ltcai 9.9.4 → 9.9.9

package/latticeai/services/local_knowledge.py

@@ -293,6 +293,32 @@ def create_local_knowledge_router(
         payload["watch"] = watch_status
         return payload
 
+    @router.get("/knowledge-graph/local/health")
+    async def knowledge_graph_local_health(request: Request, error_samples: int = 3):
+        """Per-folder memory state (v9.9.7): indexing coverage, failures with
+        their stored reasons, and watch state.
+
+        Vector freshness rides along as an explicitly **global** figure — the
+        vector index is not per-folder, and claiming otherwise would invent a
+        number.
+        """
+        require_user(request)
+        kg = graph()
+        payload = kg.local_source_health(error_samples=error_samples)
+        watch_status = watcher.status() if watcher else {"available": False, "active": {}}
+        active = watch_status.get("active", {})
+        for folder in payload.get("folders", []):
+            folder["watch_active"] = folder.get("id") in active
+        payload["watch"] = watch_status
+        try:
+            payload["vector_freshness_global"] = kg.vector_freshness()
+        except Exception as exc:  # noqa: BLE001 — one missing signal, not a 500
+            payload["vector_freshness_global"] = {
+                "status": "unavailable", "detail": str(exc),
+                "pending_items": 0, "total_items": 0,
+            }
+        return payload
+
     @router.get("/knowledge-graph/local/watch/status")
     async def knowledge_graph_local_watch_status(request: Request):
         require_user(request)

package/latticeai/services/memory_service.py

@@ -930,6 +930,15 @@ class MemoryService:
                 similarity = round(float(hit.get("score") or 0.0), 4)
                 if similarity <= 0:
                     continue
+                # Citation precision (v9.9.6): a chunk hit knows where in the
+                # document it came from (section heading / page). Carry that
+                # locator onto the recall row so the citation can say it.
+                hit_metadata = hit.get("metadata")
+                locator = (
+                    str(hit_metadata.get("locator") or "")
+                    if isinstance(hit_metadata, dict)
+                    else ""
+                )
                 existing = by_node_id.get(node_id)
                 if existing is not None:
                     existing["vector_score"] = max(existing.get("vector_score", 0.0), similarity)
@@ -937,6 +946,8 @@ class MemoryService:
                         max(existing.get("score", 0.0), 0.4 * existing.get("score", 0.0) + 0.6 * similarity),
                         4,
                     )
+                    if locator and not existing.get("locator"):
+                        existing["locator"] = locator
                 else:
                     matched = _matched_terms(hit.get("title"), hit.get("summary"))
                     row = {
@@ -948,6 +959,7 @@ class MemoryService:
                         "score": round(max(_lexical_score(matched), 0.6 * similarity), 4),
                         "matched_terms": matched,
                         "vector_score": similarity,
+                        **({"locator": locator} if locator else {}),
                     }
                     results.append(row)
                     if node_id:

package/latticeai/services/permission_mode_service.py

@@ -0,0 +1,170 @@
+"""Persisted permission-mode preference (v9.9.8).
+
+Stores the active mode under the data dir so every surface (web, VS Code,
+Telegram, agent loop) shares one dial. Scope:
+
+* global default (env ``LATTICEAI_PERMISSION_MODE`` or strict)
+* per-user override
+* per-workspace override (wins over user)
+
+Changing to ``bypass`` requires ``acknowledge_risk=True`` once; the ack is
+audited. Circuit breakers are enforced by ``latticeai.core.permission_mode``,
+not by this store.
+"""
+
+from __future__ import annotations
+
+import json
+import threading
+from pathlib import Path
+from typing import Any, Callable, Dict, Optional
+
+from latticeai.core.io_utils import atomic_write_json
+from latticeai.core.permission_mode import (
+    DEFAULT_MODE,
+    PermissionMode,
+    mode_catalog,
+    mode_contract,
+    normalize_mode,
+)
+
+
+class PermissionModeService:
+    """Load / save the autonomy dial."""
+
+    def __init__(
+        self,
+        *,
+        data_dir: Path,
+        default_mode: PermissionMode | str = DEFAULT_MODE,
+        audit: Optional[Callable[..., None]] = None,
+    ) -> None:
+        self._path = Path(data_dir) / "permission_mode.json"
+        self._default = normalize_mode(default_mode)
+        self._audit = audit or (lambda *a, **kw: None)
+        self._lock = threading.Lock()
+
+    def rebind_data_dir(self, data_dir: Path) -> None:
+        """Point the store at the app's real data dir.
+
+        The wiring may instantiate this service lazily before routers know the
+        configured data dir; rebinding keeps one file of record instead of
+        stranding writes under the fallback path.
+        """
+        with self._lock:
+            self._path = Path(data_dir) / "permission_mode.json"
+
+    def rebind_audit(self, audit: Callable[..., None]) -> None:
+        """Attach the real audit sink once app wiring provides one."""
+        with self._lock:
+            self._audit = audit
+
+    def _read(self) -> Dict[str, Any]:
+        if not self._path.exists():
+            return {"default": self._default.value, "users": {}, "workspaces": {}}
+        try:
+            data = json.loads(self._path.read_text(encoding="utf-8"))
+        except Exception:
+            return {"default": self._default.value, "users": {}, "workspaces": {}}
+        if not isinstance(data, dict):
+            return {"default": self._default.value, "users": {}, "workspaces": {}}
+        data.setdefault("default", self._default.value)
+        data.setdefault("users", {})
+        data.setdefault("workspaces", {})
+        return data
+
+    def _write(self, data: Dict[str, Any]) -> None:
+        self._path.parent.mkdir(parents=True, exist_ok=True)
+        atomic_write_json(self._path, data)
+
+    def _resolve_from(
+        self,
+        data: Dict[str, Any],
+        *,
+        user_email: Optional[str],
+        workspace_id: Optional[str],
+    ) -> PermissionMode:
+        """Scope precedence: workspace → user → process default.
+
+        Pure over ``data`` and lock-free, so holders of ``_lock`` can reuse it
+        without re-entering a non-reentrant lock.
+        """
+        if workspace_id:
+            ws = (data.get("workspaces") or {}).get(str(workspace_id))
+            if ws:
+                return normalize_mode(ws)
+        if user_email:
+            user = (data.get("users") or {}).get(str(user_email).lower())
+            if user:
+                return normalize_mode(user)
+        return normalize_mode(data.get("default") or self._default)
+
+    def resolve(
+        self,
+        *,
+        user_email: Optional[str] = None,
+        workspace_id: Optional[str] = None,
+    ) -> PermissionMode:
+        with self._lock:
+            data = self._read()
+        return self._resolve_from(
+            data, user_email=user_email, workspace_id=workspace_id,
+        )
+
+    def get(
+        self,
+        *,
+        user_email: Optional[str] = None,
+        workspace_id: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        mode = self.resolve(user_email=user_email, workspace_id=workspace_id)
+        contract = mode_contract(mode)
+        contract["catalog"] = mode_catalog()
+        contract["scope"] = {
+            "user_email": user_email,
+            "workspace_id": workspace_id,
+        }
+        return contract
+
+    def set_mode(
+        self,
+        mode: PermissionMode | str,
+        *,
+        user_email: Optional[str] = None,
+        workspace_id: Optional[str] = None,
+        acknowledge_risk: bool = False,
+        source: str = "api",
+    ) -> Dict[str, Any]:
+        mode = normalize_mode(mode)
+        if mode == PermissionMode.BYPASS and not acknowledge_risk:
+            raise PermissionError(
+                "bypass mode requires acknowledge_risk=true "
+                "(YOLO inside the agent workspace; circuit breakers still apply)"
+            )
+        with self._lock:
+            data = self._read()
+            # Lock-free helper on purpose: calling ``resolve`` here would
+            # re-enter ``_lock`` and deadlock every mode change.
+            previous = self._resolve_from(
+                data, user_email=user_email, workspace_id=workspace_id,
+            )
+            if workspace_id:
+                data.setdefault("workspaces", {})[str(workspace_id)] = mode.value
+            elif user_email:
+                data.setdefault("users", {})[str(user_email).lower()] = mode.value
+            else:
+                data["default"] = mode.value
+            self._write(data)
+        self._audit(
+            "permission_mode_changed",
+            user_email=user_email,
+            workspace_id=workspace_id,
+            previous=previous.value,
+            mode=mode.value,
+            source=source,
+            acknowledge_risk=bool(acknowledge_risk),
+        )
+        return self.get(user_email=user_email, workspace_id=workspace_id)
+
+
+__all__ = ["PermissionModeService"]

package/latticeai/services/product_readiness.py

@@ -18,7 +18,7 @@ from typing import Any, Dict, List
 
 from latticeai.services.architecture_readiness import architecture_readiness
 
-PRODUCT_VERSION_TARGET = "9.9.4"
+PRODUCT_VERSION_TARGET = "9.9.9"
 
 
 @dataclass(frozen=True)

package/latticeai/services/tool_dispatch.py

@@ -14,12 +14,19 @@ from typing import Any, Callable, Dict, Mapping, Optional
 from fastapi import HTTPException
 
 from latticeai.core.agent import AgentDeps, SingleAgentRuntime
+from latticeai.core.agent_permission import call_mode_source
 from latticeai.core.agent_prompts import (
     CRITIC_PROMPT,
     EXECUTOR_PROMPT,
     MEMORY_UPDATER_PROMPT,
     PLANNER_PROMPT,
 )
+from latticeai.core.permission_mode import (
+    DEFAULT_MODE,
+    effective_auto_approve,
+    is_circuit_breaker,
+    normalize_mode,
+)
 from latticeai.core.policy import role_has_capability
 from latticeai.core.tool_governor import classify_tool_call
 from latticeai.core.tool_registry import ToolPermission, ToolPolicy
@@ -34,6 +41,10 @@ def _default_get_user_role(_email, _users=None) -> str:
     return "user"
 
 
+def _default_permission_mode() -> Any:
+    return DEFAULT_MODE
+
+
 FILE_CREATE_ACTIONS = set(DEFAULT_TOOL_REGISTRY.file_create_actions)
 TOOL_GOVERNANCE: Dict[str, ToolPolicy] = dict(DEFAULT_TOOL_REGISTRY.governance)
 TOOL_GOVERNANCE_DEFAULT: ToolPolicy = DEFAULT_TOOL_REGISTRY.default_policy
@@ -62,6 +73,10 @@ class ToolDispatchService:
     registry: Any = field(default_factory=lambda: DEFAULT_TOOL_REGISTRY)
     load_users: Callable[[], Dict[str, Any]] = field(default=_default_load_users)
     get_user_role: Callable[..., str] = field(default=_default_get_user_role)
+    # Static mode, or a callable resolved per enforce_policy call. A callable
+    # may accept ``user_email``/``workspace_id`` scope kwargs (preferred) or no
+    # arguments at all — see ``call_mode_source``.
+    permission_mode: Any = field(default_factory=lambda: _default_permission_mode)
 
     @property
     def file_create_actions(self) -> frozenset[str]:
@@ -80,9 +95,29 @@ class ToolDispatchService:
         *,
         load_users: Callable[[], Dict[str, Any]],
         get_user_role: Callable[..., str],
+        permission_mode: Any = None,
     ) -> None:
         self.load_users = load_users
         self.get_user_role = get_user_role
+        if permission_mode is not None:
+            self.permission_mode = permission_mode
+
+    def resolve_permission_mode(
+        self,
+        *,
+        user_email: Optional[str] = None,
+        workspace_id: Optional[str] = None,
+    ) -> Any:
+        """Active autonomy dial for this caller.
+
+        The scope matters: per-user and per-workspace overrides are stored by
+        ``PermissionModeService``, so resolving without a scope would silently
+        collapse every caller onto the process-wide default.
+        """
+        raw = call_mode_source(
+            self.permission_mode, user_email=user_email, workspace_id=workspace_id,
+        )
+        return normalize_mode(raw if raw is not None else DEFAULT_MODE)
 
     def policy_for(self, action_name: str, args: dict) -> ToolPolicy:
         return self.registry.policy_for(action_name, args)
@@ -155,6 +190,8 @@ class ToolDispatchService:
         source: str,
         require_auto_approval: bool = True,
         trusted_admin: bool = False,
+        permission_mode: Any = None,
+        workspace_id: Optional[str] = None,
     ) -> ToolPolicy:
         """Authorize a tool call before any hook or handler can execute.
 
@@ -162,8 +199,18 @@ class ToolDispatchService:
         runtime uses the same policy data and blocks non-auto-approved steps in
         its state machine so Computer Use direct endpoints can remain unchanged
         when explicitly excluded from a hardening pass.
+
+        The active :class:`PermissionMode` widens what may run without an extra
+        approval prompt; it never widens a circuit breaker.
         """
         policy = self.policy_for(tool_name, args or {})
+        mode = normalize_mode(
+            permission_mode
+            if permission_mode is not None
+            else self.resolve_permission_mode(
+                user_email=current_user, workspace_id=workspace_id,
+            )
+        )
         if source in {"mcp", "plugin"} and tool_name in EXPLICIT_CONSENT_TOOLS:
             raise HTTPException(
                 status_code=403,
@@ -174,14 +221,22 @@ class ToolDispatchService:
             )
         if not trusted_admin:
             self.check_role(tool_name, current_user)
+
+        breaker = is_circuit_breaker(tool_name, policy, args or {})
+        if breaker:
+            raise HTTPException(status_code=403, detail=f"'{tool_name}' 차단: {breaker}")
+
         if policy["destructive"] or policy["risk"] == "destructive":
             raise HTTPException(
                 status_code=403,
                 detail=f"'{tool_name}' 툴은 파괴적 작업으로 차단되었습니다.",
             )
+
         # Fail-closed governance: a call that would rewrite existing content but
         # cannot be staged as a reviewable proposal is blocked, never applied
-        # silently. New-file (additive) calls are unaffected.
+        # silently. New-file (additive) calls are unaffected. This is
+        # mode-invariant — trusted/bypass skip *proposal staging*, but a binary
+        # overwrite has no safe apply path in any mode, so it stays blocked.
         verdict = classify_tool_call(
             tool_name, args or {},
             policy=dict(policy), path_exists=self._governed_path_exists,
@@ -195,17 +250,22 @@ class ToolDispatchService:
                     "지원되는 편집 도구(write_file/edit_file)를 사용하세요."
                 ),
             )
+
+        auto = policy["auto_approve"] or effective_auto_approve(
+            mode, tool_name, policy, change_class=verdict.get("change_class"), args=args or {},
+        )
         if (
             require_auto_approval
             and not trusted_admin
-            and not policy["auto_approve"]
+            and not auto
             and self.user_role(current_user) not in {"admin", "owner"}
         ):
             raise HTTPException(
                 status_code=403,
                 detail=(
-                    f"'{tool_name}' 툴은 명시 승인이 필요합니다. "
-                    "현재 릴리스에서는 승인 UI가 없는 직접 실행 경로에서 기본 차단됩니다."
+                    f"'{tool_name}' 툴은 명시 승인이 필요합니다 "
+                    f"(permission_mode={mode.value}). "
+                    "승인 UI가 없는 직접 실행 경로에서 차단되었습니다."
                 ),
             )
         return policy
@@ -220,6 +280,60 @@ class ToolDispatchService:
         )
         return {"path": path, "ok": r.returncode == 0, "stderr": r.stderr[:200]}
 
+    # ── snapshot rollback ports (review L7) ──────────────────────────────
+    # Pre-write capture + restore for workspaces where git rollback does not
+    # apply (untracked new files, no git). Strictly confined to AGENT_ROOT.
+
+    _SNAPSHOT_MAX_BYTES = 512 * 1024
+
+    def _workspace_path(self, path: str) -> Optional[Path]:
+        raw = Path(path)
+        candidate = raw if raw.is_absolute() else AGENT_ROOT / raw
+        try:
+            resolved = candidate.resolve()
+            root = AGENT_ROOT.resolve()
+        except OSError:
+            return None
+        if resolved != root and root not in resolved.parents:
+            return None
+        return resolved
+
+    def snapshot_file(self, path: str) -> Dict[str, Any]:
+        """Pre-write state of a workspace file: existence + bounded content."""
+        target = self._workspace_path(path)
+        if target is None:
+            return {"existed": False, "content": None, "too_large": False,
+                    "error": "path escapes the agent workspace"}
+        if not target.exists() or not target.is_file():
+            return {"existed": False, "content": None, "too_large": False}
+        try:
+            if target.stat().st_size > self._SNAPSHOT_MAX_BYTES:
+                return {"existed": True, "content": None, "too_large": True}
+            return {
+                "existed": True,
+                "content": target.read_text(encoding="utf-8", errors="replace"),
+                "too_large": False,
+            }
+        except OSError as exc:
+            return {"existed": True, "content": None, "too_large": True,
+                    "error": str(exc)}
+
+    def restore_snapshot(self, path: str, content: Optional[str]) -> Dict[str, Any]:
+        """Restore a pre-write snapshot: rewrite prior content, or delete a
+        file the run created (``content=None``)."""
+        target = self._workspace_path(path)
+        if target is None:
+            return {"path": path, "ok": False, "error": "path escapes the agent workspace"}
+        try:
+            if content is None:
+                target.unlink(missing_ok=True)
+                return {"path": path, "ok": True, "action": "deleted"}
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_text(content, encoding="utf-8")
+            return {"path": path, "ok": True, "action": "restored"}
+        except OSError as exc:
+            return {"path": path, "ok": False, "error": str(exc)}
+
 
 DEFAULT_TOOL_DISPATCH_SERVICE = ToolDispatchService()
 
@@ -228,10 +342,12 @@ def configure_tool_dispatch(
     *,
     load_users: Callable[[], Dict[str, Any]],
     get_user_role: Callable[..., str],
+    permission_mode: Any = None,
 ) -> None:
     DEFAULT_TOOL_DISPATCH_SERVICE.configure(
         load_users=load_users,
         get_user_role=get_user_role,
+        permission_mode=permission_mode,
     )
 
 
@@ -271,6 +387,8 @@ def enforce_tool_policy(
     source: str,
     require_auto_approval: bool = True,
     trusted_admin: bool = False,
+    permission_mode: Any = None,
+    workspace_id: Optional[str] = None,
 ) -> ToolPolicy:
     return DEFAULT_TOOL_DISPATCH_SERVICE.enforce_policy(
         tool_name,
@@ -279,6 +397,8 @@ def enforce_tool_policy(
         source=source,
         require_auto_approval=require_auto_approval,
         trusted_admin=trusted_admin,
+        workspace_id=workspace_id,
+        permission_mode=permission_mode,
     )
 
 
@@ -354,8 +474,10 @@ def build_agent_runtime(
     hooks: Any = None,
     brain_memory: Any = None,
     dispatch_service: ToolDispatchService = DEFAULT_TOOL_DISPATCH_SERVICE,
+    permission_mode: Any = None,
 ) -> SingleAgentRuntime:
     ensure_agent_root()
+    mode = permission_mode if permission_mode is not None else dispatch_service.permission_mode
     deps = AgentDeps(
         generate_as=model_router.generate_as,
         generate=model_router.generate,
@@ -375,8 +497,11 @@ def build_agent_runtime(
         memory_updater_prompt=MEMORY_UPDATER_PROMPT,
         agent_root=AGENT_ROOT,
         rollback_file=dispatch_service.rollback_file,
+        snapshot_file=dispatch_service.snapshot_file,
+        restore_snapshot=dispatch_service.restore_snapshot,
         hooks=hooks,
         brain_memory=brain_memory,
+        permission_mode=mode,
     )
     return SingleAgentRuntime(deps)