ltcai 8.9.0 → 9.1.0

package/lattice_brain/utils.py

@@ -0,0 +1,46 @@
+"""Shared Brain Core utility helpers."""
+
+from __future__ import annotations
+
+import hashlib
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Optional
+
+
+def parse_iso(value: Optional[str]) -> Optional[datetime]:
+    if not value:
+        return None
+    try:
+        return datetime.fromisoformat(str(value))
+    except (TypeError, ValueError):
+        return None
+
+
+def local_now() -> datetime:
+    """Return local wall-clock time for legacy local persistence formats."""
+
+    return datetime.now()
+
+
+def now_iso(*, timespec: str = "seconds") -> str:
+    """Return one consistently formatted local timestamp."""
+
+    return local_now().isoformat(timespec=timespec)
+
+
+def utc_now_iso(*, timespec: str = "auto") -> str:
+    """Return an offset-aware UTC timestamp."""
+
+    return datetime.now(timezone.utc).isoformat(timespec=timespec)
+
+
+def sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with open(path, "rb") as fh:
+        for block in iter(lambda: fh.read(65536), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+__all__ = ["local_now", "now_iso", "parse_iso", "sha256_file", "utc_now_iso"]

package/lattice_brain/workflow.py

@@ -24,10 +24,10 @@ a linear node chain so existing workflow history keeps working.
 from __future__ import annotations
 
 from dataclasses import dataclass, field
-from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional
 
 from lattice_brain.runtime.contracts import runtime_boundary_contract, workflow_run_contract
+from lattice_brain.utils import now_iso as _now
 
 
 WORKFLOW_ENGINE_VERSION = "2.2.0"
@@ -59,10 +59,6 @@ class WorkflowError(Exception):
     """Raised for invalid workflow definitions."""
 
 
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 def normalize_definition(workflow: Dict[str, Any]) -> Dict[str, Any]:
     """Return a node-based definition, lifting legacy ``steps`` lists if needed.
 

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "8.9.0"
+__version__ = "9.1.0"

package/latticeai/api/admin.py

@@ -259,7 +259,7 @@ def create_admin_router(
                 {"id": "model_egress", "label": "Model egress",
                  "value": "Local-only by default (no external inference in local mode)", "enforced": True},
                 {"id": "invite_gate", "label": "Invite gate",
-                 "value": "Required for new accounts" if invite_gate_enabled else "Open registration",
+                 "value": "Signed access gate" if invite_gate_enabled else "Disabled",
                  "enforced": bool(invite_gate_enabled)},
                 {"id": "log_retention", "label": "Log retention",
                  "value": "90 day local audit window with manual export before pruning", "enforced": True},

package/latticeai/api/agent_registry.py

@@ -14,6 +14,7 @@ from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
 from latticeai.core.agent_registry import AgentRegistry
+from latticeai.core.security import redact_secrets
 
 
 class AgentRegisterRequest(BaseModel):
@@ -34,6 +35,7 @@ def create_agent_registry_router(
     *,
     registry: AgentRegistry,
     require_user: Callable[[Request], str],
+    require_admin: Callable[[Request], Any],
     append_audit_event: Callable[..., None],
 ) -> APIRouter:
     router = APIRouter()
@@ -41,7 +43,7 @@ def create_agent_registry_router(
     @router.get("/agents/api/registry")
     async def list_registry(request: Request, type: Optional[str] = None):
         require_user(request)
-        return registry.list(agent_type=type)
+        return redact_secrets(registry.list(agent_type=type))
 
     @router.get("/agents/api/registry/capabilities")
     async def registry_capabilities(request: Request):
@@ -51,11 +53,11 @@ def create_agent_registry_router(
     @router.get("/agents/api/registry/discover")
     async def registry_discover(request: Request, capability: str = ""):
         require_user(request)
-        return {"capability": capability, "agents": registry.discover(capability)}
+        return {"capability": capability, "agents": redact_secrets(registry.discover(capability))}
 
     @router.post("/agents/api/registry")
     async def register_agent(req: AgentRegisterRequest, request: Request):
-        user = require_user(request)
+        user, _ = require_admin(request)
         try:
             entry = registry.register(
                 name=req.name,
@@ -68,7 +70,7 @@ def create_agent_registry_router(
         except ValueError as exc:
             raise HTTPException(status_code=400, detail=str(exc)) from exc
         append_audit_event("agent_register", user_email=user, agent_id=entry["id"], type=entry["type"])
-        return {"agent": entry}
+        return {"agent": redact_secrets(entry)}
 
     @router.get("/agents/api/registry/{agent_id:path}")
     async def get_agent(agent_id: str, request: Request):
@@ -76,21 +78,21 @@ def create_agent_registry_router(
         agent = registry.get(agent_id)
         if agent is None:
             raise HTTPException(status_code=404, detail=f"Agent not found: {agent_id}")
-        return {"agent": agent}
+        return {"agent": redact_secrets(agent)}
 
     @router.patch("/agents/api/registry/{agent_id:path}")
     async def update_agent(agent_id: str, req: AgentConfigRequest, request: Request):
-        user = require_user(request)
+        user, _ = require_admin(request)
         try:
             agent = registry.update_config(agent_id, req.config, enabled=req.enabled)
         except KeyError as exc:
             raise HTTPException(status_code=404, detail=f"Agent not found: {agent_id}") from exc
         append_audit_event("agent_config", user_email=user, agent_id=agent_id)
-        return {"agent": agent}
+        return {"agent": redact_secrets(agent)}
 
     @router.delete("/agents/api/registry/{agent_id:path}")
     async def remove_agent(agent_id: str, request: Request):
-        user = require_user(request)
+        user, _ = require_admin(request)
         try:
             result = registry.remove(agent_id)
         except KeyError as exc:

package/latticeai/api/agents.py

@@ -17,6 +17,24 @@ from pydantic import BaseModel
 from latticeai.api.ui_redirects import app_redirect
 
 
+_CORE_EXECUTION_ROLES = ["planner", "executor", "reviewer"]
+_MEMORY_GROUNDED_ROLES = ["researcher", *_CORE_EXECUTION_ROLES]
+
+
+def _memory_grounded_roles(roles: List[str]) -> Optional[List[str]]:
+    """Ground standard user-initiated agent runs in Brain recall first.
+
+    Explicit specialist/custom pipelines keep their requested shape. The
+    desktop Brain and Work surfaces both send the historical three-role core
+    sequence, so normalizing it at the API boundary upgrades existing clients
+    without a frontend-only compatibility branch.
+    """
+    requested = list(roles or _CORE_EXECUTION_ROLES)
+    if requested == _CORE_EXECUTION_ROLES:
+        return list(_MEMORY_GROUNDED_ROLES)
+    return requested or None
+
+
 class AgentRunRequest(BaseModel):
     goal: str
     roles: List[str] = []
@@ -160,13 +178,14 @@ def create_agents_router(
     async def agent_run(req: AgentRunRequest, request: Request):
         current_user = require_user(request)
         scope = gate_write(request)
+        grounded_roles = _memory_grounded_roles(req.roles)
         try:
             if run_executor is not None:
                 return await run_executor.start_agent(
                     req.goal,
                     user_email=current_user or None,
                     scope=scope,
-                    roles=req.roles or None,
+                    roles=grounded_roles,
                     inputs=req.inputs,
                     max_retries=req.max_retries,
                 )
@@ -180,7 +199,7 @@ def create_agents_router(
                 req.goal,
                 user_email=current_user or None,
                 scope=scope,
-                roles=req.roles or None,
+                roles=grounded_roles,
                 inputs=req.inputs,
                 max_retries=req.max_retries,
             )
@@ -199,7 +218,7 @@ def create_agents_router(
         return runtime.preview(
             req.goal,
             scope=scope,
-            roles=req.roles or None,
+            roles=_memory_grounded_roles(req.roles),
             inputs=req.inputs,
             max_retries=req.max_retries,
         )

package/latticeai/api/auth.py

@@ -5,7 +5,8 @@ import hashlib
 import logging
 import secrets
 import time
-from typing import Any, Awaitable, Callable, Dict, Optional, Tuple
+from dataclasses import dataclass
+from typing import Any, Awaitable, Callable, Dict, Optional
 from urllib.parse import urlencode
 
 from fastapi import APIRouter, HTTPException, Request
@@ -42,9 +43,20 @@ class UpdateProfileRequest(BaseModel):
     nickname: Optional[str] = None
 
 
-# state → (issued_at, nonce). The nonce binds the eventual ID token to *this*
-# login attempt (replay / token-injection defence); the timestamp expires it.
-_sso_states: Dict[str, Tuple[float, str]] = {}
+@dataclass(frozen=True)
+class _SSOLoginState:
+    """Server-side SSO transaction state consumed exactly once."""
+
+    issued_at: float
+    nonce: str
+    code_verifier: str
+    invite_authorized: bool
+
+
+# The nonce and PKCE verifier bind the callback/token to this login attempt.
+# The signed invite cookie is verified once at login and reduced to a
+# server-side claim, so the callback never trusts a client-supplied invite bit.
+_sso_states: Dict[str, _SSOLoginState] = {}
 
 
 def create_auth_router(
@@ -67,7 +79,10 @@ def create_auth_router(
     open_registration: bool,
     session_ttl: int,
     require_auth: bool = True,
+    secure_cookies: bool = False,
     ensure_identity: Optional[Callable[[str, Dict], None]] = None,
+    invite_gate_enabled: bool = False,
+    invite_authorized: Optional[Callable[[Request], bool]] = None,
     verify_id_token: Callable[..., Dict] = _default_verify_id_token,
     fetch_jwks: Callable[[str], Awaitable[Dict]] = _default_fetch_jwks,
 ) -> APIRouter:
@@ -86,7 +101,19 @@ def create_auth_router(
     @router.post("/register")
     async def register(req: UserRegister, request: Request):
         check_ip_rate_limit(client_ip(request), "register", max_calls=5, window_secs=3600)
-        if not open_registration:
+        invite_claim = bool(
+            invite_gate_enabled
+            and invite_authorized is not None
+            and invite_authorized(request)
+        )
+        if invite_gate_enabled and not invite_claim:
+            raise HTTPException(
+                status_code=403,
+                detail="유효한 서명 초대 권한이 필요합니다.",
+            )
+        # Closed public registration stays closed unless the operator enabled
+        # the invite gate and this exact request carries a valid signed claim.
+        if not open_registration and not invite_claim:
             raise HTTPException(status_code=403, detail="회원가입이 비활성화되어 있습니다. 관리자에게 문의하세요.")
         _enforce_password_policy(req.password)
         email = normalize_email(req.email)
@@ -127,7 +154,14 @@ def create_auth_router(
             "role": role,
             "is_admin": role == "admin",
         })
-        response.set_cookie(key="session_token", value=token, httponly=True, samesite="lax", max_age=session_ttl)
+        response.set_cookie(
+            key="session_token",
+            value=token,
+            httponly=True,
+            secure=secure_cookies,
+            samesite="lax",
+            max_age=session_ttl,
+        )
         return response
 
     @router.get("/auth/sso/config")
@@ -135,7 +169,7 @@ def create_auth_router(
         return public_sso_config()
 
     @router.get("/auth/sso/login")
-    async def sso_login():
+    async def sso_login(request: Request):
         settings = get_sso_settings()
         discovery = await get_sso_discovery()
         if not settings.get("enabled") or not discovery:
@@ -150,7 +184,19 @@ def create_auth_router(
             .rstrip(b"=")
             .decode("ascii")
         )
-        _sso_states[state] = (time.time(), nonce, code_verifier)
+        invite_claim = bool(
+            not invite_gate_enabled
+            or (
+                invite_authorized is not None
+                and invite_authorized(request)
+            )
+        )
+        _sso_states[state] = _SSOLoginState(
+            issued_at=time.time(),
+            nonce=nonce,
+            code_verifier=code_verifier,
+            invite_authorized=invite_claim,
+        )
         params = urlencode({
             "client_id": settings["client_id"],
             "response_type": "code",
@@ -165,12 +211,11 @@ def create_auth_router(
 
     @router.get("/auth/sso/callback")
     async def sso_callback(code: str = "", state: str = "", error: str = ""):
-        if error:
-            return RedirectResponse(f"/?sso_error={error}")
         entry = _sso_states.pop(state, None)
-        if entry is None or time.time() - entry[0] > 300:
+        if entry is None or time.time() - entry.issued_at > 300:
             raise HTTPException(status_code=400, detail="유효하지 않은 SSO 상태입니다.")
-        _, nonce, code_verifier = entry
+        if error:
+            return RedirectResponse(f"/?{urlencode({'sso_error': error})}")
         settings = get_sso_settings()
         discovery = await get_sso_discovery()
         if not settings.get("enabled") or not discovery:
@@ -183,7 +228,7 @@ def create_auth_router(
                 "redirect_uri": settings["redirect_uri"],
                 "client_id": settings["client_id"],
                 "client_secret": settings["client_secret"],
-                "code_verifier": code_verifier,
+                "code_verifier": entry.code_verifier,
             }, headers={"Accept": "application/json"}, timeout=15)
             tokens = r.json()
         id_token = tokens.get("id_token")
@@ -200,7 +245,7 @@ def create_auth_router(
                 jwks=jwks,
                 issuer=issuer,
                 audience=settings["client_id"],
-                nonce=nonce,
+                nonce=entry.nonce,
             )
         except OIDCValidationError as exc:
             logging.warning("SSO ID token rejected: %s", exc)
@@ -213,6 +258,11 @@ def create_auth_router(
             raise HTTPException(status_code=400, detail="이메일을 확인할 수 없습니다.")
         users = load_users()
         if email not in users:
+            if invite_gate_enabled and not entry.invite_authorized:
+                raise HTTPException(
+                    status_code=403,
+                    detail="신규 SSO 계정에는 유효한 서명 초대 권한이 필요합니다.",
+                )
             is_first = len(users) == 0
             users[email] = {
                 "password": "",
@@ -229,7 +279,14 @@ def create_auth_router(
             raise HTTPException(status_code=403, detail="비활성화된 계정입니다.")
         token = create_session(email)
         resp = RedirectResponse("/app", status_code=302)
-        resp.set_cookie("session_token", token, httponly=True, samesite="lax", max_age=session_ttl)
+        resp.set_cookie(
+            "session_token",
+            token,
+            httponly=True,
+            secure=secure_cookies,
+            samesite="lax",
+            max_age=session_ttl,
+        )
         return resp
 
     @router.post("/logout")
@@ -238,7 +295,12 @@ def create_auth_router(
         if token:
             invalidate_session(token)
         response = JSONResponse(content={"status": "ok"})
-        response.delete_cookie("session_token")
+        response.delete_cookie(
+            "session_token",
+            secure=secure_cookies,
+            httponly=True,
+            samesite="lax",
+        )
         return response
 
     @router.post("/account/change-password")