ltcai 3.6.0 → 4.0.1

package/latticeai/api/network.py

@@ -0,0 +1,81 @@
+"""Brain Network API — device identity, peer pairing, knowledge exchange.
+
+The /network/receive endpoint authenticates PEERS (signed device requests),
+not user sessions; everything else requires a logged-in user, and pairing /
+pushing are deliberate owner actions.
+"""
+
+from __future__ import annotations
+
+from typing import Optional
+
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
+
+
+class PeerPairRequest(BaseModel):
+    name: str
+    base_url: str
+    public_key: str
+
+
+class PeerPushRequest(BaseModel):
+    workspace_id: Optional[str] = None
+
+
+def create_network_router(*, network, identity, require_user) -> APIRouter:
+    router = APIRouter()
+
+    @router.get("/network/identity")
+    async def network_identity(request: Request):
+        require_user(request)
+        return identity.describe()
+
+    @router.get("/network/peers")
+    async def network_peers(request: Request):
+        require_user(request)
+        return {"peers": network.list_peers()}
+
+    @router.post("/network/peers")
+    async def network_pair(req: PeerPairRequest, request: Request):
+        require_user(request)
+        try:
+            return {"status": "paired", "peer": network.add_peer(
+                name=req.name, base_url=req.base_url, public_key=req.public_key,
+            )}
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+    @router.delete("/network/peers/{peer_id}")
+    async def network_unpair(peer_id: str, request: Request):
+        require_user(request)
+        try:
+            return network.remove_peer(peer_id)
+        except FileNotFoundError as exc:
+            raise HTTPException(status_code=404, detail=f"Unknown peer: {exc}") from exc
+
+    @router.post("/network/push/{peer_id}")
+    async def network_push(peer_id: str, req: PeerPushRequest, request: Request):
+        require_user(request)
+        try:
+            return network.push_to_peer(peer_id, workspace_id=req.workspace_id)
+        except FileNotFoundError as exc:
+            raise HTTPException(status_code=404, detail=f"Unknown peer: {exc}") from exc
+        except Exception as exc:
+            raise HTTPException(status_code=502, detail=f"Push failed: {exc}") from exc
+
+    @router.post("/network/receive")
+    async def network_receive(request: Request):
+        # Peer-authenticated: a paired device's signature replaces the session.
+        body = await request.body()
+        try:
+            return network.receive(dict(request.headers), body)
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+    return router
+
+
+__all__ = ["create_network_router"]

package/latticeai/api/plugins.py

@@ -15,6 +15,8 @@ from typing import Any, Callable, Dict, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
+from latticeai.api.ui_redirects import app_redirect
+
 
 class PluginActionRequest(BaseModel):
     plugin_id: str
@@ -50,12 +52,7 @@ def create_plugins_router(
     @router.get("/plugins/sdk")
     async def plugins_sdk_page(request: Request):
         require_user(request)
-        if ui_file_response is None or static_dir is None:
-            raise HTTPException(status_code=404, detail="Plugin SDK UI not available.")
-        page = static_dir / "plugins.html"
-        if not page.exists():
-            raise HTTPException(status_code=404, detail="Plugin SDK UI not found.")
-        return ui_file_response(page)
+        return app_redirect("marketplace", request)
 
     @router.get("/plugins/registry")
     async def plugins_registry(request: Request):

package/latticeai/api/realtime.py

@@ -10,12 +10,14 @@ from __future__ import annotations
 
 import secrets
 from pathlib import Path
-from typing import Any, Callable, Dict, Optional, Set
+from typing import Any, Callable, Optional, Set
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Request
 from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
 
+from latticeai.api.ui_redirects import app_redirect
+
 
 class PresenceRequest(BaseModel):
     client_id: Optional[str] = None
@@ -36,12 +38,7 @@ def create_realtime_router(
     @router.get("/activity")
     async def activity_page(request: Request):
         require_user(request)
-        if ui_file_response is None or static_dir is None:
-            raise HTTPException(status_code=404, detail="Activity UI not available.")
-        page = static_dir / "activity.html"
-        if not page.exists():
-            raise HTTPException(status_code=404, detail="Activity UI not found.")
-        return ui_file_response(page)
+        return app_redirect("activity", request)
 
     @router.get("/realtime/stream")
     async def realtime_stream(request: Request):

package/latticeai/api/search.py

@@ -47,17 +47,41 @@ class IndexRebuildRequest(BaseModel):
     include_chunks: bool = True
 
 
+class _ScopedSearchService:
+    """Injects the caller's workspace scope into every search call —
+    enforcement lives at this one chokepoint, not in each handler."""
+
+    _SCOPED = {"keyword_search", "vector_search", "graph_search", "hybrid_search"}
+
+    def __init__(self, service: SearchService, allowed):
+        self._service = service
+        self._allowed = allowed
+
+    def __getattr__(self, name):
+        attr = getattr(self._service, name)
+        if name in self._SCOPED:
+            def scoped(*args, **kwargs):
+                kwargs.setdefault("allowed_workspaces", self._allowed)
+                return attr(*args, **kwargs)
+            return scoped
+        return attr
+
+
 def create_search_router(
     *,
     service: SearchService,
     require_user: Callable[[Request], str],
     embedding_info: Optional[Callable[[], Dict[str, Any]]] = None,
+    allowed_workspaces_for: Optional[Callable[[Optional[str]], Any]] = None,
 ) -> APIRouter:
     router = APIRouter()
 
     def _guarded(request: Request) -> SearchService:
-        require_user(request)
-        return service
+        user = require_user(request)
+        allowed = None
+        if allowed_workspaces_for is not None and user:
+            allowed = allowed_workspaces_for(user)
+        return _ScopedSearchService(service, allowed)
 
     def _raise_graph_error(exc: Exception) -> None:
         raise HTTPException(status_code=404, detail=str(exc)) from exc

package/latticeai/api/security_dashboard.py

@@ -27,13 +27,12 @@ import io
 import json
 import logging
 import re
-import time
 from collections import defaultdict
 from datetime import datetime
-from typing import Any, Callable, Dict, List, Optional, Tuple
+from typing import Any, Callable, Dict, List, Optional
 
 from fastapi import APIRouter, HTTPException, Query, Request
-from fastapi.responses import Response, StreamingResponse
+from fastapi.responses import Response
 from pydantic import BaseModel
 
 from ..core import timezones

package/latticeai/api/setup.py

@@ -15,8 +15,8 @@ from auto_setup import (
     recommend as auto_setup_recommend,
     verify as auto_setup_verify,
 )
-from llm_router import parse_model_ref
-from setup import get_recommendations, install_stream, open_url, scan_environment
+from latticeai.models.router import parse_model_ref
+from setup_wizard import get_recommendations, install_stream, open_url, scan_environment
 
 
 def create_setup_router(*, model_router, require_user) -> APIRouter:

package/latticeai/api/static_routes.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import re
 import subprocess
 from dataclasses import dataclass
 from pathlib import Path
@@ -11,6 +10,8 @@ from typing import Callable, Optional
 from fastapi import APIRouter, Cookie, HTTPException, Request
 from fastapi.responses import FileResponse, HTMLResponse
 
+from latticeai.api.ui_redirects import app_redirect
+
 def ui_file_response(path: Path) -> FileResponse:
     response = FileResponse(path)
     response.headers["Cache-Control"] = "no-cache, no-store, must-revalidate"
@@ -45,20 +46,20 @@ def create_static_routes_router(
     async def root(request: Request, code: Optional[str] = None, authorized: Optional[str] = Cookie(None)):
         """로그인/회원가입 페이지. 초대 게이트 활성화 시 코드 검증 후 진입."""
         if not INVITE_GATE_ENABLED:
-            return ui_file_response(STATIC_DIR / "account.html")
+            return app_redirect("account", request)
     
         # 1. 이미 쿠키로 인증된 경우
         if authorized == "true":
-            return ui_file_response(STATIC_DIR / "account.html")
+            return app_redirect("account", request)
     
         # 2. 초대 코드가 일치하는 경우 (최초 진입)
         if code == INVITE_CODE:
-            response = ui_file_response(STATIC_DIR / "account.html")
+            response = app_redirect("account", request)
             response.set_cookie(key="authorized", value="true", httponly=True, samesite="lax", max_age=60*60*24*7)
             return response
     
         # 3. 인증 실패 시 차단 화면
-        return HTMLResponse(content=f"""
+        return HTMLResponse(content="""
             <body style="background:#0f1115; color:white; display:flex; flex-direction:column; align-items:center; justify-content:center; height:100vh; font-family:sans-serif;">
                 <div style="background:#16191f; padding:40px; border-radius:24px; border:1px solid rgba(255,255,255,0.1); text-align:center; box-shadow: 0 20px 40px rgba(0,0,0,0.5);">
                     <div style="font-size:48px; margin-bottom:20px;">🔒</div>
@@ -73,7 +74,7 @@ def create_static_routes_router(
     @api_router.get("/account")
     async def account_page():
         """Direct login/register page route used by logout and manual navigation."""
-        return ui_file_response(STATIC_DIR / "account.html")
+        return app_redirect("account")
     
     
     @api_router.get("/manifest.json")
@@ -106,7 +107,7 @@ def create_static_routes_router(
     
     @api_router.get("/chat")
     async def chat_page(request: Request):
-        return ui_file_response(STATIC_DIR / "chat.html")
+        return app_redirect("chat", request)
 
 
     @api_router.get("/app")
@@ -119,13 +120,8 @@ def create_static_routes_router(
 
 
     @api_router.get("/admin")
-    async def admin_page():
-        admin_path = STATIC_DIR / "admin.html"
-        if not admin_path.exists():
-            raise HTTPException(status_code=404, detail="Admin UI not found.")
-        response = FileResponse(admin_path)
-        response.headers["Cache-Control"] = "no-cache, no-store, must-revalidate"
-        return response
+    async def admin_page(request: Request):
+        return app_redirect("admin/users", request)
     
     # /workspace and /onboarding UI pages are served by the workspace router
     # (latticeai.api.workspace), included below after its dependencies are defined.
@@ -145,7 +141,7 @@ def create_static_routes_router(
     async def local_sysinfo(request: Request):
         """CPU / RAM / GPU(MLX) 사용량을 반환합니다."""
         require_user(request)
-        import subprocess, re as _re
+        import re as _re
         result = {"cpu_pct": 0.0, "ram_pct": 0.0, "gpu_mem_pct": 0.0, "gpu_mem_gb": 0.0}
         try:
             # CPU
@@ -157,7 +153,6 @@ def create_static_routes_router(
                         result["cpu_pct"] = round(float(m.group(1)) + float(m.group(2)), 1)
             # RAM
             vm_out = subprocess.run(["vm_stat"], capture_output=True, text=True, timeout=4).stdout
-            page_size = 16384
             pages: dict = {}
             for line in vm_out.splitlines():
                 for key in ["Pages free", "Pages active", "Pages inactive", "Pages wired down", "Pages occupied by compressor"]:

package/latticeai/api/tools.py

@@ -178,6 +178,7 @@ class ToolGitShowRequest(BaseModel):
 def create_tools_router(
     *,
     config,
+    ingestion_pipeline,
     data_dir: Path,
     static_dir: Path,
     model_router,
@@ -438,6 +439,7 @@ def create_tools_router(
             current_user=current_user,
             enable_graph=ENABLE_GRAPH,
             knowledge_graph=KNOWLEDGE_GRAPH,
+            ingestion_pipeline=ingestion_pipeline,
             bytes_match_extension=_bytes_match_extension,
             classify_sensitive_message=classify_sensitive_message,
             append_audit_event=append_audit_event,
@@ -588,6 +590,7 @@ def create_tools_router(
         tool_response=_tool_response,
         require_graph=_require_graph,
         knowledge_graph=KNOWLEDGE_GRAPH,
+        ingestion_pipeline=ingestion_pipeline,
         data_dir=DATA_DIR,
     ))
 

package/latticeai/api/ui_redirects.py

@@ -0,0 +1,26 @@
+"""Compatibility redirects from retired legacy pages into the v4 SPA."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+from fastapi import Request
+from fastapi.responses import RedirectResponse
+
+
+def app_redirect(fragment: str, request: Optional[Request] = None) -> RedirectResponse:
+    """Redirect a legacy GET route to the equivalent /app hash route.
+
+    Existing browser bookmarks keep working while the legacy HTML/JS/CSS pages
+    are removed from the shipped artifact. Query strings are preserved after the
+    hash so SPA route params remain addressable.
+    """
+
+    frag = fragment.strip("/")
+    query = ""
+    if request is not None and request.url.query:
+        query = f"?{request.url.query}"
+    return RedirectResponse(url=f"/app#/{frag}{query}", status_code=308)
+
+
+__all__ = ["app_redirect"]

package/latticeai/api/workflow_designer.py

@@ -19,6 +19,8 @@ from typing import Any, Callable, Dict, List, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
+from latticeai.api.ui_redirects import app_redirect
+
 
 class WorkflowDefinitionRequest(BaseModel):
     name: str
@@ -32,6 +34,10 @@ class WorkflowUpdateRequest(BaseModel):
     metadata: Optional[Dict[str, Any]] = None
 
 
+class WorkflowResumeRequest(BaseModel):
+    approved: bool = True
+
+
 class WorkflowRunRequest(BaseModel):
     inputs: Dict[str, Any] = {}
 
@@ -58,6 +64,8 @@ def create_workflow_designer_router(
     ui_file_response: Optional[Callable[[Path], Any]] = None,
     static_dir: Optional[Path] = None,
     hooks: Any = None,
+    run_executor: Any = None,
+    trigger_service: Any = None,
 ) -> APIRouter:
     from latticeai.core.workflow_engine import (
         WorkflowEngine,
@@ -72,12 +80,7 @@ def create_workflow_designer_router(
     @router.get("/workflows")
     async def workflows_page(request: Request):
         require_user(request)
-        if ui_file_response is None or static_dir is None:
-            raise HTTPException(status_code=404, detail="Workflow Designer UI not available.")
-        page = static_dir / "workflows.html"
-        if not page.exists():
-            raise HTTPException(status_code=404, detail="Workflow Designer UI not found.")
-        return ui_file_response(page)
+        return app_redirect("workflows", request)
 
     @router.get("/workflows/api/definitions")
     async def list_definitions(request: Request, q: str = ""):
@@ -147,6 +150,16 @@ def create_workflow_designer_router(
             workflow = store.get_workflow(workflow_id, workspace_id=scope)
         except FileNotFoundError as exc:
             raise HTTPException(status_code=404, detail=f"Workflow not found: {exc}") from exc
+        if run_executor is not None:
+            result = await run_executor.start_workflow(
+                workflow,
+                workflow_id=workflow_id,
+                user_email=current_user or None,
+                scope=scope,
+                inputs=req.inputs,
+            )
+            append_audit_event("workflow_run_queued", user_email=current_user, workflow_id=workflow_id, status="queued")
+            return result
         runners = build_runners(current_user or None, scope)
         engine = WorkflowEngine(runners, hooks=hooks)
         result = engine.run(workflow, inputs=req.inputs)
@@ -159,10 +172,69 @@ def create_workflow_designer_router(
             user_email=current_user or None,
             graph=workspace_graph(),
             workspace_id=scope,
+            mode="live",
+            pause={"node": result.paused_node, "pending": result.pending_approval,
+                   "context": result.paused_context} if result.status == "awaiting_approval" else None,
         )
         append_audit_event("workflow_run", user_email=current_user, workflow_id=workflow_id, status=result.status)
         return {"run": run, "result": result.as_dict()}
 
+    @router.post("/workflows/api/runs/{run_id}/stop")
+    async def stop_run(run_id: str, request: Request):
+        require_user(request)
+        scope = gate_write(request)
+        if run_executor is None:
+            try:
+                run = store.get_workflow_run(run_id, workspace_id=scope)
+            except FileNotFoundError as exc:
+                raise HTTPException(status_code=404, detail=f"Workflow run not found: {run_id}") from exc
+            return {
+                "stopped": False,
+                "reason": "asynchronous cancellation is not supported by the synchronous runtime",
+                "run_id": run_id,
+                "status": run.get("status"),
+            }
+        return run_executor.cancel(run_id, kind="workflow", scope=scope)
+
+    @router.post("/workflows/api/runs/{run_id}/resume")
+    async def resume_run(run_id: str, req: WorkflowResumeRequest, request: Request):
+        """Decide a paused (awaiting_approval) run: approve → the paused node
+        executes and the run continues; deny → the run fails honestly."""
+        current_user = require_user(request)
+        scope = gate_write(request)
+        run_record = store.get_workflow_run(run_id, workspace_id=scope)
+        pause = run_record.get("pause") or {}
+        if run_record.get("status") != "awaiting_approval" or not pause.get("node"):
+            raise HTTPException(status_code=409, detail="run is not awaiting approval")
+        workflow = store.get_workflow(run_record.get("workflow_id"), workspace_id=scope)
+        runners = build_runners(current_user or None, scope)
+        engine = WorkflowEngine(runners, hooks=hooks)
+        result = engine.resume(
+            workflow,
+            paused_node=pause["node"],
+            paused_context=pause.get("context") or {},
+            approved=bool(req.approved),
+            prior_timeline=run_record.get("timeline") or [],
+        )
+        resumed = store.record_workflow_run(
+            workflow_id=run_record.get("workflow_id"),
+            name=run_record.get("name") or "workflow",
+            status=result.status,
+            timeline=result.timeline,
+            outputs=result.outputs,
+            user_email=current_user or None,
+            graph=workspace_graph(),
+            workspace_id=scope,
+            mode="live",
+            pause={"node": result.paused_node, "pending": result.pending_approval,
+                   "context": result.paused_context} if result.status == "awaiting_approval" else None,
+        )
+        store.mark_workflow_run_resolved(run_id, resumed_run_id=resumed["id"],
+                                         approved=bool(req.approved), workspace_id=scope)
+        append_audit_event("workflow_run_resume", user_email=current_user,
+                           run_id=run_id, approved=bool(req.approved), status=result.status)
+        return {"run": resumed, "result": result.as_dict(), "resumed_from": run_id}
+
     @router.get("/workflows/api/definitions/{workflow_id}/runs")
     async def list_runs(workflow_id: str, request: Request, limit: int = 50):
         require_user(request)
@@ -175,6 +247,13 @@ def create_workflow_designer_router(
         scope = gate_read(request)
         return store.list_workflow_runs(limit=limit, workspace_id=scope)
 
+    @router.get("/workflows/api/triggers")
+    async def trigger_status(request: Request):
+        require_user(request)
+        if trigger_service is None:
+            return {"running": False, "tick_seconds": None, "armed": []}
+        return trigger_service.describe()
+
     @router.get("/workflows/api/runs/{run_id}/replay")
     async def workflow_run_replay(run_id: str, request: Request):
         require_user(request)