ltcai 8.1.0 → 8.3.0

package/lattice_brain/workflow.py

@@ -27,7 +27,7 @@ from dataclasses import dataclass, field
 from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional
 
-from lattice_brain.runtime.contracts import workflow_run_contract
+from lattice_brain.runtime.contracts import runtime_boundary_contract, workflow_run_contract
 
 
 WORKFLOW_ENGINE_VERSION = "2.2.0"
@@ -106,6 +106,11 @@ def normalize_definition(workflow: Dict[str, Any]) -> Dict[str, Any]:
     }
 
 
+def legacy_steps_from_nodes(nodes: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """Return the compact legacy ``steps`` projection for node workflows."""
+    return [{"action": node.get("type"), "node": node.get("id")} for node in nodes]
+
+
 def validate_definition(workflow: Dict[str, Any]) -> List[str]:
     """Return a list of validation errors ([] means valid)."""
     errors: List[str] = []
@@ -269,6 +274,26 @@ class WorkflowEngine:
         # against the workflow lifecycle actually executes.
         self.hooks = hooks
 
+    def boundary(self) -> Dict[str, Any]:
+        return runtime_boundary_contract(
+            name="WorkflowEngine",
+            runtime="workflow",
+            entrypoint="lattice_brain.workflow.WorkflowEngine",
+            surface="/workflows",
+            owns="typed workflow validation, execution, approval suspension, resume, export, and import",
+        )
+
+    def config(self) -> Dict[str, Any]:
+        return {
+            "version": WORKFLOW_ENGINE_VERSION,
+            "boundary": self.boundary(),
+            "node_types": list(NODE_TYPES),
+            "runner_families": dict(_RUNNER_FOR),
+            "max_steps": _MAX_STEPS,
+            "approval_suspend": True,
+            "legacy_steps_projection": "lattice_brain.workflow.legacy_steps_from_nodes",
+        }
+
     def run(self, workflow: Dict[str, Any], *, inputs: Optional[Dict[str, Any]] = None) -> WorkflowRun:
         definition = normalize_definition(workflow)
         errors = validate_definition(definition)

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "8.1.0"
+__version__ = "8.3.0"

package/latticeai/api/computer_use.py

@@ -42,12 +42,14 @@ Available actions:
 - computer_scroll: {"action":"computer_scroll","args":{"x":500,"y":300,"direction":"down","clicks":3}}
 - computer_move: {"action":"computer_move","args":{"x":500,"y":300}}
 - computer_drag: {"action":"computer_drag","args":{"x1":100,"y1":100,"x2":500,"y2":500}}
+- vision_analyze: {"action":"vision_analyze","args":{"image_b64": "...", "prompt": "What do you see on screen?"}} — use after screenshot to let VLM describe/answer about the image (only when multimodal model loaded)
 - final: {"action":"final","message":"Korean summary of what was accomplished"}
 
 Rules:
 - Respond with exactly ONE JSON object. No markdown, no extra text.
 - Do not take screenshots for simple app launch, URL opening, keyboard shortcuts, or non-visual tasks.
 - Take a screenshot before coordinate-based clicks/drags or when the task explicitly asks you to inspect the screen.
+- After screenshot, prefer vision_analyze (with good prompt) over raw b64 in next step when you need to understand what is on screen (especially with multimodal/VLM loaded).
 - After coordinate-based clicking or typing into an unknown focused field, take a screenshot only if verification is necessary.
 - Use coordinates relative to the screen (0,0 is top-left).
 - If a UI element is not visible, scroll or search for it first.

package/latticeai/api/knowledge_graph.py

@@ -13,6 +13,7 @@ from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
 from latticeai.api.ui_redirects import app_redirect
+from lattice_brain.ingestion import IngestionItem
 
 
 class KnowledgeGraphIngestRequest(BaseModel):
@@ -61,6 +62,7 @@ def create_knowledge_graph_router(
     require_user: Callable[[Request], str],
     static_dir: Path,
     allowed_workspaces_for: Optional[Callable[[Optional[str]], Any]] = None,
+    ingestion_pipeline: Any = None,
 ) -> APIRouter:
     router = APIRouter()
 
@@ -191,6 +193,37 @@ def create_knowledge_graph_router(
         if event_type not in {"message", "ai_response", "note"}:
             raise HTTPException(status_code=400, detail="지원하는 type: message, ai_response, note")
         role = req.role or ("assistant" if event_type == "ai_response" else "user")
+        if ingestion_pipeline is not None:
+            source_type = "chat_message" if event_type in {"message", "ai_response"} else "note"
+            result = ingestion_pipeline.ingest(
+                IngestionItem(
+                    source_type=source_type,
+                    title=req.title,
+                    text=req.content,
+                    source_uri=req.source,
+                    owner=req.user_email or current_user,
+                    workspace_id=workspace_id,
+                    conversation_id=req.conversation_id,
+                    metadata={
+                        "type": req.type,
+                        "role": role,
+                        "source": req.source or "mcp",
+                        "user_nickname": req.user_nickname,
+                        "raw": {
+                            "type": req.type,
+                            "title": req.title,
+                            "content": req.content,
+                            "workspace_id": workspace_id,
+                            "metadata": req.metadata or {},
+                        },
+                        **(req.metadata or {}),
+                    },
+                ),
+                user_email=req.user_email or current_user,
+            )
+            if result.status != "ok":
+                raise HTTPException(status_code=500, detail=result.detail or result.status)
+            return result.as_dict()
         return kg.ingest_message(
             role,
             req.content,

package/latticeai/api/local_files.py

@@ -46,6 +46,7 @@ def create_local_files_router(
     require_graph,
     static_dir: Path,
     local_kg_watcher,
+    ingestion_pipeline=None,
     hooks=None,
     data_dir: Optional[Path] = None,
     allowed_workspaces_for=None,
@@ -212,6 +213,7 @@ def create_local_files_router(
             require_user=require_user,
             static_dir=static_dir,
             allowed_workspaces_for=allowed_workspaces_for,
+            ingestion_pipeline=ingestion_pipeline,
         )
     )
 

package/latticeai/api/memory.py

@@ -58,6 +58,19 @@ def create_memory_router(
         scope = gate_read(request)
         return service.brain_quality_summary(user_email=user, workspace_id=scope)
 
+    @router.get("/api/memory/brain-brief")
+    async def brain_brief(request: Request, q: str = "", limit: int = 3):
+        user = require_user(request)
+        scope = gate_read(request)
+        active_model = active_model_getter() if active_model_getter else ""
+        return service.brain_brief(
+            user_email=user,
+            workspace_id=scope,
+            active_model=active_model,
+            recall_query=q,
+            limit=limit,
+        )
+
     @router.get("/api/memory/brain-proof")
     async def brain_proof(request: Request, q: str = "", limit: int = 3):
         user = require_user(request)

package/latticeai/api/tools.py

@@ -488,6 +488,7 @@ def create_tools_router(
         require_graph=_require_graph,
         static_dir=STATIC_DIR,
         local_kg_watcher=LOCAL_KG_WATCHER,
+        ingestion_pipeline=ingestion_pipeline,
         hooks=HOOKS,
         data_dir=DATA_DIR,
         allowed_workspaces_for=allowed_workspaces_for,

package/latticeai/api/workflow_designer.py

@@ -73,10 +73,11 @@ def create_workflow_designer_router(
 ) -> APIRouter:
     from lattice_brain.workflow import (
         WorkflowEngine,
+        WorkflowError,
         validate_definition,
         export_workflow,
         import_workflow,
-        WorkflowError,
+        legacy_steps_from_nodes,
     )
 
     router = APIRouter()
@@ -101,7 +102,7 @@ def create_workflow_designer_router(
             raise HTTPException(status_code=400, detail={"validation_errors": errors})
         workflow = store.create_workflow(
             name=req.name,
-            steps=[{"action": n.get("type"), "node": n.get("id")} for n in req.nodes],
+            steps=legacy_steps_from_nodes(req.nodes),
             nodes=req.nodes,
             metadata=req.metadata,
             user_email=current_user or None,
@@ -293,7 +294,7 @@ def create_workflow_designer_router(
             raise HTTPException(status_code=400, detail={"validation_errors": errors})
         workflow = store.create_workflow(
             name=definition["name"],
-            steps=[{"action": n.get("type"), "node": n.get("id")} for n in definition["nodes"]],
+            steps=legacy_steps_from_nodes(definition["nodes"]),
             nodes=definition["nodes"],
             metadata=definition["metadata"],
             user_email=current_user or None,
@@ -343,7 +344,7 @@ def create_workflow_designer_router(
             raise HTTPException(status_code=400, detail=str(exc)) from exc
         workflow = store.create_workflow(
             name=definition["name"],
-            steps=[{"action": n.get("type"), "node": n.get("id")} for n in definition["nodes"]],
+            steps=legacy_steps_from_nodes(definition["nodes"]),
             nodes=definition["nodes"],
             metadata=definition.get("metadata") or {},
             user_email=current_user or None,

package/latticeai/app_factory.py

@@ -44,6 +44,8 @@ from latticeai.runtime.platform_services_runtime import (
 from latticeai.runtime.platform_runtime_wiring import build_platform_automation_runtime
 from latticeai.runtime.persistence_runtime import build_persistence_runtime
 from latticeai.runtime.review_wiring import build_review_run_now_runner
+from latticeai.runtime.sso_runtime import build_sso_runtime
+from latticeai.runtime.audit_runtime import build_audit_runtime
 from latticeai.runtime.router_registration import (
     build_auth_admin_security_router_bundle,
     build_static_routes_bundle,
@@ -93,6 +95,7 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
 
     from latticeai.models.router import LLMRouter, normalize_branding
     from lattice_brain._kg_common import set_llm_router
+    from lattice_brain.graph.schema import set_embed_dim
     from latticeai.core.security import (
         hash_password,
         verify_password,
@@ -105,7 +108,6 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
     )
     from latticeai.core.audit import (
         get_audit_log as _get_audit_log,
-        append_audit_event as _append_audit_event,
         classify_sensitive_message as _classify_sensitive_message,
         build_sensitivity_report as _build_sensitivity_report,
         build_admin_audit_report as _build_admin_audit_report,
@@ -249,29 +251,12 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
     SSO_CLIENT_SECRET = _security_runtime["SSO_CLIENT_SECRET"]
     SSO_REDIRECT_URI = _security_runtime["SSO_REDIRECT_URI"]
     SSO_PROVIDER_NAME = _security_runtime["SSO_PROVIDER_NAME"]
-    _sso_discovery_cache: Optional[Dict] = None
-    _sso_discovery_cache_url: str = ""
-    _sso_states: Dict[str, float] = {}  # state → timestamp (CSRF protection)
 
-    async def _get_sso_discovery() -> Optional[Dict]:
-        nonlocal _sso_discovery_cache, _sso_discovery_cache_url
-        settings = get_sso_settings()
-        discovery_url = settings.get("discovery_url", "")
-        if _sso_discovery_cache and _sso_discovery_cache_url == discovery_url:
-            return _sso_discovery_cache
-        if not discovery_url:
-            return None
-        try:
-            import httpx as _httpx
-            async with _httpx.AsyncClient() as c:
-                r = await c.get(discovery_url, timeout=10)
-                r.raise_for_status()
-                _sso_discovery_cache = r.json()
-                _sso_discovery_cache_url = discovery_url
-        except Exception as e:
-            logging.warning("SSO discovery failed: %s", e)
-            return None
-        return _sso_discovery_cache
+    # SSO cache + discovery built after get_sso_settings is defined (see below)
+    _sso_discovery_cache = None
+    _sso_discovery_cache_url = ""
+    _sso_states: Dict[str, float] = {}
+    _get_sso_discovery = None  # filled after def below
 
     # ── Password hashing — used directly from latticeai.core.security ──────────────
     # (hash_password / verify_password are imported above; no local wrapper needed)
@@ -355,6 +340,7 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
         extra={"target": CONFIG.embedding_custom_target},
         probe=_embedding_provider not in {"", "hash", "local", "fallback"},
     )
+    set_embed_dim(int(getattr(EMBEDDER, "dim", None) or _embedding_dim or 384))
     if EMBEDDER.fell_back:
         logging.warning("Embedding provider %s unavailable: %s", EMBEDDER.requested, EMBEDDER.detail)
     STORAGE_ENGINE = storage_from_env(os.environ, data_dir=DATA_DIR) if ENABLE_GRAPH else None
@@ -479,6 +465,17 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
     def get_sso_settings() -> Dict[str, object]:
         return load_sso_config()
 
+    # Build SSO runtime (cache + helper) now that get_sso_settings exists in scope.
+    if _get_sso_discovery is None:
+        _sso = build_sso_runtime(
+            get_sso_settings=get_sso_settings,
+            logging=logging,
+        )
+        _sso_discovery_cache = _sso["_sso_discovery_cache"]
+        _sso_discovery_cache_url = _sso["_sso_discovery_cache_url"]
+        _sso_states = _sso["_sso_states"]
+        _get_sso_discovery = _sso["_get_sso_discovery"]
+
     def public_sso_config(config: Optional[Dict[str, object]] = None) -> Dict[str, object]:
         cfg = config or get_sso_settings()
         return {
@@ -558,11 +555,7 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
 
     _history_lock = threading.Lock()
 
-    def get_audit_log() -> List[Dict]:
-        return _get_audit_log(AUDIT_FILE)
-
-    def append_audit_event(event_type: str, **payload) -> None:
-        _append_audit_event(AUDIT_FILE, event_type, **payload)
+    # audit build moved after redact_secret_text is defined (see below)
 
     def save_to_history(
         role: str,
@@ -634,6 +627,15 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
     def redact_secret_text(text: str) -> str:
         return _redact_secret_text(text)
 
+    # Build audit now that redact is available
+    _audit_rt = build_audit_runtime(
+        audit_file=AUDIT_FILE,
+        logging=logging,
+        redact_fn=redact_secret_text,
+    )
+    get_audit_log = _audit_rt["get_audit_log"]
+    append_audit_event = _audit_rt["append_audit_event"]
+
     def get_history():
         try:
             return CONVERSATIONS.history()

package/latticeai/brain/__init__.py

@@ -22,7 +22,7 @@ warnings.warn(
     "latticeai.brain is deprecated; import lattice_brain instead",
     DeprecationWarning,
     stacklevel=2,
-)
+)  # one-time per import site in practice; shims remain for compat surface
 
 __all__ = [
     "AssembledContext",

package/latticeai/core/config.py

@@ -26,6 +26,8 @@ from typing import List, Mapping, Optional
 from latticeai.core.security import host_is_loopback
 
 
+__all__ = ["Config", "_value", "_str", "_bool", "_int"]
+
 def _value(env: Mapping[str, str], key: str, default: str = "") -> str:
     """Mirror the legacy ``env_value``: ``getenv(key) or default or ""`` (no strip)."""
     return env.get(key) or default or ""
@@ -68,6 +70,7 @@ class Config:
     host: str
     port: int
     network_exposed: bool
+    timezone: str
 
     # ── feature flags ───────────────────────────────────────────────
     enable_telegram: bool
@@ -93,6 +96,9 @@ class Config:
     local_model: str
     local_draft_model: str
     auto_read_chat_paths: bool
+    max_local_models: int
+    allow_model_downloads: bool
+    model_download_timeout: int
 
     # ── embeddings (retrieval vector signal) ────────────────────────
     embedding_provider: str
@@ -165,6 +171,7 @@ class Config:
             host=host,
             port=port,
             network_exposed=network_exposed,
+            timezone=_value(env, "LATTICE_TZ", "UTC") or "UTC",
             enable_telegram=_bool(env, "LATTICEAI_ENABLE_TELEGRAM", default=False),
             enable_graph=_bool(env, "LATTICEAI_ENABLE_GRAPH", default=True),
             autoload_models=_bool(env, "LATTICEAI_AUTOLOAD_MODELS", default=is_public),
@@ -184,6 +191,9 @@ class Config:
             local_model=local_model,
             local_draft_model=_value(env, "LATTICEAI_LOCAL_DRAFT_MODEL", ""),
             auto_read_chat_paths=_bool(env, "LATTICEAI_AUTO_READ_CHAT_PATHS", default=False),
+            max_local_models=_int(env, "LATTICEAI_MAX_LOCAL_MODELS", 1),
+            allow_model_downloads=_bool(env, "LATTICEAI_ALLOW_MODEL_DOWNLOADS", default=False),
+            model_download_timeout=_int(env, "LATTICEAI_MODEL_DOWNLOAD_TIMEOUT", 300),
             embedding_provider=_value(env, "LATTICEAI_EMBEDDING_PROVIDER", "hash").strip().lower(),
             embedding_profile=_value(env, "LATTICEAI_EMBEDDING_PROFILE", "").strip().lower(),
             embedding_model=_value(env, "LATTICEAI_EMBEDDING_MODEL", ""),

package/latticeai/core/legacy_compatibility.py

@@ -0,0 +1,174 @@
+"""Managed legacy compatibility surface for legacy import shims.
+
+Compatibility modules are intentionally still present for old scripts, VS Code
+extension paths, historical integrations, and pre-graph-package imports. 8.3.0
+stops treating them as vague technical debt: every tracked shim has an owner,
+migration target, removal phase, and replacement import that can be surfaced in
+docs and tests.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Dict, List
+
+
+LEGACY_COMPATIBILITY_VERSION = "8.3.0"
+
+
+@dataclass(frozen=True)
+class LegacyShim:
+    path: str
+    owner: str
+    replacement: str
+    reason: str
+    removal_phase: str
+    layer: str = "root"
+    status: str = "managed"
+
+    def as_dict(self) -> Dict[str, str]:
+        return {
+            "path": self.path,
+            "owner": self.owner,
+            "replacement": self.replacement,
+            "reason": self.reason,
+            "removal_phase": self.removal_phase,
+            "layer": self.layer,
+            "status": self.status,
+        }
+
+
+LEGACY_SHIMS: List[LegacyShim] = [
+    LegacyShim(
+        path="knowledge_graph.py",
+        owner="lattice_brain.graph",
+        replacement="from lattice_brain.store import KnowledgeGraphStore",
+        reason="Historical scripts imported the graph store from the repo root.",
+        removal_phase="major-release-after-8.x",
+    ),
+    LegacyShim(
+        path="knowledge_graph_api.py",
+        owner="latticeai.api.knowledge_graph",
+        replacement="from latticeai.api.knowledge_graph import create_knowledge_graph_router",
+        reason="Older API composition roots imported the knowledge graph router from the repo root.",
+        removal_phase="major-release-after-8.x",
+    ),
+    LegacyShim(
+        path="kg_schema.py",
+        owner="lattice_brain.graph.schema",
+        replacement="from lattice_brain.schema import ...",
+        reason="Historical graph schema tests and tools referenced root schema symbols.",
+        removal_phase="major-release-after-8.x",
+    ),
+    LegacyShim(
+        path="ltcai_cli.py",
+        owner="latticeai.cli.entrypoint",
+        replacement="from latticeai.cli.entrypoint import main",
+        reason="Console entry points and older package installs imported the CLI root module.",
+        removal_phase="major-release-after-8.x",
+    ),
+    LegacyShim(
+        path="telegram_bot.py",
+        owner="latticeai.integrations.telegram_bot",
+        replacement="from latticeai.integrations.telegram_bot import run_bot",
+        reason="Existing Telegram automation setups still import the legacy root module.",
+        removal_phase="major-release-after-8.x",
+    ),
+    LegacyShim(
+        path="p_reinforce.py",
+        owner="latticeai.services.p_reinforce",
+        replacement="from latticeai.services.p_reinforce import PReinforceGardener",
+        reason="Old gardener scripts referenced the root reinforcement helper.",
+        removal_phase="major-release-after-8.x",
+    ),
+    LegacyShim(
+        path="server.py",
+        owner="latticeai.server_app",
+        replacement="from latticeai.server_app import app, main",
+        reason="Deployment docs and local launch scripts historically targeted server.py.",
+        removal_phase="major-release-after-8.x",
+    ),
+    LegacyShim(
+        path="local_knowledge_api.py",
+        owner="latticeai.api.local_files",
+        replacement="from latticeai.api.local_files import create_local_files_router",
+        reason="Local folder ingestion integrations used the root local knowledge API.",
+        removal_phase="requires-api-route-migration",
+    ),
+    LegacyShim(
+        path="lattice_brain/store.py",
+        owner="lattice_brain.graph.store",
+        replacement="from lattice_brain.graph.store import KnowledgeGraphStore",
+        reason="Pre-graph-package imports used the flat Brain store module.",
+        removal_phase="major-release-after-8.x",
+        layer="brain-flat",
+    ),
+    LegacyShim(
+        path="lattice_brain/ingest.py",
+        owner="lattice_brain.graph.ingest",
+        replacement="from lattice_brain.graph.ingest import KnowledgeGraphIngestMixin",
+        reason="Pre-graph-package imports used the flat Brain ingest module.",
+        removal_phase="major-release-after-8.x",
+        layer="brain-flat",
+    ),
+    LegacyShim(
+        path="lattice_brain/retrieval.py",
+        owner="lattice_brain.graph.retrieval",
+        replacement="from lattice_brain.graph.retrieval import KnowledgeGraphRetrievalMixin",
+        reason="Pre-graph-package imports used the flat Brain retrieval module.",
+        removal_phase="major-release-after-8.x",
+        layer="brain-flat",
+    ),
+    LegacyShim(
+        path="latticeai/brain/store.py",
+        owner="lattice_brain.graph.store",
+        replacement="from lattice_brain.graph.store import KnowledgeGraphStore",
+        reason="The deprecated latticeai.brain namespace remains for package users.",
+        removal_phase="major-release-after-8.x",
+        layer="deprecated-namespace",
+    ),
+    LegacyShim(
+        path="latticeai/brain/ingest.py",
+        owner="lattice_brain.graph.ingest",
+        replacement="from lattice_brain.graph.ingest import KnowledgeGraphIngestMixin",
+        reason="The deprecated latticeai.brain namespace remains for package users.",
+        removal_phase="major-release-after-8.x",
+        layer="deprecated-namespace",
+    ),
+    LegacyShim(
+        path="latticeai/services/agent_runtime.py",
+        owner="lattice_brain.runtime.agent_runtime",
+        replacement="from lattice_brain.runtime.agent_runtime import AgentRuntime",
+        reason="Service-layer imports existed before AgentRuntime moved into Brain runtime.",
+        removal_phase="major-release-after-8.x",
+        layer="service-alias",
+    ),
+]
+
+
+def legacy_shim_report(root: Path | None = None) -> Dict[str, Any]:
+    if root is None:
+        root = Path(__file__).resolve().parents[2]
+    entries = [shim.as_dict() for shim in LEGACY_SHIMS]
+    missing = [shim.path for shim in LEGACY_SHIMS if not (root / shim.path).exists()]
+    phases = sorted({shim.removal_phase for shim in LEGACY_SHIMS})
+    layers = sorted({shim.layer for shim in LEGACY_SHIMS})
+    return {
+        "schema_version": "legacy-compatibility/v1",
+        "version_target": LEGACY_COMPATIBILITY_VERSION,
+        "status": "managed" if not missing else "incomplete",
+        "remaining_count": len(LEGACY_SHIMS),
+        "missing": missing,
+        "removal_phases": phases,
+        "layers": layers,
+        "shims": entries,
+    }
+
+
+__all__ = [
+    "LEGACY_COMPATIBILITY_VERSION",
+    "LEGACY_SHIMS",
+    "LegacyShim",
+    "legacy_shim_report",
+]

package/latticeai/core/marketplace.py

@@ -11,7 +11,7 @@ from copy import deepcopy
 from typing import Any, Dict, List, Optional
 
 
-MARKETPLACE_VERSION = "8.1.0"
+MARKETPLACE_VERSION = "8.3.0"
 TEMPLATE_KINDS = ("plugin", "workflow", "agent")
 
 

package/latticeai/core/tool_registry.py

@@ -9,6 +9,16 @@ effects at import time.
 
 from __future__ import annotations
 
+__all__ = [
+    "ToolPolicy",
+    "ToolPermission",
+    "TOOL_CATALOG_BRIEF",
+    "FILE_CREATE_ACTIONS",
+    "LOCAL_WRITE_BLOCKED_PREFIXES",
+    "RISK_LEVEL_MAP",
+    "ToolRegistry",
+]
+
 from dataclasses import dataclass, field
 from typing import Any, Callable, Dict, Mapping, Optional, TypedDict