ltcai 4.0.0 → 4.1.0

package/latticeai/services/workspace_service.py

@@ -26,7 +26,7 @@ Guardrail summary (v1.2.0):
 
 from __future__ import annotations
 
-from typing import Any, Dict, Optional
+from typing import Any, Callable, Dict, Optional
 
 from latticeai.core.workspace_os import WorkspaceOSStore
 
@@ -38,13 +38,20 @@ class WorkspaceService:
     # partitioned per workspace. Surfaced so the UI / docs can be explicit.
     SHARED_GLOBAL_AREAS = ("graph", "skills")
 
-    def __init__(self, store: WorkspaceOSStore):
+    def __init__(self, store: WorkspaceOSStore, *, resolve_user_id: Optional[Callable[[Optional[str]], Optional[str]]] = None):
         self.store = store
+        self._resolve_user_id = resolve_user_id or (lambda user_id: user_id)
+
+    def _identity(self, user_id: Optional[str]) -> Optional[str]:
+        if isinstance(user_id, str) and user_id.startswith("user:"):
+            return user_id
+        return self._resolve_user_id(user_id)
 
     # ── scope resolution + gating ────────────────────────────────────────
 
     def _ensure_permission(self, workspace_id: str, user_id: Optional[str], permission: str) -> None:
-        if not self.store.has_permission(workspace_id, user_id, permission):
+        resolved_user = self._identity(user_id)
+        if not self.store.has_permission(workspace_id, resolved_user, permission):
             raise PermissionError(
                 f"'{user_id or 'anonymous'}' lacks '{permission}' on workspace '{workspace_id}'"
             )
@@ -67,10 +74,10 @@ class WorkspaceService:
         return workspace_id
 
     def can_read(self, workspace_id: str, user_id: Optional[str]) -> bool:
-        return self.store.has_permission(workspace_id, user_id, "read")
+        return self.store.has_permission(workspace_id, self._identity(user_id), "read")
 
     def can_write(self, workspace_id: str, user_id: Optional[str]) -> bool:
-        return self.store.has_permission(workspace_id, user_id, "write")
+        return self.store.has_permission(workspace_id, self._identity(user_id), "write")
 
     # ── record-level authorization (by-id access must not bypass gating) ──
 
@@ -93,12 +100,13 @@ class WorkspaceService:
         """
         owner = (record or {}).get("user_email")
         workspace_id = (record or {}).get("workspace_id")
-        if owner and owner == user_id:
+        resolved_user = self._identity(user_id)
+        if owner and owner in {user_id, resolved_user}:
             return
         if workspace_id:
-            self._ensure_permission(workspace_id, user_id, "write")
+            self._ensure_permission(workspace_id, resolved_user, "write")
             return
-        if owner and owner != user_id:
+        if owner and owner not in {user_id, resolved_user}:
             raise PermissionError(
                 f"'{user_id or 'anonymous'}' is not the owner of memory '{record.get('id')}'"
             )
@@ -107,42 +115,42 @@ class WorkspaceService:
 
     def summary(self, user_id: Optional[str]) -> Dict[str, Any]:
         data = self.store.summary()
-        data["workspace_registry"] = self.store.list_workspaces(user_id=user_id)
+        data["workspace_registry"] = self.store.list_workspaces(user_id=self._identity(user_id))
         data["shared_global_areas"] = list(self.SHARED_GLOBAL_AREAS)
         return data
 
     def list_workspaces(self, user_id: Optional[str]) -> Dict[str, Any]:
-        return self.store.list_workspaces(user_id=user_id)
+        return self.store.list_workspaces(user_id=self._identity(user_id))
 
     def get_workspace(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
         # Reading workspace metadata requires read access to that workspace.
         self._ensure_permission(workspace_id, user_id, "read")
-        return self.store.get_workspace(workspace_id, user_id=user_id)
+        return self.store.get_workspace(workspace_id, user_id=self._identity(user_id))
 
     def workspace_summary(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
         self._ensure_permission(workspace_id, user_id, "read")
-        return self.store.workspace_summary(workspace_id, user_id=user_id)
+        return self.store.workspace_summary(workspace_id, user_id=self._identity(user_id))
 
     # ── organization workspace management (delegates with actor) ─────────
 
     def create_organization_workspace(self, *, name: str, owner_user_id: Optional[str], settings: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
-        return self.store.create_organization_workspace(name=name, owner_user_id=owner_user_id, settings=settings)
+        return self.store.create_organization_workspace(name=name, owner_user_id=self._identity(owner_user_id), settings=settings)
 
     def update_workspace(self, workspace_id: str, *, name=None, settings=None, actor=None) -> Dict[str, Any]:
-        return self.store.update_workspace(workspace_id, name=name, settings=settings, actor=actor)
+        return self.store.update_workspace(workspace_id, name=name, settings=settings, actor=self._identity(actor))
 
     def archive_workspace(self, workspace_id: str, *, actor=None) -> Dict[str, Any]:
-        return self.store.archive_workspace(workspace_id, actor=actor)
+        return self.store.archive_workspace(workspace_id, actor=self._identity(actor))
 
     def add_member(self, workspace_id: str, *, user_id: str, role: str = "member", actor=None) -> Dict[str, Any]:
-        return self.store.add_member(workspace_id, user_id=user_id, role=role, actor=actor)
+        return self.store.add_member(workspace_id, user_id=self._identity(user_id) or user_id, role=role, actor=self._identity(actor))
 
     def update_member_role(self, workspace_id: str, *, user_id: str, role: str, actor=None) -> Dict[str, Any]:
-        return self.store.update_member_role(workspace_id, user_id=user_id, role=role, actor=actor)
+        return self.store.update_member_role(workspace_id, user_id=self._identity(user_id) or user_id, role=role, actor=self._identity(actor))
 
     def remove_member(self, workspace_id: str, *, user_id: str, actor=None) -> Dict[str, Any]:
-        return self.store.remove_member(workspace_id, user_id=user_id, actor=actor)
+        return self.store.remove_member(workspace_id, user_id=self._identity(user_id) or user_id, actor=self._identity(actor))
 
     def set_active_workspace(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
         # Membership is enforced inside the store for organization workspaces.
-        return self.store.set_active_workspace(workspace_id, user_id=user_id)
+        return self.store.set_active_workspace(workspace_id, user_id=self._identity(user_id))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Lattice AI — local-first Digital Brain Platform (knowledge graph, durable memory, hybrid search, agents, signed brain exchange)",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {
@@ -18,29 +18,36 @@
     "start": "LTCAI",
     "dev": "python3 ltcai_cli.py --reload",
     "build": "npm run build:assets && npm run build:python",
-    "build:assets": "node scripts/build_v3_assets.mjs",
-    "build:python": "python3 -m build",
-    "check:python": "python3 scripts/check_python.py",
-    "lint": "node --check static/scripts/account.js && node --check static/scripts/admin.js && node --check static/scripts/chat.js && node --check static/scripts/graph.js && node --check static/scripts/platform.js && node --check static/scripts/ux.js && node --check static/scripts/workspace.js && node --check tests/visual/mock_server.cjs && node --check tests/visual/v3.spec.js && npm run lint:v3",
-    "lint:v3": "node scripts/lint_v3.mjs",
-    "typecheck": "cd vscode-extension && npm run build",
-    "test": "python3 -m pytest tests/ -v",
-    "test:unit": "python3 -m pytest tests/unit/ -v",
-    "test:integration": "python3 -m pytest tests/integration/ -v",
+    "frontend:dev": "vite --host 127.0.0.1",
+    "frontend:openapi": "node scripts/run_python.mjs scripts/export_openapi.py frontend/openapi.json && npx openapi-typescript frontend/openapi.json -o frontend/src/api/openapi.ts",
+    "build:assets": "vite build && node scripts/build_frontend_assets.mjs",
+    "build:python": "node scripts/run_python.mjs -m build",
+    "check:python": "node scripts/run_python.mjs scripts/check_python.py",
+    "lint": "node --check tests/visual/mock_server.cjs && node --check tests/visual/v3.spec.js && npm run lint:frontend",
+    "lint:frontend": "node scripts/lint_frontend.mjs",
+    "typecheck": "npm run typecheck:frontend && cd vscode-extension && npm run build",
+    "typecheck:frontend": "npx tsc -p tsconfig.json --noEmit",
+    "test": "node scripts/run_python.mjs -m pytest tests/ -v",
+    "test:unit": "node scripts/run_python.mjs -m pytest tests/unit/ -v",
+    "test:integration": "node scripts/run_python.mjs -m pytest tests/integration/ -v",
     "test:visual": "playwright test",
     "capture:workspace": "node scripts/capture/capture_workspace.js",
     "capture:graph": "node scripts/capture/capture_graph.js",
     "capture:skills": "node scripts/capture/capture_skills.js",
     "capture:enterprise": "node scripts/capture/capture_enterprise.js",
     "capture:onboarding": "node scripts/capture/capture_onboarding.js",
+    "desktop:tauri": "tauri dev",
+    "desktop:tauri:build": "tauri build",
+    "desktop:tauri:check": "cd src-tauri && cargo check",
+    "desktop:electron": "electron desktop/electron/main.cjs",
     "package:vsix": "node scripts/build_vsix.mjs",
     "release:artifacts": "npm run build:assets && npm run build:python && npm pack && npm run package:vsix",
-    "release:validate": "python3 scripts/validate_release_artifacts.py $npm_package_version --require-vsix --require-tgz",
+    "release:validate": "node scripts/run_python.mjs scripts/validate_release_artifacts.py $npm_package_version --require-vsix --require-tgz",
     "publish:npm": "npm pack && npm publish ltcai-$npm_package_version.tgz --access public",
-    "publish:pypi": "npm run build:python && python3 -m twine upload --skip-existing dist/ltcai-$npm_package_version.tar.gz dist/ltcai-$npm_package_version-py3-none-any.whl",
+    "publish:pypi": "npm run build:python && node scripts/run_python.mjs -m twine upload --skip-existing dist/ltcai-$npm_package_version.tar.gz dist/ltcai-$npm_package_version-py3-none-any.whl",
     "publish:vscode": "cd vscode-extension && npm run package:vsix && npm run publish:vscode",
     "publish:openvsx": "cd vscode-extension && npm run package:vsix && npm run publish:openvsx",
-    "publish:all": "npm run release:artifacts && npm run release:validate && npm publish ltcai-$npm_package_version.tgz --access public && python3 -m twine upload --skip-existing dist/ltcai-$npm_package_version.tar.gz dist/ltcai-$npm_package_version-py3-none-any.whl && cd vscode-extension && npm run publish:vscode && npm run publish:openvsx"
+    "publish:all": "npm run release:artifacts && npm run release:validate && npm publish ltcai-$npm_package_version.tgz --access public && node scripts/run_python.mjs -m twine upload --skip-existing dist/ltcai-$npm_package_version.tar.gz dist/ltcai-$npm_package_version-py3-none-any.whl && cd vscode-extension && npm run publish:vscode && npm run publish:openvsx"
   },
   "keywords": [
     "ltcai",
@@ -74,23 +81,12 @@
     "mcp_registry.py",
     "latticeai/**/*.py",
     "skills/",
-    "static/account.html",
-    "static/chat.html",
-    "static/admin.html",
-    "static/graph.html",
-    "static/workspace.html",
-    "static/plugins.html",
-    "static/workflows.html",
-    "static/agents.html",
-    "static/activity.html",
     "static/favicon.ico",
     "static/manifest.json",
     "static/sw.js",
-    "static/workspace.css",
-    "static/platform.css",
-    "static/scripts/",
     "static/css/",
-    "static/v3/",
+    "frontend/",
+    "static/app/",
     "static/icons/",
     "plugins/",
     "scripts/",
@@ -101,6 +97,12 @@
     "setup_wizard.py",
     "knowledge_graph_api.py",
     "static/vendor/",
+    "src-tauri/",
+    "!src-tauri/gen/",
+    "!src-tauri/gen/**",
+    "!src-tauri/target/",
+    "!src-tauri/target/**",
+    "desktop/electron/",
     "docs/*.md",
     "!docs/assets/",
     "!docs/images/"
@@ -109,6 +111,31 @@
     "access": "public"
   },
   "devDependencies": {
-    "@playwright/test": "^1.60.0"
+    "@playwright/test": "^1.60.0",
+    "@tailwindcss/postcss": "^4.3.0",
+    "@tanstack/react-query": "^5.101.0",
+    "@tauri-apps/api": "^2.0.0",
+    "@tauri-apps/cli": "^2.0.0",
+    "@types/cytoscape": "^3.21.9",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^6.0.2",
+    "autoprefixer": "^10.5.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cytoscape": "^3.34.0",
+    "electron": "^42.4.0",
+    "lucide-react": "^1.17.0",
+    "openapi-fetch": "^0.17.0",
+    "openapi-typescript": "^7.13.0",
+    "postcss": "^8.5.15",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
+    "reactflow": "^11.11.4",
+    "tailwind-merge": "^3.6.0",
+    "tailwindcss": "^4.3.0",
+    "typescript": "^5.9.3",
+    "vite": "^8.0.16",
+    "zustand": "^5.0.14"
   }
 }

package/scripts/build_frontend_assets.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const repo = join(import.meta.dirname, "..");
+const appDir = join(repo, "static", "app");
+const nestedViteManifest = join(appDir, ".vite", "asset-manifest.json");
+const publicManifest = join(appDir, "asset-manifest.json");
+const pkg = JSON.parse(readFileSync(join(repo, "package.json"), "utf8"));
+
+const viteManifest = existsSync(nestedViteManifest) ? nestedViteManifest : publicManifest;
+if (!existsSync(viteManifest)) {
+  console.error("Vite manifest missing. Run `vite build` before build_frontend_assets.mjs.");
+  process.exit(1);
+}
+
+const raw = JSON.parse(readFileSync(viteManifest, "utf8"));
+const assets = {};
+for (const [key, value] of Object.entries(raw)) {
+  if (value && typeof value === "object") {
+    if (value.file) assets[key] = `/static/app/${value.file}`;
+    for (const css of value.css || []) assets[css] = `/static/app/${css}`;
+    for (const asset of value.assets || []) assets[asset] = `/static/app/${asset}`;
+  }
+}
+
+const manifest = {
+  version: pkg.version,
+  generated_at: "vite",
+  entrypoints: {
+    app: assets["frontend/index.html"] || "/static/app/index.html",
+  },
+  assets,
+  vite: raw,
+};
+
+writeFileSync(publicManifest, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+console.log(`wrote static/app/asset-manifest.json with ${Object.keys(assets).length} assets`);

package/scripts/bump_version.py

@@ -31,7 +31,7 @@ TARGETS = [
     ("package-lock.json", "package-lock", None),
     ("vscode-extension/package.json", "json", "version"),
     ("vscode-extension/package-lock.json", "package-lock", None),
-    ("static/v3/asset-manifest.json", "json", "version"),
+    ("static/app/asset-manifest.json", "json", "version"),
 ]
 
 

package/scripts/export_openapi.py

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+"""Export the FastAPI OpenAPI schema used by the desktop frontend client."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO))
+
+
+def main() -> int:
+    from latticeai.app_factory import create_app
+
+    target = Path(sys.argv[1] if len(sys.argv) > 1 else "frontend/openapi.json")
+    target.parent.mkdir(parents=True, exist_ok=True)
+    os.environ.setdefault("LATTICEAI_REQUIRE_AUTH", "false")
+    os.environ.setdefault("LATTICEAI_TUNNEL", "false")
+    os.environ.setdefault("LATTICEAI_AUTOLOAD_MODELS", "false")
+    app = create_app()
+    schema = app.openapi()
+    target.write_text(json.dumps(schema, sort_keys=True, indent=2) + "\n", encoding="utf-8")
+    print(f"wrote {target} with {len(schema.get('paths', {}))} paths")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lint_frontend.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { join, relative } from "node:path";
+import { spawnSync } from "node:child_process";
+
+const repo = join(import.meta.dirname, "..");
+const frontend = join(repo, "frontend");
+const staticRoot = join(repo, "static");
+let failures = 0;
+
+function fail(message) {
+  failures += 1;
+  console.error(`FAIL ${message}`);
+}
+
+function walk(dir, exts) {
+  if (!existsSync(dir)) return [];
+  const out = [];
+  for (const name of readdirSync(dir)) {
+    const path = join(dir, name);
+    const stat = statSync(path);
+    if (stat.isDirectory()) {
+      if (name === "node_modules") continue;
+      out.push(...walk(path, exts));
+    } else if (exts.some((ext) => name.endsWith(ext))) {
+      out.push(path);
+    }
+  }
+  return out;
+}
+
+const tsc = spawnSync("npx", ["tsc", "-p", "tsconfig.json", "--noEmit"], { cwd: repo, encoding: "utf8" });
+if (tsc.status !== 0) fail(`frontend typecheck\n${tsc.stdout}${tsc.stderr}`);
+else console.log("typecheck: frontend TS passes");
+
+const files = [
+  ...walk(frontend, [".ts", ".tsx", ".css", ".html"]),
+  ...walk(join(staticRoot, "app"), [".js", ".css", ".html", ".json"]),
+  join(staticRoot, "sw.js"),
+  join(staticRoot, "manifest.json"),
+].filter(existsSync);
+
+const external = /https?:\/\/(fonts\.googleapis\.com|fonts\.gstatic\.com|cdn\.jsdelivr\.net|unpkg\.com|cdnjs\.cloudflare\.com)/;
+const stale = /static\/v3|lint_v3|build_v3_assets/;
+let scanned = 0;
+for (const file of files) {
+  scanned += 1;
+  const text = readFileSync(file, "utf8");
+  if (external.test(text)) fail(`${relative(repo, file)}: CDN reference`);
+  if (stale.test(text)) fail(`${relative(repo, file)}: stale v3 frontend reference`);
+}
+console.log(`privacy: ${scanned} frontend/static files scanned`);
+
+const client = readFileSync(join(frontend, "src", "api", "client.ts"), "utf8");
+if (!client.includes("openapi-fetch") || !client.includes("./openapi")) {
+  fail("frontend/src/api/client.ts must use the generated OpenAPI client");
+}
+if (!existsSync(join(frontend, "src", "api", "openapi.ts"))) {
+  fail("generated OpenAPI types missing");
+}
+
+const openapi = JSON.parse(readFileSync(join(frontend, "openapi.json"), "utf8"));
+const openapiPaths = Object.keys(openapi.paths || {});
+const requiredPaths = [
+  "/health",
+  "/chat",
+  "/api/graph",
+  "/api/search/hybrid",
+  "/api/knowledge-graph/export",
+  "/api/memory/recall",
+  "/agents/api/run",
+  "/workflows/api/definitions",
+  "/workspace/os",
+  "/models",
+];
+if (openapiPaths.length < 300) fail(`OpenAPI path count too low: ${openapiPaths.length}`);
+for (const path of requiredPaths) {
+  if (!openapiPaths.includes(path)) fail(`OpenAPI path missing: ${path}`);
+}
+console.log(`api: generated OpenAPI schema exposes ${openapiPaths.length} paths`);
+
+if (failures) {
+  console.error(`\nfrontend lint: ${failures} failure(s)`);
+  process.exit(1);
+}
+console.log("\nfrontend lint: all checks pass");

package/scripts/run_python.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const args = process.argv.slice(2);
+
+if (args.length === 0) {
+  console.error("usage: node scripts/run_python.mjs <python-args...>");
+  process.exit(2);
+}
+
+const candidates = [
+  process.env.LTCAI_PYTHON,
+  path.join(process.cwd(), ".venv", "bin", "python"),
+  path.join(process.cwd(), ".venv", "Scripts", "python.exe"),
+  "python3",
+  "python",
+].filter(Boolean);
+
+let lastError = null;
+
+for (const candidate of candidates) {
+  const isPath = candidate.includes(path.sep);
+  if (isPath && !existsSync(candidate)) {
+    continue;
+  }
+
+  const result = spawnSync(candidate, args, {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+  });
+
+  if (result.error) {
+    if (result.error.code === "ENOENT") {
+      lastError = result.error;
+      continue;
+    }
+    throw result.error;
+  }
+
+  process.exit(result.status ?? 1);
+}
+
+console.error(`No usable Python executable found. Last error: ${lastError?.message ?? "none"}`);
+process.exit(127);