npm - ltcai - Versions diffs - 8.9.0 → 9.1.0 - Mend

ltcai 8.9.0 → 9.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (208) hide show

package/README.md +81 -58
package/auto_setup.py +7 -904
package/desktop/electron/README.md +9 -0
package/desktop/electron/main.cjs +5 -3
package/docs/CHANGELOG.md +221 -238
package/docs/COMMUNITY_AND_PLUGINS.md +3 -2
package/docs/DEVELOPMENT.md +53 -14
package/docs/LEGACY_COMPATIBILITY.md +4 -4
package/docs/ONBOARDING.md +10 -2
package/docs/OPERATIONS.md +8 -4
package/docs/PRODUCT_DIRECTION_REVIEW.md +4 -0
package/docs/ROADMAP_RECOMMENDATIONS.md +61 -36
package/docs/TRUST_MODEL.md +5 -2
package/docs/WHY_LATTICE.md +15 -10
package/docs/WORKFLOW_DESIGNER.md +22 -0
package/docs/kg-schema.md +13 -2
package/docs/mcp-tools.md +17 -6
package/docs/privacy.md +19 -3
package/docs/public-deploy.md +32 -3
package/docs/security-model.md +46 -11
package/lattice_brain/__init__.py +1 -1
package/lattice_brain/archive.py +4 -14
package/lattice_brain/context.py +66 -9
package/lattice_brain/embeddings.py +38 -2
package/lattice_brain/graph/_kg_common.py +27 -462
package/lattice_brain/graph/_kg_constants.py +243 -0
package/lattice_brain/graph/_kg_fsutil.py +293 -0
package/lattice_brain/graph/discovery.py +0 -948
package/lattice_brain/graph/discovery_index.py +1126 -0
package/lattice_brain/graph/documents.py +44 -9
package/lattice_brain/graph/ingest.py +47 -20
package/lattice_brain/graph/provenance.py +13 -6
package/lattice_brain/graph/retrieval.py +141 -610
package/lattice_brain/graph/retrieval_docgen.py +243 -0
package/lattice_brain/graph/retrieval_vector.py +460 -0
package/lattice_brain/graph/store.py +6 -0
package/lattice_brain/ingestion.py +69 -4
package/lattice_brain/portability.py +29 -23
package/lattice_brain/quality.py +98 -4
package/lattice_brain/runtime/agent_runtime.py +169 -7
package/lattice_brain/runtime/hooks.py +30 -13
package/lattice_brain/runtime/multi_agent.py +27 -8
package/lattice_brain/runtime/statuses.py +10 -0
package/lattice_brain/utils.py +46 -0
package/lattice_brain/workflow.py +1 -5
package/latticeai/__init__.py +1 -1
package/latticeai/api/admin.py +1 -1
package/latticeai/api/agent_registry.py +10 -8
package/latticeai/api/agents.py +22 -3
package/latticeai/api/auth.py +78 -16
package/latticeai/api/browser.py +303 -34
package/latticeai/api/chat.py +355 -952
package/latticeai/api/chat_agent_http.py +356 -0
package/latticeai/api/chat_contracts.py +54 -0
package/latticeai/api/chat_documents.py +256 -0
package/latticeai/api/chat_helpers.py +250 -0
package/latticeai/api/chat_history.py +99 -0
package/latticeai/api/chat_intents.py +302 -0
package/latticeai/api/chat_stream.py +115 -0
package/latticeai/api/computer_use.py +211 -40
package/latticeai/api/health.py +9 -3
package/latticeai/api/hooks.py +17 -6
package/latticeai/api/knowledge_graph.py +78 -14
package/latticeai/api/local_files.py +7 -2
package/latticeai/api/marketplace.py +11 -0
package/latticeai/api/mcp.py +102 -23
package/latticeai/api/models.py +72 -33
package/latticeai/api/network.py +5 -5
package/latticeai/api/permissions.py +70 -29
package/latticeai/api/plugins.py +21 -7
package/latticeai/api/portability.py +5 -5
package/latticeai/api/realtime.py +33 -5
package/latticeai/api/setup.py +2 -2
package/latticeai/api/static_routes.py +123 -24
package/latticeai/api/tools.py +97 -14
package/latticeai/api/workflow_designer.py +37 -0
package/latticeai/api/workspace.py +2 -1
package/latticeai/app_factory.py +185 -405
package/latticeai/core/agent.py +19 -9
package/latticeai/core/agent_registry.py +1 -5
package/latticeai/core/config.py +23 -3
package/latticeai/core/context_builder.py +21 -3
package/latticeai/core/invitations.py +1 -4
package/latticeai/core/io_utils.py +45 -0
package/latticeai/core/legacy_compatibility.py +24 -3
package/latticeai/core/local_embeddings.py +2 -4
package/latticeai/core/marketplace.py +33 -2
package/latticeai/core/mcp_catalog.py +450 -0
package/latticeai/core/mcp_registry.py +2 -441
package/latticeai/core/plugins.py +15 -0
package/latticeai/core/policy.py +1 -1
package/latticeai/core/realtime.py +38 -15
package/latticeai/core/sessions.py +7 -2
package/latticeai/core/timeutil.py +10 -0
package/latticeai/core/tool_registry.py +90 -18
package/latticeai/core/users.py +5 -14
package/latticeai/core/workspace_graph_trace.py +31 -5
package/latticeai/core/workspace_memory.py +3 -1
package/latticeai/core/workspace_os.py +18 -7
package/latticeai/core/workspace_os_utils.py +2 -21
package/latticeai/core/workspace_permissions.py +2 -1
package/latticeai/core/workspace_plugins.py +1 -1
package/latticeai/core/workspace_runs.py +14 -5
package/latticeai/core/workspace_skills.py +1 -1
package/latticeai/core/workspace_snapshots.py +2 -1
package/latticeai/core/workspace_timeline.py +2 -1
package/latticeai/integrations/telegram_bot.py +96 -40
package/latticeai/models/model_providers.py +111 -0
package/latticeai/models/router.py +189 -173
package/latticeai/runtime/access_runtime.py +62 -4
package/latticeai/runtime/audit_runtime.py +27 -16
package/latticeai/runtime/automation_runtime.py +22 -7
package/latticeai/runtime/brain_runtime.py +19 -7
package/latticeai/runtime/chat_wiring.py +2 -0
package/latticeai/runtime/config_runtime.py +58 -26
package/latticeai/runtime/context_runtime.py +16 -4
package/latticeai/runtime/history_runtime.py +163 -0
package/latticeai/runtime/hooks_runtime.py +1 -1
package/latticeai/runtime/model_wiring.py +33 -5
package/latticeai/runtime/namespace_runtime.py +163 -0
package/latticeai/runtime/network_config_runtime.py +56 -0
package/latticeai/runtime/platform_runtime_wiring.py +4 -3
package/latticeai/runtime/review_wiring.py +1 -1
package/latticeai/runtime/router_registration.py +34 -1
package/latticeai/runtime/security_runtime.py +110 -13
package/latticeai/runtime/sso_config_runtime.py +128 -0
package/latticeai/runtime/stages.py +27 -0
package/latticeai/runtime/user_key_runtime.py +106 -0
package/latticeai/server_app.py +5 -1
package/latticeai/services/architecture_readiness.py +74 -5
package/latticeai/services/brain_automation.py +3 -26
package/latticeai/services/chat_service.py +205 -15
package/latticeai/services/local_knowledge.py +423 -0
package/latticeai/services/memory_service.py +268 -21
package/latticeai/services/model_engines.py +48 -33
package/latticeai/services/model_errors.py +17 -0
package/latticeai/services/model_loading.py +28 -25
package/latticeai/services/model_runtime.py +228 -162
package/latticeai/services/p_reinforce.py +22 -3
package/latticeai/services/platform_runtime.py +92 -24
package/latticeai/services/product_readiness.py +19 -17
package/latticeai/services/review_queue.py +76 -11
package/latticeai/services/router_context.py +1 -0
package/latticeai/services/run_executor.py +25 -9
package/latticeai/services/search_service.py +203 -28
package/latticeai/services/setup_detection.py +80 -0
package/latticeai/services/tool_dispatch.py +28 -5
package/latticeai/services/triggers.py +53 -4
package/latticeai/services/upload_service.py +13 -2
package/latticeai/setup/__init__.py +25 -0
package/latticeai/setup/auto_setup.py +857 -0
package/latticeai/setup/wizard.py +1264 -0
package/latticeai/tools/__init__.py +278 -0
package/{tools → latticeai/tools}/commands.py +67 -7
package/{tools → latticeai/tools}/computer.py +1 -1
package/{tools → latticeai/tools}/documents.py +1 -1
package/{tools → latticeai/tools}/filesystem.py +3 -3
package/latticeai/tools/knowledge.py +178 -0
package/{tools → latticeai/tools}/local_files.py +7 -1
package/{tools → latticeai/tools}/network.py +0 -1
package/local_knowledge_api.py +4 -342
package/package.json +22 -2
package/scripts/brain_quality_eval.py +3 -1
package/scripts/bump_version.py +3 -0
package/scripts/capture_release_evidence.mjs +180 -0
package/scripts/check_current_release_docs.mjs +142 -0
package/scripts/check_i18n_literals.mjs +107 -31
package/scripts/check_openapi_drift.mjs +56 -0
package/scripts/export_openapi.py +67 -7
package/scripts/i18n_literal_allowlist.json +22 -24
package/scripts/run_integration_tests.mjs +72 -10
package/scripts/validate_release_artifacts.py +49 -7
package/scripts/wheel_smoke.py +5 -0
package/setup_wizard.py +3 -1304
package/src-tauri/Cargo.lock +1 -1
package/src-tauri/Cargo.toml +1 -1
package/src-tauri/tauri.conf.json +1 -1
package/static/app/asset-manifest.json +11 -11
package/static/app/assets/Act-Bzz0bUyW.js +1 -0
package/static/app/assets/Brain-Dj2J20YA.js +321 -0
package/static/app/assets/Capture-CqlEl1Ga.js +1 -0
package/static/app/assets/Library-B03FP1Yx.js +1 -0
package/static/app/assets/System-80lHW0Ux.js +1 -0
package/static/app/assets/index-BiMofBTM.js +17 -0
package/static/app/assets/index-Bmx9rzTc.css +2 -0
package/static/app/assets/primitives-Q1A96_7v.js +1 -0
package/static/app/assets/textarea-D13RtnTo.js +1 -0
package/static/app/index.html +2 -2
package/static/css/tokens.css +4 -2
package/static/sw.js +1 -1
package/tools/__init__.py +21 -269
package/docs/CODE_REVIEW_2026-07-06.md +0 -764
package/latticeai/runtime/app_context_runtime.py +0 -13
package/latticeai/runtime/sso_runtime.py +0 -52
package/latticeai/runtime/tail_wiring.py +0 -21
package/scripts/com.pts.claudecode.discord.plist +0 -31
package/scripts/pts-claudecode-discord-bridge.mjs +0 -207
package/scripts/start-pts-claudecode-discord.sh +0 -51
package/static/app/assets/Act-fZokUnC0.js +0 -1
package/static/app/assets/Brain-DtyuWubr.js +0 -321
package/static/app/assets/Capture-D5KV3Cu7.js +0 -1
package/static/app/assets/Library-C9kyFkSt.js +0 -1
package/static/app/assets/System-VbChmX7r.js +0 -1
package/static/app/assets/index-DCh5AoXt.css +0 -2
package/static/app/assets/index-DPdcPoF0.js +0 -17
package/static/app/assets/primitives-DFeanEV6.js +0 -1
package/static/app/assets/textarea-CD8UNKIy.js +0 -1
package/tools/knowledge.py +0 -95

package/latticeai/api/static_routes.py CHANGED Viewed

@@ -2,7 +2,11 @@
 from __future__ import annotations
+import hashlib
+import hmac
+import secrets
 import subprocess
+import time
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Callable, Optional
@@ -26,6 +30,66 @@ PRODUCTION_CSP = (
     "frame-ancestors 'none'"
 )
+INVITE_COOKIE_NAME = "lattice_invite"
+INVITE_COOKIE_TTL_SECONDS = 60 * 60 * 24 * 7
+def _sign_invite_cookie(secret: str, *, now: Optional[int] = None) -> str:
+    """Create an expiring, nonce-bearing invite-gate capability cookie."""
+    issued_at = int(time.time() if now is None else now)
+    expires_at = issued_at + INVITE_COOKIE_TTL_SECONDS
+    nonce = secrets.token_urlsafe(24)
+    payload = f"{expires_at}.{nonce}"
+    signature = hmac.new(
+        str(secret).encode("utf-8"),
+        payload.encode("utf-8"),
+        hashlib.sha256,
+    ).hexdigest()
+    return f"v1.{payload}.{signature}"
+def _verify_invite_cookie(
+    value: Optional[str],
+    secret: str,
+    *,
+    now: Optional[int] = None,
+) -> bool:
+    """Verify version, expiry and HMAC without trusting client claims."""
+    if not value or not secret:
+        return False
+    try:
+        version, raw_expiry, nonce, supplied_signature = value.split(".", 3)
+        expires_at = int(raw_expiry)
+    except (TypeError, ValueError):
+        return False
+    if version != "v1" or not nonce or expires_at <= int(time.time() if now is None else now):
+        return False
+    payload = f"{expires_at}.{nonce}"
+    expected_signature = hmac.new(
+        str(secret).encode("utf-8"),
+        payload.encode("utf-8"),
+        hashlib.sha256,
+    ).hexdigest()
+    return hmac.compare_digest(supplied_signature, expected_signature)
+def _invite_denied_response() -> HTMLResponse:
+    return HTMLResponse(
+        content="""
+            <body style="background:#0f1115; color:white; display:flex; flex-direction:column; align-items:center; justify-content:center; height:100vh; font-family:sans-serif;">
+                <div style="background:#16191f; padding:40px; border-radius:24px; border:1px solid rgba(255,255,255,0.1); text-align:center; box-shadow: 0 20px 40px rgba(0,0,0,0.5);">
+                    <div style="font-size:48px; margin-bottom:20px;">🔒</div>
+                    <h1 style="color:#378ADD; margin:0; font-size:24px;">Invitation Required</h1>
+                    <p style="color:#94a3b8; margin:20px 0; line-height:1.6;">이 서비스는 비공개로 운영되고 있습니다.<br>선생님께 받은 <b>초대용 전용 링크</b>를 통해 접속해 주세요.</p>
+                    <div style="margin-top:30px; padding-top:20px; border-top:1px solid rgba(255,255,255,0.05); font-size:11px; color:rgba(255,255,255,0.2); letter-spacing:1px;">LATTICE AI</div>
+                </div>
+            </body>
+        """,
+        status_code=403,
+    )
 def ui_file_response(path: Path) -> FileResponse:
     response = FileResponse(path)
@@ -40,6 +104,7 @@ class StaticRoutesBundle:
     router: APIRouter
     ui_file_response: Callable[[Path], FileResponse]
     local_sysinfo: Callable[[Request], object]
+    invite_authorized: Callable[[Request], bool]
 def create_static_routes_router(
@@ -50,46 +115,69 @@ def create_static_routes_router(
     app_mode: str,
     model_router,
     require_user,
+    invite_cookie_secret: str = "",
+    secure_cookies: bool = False,
 ) -> StaticRoutesBundle:
     api_router = APIRouter()
     STATIC_DIR = static_dir
     INVITE_GATE_ENABLED = invite_gate_enabled
     INVITE_CODE = invite_code
+    INVITE_COOKIE_SECRET = invite_cookie_secret or secrets.token_urlsafe(48)
+    SECURE_COOKIES = bool(secure_cookies)
     APP_MODE = app_mode
     router = model_router
+    def invite_authorized(request: Request) -> bool:
+        """Verify the request's signed invite claim at every gated boundary."""
+        if not INVITE_GATE_ENABLED:
+            return True
+        return _verify_invite_cookie(
+            request.cookies.get(INVITE_COOKIE_NAME),
+            INVITE_COOKIE_SECRET,
+        )
     @api_router.get("/")
-    async def root(request: Request, code: Optional[str] = None, authorized: Optional[str] = Cookie(None)):
+    async def root(
+        request: Request,
+        code: Optional[str] = None,
+        invite_cookie: Optional[str] = Cookie(None, alias=INVITE_COOKIE_NAME),
+    ):
         """로그인/회원가입 페이지. 초대 게이트 활성화 시 코드 검증 후 진입."""
         if not INVITE_GATE_ENABLED:
             return app_redirect("account", request)
-        # 1. 이미 쿠키로 인증된 경우
-        if authorized == "true":
-            return app_redirect("account", request)
+        # 1. 유효한 서버 서명 쿠키가 있는 경우
+        if invite_authorized(request):
+            return app_redirect("account")
         # 2. 초대 코드가 일치하는 경우 (최초 진입)
-        if code == INVITE_CODE:
-            response = app_redirect("account", request)
-            response.set_cookie(key="authorized", value="true", httponly=True, samesite="lax", max_age=60*60*24*7)
+        if INVITE_CODE and code and secrets.compare_digest(code, INVITE_CODE):
+            # Do not retain the invitation code in the redirect URL/history.
+            response = app_redirect("account")
+            response.set_cookie(
+                key=INVITE_COOKIE_NAME,
+                value=_sign_invite_cookie(INVITE_COOKIE_SECRET),
+                httponly=True,
+                secure=SECURE_COOKIES,
+                samesite="lax",
+                max_age=INVITE_COOKIE_TTL_SECONDS,
+                path="/",
+            )
             return response
         # 3. 인증 실패 시 차단 화면
-        return HTMLResponse(content="""
-            <body style="background:#0f1115; color:white; display:flex; flex-direction:column; align-items:center; justify-content:center; height:100vh; font-family:sans-serif;">
-                <div style="background:#16191f; padding:40px; border-radius:24px; border:1px solid rgba(255,255,255,0.1); text-align:center; box-shadow: 0 20px 40px rgba(0,0,0,0.5);">
-                    <div style="font-size:48px; margin-bottom:20px;">🔒</div>
-                    <h1 style="color:#378ADD; margin:0; font-size:24px;">Invitation Required</h1>
-                    <p style="color:#94a3b8; margin:20px 0; line-height:1.6;">이 서비스는 비공개로 운영되고 있습니다.<br>선생님께 받은 <b>초대용 전용 링크</b>를 통해 접속해 주세요.</p>
-                    <div style="margin-top:30px; padding-top:20px; border-top:1px solid rgba(255,255,255,0.05); font-size:11px; color:rgba(255,255,255,0.2); letter-spacing:1px;">LATTICE AI</div>
-                </div>
-            </body>
-        """, status_code=403)
+        return _invite_denied_response()
     @api_router.get("/account")
-    async def account_page():
+    async def account_page(
+        request: Request,
+        invite_cookie: Optional[str] = Cookie(None, alias=INVITE_COOKIE_NAME),
+    ):
         """Direct login/register page route used by logout and manual navigation."""
+        if INVITE_GATE_ENABLED and not invite_authorized(request):
+            return _invite_denied_response()
         return app_redirect("account")
@@ -127,8 +215,13 @@ def create_static_routes_router(
     @api_router.get("/app")
-    async def app_shell(request: Request):
+    async def app_shell(
+        request: Request,
+        invite_cookie: Optional[str] = Cookie(None, alias=INVITE_COOKIE_NAME),
+    ):
         """React desktop single-page workspace shell."""
+        if INVITE_GATE_ENABLED and not invite_authorized(request):
+            return _invite_denied_response()
         page = STATIC_DIR / "app" / "index.html"
         if not page.exists():
             raise HTTPException(status_code=404, detail="React shell not found.")
@@ -143,8 +236,9 @@ def create_static_routes_router(
     # (latticeai.api.workspace), included below after its dependencies are defined.
     @api_router.get("/status")
-    async def status():
+    async def status(request: Request):
         """서버 상태 및 현재 로드된 모델 정보를 반환합니다."""
+        require_user(request)
         return {
             "message": "🧠 Lattice AI MLX Server is running!",
             "status": "online",
@@ -193,4 +287,9 @@ def create_static_routes_router(
             result["error"] = str(e)
         return result
-    return StaticRoutesBundle(api_router, ui_file_response, local_sysinfo)
+    return StaticRoutesBundle(
+        api_router,
+        ui_file_response,
+        local_sysinfo,
+        invite_authorized,
+    )

package/latticeai/api/tools.py CHANGED Viewed

@@ -31,8 +31,7 @@ from latticeai.services.tool_dispatch import (
     tool_registry_manifest,
 )
 from latticeai.services.router_context import ToolRouterContext
-from latticeai.services.p_reinforce import BRAIN_DIR
-from tools import (
+from latticeai.tools import (
     AGENT_ROOT,
     ToolError,
     build_project,
@@ -51,6 +50,7 @@ from tools import (
     inspect_html,
     knowledge_save,
     knowledge_search,
+    knowledge_scope_root,
     knowledge_tree,
     list_dir,
     network_status,
@@ -207,6 +207,7 @@ def create_tools_router(
     mcp_public_item=None,
     hooks=None,
     allowed_workspaces_for=None,
+    workspace_service=None,
 ) -> APIRouter:
     if tool_context is not None:
         config = tool_context.config
@@ -233,6 +234,7 @@ def create_tools_router(
         mcp_public_item = tool_context.mcp_public_item
         hooks = tool_context.hooks
         allowed_workspaces_for = tool_context.allowed_workspaces_for
+        workspace_service = tool_context.workspace_service
     api_router = APIRouter()
     HOOKS = hooks
@@ -313,6 +315,37 @@ def create_tools_router(
         if require_auth and user_email and allowed_workspaces_for is not None:
             scope["allowed_workspaces"] = allowed_workspaces_for(user_email)
         return scope
+    def _requested_workspace(request: Request) -> Optional[str]:
+        return (
+            request.headers.get("X-Workspace-Id")
+            or request.query_params.get("workspace_id")
+            or None
+        )
+    def _knowledge_scope(request: Request, current_user: str, *, write: bool) -> Dict[str, str]:
+        # Preserve the historical shared vault only for explicit single-user,
+        # no-auth local mode. Authenticated deployments always partition by
+        # both authorized workspace and account.
+        if not bool(getattr(CONFIG, "require_auth", False)):
+            return {}
+        requested = _requested_workspace(request)
+        try:
+            if workspace_service is not None:
+                resolver = (
+                    workspace_service.resolve_write_scope
+                    if write
+                    else workspace_service.resolve_read_scope
+                )
+                workspace_id = resolver(requested, current_user)
+            else:
+                workspace_id = requested or "personal"
+                allowed = allowed_workspaces_for(current_user) if allowed_workspaces_for else None
+                if allowed is not None and workspace_id not in set(allowed):
+                    raise PermissionError(f"workspace '{workspace_id}' is not readable")
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+        return {"workspace_id": str(workspace_id), "user_email": current_user}
     @api_router.post("/tools/list_dir")
@@ -437,14 +470,23 @@ def create_tools_router(
     @api_router.post("/tools/read_document")
     async def tools_read_document(req: ToolPathRequest, request: Request):
         current_user = require_user(request)
-        if Path(req.path).expanduser().is_absolute():
+        raw_path = Path(req.path).expanduser()
+        target = raw_path.resolve() if raw_path.is_absolute() else (AGENT_ROOT / raw_path).resolve()
+        inside_agent_workspace = target == AGENT_ROOT or AGENT_ROOT in target.parents
+        if not inside_agent_workspace:
             permission_gateway.require_local_approval(
                 token=req.approval_token,
-                path=req.path,
+                path=str(target),
                 action="read",
                 user_email=current_user,
             )
-        return _tool_response(read_document, req.path, current_user=current_user)
+        return _tool_response(
+            read_document,
+            str(target),
+            current_user=current_user,
+            source="workspace" if inside_agent_workspace else "approved_local",
+            trusted_admin=True,
+        )
     @api_router.get("/tools/pdf_pages")
@@ -518,12 +560,14 @@ def create_tools_router(
             append_audit_event=append_audit_event,
             enforce_rate_limit=enforce_rate_limit,
             hooks=HOOKS,
+            workspace_service=workspace_service,
         )
     api_router.include_router(permissions_router)
     api_router.include_router(create_local_files_router(
         require_user=require_user,
+        require_admin=require_admin,
         tool_response=_tool_response,
         permission_gateway=permission_gateway,
         knowledge_graph=KNOWLEDGE_GRAPH,
@@ -534,6 +578,7 @@ def create_tools_router(
         hooks=HOOKS,
         data_dir=DATA_DIR,
         allowed_workspaces_for=allowed_workspaces_for,
+        workspace_service=workspace_service,
     ))
     api_router.include_router(create_computer_use_router(
         model_router=router,
@@ -541,51 +586,87 @@ def create_tools_router(
         tool_response=_tool_response,
         save_to_history=save_to_history,
         hooks=HOOKS,
+        append_audit_event=append_audit_event,
+        workspace_service=workspace_service,
     ))
     @api_router.post("/tools/knowledge_save")
     async def tools_knowledge_save(req: ToolKnowledgeSaveRequest, request: Request):
         current_user = require_user(request)
-        return _tool_response(knowledge_save, req.content, req.folder, req.title, current_user=current_user)
+        scope = _knowledge_scope(request, current_user, write=True)
+        return _tool_response(
+            knowledge_save,
+            req.content,
+            req.folder,
+            req.title,
+            current_user=current_user,
+            **scope,
+        )
     @api_router.post("/tools/knowledge_search")
     async def tools_knowledge_search(req: ToolKnowledgeSearchRequest, request: Request):
         current_user = require_user(request)
-        return _tool_response(knowledge_search, req.query, req.max_results, current_user=current_user)
+        scope = _knowledge_scope(request, current_user, write=False)
+        return _tool_response(
+            knowledge_search,
+            req.query,
+            req.max_results,
+            current_user=current_user,
+            **scope,
+        )
     @api_router.get("/tools/knowledge_tree")
     async def tools_knowledge_tree(request: Request):
         current_user = require_user(request)
-        return _tool_response(knowledge_tree, current_user=current_user)
+        scope = _knowledge_scope(request, current_user, write=False)
+        return _tool_response(knowledge_tree, current_user=current_user, **scope)
     @api_router.post("/tools/obsidian_save")
     async def tools_obsidian_save(req: ToolKnowledgeSaveRequest, request: Request):
         current_user = require_user(request)
-        return _tool_response(obsidian_save, req.content, req.folder, req.title, current_user=current_user)
+        scope = _knowledge_scope(request, current_user, write=True)
+        return _tool_response(
+            obsidian_save,
+            req.content,
+            req.folder,
+            req.title,
+            current_user=current_user,
+            **scope,
+        )
     @api_router.post("/tools/obsidian_search")
     async def tools_obsidian_search(req: ToolKnowledgeSearchRequest, request: Request):
         current_user = require_user(request)
-        return _tool_response(obsidian_search, req.query, req.max_results, current_user=current_user)
+        scope = _knowledge_scope(request, current_user, write=False)
+        return _tool_response(
+            obsidian_search,
+            req.query,
+            req.max_results,
+            current_user=current_user,
+            **scope,
+        )
     @api_router.get("/tools/obsidian_tree")
     async def tools_obsidian_tree(request: Request):
         current_user = require_user(request)
-        return _tool_response(obsidian_tree, current_user=current_user)
+        scope = _knowledge_scope(request, current_user, write=False)
+        return _tool_response(obsidian_tree, current_user=current_user, **scope)
     @api_router.get("/obsidian/status")
     async def obsidian_status(request: Request):
-        require_user(request)
+        current_user = require_user(request)
+        scope = _knowledge_scope(request, current_user, write=False)
+        root = knowledge_scope_root(**scope)
         return {
             "status": "ok",
-            "vault_root": str(BRAIN_DIR),
-            "folders": [path.name for path in BRAIN_DIR.iterdir() if path.is_dir()] if BRAIN_DIR.exists() else [],
+            "vault_root": str(root),
+            "folders": [path.name for path in root.iterdir() if path.is_dir()] if root.exists() else [],
             "ocr_engine": shutil.which("tesseract") or None,
         }
@@ -679,6 +760,8 @@ def create_tools_router(
         knowledge_graph=KNOWLEDGE_GRAPH,
         ingestion_pipeline=ingestion_pipeline,
         data_dir=DATA_DIR,
+        allowed_workspaces_for=allowed_workspaces_for,
+        workspace_service=workspace_service,
     ))
     return api_router

package/latticeai/api/workflow_designer.py CHANGED Viewed

@@ -13,6 +13,7 @@ actually drive plugins, skills, and multi-agent runs.
 from __future__ import annotations
+from copy import deepcopy
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional
@@ -283,6 +284,42 @@ def create_workflow_designer_router(
             store.list_workflows(workspace_id=scope).get("workflows"), recipe_id
         )
         if existing is not None:
+            existing_metadata = existing.get("metadata") or {}
+            if req.enabled and existing_metadata.get("automation_state") != "enabled":
+                enabled_nodes = deepcopy(existing.get("nodes") or definition["nodes"])
+                for node in enabled_nodes:
+                    if node.get("type") != "trigger":
+                        continue
+                    node["config"] = {
+                        **(node.get("config") or {}),
+                        "enabled": True,
+                        "review_queue": True,
+                        "consent_required": True,
+                    }
+                errors = validate_definition({
+                    "name": existing.get("name") or definition["name"],
+                    "nodes": enabled_nodes,
+                })
+                if errors:
+                    raise HTTPException(status_code=400, detail={"validation_errors": errors})
+                enabled_metadata = {
+                    **existing_metadata,
+                    "automation_state": "enabled",
+                    "requires_user_enable": False,
+                }
+                existing = store.update_workflow_definition(
+                    str(existing.get("id") or existing.get("workflow_id") or ""),
+                    name=existing.get("name") or definition["name"],
+                    nodes=enabled_nodes,
+                    metadata=enabled_metadata,
+                    workspace_id=scope,
+                )
+                append_audit_event(
+                    "brain_automation_recipe_enabled",
+                    user_email=current_user,
+                    workflow_id=existing.get("id"),
+                    recipe_id=recipe_id,
+                )
             return {
                 "workflow": existing,
                 "recipe": existing.get("metadata") or definition["metadata"],

package/latticeai/api/workspace.py CHANGED Viewed

@@ -290,7 +290,7 @@ def create_workspace_router(context: AppContext) -> APIRouter:
         # not_recommended) for this machine, used by the onboarding model step.
         catalog = None
         try:
-            from auto_setup import probe as auto_setup_probe
+            from latticeai.setup.auto_setup import probe as auto_setup_probe
             from latticeai.services.model_recommendation import recommend_catalog
             profile = await asyncio.to_thread(lambda: auto_setup_probe().to_json())
             catalog = recommend_catalog(profile, engine="local_mlx")
@@ -714,6 +714,7 @@ def create_workspace_router(context: AppContext) -> APIRouter:
                     req.action,
                     user_email=current_user or None,
                     source="vscode",
+                    workspace_id=workflow.get("workspace_id"),
                     metadata={
                         "file_path": req.file_path,
                         "language": req.language,