ltcai 9.7.0 → 9.9.0

package/scripts/check_bundle_budget.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+// Guards the initial JavaScript payload of the /app SPA so heavy features stay
+// behind lazy boundaries. It measures the entry chunk plus its transitive
+// STATIC import closure (what a browser must download before first paint),
+// gzips each file, and fails if the total exceeds the budget.
+//
+// The dynamic import() chunks (pages, onboarding, conversation home, command
+// palette) are intentionally excluded — they are fetched on demand.
+//
+// The check builds into an isolated temp dir so it reads Vite's rich manifest
+// (with `isEntry`/`imports`) without clobbering the production `static/app`
+// manifest, which `build_frontend_assets.mjs` rewrites into a flat runtime map.
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { gzipSync } from "node:zlib";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+const repo = join(import.meta.dirname, "..");
+const outDir = join(repo, "node_modules", ".cache", "bundle-budget");
+const manifestPath = join(outDir, "asset-manifest.json");
+
+// Budget for the initial static JS closure, in gzipped bytes. Set below the
+// pre-split baseline (632.9 kB raw / ~180 kB gzip single chunk) to lock in the
+// code-splitting win and catch regressions that pull heavy code back onto the
+// first-paint path. Raise it only with a deliberate, reviewed reason.
+const INITIAL_JS_GZIP_BUDGET = 153_600; // 150 KiB
+
+function build() {
+  rmSync(outDir, { recursive: true, force: true });
+  const result = spawnSync(
+    "npx",
+    ["vite", "build", "--outDir", outDir, "--emptyOutDir"],
+    { cwd: repo, encoding: "utf8", stdio: ["ignore", "ignore", "inherit"] },
+  );
+  if (result.status !== 0) {
+    console.error("bundle budget: vite build failed");
+    process.exit(1);
+  }
+  if (!existsSync(manifestPath)) {
+    console.error("bundle budget: manifest missing after build");
+    process.exit(1);
+  }
+}
+
+function measure() {
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  const entryKey = Object.keys(manifest).find((key) => manifest[key].isEntry);
+  if (!entryKey) {
+    console.error("bundle budget: no entry chunk in manifest");
+    process.exit(1);
+  }
+
+  const seen = new Set();
+  const walk = (key) => {
+    if (seen.has(key) || !manifest[key]) return;
+    seen.add(key);
+    for (const imp of manifest[key].imports || []) walk(imp);
+  };
+  walk(entryKey);
+
+  const rows = [];
+  let rawTotal = 0;
+  let gzipTotal = 0;
+  for (const key of seen) {
+    const chunk = manifest[key];
+    if (!chunk?.file || !chunk.file.endsWith(".js")) continue;
+    const buffer = readFileSync(join(outDir, chunk.file));
+    const gzip = gzipSync(buffer).length;
+    rawTotal += buffer.length;
+    gzipTotal += gzip;
+    rows.push({ file: chunk.file, raw: buffer.length, gzip });
+  }
+  rows.sort((a, b) => b.gzip - a.gzip);
+
+  const lazyChunks = Object.values(manifest)
+    .filter((chunk) => chunk?.file?.endsWith(".js") && !seen.has(chunk.name ?? ""))
+    .filter((chunk) => !rows.some((row) => row.file === chunk.file));
+
+  return { rows, rawTotal, gzipTotal, lazyCount: lazyChunks.length };
+}
+
+const kib = (bytes) => `${(bytes / 1024).toFixed(1)} KiB`;
+
+build();
+const { rows, rawTotal, gzipTotal, lazyCount } = measure();
+rmSync(outDir, { recursive: true, force: true });
+
+console.log("Initial static JS (entry + static imports):");
+for (const row of rows) {
+  console.log(`  ${row.file.padEnd(40)} raw ${kib(row.raw).padStart(11)}  gzip ${kib(row.gzip).padStart(11)}`);
+}
+console.log(`  ${"TOTAL".padEnd(40)} raw ${kib(rawTotal).padStart(11)}  gzip ${kib(gzipTotal).padStart(11)}`);
+console.log(`Budget (initial JS gzip): ${kib(INITIAL_JS_GZIP_BUDGET)}`);
+console.log(`Lazy JS chunks kept off first paint: ${lazyCount}`);
+
+if (gzipTotal > INITIAL_JS_GZIP_BUDGET) {
+  console.error(
+    `\nbundle budget: FAIL — initial JS ${kib(gzipTotal)} gzip exceeds budget ${kib(INITIAL_JS_GZIP_BUDGET)}.\n`
+    + "Move heavy modules behind React.lazy/dynamic import() or justify a budget bump.",
+  );
+  process.exit(1);
+}
+console.log(`\nbundle budget: PASS — initial JS ${kib(gzipTotal)} gzip within ${kib(INITIAL_JS_GZIP_BUDGET)}.`);

package/scripts/check_current_release_docs.mjs

@@ -6,7 +6,7 @@ const root = process.cwd();
 const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
 const version = pkg.version;
 const releaseDir = `output/release/v${version}`;
-const releaseTheme = "Proactive Hybrid Brain";
+const releaseTheme = "Fail-Closed Trust";
 const title = `${version} — ${releaseTheme}`;
 const escapedVersion = version.replaceAll(".", "\\.");
 

package/scripts/check_doc_status.mjs

@@ -0,0 +1,149 @@
+// Repo-wide documentation status + link gate.
+//
+// Companion to scripts/check_current_release_docs.mjs (which pins the fixed set
+// of current-release files). This script widens coverage to every Markdown doc:
+//
+//   1. Every relative Markdown link under the root canonical docs and docs/**
+//      must resolve to a file inside the repo.
+//   2. Docs are classified by an explicit status badge:
+//        > **Status: canonical**   (or `> Status: canonical`)
+//        > **Status: reference**
+//        > **Status: historical**
+//      Canonical docs are asserted to track the current package version and
+//      carry no stale "Current release" marker. Reference/historical (and
+//      unbadged) docs are allowed to preserve their point-in-time versions, so
+//      snapshots do not have to be rewritten every release.
+//
+// It intentionally does not force a badge onto every doc; unbadged docs are
+// link-checked only. Add a `> **Status: ...**` badge when a doc should be held
+// to (or exempted from) the current-version assertion.
+
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+
+const root = process.cwd();
+const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+const version = pkg.version;
+const escapedVersion = version.replaceAll(".", "\\.");
+
+const rootCanonicalDocs = [
+  "README.md",
+  "ARCHITECTURE.md",
+  "FEATURE_STATUS.md",
+  "SECURITY.md",
+  "PRIVACY.md",
+  "AGENTS.md",
+];
+
+const errors = [];
+
+function walkMarkdown(dir) {
+  const out = [];
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      out.push(...walkMarkdown(full));
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+function collectDocs() {
+  const files = new Set();
+  for (const rel of rootCanonicalDocs) {
+    const full = path.join(root, rel);
+    if (existsSync(full)) files.add(full);
+  }
+  for (const full of walkMarkdown(path.join(root, "docs"))) {
+    files.add(full);
+  }
+  return [...files].sort();
+}
+
+function isExternal(target) {
+  return /^(https?:|mailto:|tel:)/i.test(target);
+}
+
+function relativeLinks(markdown) {
+  const out = [];
+  const linkPattern = /!?\[[^\]]*\]\(([^)]+)\)/g;
+  let match;
+  while ((match = linkPattern.exec(markdown))) {
+    out.push(match[1].trim());
+  }
+  return out;
+}
+
+function checkLinks(file, markdown) {
+  for (const raw of relativeLinks(markdown)) {
+    const hash = raw.indexOf("#");
+    let target = (hash >= 0 ? raw.slice(0, hash) : raw).trim();
+    target = target.replace(/^<|>$/g, "").trim();
+    if (!target || isExternal(target)) continue;
+    const resolved = path.resolve(path.dirname(file), decodeURIComponent(target));
+    const rel = path.relative(root, file);
+    if (!resolved.startsWith(root)) {
+      errors.push(`${rel}: link points outside repo: ${raw}`);
+      continue;
+    }
+    if (!existsSync(resolved)) {
+      errors.push(`${rel}: missing link target: ${raw}`);
+    }
+  }
+}
+
+function statusOf(markdown) {
+  const match = markdown.match(
+    />\s*\*{0,2}Status:\*{0,2}\s*(canonical|reference|historical)\b/i,
+  );
+  return match ? match[1].toLowerCase() : null;
+}
+
+function checkCanonicalVersion(file, markdown) {
+  const rel = path.relative(root, file);
+  const stale = markdown.match(
+    new RegExp(`Current release:\\s+\\*\\*(?!${escapedVersion}\\b)[^*]+\\*\\*`, "i"),
+  );
+  if (stale) {
+    errors.push(`${rel}: canonical doc has stale current-release marker ${JSON.stringify(stale[0])}`);
+  }
+  if (!markdown.includes(version)) {
+    errors.push(`${rel}: canonical doc does not reference current version ${version}`);
+  }
+}
+
+const docs = collectDocs();
+let canonical = 0;
+let reference = 0;
+let historical = 0;
+
+for (const file of docs) {
+  const markdown = readFileSync(file, "utf8");
+  checkLinks(file, markdown);
+  const status = statusOf(markdown);
+  if (status === "canonical") {
+    canonical += 1;
+    checkCanonicalVersion(file, markdown);
+  } else if (status === "reference") {
+    reference += 1;
+  } else if (status === "historical") {
+    historical += 1;
+  }
+}
+
+if (errors.length) {
+  console.error("Documentation status/link check failed:");
+  for (const error of errors) {
+    console.error(`- ${error}`);
+  }
+  process.exit(1);
+}
+
+console.log(
+  `Documentation status/link check passed: ${docs.length} docs scanned ` +
+    `(${canonical} canonical @ ${version}, ${reference} reference, ${historical} historical).`,
+);

package/scripts/generate_sbom.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Generate CycloneDX SBOMs for the Python and npm dependency trees.
+
+Thin, dependency-light wrapper so the same artifacts can be produced locally
+and in CI (.github/workflows/dependency-audit.yml). Python SBOM uses pip-audit
+(``pip install pip-audit``); npm SBOM uses ``npm sbom`` (npm >= 9).
+
+Usage:
+    .venv/bin/python scripts/generate_sbom.py --out-dir dist/sbom
+Each generator is best-effort: a missing tool is reported, not fatal, so one
+ecosystem's absence never blocks the other.
+"""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+import sys
+from pathlib import Path
+
+
+def _run(cmd: list[str], *, stdout_path: Path | None = None) -> tuple[bool, str]:
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, check=False)
+    except FileNotFoundError as exc:
+        return False, f"tool not found: {exc}"
+    if proc.returncode != 0:
+        return False, (proc.stderr or proc.stdout or "").strip()[:400]
+    if stdout_path is not None:
+        stdout_path.write_text(proc.stdout, encoding="utf-8")
+    return True, ""
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Generate CycloneDX SBOMs")
+    parser.add_argument("--out-dir", default="dist/sbom", help="output directory")
+    parser.add_argument("--requirements", default="requirements.txt")
+    args = parser.parse_args(argv)
+
+    root = Path(__file__).resolve().parent.parent
+    out = Path(args.out_dir)
+    out.mkdir(parents=True, exist_ok=True)
+
+    results: list[tuple[str, bool, str]] = []
+
+    py_sbom = out / "sbom-python.json"
+    ok, err = _run(
+        [
+            sys.executable, "-m", "pip_audit",
+            "-r", str(root / args.requirements),
+            "-f", "cyclonedx-json",
+            "-o", str(py_sbom),
+        ]
+    )
+    results.append(("python (pip-audit)", ok, err or str(py_sbom)))
+
+    npm_sbom = out / "sbom-npm.json"
+    ok, err = _run(["npm", "sbom", "--sbom-format", "cyclonedx"], stdout_path=npm_sbom)
+    results.append(("npm (npm sbom)", ok, err or str(npm_sbom)))
+
+    print("SBOM generation:")
+    any_ok = False
+    for name, ok, detail in results:
+        print(f"  [{'OK' if ok else 'SKIP'}] {name}: {detail}")
+        any_ok = any_ok or ok
+    return 0 if any_ok else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src-tauri/Cargo.lock

@@ -1584,7 +1584,7 @@ dependencies = [
 
 [[package]]
 name = "lattice-ai-desktop"
-version = "9.7.0"
+version = "9.9.0"
 dependencies = [
  "plist",
  "serde",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lattice-ai-desktop"
-version = "9.7.0"
+version = "9.9.0"
 description = "Lattice AI Digital Brain desktop shell"
 authors = ["TaeSoo Park"]
 edition = "2021"

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Lattice AI",
-  "version": "9.7.0",
+  "version": "9.9.0",
   "identifier": "ai.lattice.desktop",
   "build": {
     "beforeDevCommand": "npm run frontend:dev",

package/static/app/asset-manifest.json

@@ -1,19 +1,35 @@
 {
-  "version": "9.7.0",
+  "version": "9.9.0",
   "generated_at": "vite",
   "entrypoints": {
-    "app": "/static/app/assets/index-DJC_2oub.js"
+    "app": "/static/app/assets/index-BjaXCeOZ.js"
   },
   "assets": {
     "../node_modules/@tauri-apps/api/core.js": "/static/app/assets/core-CwxXejkd.js",
-    "_primitives-DL4Nip8C.js": "/static/app/assets/primitives-DL4Nip8C.js",
-    "_textarea-woZfCXHy.js": "/static/app/assets/textarea-woZfCXHy.js",
-    "index.html": "/static/app/assets/index-DJC_2oub.js",
-    "assets/index-85wQvEie.css": "/static/app/assets/index-85wQvEie.css",
-    "src/pages/Act.tsx": "/static/app/assets/Act-B6c39ays.js",
-    "src/pages/Brain.tsx": "/static/app/assets/Brain-D7Qg4k6M.js",
-    "src/pages/Capture.tsx": "/static/app/assets/Capture-VF_di68r.js",
-    "src/pages/Library.tsx": "/static/app/assets/Library-D_Gis2PA.js",
-    "src/pages/System.tsx": "/static/app/assets/System-C5s5H2ov.js"
+    "_BrainSignals-BjRBA18L.js": "/static/app/assets/BrainSignals-BjRBA18L.js",
+    "_LivingBrain-CaU_hCxQ.js": "/static/app/assets/LivingBrain-CaU_hCxQ.js",
+    "_bot-Bp2x1i6F.js": "/static/app/assets/bot-Bp2x1i6F.js",
+    "_circle-check-CyGal42W.js": "/static/app/assets/circle-check-CyGal42W.js",
+    "_cpu-DQFk82hG.js": "/static/app/assets/cpu-DQFk82hG.js",
+    "_download-C70gKQVi.js": "/static/app/assets/download-C70gKQVi.js",
+    "_folder-open-DNGytsVw.js": "/static/app/assets/folder-open-DNGytsVw.js",
+    "_hard-drive-CYo_bEl4.js": "/static/app/assets/hard-drive-CYo_bEl4.js",
+    "_i18n-BBMJshCW.js": "/static/app/assets/i18n-BBMJshCW.js",
+    "_input-ChWD-Fsh.js": "/static/app/assets/input-ChWD-Fsh.js",
+    "_navigation-D9D9_FPC.js": "/static/app/assets/navigation-D9D9_FPC.js",
+    "_network-DzLDGmtV.js": "/static/app/assets/network-DzLDGmtV.js",
+    "_primitives-CmaSAyGG.js": "/static/app/assets/primitives-CmaSAyGG.js",
+    "_sparkles-DXiaM1NS.js": "/static/app/assets/sparkles-DXiaM1NS.js",
+    "_textarea-CV43-o79.js": "/static/app/assets/textarea-CV43-o79.js",
+    "index.html": "/static/app/assets/index-BjaXCeOZ.js",
+    "assets/index-BqRcLZR3.css": "/static/app/assets/index-BqRcLZR3.css",
+    "src/components/ProductFlow.tsx": "/static/app/assets/ProductFlow-Db-1O71-.js",
+    "src/features/brain/BrainHome.tsx": "/static/app/assets/BrainHome-D8e3wQiW.js",
+    "src/features/command/CommandPalette.tsx": "/static/app/assets/CommandPalette-pss56Mg4.js",
+    "src/pages/Act.tsx": "/static/app/assets/Act-CfOPUKPs.js",
+    "src/pages/Brain.tsx": "/static/app/assets/Brain-Cgkh0Hpn.js",
+    "src/pages/Capture.tsx": "/static/app/assets/Capture-CQQYQ1Ga.js",
+    "src/pages/Library.tsx": "/static/app/assets/Library-CoI3xYJk.js",
+    "src/pages/System.tsx": "/static/app/assets/System-Dfocn0zN.js"
   }
 }