create-windy 0.2.33 → 0.3.0

package/template/apps/agent-server/src/southwind_agent_server/engine.py

@@ -7,6 +7,7 @@ from typing import Protocol
 from .contracts import (
     AgentErrorCode,
     JsonValue,
+    ProviderDataPolicy,
     ProviderEgress,
     RuntimeLimits,
     RuntimeToolDefinition,
@@ -24,6 +25,7 @@ class EngineRunRequest:
     allowed_tools: tuple[RuntimeToolDefinition, ...] = ()
     limits: RuntimeLimits = field(default_factory=RuntimeLimits)
     provider_egress: ProviderEgress = field(default_factory=ProviderEgress)
+    provider_data_policy: ProviderDataPolicy = field(default_factory=ProviderDataPolicy)
     tool_network_policy: ToolNetworkPolicy = field(default_factory=ToolNetworkPolicy)
     execution_grant: str = ""
     tool_host_url: str = ""

package/template/apps/agent-server/src/southwind_agent_server/openai_engine.py

@@ -17,6 +17,7 @@ from .engine import (
     UsageReported,
 )
 from .openai_provider import OpenAiCompatibleProvider, ProviderToolCall
+from .provider_governance import ProviderRequestGovernance
 from .tool_host import ToolHostClient, ToolInvocation
 
 
@@ -25,9 +26,11 @@ class OpenAiCompatibleEngineAdapter(AgentEngineAdapter):
         self,
         provider: OpenAiCompatibleProvider,
         tool_host: ToolHostClient,
+        governance: ProviderRequestGovernance,
     ) -> None:
         self._provider = provider
         self._tool_host = tool_host
+        self._governance = governance
         self._cancellations: dict[str, asyncio.Event] = {}
 
     def supports(self, operation_key: str) -> bool:
@@ -49,11 +52,24 @@ class OpenAiCompatibleEngineAdapter(AgentEngineAdapter):
         ]
         output_bytes = 0
         try:
-            for _round in range(self._provider.config.max_tool_rounds):
+            for attempt in range(1, self._provider.config.max_tool_rounds + 1):
                 cancelled(cancellation)
+                governed = self._governance.authorize(
+                    deployment_key=self._provider.config.deployment_key,
+                    operation_key=request.operation_key,
+                    run_id=request.run_id,
+                    attempt=attempt,
+                    messages=messages,
+                    tools=request.allowed_tools,
+                    policy=request.provider_data_policy,
+                    input_value=request.input,
+                    measure=lambda messages, tools: len(
+                        self._provider.request_body(messages, tools)
+                    ),
+                )
                 turn = await self._provider.complete_turn(
-                    messages,
-                    request.allowed_tools,
+                    governed.messages,
+                    governed.tools,
                 )
                 if turn.tool_calls:
                     messages.append(assistant_tool_message(turn.tool_calls))
@@ -135,6 +151,9 @@ class OpenAiCompatibleEngineAdapter(AgentEngineAdapter):
     async def health(self) -> None:
         await self._provider.health()
 
+    def governance_health(self) -> dict[str, int | float | str | None]:
+        return self._governance.health()
+
 
 def validate_runtime_request(
     request: EngineRunRequest,
@@ -166,6 +185,15 @@ def validate_runtime_request(
             "Agent Tool 网络策略不受支持",
             retryable=False,
         )
+    if (
+        not request.provider_data_policy.input_fields
+        or not request.provider_data_policy.envelope_fields
+    ):
+        raise SafeEngineError(
+            "FORBIDDEN",
+            "Agent Operation 缺少 Provider 字段治理策略",
+            retryable=False,
+        )
 
 
 def cancelled(event: asyncio.Event) -> None:

package/template/apps/agent-server/src/southwind_agent_server/openai_provider.py

@@ -59,21 +59,15 @@ class OpenAiCompatibleProvider:
         messages: list[dict[str, JsonValue]],
         tools: tuple[RuntimeToolDefinition, ...],
     ) -> ProviderTurn:
-        payload: dict[str, JsonValue] = {
-            "model": self.config.model,
-            "messages": cast(JsonValue, messages),
-            "stream": True,
-            "stream_options": {"include_usage": True},
-        }
-        if tools:
-            payload["tools"] = [tool_schema(tool) for tool in tools]
+        body = self.request_body(messages, tools)
         turn = ProviderTurn()
         async with self._client() as client:
             try:
                 async with client.stream(
                     "POST",
                     "/chat/completions",
-                    json=payload,
+                    content=body,
+                    headers={"content-type": "application/json"},
                 ) as response:
                     if not response.is_success:
                         await self._bounded_stream(response)
@@ -85,6 +79,25 @@ class OpenAiCompatibleProvider:
                 raise provider_failure(error) from None
         return turn
 
+    def request_body(
+        self,
+        messages: list[dict[str, JsonValue]],
+        tools: tuple[RuntimeToolDefinition, ...],
+    ) -> bytes:
+        payload: dict[str, JsonValue] = {
+            "model": self.config.model,
+            "messages": cast(JsonValue, messages),
+            "stream": True,
+            "stream_options": {"include_usage": True},
+        }
+        if tools:
+            payload["tools"] = [tool_schema(tool) for tool in tools]
+        return json.dumps(
+            payload,
+            ensure_ascii=False,
+            separators=(",", ":"),
+        ).encode()
+
     def _client(self) -> httpx.AsyncClient:
         api_key = (
             self._resolver.resolve(self.config.api_key_ref)

package/template/apps/agent-server/src/southwind_agent_server/provider_audit.py

@@ -0,0 +1,144 @@
+from __future__ import annotations
+
+import sqlite3
+import threading
+import time
+import uuid
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class ProviderAttemptAudit:
+    deployment_key: str
+    operation_key: str
+    run_id: str
+    attempt: int
+    classifications: tuple[str, ...]
+    sent_bytes: int
+    decision: str
+
+
+class ProviderAuditStore:
+    """Append-only Provider attempt metadata, except explicit TTL expiry."""
+
+    def __init__(self, path: str, *, retention_days: int) -> None:
+        if not path.strip():
+            raise ValueError("Provider 发送审计 Store 路径不能为空")
+        if not 1 <= retention_days <= 3650:
+            raise ValueError("Provider 发送审计留存天数超出范围")
+        Path(path).parent.mkdir(parents=True, exist_ok=True)
+        self._database = sqlite3.connect(path, check_same_thread=False)
+        self._lock = threading.RLock()
+        self._retention_seconds = retention_days * 24 * 60 * 60
+        self.retention_days = retention_days
+        self._initialize()
+        self.purge_expired()
+
+    def append(self, audit: ProviderAttemptAudit) -> None:
+        with self._lock:
+            self.purge_expired()
+            try:
+                self._database.execute(
+                    """
+                    insert into provider_attempt_audit (
+                      event_id, deployment_key, operation_key, run_id, attempt,
+                      classifications, sent_bytes, decision, occurred_at
+                    ) values (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                    """,
+                    (
+                        f"pa_{uuid.uuid4().hex}",
+                        audit.deployment_key,
+                        audit.operation_key,
+                        audit.run_id,
+                        audit.attempt,
+                        ",".join(audit.classifications),
+                        audit.sent_bytes,
+                        audit.decision,
+                        time.time(),
+                    ),
+                )
+                self._database.commit()
+            except Exception:
+                self._database.rollback()
+                raise
+
+    def purge_expired(self, *, now: float | None = None) -> int:
+        with self._lock:
+            cutoff = (now or time.time()) - self._retention_seconds
+            cursor = self._database.execute(
+                "delete from provider_attempt_audit where occurred_at < ?",
+                (cutoff,),
+            )
+            deleted = max(cursor.rowcount, 0)
+            self._database.execute(
+                """
+                update provider_audit_retention
+                set last_purge_at = ?, last_deleted = ?,
+                  total_deleted = total_deleted + ?
+                where singleton = 1
+                """,
+                (now or time.time(), deleted, deleted),
+            )
+            self._database.commit()
+            return deleted
+
+    def health(self) -> dict[str, int | float | str | None]:
+        with self._lock:
+            return self._health()
+
+    def _health(self) -> dict[str, int | float | str | None]:
+        row = self._database.execute(
+            """
+            select count(*) as retained,
+              sum(case when decision = 'reject' then 1 else 0 end) as rejected,
+              sum(case when decision = 'redact' then 1 else 0 end) as redacted,
+              max(occurred_at) as last_attempt_at
+            from provider_attempt_audit
+            """
+        ).fetchone()
+        retention = self._database.execute(
+            "select * from provider_audit_retention where singleton = 1"
+        ).fetchone()
+        return {
+            "status": "healthy",
+            "retentionDays": self.retention_days,
+            "retainedRecords": int(row[0] or 0),
+            "rejectedAttempts": int(row[1] or 0),
+            "redactedAttempts": int(row[2] or 0),
+            "lastAttemptAt": row[3],
+            "lastPurgeAt": retention[1],
+            "lastDeletedRecords": int(retention[2]),
+            "totalDeletedRecords": int(retention[3]),
+        }
+
+    def close(self) -> None:
+        with self._lock:
+            self._database.close()
+
+    def _initialize(self) -> None:
+        self._database.executescript(
+            """
+            create table if not exists provider_attempt_audit (
+              event_id text primary key,
+              deployment_key text not null,
+              operation_key text not null,
+              run_id text not null,
+              attempt integer not null,
+              classifications text not null,
+              sent_bytes integer not null,
+              decision text not null check(decision in ('allow', 'redact', 'reject')),
+              occurred_at real not null,
+              unique(run_id, attempt)
+            );
+            create table if not exists provider_audit_retention (
+              singleton integer primary key check(singleton = 1),
+              last_purge_at real,
+              last_deleted integer not null,
+              total_deleted integer not null
+            );
+            insert or ignore into provider_audit_retention
+              values (1, null, 0, 0);
+            """
+        )
+        self._database.commit()

package/template/apps/agent-server/src/southwind_agent_server/provider_governance.py

@@ -0,0 +1,227 @@
+from __future__ import annotations
+
+import json
+import re
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import cast
+
+from .contracts import (
+    JsonValue,
+    ProviderDataField,
+    ProviderDataPolicy,
+    RuntimeToolDefinition,
+)
+from .engine import SafeEngineError
+from .provider_audit import ProviderAttemptAudit, ProviderAuditStore
+
+_DLP_PATTERNS = (
+    re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/=-]{8,}"),
+    re.compile(r"(?i)\b(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+"),
+    re.compile(r"\b1[3-9]\d{9}\b"),
+    re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I),
+    re.compile(r"\b\d{17}[\dXx]\b"),
+    re.compile(r"\b(?:\d[ -]?){16,30}\b"),
+)
+_REDACTED = "[REDACTED]"
+
+
+@dataclass(frozen=True)
+class GovernedAttempt:
+    messages: list[dict[str, JsonValue]]
+    tools: tuple[RuntimeToolDefinition, ...]
+
+
+class ProviderRequestGovernance:
+    def __init__(self, audit: ProviderAuditStore) -> None:
+        self.audit = audit
+
+    def authorize(
+        self,
+        *,
+        deployment_key: str,
+        operation_key: str,
+        run_id: str,
+        attempt: int,
+        messages: list[dict[str, JsonValue]],
+        tools: tuple[RuntimeToolDefinition, ...],
+        policy: ProviderDataPolicy,
+        input_value: JsonValue = None,
+        measure: Callable[
+            [list[dict[str, JsonValue]], tuple[RuntimeToolDefinition, ...]], int
+        ]
+        | None = None,
+    ) -> GovernedAttempt:
+        rules = {rule.field: rule for rule in policy.envelope_fields}
+        classified: set[str] = set()
+        classified.update(input_classifications(input_value, policy))
+        redacted = False
+        governed_messages: list[dict[str, JsonValue]] = []
+        try:
+            for message in messages:
+                field = field_for_message(message)
+                rule = rules.get(field)
+                if rule is None:
+                    raise GovernanceDenied(f"Provider 未授权发送字段：{field}")
+                classified.add(rule.classification)
+                value, changed = govern_value(message, rule.dlp_action)
+                redacted = redacted or changed
+                governed_messages.append(cast(dict[str, JsonValue], value))
+            governed_tools = tools
+            if tools:
+                rule = rules.get("tool-definitions")
+                if rule is None:
+                    raise GovernanceDenied("Provider 未授权发送字段：tool-definitions")
+                classified.add(rule.classification)
+                raw_tools = [tool.model_dump(by_alias=True) for tool in tools]
+                governed, changed = govern_value(raw_tools, rule.dlp_action)
+                redacted = redacted or changed
+                governed_tools = tuple(
+                    RuntimeToolDefinition.model_validate(item)
+                    for item in cast(list[object], governed)
+                )
+            sent_bytes = (measure or payload_size)(
+                governed_messages,
+                governed_tools,
+            )
+            decision = "redact" if redacted else "allow"
+            self._record(
+                deployment_key,
+                operation_key,
+                run_id,
+                attempt,
+                classified,
+                sent_bytes,
+                decision,
+            )
+            return GovernedAttempt(governed_messages, governed_tools)
+        except GovernanceDenied:
+            self._record(
+                deployment_key,
+                operation_key,
+                run_id,
+                attempt,
+                classified,
+                0,
+                "reject",
+            )
+            raise SafeEngineError(
+                "FORBIDDEN",
+                "Provider 请求被字段治理策略拒绝",
+                retryable=False,
+            ) from None
+
+    def health(self) -> dict[str, int | float | str | None]:
+        return self.audit.health()
+
+    def _record(
+        self,
+        deployment_key: str,
+        operation_key: str,
+        run_id: str,
+        attempt: int,
+        classified: set[str],
+        sent_bytes: int,
+        decision: str,
+    ) -> None:
+        try:
+            self.audit.append(
+                ProviderAttemptAudit(
+                    deployment_key,
+                    operation_key,
+                    run_id,
+                    attempt,
+                    tuple(sorted(classified)),
+                    sent_bytes,
+                    decision,
+                )
+            )
+        except Exception:
+            raise SafeEngineError(
+                "FORBIDDEN",
+                "Provider 发送审计不可用",
+                retryable=False,
+            ) from None
+
+
+class GovernanceDenied(Exception):
+    pass
+
+
+def field_for_message(message: dict[str, JsonValue]) -> ProviderDataField:
+    role = message.get("role")
+    if role == "system":
+        return "instructions"
+    if role == "user":
+        return "user-prompt"
+    if role == "assistant":
+        return "provider-output"
+    if role == "tool":
+        return "tool-results"
+    raise GovernanceDenied("Provider 消息角色未知")
+
+
+def input_classifications(
+    value: JsonValue,
+    policy: ProviderDataPolicy,
+) -> set[str]:
+    result: set[str] = set()
+    for rule in policy.input_fields:
+        current = value
+        found = True
+        for encoded in rule.json_pointer.removeprefix("/").split("/"):
+            segment = encoded.replace("~1", "/").replace("~0", "~")
+            if not isinstance(current, dict) or segment not in current:
+                found = False
+                break
+            current = current[segment]
+        if found:
+            result.add(rule.classification)
+    return result
+
+
+def govern_value(value: object, action: str) -> tuple[object, bool]:
+    if isinstance(value, str):
+        detected = any(pattern.search(value) for pattern in _DLP_PATTERNS)
+        if detected and action == "reject":
+            raise GovernanceDenied("DLP reject")
+        if detected:
+            result = value
+            for pattern in _DLP_PATTERNS:
+                result = pattern.sub(_REDACTED, result)
+            return result, result != value
+        return value, False
+    if isinstance(value, list):
+        changed = False
+        items: list[object] = []
+        for item in value:
+            governed, item_changed = govern_value(item, action)
+            items.append(governed)
+            changed = changed or item_changed
+        return items, changed
+    if isinstance(value, dict):
+        changed = False
+        governed_record: dict[str, object] = {}
+        for key, item in value.items():
+            governed, item_changed = govern_value(item, action)
+            governed_record[key] = governed
+            changed = changed or item_changed
+        return governed_record, changed
+    return value, False
+
+
+def payload_size(
+    messages: list[dict[str, JsonValue]],
+    tools: tuple[RuntimeToolDefinition, ...],
+) -> int:
+    payload = {
+        "messages": messages,
+        "tools": [tool.model_dump(by_alias=True) for tool in tools],
+    }
+    return len(
+        json.dumps(
+            payload,
+            ensure_ascii=False,
+            separators=(",", ":"),
+        ).encode()
+    )

package/template/apps/agent-server/src/southwind_agent_server/service.py

@@ -86,6 +86,7 @@ class AgentRunService:
                 allowed_tools=tuple(invocation.allowed_tools),
                 limits=invocation.limits,
                 provider_egress=invocation.provider_egress,
+                provider_data_policy=invocation.provider_data_policy,
                 tool_network_policy=invocation.tool_network_policy,
                 execution_grant=invocation.execution_grant,
                 tool_host_url=invocation.tool_host_url,