", default="dist", help="dist directory (default: dist)")
+    parser.add_argument("--require-vsix", action="store_true", help="fail if the VSIX is absent")
+    parser.add_argument("--require-tgz", action="store_true", help="check for npm pack tarball at repo root")
+    parser.add_argument("--json", action="store_true", help="emit machine-readable JSON")
+    args = parser.parse_args(argv)
+
+    result = validate(
+        args.version,
+        Path(args.dist),
+        require_vsix=args.require_vsix,
+        require_tgz=args.require_tgz,
+    )
+
+    if args.json:
+        print(json.dumps(result, indent=2))
+    else:
+        status = "OK" if result["ok"] else "FAILED"
+        print(f"Release artifact validation for v{result['version']}: {status}")
+        for key, path in result["found"].items():
+            print(f"  found {key}: {Path(path).name}")
+        for warning in result["warnings"]:
+            print(f"  WARN: {warning}")
+        for error in result["errors"]:
+            print(f"  ERROR: {error}")
+
+    return 0 if result["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/static/account.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content">
     <title>Lattice AI</title>
-    <script src="/static/scripts/ux.js?v=3.0.0"></script>
+    <script src="/static/scripts/ux.js"></script>
     <link rel="manifest" href="/manifest.json">
     <meta name="theme-color" content="#f3ecff">
     <meta name="apple-mobile-web-app-capable" content="yes">
@@ -14,13 +14,13 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800&display=swap">
     <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@latest/tabler-icons.min.css">
-    <link rel="stylesheet" href="/static/css/tokens.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/base.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/account.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/admin.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/graph.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/chat.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/responsive.css?v=3.0.0">
+    <link rel="stylesheet" href="/static/css/tokens.css">
+    <link rel="stylesheet" href="/static/css/reference/base.css">
+    <link rel="stylesheet" href="/static/css/reference/account.css">
+    <link rel="stylesheet" href="/static/css/reference/admin.css">
+    <link rel="stylesheet" href="/static/css/reference/graph.css">
+    <link rel="stylesheet" href="/static/css/reference/chat.css">
+    <link rel="stylesheet" href="/static/css/responsive.css">
 </head>
 <body class="lattice-ref-auth">
     <div class="orb orb-1"></div>
@@ -110,6 +110,6 @@
         <a href="#" onclick="return false;" id="privacy-link">개인정보 처리방침</a>
     </footer>
 
-    <script src="/static/scripts/account.js?v=3.0.0"></script>
+    <script src="/static/scripts/account.js"></script>
 </body>
 </html>

package/static/activity.html

@@ -4,10 +4,10 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content" />
   <title>Realtime Activity — Lattice AI</title>
-  <script src="/static/scripts/ux.js?v=3.0.0"></script>
-  <link rel="stylesheet" href="/static/css/tokens.css?v=3.0.0" />
-  <link rel="stylesheet" href="/static/platform.css?v=3.0.0" />
-  <link rel="stylesheet" href="/static/css/responsive.css?v=3.0.0" />
+  <script src="/static/scripts/ux.js"></script>
+  <link rel="stylesheet" href="/static/css/tokens.css" />
+  <link rel="stylesheet" href="/static/platform.css" />
+  <link rel="stylesheet" href="/static/css/responsive.css" />
 </head>
 <body>
   <main>

package/static/admin.html

@@ -5,7 +5,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content">
     <title>Lattice AI Admin</title>
-    <script src="/static/scripts/ux.js?v=3.0.0"></script>
+    <script src="/static/scripts/ux.js"></script>
     <link rel="manifest" href="/manifest.json">
     <meta name="theme-color" content="#f3ecff">
     <meta name="apple-mobile-web-app-capable" content="yes">
@@ -15,13 +15,13 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800&display=swap">
     <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@latest/tabler-icons.min.css">
-    <link rel="stylesheet" href="/static/css/tokens.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/base.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/account.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/admin.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/graph.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/chat.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/responsive.css?v=3.0.0">
+    <link rel="stylesheet" href="/static/css/tokens.css">
+    <link rel="stylesheet" href="/static/css/reference/base.css">
+    <link rel="stylesheet" href="/static/css/reference/account.css">
+    <link rel="stylesheet" href="/static/css/reference/admin.css">
+    <link rel="stylesheet" href="/static/css/reference/graph.css">
+    <link rel="stylesheet" href="/static/css/reference/chat.css">
+    <link rel="stylesheet" href="/static/css/responsive.css">
     <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js"></script>
 </head>
 

package/static/agents.html

@@ -4,10 +4,10 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content" />
   <title>Multi-Agent Runtime — Lattice AI</title>
-  <script src="/static/scripts/ux.js?v=3.0.0"></script>
-  <link rel="stylesheet" href="/static/css/tokens.css?v=3.0.0" />
-  <link rel="stylesheet" href="/static/platform.css?v=3.0.0" />
-  <link rel="stylesheet" href="/static/css/responsive.css?v=3.0.0" />
+  <script src="/static/scripts/ux.js"></script>
+  <link rel="stylesheet" href="/static/css/tokens.css" />
+  <link rel="stylesheet" href="/static/platform.css" />
+  <link rel="stylesheet" href="/static/css/responsive.css" />
 </head>
 <body>
   <main>

package/static/chat.html

@@ -5,7 +5,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content">
     <title>Lattice AI — All-in-One Multimodal Workspace</title>
-    <script src="/static/scripts/ux.js?v=3.0.0"></script>
+    <script src="/static/scripts/ux.js"></script>
 
     <!-- PWA -->
     <link rel="manifest" href="/manifest.json">
@@ -24,13 +24,13 @@
     <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
 
     <!-- ── Setup Wizard Styles ──────────────────────────────────────────── -->
-    <link rel="stylesheet" href="/static/css/tokens.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/base.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/account.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/admin.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/graph.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/reference/chat.css?v=3.0.0">
-    <link rel="stylesheet" href="/static/css/responsive.css?v=3.0.0">
+    <link rel="stylesheet" href="/static/css/tokens.css">
+    <link rel="stylesheet" href="/static/css/reference/base.css">
+    <link rel="stylesheet" href="/static/css/reference/account.css">
+    <link rel="stylesheet" href="/static/css/reference/admin.css">
+    <link rel="stylesheet" href="/static/css/reference/graph.css">
+    <link rel="stylesheet" href="/static/css/reference/chat.css">
+    <link rel="stylesheet" href="/static/css/responsive.css">
 </head>
 
 <body class="lattice-ref-chat">
@@ -838,7 +838,7 @@
     </div>
 
 
-    <script src="/static/scripts/chat.js?v=3.0.0"></script>
+    <script src="/static/scripts/chat.js"></script>
 </body>
 
 </html>