ltcai 9.8.0 → 9.9.1

package/scripts/check_legacy_debt.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+// Legacy debt gate (9.9.1): the root shim layer stays removed.
+//
+// Fails when:
+//  1. a Python module other than server.py appears at the repository root;
+//  2. any source tree imports a removed root shim module;
+//  3. a removed shim directory (tools/) reappears at the root.
+//
+// Mirror of tests/unit/test_legacy_root_shims.py, but static and runnable in
+// `npm run lint` without a Python environment.
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const repo = join(import.meta.dirname, "..");
+
+const ALLOWED_ROOT_MODULES = new Set(["server.py"]);
+const REMOVED_ROOT_DIRS = ["tools"];
+const REMOVED_MODULES = [
+  "ltcai_cli",
+  "auto_setup",
+  "setup_wizard",
+  "mcp_registry",
+  "kg_schema",
+  "knowledge_graph",
+  "knowledge_graph_api",
+  "local_knowledge_api",
+  "llm_router",
+  "p_reinforce",
+  "telegram_bot",
+  "tools",
+];
+// Trees that must not import removed shims. static/app and node_modules are
+// build output; src-tauri/target is compiler output.
+const SOURCE_TREES = ["latticeai", "lattice_brain", "tests", "scripts", "bin", "desktop/electron"];
+
+const failures = [];
+
+for (const entry of readdirSync(repo)) {
+  if (entry.endsWith(".py") && !ALLOWED_ROOT_MODULES.has(entry)) {
+    failures.push(`root module reappeared: ${entry} — put code in latticeai/ or lattice_brain/`);
+  }
+}
+for (const dir of REMOVED_ROOT_DIRS) {
+  if (existsSync(join(repo, dir))) {
+    failures.push(`removed root package reappeared: ${dir}/ — use latticeai.${dir} instead`);
+  }
+}
+
+const modulePattern = REMOVED_MODULES.join("|");
+const pyImport = new RegExp(`^\\s*(?:import\\s+(?:${modulePattern})\\b|from\\s+(?:${modulePattern})\\s+import\\b)`);
+const jsSpawn = new RegExp(`(?:${modulePattern})\\.py\\b`);
+
+function* walk(dir) {
+  for (const entry of readdirSync(dir)) {
+    if (entry === "__pycache__" || entry === "node_modules" || entry === ".venv") continue;
+    const full = join(dir, entry);
+    const st = statSync(full);
+    if (st.isDirectory()) yield* walk(full);
+    else yield full;
+  }
+}
+
+for (const tree of SOURCE_TREES) {
+  const base = join(repo, tree);
+  if (!existsSync(base)) continue;
+  for (const file of walk(base)) {
+    const rel = relative(repo, file);
+    if (/\.py$/.test(file)) {
+      const lines = readFileSync(file, "utf8").split("\n");
+      lines.forEach((line, i) => {
+        if (pyImport.test(line)) {
+          failures.push(`${rel}:${i + 1} imports a removed root shim: ${line.trim()}`);
+        }
+      });
+    } else if (/\.(mjs|cjs|js)$/.test(file) && !/\.min\.js$/.test(file)) {
+      const lines = readFileSync(file, "utf8").split("\n");
+      lines.forEach((line, i) => {
+        if (jsSpawn.test(line) && !line.includes("check_legacy_debt")) {
+          failures.push(`${rel}:${i + 1} references a removed root shim file: ${line.trim()}`);
+        }
+      });
+    }
+  }
+}
+
+if (failures.length > 0) {
+  console.error("legacy debt gate FAILED:");
+  for (const failure of failures) console.error(`  - ${failure}`);
+  process.exit(1);
+}
+console.log("legacy debt gate ok: root shim layer stays removed (server.py only)");

package/scripts/generate_sbom.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Generate CycloneDX SBOMs for the Python and npm dependency trees.
+
+Thin, dependency-light wrapper so the same artifacts can be produced locally
+and in CI (.github/workflows/dependency-audit.yml). Python SBOM uses pip-audit
+(``pip install pip-audit``); npm SBOM uses ``npm sbom`` (npm >= 9).
+
+Usage:
+    .venv/bin/python scripts/generate_sbom.py --out-dir dist/sbom
+Each generator is best-effort: a missing tool is reported, not fatal, so one
+ecosystem's absence never blocks the other.
+"""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+import sys
+from pathlib import Path
+
+
+def _run(cmd: list[str], *, stdout_path: Path | None = None) -> tuple[bool, str]:
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, check=False)
+    except FileNotFoundError as exc:
+        return False, f"tool not found: {exc}"
+    if proc.returncode != 0:
+        return False, (proc.stderr or proc.stdout or "").strip()[:400]
+    if stdout_path is not None:
+        stdout_path.write_text(proc.stdout, encoding="utf-8")
+    return True, ""
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Generate CycloneDX SBOMs")
+    parser.add_argument("--out-dir", default="dist/sbom", help="output directory")
+    parser.add_argument("--requirements", default="requirements.txt")
+    args = parser.parse_args(argv)
+
+    root = Path(__file__).resolve().parent.parent
+    out = Path(args.out_dir)
+    out.mkdir(parents=True, exist_ok=True)
+
+    results: list[tuple[str, bool, str]] = []
+
+    py_sbom = out / "sbom-python.json"
+    ok, err = _run(
+        [
+            sys.executable, "-m", "pip_audit",
+            "-r", str(root / args.requirements),
+            "-f", "cyclonedx-json",
+            "-o", str(py_sbom),
+        ]
+    )
+    results.append(("python (pip-audit)", ok, err or str(py_sbom)))
+
+    npm_sbom = out / "sbom-npm.json"
+    ok, err = _run(["npm", "sbom", "--sbom-format", "cyclonedx"], stdout_path=npm_sbom)
+    results.append(("npm (npm sbom)", ok, err or str(npm_sbom)))
+
+    print("SBOM generation:")
+    any_ok = False
+    for name, ok, detail in results:
+        print(f"  [{'OK' if ok else 'SKIP'}] {name}: {detail}")
+        any_ok = any_ok or ok
+    return 0 if any_ok else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/prune_release_evidence.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+// Retention policy for output/release/: keep the newest N versioned evidence
+// directories (default 3, override with LTCAI_RELEASE_EVIDENCE_KEEP or argv).
+// Older captures are reproducible on demand via `npm run release:evidence`,
+// so keeping the full history only burns disk (13 versions ≈ 90MB).
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const repo = join(import.meta.dirname, "..");
+const releaseDir = join(repo, "output", "release");
+const keep = Math.max(1, Number(process.argv[2] || process.env.LTCAI_RELEASE_EVIDENCE_KEEP || 3));
+
+if (!existsSync(releaseDir)) {
+  console.log(`release evidence: nothing to prune (${releaseDir} missing)`);
+  process.exit(0);
+}
+
+const semver = (name) => {
+  const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(name);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+};
+
+const versioned = readdirSync(releaseDir)
+  .filter((name) => semver(name) && statSync(join(releaseDir, name)).isDirectory())
+  .sort((a, b) => {
+    const [a1, a2, a3] = semver(a);
+    const [b1, b2, b3] = semver(b);
+    return b1 - a1 || b2 - a2 || b3 - a3;
+  });
+
+const stale = versioned.slice(keep);
+for (const name of stale) {
+  rmSync(join(releaseDir, name), { recursive: true, force: true });
+  console.log(`release evidence: pruned ${name}`);
+}
+console.log(
+  `release evidence: keeping ${Math.min(keep, versioned.length)} of ${versioned.length} versions (policy: newest ${keep})`,
+);

package/scripts/wheel_smoke.py

@@ -32,7 +32,6 @@ REPO_ROOT = Path(__file__).resolve().parents[1]
 
 # Every importable module the wheel ships (pyproject py-modules + packages).
 WHEEL_MODULES = [
-    "setup_wizard",
     "lattice_brain",
     "lattice_brain.graph",
     "lattice_brain.graph.store",
@@ -55,9 +54,18 @@ WHEEL_MODULES = [
     "latticeai.services.p_reinforce",
     "latticeai.tools",
     "latticeai.tools.knowledge",
+    "latticeai.setup.auto_setup",
+    "latticeai.setup.wizard",
+    "latticeai.services.local_knowledge",
+    "lattice_brain.graph.schema",
+    "server",
+]
+
+# Root shims removed in 9.9.1 — the wheel must NOT ship them anymore.
+REMOVED_ROOT_MODULES = [
     "ltcai_cli",
     "auto_setup",
-    "server",
+    "setup_wizard",
     "mcp_registry",
     "kg_schema",
     "knowledge_graph",
@@ -67,15 +75,23 @@ WHEEL_MODULES = [
     "p_reinforce",
     "telegram_bot",
     "tools",
-    "tools.knowledge",
 ]
 
 IMPORT_CHECK = (
     "import importlib\n"
     + "".join(f"importlib.import_module({mod!r})\n" for mod in WHEEL_MODULES)
-    + "assert importlib.import_module('tools') is importlib.import_module('latticeai.tools')\n"
-    + "assert importlib.import_module('tools.knowledge') is importlib.import_module('latticeai.tools.knowledge')\n"
-    + f"print('wheel imports ok: {len(WHEEL_MODULES)} modules')\n"
+    + "".join(
+        f"""
+try:
+    importlib.import_module({mod!r})
+except ImportError:
+    pass
+else:
+    raise AssertionError('removed root shim {mod} is still shipped in the wheel')
+"""
+        for mod in REMOVED_ROOT_MODULES
+    )
+    + f"print('wheel imports ok: {len(WHEEL_MODULES)} modules, {len(REMOVED_ROOT_MODULES)} shims gone')\n"
 )
 
 HEALTH_CHECK = """

package/src-tauri/Cargo.lock

@@ -1584,7 +1584,7 @@ dependencies = [
 
 [[package]]
 name = "lattice-ai-desktop"
-version = "9.8.0"
+version = "9.9.1"
 dependencies = [
  "plist",
  "serde",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lattice-ai-desktop"
-version = "9.8.0"
+version = "9.9.1"
 description = "Lattice AI Digital Brain desktop shell"
 authors = ["TaeSoo Park"]
 edition = "2021"

package/src-tauri/src/main.rs

@@ -164,9 +164,9 @@ fn resource_dir() -> Option<PathBuf> {
 fn bundled_python_root() -> Option<PathBuf> {
     let resources = resource_dir()?;
     let up = resources.join("_up_");
-    if up.join("ltcai_cli.py").is_file() {
+    if up.join("latticeai").join("cli").join("entrypoint.py").is_file() {
         Some(up)
-    } else if resources.join("ltcai_cli.py").is_file() {
+    } else if resources.join("latticeai").join("cli").join("entrypoint.py").is_file() {
         Some(resources)
     } else {
         None
@@ -222,13 +222,13 @@ fn backend_launch(origin: &str) -> BackendLaunch {
     }
 
     for python in python_candidates() {
-        if module_importable(&python, "ltcai_cli") {
+        if module_importable(&python, "latticeai.cli.entrypoint") {
             return BackendLaunch {
-                command: format!("{python} -m ltcai_cli --host 127.0.0.1 --port {port}"),
+                command: format!("{python} -m latticeai.cli.entrypoint --host 127.0.0.1 --port {port}"),
                 program: python,
                 args: vec![
                     "-m".into(),
-                    "ltcai_cli".into(),
+                    "latticeai.cli.entrypoint".into(),
                     "--host".into(),
                     "127.0.0.1".into(),
                     "--port".into(),
@@ -240,27 +240,27 @@ fn backend_launch(origin: &str) -> BackendLaunch {
     }
 
     if let Some(resources) = bundled_python_root() {
-        let launcher = resources.join("ltcai_cli.py");
-        if launcher.is_file() {
+        if resources.join("latticeai").join("cli").join("entrypoint.py").is_file() {
             if let Some(python) = python_candidates().into_iter().next() {
                 return BackendLaunch {
-                    command: format!("{python} {} --host 127.0.0.1 --port {port}", launcher.display()),
+                    command: format!("{python} -m latticeai.cli.entrypoint --host 127.0.0.1 --port {port}"),
                     program: python,
                     args: vec![
-                        launcher.to_string_lossy().to_string(),
+                        "-m".into(),
+                        "latticeai.cli.entrypoint".into(),
                         "--host".into(),
                         "127.0.0.1".into(),
                         "--port".into(),
                         port,
                     ],
-                    cwd: None,
+                    cwd: Some(resources),
                 };
             }
         }
     }
 
     BackendLaunch {
-        command: "unavailable: LTCAI executable or importable ltcai_cli module not found".to_string(),
+        command: "unavailable: LTCAI executable or importable latticeai.cli.entrypoint module not found".to_string(),
         program: String::new(),
         args: Vec::new(),
         cwd: None,
@@ -278,7 +278,7 @@ fn spawn_backend(origin: &str, launch: &BackendLaunch) -> Result<Option<Child>,
         return Ok(None);
     }
     if launch.program.is_empty() {
-        return Err("Desktop backend unavailable: LTCAI executable or importable ltcai_cli module not found.".to_string());
+        return Err("Desktop backend unavailable: LTCAI executable or importable latticeai.cli.entrypoint module not found.".to_string());
     }
 
     let mut cmd = Command::new(&launch.program);

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Lattice AI",
-  "version": "9.8.0",
+  "version": "9.9.1",
   "identifier": "ai.lattice.desktop",
   "build": {
     "beforeDevCommand": "npm run frontend:dev",
@@ -33,22 +33,10 @@
       "app"
     ],
     "resources": [
-      "../auto_setup.py",
-      "../kg_schema.py",
-      "../knowledge_graph.py",
-      "../knowledge_graph_api.py",
-      "../llm_router.py",
-      "../local_knowledge_api.py",
-      "../ltcai_cli.py",
-      "../mcp_registry.py",
-      "../p_reinforce.py",
       "../server.py",
-      "../setup_wizard.py",
-      "../telegram_bot.py",
       "../requirements.txt",
       "../latticeai",
       "../lattice_brain",
-      "../tools",
       "../static"
     ],
     "icon": [

package/static/app/asset-manifest.json

@@ -1,19 +1,35 @@
 {
-  "version": "9.8.0",
+  "version": "9.9.1",
   "generated_at": "vite",
   "entrypoints": {
-    "app": "/static/app/assets/index-CndfILiF.js"
+    "app": "/static/app/assets/index-DrZSkwrE.js"
   },
   "assets": {
     "../node_modules/@tauri-apps/api/core.js": "/static/app/assets/core-CwxXejkd.js",
-    "_primitives-DxsIXb6G.js": "/static/app/assets/primitives-DxsIXb6G.js",
-    "_textarea-DH7ne8VI.js": "/static/app/assets/textarea-DH7ne8VI.js",
-    "index.html": "/static/app/assets/index-CndfILiF.js",
-    "assets/index-7gY9t9Sd.css": "/static/app/assets/index-7gY9t9Sd.css",
-    "src/pages/Act.tsx": "/static/app/assets/Act-Dd3z8AzF.js",
-    "src/pages/Brain.tsx": "/static/app/assets/Brain-BMkgdWnI.js",
-    "src/pages/Capture.tsx": "/static/app/assets/Capture-D2Aw9gkv.js",
-    "src/pages/Library.tsx": "/static/app/assets/Library-Yreq-KW5.js",
-    "src/pages/System.tsx": "/static/app/assets/System-CXNmmtEo.js"
+    "_BrainSignals-CmFD8PWk.js": "/static/app/assets/BrainSignals-CmFD8PWk.js",
+    "_LivingBrain-6FvA0H5T.js": "/static/app/assets/LivingBrain-6FvA0H5T.js",
+    "_ReviewCard-D56TMypk.js": "/static/app/assets/ReviewCard-D56TMypk.js",
+    "_bot-DgC7xgUl.js": "/static/app/assets/bot-DgC7xgUl.js",
+    "_cpu-DDGb4XHl.js": "/static/app/assets/cpu-DDGb4XHl.js",
+    "_download-C-Ei3GFa.js": "/static/app/assets/download-C-Ei3GFa.js",
+    "_folder-open-BbVuSO9M.js": "/static/app/assets/folder-open-BbVuSO9M.js",
+    "_hard-drive-yDZR6XYz.js": "/static/app/assets/hard-drive-yDZR6XYz.js",
+    "_input-DPIkTs9n.js": "/static/app/assets/input-DPIkTs9n.js",
+    "_navigation-B1mkmyUe.js": "/static/app/assets/navigation-B1mkmyUe.js",
+    "_network-0XDI1Uf_.js": "/static/app/assets/network-0XDI1Uf_.js",
+    "_primitives-sIQYKyf5.js": "/static/app/assets/primitives-sIQYKyf5.js",
+    "_sunrise-DXMjueec.js": "/static/app/assets/sunrise-DXMjueec.js",
+    "_textarea-DvnwpnqS.js": "/static/app/assets/textarea-DvnwpnqS.js",
+    "_utils-BrfFHAJl.js": "/static/app/assets/utils-BrfFHAJl.js",
+    "index.html": "/static/app/assets/index-DrZSkwrE.js",
+    "assets/index-CFRhNBuH.css": "/static/app/assets/index-CFRhNBuH.css",
+    "src/components/ProductFlow.tsx": "/static/app/assets/ProductFlow-Cr8bkQPw.js",
+    "src/features/brain/BrainHome.tsx": "/static/app/assets/BrainHome-B5QpJ1Fx.js",
+    "src/features/command/CommandPalette.tsx": "/static/app/assets/CommandPalette-BrqpT7K2.js",
+    "src/pages/Act.tsx": "/static/app/assets/Act-CcSWTQsx.js",
+    "src/pages/Brain.tsx": "/static/app/assets/Brain-CSCDZEHd.js",
+    "src/pages/Capture.tsx": "/static/app/assets/Capture-BiuerOio.js",
+    "src/pages/Library.tsx": "/static/app/assets/Library-BcaiPbum.js",
+    "src/pages/System.tsx": "/static/app/assets/System-D6uJacqu.js"
   }
 }