ltcai 9.0.0 → 9.1.0

package/latticeai/api/health.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 import asyncio
 from typing import Callable, List, Optional
 
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, HTTPException, Request
 
 
 def create_health_router(
@@ -25,6 +25,10 @@ def create_health_router(
     router = APIRouter()
     svc = model_service
 
+    def _require_sensitive_status_access(request: Request) -> None:
+        if require_auth and not get_current_user(request):
+            raise HTTPException(status_code=401, detail="인증이 필요합니다.")
+
     @router.get("/health")
     async def health(request: Request):
         base = svc.health_base(version=app_version, mode=app_mode)
@@ -35,11 +39,13 @@ def create_health_router(
 
     @router.get("/mode")
     @router.get("/runtime_features")
-    async def mode():
+    async def mode(request: Request):
+        _require_sensitive_status_access(request)
         return svc.runtime()
 
     @router.get("/engines")
-    async def engines():
+    async def engines(request: Request):
+        _require_sensitive_status_access(request)
         return svc.engines_payload(await asyncio.to_thread(engine_status))
 
     return router

package/latticeai/api/hooks.py

@@ -46,10 +46,21 @@ def create_hooks_router(
     *,
     registry: HooksRegistry,
     require_user: Callable[[Request], str],
+    require_admin: Callable[[Request], tuple],
     append_audit_event: Callable[..., None],
 ) -> APIRouter:
     router = APIRouter()
 
+    def _require_admin_email(request: Request) -> str:
+        """Authorize a hook mutation and return the acting administrator."""
+        result = require_admin(request)
+        if isinstance(result, tuple):
+            return str(result[0] or "")
+        # Keep the router tolerant of small test/runtime adapters that return
+        # only the identity while the production access runtime returns
+        # ``(email, users)``.
+        return str(result or "")
+
     @router.get("/api/hooks")
     async def list_hooks(request: Request, kind: Optional[str] = None):
         require_user(request)
@@ -67,7 +78,7 @@ def create_hooks_router(
         """Execute hooks now — by ``kind`` (all enabled hooks of that kind) or a
         single ``hook_id``. Returns the dispatch record so callers can see what
         ran, in what order, and whether the action was blocked."""
-        user = require_user(request)
+        user = _require_admin_email(request)
         try:
             if req.hook_id:
                 result = registry.run_hook(req.hook_id, event=req.event or None, payload=req.payload, user_email=user)
@@ -97,7 +108,7 @@ def create_hooks_router(
 
     @router.post("/api/hooks/enable")
     async def enable_hook(req: HookToggleRequest, request: Request):
-        user = require_user(request)
+        user = _require_admin_email(request)
         try:
             hook = registry.set_enabled(req.hook_id, req.enabled)
         except KeyError as exc:
@@ -107,7 +118,7 @@ def create_hooks_router(
 
     @router.post("/api/hooks/disable")
     async def disable_hook(req: HookToggleRequest, request: Request):
-        user = require_user(request)
+        user = _require_admin_email(request)
         try:
             hook = registry.set_enabled(req.hook_id, False)
         except KeyError as exc:
@@ -117,12 +128,12 @@ def create_hooks_router(
 
     @router.post("/api/hooks/reorder")
     async def reorder_hooks(req: HookReorderRequest, request: Request):
-        require_user(request)
+        _require_admin_email(request)
         return registry.reorder(req.kind, req.ordered_ids)
 
     @router.post("/api/hooks/register")
     async def register_hook(req: HookRegisterRequest, request: Request):
-        user = require_user(request)
+        user = _require_admin_email(request)
         try:
             entry = registry.register(
                 name=req.name,
@@ -139,7 +150,7 @@ def create_hooks_router(
 
     @router.delete("/api/hooks/{hook_id:path}")
     async def remove_hook(hook_id: str, request: Request):
-        user = require_user(request)
+        user = _require_admin_email(request)
         try:
             result = registry.remove(hook_id)
         except KeyError as exc:

package/latticeai/api/knowledge_graph.py

@@ -61,8 +61,10 @@ def create_knowledge_graph_router(
     require_graph: Callable[[], None],
     require_user: Callable[[Request], str],
     static_dir: Path,
+    require_admin: Optional[Callable[[Request], Any]] = None,
     allowed_workspaces_for: Optional[Callable[[Optional[str]], Any]] = None,
     ingestion_pipeline: Any = None,
+    workspace_service: Any = None,
 ) -> APIRouter:
     router = APIRouter()
 
@@ -75,9 +77,9 @@ def create_knowledge_graph_router(
 
         Returns ``(graph, allowed)``. ``allowed is None`` means no scoping
         (single-user / no-auth mode); otherwise it is the set of workspace ids
-        the caller may read. Legacy-global rows (no workspace) stay visible —
-        the documented pre-v4 compatibility behavior enforced by
-        ``filter_scoped_nodes``.
+        the caller may read. Legacy-global rows are private by default in this
+        multi-user path; maintenance callers can opt in only through the store
+        API's explicit ``include_legacy_global=True`` argument.
         """
         user = require_user(request)
         allowed = None
@@ -85,6 +87,39 @@ def create_knowledge_graph_router(
             allowed = allowed_workspaces_for(user)
         return graph(), allowed
 
+    def _filter_scoped(kg: Any, items: Any, allowed: Any) -> list:
+        """Apply the fail-closed v2 scope contract, including to old stores."""
+
+        candidates = list(items)
+        try:
+            return kg.filter_scoped_nodes(
+                candidates,
+                allowed,
+                include_legacy_global=False,
+            )
+        except TypeError:
+            # A pre-hardening store may still interpret missing ids as global.
+            # Resolve authoritative scopes directly and keep only known rows in
+            # an allowed workspace instead of invoking that legacy behavior.
+            scopes = kg.workspaces_of([item.get("id") for item in candidates])
+            allowed_ids = {str(item) for item in allowed if item}
+            return [
+                item
+                for item in candidates
+                if str(item.get("id") or "") in scopes
+                and scopes[str(item.get("id") or "")] is not None
+                and str(scopes[str(item.get("id") or "")]) in allowed_ids
+            ]
+
+    def _write_workspace(request: Request, user: str) -> Optional[str]:
+        requested = _workspace_scope_from_request(request)
+        if workspace_service is None:
+            return requested
+        try:
+            return workspace_service.resolve_write_scope(requested, user or None)
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+
     @router.get("/graph")
     async def knowledge_graph_page(request: Request):
         """Serve the interactive knowledge graph canvas UI."""
@@ -101,7 +136,11 @@ def create_knowledge_graph_router(
 
     @router.post("/knowledge-graph/curate")
     async def knowledge_graph_curate(request: Request):
-        require_user(request)
+        # Curation rewrites the shared graph and is therefore an administrative
+        # operation whenever role-based authentication is configured.  The
+        # fallback preserves the standalone/local router contract used by
+        # embedders that only provide ``require_user``.
+        (require_admin or require_user)(request)
         return graph().curate()
 
     @router.get("/knowledge-graph/provenance/coverage")
@@ -129,7 +168,25 @@ def create_knowledge_graph_router(
         kg, allowed = _scoped(request)
         if allowed is None:
             return kg.graph(limit)
-        return kg.graph(limit, allowed_workspaces=allowed)
+        try:
+            return kg.graph(
+                limit,
+                allowed_workspaces=allowed,
+                include_legacy_global=False,
+            )
+        except TypeError:
+            payload = kg.graph(limit)
+            nodes = _filter_scoped(kg, payload.get("nodes", []), allowed)
+            kept = {node.get("id") for node in nodes}
+            return {
+                **payload,
+                "nodes": nodes,
+                "edges": [
+                    edge
+                    for edge in payload.get("edges", [])
+                    if edge.get("from") in kept and edge.get("to") in kept
+                ],
+            }
 
     @router.get("/knowledge-graph/documents")
     async def knowledge_graph_documents(request: Request, limit: int = 200):
@@ -141,7 +198,7 @@ def create_knowledge_graph_router(
         kg, allowed = _scoped(request)
         payload = kg.list_documents(limit)
         if allowed is not None:
-            documents = kg.filter_scoped_nodes(payload.get("documents", []), allowed)
+            documents = _filter_scoped(kg, payload.get("documents", []), allowed)
             payload = {**payload, "documents": documents, "total": len(documents)}
         return payload
 
@@ -152,7 +209,10 @@ def create_knowledge_graph_router(
             return {"query": q, "matches": []}
         payload = kg.search(q, limit)
         if allowed is not None:
-            payload = {**payload, "matches": kg.filter_scoped_nodes(payload.get("matches", []), allowed)}
+            payload = {
+                **payload,
+                "matches": _filter_scoped(kg, payload.get("matches", []), allowed),
+            }
         return payload
 
     @router.get("/knowledge-graph/context")
@@ -162,7 +222,7 @@ def create_knowledge_graph_router(
             return {"query": q, "context": kg.context_for_query(q, limit)}
         # Scoped mode: derive context from scope-filtered search matches so the
         # RAG context never carries content from workspaces the caller can't read.
-        matches = kg.filter_scoped_nodes(kg.search(q, limit).get("matches", []), allowed)
+        matches = _filter_scoped(kg, kg.search(q, limit).get("matches", []), allowed)
         return {"query": q, "context": _format_context(matches, limit)}
 
     @router.get("/knowledge-graph/neighbors/{node_id:path}")
@@ -170,11 +230,11 @@ def create_knowledge_graph_router(
         kg, allowed = _scoped(request)
         if not node_id:
             raise HTTPException(status_code=400, detail="node_id required")
-        if allowed is not None and not kg.filter_scoped_nodes([{"id": node_id}], allowed):
+        if allowed is not None and not _filter_scoped(kg, [{"id": node_id}], allowed):
             raise HTTPException(status_code=404, detail="node not found")
         payload = kg.neighbors(node_id)
         if allowed is not None:
-            neighbors = kg.filter_scoped_nodes(payload.get("neighbors", []), allowed)
+            neighbors = _filter_scoped(kg, payload.get("neighbors", []), allowed)
             kept = {n.get("id") for n in neighbors}
             edges = [
                 e for e in payload.get("edges", [])
@@ -187,8 +247,12 @@ def create_knowledge_graph_router(
     @router.post("/knowledge-graph/ingest")
     async def knowledge_graph_ingest(req: KnowledgeGraphIngestRequest, request: Request):
         current_user = require_user(request)
+        if current_user and req.user_email:
+            if current_user.strip().lower() != req.user_email.strip().lower():
+                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+        effective_user = current_user or req.user_email or None
         kg = graph()
-        workspace_id = _workspace_scope_from_request(request)
+        workspace_id = _write_workspace(request, current_user)
         event_type = (req.type or "").strip().lower()
         if event_type not in {"message", "ai_response", "note"}:
             raise HTTPException(status_code=400, detail="지원하는 type: message, ai_response, note")
@@ -201,7 +265,7 @@ def create_knowledge_graph_router(
                     title=req.title,
                     text=req.content,
                     source_uri=req.source,
-                    owner=req.user_email or current_user,
+                    owner=effective_user,
                     workspace_id=workspace_id,
                     conversation_id=req.conversation_id,
                     metadata={
@@ -219,7 +283,7 @@ def create_knowledge_graph_router(
                         **(req.metadata or {}),
                     },
                 ),
-                user_email=req.user_email or current_user,
+                user_email=effective_user,
             )
             if result.status != "ok":
                 raise HTTPException(status_code=500, detail=result.detail or result.status)
@@ -227,7 +291,7 @@ def create_knowledge_graph_router(
         return kg.ingest_message(
             role,
             req.content,
-            user_email=req.user_email or current_user,
+            user_email=effective_user,
             user_nickname=req.user_nickname,
             source=req.source or "mcp",
             conversation_id=req.conversation_id,

package/latticeai/api/local_files.py

@@ -15,8 +15,8 @@ from fastapi.responses import FileResponse
 from pydantic import BaseModel
 
 from latticeai.api.knowledge_graph import create_knowledge_graph_router
-from local_knowledge_api import create_local_knowledge_router
-from tools import local_list, local_read, local_write
+from latticeai.services.local_knowledge import create_local_knowledge_router
+from latticeai.tools import local_list, local_read, local_write
 
 try:
     from latticeai import __version__ as _LATTICE_VERSION
@@ -40,6 +40,7 @@ class LocalWriteRequest(BaseModel):
 def create_local_files_router(
     *,
     require_user,
+    require_admin=None,
     tool_response,
     permission_gateway,
     knowledge_graph,
@@ -50,6 +51,7 @@ def create_local_files_router(
     hooks=None,
     data_dir: Optional[Path] = None,
     allowed_workspaces_for=None,
+    workspace_service=None,
 ) -> APIRouter:
     router = APIRouter()
 
@@ -211,9 +213,11 @@ def create_local_files_router(
             get_graph=lambda: knowledge_graph,
             require_graph=require_graph,
             require_user=require_user,
+            require_admin=require_admin,
             static_dir=static_dir,
             allowed_workspaces_for=allowed_workspaces_for,
             ingestion_pipeline=ingestion_pipeline,
+            workspace_service=workspace_service,
         )
     )
 
@@ -227,6 +231,7 @@ def create_local_files_router(
             require_local_approval=permission_gateway.require_local_approval,
             watcher=local_kg_watcher,
             hooks=hooks,
+            workspace_service=workspace_service,
         )
     )
 

package/latticeai/api/mcp.py

@@ -29,9 +29,13 @@ from latticeai.core.mcp_registry import (
     install_skill,
     SKILLS_DIR,
 )
-from latticeai.core.tool_registry import MCP_TOOL_DESCRIPTIONS
-from latticeai.services.tool_dispatch import enforce_tool_policy
-from tools import AGENT_ROOT, execute_tool
+from latticeai.core.tool_registry import (
+    KNOWLEDGE_WRITE_TOOLS,
+    MCP_TOOL_DESCRIPTIONS,
+    SCOPED_KNOWLEDGE_TOOLS,
+)
+from latticeai.services.tool_dispatch import EXPLICIT_CONSENT_TOOLS, enforce_tool_policy
+from latticeai.tools import execute_tool
 
 
 class McpRecommendRequest(BaseModel):
@@ -80,6 +84,8 @@ def create_mcp_router(
     knowledge_graph: Any,
     ingestion_pipeline: Any,
     data_dir: Path,
+    allowed_workspaces_for: Optional[Callable[[Optional[str]], Any]] = None,
+    workspace_service: Any = None,
 ) -> APIRouter:
     router = APIRouter()
 
@@ -106,30 +112,70 @@ def create_mcp_router(
         with open(_CUSTOM_MCP_FILE, "w", encoding="utf-8") as f:
             json.dump(items, f, ensure_ascii=False, indent=2)
 
+    def _public_env_vars(items: Any) -> List[Dict[str, Any]]:
+        return [
+            {"name": str(item.get("name") or ""), "configured": bool(item.get("value"))}
+            for item in (items or [])
+            if isinstance(item, dict) and item.get("name")
+        ]
+
+    def _allowed_graph_workspaces(user: Optional[str]):
+        return allowed_workspaces_for(user) if allowed_workspaces_for is not None else None
+
+    def _write_workspace(requested: Optional[str], user: Optional[str]) -> Optional[str]:
+        if workspace_service is None:
+            return requested
+        try:
+            return workspace_service.resolve_write_scope(requested, user)
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+
+    def _read_workspace(requested: Optional[str], user: Optional[str]) -> Optional[str]:
+        if workspace_service is not None:
+            try:
+                return workspace_service.resolve_read_scope(requested, user)
+            except PermissionError as exc:
+                raise HTTPException(status_code=403, detail=str(exc)) from exc
+        workspace_id = requested or "personal"
+        allowed = _allowed_graph_workspaces(user)
+        if allowed is not None and workspace_id not in set(allowed):
+            raise HTTPException(status_code=403, detail=f"workspace '{workspace_id}' is not readable")
+        return workspace_id
+
     @router.get("/mcp/tools")
-    async def mcp_tools():
+    async def mcp_tools(request: Request):
+        require_user(request)
         installed = load_mcp_installs().get("installed", {})
         registry = await _get_combined_registry()
         tools = []
         for name, description in MCP_TOOL_DESCRIPTIONS.items():
+            if name in EXPLICIT_CONSENT_TOOLS:
+                continue
             policy = TOOL_GOVERNANCE.get(name, _TOOL_GOVERNANCE_DEFAULT)
+            governance = {
+                "risk":         policy["risk"],
+                "destructive":  policy["destructive"],
+                "shell":        policy["shell"],
+                "network":      policy["network"],
+                "auto_approve": policy["auto_approve"],
+                "sandbox":      policy["sandbox"],
+                "rollback":     policy["rollback"],
+            }
+            if policy.get("capability"):
+                governance["capability"] = policy["capability"]
+            if policy.get("scope"):
+                governance["scope"] = policy["scope"]
             tools.append({
                 "name": name,
                 "description": description,
                 "permission": get_tool_permission(name),
-                "governance": {
-                    "risk":         policy["risk"],
-                    "destructive":  policy["destructive"],
-                    "shell":        policy["shell"],
-                    "network":      policy["network"],
-                    "auto_approve": policy["auto_approve"],
-                    "sandbox":      policy["sandbox"],
-                    "rollback":     policy["rollback"],
-                },
+                "governance": governance,
             })
         return {
             "status": "ok",
-            "workspace": str(AGENT_ROOT),
+            # Do not disclose the host user's absolute checkout path through a
+            # discovery endpoint. Tool paths are workspace-relative already.
+            "workspace": ".",
             "installed_mcps": [mcp_public_item(item, installed) for item in registry],
             "tools": tools,
         }
@@ -178,7 +224,7 @@ def create_mcp_router(
     @router.get("/mcp/claude-code-servers")
     async def mcp_claude_code_servers(request: Request):
         """Read ~/.claude/settings.json mcpServers and return them as Lattice MCP items."""
-        require_user(request)
+        require_admin(request)
         settings_path = Path.home() / ".claude" / "settings.json"
         if not settings_path.exists():
             return {"servers": []}
@@ -192,7 +238,7 @@ def create_mcp_router(
                 args = cfg.get("args", [])
                 package = " ".join([cmd] + args) if args else cmd
                 env = cfg.get("env", {})
-                env_vars = [{"name": k, "value": v} for k, v in env.items()]
+                env_vars = [{"name": k, "configured": bool(v)} for k, v in env.items()]
                 servers.append({
                     "id": f"claude-code:{name}",
                     "name": name,
@@ -213,7 +259,12 @@ def create_mcp_router(
     async def mcp_custom_list(request: Request):
         """Return user-added custom MCP entries."""
         require_user(request)
-        return {"custom": _load_custom_mcps()}
+        items = []
+        for raw in _load_custom_mcps():
+            item = dict(raw)
+            item["env_vars"] = _public_env_vars(item.get("env_vars"))
+            items.append(item)
+        return {"custom": items}
 
     @router.post("/mcp/custom")
     async def mcp_custom_add(req: McpCustomRequest, request: Request):
@@ -362,18 +413,26 @@ def create_mcp_router(
             _require_graph()
             # v4: MCP messages enter the brain through the unified ingestion
             # pipeline (provenance + hook lifecycle), not a direct store call.
-            owner = args.get("user_email") or current_user
+            claimed_user = str(args.get("user_email") or "").strip()
+            if current_user and claimed_user and claimed_user.lower() != current_user.strip().lower():
+                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+            owner = current_user or claimed_user or None
+            workspace_id = _write_workspace(args.get("workspace_id"), owner)
+            raw = dict(args)
+            raw["user_email"] = owner
+            raw["workspace_id"] = workspace_id
             result = ingestion_pipeline.ingest(
                 IngestionItem(
                     source_type="mcp_message",
                     text=args.get("content") or "",
                     owner=owner,
+                    workspace_id=workspace_id,
                     conversation_id=args.get("conversation_id"),
                     metadata={
                         "role": args.get("role") or ("assistant" if args.get("type") == "ai_response" else "user"),
                         "user_nickname": args.get("user_nickname"),
                         "source": args.get("source") or "mcp",
-                        "raw": args,
+                        "raw": raw,
                     },
                 ),
                 user_email=owner,
@@ -381,19 +440,39 @@ def create_mcp_router(
             return result.as_dict()
         if req.action == "knowledge_graph_search":
             _require_graph()
-            return KNOWLEDGE_GRAPH.search(args.get("query") or args.get("q") or "", args.get("limit", 30))
+            return KNOWLEDGE_GRAPH.search(
+                args.get("query") or args.get("q") or "",
+                args.get("limit", 30),
+                allowed_workspaces=_allowed_graph_workspaces(current_user or None),
+            )
         if req.action == "knowledge_graph_graph":
             _require_graph()
-            return KNOWLEDGE_GRAPH.graph(args.get("limit", 300))
+            return KNOWLEDGE_GRAPH.graph(
+                args.get("limit", 300),
+                allowed_workspaces=_allowed_graph_workspaces(current_user or None),
+            )
         if req.action == "knowledge_graph_context":
             _require_graph()
             return {
                 "context": KNOWLEDGE_GRAPH.context_for_query(
                     args.get("query") or args.get("q") or "",
                     args.get("limit", 6),
+                    allowed_workspaces=_allowed_graph_workspaces(current_user or None),
                 )
             }
-        enforce_tool_policy(req.action, req.args or {}, current_user=current_user, source="mcp")
-        return _tool_response(execute_tool, req.action, req.args or {}, source="mcp")
+        dispatch_args = dict(req.args or {})
+        if req.action in SCOPED_KNOWLEDGE_TOOLS:
+            claimed_user = str(dispatch_args.get("user_email") or "").strip().lower()
+            if claimed_user and claimed_user != current_user.strip().lower():
+                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+            requested_workspace = dispatch_args.get("workspace_id")
+            if req.action in KNOWLEDGE_WRITE_TOOLS:
+                workspace_id = _write_workspace(requested_workspace, current_user)
+            else:
+                workspace_id = _read_workspace(requested_workspace, current_user)
+            dispatch_args["workspace_id"] = workspace_id
+            dispatch_args["user_email"] = current_user
+        enforce_tool_policy(req.action, dispatch_args, current_user=current_user, source="mcp")
+        return _tool_response(execute_tool, req.action, dispatch_args, source="mcp")
 
     return router