ltcai 8.8.0 → 9.0.0

package/latticeai/services/process_audit.py

@@ -0,0 +1,208 @@
+"""Auditable command plans for installer and local process execution."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import time
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Optional, Sequence
+
+
+_SECRET_RE = re.compile(
+    r"(api[_-]?key|access[_-]?token|auth[_-]?token|bearer|client[_-]?secret|password|secret|token)",
+    re.IGNORECASE,
+)
+_SENSITIVE_FLAGS = {
+    "--api-key",
+    "--access-token",
+    "--auth-token",
+    "--client-secret",
+    "--password",
+    "--secret",
+    "--token",
+}
+
+
+class CommandConfirmationError(ValueError):
+    """Raised when a process command lacks the expected execution token."""
+
+
+def _default_audit_file() -> Path:
+    base = Path(os.environ.get("LATTICEAI_DATA_DIR") or Path.home() / ".ltcai")
+    return base / "process_audit.jsonl"
+
+
+def _normalize_command(command: Sequence[Any]) -> list[str]:
+    return [str(part) for part in command]
+
+
+def redact_command(command: Sequence[Any]) -> list[str]:
+    redacted: list[str] = []
+    redact_next = False
+    for raw in _normalize_command(command):
+        lower = raw.lower()
+        if redact_next:
+            redacted.append("[REDACTED]")
+            redact_next = False
+            continue
+        if lower in _SENSITIVE_FLAGS:
+            redacted.append(raw)
+            redact_next = True
+            continue
+        if "=" in raw:
+            key, _value = raw.split("=", 1)
+            if _SECRET_RE.search(key):
+                redacted.append(f"{key}=[REDACTED]")
+                continue
+        if _SECRET_RE.search(raw) and len(raw) > 32:
+            redacted.append("[REDACTED]")
+            continue
+        redacted.append(raw)
+    return redacted
+
+
+def _digest_payload(payload: Mapping[str, Any]) -> str:
+    encoded = json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+def command_hash(command: Sequence[Any], *, cwd: Optional[str] = None) -> str:
+    return _digest_payload({"command": _normalize_command(command), "cwd": cwd or ""})
+
+
+def confirmation_token(command: Sequence[Any], *, cwd: Optional[str] = None, purpose: str = "execute") -> str:
+    digest = _digest_payload(
+        {
+            "purpose": purpose,
+            "command": _normalize_command(command),
+            "cwd": cwd or "",
+        }
+    )
+    return digest[:16]
+
+
+def command_plan(
+    command: Sequence[Any],
+    *,
+    name: str,
+    purpose: str = "installer",
+    cwd: Optional[str] = None,
+    requires_admin: bool = False,
+    metadata: Optional[Mapping[str, Any]] = None,
+) -> dict[str, Any]:
+    return {
+        "name": name,
+        "purpose": purpose,
+        "command_preview": redact_command(command),
+        "command_hash": command_hash(command, cwd=cwd),
+        "confirmation_token": confirmation_token(command, cwd=cwd, purpose=purpose),
+        "requires_admin": bool(requires_admin),
+        "cwd": cwd,
+        "metadata": dict(metadata or {}),
+    }
+
+
+def command_plan_for_commands(
+    commands: Iterable[Sequence[Any]],
+    *,
+    name: str,
+    purpose: str = "installer",
+    cwd: Optional[str] = None,
+    metadata: Optional[Mapping[str, Any]] = None,
+) -> dict[str, Any]:
+    normalized = [_normalize_command(command) for command in commands]
+    digest = _digest_payload({"purpose": purpose, "commands": normalized, "cwd": cwd or ""})
+    return {
+        "name": name,
+        "purpose": purpose,
+        "command_count": len(normalized),
+        "command_hash": digest,
+        "confirmation_token": digest[:16],
+        "cwd": cwd,
+        "metadata": dict(metadata or {}),
+    }
+
+
+def verify_command_confirmation(
+    command: Sequence[Any],
+    provided_token: Optional[str],
+    *,
+    cwd: Optional[str] = None,
+    purpose: str = "installer",
+) -> bool:
+    if not provided_token:
+        return False
+    return str(provided_token).strip() == confirmation_token(command, cwd=cwd, purpose=purpose)
+
+
+def require_command_confirmation(
+    command: Sequence[Any],
+    provided_token: Optional[str],
+    *,
+    cwd: Optional[str] = None,
+    purpose: str = "installer",
+) -> None:
+    if not verify_command_confirmation(command, provided_token, cwd=cwd, purpose=purpose):
+        raise CommandConfirmationError("installer command requires a matching confirmation token")
+
+
+def _preview_text(text: Optional[str], *, limit: int = 500) -> Optional[str]:
+    if text is None:
+        return None
+    value = str(text)[-limit:]
+    value = re.sub(r"(?i)(api[_-]?key|access[_-]?token|auth[_-]?token|password|secret|token)=\S+", r"\1=[REDACTED]", value)
+    return value
+
+
+def _text_hash(text: Optional[str]) -> Optional[str]:
+    if text is None:
+        return None
+    return hashlib.sha256(str(text).encode("utf-8", errors="replace")).hexdigest()
+
+
+def append_process_audit_event(
+    event_type: str,
+    *,
+    plan: Mapping[str, Any],
+    status: str,
+    user_email: Optional[str] = None,
+    returncode: Optional[int] = None,
+    stdout: Optional[str] = None,
+    stderr: Optional[str] = None,
+    error: Optional[str] = None,
+    audit_file: Optional[Path] = None,
+    extra: Optional[Mapping[str, Any]] = None,
+) -> None:
+    path = audit_file or _default_audit_file()
+    entry = {
+        "ts": time.time(),
+        "event_type": event_type,
+        "status": status,
+        "user_email": user_email,
+        "plan": {
+            "name": plan.get("name"),
+            "purpose": plan.get("purpose"),
+            "command_preview": plan.get("command_preview"),
+            "command_hash": plan.get("command_hash"),
+            "requires_admin": plan.get("requires_admin"),
+            "cwd": plan.get("cwd"),
+            "metadata": plan.get("metadata") or {},
+        },
+        "returncode": returncode,
+        "stdout_hash": _text_hash(stdout),
+        "stderr_hash": _text_hash(stderr),
+        "stdout_preview": _preview_text(stdout),
+        "stderr_preview": _preview_text(stderr),
+        "error": _preview_text(error),
+        "extra": dict(extra or {}),
+    }
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        with path.open("a", encoding="utf-8") as fh:
+            fh.write(json.dumps(entry, ensure_ascii=False, sort_keys=True) + "\n")
+    except Exception:
+        # Auditing must never make setup recovery paths unusable.
+        return

package/latticeai/services/product_readiness.py

@@ -18,7 +18,7 @@ from typing import Any, Dict, List
 
 from latticeai.services.architecture_readiness import architecture_readiness
 
-PRODUCT_VERSION_TARGET = "8.8.0"
+PRODUCT_VERSION_TARGET = "9.0.0"
 
 
 @dataclass(frozen=True)
@@ -76,10 +76,10 @@ PRODUCT_GATES: List[ProductGate] = [
         evidence=[
             "package.json::release:artifacts",
             "package.json::release:validate",
-            "README.md::dist/ltcai-8.8.0-py3-none-any.whl",
-            "README.md::dist/ltcai-8.8.0.tar.gz",
-            "README.md::dist/ltcai-8.8.0.vsix",
-            "README.md::ltcai-8.8.0.tgz",
+            "README.md::dist/ltcai-9.0.0-py3-none-any.whl",
+            "README.md::dist/ltcai-9.0.0.tar.gz",
+            "README.md::dist/ltcai-9.0.0.vsix",
+            "README.md::ltcai-9.0.0.tgz",
             "scripts/validate_release_artifacts.py",
             "scripts/release_smoke.py",
             "Dockerfile",
@@ -95,12 +95,12 @@ PRODUCT_GATES: List[ProductGate] = [
         title="Release story is documented and honest",
         evidence=[
             "README.md",
-            "README.md::The current release is **8.8.0",
-            "SECURITY.md::8.8.x (latest)",
-            "vscode-extension/README.md::**8.8.0",
-            "docs/CHANGELOG.md::## [8.8.0]",
+            "README.md::The current release is **9.0.0",
+            "SECURITY.md::9.0.x (latest)",
+            "vscode-extension/README.md::**9.0.0",
+            "docs/CHANGELOG.md::## [9.0.0]",
             "FEATURE_STATUS.md",
-            "RELEASE_NOTES_v8.8.0.md",
+            "RELEASE_NOTES_v9.0.0.md",
             "latticeai/core/agent.py::SingleAgentRuntime",
             "latticeai/core/agent.py::AgentRuntime = SingleAgentRuntime",
             "lattice_brain/runtime/contracts.py::runtime-boundary/v1",
@@ -115,7 +115,7 @@ PRODUCT_GATES: List[ProductGate] = [
         id="ecosystem-path",
         title="Community and plugin growth path is explicit",
         evidence=[
-            "docs/COMMUNITY_AND_PLUGINS.md::8.8.0",
+            "docs/COMMUNITY_AND_PLUGINS.md::9.0.0",
             "docs/PLUGIN_SDK.md",
             "plugins/README.md",
             "plugins/hello-world/plugin.json",

package/latticeai/services/review_queue.py

@@ -21,12 +21,14 @@ from __future__ import annotations
 from datetime import datetime
 from typing import Any, Callable, Dict, Optional
 
+from latticeai.core.io_utils import parse_iso as _parse_iso
+
 # status: terminal vs. open. Open items can still be acted on.
 OPEN_STATUSES = {"pending", "snoozed"}
 TERMINAL_STATUSES = {"approved", "dismissed"}
 ALL_STATUSES = OPEN_STATUSES | TERMINAL_STATUSES
 
-REVIEW_SOURCES = frozenset({"workflow_run", "trigger", "kg_change_digest"})
+REVIEW_SOURCES = frozenset({"workflow_run", "trigger", "kg_change_digest", "chat_followup", "agent_followup"})
 
 # Which source statuses each action is allowed from.
 _ALLOWED_FROM: Dict[str, set] = {
@@ -59,15 +61,6 @@ class InvalidReviewTransition(Exception):
         super().__init__(f"cannot {action!r} a review item in status {status!r}")
 
 
-def _parse_iso(value: Optional[str]) -> Optional[datetime]:
-    if not value:
-        return None
-    try:
-        return datetime.fromisoformat(str(value))
-    except (TypeError, ValueError):
-        return None
-
-
 class ReviewQueueService:
     """Policy layer over the store's workspace-scoped ``review_items``."""
 
@@ -122,7 +115,20 @@ class ReviewQueueService:
 
     # ── transitions ──────────────────────────────────────────────────────
     def approve(self, item_id: str, *, workspace_id: Optional[str] = None) -> Dict[str, Any]:
-        return self._transition(item_id, "approve", "approved", workspace_id=workspace_id)
+        item = self._store.get_review_item(item_id, workspace_id=workspace_id)
+        self._guard("approve", item)
+        payload = dict(item.get("payload") or {})
+        provenance = dict(item.get("provenance") or {})
+        promoted = self._promote_agent_followup(item, workspace_id=workspace_id)
+        if promoted:
+            payload["promoted_workflow_id"] = promoted.get("id")
+            provenance["workflow_id"] = promoted.get("id")
+            provenance["promotion"] = "workflow_draft"
+        patch: Dict[str, Any] = {"status": "approved", "payload": payload, "provenance": provenance}
+        if item.get("snoozed_until") is not None:
+            patch["snoozed_until"] = None
+        updated = self._store.update_review_item(item_id, workspace_id=workspace_id, **patch)
+        return self._view(updated)
 
     def dismiss(self, item_id: str, *, workspace_id: Optional[str] = None) -> Dict[str, Any]:
         return self._transition(item_id, "dismiss", "dismissed", workspace_id=workspace_id)
@@ -210,6 +216,53 @@ class ReviewQueueService:
         view["effective_status"] = self._effective_status(item)
         return view
 
+    def _promote_agent_followup(self, item: Dict[str, Any], *, workspace_id: Optional[str]) -> Optional[Dict[str, Any]]:
+        if item.get("source") != "agent_followup" or not hasattr(self._store, "create_workflow"):
+            return None
+        payload = dict(item.get("payload") or {})
+        followup = str(payload.get("followup") or item.get("title") or "").strip()
+        if not followup:
+            return None
+        goal = str(payload.get("goal") or item.get("summary") or followup).strip()
+        nodes = [
+            {
+                "id": "trigger",
+                "type": "trigger",
+                "config": {"trigger": "manual", "review_queue": False},
+                "next": "agent",
+            },
+            {
+                "id": "agent",
+                "type": "agent",
+                "config": {
+                    "goal": followup,
+                    "roles": ["planner", "executor", "reviewer"],
+                    "source": "agent_followup",
+                },
+                "next": "output",
+            },
+            {
+                "id": "output",
+                "type": "output",
+                "config": {"format": "review_followup"},
+                "next": None,
+            },
+        ]
+        return self._store.create_workflow(
+            name=f"Follow-up: {str(item.get('title') or followup)[:96]}",
+            steps=[{"action": "agent", "goal": followup}],
+            nodes=nodes,
+            metadata={
+                "source": "review_center",
+                "review_item_id": item.get("id"),
+                "agent_followup": followup,
+                "goal": goal,
+                "draft": True,
+            },
+            user_email=item.get("user_email"),
+            workspace_id=workspace_id or item.get("workspace_id"),
+        )
+
 
 def enqueue_from_automation(
     sink: "ReviewQueueService",

package/latticeai/services/run_executor.py

@@ -129,6 +129,27 @@ class RunExecutor:
                 self._cancel_agent_record(run_id, handle.scope, "cancelled after the final result was persisted")
             else:
                 self._results[run_id] = payload
+        except Exception as exc:
+            try:
+                run = self.store.get_agent_run(run_id, workspace_id=handle.scope)
+                timeline = list(run.get("timeline") or [])
+                timeline.append({"event": "execution_failed", "status": "failed", "detail": str(exc), "timestamp": _now()})
+                failed = self.store.update_agent_run(
+                    run_id,
+                    workspace_id=handle.scope,
+                    status="failed",
+                    current_role=None,
+                    output_text=str(exc),
+                    timeline=timeline,
+                    graph=self.workspace_graph(),
+                )
+                self._results[run_id] = {"run": failed, "result": {"status": "failed", "error": str(exc)}}
+            except Exception:
+                self._results[run_id] = {"run": {"id": run_id, "status": "failed"}, "result": {"status": "failed", "error": str(exc)}}
+            try:
+                self.append_audit_event("agent_run_failed", user_email=user_email, run_id=run_id, error=str(exc))
+            except Exception:
+                pass
         finally:
             self._handles.pop(run_id, None)
 

package/latticeai/services/search_service.py

@@ -42,9 +42,84 @@ class SearchService:
         graph = self._require_graph()
         return graph.filter_scoped_nodes(matches, allowed_workspaces)
 
+    def _graph_search(self, graph, query: str, *, limit: int, allowed_workspaces=None):
+        try:
+            return graph.search(query, limit, allowed_workspaces=allowed_workspaces)
+        except TypeError:
+            payload = graph.search(query, limit)
+            if allowed_workspaces is not None:
+                payload = {
+                    **payload,
+                    "matches": graph.filter_scoped_nodes(
+                        payload.get("matches", []),
+                        allowed_workspaces,
+                    ),
+                }
+            return payload
+
+    def _relationship_search(self, graph, *, allowed_workspaces=None, **kwargs):
+        try:
+            return graph.relationship_search(
+                **kwargs,
+                allowed_workspaces=allowed_workspaces,
+            )
+        except TypeError:
+            payload = graph.relationship_search(**kwargs)
+            if allowed_workspaces is not None:
+                kept = []
+                for rel in payload.get("relationships", []):
+                    endpoints = [
+                        {"id": (rel.get("source") or {}).get("id")},
+                        {"id": (rel.get("target") or {}).get("id")},
+                    ]
+                    if len(graph.filter_scoped_nodes(endpoints, allowed_workspaces)) == 2:
+                        kept.append(rel)
+                payload = {**payload, "relationships": kept}
+            return payload
+
+    def _traverse(self, graph, node_id: str, *, depth: int, limit: int, allowed_workspaces=None):
+        try:
+            return graph.traverse(
+                node_id,
+                depth=depth,
+                limit=limit,
+                allowed_workspaces=allowed_workspaces,
+            )
+        except TypeError:
+            neighborhood = graph.traverse(node_id, depth=depth, limit=limit)
+            if allowed_workspaces is not None:
+                nodes = graph.filter_scoped_nodes(
+                    neighborhood.get("nodes", []),
+                    allowed_workspaces,
+                )
+                kept = {item.get("id") for item in nodes}
+                edges = [
+                    edge for edge in neighborhood.get("edges", [])
+                    if edge.get("from") in kept and edge.get("to") in kept
+                ]
+                neighborhood = {**neighborhood, "nodes": nodes, "edges": edges}
+            return neighborhood
+
+    def _get_node(self, graph, node_id: str, *, allowed_workspaces=None):
+        try:
+            return graph.get_node(node_id, allowed_workspaces=allowed_workspaces)
+        except TypeError:
+            node = graph.get_node(node_id)
+            if allowed_workspaces is not None:
+                visible = graph.filter_scoped_nodes([node], allowed_workspaces)
+                if not visible:
+                    raise ValueError(f"graph node not found: {node_id}")
+                return visible[0]
+            return node
+
     def keyword_search(self, query: str, *, limit: int = 30, allowed_workspaces=None) -> Dict[str, Any]:
         graph = self._require_graph()
-        payload = graph.search(query, limit)
+        payload = self._graph_search(
+            graph,
+            query,
+            limit=limit,
+            allowed_workspaces=allowed_workspaces,
+        )
         matches = []
         for rank, match in enumerate(payload.get("matches", []), start=1):
             matches.append({
@@ -95,8 +170,18 @@ class SearchService:
         graph = self._require_graph()
         limit = max(1, min(int(limit or 30), 100))
         expand_depth = max(0, min(int(expand_depth or 1), 3))
-        direct = graph.search(query, limit=max(limit, 10)).get("matches", [])
-        relationships = graph.relationship_search(query=query, limit=limit).get("relationships", [])
+        direct = self._graph_search(
+            graph,
+            query,
+            limit=max(limit, 10),
+            allowed_workspaces=allowed_workspaces,
+        ).get("matches", [])
+        relationships = self._relationship_search(
+            graph,
+            query=query,
+            limit=limit,
+            allowed_workspaces=allowed_workspaces,
+        ).get("relationships", [])
         by_id: Dict[str, Dict[str, Any]] = {}
 
         def add_node(node: Mapping[str, Any], score: float, reason: str, edge: Optional[Mapping[str, Any]] = None) -> None:
@@ -138,7 +223,13 @@ class SearchService:
             if expand_depth <= 0:
                 continue
             try:
-                neighborhood = graph.traverse(match["id"], depth=expand_depth, limit=limit * 3)
+                neighborhood = self._traverse(
+                    graph,
+                    match["id"],
+                    depth=expand_depth,
+                    limit=limit * 3,
+                    allowed_workspaces=allowed_workspaces,
+                )
             except Exception:
                 neighborhood = {"nodes": [], "edges": []}
             edge_by_pair = {
@@ -262,23 +353,16 @@ class SearchService:
         allowed_workspaces=None,
     ) -> Dict[str, Any]:
         graph = self._require_graph()
-        node = graph.get_node(node_id)
-        if allowed_workspaces is not None:
-            visible = graph.filter_scoped_nodes([node], allowed_workspaces)
-            if not visible:
-                raise ValueError(f"graph node not found: {node_id}")
-            node = visible[0]
+        node = self._get_node(graph, node_id, allowed_workspaces=allowed_workspaces)
         payload = {"node": node}
         if include_neighbors:
-            neighborhood = graph.traverse(node_id, depth=depth, limit=limit)
-            if allowed_workspaces is not None:
-                nodes = graph.filter_scoped_nodes(neighborhood.get("nodes", []), allowed_workspaces)
-                kept = {item.get("id") for item in nodes}
-                edges = [
-                    edge for edge in neighborhood.get("edges", [])
-                    if edge.get("from") in kept and edge.get("to") in kept
-                ]
-                neighborhood = {**neighborhood, "nodes": nodes, "edges": edges}
+            neighborhood = self._traverse(
+                graph,
+                node_id,
+                depth=depth,
+                limit=limit,
+                allowed_workspaces=allowed_workspaces,
+            )
             payload["neighborhood"] = neighborhood
         return payload
 
@@ -292,22 +376,14 @@ class SearchService:
         allowed_workspaces=None,
     ) -> Dict[str, Any]:
         graph = self._require_graph()
-        payload = graph.relationship_search(
+        payload = self._relationship_search(
+            graph,
             query=query,
             node_id=node_id,
             relationship_type=relationship_type,
             limit=limit,
+            allowed_workspaces=allowed_workspaces,
         )
-        if allowed_workspaces is not None:
-            kept = []
-            for rel in payload.get("relationships", []):
-                endpoints = [
-                    {"id": (rel.get("source") or {}).get("id")},
-                    {"id": (rel.get("target") or {}).get("id")},
-                ]
-                if len(graph.filter_scoped_nodes(endpoints, allowed_workspaces)) == 2:
-                    kept.append(rel)
-            payload = {**payload, "relationships": kept}
         return payload
 
     def index_status(self) -> Dict[str, Any]:

package/latticeai/services/setup_detection.py

@@ -0,0 +1,80 @@
+"""Shared setup/environment detection helpers."""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
+
+
+WhichFn = Callable[[str], Optional[str]]
+RunFn = Callable[[List[str]], str]
+
+
+def parse_windows_video_controllers(raw: str) -> List[Dict[str, Any]]:
+    controllers: List[Dict[str, Any]] = []
+    if not raw:
+        return controllers
+    try:
+        data = json.loads(raw)
+        if isinstance(data, dict):
+            data = [data]
+        if isinstance(data, list):
+            for item in data:
+                name = str(item.get("Name") or "").strip()
+                if not name:
+                    continue
+                try:
+                    ram_mb = int(item.get("AdapterRAM") or 0) // (1024 * 1024)
+                except Exception:
+                    ram_mb = 0
+                controllers.append({"name": name, "vram_mb": ram_mb})
+        if controllers:
+            return controllers
+    except Exception:
+        pass
+    current: Dict[str, Any] = {}
+    for line in raw.splitlines():
+        if line.startswith("Name="):
+            if current:
+                controllers.append(current)
+            current = {"name": line.split("=", 1)[-1].strip(), "vram_mb": 0}
+        elif line.startswith("AdapterRAM=") and current:
+            try:
+                current["vram_mb"] = int(line.split("=", 1)[-1].strip()) // (1024 * 1024)
+            except ValueError:
+                current["vram_mb"] = 0
+    if current:
+        controllers.append(current)
+    return controllers
+
+
+def detect_cuda(which: WhichFn, run: RunFn) -> Tuple[bool, str, Optional[str], Optional[str]]:
+    nvidia_smi = which("nvidia-smi")
+    nvcc = which("nvcc")
+    version = ""
+    if nvidia_smi:
+        raw = run([nvidia_smi, "--query-gpu=driver_version", "--format=csv,noheader"])
+        version = raw.splitlines()[0].strip() if raw.splitlines() else ""
+    if nvcc:
+        raw = run([nvcc, "--version"])
+        match = re.search(r"release\s+([\d.]+)", raw)
+        if match:
+            version = match.group(1)
+    return bool(nvidia_smi or nvcc), version, nvidia_smi, nvcc
+
+
+def detect_wsl_from_text(prof_os: str, raw: str) -> Tuple[bool, str]:
+    if prof_os.lower() != "linux":
+        return False, ""
+    lowered = (raw or "").lower()
+    is_wsl = "microsoft" in lowered or "wsl" in lowered
+    version = "2" if "microsoft-standard" in lowered or "wsl2" in lowered else ("1" if is_wsl else "")
+    return is_wsl, version
+
+
+def detect_tools(which: WhichFn, binaries: Iterable[str]) -> Dict[str, Optional[str]]:
+    return {binary: which(binary) for binary in binaries}
+
+
+__all__ = ["detect_cuda", "detect_tools", "detect_wsl_from_text", "parse_windows_video_controllers"]