create-windy 0.2.33 → 0.2.34

package/dist/cli.js

@@ -248,6 +248,7 @@ var optionalModuleManifests = [
       "apps/server/src/agent",
       "apps/server/src/mcp",
       "apps/server/src/module-host/tool-handlers.ts",
+      "apps/server/src/module-host/tool-handlers.test.ts",
       "packages/modules/src/system-agent-tools.ts"
     ],
     documentation: [
@@ -1582,6 +1583,8 @@ var agentComposeService = `  agent-server:
     environment:
       AGENT_SERVER_INTERNAL_TOKEN: \${AGENT_SERVER_INTERNAL_TOKEN:-}
       AGENT_RUN_STORE_PATH: /app/data/agent/runs.sqlite3
+      AI_PROVIDER_AUDIT_STORE_PATH: /app/data/agent/provider-audit.sqlite3
+      AI_PROVIDER_AUDIT_RETENTION_DAYS: \${AI_PROVIDER_AUDIT_RETENTION_DAYS:-90}
       QWEN_API_URL: \${QWEN_API_URL:-}
       QWEN_API_KEY: \${QWEN_API_KEY:-}
       QWEN_MODEL: \${QWEN_MODEL:-}
@@ -1614,6 +1617,7 @@ QWEN_API_URL=
 QWEN_API_KEY=
 QWEN_MODEL=
 AI_PROVIDER_HTTPS_HOST_ALLOWLIST=
+# AI_PROVIDER_AUDIT_RETENTION_DAYS=90
 # AI_PROVIDER_CONNECT_TIMEOUT_MS=5000
 # AI_PROVIDER_REQUEST_TIMEOUT_MS=60000
 # AI_PROVIDER_MAX_RESPONSE_BYTES=2097152
@@ -1934,6 +1938,7 @@ var templateDocumentationFiles = [
   "docs/platform/agent-runtime.md",
   "docs/platform/audit-reliability.md",
   "docs/platform/bulk-data-jobs.md",
+  "docs/platform/business-user-directory.md",
   "docs/platform/data-access-control.md",
   "docs/platform/module-configuration.md",
   "docs/platform/navigation-registry.md",
@@ -4364,7 +4369,8 @@ var recipes = [
   { id: "starter-0.2.29-to-0.2.30", from: "0.2.29", to: "0.2.30" },
   { id: "starter-0.2.30-to-0.2.31", from: "0.2.30", to: "0.2.31" },
   { id: "starter-0.2.31-to-0.2.32", from: "0.2.31", to: "0.2.32" },
-  { id: "starter-0.2.32-to-0.2.33", from: "0.2.32", to: "0.2.33" }
+  { id: "starter-0.2.32-to-0.2.33", from: "0.2.32", to: "0.2.33" },
+  { id: "starter-0.2.33-to-0.2.34", from: "0.2.33", to: "0.2.34" }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
   if (sourceVersion === targetVersion)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-windy",
-  "version": "0.2.33",
+  "version": "0.2.34",
   "description": "创建单组织、单租户、私有部署优先的 Windy 企业 Dashboard Starter",
   "type": "module",
   "bin": {

package/template/.agents/skills/windy-business-module/SKILL.md

@@ -18,14 +18,23 @@ description: "Windy 业务模块、Manifest、Repository、Service、Agent Tool
    其它模块只能通过 Service、公开 Port 或模块注册机制协作。
 4. Server 通过 `InstallableServerModule` 和 `ModuleHost` 注册 Guarded Route、Task、
    Provider 或 Tool Handler。Handler 调用 Service，不直接访问其它模块 Repository。
+   需要选择启用用户时使用 `ModuleRequestContext.userDirectory`；不要导入用户 Admin
+   Repository。业务 RolePreset 不能注册平台 Permission，部署管理员须显式向业务角色
+   授予 `system.user-directory.read` 并配置数据范围。
 5. Tool 输入输出只使用 Manifest 已注册的顶层 object JSON Schema。Actor、Permission、
    Feature、License 和 Data Scope 只来自 `ModuleToolContext` 与平台 Runtime。
+   Tool 或 Route 需要读取同业务范围内其他用户上传的文件时，在 Host 注册精确
+   `purpose + resourceType` 的 `registerResourceFileAccessPolicies()`；Resolver 必须用
+   project-owned Repository 回查资源与 fileId 绑定及对象级授权，只返回布尔判定，
+   再通过 `context.storage.openResourceFile()` 取得最小元数据与流。禁止注入
+   UploadRepository、BlobStore 或申请平台 manage Repository。
 6. 若项目包含 `system.agent`，`operation=query` 的 Tool 会由同一 Registry 自动进入
    MCP；不要编辑 MCP Adapter 或复制 Tool 定义。写操作在幂等、审批和结果追踪闭环前
    不通过 MCP 暴露。
 7. 补 Manifest/Composition、Repository/Service、Guard 拒绝和 Handler 契约测试。
    涉及 Tool 时还要覆盖 Schema 拒绝、数据范围与未授权发现/调用；涉及可选模块时覆盖
-   Starter 的文件、依赖和数据库裁剪。
+   Starter 的文件、依赖和数据库裁剪。涉及资源文件时还要覆盖跨上传者成功、资源绑定/
+   purpose/Feature/Permission/Scope 任一拒绝、最小元数据与成功/拒绝审计。
 8. 更新长期文档，运行受影响测试、`bun run typecheck` 和 `bun run lint`，按一个完整
    小切片提交。
 

package/template/.windy-template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "templateCommit": "395761d19b6dac6f4135547bedf996e3a53249a7",
-  "generatorVersion": "0.2.33",
+  "templateCommit": "28f6b738276d5138a514a4ab374d60884b94e769",
+  "generatorVersion": "0.2.34",
   "modules": [
     {
       "name": "system",

package/template/AGENTS.md

@@ -44,6 +44,10 @@
   `apps/web/src/pages/auth/LoginPage.vue` 或 Router。业务页面复用
   `useLoginFlow`、`DevelopmentAuthWarning` 和平台品牌设置，保留安全
   `returnTo`、真实认证与开发认证提示。
+- 业务 Agent Operation 开启 Provider 出网时，必须在 Manifest 同时声明最小
+  `providerDataPolicy.inputFields` JSON Pointer allowlist 与
+  `envelopeFields`；raw input 会在进入 `prepare` 前裁剪并执行 DLP。接入与升级
+  诊断见 `docs/platform/agent-runtime.md`。
 
 ## 常用入口
 

package/template/apps/agent-server/README.md

@@ -32,6 +32,8 @@ export QWEN_API_KEY='<server-secret>'
 export QWEN_MODEL='qwen-plus'
 export AI_PROVIDER_HTTPS_HOST_ALLOWLIST='dashscope-intl.aliyuncs.com'
 export AGENT_RUN_STORE_PATH='.data/agent-runs.sqlite3'
+export AI_PROVIDER_AUDIT_STORE_PATH='.data/provider-audit.sqlite3'
+export AI_PROVIDER_AUDIT_RETENTION_DAYS='90'
 uv run uvicorn southwind_agent_server.app:app
 ```
 
@@ -46,3 +48,11 @@ readiness。缺少 URL/Model 时回退
 cursor；多副本部署仍必须替换为共享 Store。Execution Grant 与 Tool 授权由
 Southwind AI Server 签发和复核，Agent Server 不能自行扩大 Operation 的
 `allowedToolKeys`。
+
+每次实际 `/chat/completions` HTTP 调用前，Runtime 会对 Manifest 允许的输入 JSON
+Pointer 与 Provider outbound envelope 字段执行 DLP，并将 deployment、operation、
+run、attempt、分类集合、实际序列化请求字节数和 allow/redact/reject 决策写入独立
+SQLite append-only 表。审计不保存 prompt、请求正文或 Secret；审计写入失败时禁止
+出网。记录到期后只由配置的 TTL 清理，清理计数可通过需内部 Token 的
+`GET /health/provider-governance` 查看。SQLite 实现仅支持单副本；多副本部署必须替换
+为共享、并发安全的审计 Adapter。

package/template/apps/agent-server/src/southwind_agent_server/app.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import hmac
 import os
 import uuid
-from typing import Annotated
+from typing import Annotated, cast
 
 from fastapi import FastAPI, Header, Query, Request
 from fastapi.exceptions import RequestValidationError
@@ -23,6 +23,8 @@ from .contracts import (
 from .engine import AgentEngineAdapter
 from .openai_engine import OpenAiCompatibleEngineAdapter
 from .openai_provider import OpenAiCompatibleProvider
+from .provider_audit import ProviderAuditStore
+from .provider_governance import ProviderRequestGovernance
 from .service import (
     AgentRunService,
     IdempotencyConflictError,
@@ -71,6 +73,24 @@ def create_app(
                 True,
             )
 
+    @application.get("/health/provider-governance", response_model=None)
+    async def provider_governance_health(
+        authorization: Annotated[str | None, Header()] = None,
+    ) -> dict[str, int | float | str | None] | JSONResponse:
+        if not authorized(authorization, internal_token):
+            return safe_error(403, "FORBIDDEN", "内部调用认证失败", False)
+        health = getattr(runtime_engine, "governance_health", None)
+        if not health:
+            return safe_error(
+                503,
+                "RUNTIME_UNAVAILABLE",
+                "Provider 字段治理尚未配置",
+                True,
+            )
+        return provider_governance_snapshot(
+            cast(dict[str, int | float | str | None], health())
+        )
+
     @application.exception_handler(OperationNotFoundError)
     async def operation_not_found(
         _request: Request,
@@ -215,6 +235,12 @@ def default_engine() -> AgentEngineAdapter:
             EnvironmentSecretResolver(os.environ),
         ),
         ToolHostClient(internal_token),
+        ProviderRequestGovernance(
+            ProviderAuditStore(
+                required_environment("AI_PROVIDER_AUDIT_STORE_PATH"),
+                retention_days=provider_audit_retention_days(),
+            )
+        ),
     )
 
 
@@ -223,6 +249,41 @@ def default_store() -> RunStore:
     return SqliteRunStore(path) if path else InMemoryRunStore()
 
 
+def required_environment(key: str) -> str:
+    value = os.environ.get(key, "").strip()
+    if not value:
+        raise ValueError(f"Provider 已配置但缺少 {key}")
+    return value
+
+
+def provider_audit_retention_days() -> int:
+    raw = os.environ.get("AI_PROVIDER_AUDIT_RETENTION_DAYS", "90")
+    try:
+        value = int(raw)
+    except ValueError as error:
+        raise ValueError("AI_PROVIDER_AUDIT_RETENTION_DAYS 必须是整数") from error
+    if not 1 <= value <= 3650:
+        raise ValueError("AI_PROVIDER_AUDIT_RETENTION_DAYS 超出允许范围")
+    return value
+
+
+def provider_governance_snapshot(
+    value: dict[str, int | float | str | None],
+) -> dict[str, int | float | str | None]:
+    allowed = (
+        "status",
+        "retentionDays",
+        "retainedRecords",
+        "rejectedAttempts",
+        "redactedAttempts",
+        "lastAttemptAt",
+        "lastPurgeAt",
+        "lastDeletedRecords",
+        "totalDeletedRecords",
+    )
+    return {key: value.get(key) for key in allowed}
+
+
 def authorized(provided: str | None, expected: str | None) -> bool:
     if expected is None:
         return True

package/template/apps/agent-server/src/southwind_agent_server/contracts.py

@@ -74,6 +74,40 @@ class ProviderEgress(CanonicalModel):
         return self
 
 
+type ProviderDataField = Literal[
+    "instructions",
+    "user-prompt",
+    "tool-definitions",
+    "provider-output",
+    "tool-results",
+]
+
+
+class ProviderFieldPolicy(CanonicalModel):
+    field: ProviderDataField
+    classification: Literal["public", "internal", "sensitive"]
+    dlp_action: Literal["reject", "redact"]
+
+
+class ProviderInputFieldPolicy(CanonicalModel):
+    json_pointer: str = Field(pattern=r"^/[^/]+(?:/[^/]+)*$")
+    classification: Literal["public", "internal", "sensitive"]
+    dlp_action: Literal["reject", "redact"]
+
+
+class ProviderDataPolicy(CanonicalModel):
+    input_fields: list[ProviderInputFieldPolicy] = Field(default_factory=list)
+    envelope_fields: list[ProviderFieldPolicy] = Field(default_factory=list)
+
+    @model_validator(mode="after")
+    def validate_fields(self) -> Self:
+        names = [rule.field for rule in self.envelope_fields]
+        pointers = [rule.json_pointer for rule in self.input_fields]
+        if len(names) != len(set(names)) or len(pointers) != len(set(pointers)):
+            raise ValueError("Provider 字段发送规则重复")
+        return self
+
+
 class ToolNetworkPolicy(CanonicalModel):
     mode: Literal["forbidden"] = "forbidden"
 
@@ -86,6 +120,7 @@ class StartRunRequest(CanonicalModel):
     allowed_tools: list[RuntimeToolDefinition] = Field(default_factory=list)
     limits: RuntimeLimits = Field(default_factory=RuntimeLimits)
     provider_egress: ProviderEgress = Field(default_factory=ProviderEgress)
+    provider_data_policy: ProviderDataPolicy = Field(default_factory=ProviderDataPolicy)
     tool_network_policy: ToolNetworkPolicy = Field(default_factory=ToolNetworkPolicy)
     execution_grant: str = ""
     tool_host_url: str = ""

package/template/apps/agent-server/src/southwind_agent_server/engine.py

@@ -7,6 +7,7 @@ from typing import Protocol
 from .contracts import (
     AgentErrorCode,
     JsonValue,
+    ProviderDataPolicy,
     ProviderEgress,
     RuntimeLimits,
     RuntimeToolDefinition,
@@ -24,6 +25,7 @@ class EngineRunRequest:
     allowed_tools: tuple[RuntimeToolDefinition, ...] = ()
     limits: RuntimeLimits = field(default_factory=RuntimeLimits)
     provider_egress: ProviderEgress = field(default_factory=ProviderEgress)
+    provider_data_policy: ProviderDataPolicy = field(default_factory=ProviderDataPolicy)
     tool_network_policy: ToolNetworkPolicy = field(default_factory=ToolNetworkPolicy)
     execution_grant: str = ""
     tool_host_url: str = ""

package/template/apps/agent-server/src/southwind_agent_server/openai_engine.py

@@ -17,6 +17,7 @@ from .engine import (
     UsageReported,
 )
 from .openai_provider import OpenAiCompatibleProvider, ProviderToolCall
+from .provider_governance import ProviderRequestGovernance
 from .tool_host import ToolHostClient, ToolInvocation
 
 
@@ -25,9 +26,11 @@ class OpenAiCompatibleEngineAdapter(AgentEngineAdapter):
         self,
         provider: OpenAiCompatibleProvider,
         tool_host: ToolHostClient,
+        governance: ProviderRequestGovernance,
     ) -> None:
         self._provider = provider
         self._tool_host = tool_host
+        self._governance = governance
         self._cancellations: dict[str, asyncio.Event] = {}
 
     def supports(self, operation_key: str) -> bool:
@@ -49,11 +52,24 @@ class OpenAiCompatibleEngineAdapter(AgentEngineAdapter):
         ]
         output_bytes = 0
         try:
-            for _round in range(self._provider.config.max_tool_rounds):
+            for attempt in range(1, self._provider.config.max_tool_rounds + 1):
                 cancelled(cancellation)
+                governed = self._governance.authorize(
+                    deployment_key=self._provider.config.deployment_key,
+                    operation_key=request.operation_key,
+                    run_id=request.run_id,
+                    attempt=attempt,
+                    messages=messages,
+                    tools=request.allowed_tools,
+                    policy=request.provider_data_policy,
+                    input_value=request.input,
+                    measure=lambda messages, tools: len(
+                        self._provider.request_body(messages, tools)
+                    ),
+                )
                 turn = await self._provider.complete_turn(
-                    messages,
-                    request.allowed_tools,
+                    governed.messages,
+                    governed.tools,
                 )
                 if turn.tool_calls:
                     messages.append(assistant_tool_message(turn.tool_calls))
@@ -135,6 +151,9 @@ class OpenAiCompatibleEngineAdapter(AgentEngineAdapter):
     async def health(self) -> None:
         await self._provider.health()
 
+    def governance_health(self) -> dict[str, int | float | str | None]:
+        return self._governance.health()
+
 
 def validate_runtime_request(
     request: EngineRunRequest,
@@ -166,6 +185,15 @@ def validate_runtime_request(
             "Agent Tool 网络策略不受支持",
             retryable=False,
         )
+    if (
+        not request.provider_data_policy.input_fields
+        or not request.provider_data_policy.envelope_fields
+    ):
+        raise SafeEngineError(
+            "FORBIDDEN",
+            "Agent Operation 缺少 Provider 字段治理策略",
+            retryable=False,
+        )
 
 
 def cancelled(event: asyncio.Event) -> None:

package/template/apps/agent-server/src/southwind_agent_server/openai_provider.py

@@ -59,21 +59,15 @@ class OpenAiCompatibleProvider:
         messages: list[dict[str, JsonValue]],
         tools: tuple[RuntimeToolDefinition, ...],
     ) -> ProviderTurn:
-        payload: dict[str, JsonValue] = {
-            "model": self.config.model,
-            "messages": cast(JsonValue, messages),
-            "stream": True,
-            "stream_options": {"include_usage": True},
-        }
-        if tools:
-            payload["tools"] = [tool_schema(tool) for tool in tools]
+        body = self.request_body(messages, tools)
         turn = ProviderTurn()
         async with self._client() as client:
             try:
                 async with client.stream(
                     "POST",
                     "/chat/completions",
-                    json=payload,
+                    content=body,
+                    headers={"content-type": "application/json"},
                 ) as response:
                     if not response.is_success:
                         await self._bounded_stream(response)
@@ -85,6 +79,25 @@ class OpenAiCompatibleProvider:
                 raise provider_failure(error) from None
         return turn
 
+    def request_body(
+        self,
+        messages: list[dict[str, JsonValue]],
+        tools: tuple[RuntimeToolDefinition, ...],
+    ) -> bytes:
+        payload: dict[str, JsonValue] = {
+            "model": self.config.model,
+            "messages": cast(JsonValue, messages),
+            "stream": True,
+            "stream_options": {"include_usage": True},
+        }
+        if tools:
+            payload["tools"] = [tool_schema(tool) for tool in tools]
+        return json.dumps(
+            payload,
+            ensure_ascii=False,
+            separators=(",", ":"),
+        ).encode()
+
     def _client(self) -> httpx.AsyncClient:
         api_key = (
             self._resolver.resolve(self.config.api_key_ref)

package/template/apps/agent-server/src/southwind_agent_server/provider_audit.py

@@ -0,0 +1,144 @@
+from __future__ import annotations
+
+import sqlite3
+import threading
+import time
+import uuid
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class ProviderAttemptAudit:
+    deployment_key: str
+    operation_key: str
+    run_id: str
+    attempt: int
+    classifications: tuple[str, ...]
+    sent_bytes: int
+    decision: str
+
+
+class ProviderAuditStore:
+    """Append-only Provider attempt metadata, except explicit TTL expiry."""
+
+    def __init__(self, path: str, *, retention_days: int) -> None:
+        if not path.strip():
+            raise ValueError("Provider 发送审计 Store 路径不能为空")
+        if not 1 <= retention_days <= 3650:
+            raise ValueError("Provider 发送审计留存天数超出范围")
+        Path(path).parent.mkdir(parents=True, exist_ok=True)
+        self._database = sqlite3.connect(path, check_same_thread=False)
+        self._lock = threading.RLock()
+        self._retention_seconds = retention_days * 24 * 60 * 60
+        self.retention_days = retention_days
+        self._initialize()
+        self.purge_expired()
+
+    def append(self, audit: ProviderAttemptAudit) -> None:
+        with self._lock:
+            self.purge_expired()
+            try:
+                self._database.execute(
+                    """
+                    insert into provider_attempt_audit (
+                      event_id, deployment_key, operation_key, run_id, attempt,
+                      classifications, sent_bytes, decision, occurred_at
+                    ) values (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                    """,
+                    (
+                        f"pa_{uuid.uuid4().hex}",
+                        audit.deployment_key,
+                        audit.operation_key,
+                        audit.run_id,
+                        audit.attempt,
+                        ",".join(audit.classifications),
+                        audit.sent_bytes,
+                        audit.decision,
+                        time.time(),
+                    ),
+                )
+                self._database.commit()
+            except Exception:
+                self._database.rollback()
+                raise
+
+    def purge_expired(self, *, now: float | None = None) -> int:
+        with self._lock:
+            cutoff = (now or time.time()) - self._retention_seconds
+            cursor = self._database.execute(
+                "delete from provider_attempt_audit where occurred_at < ?",
+                (cutoff,),
+            )
+            deleted = max(cursor.rowcount, 0)
+            self._database.execute(
+                """
+                update provider_audit_retention
+                set last_purge_at = ?, last_deleted = ?,
+                  total_deleted = total_deleted + ?
+                where singleton = 1
+                """,
+                (now or time.time(), deleted, deleted),
+            )
+            self._database.commit()
+            return deleted
+
+    def health(self) -> dict[str, int | float | str | None]:
+        with self._lock:
+            return self._health()
+
+    def _health(self) -> dict[str, int | float | str | None]:
+        row = self._database.execute(
+            """
+            select count(*) as retained,
+              sum(case when decision = 'reject' then 1 else 0 end) as rejected,
+              sum(case when decision = 'redact' then 1 else 0 end) as redacted,
+              max(occurred_at) as last_attempt_at
+            from provider_attempt_audit
+            """
+        ).fetchone()
+        retention = self._database.execute(
+            "select * from provider_audit_retention where singleton = 1"
+        ).fetchone()
+        return {
+            "status": "healthy",
+            "retentionDays": self.retention_days,
+            "retainedRecords": int(row[0] or 0),
+            "rejectedAttempts": int(row[1] or 0),
+            "redactedAttempts": int(row[2] or 0),
+            "lastAttemptAt": row[3],
+            "lastPurgeAt": retention[1],
+            "lastDeletedRecords": int(retention[2]),
+            "totalDeletedRecords": int(retention[3]),
+        }
+
+    def close(self) -> None:
+        with self._lock:
+            self._database.close()
+
+    def _initialize(self) -> None:
+        self._database.executescript(
+            """
+            create table if not exists provider_attempt_audit (
+              event_id text primary key,
+              deployment_key text not null,
+              operation_key text not null,
+              run_id text not null,
+              attempt integer not null,
+              classifications text not null,
+              sent_bytes integer not null,
+              decision text not null check(decision in ('allow', 'redact', 'reject')),
+              occurred_at real not null,
+              unique(run_id, attempt)
+            );
+            create table if not exists provider_audit_retention (
+              singleton integer primary key check(singleton = 1),
+              last_purge_at real,
+              last_deleted integer not null,
+              total_deleted integer not null
+            );
+            insert or ignore into provider_audit_retention
+              values (1, null, 0, 0);
+            """
+        )
+        self._database.commit()