ltcai 8.9.0 → 9.0.0

package/latticeai/api/chat_helpers.py

@@ -0,0 +1,227 @@
+"""Pure chat helpers: language/intent detection, file-action parsing,
+network-status formatting, workspace-scope extraction, and recent-context
+assembly. Split out of the chat router module so create_chat_router keeps
+only request wiring. chat.py re-imports every name, so external import
+sites (tests, app_factory) are unaffected.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import AsyncIterator, Dict, List, Optional
+
+from fastapi import Request
+
+
+def pair_user_history(history: List[Dict], user_email: str) -> List[Dict]:
+    """Restrict history to one user's exchange.
+
+    Keeps the user's own messages plus assistant replies that directly follow
+    them. A bare role=="assistant" pass would leak every other user's replies
+    into this user's prompt context.
+    """
+    paired: List[Dict] = []
+    include_next_assistant = False
+    for item in history:
+        if item.get("role") == "assistant":
+            if include_next_assistant:
+                paired.append(item)
+                include_next_assistant = False
+        elif item.get("user_email") == user_email:
+            paired.append(item)
+            include_next_assistant = True
+        else:
+            include_next_assistant = False
+    return paired
+
+
+def detect_language(text: str) -> str:
+    """Detect language: 'ko' (Korean) or 'en' (English)."""
+    total = max(len(text), 1)
+    ko = sum(1 for c in text if '가' <= c <= '힣')
+    if ko / total > 0.05:
+        return "ko"
+    return "en"
+
+_LANG_HINT = {
+    "ko": "Respond in Korean (한국어로 답변하세요).",
+    "en": "Respond in English.",
+}
+
+def is_network_status_request(text: str) -> bool:
+    """사용자가 현재 IP/네트워크 정보를 물었는지 감지합니다."""
+    t = (text or "").lower()
+    explicit_network = any(
+        phrase in t
+        for phrase in (
+            "ipconfig",
+            "ifconfig",
+            "network status",
+            "네트워크 상태",
+            "네트워크 확인",
+            "현재 네트워크",
+        )
+    )
+    current_ip = bool(
+        re.search(
+            r"(내|현재|지금|로컬|local|public|공인|외부|내부)\s*(ip|아이피)\s*(주소)?",
+            t,
+        )
+        or re.search(
+            r"(ip|아이피)\s*(주소)?\s*(확인|상태|알려줘|보여줘)",
+            t,
+        )
+    )
+    return explicit_network or current_ip
+
+def is_current_url_request(text: str) -> bool:
+    t = (text or "").lower()
+    explicit_url = any(phrase in t for phrase in ("현재 url", "current url", "page url", "페이지 url"))
+    current_page_link = bool(
+        re.search(r"(현재|지금|여기|이\s*페이지|브라우저|접속)\s*(페이지\s*)?(url|링크|주소)", t)
+        or re.search(r"(url|링크)\s*(알려줘|보여줘|확인)", t)
+    )
+    return explicit_url or current_page_link
+
+def is_clear_command(text: str) -> bool:
+    return (text or "").strip().lower() in {"/clear", "/clear_all"}
+
+# Path segments intentionally exclude spaces: allowing spaces let the target
+# match swallow preceding words (e.g. "create a text file report.txt" resolved
+# to the whole phrase as the path). Chat file targets are single tokens.
+_FILE_TARGET_RE = re.compile(
+    r"(?<![\w.-])(?:[~./\\]?[\w.@()+-]+[\\/])*[\w.@()+-]+"
+    r"\.(?:py|js|jsx|ts|tsx|md|markdown|txt|json|yaml|yml|toml|html|css|csv|xml|pdf|docx|xlsx|pptx|sh|sql)",
+    re.IGNORECASE,
+)
+
+
+def is_file_action_request(text: str) -> bool:
+    """Return True for chat requests that should execute file tools, not prose.
+
+    The Brain chat composer posts to ``/chat``. Without this gate, explicit
+    side-effect requests such as "create hello.md" are handled as plain model
+    generation, which commonly produces a code block instead of a real file.
+    Keep the gate narrow so normal Q&A and "how do I create a file?" stay in
+    ordinary chat.
+    """
+    raw = (text or "").strip()
+    if not raw:
+        return False
+    lower = raw.lower()
+
+    if any(phrase in lower for phrase in (
+        "how to ", "how do i ", "방법", "어떻게", "예시", "sample", "example",
+    )) and not any(phrase in lower for phrase in (
+        "actually create", "real file", "실제로", "파일로", "저장해", "만들어",
+    )):
+        return False
+
+    has_target = bool(_FILE_TARGET_RE.search(raw))
+    has_file_word = any(word in lower for word in (
+        "file", "파일", "문서", "artifact", "아티팩트", "save as", "저장",
+    ))
+    has_action = any(word in lower for word in (
+        "create", "make", "write", "save", "generate", "edit", "update",
+        "만들", "생성", "작성", "저장", "수정", "써줘", "만들어줘",
+    ))
+
+    if not has_action:
+        return False
+    if has_target and has_action:
+        return True
+    return has_file_word and has_action
+
+
+def file_action_target(text: str) -> Optional[str]:
+    """Extract the first explicit workspace file target from a request."""
+    match = _FILE_TARGET_RE.search(text or "")
+    if not match:
+        return None
+    return match.group(0).strip().strip("`'\".,:;)]}")
+
+
+def inline_file_action_content(text: str) -> Optional[str]:
+    """Extract short user-provided content for deterministic file writes."""
+    raw = (text or "").strip()
+    # Each pattern requires an explicit binder so ambiguous words like "text"
+    # ("create a text file report.txt") or a bare "with" ("report.md with a
+    # summary of X") do not get captured as literal file content.
+    patterns = [
+        r"(?:내용|본문)\s*(?:은|는|이에요|입니다)\s*(.+)$",
+        r"(?:내용|본문|content|body|text)\s*[:=]\s*(.+)$",
+        r"(?:content|body)\s+(?:is|as)\s+(.+)$",
+        r"(?:with the content|with content|containing)\s+(.+)$",
+    ]
+    for pattern in patterns:
+        match = re.search(pattern, raw, flags=re.IGNORECASE | re.DOTALL)
+        if match:
+            content = match.group(1).strip()
+            return content.strip("`'\"")
+    return None
+
+
+def strip_generated_file_content(text: str) -> str:
+    """Remove common chat wrappers when a model is asked for file content only."""
+    content = (text or "").strip()
+    fenced = re.search(r"```(?:[\w.+-]+)?\s*(.*?)\s*```", content, flags=re.DOTALL)
+    if fenced:
+        content = fenced.group(1).strip()
+    return content
+
+
+def format_network_status(info: Dict) -> str:
+    lines = [
+        f"내부 IP: {info.get('local_ip') or '확인 안 됨'}",
+        f"외부 IP: {info.get('public_ip') or '확인 안 됨'}",
+        f"호스트명: {info.get('hostname') or '확인 안 됨'}",
+    ]
+    local_ips = info.get("local_ips") or {}
+    if local_ips:
+        lines.extend(["", "인터페이스:"])
+        lines.extend(f"- {name}: {ip}" for name, ip in local_ips.items())
+    note = info.get("note")
+    if note:
+        lines.extend(["", note])
+    return "\n".join(lines)
+
+def workspace_scope_from_request(request: Request) -> Optional[str]:
+    header = request.headers.get("X-Workspace-Id")
+    if header and header.strip():
+        return header.strip()
+    query = request.query_params.get("workspace_id")
+    return query.strip() if query and query.strip() else None
+
+async def single_text_stream(text: str, model: str = "system") -> AsyncIterator[str]:
+    yield f"data: {json.dumps({'chunk': text, 'model': model}, ensure_ascii=False)}\n\n"
+    yield "data: [DONE]\n\n"
+
+
+def build_recent_chat_context(
+    *,
+    get_history,
+    limit: int = 10,
+    include_image_missing_replies: bool = True,
+    user_email: Optional[str] = None,
+    conversation_id: Optional[str] = None,
+) -> str:
+    history = get_history()
+    if conversation_id:
+        history = [item for item in history if item.get("conversation_id") == conversation_id]
+    if user_email:
+        history = pair_user_history(history, user_email)
+    history = history[-limit:]
+    lines = []
+    for item in history:
+        role = item.get("role", "user")
+        content = item.get("content", "")
+        if not include_image_missing_replies and role == "assistant":
+            if "이미지" in content and any(word in content for word in ["업로드", "제공", "올려"]):
+                continue
+        source = item.get("source")
+        label = role
+        if source:
+            label = f"{role} ({source})"
+        lines.append(f"{label}: {content}")
+    return "\n".join(lines)

package/latticeai/api/computer_use.py

@@ -12,7 +12,9 @@ from pydantic import BaseModel
 
 from latticeai.core.agent import extract_action as _extract_agent_action
 from lattice_brain.runtime.hooks import dispatch_tool
+from latticeai.services.tool_dispatch import enforce_tool_policy
 from tools import (
+    AGENT_ROOT,
     ToolError,
     computer_click,
     computer_drag,
@@ -108,14 +110,64 @@ class CuDragRequest(BaseModel):
     y2: int
 
 
-def create_computer_use_router(*, model_router, require_user, tool_response, save_to_history, hooks=None) -> APIRouter:
+def create_computer_use_router(
+    *,
+    model_router,
+    require_user,
+    tool_response,
+    save_to_history,
+    hooks=None,
+    append_audit_event=None,
+) -> APIRouter:
     router = APIRouter()
 
-    def _dispatch(name, args, fn):
+    def _audit_args(name: str, args: dict) -> dict:
+        """Return audit-safe argument metadata without storing typed text."""
+        args = dict(args or {})
+        if name == "computer_type":
+            return {"text_length": len(str(args.get("text") or "")), "interval": args.get("interval")}
+        if name == "vision_analyze":
+            return {
+                "image_b64_length": len(str(args.get("image_b64") or "")),
+                "prompt_length": len(str(args.get("prompt") or "")),
+            }
+        return args
+
+    def _audit(name: str, args: dict, *, current_user: str, status: str, error: Optional[str] = None) -> None:
+        if append_audit_event is None:
+            return
+        payload = {
+            "user_email": current_user,
+            "source": "computer_use",
+            "tool": name,
+            "status": status,
+            "args": _audit_args(name, args),
+        }
+        if error:
+            payload["error"] = error[:500]
+        append_audit_event("computer_use_tool", **payload)
+
+    def _dispatch(name, args, fn, *, current_user: str):
         # Run a computer-use action through the unified pre_tool/post_tool
-        # lifecycle. With hooks=None this is a transparent pass-through, so the
-        # behaviour is unchanged when hooks are absent.
-        return dispatch_tool(hooks, name, dict(args or {}), fn, source="computer_use")
+        # lifecycle after the same ToolRegistry policy gate used by direct
+        # /tools execution. This keeps desktop control behind one governance
+        # boundary instead of relying on route-specific checks.
+        args = dict(args or {})
+        try:
+            enforce_tool_policy(name, args, current_user=current_user, source="computer_use")
+        except HTTPException as exc:
+            _audit(name, args, current_user=current_user, status="blocked", error=str(exc.detail))
+            raise
+        try:
+            result = dispatch_tool(hooks, name, args, fn, source="computer_use")
+        except (PermissionError, ToolError, KeyError, TypeError) as exc:
+            _audit(name, args, current_user=current_user, status="error", error=str(exc))
+            raise
+        _audit(name, args, current_user=current_user, status="ok")
+        return result
+
+    def _response(result):
+        return {"status": "ok", "workspace": str(AGENT_ROOT), "result": result}
 
     @router.get("/tools/chrome_status")
     async def tools_chrome_status(request: Request):
@@ -129,9 +181,11 @@ def create_computer_use_router(*, model_router, require_user, tool_response, sav
 
     @router.get("/cu/status")
     async def cu_status(request: Request):
-        require_user(request)
+        current_user = require_user(request)
         try:
-            return _dispatch("computer_status", {}, computer_status)
+            return _dispatch("computer_status", {}, computer_status, current_user=current_user)
+        except HTTPException:
+            raise
         except PermissionError as exc:
             raise HTTPException(status_code=403, detail=str(exc))
         except ToolError as exc:
@@ -139,9 +193,11 @@ def create_computer_use_router(*, model_router, require_user, tool_response, sav
 
     @router.get("/cu/screenshot")
     async def cu_screenshot(request: Request):
-        require_user(request)
+        current_user = require_user(request)
         try:
-            return _dispatch("computer_screenshot", {}, computer_screenshot)
+            return _dispatch("computer_screenshot", {}, computer_screenshot, current_user=current_user)
+        except HTTPException:
+            raise
         except PermissionError as exc:
             raise HTTPException(status_code=403, detail=str(exc))
         except ToolError as exc:
@@ -149,47 +205,95 @@ def create_computer_use_router(*, model_router, require_user, tool_response, sav
 
     @router.post("/cu/open_app")
     async def cu_open_app(req: CuOpenAppRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_open_app, req.app)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_open_app",
+            {"app": req.app},
+            lambda: computer_open_app(req.app),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/open_url")
     async def cu_open_url(req: CuOpenUrlRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_open_url, req.url, req.app)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_open_url",
+            {"url": req.url, "app": req.app},
+            lambda: computer_open_url(req.url, req.app),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/click")
     async def cu_click(req: CuClickRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_click, req.x, req.y, req.button, req.double)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_click",
+            {"x": req.x, "y": req.y, "button": req.button, "double": req.double},
+            lambda: computer_click(req.x, req.y, req.button, req.double),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/type")
     async def cu_type(req: CuTypeRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_type, req.text, req.interval)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_type",
+            {"text": req.text, "interval": req.interval},
+            lambda: computer_type(req.text, req.interval),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/key")
     async def cu_key(req: CuKeyRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_key, req.key)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_key",
+            {"key": req.key},
+            lambda: computer_key(req.key),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/scroll")
     async def cu_scroll(req: CuScrollRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_scroll, req.x, req.y, req.direction, req.clicks)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_scroll",
+            {"x": req.x, "y": req.y, "direction": req.direction, "clicks": req.clicks},
+            lambda: computer_scroll(req.x, req.y, req.direction, req.clicks),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/move")
     async def cu_move(req: CuMoveRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_move, req.x, req.y)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_move",
+            {"x": req.x, "y": req.y},
+            lambda: computer_move(req.x, req.y),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/drag")
     async def cu_drag(req: CuDragRequest, request: Request):
-        require_user(request)
-        return tool_response(computer_drag, req.x1, req.y1, req.x2, req.y2)
+        current_user = require_user(request)
+        result = _dispatch(
+            "computer_drag",
+            {"x1": req.x1, "y1": req.y1, "x2": req.x2, "y2": req.y2},
+            lambda: computer_drag(req.x1, req.y1, req.x2, req.y2),
+            current_user=current_user,
+        )
+        return _response(result)
 
     @router.post("/cu/agent")
     async def cu_agent(req: CuAgentRequest, request: Request):
-        require_user(request)
+        current_user = require_user(request)
 
         async def _stream():
             task_lower = (req.task or "").lower()
@@ -209,8 +313,12 @@ def create_computer_use_router(*, model_router, require_user, tool_response, sav
                             "action",
                             {"step": 1, "action": "computer_open_url", "args": {"url": url, "app": "Google Chrome"}},
                         )
-                        result = _dispatch("computer_open_url", {"url": url, "app": "Google Chrome"},
-                                           lambda: computer_open_url(url, "Google Chrome"))
+                        result = _dispatch(
+                            "computer_open_url",
+                            {"url": url, "app": "Google Chrome"},
+                            lambda: computer_open_url(url, "Google Chrome"),
+                            current_user=current_user,
+                        )
                         yield _send("result", {"step": 1, "action": "computer_open_url", "result": result})
                         message = f"Google Chrome에서 {url}을 열었습니다."
                         action_name = "computer_open_url"
@@ -219,14 +327,20 @@ def create_computer_use_router(*, model_router, require_user, tool_response, sav
                             "action",
                             {"step": 1, "action": "computer_open_app", "args": {"app": "Google Chrome"}},
                         )
-                        result = _dispatch("computer_open_app", {"app": "Google Chrome"},
-                                           lambda: computer_open_app("Google Chrome"))
+                        result = _dispatch(
+                            "computer_open_app",
+                            {"app": "Google Chrome"},
+                            lambda: computer_open_app("Google Chrome"),
+                            current_user=current_user,
+                        )
                         yield _send("result", {"step": 1, "action": "computer_open_app", "result": result})
                         message = "Google Chrome을 열었습니다."
                         action_name = "computer_open_app"
                     save_to_history("user", req.task, source="web", conversation_id=req.conversation_id)
                     save_to_history("assistant", message, source="web", conversation_id=req.conversation_id)
                     yield _send("final", {"message": message, "steps": [{"step": 1, "action": action_name, "result": result}]})
+                except HTTPException as exc:
+                    yield _send("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc.detail)})
                 except (ToolError, PermissionError) as exc:
                     yield _send("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc)})
                 return
@@ -271,7 +385,7 @@ def create_computer_use_router(*, model_router, require_user, tool_response, sav
 
                 yield _send("action", {"step": step + 1, "action": name, "args": args})
                 try:
-                    result = _dispatch(name, args, lambda: execute_tool(name, args))
+                    result = _dispatch(name, args, lambda: execute_tool(name, args), current_user=current_user)
                     if name == "computer_screenshot" and "screenshot_b64" in result:
                         last_screenshot_b64 = result["screenshot_b64"]
                         result_summary = {k: v for k, v in result.items() if k != "screenshot_b64"}
@@ -290,6 +404,10 @@ def create_computer_use_router(*, model_router, require_user, tool_response, sav
                         last_screenshot_b64 = None
                         transcript.append({"step": step + 1, "action": name, "args": args, "result": result})
                         yield _send("result", {"step": step + 1, "action": name, "result": result})
+                except HTTPException as exc:
+                    error_str = str(exc.detail)
+                    transcript.append({"step": step + 1, "action": name, "args": args, "error": error_str})
+                    yield _send("tool_error", {"step": step + 1, "action": name, "error": error_str})
                 except (ToolError, PermissionError, KeyError, TypeError) as exc:
                     error_str = str(exc)
                     transcript.append({"step": step + 1, "action": name, "args": args, "error": error_str})

package/latticeai/api/marketplace.py

@@ -91,4 +91,15 @@ def create_marketplace_router(
         scope = gate_read(request)
         return {"registry": store.list_template_registry(workspace_id=scope)}
 
+    @router.get("/marketplace/interop/bridges")
+    async def list_interop_bridges(request: Request):
+        require_user(request)
+        gate_read(request)
+        bridges = catalog.list_templates(kind="ingestion_bridge")["templates"]
+        return {
+            "bridges": bridges,
+            "total": len(bridges),
+            "pipeline": "unified-ingestion",
+        }
+
     return router

package/latticeai/api/permissions.py

@@ -216,9 +216,9 @@ class PermissionGateway:
         now = time.time()
         key = self.token_hash(token)
         with self.local_approval_lock:
-            expired = [key for key, value in self.local_approvals.items() if float(value.get("expires_at", 0)) < now]
-            for key in expired:
-                self.local_approvals.pop(key, None)
+            expired = [approval_key for approval_key, value in self.local_approvals.items() if float(value.get("expires_at", 0)) < now]
+            for expired_key in expired:
+                self.local_approvals.pop(expired_key, None)
             record = self.local_approvals.get(key)
         if not record:
             raise HTTPException(status_code=403, detail="파일 접근 승인이 만료되었거나 유효하지 않습니다.")

package/latticeai/api/tools.py

@@ -541,6 +541,7 @@ def create_tools_router(
         tool_response=_tool_response,
         save_to_history=save_to_history,
         hooks=HOOKS,
+        append_audit_event=append_audit_event,
     ))
 
     @api_router.post("/tools/knowledge_save")