create-windy 0.3.2 → 0.3.5

package/template/apps/agent-server/src/southwind_agent_server/tool_host.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import json
 from dataclasses import dataclass
 
@@ -65,6 +66,10 @@ class ToolHostClient:
             raise denied("Agent Tool Host 暂不可用", retryable=True) from None
         if len(body) > self._max_response_bytes:
             raise denied("Agent Tool 响应超过安全上限")
+        if response.status_code == 202:
+            raise approval_pending(body)
+        if response.status_code == 409:
+            raise approval_resolved(body)
         if not response.is_success:
             raise denied("Agent Tool 执行被拒绝")
         try:
@@ -78,3 +83,70 @@ class ToolHostClient:
 
 def denied(message: str, *, retryable: bool = False) -> SafeEngineError:
     return SafeEngineError("TOOL_DENIED", message, retryable=retryable)
+
+
+def canonical_tool_call_id(
+    run_id: str,
+    tool_key: str,
+    arguments: dict[str, JsonValue],
+) -> str:
+    encoded = json.dumps(
+        {
+            "runId": run_id,
+            "toolKey": tool_key,
+            "arguments": arguments,
+        },
+        ensure_ascii=False,
+        separators=(",", ":"),
+        sort_keys=True,
+    ).encode()
+    return f"tool_{hashlib.sha256(encoded).hexdigest()[:40]}"
+
+
+class ToolApprovalPending(Exception):
+    def __init__(self, work_item_id: str) -> None:
+        super().__init__("Agent Tool 等待人工审批")
+        self.work_item_id = work_item_id
+
+
+class ToolApprovalResolved(Exception):
+    def __init__(self, work_item_id: str, outcome: str) -> None:
+        super().__init__("Agent Tool 审批未通过")
+        self.work_item_id = work_item_id
+        self.outcome = outcome
+
+
+def approval_pending(body: bytes) -> ToolApprovalPending:
+    value = safe_object(body)
+    if value.get("code") != "APPROVAL_REQUIRED" or not isinstance(
+        value.get("workItemId"), str
+    ):
+        raise denied("Agent Tool 审批响应无效")
+    work_item_id = value["workItemId"]
+    if not isinstance(work_item_id, str):
+        raise denied("Agent Tool 审批响应无效")
+    return ToolApprovalPending(work_item_id)
+
+
+def approval_resolved(body: bytes) -> ToolApprovalResolved:
+    value = safe_object(body)
+    code = value.get("code")
+    work_item_id = value.get("workItemId")
+    outcomes = {
+        "APPROVAL_REJECTED": "rejected",
+        "APPROVAL_CANCELLED": "cancelled",
+        "APPROVAL_TIMED_OUT": "timed-out",
+    }
+    if code not in outcomes or not isinstance(work_item_id, str):
+        raise denied("Agent Tool 审批响应无效")
+    return ToolApprovalResolved(work_item_id, outcomes[code])
+
+
+def safe_object(body: bytes) -> dict[str, JsonValue]:
+    try:
+        value = json.loads(body)
+    except json.JSONDecodeError:
+        raise denied("Agent Tool 审批响应无效") from None
+    if not isinstance(value, dict):
+        raise denied("Agent Tool 审批响应无效")
+    return value

package/template/apps/agent-server/tests/test_adk_adapter.py

@@ -35,7 +35,7 @@ from southwind_agent_server.engine import (
 from southwind_agent_server.openai_provider import OpenAiCompatibleProvider
 from southwind_agent_server.provider_audit import ProviderAuditStore
 from southwind_agent_server.provider_governance import ProviderRequestGovernance
-from southwind_agent_server.tool_host import ToolHostClient
+from southwind_agent_server.tool_host import ToolHostClient, canonical_tool_call_id
 
 
 async def test_adk_runner_maps_text_usage_and_terminal() -> None:
@@ -103,7 +103,11 @@ async def test_adk_tool_events_execute_only_through_tool_host() -> None:
         {
             "executionGrant": "grant_1",
             "runId": "run_1",
-            "toolCallId": "call_1",
+            "toolCallId": canonical_tool_call_id(
+                "run_1",
+                "business.records.list",
+                {"page": 2},
+            ),
             "toolKey": "business.records.list",
             "arguments": {"page": 2},
         }

package/template/apps/agent-server/tests/test_api.py

@@ -9,8 +9,9 @@ import httpx
 import pytest
 from fastapi import FastAPI
 
-from southwind_agent_server.app import create_app, provider_governance_snapshot
+from southwind_agent_server.app import create_app
 from southwind_agent_server.deterministic import DeterministicEngineAdapter
+from southwind_agent_server.http_helpers import provider_governance_snapshot
 
 
 @pytest.fixture
@@ -101,6 +102,28 @@ async def test_replay_supports_header_and_after(client: httpx.AsyncClient) -> No
     assert [event["sequence"] for event in events(from_query)] == [4]
 
 
+async def test_status_exposes_only_canonical_terminal_event(
+    client: httpx.AsyncClient,
+) -> None:
+    created = await start(client, "test.echo", {"text": "status"}, "status-1")
+    run_id = str(created["runId"])
+    await wait_for_terminal(client, run_id)
+
+    response = await client.get(f"/api/agent/runs/{run_id}")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "runId": run_id,
+        "status": "completed",
+        "lastSequence": 4,
+        "terminalEvent": {
+            "type": "run.completed",
+            "runId": run_id,
+            "sequence": 4,
+        },
+    }
+
+
 async def test_idempotency_reuses_or_conflicts(client: httpx.AsyncClient) -> None:
     first = await start(client, "test.echo", {"text": "same"}, "same-key")
     second = await start(client, "test.echo", {"text": "same"}, "same-key")

package/template/apps/agent-server/tests/test_artifact_input.py

@@ -0,0 +1,110 @@
+from __future__ import annotations
+
+import hashlib
+from io import BytesIO
+
+import httpx
+import pytest
+from PIL import Image
+
+from southwind_agent_server.artifact_input import ArtifactLoader
+from southwind_agent_server.contracts import RuntimeArtifact, RuntimeLimits
+from southwind_agent_server.engine import SafeEngineError
+
+
+async def test_loader_uses_fixed_endpoint_and_sanitizes_image() -> None:
+    source = png(4, 3)
+    digest = hashlib.sha256(source).hexdigest()
+
+    async def respond(request: httpx.Request) -> httpx.Response:
+        assert str(request.url) == "http://server.internal/api/internal/ai/artifacts"
+        assert request.headers["x-ai-artifact-ref"] == "opaque-ref"
+        assert request.headers["authorization"] == "Bearer internal"
+        return httpx.Response(
+            200,
+            content=source,
+            headers={"content-type": "image/png"},
+        )
+
+    prepared = await ArtifactLoader(
+        "http://server.internal/api/internal/ai/artifacts",
+        "internal",
+        transport=httpx.MockTransport(respond),
+    ).prepare(
+        [
+            RuntimeArtifact(
+                value="opaque-ref",
+                media_type="image/png",
+                byte_size=len(source),
+                sha256=digest,
+            )
+        ],
+        ["text", "image"],
+        RuntimeLimits(
+            max_input_bytes=4096,
+            max_output_bytes=4096,
+            max_artifacts=1,
+            max_pixels_per_artifact=12,
+        ),
+    )
+
+    assert len(prepared) == 1
+    assert prepared[0].media_type == "image/png"
+    assert prepared[0].data_url.startswith("data:image/png;base64,")
+
+
+async def test_loader_rejects_pixel_budget_and_integrity_drift() -> None:
+    source = png(4, 3)
+
+    async def respond(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            content=source,
+            headers={"content-type": "image/png"},
+        )
+
+    loader = ArtifactLoader(
+        "http://server.internal/api/internal/ai/artifacts",
+        "internal",
+        transport=httpx.MockTransport(respond),
+    )
+    artifact = RuntimeArtifact(
+        value="opaque-ref",
+        media_type="image/png",
+        byte_size=len(source),
+        sha256=hashlib.sha256(source).hexdigest(),
+    )
+    with pytest.raises(SafeEngineError) as pixels:
+        await loader.prepare(
+            [artifact],
+            ["text", "image"],
+            RuntimeLimits(
+                max_input_bytes=4096,
+                max_output_bytes=4096,
+                max_artifacts=1,
+                max_pixels_per_artifact=11,
+            ),
+        )
+    assert pixels.value.code == "BUDGET_EXCEEDED"
+
+    with pytest.raises(SafeEngineError) as integrity:
+        await loader.prepare(
+            [artifact.model_copy(update={"sha256": "a" * 64})],
+            ["text", "image"],
+            RuntimeLimits(
+                max_input_bytes=4096,
+                max_output_bytes=4096,
+                max_artifacts=1,
+                max_pixels_per_artifact=12,
+            ),
+        )
+    assert integrity.value.code == "INVALID_INPUT"
+
+
+def png(width: int, height: int) -> bytes:
+    target = BytesIO()
+    Image.new("RGB", (width, height), color=(10, 20, 30)).save(
+        target,
+        format="PNG",
+    )
+    return target.getvalue()

package/template/apps/agent-server/tests/test_config.py

@@ -15,11 +15,15 @@ def test_server_config_uses_secret_ref_and_normalizes_endpoint() -> None:
         "QWEN_MODEL": "qwen-plus",
         "QWEN_API_KEY": "server-secret",
         "AI_PROVIDER_HTTPS_HOST_ALLOWLIST": "example.com",
+        "AI_PROVIDER_CAPABILITIES": "text-generation,vision",
+        "AI_PROVIDER_INPUT_MODALITIES": "text,image",
     }
     config = OpenAiCompatibleConfig.from_environment(environment)
     assert config is not None
     assert config.base_url == "https://example.com/compatible-mode/v1"
     assert config.https_host_allowlist == ("example.com",)
+    assert config.capabilities == ("text-generation", "vision")
+    assert config.input_modalities == ("text", "image")
     assert str(config.api_key_ref) == "[SecretRef]"
     resolver = EnvironmentSecretResolver(environment)
     assert config.api_key_ref is not None

package/template/apps/agent-server/tests/test_fingerprint.py

@@ -0,0 +1,10 @@
+from southwind_agent_server.contracts import StartRunRequest
+from southwind_agent_server.fingerprint import request_fingerprint, resolved_release
+
+
+def test_legacy_release_is_scoped_to_operation() -> None:
+    first = StartRunRequest(operation_key="business.first", input=None)
+    second = StartRunRequest(operation_key="business.second", input=None)
+
+    assert resolved_release(first)["releaseId"] != resolved_release(second)["releaseId"]
+    assert request_fingerprint(first) != request_fingerprint(second)

package/template/apps/agent-server/tests/test_multimodal.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import pytest
+
+from southwind_agent_server.contracts import JsonValue
+from southwind_agent_server.engine import PreparedArtifact, SafeEngineError
+from southwind_agent_server.multimodal import (
+    attach_artifacts,
+    final_output,
+    response_format,
+)
+
+
+def test_typed_image_part_and_json_schema_output() -> None:
+    artifact = PreparedArtifact(
+        media_type="image/png",
+        data_url="data:image/png;base64,AAAA",
+        byte_size=3,
+        sha256="a" * 64,
+    )
+    messages = attach_artifacts(
+        [{"role": "user", "content": "提取可见字段"}],
+        (artifact,),
+    )
+    assert messages[0]["content"] == [
+        {"type": "text", "text": "提取可见字段"},
+        {
+            "type": "image_url",
+            "image_url": {
+                "url": "data:image/png;base64,AAAA",
+                "detail": "auto",
+            },
+        },
+    ]
+    schema: dict[str, JsonValue] = {
+        "type": "object",
+        "required": ["name"],
+        "properties": {"name": {"type": "string"}},
+    }
+    assert response_format("evidence.output.v1", schema) == {
+        "type": "json_schema",
+        "json_schema": {
+            "name": "evidence_output_v1",
+            "strict": True,
+            "schema": schema,
+        },
+    }
+    assert final_output('{"name":"票据"}', schema) == {"name": "票据"}
+    with pytest.raises(SafeEngineError) as invalid:
+        final_output('{"name":42}', schema)
+    assert invalid.value.code == "OUTPUT_VALIDATION_FAILED"

package/template/apps/agent-server/tests/test_openai_provider.py

@@ -15,7 +15,7 @@ from southwind_agent_server.engine import (
     ToolRequested,
 )
 from southwind_agent_server.openai_engine import OpenAiCompatibleEngineAdapter
-from southwind_agent_server.tool_host import ToolHostClient
+from southwind_agent_server.tool_host import ToolHostClient, canonical_tool_call_id
 from tests.openai_provider_test_support import (
     create_provider,
     governance,
@@ -128,7 +128,11 @@ async def test_engine_executes_only_allowed_tool_through_host() -> None:
     assert tool_requests[0] == {
         "executionGrant": "grant_1",
         "runId": "run_1",
-        "toolCallId": "call_1",
+        "toolCallId": canonical_tool_call_id(
+            "run_1",
+            "business.records.list",
+            {"page": 2},
+        ),
         "toolKey": "business.records.list",
         "arguments": {"page": 2},
     }

package/template/apps/agent-server/tests/test_postgres_store.py

@@ -0,0 +1,131 @@
+from __future__ import annotations
+
+import os
+import uuid
+from typing import cast
+
+import pytest
+from psycopg import AsyncConnection
+
+from southwind_agent_server.contracts import JsonValue
+from southwind_agent_server.postgres_store import PostgresRunStore
+from southwind_agent_server.store import IdempotencyConflictError, RunRecord
+from southwind_agent_server.store_cipher import RunStoreCipher
+
+DATABASE_URL = os.environ.get("AGENT_TEST_DATABASE_URL", "")
+pytestmark = pytest.mark.skipif(
+    not DATABASE_URL,
+    reason="需要 AGENT_TEST_DATABASE_URL",
+)
+TEST_CIPHER = RunStoreCipher("postgres-test-secret-" * 2)
+
+
+async def test_multi_replica_replay_recovery_and_immutable_release() -> None:
+    suffix = uuid.uuid4().hex
+    first = PostgresRunStore(DATABASE_URL, TEST_CIPHER, lease_seconds=1)
+    second = PostgresRunStore(DATABASE_URL, TEST_CIPHER, lease_seconds=1)
+    record = fixture(suffix)
+    try:
+        created, is_new = await first.create_or_get(
+            record,
+            {"input": {"secret": f"sensitive-{suffix}"}},
+        )
+        repeated, repeated_is_new = await second.create_or_get(record)
+        await first.append(record.run_id, "run.started")
+        await first.append(record.run_id, "output.delta", {"text": "one"})
+        replayed, terminal = await second.events_after(record.run_id, 1, 0)
+
+        await first.release_lease(record.run_id)
+        recovered = await second.recoverable()
+        await second.complete(record.run_id, {"answer": "done"})
+        await first.append(record.run_id, "run.cancelled")
+        final = await first.get(record.run_id)
+
+        evaluation = await second.record_evaluation(
+            release_id(suffix),
+            "quality",
+            "1",
+            {"accuracy": 1.0},
+        )
+        repeated_evaluation = await first.record_evaluation(
+            release_id(suffix),
+            "quality",
+            "1",
+            {"accuracy": 1.0},
+        )
+
+        assert is_new is True
+        assert created.run_id == repeated.run_id
+        assert repeated_is_new is False
+        assert [event["sequence"] for event in replayed] == [2]
+        assert terminal is False
+        assert recovered[0][0].run_id == record.run_id
+        assert final is not None
+        assert final.status == "completed"
+        assert [event["type"] for event in final.events].count("run.completed") == 1
+        assert evaluation == repeated_evaluation
+        await assert_encrypted(record.run_id, suffix)
+
+        conflict = fixture(f"{suffix}_other")
+        conflict.release = {
+            **cast(dict[str, JsonValue], conflict.release),
+            "releaseId": release_id(suffix),
+            "promptVersion": "changed",
+        }
+        with pytest.raises(IdempotencyConflictError):
+            await second.create_or_get(conflict)
+    finally:
+        await first.close()
+        await second.close()
+        await cleanup(suffix)
+
+
+def fixture(suffix: str) -> RunRecord:
+    return RunRecord(
+        run_id=f"run_{suffix}",
+        operation_key="test.echo",
+        input={"secret": f"sensitive-{suffix}"},
+        idempotency_key=f"key_{suffix}",
+        fingerprint=f"{suffix:0<64}"[:64],
+        release={
+            "releaseId": release_id(suffix),
+            "operationVersion": "1.0.0",
+            "workflowVersion": "workflow-1",
+            "promptVersion": "prompt-1",
+            "routeVersion": "route-1",
+            "toolSchemaVersion": "schema-1",
+            "manifestDigest": "0" * 64,
+        },
+        trace_id="1" * 32,
+    )
+
+
+def release_id(suffix: str) -> str:
+    return f"release_{suffix[:40]}"
+
+
+async def assert_encrypted(run_id: str, suffix: str) -> None:
+    async with await AsyncConnection.connect(DATABASE_URL) as connection:
+        cursor = await connection.execute(
+            """
+            select invocation_cipher, output_cipher from agent_runtime_runs
+            where run_id = %s
+            """,
+            (run_id,),
+        )
+        row = await cursor.fetchone()
+        assert row is not None
+        assert f"sensitive-{suffix}" not in str(row)
+
+
+async def cleanup(suffix: str) -> None:
+    async with await AsyncConnection.connect(DATABASE_URL) as connection:
+        await connection.execute(
+            "delete from agent_evaluation_results where release_id = %s",
+            (release_id(suffix),),
+        )
+        await connection.execute(
+            "delete from agent_runtime_runs where run_id like %s",
+            (f"run_{suffix}%",),
+        )
+        await connection.commit()

package/template/apps/agent-server/tests/test_provider_governance.py

@@ -108,6 +108,67 @@ def test_missing_allowlist_and_dlp_reject_before_network(tmp_path: Path) -> None
     assert decisions == [("reject", 0), ("reject", 0)]
 
 
+def test_multimodal_attempt_requires_artifact_and_schema_allowlist(
+    tmp_path: Path,
+) -> None:
+    path = tmp_path / "provider-audit.sqlite3"
+    governance = ProviderRequestGovernance(
+        ProviderAuditStore(str(path), retention_days=90)
+    )
+    multimodal = policy(user_action="redact")
+    multimodal.envelope_fields.extend(
+        [
+            ProviderFieldPolicy(
+                field="artifact-content",
+                classification="sensitive",
+                dlp_action="reject",
+            ),
+            ProviderFieldPolicy(
+                field="output-schema",
+                classification="internal",
+                dlp_action="reject",
+            ),
+        ]
+    )
+    result = governance.authorize(
+        deployment_key="ai.openai-compatible",
+        operation_key="business.vision",
+        run_id="run_vision",
+        attempt=1,
+        messages=[
+            {"role": "system", "content": "只提取可见内容"},
+            {
+                "role": "user",
+                "content": [
+                    {"type": "text", "text": "提取字段"},
+                    {
+                        "type": "image_url",
+                        "image_url": {
+                            "url": "data:image/png;base64,AAAA",
+                            "detail": "auto",
+                        },
+                    },
+                ],
+            },
+        ],
+        tools=(),
+        policy=multimodal,
+        artifact_bytes=3,
+        output_schema={"type": "object"},
+    )
+    assert result.output_schema == {"type": "object"}
+    row = (
+        sqlite3.connect(path)
+        .execute(
+            "select classifications, sent_bytes, decision from provider_attempt_audit"
+        )
+        .fetchone()
+    )
+    assert row[0] == "internal,sensitive"
+    assert row[1] > 3
+    assert row[2] == "allow"
+
+
 def test_attempts_are_unique_append_only_and_ttl_purge_is_bounded(
     tmp_path: Path,
 ) -> None: