ltcai 8.8.0 → 9.0.0

package/latticeai/services/tool_dispatch.py

@@ -107,6 +107,53 @@ class ToolDispatchService:
                 detail=f"'{tool_name}' 툴은 관리자 전용입니다.",
             )
 
+    def user_role(self, current_user: str) -> str:
+        users = self.load_users()
+        try:
+            return str(self.get_user_role(current_user, users) or "user")
+        except Exception:
+            return "user"
+
+    def enforce_policy(
+        self,
+        tool_name: str,
+        args: Optional[dict],
+        *,
+        current_user: str,
+        source: str,
+        require_auto_approval: bool = True,
+        trusted_admin: bool = False,
+    ) -> ToolPolicy:
+        """Authorize a tool call before any hook or handler can execute.
+
+        This is the shared policy gate for direct HTTP/MCP/tool surfaces. Agent
+        runtime uses the same policy data and blocks non-auto-approved steps in
+        its state machine so Computer Use direct endpoints can remain unchanged
+        when explicitly excluded from a hardening pass.
+        """
+        policy = self.policy_for(tool_name, args or {})
+        if not trusted_admin:
+            self.check_role(tool_name, current_user)
+        if policy["destructive"] or policy["risk"] == "destructive":
+            raise HTTPException(
+                status_code=403,
+                detail=f"'{tool_name}' 툴은 파괴적 작업으로 차단되었습니다.",
+            )
+        if (
+            require_auto_approval
+            and not trusted_admin
+            and not policy["auto_approve"]
+            and self.user_role(current_user) != "admin"
+        ):
+            raise HTTPException(
+                status_code=403,
+                detail=(
+                    f"'{tool_name}' 툴은 명시 승인이 필요합니다. "
+                    "9.0.0에서는 승인 UI가 없는 직접 실행 경로에서 기본 차단됩니다."
+                ),
+            )
+        return policy
+
     def rollback_file(self, path: str) -> Dict[str, Any]:
         r = subprocess.run(
             ["git", "checkout", "--", path],
@@ -160,6 +207,25 @@ def check_tool_role(tool_name: str, current_user: str) -> None:
     DEFAULT_TOOL_DISPATCH_SERVICE.check_role(tool_name, current_user)
 
 
+def enforce_tool_policy(
+    tool_name: str,
+    args: Optional[dict],
+    *,
+    current_user: str,
+    source: str,
+    require_auto_approval: bool = True,
+    trusted_admin: bool = False,
+) -> ToolPolicy:
+    return DEFAULT_TOOL_DISPATCH_SERVICE.enforce_policy(
+        tool_name,
+        args or {},
+        current_user=current_user,
+        source=source,
+        require_auto_approval=require_auto_approval,
+        trusted_admin=trusted_admin,
+    )
+
+
 def collect_created_files(transcript: list) -> list:
     files = []
     for step in transcript:

package/latticeai/services/workspace_service.py

@@ -79,6 +79,21 @@ class WorkspaceService:
     def can_write(self, workspace_id: str, user_id: Optional[str]) -> bool:
         return self.store.has_permission(workspace_id, self._identity(user_id), "write")
 
+    def readable_workspaces(self, user_id: Optional[str]) -> list[str]:
+        """Return workspace ids the caller can read.
+
+        This keeps scoped read APIs from each reconstructing membership logic
+        from raw workspace state. The personal workspace remains readable via
+        the store's normal permission rules.
+        """
+        resolved_user = self._identity(user_id)
+        workspaces = (self.store.load_state().get("workspaces") or {})
+        return [
+            str(workspace_id)
+            for workspace_id in workspaces
+            if self.store.has_permission(str(workspace_id), resolved_user, "read")
+        ]
+
     # ── record-level authorization (by-id access must not bypass gating) ──
 
     def authorize_record_read(self, record: Dict[str, Any], user_id: Optional[str]) -> None:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "8.8.0",
+  "version": "9.0.0",
   "description": "Lattice AI — local-first Digital Brain that keeps your knowledge durable across any AI model.",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {

package/scripts/check_i18n_literals.mjs

@@ -4,10 +4,12 @@ import { join, relative } from "node:path";
 
 const repo = join(import.meta.dirname, "..");
 const roots = [
-  join(repo, "frontend", "src", "features", "brain"),
-  join(repo, "frontend", "src", "features", "admin"),
-  join(repo, "frontend", "src", "components", "onboarding"),
+  join(repo, "frontend", "src"),
 ];
+const allowlistPath = join(repo, "scripts", "i18n_literal_allowlist.json");
+const allowlist = existsSync(allowlistPath)
+  ? JSON.parse(readFileSync(allowlistPath, "utf8"))
+  : {};
 
 function walk(dir) {
   if (!existsSync(dir)) return [];
@@ -16,7 +18,9 @@ function walk(dir) {
     const path = join(dir, name);
     const stat = statSync(path);
     if (stat.isDirectory()) out.push(...walk(path));
-    else if (name.endsWith(".tsx")) out.push(path);
+    else if ((name.endsWith(".tsx") || name.endsWith(".ts")) && name !== "openapi.ts") {
+      out.push(path);
+    }
   }
   return out;
 }
@@ -25,6 +29,7 @@ const rawLocalizedProps = /\b(?:aria-label|placeholder|title)=["'][^"'{]*[A-Za-z
 const rawJsxText = />\s*([A-Z][A-Za-z0-9][^<>{}\n]{2,})\s*</g;
 const rawComponentCopy = /\b(?:title|detail|description|successLabel|empty)=["'][^"'{]*[A-Za-z][^"']*["']/g;
 let failures = 0;
+let allowed = 0;
 
 for (const file of roots.flatMap(walk)) {
   const text = readFileSync(file, "utf8");
@@ -38,9 +43,16 @@ for (const file of roots.flatMap(walk)) {
     matches.push(`JSX text: ${literal}`);
   }
   if (!matches.length) continue;
-  failures += matches.length;
-  for (const match of matches) {
-    console.error(`${relative(repo, file)}: hardcoded localized prop: ${match}`);
+  const rel = relative(repo, file);
+  const budget = Number(allowlist[rel]?.maxFindings || 0);
+  if (budget >= matches.length) {
+    allowed += matches.length;
+    continue;
+  }
+  const newMatches = matches.slice(budget);
+  failures += newMatches.length;
+  for (const match of newMatches) {
+    console.error(`${rel}: hardcoded localized prop: ${match}`);
   }
 }
 
@@ -49,4 +61,4 @@ if (failures) {
   process.exit(1);
 }
 
-console.log("i18n literal check: localized props use translation keys");
+console.log(`i18n literal check: localized props use translation keys (${allowed} allowlisted legacy literal(s))`);

package/scripts/i18n_literal_allowlist.json

@@ -0,0 +1,34 @@
+{
+  "frontend/src/App.tsx": {
+    "maxFindings": 1,
+    "reason": "legacy shell aria label pending translation-key migration"
+  },
+  "frontend/src/components/LivingBrain.tsx": {
+    "maxFindings": 1,
+    "reason": "legacy visual component aria label pending translation-key migration"
+  },
+  "frontend/src/components/primitives.tsx": {
+    "maxFindings": 1,
+    "reason": "shared empty-state fallback pending translation-key migration"
+  },
+  "frontend/src/pages/Act.tsx": {
+    "maxFindings": 41,
+    "reason": "large legacy automation page pending incremental copy migration"
+  },
+  "frontend/src/pages/Brain.tsx": {
+    "maxFindings": 25,
+    "reason": "large legacy memory page pending incremental copy migration"
+  },
+  "frontend/src/pages/Capture.tsx": {
+    "maxFindings": 2,
+    "reason": "technical type-name literals are intentionally preserved for now"
+  },
+  "frontend/src/pages/Library.tsx": {
+    "maxFindings": 21,
+    "reason": "large legacy model/plugin page pending incremental copy migration"
+  },
+  "frontend/src/pages/System.tsx": {
+    "maxFindings": 118,
+    "reason": "large legacy system/admin page pending incremental copy migration"
+  }
+}

package/scripts/lint_frontend.mjs

@@ -52,8 +52,12 @@ for (const file of files) {
 console.log(`privacy: ${scanned} frontend/static files scanned`);
 
 const client = readFileSync(join(frontend, "src", "api", "client.ts"), "utf8");
-if (!client.includes("openapi-fetch") || !client.includes("./openapi")) {
-  fail("frontend/src/api/client.ts must use the generated OpenAPI client");
+const apiBase = readFileSync(join(frontend, "src", "api", "base.ts"), "utf8");
+if (
+  !(client.includes("openapi-fetch") || apiBase.includes("openapi-fetch")) ||
+  !(client.includes("./openapi") || apiBase.includes("./openapi"))
+) {
+  fail("frontend/src/api/client.ts or base.ts must use the generated OpenAPI client");
 }
 if (!existsSync(join(frontend, "src", "api", "openapi.ts"))) {
   fail("generated OpenAPI types missing");

package/setup_wizard.py

@@ -21,6 +21,20 @@ import time
 from pathlib import Path
 from typing import Any, AsyncIterator, Dict, List, Tuple
 
+from latticeai.services.process_audit import (
+    CommandConfirmationError,
+    append_process_audit_event,
+    command_plan,
+    command_plan_for_commands,
+    require_command_confirmation,
+)
+from latticeai.services.setup_detection import (
+    detect_cuda,
+    detect_tools,
+    detect_wsl_from_text,
+    parse_windows_video_controllers as _parse_windows_video_controllers,
+)
+
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
 def _cmd(args: List[str], timeout: int = 10) -> str:
@@ -33,6 +47,61 @@ def _cmd(args: List[str], timeout: int = 10) -> str:
 def _sse(data: Dict) -> str:
     return f"data: {_json.dumps(data, ensure_ascii=False)}\n\n"
 
+
+def _action_commands(action: Dict[str, Any]) -> List[List[str]]:
+    atype = action.get("type")
+    if atype == "pip":
+        return [[sys.executable, "-m", "pip", "install", "--upgrade", str(pkg)] for pkg in action.get("packages", [])]
+    if atype == "brew":
+        package = str(action.get("package") or "")
+        return [["brew", "install", package]] if package else []
+    return []
+
+
+def _action_command_plan(action: Dict[str, Any], *, name: str) -> Dict[str, Any] | None:
+    commands = _action_commands(action)
+    if not commands:
+        return None
+    return command_plan_for_commands(
+        commands,
+        name=name,
+        purpose="setup_wizard_install",
+        metadata={"action_type": action.get("type")},
+    )
+
+
+def _attach_action_plan(action: Dict[str, Any] | None, *, name: str) -> Dict[str, Any] | None:
+    if not isinstance(action, dict):
+        return action
+    plan = _action_command_plan(action, name=name)
+    if not plan:
+        return action
+    hydrated = dict(action)
+    hydrated["command_plan"] = plan
+    hydrated["confirmation_token"] = plan["confirmation_token"]
+    return hydrated
+
+
+def _hydrate_install_actions(groups: Dict[str, Any]) -> Dict[str, Any]:
+    for group_name in ("components", "engines", "models", "mcps"):
+        items = groups.get(group_name)
+        if not isinstance(items, list):
+            continue
+        for item in items:
+            if isinstance(item, dict):
+                item["action"] = _attach_action_plan(
+                    item.get("action"),
+                    name=str(item.get("id") or item.get("name") or group_name),
+                )
+    return groups
+
+
+def _verify_action_confirmation(action: Dict[str, Any], token: str | None, *, name: str) -> bool:
+    plan = _action_command_plan(action, name=name)
+    if not plan:
+        return True
+    return str(token or "").strip() == plan["confirmation_token"]
+
 OFFICIAL_DOWNLOADS: Dict[str, str] = {
     "homebrew": "https://brew.sh",
     "python": "https://www.python.org/downloads/",
@@ -348,43 +417,6 @@ def _detect_disk_free_gb() -> float:
         return 0.0
 
 
-def _parse_windows_video_controllers(raw: str) -> List[Dict[str, Any]]:
-    controllers: List[Dict[str, Any]] = []
-    if not raw:
-        return controllers
-    try:
-        data = _json.loads(raw)
-        if isinstance(data, dict):
-            data = [data]
-        if isinstance(data, list):
-            for item in data:
-                name = str(item.get("Name") or "").strip()
-                try:
-                    ram_mb = int(item.get("AdapterRAM") or 0) // (1024 * 1024)
-                except Exception:
-                    ram_mb = 0
-                if name:
-                    controllers.append({"name": name, "vram_mb": ram_mb})
-        if controllers:
-            return controllers
-    except Exception:
-        pass
-    current: Dict[str, Any] = {}
-    for line in raw.splitlines():
-        if line.startswith("Name="):
-            if current:
-                controllers.append(current)
-            current = {"name": line.split("=", 1)[-1].strip(), "vram_mb": 0}
-        elif line.startswith("AdapterRAM=") and current:
-            try:
-                current["vram_mb"] = int(line.split("=", 1)[-1].strip()) // (1024 * 1024)
-            except ValueError:
-                current["vram_mb"] = 0
-    if current:
-        controllers.append(current)
-    return controllers
-
-
 def _detect_gpu() -> Dict[str, Any]:
     devices: List[Dict[str, Any]] = []
     nvidia_smi = _which_any("nvidia-smi")
@@ -451,37 +483,24 @@ def _detect_gpu() -> Dict[str, Any]:
 
 
 def _detect_cuda() -> Dict[str, Any]:
-    nvidia_smi = _which_any("nvidia-smi")
-    nvcc = _which_any("nvcc")
-    version = ""
-    if nvidia_smi:
-        raw = _cmd([nvidia_smi, "--query-gpu=driver_version", "--format=csv,noheader"], timeout=5)
-        version = raw.splitlines()[0].strip() if raw.splitlines() else ""
-    if nvcc:
-        raw = _cmd([nvcc, "--version"], timeout=5)
-        m = re.search(r"release\s+([\d.]+)", raw)
-        if m:
-            version = m.group(1)
-    return {"available": bool(nvidia_smi or nvcc), "nvidia_smi": nvidia_smi, "nvcc": nvcc, "version": version}
+    available, version, nvidia_smi, nvcc = detect_cuda(_which_any, lambda args: _cmd(args, timeout=5))
+    return {"available": available, "nvidia_smi": nvidia_smi, "nvcc": nvcc, "version": version}
 
 
 def _detect_wsl() -> Dict[str, Any]:
-    if platform.system() != "Linux":
-        return {"is_wsl": False, "version": ""}
     raw = ""
     try:
         raw = Path("/proc/version").read_text(encoding="utf-8", errors="replace")
     except Exception:
         pass
-    is_wsl = "microsoft" in raw.lower() or "wsl" in raw.lower()
-    version = "2" if "microsoft-standard" in raw.lower() or "wsl2" in raw.lower() else ("1" if is_wsl else "")
+    is_wsl, version = detect_wsl_from_text(platform.system().lower(), raw)
     return {"is_wsl": is_wsl, "version": version}
 
 
 def _detect_tools() -> Dict[str, bool]:
     repair_path_for()
-    return {t: _which_any(t) is not None
-            for t in ["brew", "ollama", "python3", "python", "node", "npm", "git", "tesseract", "lms", "nvidia-smi", "nvcc"]}
+    detected = detect_tools(_which_any, ["brew", "ollama", "python3", "python", "node", "npm", "git", "tesseract", "lms", "nvidia-smi", "nvcc"])
+    return {tool: path is not None for tool, path in detected.items()}
 
 def _detect_mlx() -> Dict[str, Any]:
     return {
@@ -933,7 +952,7 @@ def get_recommendations(env: Dict[str, Any]) -> Dict[str, Any]:
         },
     ]
 
-    return {
+    return _hydrate_install_actions({
         "components": components,
         "engines": engines,
         "models":  models,
@@ -954,7 +973,7 @@ def get_recommendations(env: Dict[str, Any]) -> Dict[str, Any]:
             "is_apple_silicon": is_apple,
             "max_model_gb":    round(max_model_gb, 1),
         },
-    }
+    })
 
 # ── Installation Stream ───────────────────────────────────────────────────────
 
@@ -972,7 +991,12 @@ def _verify_action(action: Dict[str, Any]) -> Tuple[bool, str]:
     return True, "검증 항목 없음"
 
 
-async def _repair_action(action: Dict[str, Any]) -> Tuple[bool, str]:
+async def _repair_action(
+    action: Dict[str, Any],
+    *,
+    confirmation_token: str | None = None,
+    actor: str | None = None,
+) -> Tuple[bool, str]:
     binary = action.get("binary")
     if binary:
         repair_path_for(binary)
@@ -982,15 +1006,23 @@ async def _repair_action(action: Dict[str, Any]) -> Tuple[bool, str]:
     if action.get("type") == "pip":
         packages = action.get("packages", [])
         if packages:
+            if not _verify_action_confirmation(action, confirmation_token, name="repair_action"):
+                return False, "설치 명령 확인 토큰이 일치하지 않습니다."
             for pkg in packages:
-                success, err = await _pip_install(pkg)
+                success, err = await _pip_install(pkg, confirmed=True, actor=actor)
                 if not success:
                     return False, err
             return _verify_action(action)
     return False, "자동 복구 방법을 찾지 못했습니다."
 
 
-async def install_stream(items: List[Dict], router: Any) -> AsyncIterator[str]:
+async def install_stream(
+    items: List[Dict],
+    router: Any,
+    *,
+    confirmation_token: str | None = None,
+    user_email: str | None = None,
+) -> AsyncIterator[str]:
     for item in items:
         item_id    = item.get("id", "unknown")
         name       = item.get("name", item_id)
@@ -1006,10 +1038,14 @@ async def install_stream(items: List[Dict], router: Any) -> AsyncIterator[str]:
 
         if atype == "pip":
             packages = action.get("packages", [])
+            token = confirmation_token or action.get("confirmation_token") or (action.get("command_plan") or {}).get("confirmation_token")
+            if not _verify_action_confirmation(action, token, name=str(item_id)):
+                yield _sse({"id": item_id, "status": "error", "msg": "설치 명령 확인 토큰이 일치하지 않습니다."})
+                continue
             ok = True
             for pkg in packages:
                 yield _sse({"id": item_id, "status": "running", "msg": f"pip install {pkg} ..."})
-                success, err = await _pip_install(pkg)
+                success, err = await _pip_install(pkg, confirmed=True, actor=user_email)
                 if success:
                     yield _sse({"id": item_id, "status": "progress", "msg": f"{pkg} 설치 완료"})
                 else:
@@ -1023,13 +1059,17 @@ async def install_stream(items: List[Dict], router: Any) -> AsyncIterator[str]:
                     yield _sse({"id": item_id, "status": "done", "msg": f"{name} 설치 · 검증 완료 ✅\n{detail}"})
                 else:
                     yield _sse({"id": item_id, "status": "running", "msg": f"검증 실패 — 자동 복구 중...\n{detail}"})
-                    repaired, repair_msg = await _repair_action(action)
+                    repaired, repair_msg = await _repair_action(action, confirmation_token=token, actor=user_email)
                     yield _sse({"id": item_id, "status": "done" if repaired else "error", "msg": repair_msg[:500]})
 
         elif atype == "brew":
             pkg = action.get("package", "")
+            token = confirmation_token or action.get("confirmation_token") or (action.get("command_plan") or {}).get("confirmation_token")
+            if not _verify_action_confirmation(action, token, name=str(item_id)):
+                yield _sse({"id": item_id, "status": "error", "msg": "설치 명령 확인 토큰이 일치하지 않습니다."})
+                continue
             yield _sse({"id": item_id, "status": "running", "msg": f"brew install {pkg} ..."})
-            success, err = await _brew_install(pkg)
+            success, err = await _brew_install(pkg, confirmed=True, actor=user_email)
             if success:
                 yield _sse({"id": item_id, "status": "running", "msg": "설치 완료 감지 · PATH 보정 중..."})
                 binary = action.get("binary")
@@ -1040,7 +1080,7 @@ async def install_stream(items: List[Dict], router: Any) -> AsyncIterator[str]:
                     yield _sse({"id": item_id, "status": "done", "msg": f"{name} 설치 · 연결 · 검증 완료 ✅\n{detail}"})
                 else:
                     yield _sse({"id": item_id, "status": "running", "msg": f"검증 실패 — 자동 복구 중...\n{detail}"})
-                    repaired, repair_msg = await _repair_action(action)
+                    repaired, repair_msg = await _repair_action(action, confirmation_token=token, actor=user_email)
                     yield _sse({"id": item_id, "status": "done" if repaired else "error", "msg": repair_msg[:500]})
             else:
                 url = action.get("official_url") or action.get("url")
@@ -1094,49 +1134,131 @@ async def install_stream(items: List[Dict], router: Any) -> AsyncIterator[str]:
     yield _sse({"status": "complete", "msg": "모든 항목 처리 완료!"})
 
 
-async def _pip_install(package: str) -> Tuple[bool, str]:
+async def _pip_install(
+    package: str,
+    *,
+    confirmation_token: str | None = None,
+    confirmed: bool = False,
+    actor: str | None = None,
+) -> Tuple[bool, str]:
+    command = [sys.executable, "-m", "pip", "install", "--upgrade", package]
+    plan = command_plan(
+        command,
+        name=f"pip:{package}",
+        purpose="setup_wizard_install",
+        metadata={"package": package},
+    )
     try:
+        if not confirmed:
+            require_command_confirmation(command, confirmation_token, purpose="setup_wizard_install")
+        append_process_audit_event("setup_wizard_install", plan=plan, status="started", user_email=actor)
         proc = await asyncio.create_subprocess_exec(
-            sys.executable, "-m", "pip", "install", "--upgrade", package,
+            *command,
             stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE,
         )
         _, stderr = await asyncio.wait_for(proc.communicate(), timeout=600)
+        stderr_text = stderr.decode(errors="replace")
+        append_process_audit_event(
+            "setup_wizard_install",
+            plan=plan,
+            status="finished",
+            user_email=actor,
+            returncode=proc.returncode,
+            stderr=stderr_text,
+        )
         if proc.returncode == 0:
             return True, ""
-        return False, stderr.decode(errors="replace")
+        return False, stderr_text
+    except CommandConfirmationError as e:
+        append_process_audit_event("setup_wizard_install", plan=plan, status="denied", user_email=actor, error=str(e))
+        return False, str(e)
     except asyncio.TimeoutError:
+        append_process_audit_event("setup_wizard_install", plan=plan, status="timeout", user_email=actor)
         return False, "설치 시간 초과 (10분)"
     except Exception as e:
+        append_process_audit_event("setup_wizard_install", plan=plan, status="error", user_email=actor, error=str(e))
         return False, str(e)
 
 
-async def _brew_install(package: str) -> Tuple[bool, str]:
+async def _brew_install(
+    package: str,
+    *,
+    confirmation_token: str | None = None,
+    confirmed: bool = False,
+    actor: str | None = None,
+) -> Tuple[bool, str]:
     brew = shutil.which("brew")
     if not brew:
         return False, "Homebrew 미설치 — https://brew.sh 에서 설치하세요"
+    command = [brew, "install", package]
+    plan = command_plan(
+        command,
+        name=f"brew:{package}",
+        purpose="setup_wizard_install",
+        metadata={"package": package},
+    )
     try:
+        if not confirmed:
+            require_command_confirmation(command, confirmation_token, purpose="setup_wizard_install")
+        append_process_audit_event("setup_wizard_install", plan=plan, status="started", user_email=actor)
         proc = await asyncio.create_subprocess_exec(
-            brew, "install", package,
+            *command,
             stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE,
         )
         _, stderr = await asyncio.wait_for(proc.communicate(), timeout=300)
+        stderr_text = stderr.decode(errors="replace")
+        append_process_audit_event(
+            "setup_wizard_install",
+            plan=plan,
+            status="finished",
+            user_email=actor,
+            returncode=proc.returncode,
+            stderr=stderr_text,
+        )
         if proc.returncode == 0:
             return True, ""
-        return False, stderr.decode(errors="replace")
+        return False, stderr_text
+    except CommandConfirmationError as e:
+        append_process_audit_event("setup_wizard_install", plan=plan, status="denied", user_email=actor, error=str(e))
+        return False, str(e)
     except asyncio.TimeoutError:
+        append_process_audit_event("setup_wizard_install", plan=plan, status="timeout", user_email=actor)
         return False, "설치 시간 초과 (5분)"
     except Exception as e:
+        append_process_audit_event("setup_wizard_install", plan=plan, status="error", user_email=actor, error=str(e))
         return False, str(e)
 
 
 def open_url(url: str) -> None:
+    command: List[str]
     try:
         system = platform.system()
         if system == "Darwin":
-            subprocess.Popen(["open", url])
+            command = ["open", url]
+            plan = command_plan(command, name="open_url", purpose="setup_wizard_open_url")
+            append_process_audit_event("setup_wizard_open_url", plan=plan, status="started")
+            subprocess.Popen(command)
+            append_process_audit_event("setup_wizard_open_url", plan=plan, status="spawned")
         elif system == "Windows":
-            subprocess.Popen(["start", "", url], shell=True)
+            command = ["start", "", url]
+            plan = command_plan(command, name="open_url", purpose="setup_wizard_open_url")
+            append_process_audit_event("setup_wizard_open_url", plan=plan, status="started")
+            subprocess.Popen(command, shell=True)
+            append_process_audit_event("setup_wizard_open_url", plan=plan, status="spawned")
         else:
-            subprocess.Popen(["xdg-open", url])
-    except Exception:
+            command = ["xdg-open", url]
+            plan = command_plan(command, name="open_url", purpose="setup_wizard_open_url")
+            append_process_audit_event("setup_wizard_open_url", plan=plan, status="started")
+            subprocess.Popen(command)
+            append_process_audit_event("setup_wizard_open_url", plan=plan, status="spawned")
+    except Exception as exc:
+        try:
+            append_process_audit_event(
+                "setup_wizard_open_url",
+                plan=command_plan(["open_url", url], name="open_url", purpose="setup_wizard_open_url"),
+                status="error",
+                error=str(exc),
+            )
+        except Exception:
+            pass
         pass

package/src-tauri/Cargo.lock

@@ -1584,7 +1584,7 @@ dependencies = [
 
 [[package]]
 name = "lattice-ai-desktop"
-version = "8.8.0"
+version = "9.0.0"
 dependencies = [
  "plist",
  "serde",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lattice-ai-desktop"
-version = "8.8.0"
+version = "9.0.0"
 description = "Lattice AI Digital Brain desktop shell"
 authors = ["TaeSoo Park"]
 edition = "2021"

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Lattice AI",
-  "version": "8.8.0",
+  "version": "9.0.0",
   "identifier": "ai.lattice.desktop",
   "build": {
     "beforeDevCommand": "npm run frontend:dev",