create-windy 0.2.33 → 0.2.34

package/template/apps/server/src/agent/provider-input-governance.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, test } from "bun:test";
+import type { AiProviderDataPolicy } from "@southwind-ai/modules";
+import {
+  governProviderInput,
+  ProviderInputGovernanceError,
+} from "./provider-input-governance.js";
+
+const policy: AiProviderDataPolicy = {
+  inputFields: [
+    {
+      jsonPointer: "/question",
+      classification: "internal",
+      dlpAction: "redact",
+    },
+    {
+      jsonPointer: "/identity",
+      classification: "sensitive",
+      dlpAction: "reject",
+    },
+  ],
+  envelopeFields: [
+    {
+      field: "instructions",
+      classification: "internal",
+      dlpAction: "reject",
+    },
+    {
+      field: "user-prompt",
+      classification: "internal",
+      dlpAction: "redact",
+    },
+  ],
+};
+
+describe("Provider 输入字段治理", () => {
+  test("只保留 JSON Pointer allowlist 并在 Handler 前脱敏", () => {
+    const governed = governProviderInput(
+      {
+        question: "联系 me@example.com 或 13800138000",
+        internalCaseId: "case-secret",
+      },
+      policy,
+    );
+
+    expect(governed).toEqual({
+      question: "联系 [REDACTED] 或 [REDACTED]",
+    });
+    expect(JSON.stringify(governed)).not.toContain("case-secret");
+  });
+
+  test.each([
+    "password=do-not-send",
+    "Bearer abcdefghijklmnop",
+    "11010519491231002X",
+    "6222 0201 2345 6789 012",
+  ])("高风险字段按 reject 策略拒绝：%s", (identity) => {
+    expect(() =>
+      governProviderInput({ question: "ok", identity }, policy),
+    ).toThrow(ProviderInputGovernanceError);
+  });
+
+  test("拒绝非对象输入和非法 JSON Pointer", () => {
+    expect(() => governProviderInput("raw", policy)).toThrow("输入必须是对象");
+    expect(() =>
+      governProviderInput(
+        { question: "ok" },
+        {
+          ...policy,
+          inputFields: [{ ...policy.inputFields[0]!, jsonPointer: "/bad~2" }],
+        },
+      ),
+    ).toThrow("JSON Pointer 无效");
+  });
+
+  test("allowlist 只读取输入自身字段，不继承原型属性", () => {
+    const inherited = Object.create({
+      question: "prototype-secret",
+    }) as Record<string, string>;
+
+    expect(governProviderInput(inherited, policy)).toEqual({});
+  });
+});

package/template/apps/server/src/agent/provider-input-governance.ts

@@ -0,0 +1,140 @@
+import type {
+  AiProviderDataPolicy,
+  AiProviderDlpAction,
+} from "@southwind-ai/modules";
+import type { ModuleAiJsonValue } from "@southwind-ai/server-sdk";
+
+export class ProviderInputGovernanceError extends Error {
+  constructor(
+    readonly code: "INVALID_INPUT" | "FORBIDDEN",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+const dlpPatterns = [
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/giu,
+  /\b(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+/giu,
+  /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu,
+  /\b1[3-9]\d{9}\b/gu,
+  /\b\d{17}[\dXx]\b/gu,
+  /\b(?:\d[ -]?){16,30}\b/gu,
+];
+
+export function governProviderInput(
+  input: ModuleAiJsonValue,
+  policy: AiProviderDataPolicy,
+): ModuleAiJsonValue {
+  if (!isRecord(input)) {
+    throw new ProviderInputGovernanceError(
+      "INVALID_INPUT",
+      "Provider Operation 输入必须是对象",
+    );
+  }
+  const governed: Record<string, ModuleAiJsonValue> = Object.create(null);
+  for (const rule of policy.inputFields) {
+    const segments = parseJsonPointer(rule.jsonPointer);
+    const result = readPath(input, segments);
+    if (!result.found) continue;
+    writePath(governed, segments, governValue(result.value, rule.dlpAction));
+  }
+  return governed;
+}
+
+function governValue(
+  value: ModuleAiJsonValue,
+  action: AiProviderDlpAction,
+): ModuleAiJsonValue {
+  if (typeof value === "string") {
+    if (!dlpPatterns.some((pattern) => matches(pattern, value))) return value;
+    if (action === "reject") {
+      throw new ProviderInputGovernanceError(
+        "FORBIDDEN",
+        "Provider 输入被 DLP 策略拒绝",
+      );
+    }
+    return dlpPatterns.reduce(
+      (result, pattern) => result.replace(pattern, "[REDACTED]"),
+      value,
+    );
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => governValue(item, action));
+  }
+  if (isRecord(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [
+        key,
+        governValue(item, action),
+      ]),
+    );
+  }
+  return value;
+}
+
+function parseJsonPointer(pointer: string): string[] {
+  return pointer
+    .slice(1)
+    .split("/")
+    .map((segment) => {
+      if (/~(?:[^01]|$)/u.test(segment)) {
+        throw new ProviderInputGovernanceError(
+          "INVALID_INPUT",
+          "Provider 输入字段 JSON Pointer 无效",
+        );
+      }
+      const decoded = segment.replaceAll("~1", "/").replaceAll("~0", "~");
+      if (["__proto__", "prototype", "constructor"].includes(decoded)) {
+        throw new ProviderInputGovernanceError(
+          "INVALID_INPUT",
+          "Provider 输入字段 JSON Pointer 无效",
+        );
+      }
+      return decoded;
+    });
+}
+
+function readPath(
+  input: Record<string, ModuleAiJsonValue>,
+  segments: readonly string[],
+): { found: boolean; value: ModuleAiJsonValue } {
+  let current: ModuleAiJsonValue = input;
+  for (const segment of segments) {
+    if (!isRecord(current) || !Object.hasOwn(current, segment)) {
+      return { found: false, value: null };
+    }
+    current = current[segment]!;
+  }
+  return { found: true, value: current };
+}
+
+function writePath(
+  output: Record<string, ModuleAiJsonValue>,
+  segments: readonly string[],
+  value: ModuleAiJsonValue,
+): void {
+  let current = output;
+  segments.forEach((segment, index) => {
+    if (index === segments.length - 1) {
+      current[segment] = value;
+      return;
+    }
+    const next = current[segment];
+    if (!isRecord(next)) {
+      current[segment] = Object.create(null);
+    }
+    current = current[segment] as Record<string, ModuleAiJsonValue>;
+  });
+}
+
+function matches(pattern: RegExp, value: string): boolean {
+  pattern.lastIndex = 0;
+  return pattern.test(value);
+}
+
+function isRecord(
+  value: ModuleAiJsonValue,
+): value is Record<string, ModuleAiJsonValue> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/template/apps/server/src/agent/remote-runtime.test.ts

@@ -40,6 +40,27 @@ describe("RemoteAgentRuntime", () => {
         mode: "configured-endpoint",
         deploymentKey: "ai.openai-compatible",
       },
+      providerDataPolicy: {
+        inputFields: [
+          {
+            jsonPointer: "/question",
+            classification: "internal",
+            dlpAction: "redact",
+          },
+        ],
+        envelopeFields: [
+          {
+            field: "instructions",
+            classification: "internal",
+            dlpAction: "reject",
+          },
+          {
+            field: "user-prompt",
+            classification: "internal",
+            dlpAction: "redact",
+          },
+        ],
+      },
       toolNetworkPolicy: { mode: "forbidden" },
       executionGrant: "grant_1",
     };
@@ -60,6 +81,7 @@ describe("RemoteAgentRuntime", () => {
         mode: "configured-endpoint",
         deploymentKey: "ai.openai-compatible",
       },
+      providerDataPolicy: operation.providerDataPolicy,
       toolNetworkPolicy: { mode: "forbidden" },
     });
     expect(

package/template/apps/server/src/agent/remote-runtime.ts

@@ -38,6 +38,7 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
         maxOutputBytes: request.limits.maxOutputBytes,
       },
       providerEgress: request.providerEgress,
+      providerDataPolicy: request.providerDataPolicy,
       toolNetworkPolicy: request.toolNetworkPolicy,
       executionGrant: request.executionGrant,
       toolHostUrl: this.options.toolHostUrl,

package/template/apps/server/src/agent/run-contracts.ts

@@ -1,4 +1,5 @@
 import type {
+  AiProviderDataPolicy,
   AiProviderEgressPolicy,
   AiToolNetworkPolicy,
 } from "@southwind-ai/modules";
@@ -19,6 +20,7 @@ export interface AgentRuntimeOperation {
     maxOutputBytes: number;
   };
   providerEgress: AiProviderEgressPolicy;
+  providerDataPolicy: AiProviderDataPolicy;
   toolNetworkPolicy: AiToolNetworkPolicy;
   executionGrant: string;
 }

package/template/apps/server/src/agent/run-facade.test.ts

@@ -17,7 +17,7 @@ describe("Guarded Agent Run facade", () => {
     const fixture = await createFixture();
     const created = await fixture.facade.start(
       "business.answer",
-      { question: "你好" },
+      { question: "你好", internalCaseId: "case-secret" },
       "request-1",
       fixture.context,
     );
@@ -33,8 +33,18 @@ describe("Guarded Agent Run facade", () => {
       instructions: "只回答当前业务问题。",
       userPrompt: "你好",
       allowedTools: [{ key: "business.records.list" }],
+      providerDataPolicy: {
+        inputFields: expect.arrayContaining([
+          expect.objectContaining({ jsonPointer: "/question" }),
+        ]),
+        envelopeFields: expect.arrayContaining([
+          expect.objectContaining({ field: "instructions" }),
+        ]),
+      },
     });
     expect(fixture.remote.started[0]?.executionGrant).toMatch(/^grant_/);
+    expect(fixture.remote.started[0]?.input).toEqual({ question: "你好" });
+    expect(JSON.stringify(fixture.prepared)).not.toContain("case-secret");
     expect(() =>
       fixture.facade.authorizeRun("run_1", fixture.context),
     ).not.toThrow();
@@ -250,7 +260,47 @@ function manifest(): ModuleManifest {
         allowedToolKeys: ["business.records.list"],
         dataClassification: "internal",
         execution: "streaming",
-        publicNetworkAccess: "forbidden",
+        providerEgress: {
+          mode: "configured-endpoint",
+          deploymentKey: "ai.openai-compatible",
+        },
+        providerDataPolicy: {
+          inputFields: [
+            {
+              jsonPointer: "/question",
+              classification: "internal",
+              dlpAction: "redact",
+            },
+          ],
+          envelopeFields: [
+            {
+              field: "instructions",
+              classification: "internal",
+              dlpAction: "reject",
+            },
+            {
+              field: "user-prompt",
+              classification: "internal",
+              dlpAction: "redact",
+            },
+            {
+              field: "tool-definitions",
+              classification: "internal",
+              dlpAction: "reject",
+            },
+            {
+              field: "provider-output",
+              classification: "internal",
+              dlpAction: "redact",
+            },
+            {
+              field: "tool-results",
+              classification: "sensitive",
+              dlpAction: "redact",
+            },
+          ],
+        },
+        toolNetworkPolicy: { mode: "forbidden" },
         limits: {
           maxDurationSeconds: 60,
           maxInputBytes: 4096,

package/template/apps/server/src/agent/run-facade.ts

@@ -22,6 +22,10 @@ import type {
   AgentRuntimePort,
   AgentRuntimeStartResponse,
 } from "./run-contracts.js";
+import {
+  governProviderInput,
+  ProviderInputGovernanceError,
+} from "./provider-input-governance.js";
 
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
@@ -88,7 +92,33 @@ export class AgentRunFacade {
       );
     }
     assertInputSize(input, operation.definition.limits.maxInputBytes);
-    const plan = await operation.handler.prepare(input, {
+    const providerPolicy = operation.definition.providerDataPolicy;
+    if (
+      operation.definition.providerEgress?.mode === "configured-endpoint" &&
+      !providerPolicy
+    ) {
+      throw new AgentRunFacadeError(
+        "FORBIDDEN",
+        "Agent Operation 缺少 Provider 字段治理策略",
+        403,
+      );
+    }
+    let governedInput = input;
+    try {
+      governedInput = providerPolicy
+        ? governProviderInput(input, providerPolicy)
+        : input;
+    } catch (error) {
+      if (error instanceof ProviderInputGovernanceError) {
+        throw new AgentRunFacadeError(
+          error.code,
+          error.message,
+          error.code === "FORBIDDEN" ? 403 : 400,
+        );
+      }
+      throw error;
+    }
+    const plan = await operation.handler.prepare(governedInput, {
       actor: toModuleActor(context.actor),
       requestId: context.requestId,
     });
@@ -104,12 +134,16 @@ export class AgentRunFacade {
       const created = await this.remote.start(
         {
           operationKey,
-          input,
+          input: governedInput,
           instructions: plan.instructions,
           userPrompt: plan.userPrompt,
           allowedTools: operation.tools,
           limits: operation.definition.limits,
           providerEgress: resolveProviderEgress(operation.definition),
+          providerDataPolicy: operation.definition.providerDataPolicy ?? {
+            inputFields: [],
+            envelopeFields: [],
+          },
           toolNetworkPolicy: resolveToolNetworkPolicy(operation.definition),
           executionGrant: grant.token,
         },

package/template/apps/server/src/index.ts

@@ -104,6 +104,7 @@ const {
   moduleHosts,
   systemRepositories,
 } = await bootstrapServerModules(platformConfig, persistence);
+const features = foundationSnapshot.features;
 // @windy-module system.license begin
 const platformLicenseOptions = createPlatformLicenseRuntimeOptions(process.env);
 const platformLicenseRuntime = new PlatformLicenseRuntime(
@@ -121,7 +122,7 @@ const runtime = createServerRuntime(process.env, {
     : persistence?.licenseResolver,
   // @windy-module system.license end
   featureResolver: persistence ? systemRepositories.features : undefined,
-  featureCatalog: foundationSnapshot.features,
+  featureCatalog: features,
   // @windy-module system.audit begin
   auditReader: persistence?.auditReader,
   auditWriter: persistence?.auditWriter,
@@ -169,7 +170,7 @@ const searchHost = createSearchHost(
 // @windy-module system.scheduler begin
 const moduleTaskDefinitions = createModuleTaskDefinitions(
   moduleHosts,
-  foundationSnapshot.features,
+  features,
 );
 const {
   bulkDataService,
@@ -209,33 +210,23 @@ registerAuthRoutes(app, authService, {
   sessionCookieName: platformConfig.security.sessionCookieName,
   secureCookie: process.env.NODE_ENV === "production",
 });
-registerProfileRoutes(
-  app,
-  authRepository,
-  runtime,
-  foundationSnapshot.features,
-);
+registerProfileRoutes(app, authRepository, runtime, features);
 
 // @windy-module system.license begin
 registerPlatformLicenseRoutes(app, platformLicenseRuntime);
 // @windy-module system.license end
 
 // @windy-module system.settings begin
-platformSettings.register(app, runtime, foundationSnapshot.features);
+platformSettings.register(app, runtime, features);
 // @windy-module system.settings end
 // @windy-module system.notification begin
-registerNotificationRoutes(
-  app,
-  notificationRepository,
-  runtime,
-  foundationSnapshot.features,
-);
+registerNotificationRoutes(app, notificationRepository, runtime, features);
 // @windy-module system.notification end
 // @windy-module system.workflow begin
 registerWorkflowRoutes(app, workflowService, runtime);
 // @windy-module system.workflow end
 // @windy-module system.configuration begin
-configurationRuntime.register(app, runtime, foundationSnapshot.features);
+configurationRuntime.register(app, runtime, features);
 // @windy-module system.configuration end
 // @windy-module system.storage begin
 registerStorageRoutes(
@@ -248,7 +239,7 @@ registerStorageRoutes(
       `/api/platform/files/${fileId}`,
   },
   runtime,
-  foundationSnapshot.features,
+  features,
 );
 // @windy-module system.storage end
 // @windy-module system.search begin
@@ -260,27 +251,18 @@ registerAdminBootstrapRoute(app, runtime, {
   snapshot: foundationSnapshot,
   loadMenus: () => systemRepositories.menuRegistry.tree(),
 });
-registerSessionContextRoute(app, runtime, foundationSnapshot.features);
+registerSessionContextRoute(app, runtime, features);
 
 registerFoundationRoute(app, runtime, foundationSnapshot, systemRepositories);
 
 // @windy-module system.data-governance begin
-registerGovernedUserExportRoutes(
-  app,
-  governedExportService,
-  runtime,
-  foundationSnapshot.features,
-);
+registerGovernedUserExportRoutes(app, governedExportService, runtime, features);
 // @windy-module system.data-governance end
-registerSystemRoutes(
-  app,
-  systemRepositories,
-  runtime,
-  foundationSnapshot.features,
-  { authRepository: persistence?.authRepository },
-);
+registerSystemRoutes(app, systemRepositories, runtime, features, {
+  authRepository: persistence?.authRepository,
+});
 // @windy-module system.operations begin
-registerSystemOperationRoutes(app, runtime, foundationSnapshot.features, {
+registerSystemOperationRoutes(app, runtime, features, {
   redisHealthProbe: configurationRuntime.redisHealthProbe,
   onlineUserProvider: () =>
     persistence?.authRepository.listActiveSessions(
@@ -293,7 +275,13 @@ registerSystemOperationRoutes(app, runtime, foundationSnapshot.features, {
 // @windy-module system.agent begin
 const toolHandlers = new Map([
   ...createSystemToolHandlers(systemRepositories, runtime),
-  ...createModuleToolHandlerMap(moduleHosts),
+  ...createModuleToolHandlerMap(moduleHosts, {
+    runtime,
+    features: foundationSnapshot.features,
+    // @windy-module system.storage begin
+    storage: storageRuntime,
+    // @windy-module system.storage end
+  }),
 ]);
 const toolRegistry = new GovernedToolRegistry(
   foundationModules,
@@ -301,10 +289,7 @@ const toolRegistry = new GovernedToolRegistry(
   runtime,
 );
 registerAgentRoutes(app, toolRegistry);
-registerMcpRoutes(
-  app,
-  new PlatformMcpAdapter(toolRegistry, runtime, foundationSnapshot.features),
-);
+registerMcpRoutes(app, new PlatformMcpAdapter(toolRegistry, runtime, features));
 registerAgentPlatformRuntime({
   app,
   platformConfig,
@@ -315,19 +300,14 @@ registerAgentPlatformRuntime({
 });
 // @windy-module system.agent end
 // @windy-module system.scheduler begin
-registerSchedulerRoutes(app, scheduler, runtime, foundationSnapshot.features);
+registerSchedulerRoutes(app, scheduler, runtime, features);
 // @windy-module system.scheduler end
 // @windy-module system.bulk-data begin
-registerBulkDataRoutes(
-  app,
-  bulkDataService,
-  runtime,
-  foundationSnapshot.features,
-);
+registerBulkDataRoutes(app, bulkDataService, runtime, features);
 // @windy-module system.bulk-data end
 installModuleRoutes(moduleHosts, app, {
   runtime,
-  features: foundationSnapshot.features,
+  features,
   // @windy-module system.scheduler begin
   jobs: durableJobRuntime.service,
   // @windy-module system.scheduler end
@@ -337,6 +317,9 @@ installModuleRoutes(moduleHosts, app, {
     files: storageRuntime.files,
   },
   // @windy-module system.storage end
+  userDirectory: {
+    repositories: systemRepositories,
+  },
 });
 
 validateInstalledRuntime({

package/template/apps/server/src/module-host/initialize-contracts.ts

@@ -5,6 +5,7 @@ import type {
   ModuleAiOperationHandlerRegistration,
   ModuleInitializer,
   ModuleRolePreset,
+  ModuleResourceFileAccessPolicy,
   ModuleRouteDefinition,
   ModuleSearchProvider,
   ModuleTaskHandlerRegistration,
@@ -54,6 +55,7 @@ export interface InitializeModuleHostsInput {
 export interface InitializedModuleHosts {
   readonly manifests: readonly ModuleManifest[];
   readonly uploadPolicies: readonly ModuleUploadPolicy[];
+  readonly resourceFileAccessPolicies: readonly ModuleResourceFileAccessPolicy[];
   readonly routes: readonly RegisteredModuleRoute[];
   readonly taskHandlers: readonly RegisteredModuleTaskHandler[];
   readonly toolHandlers: readonly RegisteredModuleToolHandler[];
@@ -63,5 +65,9 @@ export interface InitializedModuleHosts {
   manifestOf(moduleName: string): ModuleManifest;
   /** 该模块经 Host 注册的上传用途集合（不含平台基础用途）。 */
   uploadPurposesOf(moduleName: string): ReadonlySet<string>;
+  /** 该模块注册的资源文件读取策略。 */
+  resourceFileAccessPoliciesOf(
+    moduleName: string,
+  ): readonly ModuleResourceFileAccessPolicy[];
   installDurableHandlers(registry: DurableHandlerRegistry): void;
 }