create-windy 0.2.33 → 0.3.0

package/template/apps/agent-server/tests/test_provider_governance.py

@@ -0,0 +1,215 @@
+from __future__ import annotations
+
+import sqlite3
+import time
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from typing import Literal, cast
+
+import pytest
+
+from southwind_agent_server.contracts import (
+    ProviderDataPolicy,
+    ProviderFieldPolicy,
+    ProviderInputFieldPolicy,
+)
+from southwind_agent_server.engine import SafeEngineError
+from southwind_agent_server.provider_audit import (
+    ProviderAttemptAudit,
+    ProviderAuditStore,
+)
+from southwind_agent_server.provider_governance import ProviderRequestGovernance
+
+
+def test_dlp_redacts_before_send_and_audits_metadata_only(tmp_path: Path) -> None:
+    path = tmp_path / "provider-audit.sqlite3"
+    governance = ProviderRequestGovernance(
+        ProviderAuditStore(str(path), retention_days=90)
+    )
+
+    result = governance.authorize(
+        deployment_key="ai.openai-compatible",
+        operation_key="business.answer",
+        run_id="run_1",
+        attempt=1,
+        messages=[
+            {"role": "system", "content": "只回答问题"},
+            {"role": "user", "content": "联系 me@example.com"},
+        ],
+        tools=(),
+        policy=policy(user_action="redact"),
+    )
+
+    assert result.messages[1]["content"] == "联系 [REDACTED]"
+    row = (
+        sqlite3.connect(path)
+        .execute(
+            """
+        select deployment_key, operation_key, run_id, attempt,
+          classifications, sent_bytes, decision
+        from provider_attempt_audit
+        """
+        )
+        .fetchone()
+    )
+    assert row == (
+        "ai.openai-compatible",
+        "business.answer",
+        "run_1",
+        1,
+        "internal",
+        row[5],
+        "redact",
+    )
+    assert row[5] > 0
+    assert "me@example.com" not in path.read_bytes().decode(errors="ignore")
+
+
+def test_missing_allowlist_and_dlp_reject_before_network(tmp_path: Path) -> None:
+    path = tmp_path / "provider-audit.sqlite3"
+    governance = ProviderRequestGovernance(
+        ProviderAuditStore(str(path), retention_days=90)
+    )
+
+    with pytest.raises(SafeEngineError) as missing:
+        governance.authorize(
+            deployment_key="ai.openai-compatible",
+            operation_key="business.answer",
+            run_id="run_missing",
+            attempt=1,
+            messages=[{"role": "system", "content": "只回答问题"}],
+            tools=(),
+            policy=ProviderDataPolicy(input_fields=[], envelope_fields=[]),
+        )
+    assert missing.value.code == "FORBIDDEN"
+
+    with pytest.raises(SafeEngineError) as rejected:
+        governance.authorize(
+            deployment_key="ai.openai-compatible",
+            operation_key="business.answer",
+            run_id="run_reject",
+            attempt=1,
+            messages=[
+                {"role": "system", "content": "只回答问题"},
+                {"role": "user", "content": "password=do-not-send"},
+            ],
+            tools=(),
+            policy=policy(user_action="reject"),
+        )
+    assert rejected.value.code == "FORBIDDEN"
+    decisions = (
+        sqlite3.connect(path)
+        .execute(
+            "select decision, sent_bytes from provider_attempt_audit "
+            "order by occurred_at"
+        )
+        .fetchall()
+    )
+    assert decisions == [("reject", 0), ("reject", 0)]
+
+
+def test_attempts_are_unique_append_only_and_ttl_purge_is_bounded(
+    tmp_path: Path,
+) -> None:
+    path = tmp_path / "provider-audit.sqlite3"
+    store = ProviderAuditStore(str(path), retention_days=1)
+    event = ProviderAttemptAudit(
+        "ai.openai-compatible",
+        "business.answer",
+        "run_1",
+        1,
+        ("internal",),
+        42,
+        "allow",
+    )
+    store.append(event)
+    with pytest.raises(sqlite3.IntegrityError):
+        store.append(event)
+
+    database = sqlite3.connect(path)
+    database.execute(
+        "update provider_attempt_audit set occurred_at = ?",
+        (time.time() - 2 * 24 * 60 * 60,),
+    )
+    database.commit()
+    database.close()
+
+    assert store.purge_expired() == 1
+    health = store.health()
+    assert health["retainedRecords"] == 0
+    assert health["lastDeletedRecords"] == 1
+    assert health["totalDeletedRecords"] == 1
+
+
+def test_audit_store_serializes_concurrent_single_replica_writes(
+    tmp_path: Path,
+) -> None:
+    store = ProviderAuditStore(
+        str(tmp_path / "provider-audit.sqlite3"),
+        retention_days=90,
+    )
+
+    def append(attempt: int) -> None:
+        store.append(
+            ProviderAttemptAudit(
+                "ai.openai-compatible",
+                "business.answer",
+                "run_concurrent",
+                attempt,
+                ("internal",),
+                42,
+                "allow",
+            )
+        )
+
+    with ThreadPoolExecutor(max_workers=4) as executor:
+        list(executor.map(append, range(1, 21)))
+
+    assert store.health()["retainedRecords"] == 20
+
+
+def test_audit_failure_denies_provider_attempt() -> None:
+    class BrokenAudit:
+        def append(self, _event: ProviderAttemptAudit) -> None:
+            raise sqlite3.OperationalError("do-not-expose")
+
+    governance = ProviderRequestGovernance(cast(ProviderAuditStore, BrokenAudit()))
+    with pytest.raises(SafeEngineError) as captured:
+        governance.authorize(
+            deployment_key="ai.openai-compatible",
+            operation_key="business.answer",
+            run_id="run_audit_failure",
+            attempt=1,
+            messages=[
+                {"role": "system", "content": "只回答问题"},
+                {"role": "user", "content": "正常内容"},
+            ],
+            tools=(),
+            policy=policy(user_action="redact"),
+        )
+    assert captured.value.code == "FORBIDDEN"
+    assert "do-not-expose" not in str(captured.value)
+
+
+def policy(*, user_action: Literal["reject", "redact"]) -> ProviderDataPolicy:
+    return ProviderDataPolicy(
+        input_fields=[
+            ProviderInputFieldPolicy(
+                json_pointer="/question",
+                classification="internal",
+                dlp_action="redact",
+            )
+        ],
+        envelope_fields=[
+            ProviderFieldPolicy(
+                field="instructions",
+                classification="internal",
+                dlp_action="reject",
+            ),
+            ProviderFieldPolicy(
+                field="user-prompt",
+                classification="internal",
+                dlp_action=user_action,
+            ),
+        ],
+    )

package/template/apps/server/package.json

@@ -26,9 +26,12 @@
     "drizzle-orm": "^0.45.2",
     "elysia": "^1.4.29",
     "mysql2": "^3.22.6",
+    "nodemailer": "^9.0.3",
     "pg": "^8.22.0",
     "pino": "^10.3.1",
     "zod": "^4.4.3"
   },
-  "devDependencies": {}
+  "devDependencies": {
+    "@types/nodemailer": "^8.0.1"
+  }
 }

package/template/apps/server/src/agent/provider-input-governance.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, test } from "bun:test";
+import type { AiProviderDataPolicy } from "@southwind-ai/modules";
+import {
+  governProviderInput,
+  ProviderInputGovernanceError,
+} from "./provider-input-governance.js";
+
+const policy: AiProviderDataPolicy = {
+  inputFields: [
+    {
+      jsonPointer: "/question",
+      classification: "internal",
+      dlpAction: "redact",
+    },
+    {
+      jsonPointer: "/identity",
+      classification: "sensitive",
+      dlpAction: "reject",
+    },
+  ],
+  envelopeFields: [
+    {
+      field: "instructions",
+      classification: "internal",
+      dlpAction: "reject",
+    },
+    {
+      field: "user-prompt",
+      classification: "internal",
+      dlpAction: "redact",
+    },
+  ],
+};
+
+describe("Provider 输入字段治理", () => {
+  test("只保留 JSON Pointer allowlist 并在 Handler 前脱敏", () => {
+    const governed = governProviderInput(
+      {
+        question: "联系 me@example.com 或 13800138000",
+        internalCaseId: "case-secret",
+      },
+      policy,
+    );
+
+    expect(governed).toEqual({
+      question: "联系 [REDACTED] 或 [REDACTED]",
+    });
+    expect(JSON.stringify(governed)).not.toContain("case-secret");
+  });
+
+  test.each([
+    "password=do-not-send",
+    "Bearer abcdefghijklmnop",
+    "11010519491231002X",
+    "6222 0201 2345 6789 012",
+  ])("高风险字段按 reject 策略拒绝：%s", (identity) => {
+    expect(() =>
+      governProviderInput({ question: "ok", identity }, policy),
+    ).toThrow(ProviderInputGovernanceError);
+  });
+
+  test("拒绝非对象输入和非法 JSON Pointer", () => {
+    expect(() => governProviderInput("raw", policy)).toThrow("输入必须是对象");
+    expect(() =>
+      governProviderInput(
+        { question: "ok" },
+        {
+          ...policy,
+          inputFields: [{ ...policy.inputFields[0]!, jsonPointer: "/bad~2" }],
+        },
+      ),
+    ).toThrow("JSON Pointer 无效");
+  });
+
+  test("allowlist 只读取输入自身字段，不继承原型属性", () => {
+    const inherited = Object.create({
+      question: "prototype-secret",
+    }) as Record<string, string>;
+
+    expect(governProviderInput(inherited, policy)).toEqual({});
+  });
+});

package/template/apps/server/src/agent/provider-input-governance.ts

@@ -0,0 +1,140 @@
+import type {
+  AiProviderDataPolicy,
+  AiProviderDlpAction,
+} from "@southwind-ai/modules";
+import type { ModuleAiJsonValue } from "@southwind-ai/server-sdk";
+
+export class ProviderInputGovernanceError extends Error {
+  constructor(
+    readonly code: "INVALID_INPUT" | "FORBIDDEN",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+const dlpPatterns = [
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/giu,
+  /\b(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+/giu,
+  /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu,
+  /\b1[3-9]\d{9}\b/gu,
+  /\b\d{17}[\dXx]\b/gu,
+  /\b(?:\d[ -]?){16,30}\b/gu,
+];
+
+export function governProviderInput(
+  input: ModuleAiJsonValue,
+  policy: AiProviderDataPolicy,
+): ModuleAiJsonValue {
+  if (!isRecord(input)) {
+    throw new ProviderInputGovernanceError(
+      "INVALID_INPUT",
+      "Provider Operation 输入必须是对象",
+    );
+  }
+  const governed: Record<string, ModuleAiJsonValue> = Object.create(null);
+  for (const rule of policy.inputFields) {
+    const segments = parseJsonPointer(rule.jsonPointer);
+    const result = readPath(input, segments);
+    if (!result.found) continue;
+    writePath(governed, segments, governValue(result.value, rule.dlpAction));
+  }
+  return governed;
+}
+
+function governValue(
+  value: ModuleAiJsonValue,
+  action: AiProviderDlpAction,
+): ModuleAiJsonValue {
+  if (typeof value === "string") {
+    if (!dlpPatterns.some((pattern) => matches(pattern, value))) return value;
+    if (action === "reject") {
+      throw new ProviderInputGovernanceError(
+        "FORBIDDEN",
+        "Provider 输入被 DLP 策略拒绝",
+      );
+    }
+    return dlpPatterns.reduce(
+      (result, pattern) => result.replace(pattern, "[REDACTED]"),
+      value,
+    );
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => governValue(item, action));
+  }
+  if (isRecord(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [
+        key,
+        governValue(item, action),
+      ]),
+    );
+  }
+  return value;
+}
+
+function parseJsonPointer(pointer: string): string[] {
+  return pointer
+    .slice(1)
+    .split("/")
+    .map((segment) => {
+      if (/~(?:[^01]|$)/u.test(segment)) {
+        throw new ProviderInputGovernanceError(
+          "INVALID_INPUT",
+          "Provider 输入字段 JSON Pointer 无效",
+        );
+      }
+      const decoded = segment.replaceAll("~1", "/").replaceAll("~0", "~");
+      if (["__proto__", "prototype", "constructor"].includes(decoded)) {
+        throw new ProviderInputGovernanceError(
+          "INVALID_INPUT",
+          "Provider 输入字段 JSON Pointer 无效",
+        );
+      }
+      return decoded;
+    });
+}
+
+function readPath(
+  input: Record<string, ModuleAiJsonValue>,
+  segments: readonly string[],
+): { found: boolean; value: ModuleAiJsonValue } {
+  let current: ModuleAiJsonValue = input;
+  for (const segment of segments) {
+    if (!isRecord(current) || !Object.hasOwn(current, segment)) {
+      return { found: false, value: null };
+    }
+    current = current[segment]!;
+  }
+  return { found: true, value: current };
+}
+
+function writePath(
+  output: Record<string, ModuleAiJsonValue>,
+  segments: readonly string[],
+  value: ModuleAiJsonValue,
+): void {
+  let current = output;
+  segments.forEach((segment, index) => {
+    if (index === segments.length - 1) {
+      current[segment] = value;
+      return;
+    }
+    const next = current[segment];
+    if (!isRecord(next)) {
+      current[segment] = Object.create(null);
+    }
+    current = current[segment] as Record<string, ModuleAiJsonValue>;
+  });
+}
+
+function matches(pattern: RegExp, value: string): boolean {
+  pattern.lastIndex = 0;
+  return pattern.test(value);
+}
+
+function isRecord(
+  value: ModuleAiJsonValue,
+): value is Record<string, ModuleAiJsonValue> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/template/apps/server/src/agent/remote-runtime.test.ts

@@ -40,6 +40,27 @@ describe("RemoteAgentRuntime", () => {
         mode: "configured-endpoint",
         deploymentKey: "ai.openai-compatible",
       },
+      providerDataPolicy: {
+        inputFields: [
+          {
+            jsonPointer: "/question",
+            classification: "internal",
+            dlpAction: "redact",
+          },
+        ],
+        envelopeFields: [
+          {
+            field: "instructions",
+            classification: "internal",
+            dlpAction: "reject",
+          },
+          {
+            field: "user-prompt",
+            classification: "internal",
+            dlpAction: "redact",
+          },
+        ],
+      },
       toolNetworkPolicy: { mode: "forbidden" },
       executionGrant: "grant_1",
     };
@@ -60,6 +81,7 @@ describe("RemoteAgentRuntime", () => {
         mode: "configured-endpoint",
         deploymentKey: "ai.openai-compatible",
       },
+      providerDataPolicy: operation.providerDataPolicy,
       toolNetworkPolicy: { mode: "forbidden" },
     });
     expect(

package/template/apps/server/src/agent/remote-runtime.ts

@@ -38,6 +38,7 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
         maxOutputBytes: request.limits.maxOutputBytes,
       },
       providerEgress: request.providerEgress,
+      providerDataPolicy: request.providerDataPolicy,
       toolNetworkPolicy: request.toolNetworkPolicy,
       executionGrant: request.executionGrant,
       toolHostUrl: this.options.toolHostUrl,

package/template/apps/server/src/agent/run-contracts.ts

@@ -1,4 +1,5 @@
 import type {
+  AiProviderDataPolicy,
   AiProviderEgressPolicy,
   AiToolNetworkPolicy,
 } from "@southwind-ai/modules";
@@ -19,6 +20,7 @@ export interface AgentRuntimeOperation {
     maxOutputBytes: number;
   };
   providerEgress: AiProviderEgressPolicy;
+  providerDataPolicy: AiProviderDataPolicy;
   toolNetworkPolicy: AiToolNetworkPolicy;
   executionGrant: string;
 }

package/template/apps/server/src/agent/run-facade.test.ts

@@ -17,7 +17,7 @@ describe("Guarded Agent Run facade", () => {
     const fixture = await createFixture();
     const created = await fixture.facade.start(
       "business.answer",
-      { question: "你好" },
+      { question: "你好", internalCaseId: "case-secret" },
       "request-1",
       fixture.context,
     );
@@ -33,8 +33,18 @@ describe("Guarded Agent Run facade", () => {
       instructions: "只回答当前业务问题。",
       userPrompt: "你好",
       allowedTools: [{ key: "business.records.list" }],
+      providerDataPolicy: {
+        inputFields: expect.arrayContaining([
+          expect.objectContaining({ jsonPointer: "/question" }),
+        ]),
+        envelopeFields: expect.arrayContaining([
+          expect.objectContaining({ field: "instructions" }),
+        ]),
+      },
     });
     expect(fixture.remote.started[0]?.executionGrant).toMatch(/^grant_/);
+    expect(fixture.remote.started[0]?.input).toEqual({ question: "你好" });
+    expect(JSON.stringify(fixture.prepared)).not.toContain("case-secret");
     expect(() =>
       fixture.facade.authorizeRun("run_1", fixture.context),
     ).not.toThrow();
@@ -250,7 +260,47 @@ function manifest(): ModuleManifest {
         allowedToolKeys: ["business.records.list"],
         dataClassification: "internal",
         execution: "streaming",
-        publicNetworkAccess: "forbidden",
+        providerEgress: {
+          mode: "configured-endpoint",
+          deploymentKey: "ai.openai-compatible",
+        },
+        providerDataPolicy: {
+          inputFields: [
+            {
+              jsonPointer: "/question",
+              classification: "internal",
+              dlpAction: "redact",
+            },
+          ],
+          envelopeFields: [
+            {
+              field: "instructions",
+              classification: "internal",
+              dlpAction: "reject",
+            },
+            {
+              field: "user-prompt",
+              classification: "internal",
+              dlpAction: "redact",
+            },
+            {
+              field: "tool-definitions",
+              classification: "internal",
+              dlpAction: "reject",
+            },
+            {
+              field: "provider-output",
+              classification: "internal",
+              dlpAction: "redact",
+            },
+            {
+              field: "tool-results",
+              classification: "sensitive",
+              dlpAction: "redact",
+            },
+          ],
+        },
+        toolNetworkPolicy: { mode: "forbidden" },
         limits: {
           maxDurationSeconds: 60,
           maxInputBytes: 4096,

package/template/apps/server/src/agent/run-facade.ts

@@ -12,7 +12,7 @@ import type {
   ModuleAiOperationHandlerRegistration,
 } from "@southwind-ai/server-sdk";
 import { evaluateAccessGuards } from "../access-guards.js";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 import type { InitializedModuleHosts } from "../module-host.js";
 import { toModuleActor } from "../module-host.js";
 import type { createServerRuntime } from "../runtime.js";
@@ -22,6 +22,10 @@ import type {
   AgentRuntimePort,
   AgentRuntimeStartResponse,
 } from "./run-contracts.js";
+import {
+  governProviderInput,
+  ProviderInputGovernanceError,
+} from "./provider-input-governance.js";
 
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
@@ -88,7 +92,33 @@ export class AgentRunFacade {
       );
     }
     assertInputSize(input, operation.definition.limits.maxInputBytes);
-    const plan = await operation.handler.prepare(input, {
+    const providerPolicy = operation.definition.providerDataPolicy;
+    if (
+      operation.definition.providerEgress?.mode === "configured-endpoint" &&
+      !providerPolicy
+    ) {
+      throw new AgentRunFacadeError(
+        "FORBIDDEN",
+        "Agent Operation 缺少 Provider 字段治理策略",
+        403,
+      );
+    }
+    let governedInput = input;
+    try {
+      governedInput = providerPolicy
+        ? governProviderInput(input, providerPolicy)
+        : input;
+    } catch (error) {
+      if (error instanceof ProviderInputGovernanceError) {
+        throw new AgentRunFacadeError(
+          error.code,
+          error.message,
+          error.code === "FORBIDDEN" ? 403 : 400,
+        );
+      }
+      throw error;
+    }
+    const plan = await operation.handler.prepare(governedInput, {
       actor: toModuleActor(context.actor),
       requestId: context.requestId,
     });
@@ -104,12 +134,16 @@ export class AgentRunFacade {
       const created = await this.remote.start(
         {
           operationKey,
-          input,
+          input: governedInput,
           instructions: plan.instructions,
           userPrompt: plan.userPrompt,
           allowedTools: operation.tools,
           limits: operation.definition.limits,
           providerEgress: resolveProviderEgress(operation.definition),
+          providerDataPolicy: operation.definition.providerDataPolicy ?? {
+            inputFields: [],
+            envelopeFields: [],
+          },
           toolNetworkPolicy: resolveToolNetworkPolicy(operation.definition),
           executionGrant: grant.token,
         },
@@ -120,12 +154,7 @@ export class AgentRunFacade {
         id: randomUUIDv7(),
         action: operation.definition.auditAction,
         outcome: "success",
-        actor: {
-          id: context.actor.id,
-          type:
-            context.actor.type === "anonymous" ? "user" : context.actor.type,
-          name: context.actor.name,
-        },
+        actor: auditActor(context),
         target: {
           type: "agent-run",
           id: created.runId,

package/template/apps/server/src/agent/tool-registry.ts

@@ -11,7 +11,7 @@ import type { AuditEvent, FeatureFlagDefinition } from "@southwind-ai/shared";
 import Ajv, { type ValidateFunction } from "ajv";
 import { evaluateAccessGuards } from "../access-guards.js";
 import { isServerScopeContext } from "../data-access/context.js";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 import { findFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
 
@@ -292,11 +292,7 @@ function toolEvent(
     id: crypto.randomUUID(),
     action: tool.auditAction,
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: { type: "agent-tool", id: tool.key, label: tool.label },
     module: tool.module,
     requestId: context.requestId,