create-windy 0.4.0 → 0.5.0

package/template/apps/server/src/module-host/request-context.ts

@@ -133,6 +133,7 @@ function unavailableModuleAiOperationPort(
   };
   return {
     startAgent: async () => unavailable(),
+    verifyAgentRun: async () => unavailable(),
     startDocument: async () => unavailable(),
     startSpeech: async () => unavailable(),
     embed: async () => unavailable(),

package/template/apps/server/src/module-host/scoped-host.ts

@@ -0,0 +1,214 @@
+import type { DurableHandlerRegistry } from "@southwind-ai/jobs";
+import type { ModuleManifest } from "@southwind-ai/modules";
+import {
+  requireModuleNamespace,
+  type ModuleHost,
+  type ModuleResourceFileAccessPolicy,
+  type ModuleUploadPolicy,
+} from "@southwind-ai/server-sdk";
+import type {
+  RegisteredModuleAiOperationHandler,
+  RegisteredModuleDebugSessionProvider,
+  RegisteredModuleDurableHandler,
+  RegisteredModuleGovernedResource,
+  RegisteredModuleRolePreset,
+  RegisteredModuleRoute,
+  RegisteredModuleSandboxToolHandler,
+  RegisteredModuleSearchProvider,
+  RegisteredModuleTaskHandler,
+  RegisteredModuleToolHandler,
+} from "./initialize-contracts.js";
+import { validateDebugSessionProviderRegistration } from "./debug-session-provider-registration.js";
+import { registerModuleDurableHandler } from "./durable-handler-registration.js";
+import { registerGovernedResources } from "./governed-resources.js";
+import { registerResourceFileAccessPolicies } from "./resource-file-policies.js";
+import { validateRouteDeclaration } from "./route-declaration.js";
+import { validateSearchProviderRegistration } from "./search-provider-registration.js";
+
+type HandlerInstaller = (registry: DurableHandlerRegistry) => void;
+
+export interface HostCollections {
+  uploadPolicies: ModuleUploadPolicy[];
+  uploadPurposes: Set<string>;
+  modulePurposes: Map<string, Set<string>>;
+  moduleDependencies: ReadonlyMap<string, readonly string[]>;
+  resourceFileAccessPolicies: ModuleResourceFileAccessPolicy[];
+  moduleResourceFileAccessPolicies: Map<
+    string,
+    ModuleResourceFileAccessPolicy[]
+  >;
+  resourceFileAccessPolicyKeys: Set<string>;
+  handlerKeys: Set<string>;
+  handlerInstallers: HandlerInstaller[];
+  durableHandlers: RegisteredModuleDurableHandler[];
+  routes: RegisteredModuleRoute[];
+  routeKeys: Set<string>;
+  taskHandlers: RegisteredModuleTaskHandler[];
+  taskKeys: Set<string>;
+  toolHandlers: RegisteredModuleToolHandler[];
+  sandboxToolHandlers: RegisteredModuleSandboxToolHandler[];
+  toolKeys: Set<string>;
+  aiOperationHandlers: RegisteredModuleAiOperationHandler[];
+  aiOperationKeys: Set<string>;
+  governedResources: RegisteredModuleGovernedResource[];
+  governedResourceKeys: Set<string>;
+  rolePresets: RegisteredModuleRolePreset[];
+  rolePresetKeys: Set<string>;
+  searchProviders: RegisteredModuleSearchProvider[];
+  searchProviderKeys: Set<string>;
+  debugSessionProviders: RegisteredModuleDebugSessionProvider[];
+  debugSessionProviderKeys: Set<string>;
+}
+
+export function createScopedHost(
+  manifest: ModuleManifest,
+  state: HostCollections,
+): ModuleHost {
+  const moduleName = manifest.name;
+  return {
+    moduleName,
+    registerUploadPolicy(policy) {
+      requireModuleNamespace("上传用途", policy.purpose, moduleName);
+      if (state.uploadPurposes.has(policy.purpose)) {
+        throw new Error(`上传用途重复注册：${policy.purpose}`);
+      }
+      state.uploadPurposes.add(policy.purpose);
+      state.uploadPolicies.push(policy);
+      const purposes =
+        state.modulePurposes.get(moduleName) ?? new Set<string>();
+      purposes.add(policy.purpose);
+      state.modulePurposes.set(moduleName, purposes);
+    },
+    registerResourceFileAccessPolicies(policies) {
+      registerResourceFileAccessPolicies(manifest, state, policies);
+    },
+    registerDurableHandler(definition) {
+      requireModuleNamespace("任务 handler", definition.key, moduleName);
+      registerModuleDurableHandler(manifest, state, definition);
+    },
+    registerGovernedResources(registrations) {
+      registerGovernedResources(manifest, state, registrations);
+    },
+    registerRoutes(routes) {
+      for (const definition of routes) {
+        requireModuleNamespace(
+          "路由权限",
+          definition.permissionKey,
+          moduleName,
+        );
+        validateRouteDeclaration(manifest, definition);
+        const key = `${definition.method} ${definition.path}`;
+        if (state.routeKeys.has(key)) {
+          throw new Error(`模块路由重复注册：${key}`);
+        }
+        state.routeKeys.add(key);
+        state.routes.push({ moduleName, definition });
+      }
+    },
+    registerTaskHandlers(registrations) {
+      for (const registration of registrations) {
+        requireModuleNamespace("定时任务", registration.taskKey, moduleName);
+        if (!manifest.tasks.some(({ key }) => key === registration.taskKey)) {
+          throw new Error(
+            `定时任务 Handler 未在 Manifest 声明：${registration.taskKey}`,
+          );
+        }
+        if (state.taskKeys.has(registration.taskKey)) {
+          throw new Error(`定时任务 Handler 重复注册：${registration.taskKey}`);
+        }
+        state.taskKeys.add(registration.taskKey);
+        state.taskHandlers.push({ moduleName, registration });
+      }
+    },
+    registerToolHandlers(registrations) {
+      for (const registration of registrations) {
+        requireModuleNamespace("Agent Tool", registration.toolKey, moduleName);
+        if (!manifest.tools.some(({ key }) => key === registration.toolKey)) {
+          throw new Error(
+            `Agent Tool Handler 未在 Manifest 声明：${registration.toolKey}`,
+          );
+        }
+        if (state.toolKeys.has(registration.toolKey)) {
+          throw new Error(
+            `Agent Tool Handler 重复注册：${registration.toolKey}`,
+          );
+        }
+        state.toolKeys.add(registration.toolKey);
+        state.toolHandlers.push({ moduleName, registration });
+      }
+    },
+    registerAiOperationHandlers(registrations) {
+      for (const registration of registrations) {
+        requireModuleNamespace(
+          "AI Operation",
+          registration.operationKey,
+          moduleName,
+        );
+        const operation = manifest.aiOperations?.find(
+          ({ key }) => key === registration.operationKey,
+        );
+        if (!operation) {
+          throw new Error(
+            `AI Operation Handler 未在 Manifest 声明：${registration.operationKey}`,
+          );
+        }
+        if (
+          (operation.kind === "agent" && !registration.prepare) ||
+          (operation.kind === "document" && !registration.prepareDocument) ||
+          (operation.kind === "speech" && !registration.prepareSpeech) ||
+          (operation.kind === "embedding" && !registration.prepareEmbedding)
+        ) {
+          throw new Error(
+            `AI Operation Handler 与 kind 不匹配：${registration.operationKey}`,
+          );
+        }
+        if (state.aiOperationKeys.has(registration.operationKey)) {
+          throw new Error(
+            `AI Operation Handler 重复注册：${registration.operationKey}`,
+          );
+        }
+        state.aiOperationKeys.add(registration.operationKey);
+        state.aiOperationHandlers.push({ moduleName, registration });
+      }
+    },
+    registerRolePresets(presets) {
+      for (const preset of presets) {
+        requireModuleNamespace("角色预设", preset.key, moduleName);
+        if (state.rolePresetKeys.has(preset.key)) {
+          throw new Error(`角色预设重复注册：${preset.key}`);
+        }
+        for (const permissionKey of preset.permissionKeys) {
+          requireModuleNamespace("角色预设权限", permissionKey, moduleName);
+          if (!manifest.permissions.some(({ key }) => key === permissionKey)) {
+            throw new Error(
+              `角色预设引用了模块 ${moduleName} 未声明权限：${permissionKey}`,
+            );
+          }
+        }
+        state.rolePresetKeys.add(preset.key);
+        state.rolePresets.push({ moduleName, preset });
+      }
+    },
+    registerSearchProviders(providers) {
+      for (const provider of providers) {
+        requireModuleNamespace("搜索 Provider", provider.key, moduleName);
+        validateSearchProviderRegistration(manifest, provider);
+        if (state.searchProviderKeys.has(provider.key)) {
+          throw new Error(`搜索 Provider 重复注册：${provider.key}`);
+        }
+        state.searchProviderKeys.add(provider.key);
+        state.searchProviders.push({ moduleName, provider });
+      }
+    },
+    registerDebugSessionProviders(providers) {
+      for (const provider of providers) {
+        validateDebugSessionProviderRegistration(manifest, provider);
+        if (state.debugSessionProviderKeys.has(provider.key)) {
+          throw new Error(`调试会话 Provider 重复注册：${provider.key}`);
+        }
+        state.debugSessionProviderKeys.add(provider.key);
+        state.debugSessionProviders.push({ moduleName, provider });
+      }
+    },
+  };
+}

package/template/apps/server/src/module-host.ts

@@ -9,6 +9,7 @@ export {
   type RegisteredModuleTaskHandler,
   type RegisteredModuleToolHandler,
   type RegisteredModuleAiOperationHandler,
+  type RegisteredModuleDebugSessionProvider,
 } from "./module-host/initialize.js";
 export {
   buildModuleRequestContext,

package/template/apps/server/src/runtime-adk-debug.test.ts

@@ -7,7 +7,7 @@ import { createAdkDebugRuntime } from "./runtime-adk-debug.js";
 const token = "debug-token-012345678901234567890123";
 
 describe("ADK Web 专用调试身份", () => {
-  test("只在 canonical Run 路径委托真实用户并收窄权限", async () => {
+  test("只在 canonical Run 与只读 debug-session 路径委托真实用户", async () => {
     const runtime = createRuntime();
     expect(
       runtime.claimsRequest(request("/api/foundation", "GET", token)),
@@ -28,6 +28,30 @@ describe("ADK Web 专用调试身份", () => {
     expect(
       await runtime.resolveRequest(request("/api/foundation", "GET", token)),
     ).toBeUndefined();
+    expect(
+      await runtime.resolveRequest(
+        request("/api/agent/debug/sessions/v1", "GET", token),
+      ),
+    ).toMatchObject({ id: "service_adk_debug" });
+    expect(
+      await runtime.resolveRequest(
+        request(
+          "/api/agent/debug/sessions/v1/wdbg1_" + "a".repeat(43),
+          "GET",
+          token,
+        ),
+      ),
+    ).toMatchObject({ id: "service_adk_debug" });
+    expect(
+      await runtime.resolveRequest(
+        request("/api/agent/debug/sessions/v1", "POST", token),
+      ),
+    ).toBeUndefined();
+    expect(
+      await runtime.resolveRequest(
+        request("/api/agent/debug/sessions/v1/one/events", "GET", token),
+      ),
+    ).toBeUndefined();
     expect(
       await runtime.resolveRequest(
         request("/api/agent/runs/run_1/result", "GET"),

package/template/apps/server/src/runtime-adk-debug.ts

@@ -45,7 +45,7 @@ export function createAdkDebugRuntime(
   return {
     claimsRequest,
     async resolveRequest(request: Request): Promise<RequestActor | undefined> {
-      if (!claimsRequest(request) || !isCanonicalRunRequest(request)) {
+      if (!claimsRequest(request) || !isAdkDebugRequest(request)) {
         return undefined;
       }
       return resolveDelegatedActor(actorResolver, dataActorId, permissionKeys);
@@ -123,8 +123,14 @@ function resolvePermissionClosure(
   return [...new Set([operation.permissionKey, ...toolPermissions])];
 }
 
-function isCanonicalRunRequest(request: Request): boolean {
+function isAdkDebugRequest(request: Request): boolean {
   const path = new URL(request.url).pathname.replace(/\/+$/, "");
+  if (
+    request.method === "GET" &&
+    /^\/api\/agent\/debug\/sessions\/v1(?:\/[^/]+)?$/.test(path)
+  ) {
+    return true;
+  }
   if (request.method === "POST" && path === "/api/agent/runs") return true;
   const match = path.match(
     /^\/api\/agent\/runs\/[^/]+\/(events|result|cancel|attach)$/,

package/template/apps/server/src/settings/drizzle-watermark-repository.integration.test.ts

@@ -42,6 +42,8 @@ describePostgres("PostgreSQL watermark policy repository", () => {
         density: "high",
         contentFields: ["username", "phone"],
         customContent: "内部资料",
+        opacityPercent: 16,
+        fontSize: 20,
       },
       "user_settings",
     );
@@ -56,6 +58,8 @@ describePostgres("PostgreSQL watermark policy repository", () => {
       density: "high",
       contentFields: ["username", "phone"],
       customContent: "内部资料",
+      opacityPercent: 16,
+      fontSize: 20,
     });
   });
 });

package/template/apps/server/src/settings/drizzle-watermark-repository.ts

@@ -30,6 +30,7 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
       .values({
         id: PLATFORM_WATERMARK_ID,
         ...policy,
+        businessPagesEnabled: policy.enabled,
         createdBy: actorId,
         updatedBy: actorId,
       })
@@ -37,10 +38,12 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
         target: platformWatermarkPolicies.id,
         set: {
           enabled: policy.enabled,
-          businessPagesEnabled: policy.businessPagesEnabled,
+          businessPagesEnabled: policy.enabled,
           density: policy.density,
           contentFields: policy.contentFields,
           customContent: policy.customContent,
+          opacityPercent: policy.opacityPercent,
+          fontSize: policy.fontSize,
           updatedAt: new Date(),
           updatedBy: actorId,
         },
@@ -57,12 +60,17 @@ function toPolicy(row: {
   density: PlatformWatermarkPolicy["density"];
   contentFields: PlatformWatermarkPolicy["contentFields"];
   customContent: string;
+  opacityPercent: number;
+  fontSize: number;
 }): PlatformWatermarkPolicy {
+  const enabled = row.enabled && row.businessPagesEnabled;
   return {
-    enabled: row.enabled,
-    businessPagesEnabled: row.businessPagesEnabled,
+    enabled,
+    businessPagesEnabled: enabled,
     density: row.density,
     contentFields: row.contentFields,
     customContent: row.customContent,
+    opacityPercent: row.opacityPercent,
+    fontSize: row.fontSize,
   };
 }

package/template/apps/server/src/settings/watermark-routes.test.ts

@@ -47,6 +47,8 @@ describe("平台水印策略路由", () => {
       density: "medium",
       contentFields: ["username", "displayName"],
       customContent: "",
+      opacityPercent: 8,
+      fontSize: 14,
     });
   });
 
@@ -58,6 +60,8 @@ describe("平台水印策略路由", () => {
       density: "high",
       contentFields: ["username", "phone", "custom"],
       customContent: "内部资料",
+      opacityPercent: 16,
+      fontSize: 20,
     };
 
     const updated = (await fixture.app.invoke(
@@ -83,7 +87,13 @@ describe("平台水印策略路由", () => {
           action: "config.update",
           target: { type: "platform-watermark", id: "platform" },
           metadata: expect.objectContaining({
-            changedFields: ["density", "contentFields", "customContent"],
+            changedFields: [
+              "density",
+              "contentFields",
+              "customContent",
+              "opacityPercent",
+              "fontSize",
+            ],
           }),
         }),
       ]),
@@ -104,6 +114,8 @@ describe("平台水印策略路由", () => {
       density: "low",
       contentFields: ["username"],
       customContent: "",
+      opacityPercent: 8,
+      fontSize: 14,
     })) as Response;
 
     expect(readable.enabled).toBe(true);
@@ -139,6 +151,8 @@ describe("平台水印策略路由", () => {
       density: "medium",
       contentFields: ["username"],
       customContent: "x".repeat(81),
+      opacityPercent: 8,
+      fontSize: 14,
     })) as Response;
 
     expect(response.status).toBe(400);
@@ -148,9 +162,48 @@ describe("平台水印策略路由", () => {
       density: "medium",
       contentFields: ["username", "displayName"],
       customContent: "",
+      opacityPercent: 8,
+      fontSize: 14,
     });
     expect(fixture.runtime.auditSink.list()).toHaveLength(0);
   });
+
+  test("旧业务范围状态会折叠到唯一开关", async () => {
+    const fixture = await createFixture(settingsActor(true));
+
+    const updated = (await update(fixture, {
+      enabled: true,
+      businessPagesEnabled: false,
+      density: "medium",
+      contentFields: ["email", "displayName"],
+      customContent: "",
+      opacityPercent: 8,
+      fontSize: 14,
+    })) as PlatformWatermarkPolicy;
+
+    expect(updated.enabled).toBe(true);
+    expect(updated.businessPagesEnabled).toBe(true);
+    expect(updated.contentFields).toEqual(["email", "displayName"]);
+  });
+
+  test("不透明度和字体大小超出范围时拒绝保存", async () => {
+    const fixture = await createFixture(settingsActor(true));
+
+    const response = (await update(fixture, {
+      enabled: true,
+      businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username"],
+      customContent: "",
+      opacityPercent: 31,
+      fontSize: 14,
+    })) as Response;
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      error: "INVALID_WATERMARK_POLICY",
+    });
+  });
 });
 
 async function update(

package/template/apps/server/src/settings/watermark-routes.ts

@@ -6,6 +6,8 @@ import type {
 import {
   WATERMARK_CONTENT_FIELDS,
   WATERMARK_DENSITIES,
+  WATERMARK_FONT_SIZE_RANGE,
+  WATERMARK_OPACITY_RANGE,
 } from "@southwind-ai/shared";
 import { evaluateRouteGuards, findFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
@@ -137,6 +139,28 @@ function parseWatermarkPolicy(body: unknown): WatermarkParseResult {
   if (customContent.length > 80) {
     return { ok: false, message: "自定义内容不能超过 80 个字符" };
   }
+  if (
+    typeof source.opacityPercent !== "number" ||
+    !Number.isInteger(source.opacityPercent) ||
+    source.opacityPercent < WATERMARK_OPACITY_RANGE.min ||
+    source.opacityPercent > WATERMARK_OPACITY_RANGE.max
+  ) {
+    return {
+      ok: false,
+      message: `水印不透明度必须是 ${WATERMARK_OPACITY_RANGE.min}% 到 ${WATERMARK_OPACITY_RANGE.max}% 的整数`,
+    };
+  }
+  if (
+    typeof source.fontSize !== "number" ||
+    !Number.isInteger(source.fontSize) ||
+    source.fontSize < WATERMARK_FONT_SIZE_RANGE.min ||
+    source.fontSize > WATERMARK_FONT_SIZE_RANGE.max
+  ) {
+    return {
+      ok: false,
+      message: `水印字体大小必须是 ${WATERMARK_FONT_SIZE_RANGE.min}px 到 ${WATERMARK_FONT_SIZE_RANGE.max}px 的整数`,
+    };
+  }
   const contentFields = [
     ...new Set(
       source.contentFields as PlatformWatermarkPolicy["contentFields"],
@@ -146,10 +170,12 @@ function parseWatermarkPolicy(body: unknown): WatermarkParseResult {
     ok: true,
     value: {
       enabled: source.enabled,
-      businessPagesEnabled: source.businessPagesEnabled,
+      businessPagesEnabled: source.enabled,
       density: source.density as PlatformWatermarkPolicy["density"],
       contentFields,
       customContent,
+      opacityPercent: source.opacityPercent,
+      fontSize: source.fontSize,
     },
   };
 }
@@ -164,6 +190,8 @@ function changedFields(
     "density",
     "contentFields",
     "customContent",
+    "opacityPercent",
+    "fontSize",
   ].filter(
     (field) =>
       JSON.stringify(before[field as keyof PlatformWatermarkPolicy]) !==

package/template/apps/server/src/system/operations.test.ts

@@ -84,6 +84,37 @@ describe("system operation routes", () => {
           path: "/imports",
           usedBytes: 500,
         }),
+        cpuMonitorProbe: async () => ({
+          status: "available",
+          logicalCores: 16,
+          hostUsagePercent: 42.5,
+          processUsagePercent: 3.25,
+          loadAverage1m: 2.1,
+        }),
+        gpuMonitorProbe: async () => ({
+          status: "available",
+          provider: "NVIDIA",
+          message: "GPU 指标可用。",
+          devices: [
+            {
+              index: 0,
+              uuid: "GPU-abc",
+              name: "NVIDIA RTX 5000",
+              usagePercent: 75,
+              memoryUsedBytes: 8_192,
+              memoryTotalBytes: 32_768,
+              memoryUsagePercent: 25,
+              temperatureCelsius: 62,
+              processes: [
+                {
+                  pid: 4321,
+                  name: "python ai-service.py",
+                  usedMemoryBytes: 7_168,
+                },
+              ],
+            },
+          ],
+        }),
       },
     );
     const guardContext = await runtime.createGuardContext(
@@ -104,6 +135,15 @@ describe("system operation routes", () => {
           totalBytes: number;
           usagePercent: number;
         };
+        cpu: {
+          logicalCores: number;
+          hostUsagePercent: number;
+          processUsagePercent: number;
+        };
+      };
+      gpuMonitor: {
+        status: string;
+        devices: Array<{ name: string; processes: Array<{ pid: number }> }>;
       };
       databaseMonitor: { engine: string; version: string };
       diskMonitor: {
@@ -118,6 +158,20 @@ describe("system operation routes", () => {
     expect(snapshot.serviceMonitor.status).toBe("running");
     expect(snapshot.serviceMonitor.startedAt).toMatch(/^\d{4}-\d{2}-\d{2}T/);
     expect(snapshot.serviceMonitor.memory.usagePercent).toBeGreaterThan(0);
+    expect(snapshot.serviceMonitor.cpu).toMatchObject({
+      logicalCores: 16,
+      hostUsagePercent: 42.5,
+      processUsagePercent: 3.25,
+    });
+    expect(snapshot.gpuMonitor).toMatchObject({
+      status: "available",
+      devices: [
+        {
+          name: "NVIDIA RTX 5000",
+          processes: [{ pid: 4321 }],
+        },
+      ],
+    });
     expect(snapshot.databaseMonitor).toMatchObject({
       engine: "PostgreSQL",
       version: "16.3",

package/template/apps/server/src/system/operations.ts

@@ -18,6 +18,12 @@ import {
   type DirectoryUsageProbe,
   type HostDiskUsageProbe,
 } from "./operation-monitoring.js";
+import {
+  createCpuMonitorProbe,
+  createGpuMonitorProbe,
+  type CpuMonitorProbe,
+  type GpuMonitorProbe,
+} from "./system-resource-monitoring.js";
 
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
@@ -31,6 +37,8 @@ export interface OperationRouteOptions {
   hostDiskUsageProbe?: HostDiskUsageProbe;
   systemUsageProbe?: DirectoryUsageProbe;
   importDataUsageProbe?: DirectoryUsageProbe;
+  cpuMonitorProbe?: CpuMonitorProbe;
+  gpuMonitorProbe?: GpuMonitorProbe;
   onlineUserProvider?: () => Promise<ActiveAuthSession[]>;
 }
 
@@ -69,6 +77,8 @@ export function registerSystemOperationRoutes(
           process.env.WINDY_IMPORT_DATA_PATH,
       ),
     );
+  const cpuMonitorProbe = options.cpuMonitorProbe ?? createCpuMonitorProbe();
+  const gpuMonitorProbe = options.gpuMonitorProbe ?? createGpuMonitorProbe();
   const onlineUserProvider = options.onlineUserProvider ?? (async () => []);
   app.get("/system/operations", async (rawContext) => {
     const { guardContext } = rawContext as OperationRouteContext;
@@ -87,6 +97,8 @@ export function registerSystemOperationRoutes(
           hostDiskUsageProbe,
           systemUsageProbe,
           importDataUsageProbe,
+          cpuMonitorProbe,
+          gpuMonitorProbe,
           onlineUserProvider,
         )
       : forbidden(decision.reason);
@@ -108,6 +120,8 @@ async function createOperationSnapshot(
   hostDiskUsageProbe: HostDiskUsageProbe,
   systemUsageProbe: DirectoryUsageProbe,
   importDataUsageProbe: DirectoryUsageProbe,
+  cpuMonitorProbe: CpuMonitorProbe,
+  gpuMonitorProbe: GpuMonitorProbe,
   onlineUserProvider: () => Promise<ActiveAuthSession[]>,
 ) {
   const [
@@ -116,6 +130,8 @@ async function createOperationSnapshot(
     hostDiskUsage,
     systemUsage,
     importDataUsage,
+    cpuMonitor,
+    gpuMonitor,
     activeSessions,
   ] = await Promise.all([
     redisHealthProbe(),
@@ -123,6 +139,8 @@ async function createOperationSnapshot(
     hostDiskUsageProbe(),
     systemUsageProbe(),
     importDataUsageProbe(),
+    cpuMonitorProbe(),
+    gpuMonitorProbe(),
     onlineUserProvider(),
   ]);
   return {
@@ -138,7 +156,11 @@ async function createOperationSnapshot(
       lastSeenAt: (session.lastSeenAt || session.issuedAt).toISOString(),
       expiresAt: session.expiresAt.toISOString(),
     })),
-    serviceMonitor: serviceMonitorSnapshot(),
+    serviceMonitor: {
+      ...serviceMonitorSnapshot(),
+      cpu: cpuMonitor,
+    },
+    gpuMonitor,
     databaseMonitor,
     diskMonitor: diskMonitorSnapshot(
       hostDiskUsage,

package/template/apps/server/src/system/seed.test.ts

@@ -33,6 +33,7 @@ describe("系统内置角色同步", () => {
     // @windy-module system.settings end
     expect(role?.permissionKeys).not.toContain("system.user.reveal");
     expect(role?.permissionKeys).not.toContain("system.user.export");
+    expect(role?.permissionKeys).not.toContain("system.ai-runtime.read");
     expect(role?.permissionKeys).toContain("custom.permission");
     // @windy-module system.settings begin
     expect(role?.menuKeys).toContain("system.settings");
@@ -54,6 +55,9 @@ describe("系统内置角色同步", () => {
     expect(
       (await repositories.roles.get("role_developer"))?.permissionKeys,
     ).not.toEqual(expect.arrayContaining(["system.user.reveal"]));
+    expect(
+      (await repositories.roles.get("role_developer"))?.permissionKeys,
+    ).not.toContain("system.ai-runtime.read");
 
     await repositories.roles.update(
       "role_developer",