ltcai 9.0.0 → 9.1.0

package/latticeai/core/legacy_compatibility.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import Any, Dict, List
 
 
-LEGACY_COMPATIBILITY_VERSION = "9.0.0"
+LEGACY_COMPATIBILITY_VERSION = "9.1.0"
 
 
 @dataclass(frozen=True)
@@ -89,13 +89,34 @@ LEGACY_SHIMS: List[LegacyShim] = [
         reason="Deployment docs and local launch scripts historically targeted server.py.",
         removal_phase="major-release-after-8.x",
     ),
+    LegacyShim(
+        path="tools/",
+        owner="latticeai.tools",
+        replacement="from latticeai.tools import execute_tool",
+        reason="Existing integrations and tests import the historical root tools package.",
+        removal_phase="major-release-after-9.x",
+    ),
     LegacyShim(
         path="local_knowledge_api.py",
-        owner="latticeai.api.local_files",
-        replacement="from latticeai.api.local_files import create_local_files_router",
+        owner="latticeai.services.local_knowledge",
+        replacement="from latticeai.services.local_knowledge import create_local_knowledge_router",
         reason="Local folder ingestion integrations used the root local knowledge API.",
         removal_phase="requires-api-route-migration",
     ),
+    LegacyShim(
+        path="auto_setup.py",
+        owner="latticeai.setup.auto_setup",
+        replacement="from latticeai.setup.auto_setup import probe, recommend",
+        reason="Historical scripts invoke the zero-config setup module from the repo root.",
+        removal_phase="major-release-after-9.x",
+    ),
+    LegacyShim(
+        path="setup_wizard.py",
+        owner="latticeai.setup.wizard",
+        replacement="from latticeai.setup.wizard import scan_environment",
+        reason="Older integrations imported the setup wizard from the repo root.",
+        removal_phase="major-release-after-9.x",
+    ),
 ]
 
 # Shim layers that have completed their compatibility window and were

package/latticeai/core/marketplace.py

@@ -11,7 +11,7 @@ from copy import deepcopy
 from typing import Any, Dict, List, Optional
 
 
-MARKETPLACE_VERSION = "9.0.0"
+MARKETPLACE_VERSION = "9.1.0"
 TEMPLATE_KINDS = ("plugin", "workflow", "agent", "ingestion_bridge")
 
 

package/latticeai/core/plugins.py

@@ -403,6 +403,21 @@ class PluginRegistry:
                 reason=f"permission '{permission}' not granted at install time",
             ))
 
+        if capability == "tools":
+            tool_name = str(args.get("tool") or "").strip()
+            declared_tools = {
+                str(item).strip()
+                for item in (manifest.provides.get("tools") or [])
+                if str(item).strip()
+            }
+            if not tool_name or tool_name not in declared_tools:
+                return finish(PluginExecutionResult(
+                    plugin_id,
+                    action,
+                    "blocked",
+                    reason=f"tool '{tool_name or '<missing>'}' is not declared in provides.tools",
+                ))
+
         runner = runners.get(capability)
         if runner is None:
             return finish(PluginExecutionResult(

package/latticeai/core/policy.py

@@ -21,6 +21,7 @@ ROLE_CAPABILITIES: Dict[str, Set[str]] = {
         "search",
         "files",
         "pipeline",
+        "desktop:control",
     },
     "member": {"workspace:read", "workspace:write", "chat", "search", "files", "pipeline"},
     "user": {"workspace:read", "workspace:write", "chat", "search", "files", "pipeline"},
@@ -51,4 +52,3 @@ def require_capability(role: str, capability: str) -> None:
 def policy_matrix(roles: Iterable[str] | None = None) -> List[Dict[str, object]]:
     selected = list(roles or ROLE_CAPABILITIES.keys())
     return [{"role": normalize_role(role), "caps": capabilities_for_role(role)} for role in selected]
-

package/latticeai/core/realtime.py

@@ -29,10 +29,10 @@ from __future__ import annotations
 import asyncio
 import json
 import threading
-from datetime import datetime
-from typing import Any, AsyncIterator, Dict, List, Optional, Set
+from typing import Any, AsyncIterator, Callable, Dict, List, Optional, Set
 
 from lattice_brain.runtime.contracts import realtime_event_contract
+from .timeutil import now_iso as _now
 
 
 REALTIME_VERSION = "2.2.0"
@@ -40,10 +40,6 @@ _FEED_LIMIT = 200
 _QUEUE_MAX = 100
 
 
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 def sse_format(event: Dict[str, Any]) -> str:
     """Encode an event as an SSE ``data:`` frame."""
     return f"data: {json.dumps(event, ensure_ascii=False, default=str)}\n\n"
@@ -64,11 +60,11 @@ class _Subscriber:
             self.loop = None
 
     def accepts(self, workspace_id: Optional[str]) -> bool:
-        # ``None`` scope = see everything the local user can (personal/unscoped).
+        # Only the explicit no-auth/local ``None`` scope sees unscoped events.
+        # Any concrete set, including the authenticated fail-closed empty set,
+        # requires an exact workspace match.
         if self.workspace_scope is None:
             return True
-        if workspace_id is None:
-            return True
         return workspace_id in self.workspace_scope
 
 
@@ -142,21 +138,42 @@ class RealtimeBus:
         with self._lock:
             self._subscribers.pop(sub_id, None)
 
-    async def stream(self, sub: _Subscriber, *, heartbeat: float = 15.0) -> AsyncIterator[str]:
+    async def stream(
+        self,
+        sub: _Subscriber,
+        *,
+        heartbeat: float = 15.0,
+        refresh_authorization: Optional[Callable[[_Subscriber], bool]] = None,
+    ) -> AsyncIterator[str]:
         """Yield SSE frames for a subscriber until the client disconnects.
 
         Emits a periodic heartbeat comment so proxies keep the connection open
         and single-user local mode never looks "stuck" with no events.
         """
         # Replay a small tail so a fresh subscriber has immediate context.
+        if refresh_authorization is not None and not refresh_authorization(sub):
+            self.remove_subscriber(sub.id)
+            return
         for event in self.recent(limit=10, workspace_scope=sub.workspace_scope):
-            yield sse_format(event)
+            if refresh_authorization is not None and not refresh_authorization(sub):
+                self.remove_subscriber(sub.id)
+                return
+            if sub.accepts(event.get("workspace_id")):
+                yield sse_format(event)
         try:
             while True:
                 try:
                     event = await asyncio.wait_for(sub.queue.get(), timeout=heartbeat)
-                    yield sse_format(event)
+                    if refresh_authorization is not None and not refresh_authorization(sub):
+                        break
+                    # The event may have been queued under an older membership
+                    # snapshot. Recheck it against the refreshed scope before
+                    # any bytes leave the process.
+                    if sub.accepts(event.get("workspace_id")):
+                        yield sse_format(event)
                 except asyncio.TimeoutError:
+                    if refresh_authorization is not None and not refresh_authorization(sub):
+                        break
                     yield ": heartbeat\n\n"
         finally:
             self.remove_subscriber(sub.id)
@@ -167,7 +184,7 @@ class RealtimeBus:
         with self._lock:
             events = list(self._feed)
         if workspace_scope is not None:
-            events = [e for e in events if e.get("workspace_id") is None or e.get("workspace_id") in workspace_scope]
+            events = [e for e in events if e.get("workspace_id") in workspace_scope]
         return list(reversed(events[-max(1, min(limit, _FEED_LIMIT)):]))
 
     def join(self, client_id: str, *, user: Optional[str], workspace_id: Optional[str]) -> Dict[str, Any]:
@@ -179,6 +196,9 @@ class RealtimeBus:
             "last_seen": _now(),
         }
         with self._lock:
+            existing = self._presence.get(client_id)
+            if existing is not None and existing.get("user") != user:
+                raise PermissionError("Presence client belongs to another user.")
             self._presence[client_id] = record
         self.publish({"area": "presence", "event_type": "join", "workspace_id": workspace_id, "payload": {"user": user, "client_id": client_id}})
         return record
@@ -190,8 +210,11 @@ class RealtimeBus:
                 record["last_seen"] = _now()
             return record
 
-    def leave(self, client_id: str) -> None:
+    def leave(self, client_id: str, *, user: Optional[str] = None) -> None:
         with self._lock:
+            record = self._presence.get(client_id)
+            if record is not None and user is not None and record.get("user") != user:
+                raise PermissionError("Presence client belongs to another user.")
             record = self._presence.pop(client_id, None)
         if record:
             self.publish({"area": "presence", "event_type": "leave", "workspace_id": record.get("workspace_id"), "payload": {"client_id": client_id}})
@@ -200,7 +223,7 @@ class RealtimeBus:
         with self._lock:
             records = list(self._presence.values())
         if workspace_scope is not None:
-            records = [r for r in records if r.get("workspace_id") is None or r.get("workspace_id") in workspace_scope]
+            records = [r for r in records if r.get("workspace_id") in workspace_scope]
         return records
 
     def stats(self) -> Dict[str, Any]:

package/latticeai/core/sessions.py

@@ -15,6 +15,8 @@ import time
 from pathlib import Path
 from typing import Dict, Optional
 
+from latticeai.core.io_utils import atomic_write_json
+
 SESSION_TTL = 60 * 60 * 24  # 24 hours
 SESSION_REFRESH_THRESHOLD = 60 * 15  # only persist if >15 min since last bump
 _lock = threading.Lock()
@@ -39,7 +41,7 @@ def _sessions_file(data_dir: Optional[Path] = None) -> Path:
             import os
             data_dir = Path(os.getenv("LATTICEAI_DATA_DIR") or (Path.home() / ".ltcai"))
     d = data_dir
-    d.mkdir(parents=True, exist_ok=True)
+    d.mkdir(parents=True, exist_ok=True, mode=0o700)
     return d / "sessions.json"
 
 
@@ -68,7 +70,10 @@ def load_sessions(data_dir: Optional[Path] = None) -> Dict[str, tuple]:
 
 def persist_sessions(sessions: Dict[str, tuple], data_dir: Optional[Path] = None) -> None:
     try:
-        _sessions_file(data_dir).write_text(json.dumps({k: list(v) for k, v in sessions.items()}, ensure_ascii=False))
+        atomic_write_json(
+            _sessions_file(data_dir),
+            {key: list(value) for key, value in sessions.items()},
+        )
     except Exception as e:
         logging.warning("persist_sessions failed: %s", e)
 

package/latticeai/core/timeutil.py

@@ -0,0 +1,10 @@
+"""Canonical application timestamp helpers.
+
+Brain Core owns the dependency-free implementation so it remains independently
+importable; the application layer exposes the same helpers from this stable
+location for all LatticeAI services.
+"""
+
+from lattice_brain.utils import local_now, now_iso, parse_iso, utc_now_iso
+
+__all__ = ["local_now", "now_iso", "parse_iso", "utc_now_iso"]

package/latticeai/core/tool_registry.py

@@ -16,11 +16,13 @@ __all__ = [
     "FILE_CREATE_ACTIONS",
     "LOCAL_WRITE_BLOCKED_PREFIXES",
     "RISK_LEVEL_MAP",
+    "SCOPED_KNOWLEDGE_TOOLS",
+    "KNOWLEDGE_WRITE_TOOLS",
     "ToolRegistry",
 ]
 
 from dataclasses import dataclass, field
-from typing import Any, Callable, Dict, Mapping, Optional, TypedDict
+from typing import Any, Callable, Dict, Mapping, NotRequired, Optional, TypedDict
 
 
 class ToolPolicy(TypedDict):
@@ -31,6 +33,8 @@ class ToolPolicy(TypedDict):
     auto_approve: bool
     sandbox: str
     rollback: str
+    capability: NotRequired[str]
+    scope: NotRequired[str]
 
 
 class ToolPermission(TypedDict):
@@ -38,6 +42,8 @@ class ToolPermission(TypedDict):
     risk: str
     requires_approval: bool
     network: bool
+    capability: NotRequired[str]
+    scope: NotRequired[str]
 
 
 TOOL_CATALOG_BRIEF = """
@@ -80,6 +86,17 @@ RISK_LEVEL_MAP = {
     "destructive": "high",
 }
 
+SCOPED_KNOWLEDGE_TOOLS = frozenset({
+    "knowledge_save",
+    "knowledge_search",
+    "knowledge_tree",
+    "obsidian_save",
+    "obsidian_search",
+    "obsidian_tree",
+})
+
+KNOWLEDGE_WRITE_TOOLS = frozenset({"knowledge_save", "obsidian_save"})
+
 
 def _r(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
     return ToolPolicy(
@@ -88,6 +105,25 @@ def _r(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
     )
 
 
+def _rc(
+    sandbox: str = "home",
+    rollback: str = "none",
+    *,
+    capability: str = "",
+    scope: str = "",
+) -> ToolPolicy:
+    """Read operation that still requires explicit human consent."""
+    policy = ToolPolicy(
+        risk="read", destructive=False, shell=False, network=False,
+        auto_approve=False, sandbox=sandbox, rollback=rollback,
+    )
+    if capability:
+        policy["capability"] = capability
+    if scope:
+        policy["scope"] = scope
+    return policy
+
+
 def _rs(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
     return ToolPolicy(
         risk="read", destructive=False, shell=True, network=False,
@@ -102,11 +138,22 @@ def _rn(sandbox: str = "system", rollback: str = "none") -> ToolPolicy:
     )
 
 
-def _w(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
-    return ToolPolicy(
+def _w(
+    sandbox: str = "workspace",
+    rollback: str = "none",
+    *,
+    capability: str = "",
+    scope: str = "",
+) -> ToolPolicy:
+    policy = ToolPolicy(
         risk="write", destructive=False, shell=False, network=False,
         auto_approve=False, sandbox=sandbox, rollback=rollback,
     )
+    if capability:
+        policy["capability"] = capability
+    if scope:
+        policy["scope"] = scope
+    return policy
 
 
 def _wa(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
@@ -146,21 +193,37 @@ TOOL_GOVERNANCE: Dict[str, ToolPolicy] = {
     "inspect_html": _r(),
     "preview_url": _r(),
     "todo_read": _r(),
-    "local_list": _r(sandbox="home"),
-    "local_read": _r(sandbox="home"),
-    "read_document": _r(sandbox="home"),
+    "local_list": _rc(sandbox="home"),
+    "local_read": _rc(sandbox="home"),
+    "read_document": _rc(sandbox="home"),
     "git_status": _rs(),
     "git_diff": _rs(),
     "git_log": _rs(),
     "git_show": _rs(),
-    "knowledge_search": _r(sandbox="home"),
-    "knowledge_tree": _r(sandbox="home"),
-    "obsidian_search": _r(sandbox="home"),
-    "obsidian_tree": _r(sandbox="home"),
-    "computer_screenshot": _r(sandbox="system"),
-    "computer_status": _r(sandbox="system"),
-    "chrome_status": _r(sandbox="system"),
-    "computer_use_status": _r(sandbox="system"),
+    "knowledge_search": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "knowledge_tree": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "obsidian_search": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "obsidian_tree": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "computer_screenshot": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
+    "computer_status": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
+    "chrome_status": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
+    "computer_use_status": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
     "network_status": _rn(),
     "write_file": _w(rollback="git"),
     "edit_file": _w(rollback="git"),
@@ -170,8 +233,12 @@ TOOL_GOVERNANCE: Dict[str, ToolPolicy] = {
     "create_pptx": _w(),
     "create_pdf": _w(),
     "todo_write": _w(),
-    "knowledge_save": _w(sandbox="home"),
-    "obsidian_save": _w(sandbox="home"),
+    "knowledge_save": _w(
+        sandbox="workspace", capability="workspace:write", scope="workspace_user"
+    ),
+    "obsidian_save": _w(
+        sandbox="workspace", capability="workspace:write", scope="workspace_user"
+    ),
     "local_write": _w(sandbox="home"),
     "run_command": _e(),
     "build_project": _e(),
@@ -315,7 +382,7 @@ class ToolRegistry:
             "status": "ok" if diagnostics["ready"] else "degraded",
             "boundary": {
                 "owner": "latticeai.core.tool_registry.ToolRegistry",
-                "dispatch_owner": "tools.DEFAULT_TOOL_REGISTRY",
+                "dispatch_owner": "latticeai.tools.DEFAULT_TOOL_REGISTRY",
                 "policy_owner": "latticeai.core.tool_registry.ToolRegistry",
                 "permission_owner": "latticeai.services.tool_dispatch.ToolDispatchService",
             },
@@ -354,12 +421,17 @@ class ToolRegistry:
 
     def permission(self, name: str, args: Optional[dict] = None) -> ToolPermission:
         policy = self.policy_for(name, args or {})
-        return ToolPermission(
+        permission = ToolPermission(
             tool=name,
             risk=self.risk_level(policy),
             requires_approval=not policy["auto_approve"],
             network=policy["network"],
         )
+        if policy.get("capability"):
+            permission["capability"] = policy["capability"]
+        if policy.get("scope"):
+            permission["scope"] = policy["scope"]
+        return permission
 
     def permissions(self) -> list[ToolPermission]:
         return [self.permission(name) for name in sorted(self.governance.keys())]

package/latticeai/core/users.py

@@ -6,20 +6,16 @@ import json
 import shutil
 import sqlite3
 import uuid
-from datetime import datetime
 from pathlib import Path
 from typing import Any, Dict, Optional
 
 from .io_utils import atomic_write_json
+from .timeutil import now_iso as _now
 
 
 USER_NAMESPACE = uuid.UUID("5d6d4480-cf79-49c3-a6d0-4c6eec3224d6")
 
 
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 def normalize_email(email: str) -> str:
     return str(email or "").strip().lower()
 

package/latticeai/core/workspace_graph_trace.py

@@ -3,7 +3,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, List, Optional
 
-from .workspace_os_utils import _json_hash, _listify, _now
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _json_hash, _listify
 
 
 class WorkspaceGraphTrace:
@@ -13,7 +14,15 @@ class WorkspaceGraphTrace:
     def __getattr__(self, name: str) -> Any:
         return getattr(self._store, name)
 
-    def build_graph_trace(self, question: str, graph: Any, context: str = "", *, limit: int = 8) -> Dict[str, Any]:
+    def build_graph_trace(
+        self,
+        question: str,
+        graph: Any,
+        context: str = "",
+        *,
+        limit: int = 8,
+        allowed_workspaces=None,
+    ) -> Dict[str, Any]:
         if graph is None:
             return {
                 "source_files": [],
@@ -31,7 +40,16 @@ class WorkspaceGraphTrace:
         matches: List[Dict[str, Any]] = []
         search_error = ""
         try:
-            matches = graph.search(question, limit=limit).get("matches", [])
+            scope_kwargs = (
+                {"allowed_workspaces": allowed_workspaces}
+                if allowed_workspaces is not None
+                else {}
+            )
+            matches = graph.search(
+                question,
+                limit=limit,
+                **scope_kwargs,
+            ).get("matches", [])
         except Exception as exc:
             search_error = str(exc)
             matches = []
@@ -67,7 +85,10 @@ class WorkspaceGraphTrace:
             if not node_id:
                 continue
             try:
-                for edge in graph.neighbors(node_id).get("edges", []):
+                for edge in graph.neighbors(
+                    node_id,
+                    **scope_kwargs,
+                ).get("edges", []):
                     key = (edge.get("from"), edge.get("to"), edge.get("type"))
                     if key in edge_seen:
                         continue
@@ -122,7 +143,12 @@ class WorkspaceGraphTrace:
         }
         state.setdefault("traces", []).append(record)
         self.save_state(state)
-        self.record_timeline_event("graph", "answer_trace", {"trace_id": trace_id, "conversation_id": conversation_id})
+        self.record_timeline_event(
+            "graph",
+            "answer_trace",
+            {"trace_id": trace_id, "conversation_id": conversation_id},
+            workspace_id=record["workspace_id"],
+        )
         return record
 
     def list_traces(self, conversation_id: Optional[str] = None, limit: int = 50, workspace_id: Optional[str] = None) -> Dict[str, Any]:

package/latticeai/core/workspace_memory.py

@@ -6,7 +6,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, List, Optional
 
-from .workspace_os_utils import _json_hash, _listify, _now
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _json_hash, _listify
 
 
 class WorkspaceMemory:
@@ -52,6 +53,7 @@ class WorkspaceMemory:
                     f"{kind}: {content[:80]}",
                     user_email=user_email,
                     source="workspace_os",
+                    workspace_id=record["workspace_id"],
                     metadata={"memory_id": memory_id, "kind": kind, "tags": tags or []},
                 )
                 record["graph_node_id"] = ingested.get("node_id")

package/latticeai/core/workspace_os.py

@@ -21,10 +21,10 @@ from .workspace_os_utils import (
     _deep_merge,
     _json_hash,
     _listify,
-    _now,
     _safe_slug,
     remove_skill_directory,
 )
+from .timeutil import now_iso as _now
 from .workspace_permissions import WorkspacePermissionManager, _member_role  # type: ignore
 from .workspace_timeline import WorkspaceTimeline
 from .workspace_plugins import WorkspacePluginManager
@@ -49,7 +49,7 @@ __all__ = [
     "remove_skill_directory",
 ]
 
-WORKSPACE_OS_VERSION = "9.0.0"
+WORKSPACE_OS_VERSION = "9.1.0"
 
 # Workspace types separate single-user Personal workspaces from shared
 # Organization workspaces. Both keep the same local-first JSON store; the type
@@ -126,9 +126,6 @@ EXECUTION_EVENT_TYPES = {
     "execution_interrupted",
 }
 
-RUN_ACTIVE_STATUSES = {"queued", "running", "in_progress", "retrying", "cancelling"}
-RUN_TERMINAL_STATUSES = {"ok", "retried_ok", "failed", "rejected", "cancelled", "interrupted", "partial"}
-
 DEFAULT_AGENTS = [
     {
         "id": "agent:planner",
@@ -830,8 +827,22 @@ class WorkspaceOSStore:
     # Graph answer traces
     # ------------------------------------------------------------------
 
-    def build_graph_trace(self, question: str, graph: Any, context: str = "", *, limit: int = 8) -> Dict[str, Any]:
-        return self.graph_trace.build_graph_trace(question, graph, context, limit=limit)
+    def build_graph_trace(
+        self,
+        question: str,
+        graph: Any,
+        context: str = "",
+        *,
+        limit: int = 8,
+        allowed_workspaces=None,
+    ) -> Dict[str, Any]:
+        return self.graph_trace.build_graph_trace(
+            question,
+            graph,
+            context,
+            limit=limit,
+            allowed_workspaces=allowed_workspaces,
+        )
 
     def record_trace(self, *args: Any, **kwargs: Any) -> Dict[str, Any]:
         return self.graph_trace.record_trace(*args, **kwargs)

package/latticeai/core/workspace_os_utils.py

@@ -8,7 +8,6 @@ from __future__ import annotations
 
 import json
 import shutil
-from datetime import datetime
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
@@ -16,10 +15,6 @@ from .io_utils import atomic_write_json as _atomic_write_json  # noqa: F401 - le
 from .io_utils import parse_iso as _parse_iso  # noqa: F401 - legacy helper re-export
 
 
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 def _safe_slug(raw: str) -> str:
     value = "".join(ch if ch.isalnum() or ch in "-_." else "-" for ch in str(raw or "").strip())
     value = "-".join(part for part in value.split("-") if part)

package/latticeai/core/workspace_permissions.py

@@ -7,7 +7,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, Optional
 
-from .workspace_os_utils import _listify, _now
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _listify
 
 # Avoid circular at import time: pull constants lazily from parent module.
 def _get_role_permissions():

package/latticeai/core/workspace_plugins.py

@@ -6,7 +6,7 @@ from __future__ import annotations
 
 from typing import Any, Dict, Optional
 
-from .workspace_os_utils import _now
+from .timeutil import now_iso as _now
 
 
 class WorkspacePluginManager: