ltcai 8.9.0 → 9.0.0

package/latticeai/runtime/namespace_runtime.py

@@ -0,0 +1,173 @@
+"""Runtime namespace filtering for legacy server_app compatibility.
+
+The app factory still constructs a broad local namespace for historical
+``server_app`` attribute access. This module keeps that surface deliberate:
+public runtime objects and known legacy helpers stay visible, while internal
+assembly scratch values do not leak into ``server_app.__getattr__``.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, fields
+from types import ModuleType
+from typing import Any, Dict, Mapping
+
+
+@dataclass(frozen=True)
+class RuntimeBundle:
+    """Typed migration target for app-factory runtime dependencies."""
+
+    app: Any
+    CONFIG: Any
+    KNOWLEDGE_GRAPH: Any
+    INGESTION_PIPELINE: Any
+    AGENT_RUNTIME: Any
+    HOOKS_REGISTRY: Any
+    REVIEW_QUEUE: Any
+    AGENT_REGISTRY: Any
+    model_router: Any
+    build_runtime: Any
+    get_shared_runtime: Any
+    create_app: Any
+
+    def as_legacy_dict(self) -> Dict[str, Any]:
+        return {field.name: getattr(self, field.name) for field in fields(self)}
+
+
+INTERNAL_RUNTIME_NAMES = {
+    "config",
+    "logging",
+    "os",
+    "threading",
+    "Path",
+    "mx",
+    "uvicorn",
+    "HTTPException",
+    "Request",
+    "BaseModel",
+    "keyring",
+    "datetime",
+    "runtime_bundle",
+}
+
+LEGACY_UNDERSCORE_EXPORTS = {
+    "_LOCAL_WRITE_BLOCKED_PREFIXES",
+    "_RATE_LIMIT_ENABLED",
+    "_SESSION_TTL",
+    "_TOOL_CATALOG_BRIEF",
+    "_TOOL_GOVERNANCE_DEFAULT",
+    "_agent_risk",
+    "_allowed_workspaces_for",
+    "_build_admin_audit_report",
+    "_build_sensitivity_report",
+    "_bytes_match_extension",
+    "_check_ip_rate_limit",
+    "_check_rate_limit",
+    "_check_tool_role",
+    "_classify_sensitive_message",
+    "_client_ip",
+    "_create_security_router",
+    "_embedding_info",
+    "_fetch_skills_marketplace",
+    "_get_audit_log",
+    "_get_sso_discovery",
+    "_graph_stats_safe",
+    "_host_is_loopback",
+    "_list_compat_profiles",
+    "_llm_generate_sync",
+    "_product_hardening_status",
+    "_recent_chat_context",
+    "_redact_secret_text",
+    "_require_graph",
+    "_scoped_hybrid_search",
+    "_security_audit_events_safe",
+    "_security_list_uploaded_files",
+    "_spawn",
+    "_tool_response",
+    "_user_id_for_email",
+    "_workspace_graph",
+    "_workspace_models_payload",
+    "_workspace_scope_from_request",
+    "_workspace_settings_payload",
+}
+
+LEGACY_PUBLIC_EXPORTS = {
+    "ENGINE_MODEL_CATALOG",
+    "TOOL_GOVERNANCE",
+    "enforce_rate_limit",
+    "filter_lower_family_versions",
+    "hash_password",
+    "normalize_local_model_request",
+    "verify_password",
+}
+
+
+def _is_internal_runtime_dict(name: str, value: Any) -> bool:
+    if not isinstance(value, dict):
+        return False
+    if name in {"_RUNTIME_BUNDLE"}:
+        return False
+    return (
+        name.endswith("_runtime")
+        or name.endswith("_router_bundle")
+        or name.endswith("_rt")
+        or name
+        in {
+            "_mcp_state",
+            "_garden_import",
+            "_foundation_router_bundle",
+            "_static_routes_bundle",
+            "_vpc_runtime",
+            "_sso_runtime",
+            "_security_runtime",
+            "_session_runtime",
+            "_config_runtime",
+            "_context_runtime",
+            "_brain_runtime",
+            "_hooks_runtime",
+            "_history_query_runtime",
+            "_persistence_runtime",
+            "_platform_automation_runtime",
+            "_user_key_runtime",
+            "_web_runtime",
+        }
+    )
+
+
+def build_runtime_namespace(
+    local_namespace: Mapping[str, Any],
+    *,
+    runtime_bundle: RuntimeBundle | Mapping[str, Any],
+) -> Dict[str, Any]:
+    """Return the compatibility namespace without assembly scratch values."""
+    legacy_bundle = (
+        runtime_bundle.as_legacy_dict()
+        if isinstance(runtime_bundle, RuntimeBundle)
+        else dict(runtime_bundle)
+    )
+    exported: Dict[str, Any] = dict(legacy_bundle)
+    allowed = set(legacy_bundle) | LEGACY_PUBLIC_EXPORTS | LEGACY_UNDERSCORE_EXPORTS
+    for name in allowed:
+        if name in exported:
+            continue
+        if name in INTERNAL_RUNTIME_NAMES:
+            continue
+        value = local_namespace.get(name)
+        if value is None:
+            continue
+        if isinstance(value, ModuleType):
+            continue
+        if _is_internal_runtime_dict(name, value):
+            continue
+        exported[name] = value
+    exported["RUNTIME_BUNDLE"] = runtime_bundle
+    exported["_RUNTIME_BUNDLE"] = legacy_bundle
+    return exported
+
+
+__all__ = [
+    "INTERNAL_RUNTIME_NAMES",
+    "LEGACY_UNDERSCORE_EXPORTS",
+    "RuntimeBundle",
+    "build_runtime_namespace",
+]

package/latticeai/runtime/network_config_runtime.py

@@ -0,0 +1,56 @@
+"""VPC network-profile config seam extracted from the legacy app factory.
+
+``DEFAULT_VPC_CONFIG`` and the load/save helpers used to live inline in
+``app_factory._build``. Behaviour and exported names are preserved exactly for
+the legacy ``server_app`` compatibility namespace; the only change is that they
+now live behind a builder so the factory stays a wiring path.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Dict
+
+
+def build_vpc_runtime(*, vpc_file: Path, logging: Any) -> Dict[str, Any]:
+    """Return ``DEFAULT_VPC_CONFIG`` and the VPC load/save helpers."""
+
+    default_vpc_config: Dict[str, Any] = {
+        "provider": "AWS",
+        "region": "ap-northeast-2",
+        "cidr_block": "10.42.0.0/16",
+        "private_subnets": ["10.42.10.0/24", "10.42.20.0/24"],
+        "endpoint": "ltcai-private.local",
+        "vpn_status": "standby",
+        "peering_status": "not_configured",
+        "notes": "로컬 MLX 브릿지를 프라이빗 서브넷 또는 VPN 뒤에서 운영할 때 쓰는 네트워크 프로필입니다.",
+        "updated_at": None,
+    }
+
+    def load_vpc_config() -> Dict:
+        if not os.path.exists(vpc_file):
+            return default_vpc_config.copy()
+        try:
+            with open(vpc_file, "r", encoding="utf-8") as f:
+                stored = json.load(f)
+            return {**default_vpc_config, **stored}
+        except Exception as e:
+            logging.warning("load_vpc_config failed (using defaults): %s", e)
+            return default_vpc_config.copy()
+
+    def save_vpc_config(config: Dict) -> None:
+        config["updated_at"] = datetime.now().isoformat()
+        with open(vpc_file, "w", encoding="utf-8") as f:
+            json.dump(config, f, ensure_ascii=False, indent=2)
+
+    return {
+        "DEFAULT_VPC_CONFIG": default_vpc_config,
+        "load_vpc_config": load_vpc_config,
+        "save_vpc_config": save_vpc_config,
+    }
+
+
+__all__ = ["build_vpc_runtime"]

package/latticeai/runtime/sso_config_runtime.py

@@ -0,0 +1,128 @@
+"""SSO / OIDC config + discovery seam extracted from the app factory.
+
+Owns the whole SSO surface that used to be inline in ``app_factory._build``:
+the env-default resolution, the ``sso_config.json`` load/save, the public
+(secret-stripped) view, and the OIDC discovery document cache.
+
+Unlike the previous split (config inline in the factory + a separate discovery
+cache in ``sso_runtime``), the discovery cache now lives in the *same* closure
+as ``save_sso_config``, so saving a new SSO config actually invalidates the
+cached discovery document. The old inline ``save_sso_config`` reassigned a
+factory-local cache variable that ``_get_sso_discovery`` never read, so the
+invalidation was a silent no-op — this consolidation fixes that.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+
+def build_sso_config_runtime(
+    *,
+    sso_file: Path,
+    discovery_url: str,
+    client_id: str,
+    client_secret: str,
+    redirect_uri: str,
+    provider_name: str,
+    logging: Any,
+) -> Dict[str, Any]:
+    """Return the SSO config helpers + discovery accessor as a name → value dict."""
+
+    # Single shared discovery cache: save_sso_config and _get_sso_discovery both
+    # close over it, so a config change is observed on the next discovery fetch.
+    _discovery_cache: Dict[str, Any] = {"data": None, "url": ""}
+    _sso_states: Dict[str, float] = {}
+
+    def _sso_env_defaults() -> Dict[str, object]:
+        return {
+            "enabled": bool(discovery_url and client_id and client_secret),
+            "provider_name": provider_name,
+            "discovery_url": discovery_url,
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "redirect_uri": redirect_uri,
+            "scopes": "openid email profile",
+        }
+
+    def load_sso_config() -> Dict[str, object]:
+        config = _sso_env_defaults()
+        if sso_file.exists():
+            try:
+                data = json.loads(sso_file.read_text(encoding="utf-8"))
+                if isinstance(data, dict):
+                    config.update({k: v for k, v in data.items() if v is not None})
+            except Exception as e:
+                logging.warning("load_sso_config failed (using env/defaults): %s", e)
+        config["provider_name"] = str(config.get("provider_name") or "SSO")
+        config["discovery_url"] = str(config.get("discovery_url") or "")
+        config["client_id"] = str(config.get("client_id") or "")
+        config["client_secret"] = str(config.get("client_secret") or "")
+        config["redirect_uri"] = str(config.get("redirect_uri") or redirect_uri)
+        config["scopes"] = str(config.get("scopes") or "openid email profile")
+        config["enabled"] = bool(config.get("enabled")) and bool(
+            config["discovery_url"] and config["client_id"] and config["client_secret"]
+        )
+        return config
+
+    def get_sso_settings() -> Dict[str, object]:
+        return load_sso_config()
+
+    def public_sso_config(config: Optional[Dict[str, object]] = None) -> Dict[str, object]:
+        cfg = config or get_sso_settings()
+        return {
+            "enabled": bool(cfg.get("enabled")),
+            "provider_name": cfg.get("provider_name") or "",
+            "discovery_url": cfg.get("discovery_url") or "",
+            "client_id": cfg.get("client_id") or "",
+            "redirect_uri": cfg.get("redirect_uri") or redirect_uri,
+            "scopes": cfg.get("scopes") or "openid email profile",
+            "secret_configured": bool(cfg.get("client_secret")),
+        }
+
+    def save_sso_config(update: Dict[str, object]) -> Dict[str, object]:
+        current = load_sso_config()
+        if update.get("client_secret") == "":
+            update.pop("client_secret", None)
+        current.update({k: v for k, v in update.items() if v is not None})
+        current["enabled"] = bool(current.get("enabled")) and bool(
+            current.get("discovery_url") and current.get("client_id") and current.get("client_secret")
+        )
+        sso_file.write_text(json.dumps(current, ensure_ascii=False, indent=2), encoding="utf-8")
+        _discovery_cache["data"] = None
+        _discovery_cache["url"] = ""
+        return current
+
+    async def _get_sso_discovery() -> Optional[Dict]:
+        settings = get_sso_settings()
+        url = settings.get("discovery_url", "")
+        if _discovery_cache["data"] and _discovery_cache["url"] == url:
+            return _discovery_cache["data"]
+        if not url:
+            return None
+        try:
+            import httpx as _httpx
+            async with _httpx.AsyncClient() as c:
+                r = await c.get(url, timeout=10)
+                r.raise_for_status()
+                _discovery_cache["data"] = r.json()
+                _discovery_cache["url"] = url
+        except Exception as e:
+            logging.warning("SSO discovery failed: %s", e)
+            return None
+        return _discovery_cache["data"]
+
+    return {
+        "_sso_env_defaults": _sso_env_defaults,
+        "load_sso_config": load_sso_config,
+        "get_sso_settings": get_sso_settings,
+        "public_sso_config": public_sso_config,
+        "save_sso_config": save_sso_config,
+        "_get_sso_discovery": _get_sso_discovery,
+        "_sso_states": _sso_states,
+    }
+
+
+__all__ = ["build_sso_config_runtime"]

package/latticeai/runtime/user_key_runtime.py

@@ -0,0 +1,106 @@
+"""User profile + provider API-key helpers extracted from the app factory.
+
+The helpers close over the user store, keyring adapter, identity migration, and
+plaintext-key policy. Returning callables preserves the legacy ``server_app``
+namespace while keeping ``app_factory._build`` focused on wiring.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+
+def build_user_key_runtime(
+    *,
+    load_users: Any,
+    save_users: Any,
+    ensure_user_identity: Any,
+    keyring: Any,
+    allow_plaintext_api_keys: bool,
+    logging: Any,
+    http_exception: Any,
+) -> Dict[str, Any]:
+    """Return history-user and provider API-key helpers."""
+
+    def get_history_user(email: Optional[str], nickname: Optional[str] = None) -> Dict:
+        if not email:
+            return {"user_email": None, "user_nickname": nickname or None}
+        users = load_users()
+        user = users.get(email, {})
+        return {
+            "user_email": email,
+            "user_nickname": nickname or user.get("nickname") or user.get("name") or email,
+        }
+
+    def get_user_api_key(email: Optional[str], provider: str) -> Optional[str]:
+        if not email:
+            return None
+        keyring_key = f"{email}:{provider}"
+        if keyring is not None:
+            try:
+                key = keyring.get_password("LatticeAI", keyring_key)
+                if key:
+                    return key.strip()
+            except Exception as exc:
+                logging.warning("keyring read failed for %s: %s", provider, exc)
+        users = load_users()
+        user = users.get(email) or {}
+        api_keys = user.get("api_keys") or {}
+        key = api_keys.get(provider)
+        if isinstance(key, str) and key.strip() and allow_plaintext_api_keys:
+            return key.strip()
+        return None
+
+    def set_user_api_key(email: str, provider: str, key: str) -> None:
+        keyring_key = f"{email}:{provider}"
+        if keyring is not None:
+            try:
+                keyring.set_password("LatticeAI", keyring_key, key)
+                users = load_users()
+                user = users.get(email)
+                if user and "api_keys" in user:
+                    user["api_keys"].pop(provider, None)
+                    if not user["api_keys"]:
+                        user.pop("api_keys", None)
+                    save_users(users)
+                return
+            except Exception as exc:
+                logging.warning("keyring write failed for %s: %s", provider, exc)
+                if not allow_plaintext_api_keys:
+                    raise http_exception(
+                        status_code=500,
+                        detail="OS keyring에 API 키를 저장하지 못했습니다. keyring 설정을 확인하거나 LATTICEAI_ALLOW_PLAINTEXT_API_KEYS=true를 명시적으로 설정하세요.",
+                    )
+
+        if not allow_plaintext_api_keys:
+            raise http_exception(
+                status_code=500,
+                detail="keyring 패키지를 사용할 수 없어 API 키를 안전하게 저장할 수 없습니다.",
+            )
+
+        users = load_users()
+        user = users.get(email)
+        if not user:
+            user = {
+                "password_hash": "",
+                "salt": "",
+                "name": email,
+                "nickname": email,
+                "role": "user",
+                "disabled": False,
+            }
+        ensure_user_identity(email, user)
+        api_keys = user.get("api_keys") or {}
+        api_keys[provider] = key
+        user["api_keys"] = api_keys
+        users[email] = user
+        save_users(users)
+
+    return {
+        "get_history_user": get_history_user,
+        "get_user_api_key": get_user_api_key,
+        "set_user_api_key": set_user_api_key,
+    }
+
+
+__all__ = ["build_user_key_runtime"]

package/latticeai/services/architecture_readiness.py

@@ -1,6 +1,6 @@
 """Machine-checkable architecture readiness gates for release work.
 
-8.9.0 keeps the major architecture priorities under an explicit release
+9.0.0 keeps the major architecture priorities under an explicit release
 contract while product maturity work reduces visible beta seams. AgentRuntime, ToolRegistry,
 central Config, decomposed server runtime, and Knowledge Graph stabilization
 must remain discoverable, ordered, and backed by tests before the release can be
@@ -17,7 +17,7 @@ from typing import Any, Dict, List
 from latticeai.core.legacy_compatibility import legacy_shim_report
 
 
-ARCHITECTURE_VERSION_TARGET = "8.9.0"
+ARCHITECTURE_VERSION_TARGET = "9.0.0"
 
 PREFERRED_REFACTORING_ORDER = [
     "agent-runtime",