create-windy 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-windy",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "创建单组织、单租户、私有部署优先的 Windy 企业 Dashboard Starter",
   "type": "module",
   "bin": {
@@ -13,14 +13,14 @@
     "README.md"
   ],
   "scripts": {
-    "build": "bun build src/cli.ts --target=node --format=esm --outdir=dist",
+    "build": "bun build src/cli.ts --target=bun --format=esm --outdir=dist",
     "template:sync": "bun run src/sync-template.ts",
     "prepack": "bun run template:sync && bun run build",
     "postpack": "bun run src/clean-template.ts",
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "engines": {
-    "node": ">=20"
+    "bun": ">=1.3.14"
   },
   "keywords": [
     "dashboard",

package/template/.windy-template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "templateCommit": "c6c39b2cac4c74ed6352c50e89a4bcddab0eafc7",
-  "generatorVersion": "0.3.0",
+  "templateCommit": "cb75f345710c9db90091819fd917d999cca88d05",
+  "generatorVersion": "0.3.2",
   "modules": [
     {
       "name": "system",

package/template/README.md

@@ -52,6 +52,19 @@ bun run dev:server
 以终端输出为准。`dev:server` 不会自动启动 PostgreSQL 或执行 migration；未配置
 `DATABASE_URL` 时使用内存模式。
 
+## Agent、MCP 与仓库 Skill
+
+仓库始终包含 `.agents/skills/windy-business-module/SKILL.md`。新增或修改业务模块、
+Agent Tool 或 MCP 暴露时，可以明确要求代码 Agent“使用 `windy-business-module`
+Skill 完成该能力”。Skill 只指导开发流程；Feature、Permission、Schema 和 Tool 的
+运行时事实仍以 Module Manifest 与平台 Registry 为准。
+
+当前组合未包含 `system.agent`，MCP Server、Agent Tool Host 和相关文档已被
+物理裁剪。若项目尚可重新生成，请在创建时增加 `--module system.agent` 或使用
+`--all-modules`；部署后的通用 `module add` 尚未交付，不要手工复制 MCP Adapter
+或另建授权链。仓库 Skill 仍可用于普通业务模块开发。
+
+
 
 
 ## 页面与登录
@@ -129,6 +142,7 @@ bun run build
 bun run windy doctor
 bun run windy update --check
 bun run windy update --dry-run
+bun run windy reconcile --to <精确目标版本>
 bun run lint
 bun run format
 ```
@@ -137,7 +151,14 @@ bun run format
 
 更新前必须保持 Git 工作区干净。`--dry-run` 只生成计划，不写项目；正式更新先备份，
 再做 package 字段级合并、共享脚手架三方合并与完整验证。任何冲突都会在写入前中止，
-验证失败会自动回滚；中断恢复使用 `bun run windy doctor --repair`。
+无并发变化的验证失败会自动回滚；中断恢复使用
+`bun run windy doctor --repair`。该命令在提交点前保留并发编辑并回滚其余路径，
+在 committed 提交点后只完成事务状态与备份清理，不回滚项目文件。
+
+仅当 Windy 发布说明提供确定性 proof 时使用
+`reconcile --to <精确目标版本>`。它默认只演练；显式增加 `--apply` 后也只更新
+受管清单元数据与无正文报告，不修改项目源码或推进 Project Lock。project-owned、
+缺失和未知语义差异始终保守未决；shared-scaffold 只有精确命中已发布 proof 才可对账。
 
 ## 开发约束
 
@@ -156,8 +177,9 @@ bun run format
 create-windy 默认建立 `main` 分支并创建 `chore: initialize project` 首次提交。若当时
 没有配置 Git 用户身份，文件会保留在暂存区；配置身份后手动提交即可。
 
-未来的 Windy 更新器会根据 project lock 和文件所有权执行三方合并，不会要求连接
-私有源仓库，也不会静默覆盖项目代码。该更新引擎当前尚未交付。
+当前已交付的 Windy 更新器会根据 Project Lock 和文件所有权，从 npm 历史 artifact
+重建 Base 并执行三方合并；它不连接私有源仓库，也不会静默覆盖项目代码。部署期通用
+`module add/update/remove` 尚未交付。
 
 ## License
 

package/template/_gitignore

@@ -1,4 +1,8 @@
 .env
+.env.*
+!.env.example
+!.env.sample
+!.env.template
 .DS_Store
 node_modules/
 dist/

package/template/apps/agent-server/tests/__init__.py

@@ -0,0 +1 @@
+"""Agent Server test package."""

package/template/apps/agent-server/tests/openai_provider_test_support.py

@@ -0,0 +1,131 @@
+from __future__ import annotations
+
+import json
+import tempfile
+
+import httpx
+
+from southwind_agent_server.config import (
+    EnvironmentSecretResolver,
+    OpenAiCompatibleConfig,
+    SecretRef,
+)
+from southwind_agent_server.contracts import (
+    ProviderDataPolicy,
+    ProviderEgress,
+    ProviderFieldPolicy,
+    ProviderInputFieldPolicy,
+    RuntimeLimits,
+    RuntimeToolDefinition,
+    ToolNetworkPolicy,
+)
+from southwind_agent_server.engine import EngineRunRequest
+from southwind_agent_server.openai_provider import OpenAiCompatibleProvider
+from southwind_agent_server.provider_audit import ProviderAuditStore
+from southwind_agent_server.provider_governance import ProviderRequestGovernance
+
+
+def create_provider(
+    transport: httpx.AsyncBaseTransport,
+) -> OpenAiCompatibleProvider:
+    environment = {"QWEN_API_KEY": "server-secret"}
+    return OpenAiCompatibleProvider(
+        OpenAiCompatibleConfig(
+            base_url="https://provider.test/v1",
+            model="qwen-compatible",
+            api_key_ref=SecretRef("env", "QWEN_API_KEY"),
+            https_host_allowlist=("provider.test",),
+        ),
+        EnvironmentSecretResolver(environment),
+        transport=transport,
+    )
+
+
+def runtime_request(tool_key: str) -> EngineRunRequest:
+    return EngineRunRequest(
+        run_id="run_1",
+        operation_key="business.answer",
+        input={"question": "记录"},
+        instructions="回答业务问题。",
+        user_prompt="有多少记录？",
+        allowed_tools=(
+            RuntimeToolDefinition(
+                key=tool_key,
+                label="查询记录",
+                description="查询当前数据范围内的记录。",
+            ),
+        ),
+        limits=RuntimeLimits(
+            max_duration_seconds=60,
+            max_output_bytes=4096,
+        ),
+        provider_egress=ProviderEgress(
+            mode="configured-endpoint",
+            deployment_key="ai.openai-compatible",
+        ),
+        provider_data_policy=provider_data_policy(),
+        tool_network_policy=ToolNetworkPolicy(mode="forbidden"),
+        execution_grant="grant_1",
+        tool_host_url="http://server:9747",
+    )
+
+
+def provider_data_policy() -> ProviderDataPolicy:
+    return ProviderDataPolicy(
+        input_fields=[
+            ProviderInputFieldPolicy(
+                json_pointer="/question",
+                classification="internal",
+                dlp_action="redact",
+            )
+        ],
+        envelope_fields=[
+            ProviderFieldPolicy(
+                field="instructions",
+                classification="internal",
+                dlp_action="reject",
+            ),
+            ProviderFieldPolicy(
+                field="user-prompt",
+                classification="internal",
+                dlp_action="redact",
+            ),
+            ProviderFieldPolicy(
+                field="tool-definitions",
+                classification="internal",
+                dlp_action="reject",
+            ),
+            ProviderFieldPolicy(
+                field="provider-output",
+                classification="internal",
+                dlp_action="redact",
+            ),
+            ProviderFieldPolicy(
+                field="tool-results",
+                classification="sensitive",
+                dlp_action="redact",
+            ),
+        ],
+    )
+
+
+def governance(path: str | None = None) -> ProviderRequestGovernance:
+    path = (
+        path
+        or tempfile.NamedTemporaryFile(
+            suffix=".sqlite3",
+            delete=False,
+        ).name
+    )
+    return ProviderRequestGovernance(ProviderAuditStore(path, retention_days=90))
+
+
+def sse_response(chunks: list[object]) -> httpx.Response:
+    body = "".join(
+        f"data: {json.dumps(chunk, ensure_ascii=False)}\n\n" for chunk in chunks
+    )
+    return httpx.Response(
+        200,
+        headers={"content-type": "text/event-stream"},
+        content=f"{body}data: [DONE]\n\n",
+    )

package/template/apps/agent-server/tests/test_openai_provider.py

@@ -7,20 +7,7 @@ import tempfile
 import httpx
 import pytest
 
-from southwind_agent_server.config import (
-    EnvironmentSecretResolver,
-    OpenAiCompatibleConfig,
-    SecretRef,
-)
-from southwind_agent_server.contracts import (
-    ProviderDataPolicy,
-    ProviderEgress,
-    ProviderFieldPolicy,
-    ProviderInputFieldPolicy,
-    RuntimeLimits,
-    RuntimeToolDefinition,
-    ToolNetworkPolicy,
-)
+from southwind_agent_server.contracts import ProviderEgress
 from southwind_agent_server.engine import (
     EngineRunRequest,
     SafeEngineError,
@@ -28,10 +15,13 @@ from southwind_agent_server.engine import (
     ToolRequested,
 )
 from southwind_agent_server.openai_engine import OpenAiCompatibleEngineAdapter
-from southwind_agent_server.openai_provider import OpenAiCompatibleProvider
-from southwind_agent_server.provider_audit import ProviderAuditStore
-from southwind_agent_server.provider_governance import ProviderRequestGovernance
 from southwind_agent_server.tool_host import ToolHostClient
+from tests.openai_provider_test_support import (
+    create_provider,
+    governance,
+    runtime_request,
+    sse_response,
+)
 
 
 async def test_provider_stream_and_health_use_bounded_safe_protocol() -> None:
@@ -255,109 +245,3 @@ async def test_engine_denies_mismatched_provider_deployment() -> None:
         async for _signal in engine.execute(request):
             pass
     assert captured.value.code == "FORBIDDEN"
-
-
-def create_provider(
-    transport: httpx.AsyncBaseTransport,
-) -> OpenAiCompatibleProvider:
-    environment = {"QWEN_API_KEY": "server-secret"}
-    return OpenAiCompatibleProvider(
-        OpenAiCompatibleConfig(
-            base_url="https://provider.test/v1",
-            model="qwen-compatible",
-            api_key_ref=SecretRef("env", "QWEN_API_KEY"),
-            https_host_allowlist=("provider.test",),
-        ),
-        EnvironmentSecretResolver(environment),
-        transport=transport,
-    )
-
-
-def runtime_request(tool_key: str) -> EngineRunRequest:
-    return EngineRunRequest(
-        run_id="run_1",
-        operation_key="business.answer",
-        input={"question": "记录"},
-        instructions="回答业务问题。",
-        user_prompt="有多少记录？",
-        allowed_tools=(
-            RuntimeToolDefinition(
-                key=tool_key,
-                label="查询记录",
-                description="查询当前数据范围内的记录。",
-            ),
-        ),
-        limits=RuntimeLimits(
-            max_duration_seconds=60,
-            max_output_bytes=4096,
-        ),
-        provider_egress=ProviderEgress(
-            mode="configured-endpoint",
-            deployment_key="ai.openai-compatible",
-        ),
-        provider_data_policy=provider_data_policy(),
-        tool_network_policy=ToolNetworkPolicy(mode="forbidden"),
-        execution_grant="grant_1",
-        tool_host_url="http://server:9747",
-    )
-
-
-def provider_data_policy() -> ProviderDataPolicy:
-    return ProviderDataPolicy(
-        input_fields=[
-            ProviderInputFieldPolicy(
-                json_pointer="/question",
-                classification="internal",
-                dlp_action="redact",
-            )
-        ],
-        envelope_fields=[
-            ProviderFieldPolicy(
-                field="instructions",
-                classification="internal",
-                dlp_action="reject",
-            ),
-            ProviderFieldPolicy(
-                field="user-prompt",
-                classification="internal",
-                dlp_action="redact",
-            ),
-            ProviderFieldPolicy(
-                field="tool-definitions",
-                classification="internal",
-                dlp_action="reject",
-            ),
-            ProviderFieldPolicy(
-                field="provider-output",
-                classification="internal",
-                dlp_action="redact",
-            ),
-            ProviderFieldPolicy(
-                field="tool-results",
-                classification="sensitive",
-                dlp_action="redact",
-            ),
-        ],
-    )
-
-
-def governance(path: str | None = None) -> ProviderRequestGovernance:
-    path = (
-        path
-        or tempfile.NamedTemporaryFile(
-            suffix=".sqlite3",
-            delete=False,
-        ).name
-    )
-    return ProviderRequestGovernance(ProviderAuditStore(path, retention_days=90))
-
-
-def sse_response(chunks: list[object]) -> httpx.Response:
-    body = "".join(
-        f"data: {json.dumps(chunk, ensure_ascii=False)}\n\n" for chunk in chunks
-    )
-    return httpx.Response(
-        200,
-        headers={"content-type": "text/event-stream"},
-        content=f"{body}data: [DONE]\n\n",
-    )

package/template/apps/server/src/auth/routes.test-support.ts

@@ -0,0 +1,94 @@
+import { expect } from "bun:test";
+import type { AuditEvent, PasswordPolicy } from "@southwind-ai/shared";
+import { Elysia } from "elysia";
+import { createServerRuntime } from "../runtime.js";
+import { RepositoryActorResolver } from "./actor-resolver.js";
+import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
+import { registerAuthRoutes, registerAuthSessionRoute } from "./routes.js";
+import { AuthService } from "./service.js";
+
+export function authFixture(
+  users: AuthUserRecord[],
+  passwordPolicy?: () => PasswordPolicy,
+  sessionTtlSeconds?: () => number,
+) {
+  const repository = new InMemoryAuthRepository(users);
+  const resolver = new RepositoryActorResolver(repository, {
+    sessionCookieName: "windy.sid",
+  });
+  const events: AuditEvent[] = [];
+  const runtime = createServerRuntime({}, { actorResolver: resolver });
+  const service = new AuthService(repository, {
+    passwordPolicy,
+    sessionTtlSeconds,
+    auditWriter: {
+      write(event) {
+        events.push(event);
+      },
+    },
+  });
+  const app = new Elysia({ prefix: "/api" }).derive(async ({ request }) => ({
+    guardContext: await runtime.createGuardContext(request),
+  }));
+  registerAuthSessionRoute(app);
+  registerAuthRoutes(app, service, { secureCookie: false });
+  return { app, events, repository, runtime };
+}
+
+export function createActiveUser(passwordHash: string): AuthUserRecord {
+  return {
+    id: "user_admin",
+    username: "admin",
+    displayName: "平台管理员",
+    email: "admin@windy.local",
+    phone: "13800138000",
+    passwordHash,
+    credentialState: "active",
+    status: "active",
+    roleCodes: ["developer"],
+    permissionKeys: ["system.user.manage", "system.audit.read"],
+  };
+}
+
+export async function loginWithPassword(
+  app: { handle(request: Request): Response | Promise<Response> },
+  username: string,
+  password: string,
+) {
+  const response = await app.handle(
+    jsonRequest("/api/auth/api/login", {
+      username,
+      password,
+    }),
+  );
+  expect(response.status).toBe(200);
+  return (await response.json()) as {
+    token: string;
+    sessionId: string;
+    expiresAt: string;
+  };
+}
+
+export function readCookieValue(header: string, name: string): string {
+  const value = header.split(";")[0]?.slice(`${name}=`.length);
+  return value ? decodeURIComponent(value) : "";
+}
+
+export function jsonRequest(path: string, body: unknown): Request {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+export function apiRequest(
+  path: string,
+  token: string,
+  method = "GET",
+): Request {
+  return new Request(`http://localhost${path}`, {
+    method,
+    headers: { authorization: `Bearer ${token}` },
+  });
+}

package/template/apps/server/src/auth/routes.test.ts

@@ -1,12 +1,14 @@
 import { beforeAll, describe, expect, test } from "bun:test";
-import type { AuditEvent, PasswordPolicy } from "@southwind-ai/shared";
-import { Elysia } from "elysia";
-import { createServerRuntime } from "../runtime.js";
-import { RepositoryActorResolver } from "./actor-resolver.js";
+import type { PasswordPolicy } from "@southwind-ai/shared";
 import { argon2PasswordHasher } from "./password.js";
-import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
-import { registerAuthRoutes, registerAuthSessionRoute } from "./routes.js";
-import { AuthService } from "./service.js";
+import {
+  apiRequest,
+  authFixture,
+  createActiveUser,
+  jsonRequest,
+  loginWithPassword,
+  readCookieValue,
+} from "./routes.test-support.js";
 
 let passwordHash = "";
 
@@ -14,6 +16,17 @@ beforeAll(async () => {
   passwordHash = await argon2PasswordHasher.hash("test-only-password");
 });
 
+function activeUser() {
+  return createActiveUser(passwordHash);
+}
+
+function login(
+  app: { handle(request: Request): Response | Promise<Response> },
+  username: string,
+) {
+  return loginWithPassword(app, username, "test-only-password");
+}
+
 describe("platform auth API", () => {
   test("密码策略端点返回当前运行时策略且禁止缓存", async () => {
     let policy: PasswordPolicy = { minLength: 16, maxLength: 64 };
@@ -308,84 +321,3 @@ describe("platform auth API", () => {
     );
   });
 });
-
-function authFixture(
-  users: AuthUserRecord[],
-  passwordPolicy?: () => PasswordPolicy,
-  sessionTtlSeconds?: () => number,
-) {
-  const repository = new InMemoryAuthRepository(users);
-  const resolver = new RepositoryActorResolver(repository, {
-    sessionCookieName: "windy.sid",
-  });
-  const events: AuditEvent[] = [];
-  const runtime = createServerRuntime({}, { actorResolver: resolver });
-  const service = new AuthService(repository, {
-    passwordPolicy,
-    sessionTtlSeconds,
-    auditWriter: {
-      write(event) {
-        events.push(event);
-      },
-    },
-  });
-  const app = new Elysia({ prefix: "/api" }).derive(async ({ request }) => ({
-    guardContext: await runtime.createGuardContext(request),
-  }));
-  registerAuthSessionRoute(app);
-  registerAuthRoutes(app, service, { secureCookie: false });
-  return { app, events, repository, runtime };
-}
-
-function activeUser(): AuthUserRecord {
-  return {
-    id: "user_admin",
-    username: "admin",
-    displayName: "平台管理员",
-    email: "admin@windy.local",
-    phone: "13800138000",
-    passwordHash,
-    credentialState: "active",
-    status: "active",
-    roleCodes: ["developer"],
-    permissionKeys: ["system.user.manage", "system.audit.read"],
-  };
-}
-
-async function login(
-  app: { handle(request: Request): Response | Promise<Response> },
-  username: string,
-) {
-  const response = await app.handle(
-    jsonRequest("/api/auth/api/login", {
-      username,
-      password: "test-only-password",
-    }),
-  );
-  expect(response.status).toBe(200);
-  return (await response.json()) as {
-    token: string;
-    sessionId: string;
-    expiresAt: string;
-  };
-}
-
-function readCookieValue(header: string, name: string): string {
-  const value = header.split(";")[0]?.slice(`${name}=`.length);
-  return value ? decodeURIComponent(value) : "";
-}
-
-function jsonRequest(path: string, body: unknown): Request {
-  return new Request(`http://localhost${path}`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(body),
-  });
-}
-
-function apiRequest(path: string, token: string, method = "GET"): Request {
-  return new Request(`http://localhost${path}`, {
-    method,
-    headers: { authorization: `Bearer ${token}` },
-  });
-}