create-windy 0.5.2 → 0.6.0

package/template/apps/embedding-server/tests/test_run_service.py

@@ -0,0 +1,200 @@
+from __future__ import annotations
+
+import asyncio
+import sqlite3
+from dataclasses import replace
+from pathlib import Path
+
+import pytest
+
+from southwind_embedding_server.adapter import EmbeddingAdapter
+from southwind_embedding_server.config import EmbeddingConfig
+from southwind_embedding_server.contracts import EmbeddingRequest, EmbeddingResponse
+from southwind_embedding_server.run_cipher import EmbeddingRunCipher
+from southwind_embedding_server.run_service import EmbeddingRunService, deployment_pin
+from southwind_embedding_server.run_store import EmbeddingRunStore, RunConflictError
+
+
+def config(path: str) -> EmbeddingConfig:
+    return EmbeddingConfig(
+        internal_token="internal",
+        artifact_url="http://server:9747/api/internal/ai/artifacts",
+        run_artifact_url="http://server:9747/api/internal/embeddings/runs",
+        adapter_url="http://adapter:9000",
+        adapter_token=None,
+        deployment_key="local",
+        deployment_alias="intranet-v1",
+        model="embedding-model",
+        version="2026-08",
+        dimensions=3,
+        normalized=True,
+        capabilities=("embedding.text",),
+        run_store_path=path,
+        run_encryption_secret="x" * 32,
+    )
+
+
+def request(text: str = "敏感文本") -> EmbeddingRequest:
+    return EmbeddingRequest.model_validate(
+        {
+            "kind": "embedding",
+            "operationKey": "analysis.embedding.text",
+            "items": [{"id": "one", "text": text}],
+            "options": {},
+            "inputModalities": ["text"],
+            "requiredCapabilities": ["embedding.text"],
+            "dataClassification": "sensitive",
+            "limits": {
+                "maxDurationSeconds": 30,
+                "maxInputBytes": 1024,
+                "maxOutputBytes": 1024,
+                "maxUnits": 10,
+            },
+            "providerEgress": {"mode": "forbidden"},
+        }
+    )
+
+
+@pytest.mark.asyncio
+async def test_encrypts_invocation_and_emits_monotonic_terminal_events(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    path = str(tmp_path / "embedding.sqlite3")
+    adapter = EmbeddingAdapter(config(path))
+
+    run_ids: list[str | None] = []
+
+    async def embed(
+        _request: EmbeddingRequest, _run_id: str | None = None
+    ) -> EmbeddingResponse:
+        run_ids.append(_run_id)
+        return EmbeddingResponse.model_validate(
+            {
+                "batchId": "batch-1",
+                "items": [{"id": "one", "vector": [1, 0, 0], "inputSha256": "a" * 64}],
+                "metadata": {
+                    "deploymentAlias": "intranet-v1",
+                    "model": "embedding-model",
+                    "version": "2026-08",
+                    "dimensions": 3,
+                    "normalized": True,
+                },
+            }
+        )
+
+    monkeypatch.setattr(adapter, "embed", embed)
+    store = EmbeddingRunStore(path, EmbeddingRunCipher("x" * 32), 60)
+    service = EmbeddingRunService(adapter, store, 1)
+    started = await service.start(request(), "key-1", "embedding_started")
+    for _ in range(20):
+        if (await service.require(started.run_id)).terminal:
+            break
+        await asyncio.sleep(0)
+    events = await store.events_after(started.run_id, 0)
+    assert [event["sequence"] for event in events] == [1, 2]
+    assert [event["type"] for event in events] == ["run.started", "run.completed"]
+    assert run_ids == [started.run_id]
+    with sqlite3.connect(path) as database:
+        cipher = str(
+            database.execute("select invocation_cipher from embedding_runs").fetchone()[
+                0
+            ]
+        )
+    assert "敏感文本" not in cipher
+
+
+@pytest.mark.asyncio
+async def test_rejects_same_idempotency_key_with_changed_semantics(
+    tmp_path: Path,
+) -> None:
+    path = str(tmp_path / "embedding.sqlite3")
+    store = EmbeddingRunStore(path, EmbeddingRunCipher("x" * 32), 60)
+    first, _ = await store.create_or_get(
+        "run-1", request(), "key-1", "a" * 64, deployment_pin(config(path))
+    )
+    assert first.status == "accepted"
+    with pytest.raises(RunConflictError):
+        await store.create_or_get(
+            "run-2",
+            request("changed"),
+            "key-1",
+            "b" * 64,
+            deployment_pin(config(path)),
+        )
+
+
+@pytest.mark.asyncio
+async def test_recovers_accepted_run_after_sqlite_restart(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    path = str(tmp_path / "embedding.sqlite3")
+    first_store = EmbeddingRunStore(path, EmbeddingRunCipher("x" * 32), 60)
+    pending, _ = await first_store.create_or_get(
+        "embedding_recovered",
+        request(),
+        "recover-key",
+        "a" * 64,
+        deployment_pin(config(path)),
+    )
+    adapter = EmbeddingAdapter(config(path))
+    invoked: list[str | None] = []
+
+    async def embed(
+        _request: EmbeddingRequest, run_id: str | None = None
+    ) -> EmbeddingResponse:
+        invoked.append(run_id)
+        return response()
+
+    monkeypatch.setattr(adapter, "embed", embed)
+    restarted_store = EmbeddingRunStore(path, EmbeddingRunCipher("x" * 32), 60)
+    restarted = EmbeddingRunService(adapter, restarted_store, 1)
+    await restarted.recover()
+    for _ in range(20):
+        if (await restarted.require(pending.run_id)).terminal:
+            break
+        await asyncio.sleep(0)
+    assert invoked == [pending.run_id]
+    assert (await restarted.require(pending.run_id)).status == "completed"
+
+
+@pytest.mark.asyncio
+async def test_recovery_fails_closed_when_deployment_pin_drifts(tmp_path: Path) -> None:
+    path = str(tmp_path / "embedding.sqlite3")
+    initial = config(path)
+    store = EmbeddingRunStore(path, EmbeddingRunCipher("x" * 32), 60)
+    pending, _ = await store.create_or_get(
+        "embedding_drifted",
+        request(),
+        "drift-key",
+        "a" * 64,
+        deployment_pin(initial),
+    )
+    restarted = EmbeddingRunService(
+        EmbeddingAdapter(replace(initial, model="replacement-model")),
+        EmbeddingRunStore(path, EmbeddingRunCipher("x" * 32), 60),
+        1,
+    )
+    await restarted.recover()
+    for _ in range(20):
+        if (await restarted.require(pending.run_id)).terminal:
+            break
+        await asyncio.sleep(0)
+    events = await restarted.store.events_after(pending.run_id, 0)
+    assert events[-1]["type"] == "run.failed"
+    assert events[-1]["error"]["code"] == "CAPABILITY_UNAVAILABLE"
+
+
+def response() -> EmbeddingResponse:
+    return EmbeddingResponse.model_validate(
+        {
+            "batchId": "batch-1",
+            "items": [{"id": "one", "vector": [1, 0, 0], "inputSha256": "a" * 64}],
+            "metadata": {
+                "deploymentAlias": "intranet-v1",
+                "model": "embedding-model",
+                "version": "2026-08",
+                "dimensions": 3,
+                "normalized": True,
+            },
+        }
+    )

package/template/apps/embedding-server/uv.lock

@@ -67,6 +67,29 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
 ]
 
+[[package]]
+name = "cffi"
+version = "2.1.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/9e/ef/008a1939e372c06329a3fce4279c02f328488f3526744906eeec3da7ad5f/cffi-2.1.1.tar.gz", hash = "sha256:dd31f52ea1086513bb9df30f8fcee9b8918323ae067a3d5b78bc826a000712be", size = 530807, upload-time = "2026-08-03T21:21:18.939Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/10/69/43965eccfdead3b9220015fd1320e117be8c6ed01a62ffab76eeb752f5d5/cffi-2.1.1-cp312-cp312-macosx_10_15_x86_64.whl", hash = "sha256:c8c69575568085ba0b1b10c0249d779a214aea6f6522e949a0fc9fb0fcb449d0", size = 184821, upload-time = "2026-08-03T21:19:44.887Z" },
+    { url = "https://files.pythonhosted.org/packages/54/7d/16e5a096677b5e313ca80cd5e5170efa3ea44624a82bb111925522da64b1/cffi-2.1.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f81b3b8f3d4e343550fa4baa0e479bba9f2d29ce9c2e9b51d1ce1718d7442fcf", size = 184719, upload-time = "2026-08-03T21:19:46.129Z" },
+    { url = "https://files.pythonhosted.org/packages/56/e6/8941622732edec876dd17d0453dce07317ae96db34f2ec1436c9d3785986/cffi-2.1.1-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:811bd1e21d32de12efca32393a0ab3f5133b54fce9bd44b8bd77ab07da14bf6a", size = 214799, upload-time = "2026-08-03T21:19:47.218Z" },
+    { url = "https://files.pythonhosted.org/packages/44/de/f98430906df1545ffde0d543dd124a7a439bc2cd32b36b9c53f805df7333/cffi-2.1.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:68e62fe11f30d5ca8289242866f0a5291402d8529ca2178ab8afc5c9694ae890", size = 222389, upload-time = "2026-08-03T21:19:48.331Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/5b/717f1526b9957b34456313c31645c5b82b8fb5c3fe9e4752999be7128bfc/cffi-2.1.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:4a7c934f7360e8cd64fe9efadcbd10c7c6364f531e432b9a4bf5ccbc9e0e8b50", size = 210249, upload-time = "2026-08-03T21:19:49.543Z" },
+    { url = "https://files.pythonhosted.org/packages/64/b3/f8aa4f3e34986c7e4ec45072d1b1b9dd295b6b18007b45518d79726dd725/cffi-2.1.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:3143d81e29e1e20a9ce10901ec369012947876596f75a222235965f2b7ae832e", size = 208775, upload-time = "2026-08-03T21:19:50.918Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/db/dceb9dd5b231e1da801793f8acc9f3c52a7e1afe40bb1aae37e02b0faad5/cffi-2.1.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c1453022f490d2459a11819d83ad1d586e9ff65a12ac3e705ffebd46d3685dcf", size = 221822, upload-time = "2026-08-03T21:19:52.054Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/d2/6cd24ae3be000a634109c247d1475d62e5616d0dc78c82770942ec384248/cffi-2.1.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:208f941bb9d18e768138677f0a6d2ce01f590df56043dda1df1535ac57c88517", size = 225232, upload-time = "2026-08-03T21:19:53.109Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/52/3fa190537004dd7f0ab860a6dc7c0175b8667f68d1e618a46f5498d30250/cffi-2.1.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:210019b6c7cf07f081b4c54635c8cf744377001350e29cc0f81c4377b4797735", size = 223597, upload-time = "2026-08-03T21:19:54.515Z" },
+    { url = "https://files.pythonhosted.org/packages/80/fb/0bb75b7039588c074b37ae99f40d9bfddf990ecb2fbc346ebccd2e56b9be/cffi-2.1.1-cp312-cp312-win32.whl", hash = "sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e", size = 175292, upload-time = "2026-08-03T21:19:55.566Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/79/615cc094e2fb508cade7de88d3b4f6c4ec2bab695c97bce9153dc65aadf5/cffi-2.1.1-cp312-cp312-win_amd64.whl", hash = "sha256:f53e442b08449d42821fa4a4fba000095af9f62742a500f978a9f557ec44339a", size = 185919, upload-time = "2026-08-03T21:19:56.89Z" },
+    { url = "https://files.pythonhosted.org/packages/70/c6/d0ea84713fe46b243a436a18fcd47d639732747e21635c8a27191b06dc30/cffi-2.1.1-cp312-cp312-win_arm64.whl", hash = "sha256:7bde5e4cc5c10140859842b9d383af292b22639a4dffb725314baf45968cef80", size = 180093, upload-time = "2026-08-03T21:19:58.155Z" },
+]
+
 [[package]]
 name = "click"
 version = "8.4.2"
@@ -88,6 +111,43 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
 ]
 
+[[package]]
+name = "cryptography"
+version = "50.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/de/41/6cbdcf9142d00fe82836fbb51e503e58088575cf7a0fe1dbff6695bf0840/cryptography-50.0.0.tar.gz", hash = "sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9", size = 880201, upload-time = "2026-07-31T14:25:10.11Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c5/5c/59086b4aac5e879d38ddbcf74e4be7ade89cebc3eb199a55da998c3bb46a/cryptography-50.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03", size = 4001252, upload-time = "2026-07-31T14:23:33.331Z" },
+    { url = "https://files.pythonhosted.org/packages/57/ef/8f2df13c7216bcad3e1c74e07f6e193d93e998e114f524a53877c9af27ad/cryptography-50.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645", size = 4719554, upload-time = "2026-07-31T14:23:35.611Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/41/029086c34d91052fc3b88bcc8056f709a7c915c7a23b235a54eb800b1c97/cryptography-50.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7", size = 4702130, upload-time = "2026-07-31T14:23:37.635Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/ff/b6ce0954962e7f7b969f850a883744197bb3910bdfd7b6da162eab7d9f68/cryptography-50.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3", size = 4725244, upload-time = "2026-07-31T14:23:39.471Z" },
+    { url = "https://files.pythonhosted.org/packages/06/1e/63a1027cb7fec360a182208e1b7767d5aa1fe57be3d6aa856e69a321edc0/cryptography-50.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f", size = 5342265, upload-time = "2026-07-31T14:23:41.286Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/72/a1116d683a6d7ece94590013882515de087edf9ef0e6292aae615a44df73/cryptography-50.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae", size = 4734609, upload-time = "2026-07-31T14:23:43.139Z" },
+    { url = "https://files.pythonhosted.org/packages/15/37/36a9c479bbe49acea2636c7fd3360d20f7b7e079c300352011c44850b181/cryptography-50.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a", size = 4356517, upload-time = "2026-07-31T14:23:44.939Z" },
+    { url = "https://files.pythonhosted.org/packages/32/98/8a151d64367204cbc63ec65d37502f1d9c53cf4bfc6ec3c532614dbec60d/cryptography-50.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987", size = 4724529, upload-time = "2026-07-31T14:23:46.93Z" },
+    { url = "https://files.pythonhosted.org/packages/22/f6/ec13b470172126464a86bf54d2294a46d29837fc51ba3e45d4047946fb5e/cryptography-50.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169", size = 5299852, upload-time = "2026-07-31T14:23:48.851Z" },
+    { url = "https://files.pythonhosted.org/packages/da/3a/f05e32c99d440c9bb891ea0e36c9091891e36be5a9a87ab2ee6ea20729f6/cryptography-50.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f", size = 4734462, upload-time = "2026-07-31T14:23:50.861Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/dc/bd72b26be8953f80625f63151efd38eee71c76ca6cf591c08ff34615a79e/cryptography-50.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105", size = 4852708, upload-time = "2026-07-31T14:23:52.715Z" },
+    { url = "https://files.pythonhosted.org/packages/27/20/c930314a2ab476d15dec966ec87e2e9637bb02b06106b12c0396c57bb603/cryptography-50.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef", size = 5004179, upload-time = "2026-07-31T14:23:54.887Z" },
+    { url = "https://files.pythonhosted.org/packages/32/2e/c9db68a0c4bfa28e310707527c0ee3a2bd254104d2e02e68f368e197aa4c/cryptography-50.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30", size = 3840395, upload-time = "2026-07-31T14:23:56.677Z" },
+    { url = "https://files.pythonhosted.org/packages/03/37/73d005be173aff344af30e9fd2a576575cb2391a7101d9cd3842e1fa8cce/cryptography-50.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07", size = 4036009, upload-time = "2026-07-31T14:24:24.122Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/c6/7a6202a534e32103a285b7834a120869557fe198d51d7cfe59754c8bda9c/cryptography-50.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3", size = 4745252, upload-time = "2026-07-31T14:24:26.118Z" },
+    { url = "https://files.pythonhosted.org/packages/85/4f/0fa8c2f4428198f15d9ff8d63400e27afbf94ce833f6108da1eb3753f945/cryptography-50.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f", size = 4728939, upload-time = "2026-07-31T14:24:27.994Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/63/54dd723490ba2dc09b299682c10b38db38f159728bcaae8c591b8af2f22d/cryptography-50.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5", size = 4748483, upload-time = "2026-07-31T14:24:30.254Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/dd/7c77d26285cc7f6991efce64a0f5b4f9383bfa5dd8c5033003eaf7db4cdb/cryptography-50.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f", size = 5367599, upload-time = "2026-07-31T14:24:32.457Z" },
+    { url = "https://files.pythonhosted.org/packages/46/c9/f60aed34c013f317f92817b6c171c2d22a78270fa41109bd4b08af26b194/cryptography-50.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025", size = 4762647, upload-time = "2026-07-31T14:24:34.599Z" },
+    { url = "https://files.pythonhosted.org/packages/be/f3/f9a0173b139372c3a48ed98154b45cc6b9de17c789d5ab552e621c293609/cryptography-50.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a", size = 4385197, upload-time = "2026-07-31T14:24:36.647Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/36/83bb81f6e569bc38e1e4a7bc80f29b46bb9601920bc455fc8e888f5d5742/cryptography-50.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b", size = 4748095, upload-time = "2026-07-31T14:24:39.493Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/16/d3008eff98c764979865834c3d386d4fd041b5f52e7f34fc29ac1a5eb515/cryptography-50.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708", size = 5325948, upload-time = "2026-07-31T14:24:41.556Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/f8/d97f9603efda3888187bfdb893f26c41be4735c10631d05d284ee6b047c4/cryptography-50.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47", size = 4762400, upload-time = "2026-07-31T14:24:43.636Z" },
+    { url = "https://files.pythonhosted.org/packages/64/a2/4615c8f7d81a00b1d6e6afe19f694e1543582349fb5f4076f6cb5dc36485/cryptography-50.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9", size = 4878208, upload-time = "2026-07-31T14:24:45.522Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/1a/efcfb02f91407149a0dacffffab791f7e19bf6385f63b3666dc8b5e5c9c8/cryptography-50.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7", size = 5037050, upload-time = "2026-07-31T14:24:47.697Z" },
+    { url = "https://files.pythonhosted.org/packages/57/30/4a22984d4f1bdfb8c054f07a92bc176b97a3134cc1d6c4b3bffb1f3688b4/cryptography-50.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba", size = 3874135, upload-time = "2026-07-31T14:24:50.085Z" },
+]
+
 [[package]]
 name = "fastapi"
 version = "0.139.2"
@@ -256,6 +316,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
 ]
 
+[[package]]
+name = "pycparser"
+version = "3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
+]
+
 [[package]]
 name = "pydantic"
 version = "2.13.4"
@@ -369,6 +438,7 @@ name = "southwind-embedding-server"
 version = "0.1.0"
 source = { editable = "." }
 dependencies = [
+    { name = "cryptography" },
     { name = "fastapi" },
     { name = "httpx" },
     { name = "pillow" },
@@ -386,6 +456,7 @@ dev = [
 
 [package.metadata]
 requires-dist = [
+    { name = "cryptography", specifier = ">=50.0.0" },
     { name = "fastapi", specifier = "==0.139.2" },
     { name = "httpx", specifier = "==0.28.1" },
     { name = "pillow", specifier = "==12.3.0" },

package/template/apps/server/Dockerfile

@@ -26,9 +26,22 @@ COPY packages/storage/package.json packages/storage/package.json
 RUN --mount=type=cache,id=windy-bun-1.3.14,target=/root/.bun/install/cache,sharing=shared bun -e 'const child=Bun.spawn(["bun","install","--frozen-lockfile","--no-progress"],{stdin:"inherit",stdout:"inherit",stderr:"inherit"});const heartbeat=setInterval(()=>console.log("[windy] Bun 依赖安装仍在进行"),15000);const exitCode=await child.exited;clearInterval(heartbeat);process.exit(exitCode)'
 
 FROM deps AS runner
+# @windy-module system.storage begin
+RUN apk add --no-cache libarchive=3.8.3-r0 libarchive-tools=3.8.3-r0 \
+    && apk add --no-cache --virtual .windy-report-staging-build build-base=0.5-r3 libarchive-dev=3.8.3-r0
+# @windy-module system.storage end
 COPY drizzle.config.ts drizzle.config.ts
 COPY apps/server apps/server
 COPY packages packages
+# @windy-module system.storage begin
+RUN cc -std=c11 -O2 -Wall -Wextra -Werror \
+      apps/server/src/report-staging/native/archive-frame-helper.c \
+      -larchive -o /usr/local/bin/windy-report-archive-stream \
+    && strip /usr/local/bin/windy-report-archive-stream \
+    && chown root:root /usr/local/bin/windy-report-archive-stream \
+    && chmod 0555 /usr/local/bin/windy-report-archive-stream \
+    && apk del .windy-report-staging-build
+# @windy-module system.storage end
 COPY --chmod=0555 deploy/production/server-entrypoint.sh /usr/local/bin/windy-server-entrypoint
 RUN mkdir -p /app/data/audit /app/data/license && chown -R bun:bun /app/data
 ENV NODE_ENV=production

package/template/apps/server/package.json

@@ -30,6 +30,7 @@
     "nodemailer": "^9.0.3",
     "pg": "^8.22.0",
     "pino": "^10.3.1",
+    "unicode-case-folding": "1.1.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/template/apps/server/src/agent/drizzle-screenshot-intake-repository.integration.test.ts

@@ -0,0 +1,283 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import type { ModuleManifest } from "@southwind-ai/modules";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { AiArtifactCodec } from "../ai-artifact/codec.js";
+import { AiArtifactRuntime } from "../ai-artifact/runtime.js";
+import { buildScopeContext } from "../data-access/context.js";
+import { createRequestGuardContext } from "../guards.js";
+import type { InitializedModuleHosts } from "../module-host.js";
+import { createServerRuntime } from "../runtime.js";
+import { createStorageRuntime } from "../storage/runtime.js";
+import { DrizzleScreenshotIntakeRepository } from "./drizzle-screenshot-intake-repository.js";
+import { createScreenshotIntakeRuntimeV2 } from "./screenshot-intake-bootstrap.js";
+import type { PersistentScreenshotIntake } from "./screenshot-intake-repository.js";
+import {
+  screenshotDeployment,
+  screenshotVisionManifest,
+} from "./screenshot-intake-test-support.js";
+
+const databaseUrl = process.env.SCREENSHOT_INTAKE_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("Screenshot Intake V2 真实 PostgreSQL 重启与 TTL", () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    await migrate(drizzle(pool), {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__screenshot_intake_test_migrations",
+    });
+    await pool.query("truncate table agent_screenshot_intakes");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("重启后保持上传 CAS、canonical Run 绑定与过期清理", async () => {
+    const first = new DrizzleScreenshotIntakeRepository(drizzle(pool));
+    await first.create(record());
+    expect(await first.claimUpload("intake-1", "upload-1", 100)).toMatchObject({
+      status: "uploading",
+    });
+    expect(
+      await first.completeUpload("intake-1", "upload-1", "file-1"),
+    ).toMatchObject({ status: "uploaded", fileId: "file-1" });
+
+    const restarted = new DrizzleScreenshotIntakeRepository(drizzle(pool));
+    expect(await restarted.reserve("intake-1", 101)).toMatchObject({
+      status: "reserving",
+      pageId: "case-detail",
+      contextDigest: `sha256:${"c".repeat(64)}`,
+    });
+    expect(await first.bind("intake-1", "run-1", 102)).toMatchObject({
+      runId: "run-1",
+      status: "bound",
+    });
+    expect(await restarted.bind("intake-1", "run-other", 103)).toBeUndefined();
+
+    await restarted.create({
+      ...record(),
+      intakeId: "boundary",
+      tokenHash: "c".repeat(64),
+      expiresAt: 200,
+    });
+    expect(
+      await restarted.claimUpload("boundary", "upload-boundary", 200),
+    ).toBeUndefined();
+
+    await restarted.create({
+      ...record(),
+      intakeId: "expired",
+      tokenHash: "b".repeat(64),
+      expiresAt: 1,
+    });
+    const expired = await first.listExpired(200, 10);
+    expect(expired.map(({ intakeId }) => intakeId).sort()).toEqual([
+      "boundary",
+      "expired",
+    ]);
+    expect(await restarted.cancel("expired", 200)).toMatchObject({
+      status: "cancelled",
+    });
+  });
+
+  test("Route Runtime 重启后恢复 Host token、Artifact 与幂等 Run 绑定", async () => {
+    await pool.query("truncate table agent_screenshot_intakes");
+    const root = await mkdtemp(`${tmpdir()}/windy-screenshot-intake-`);
+    const db = drizzle(pool);
+    const modules = [screenshotVisionManifest()];
+    const serverRuntime = runtime(modules);
+    const storage = createStorageRuntime({ WINDY_STORAGE_ROOT: root }, db);
+    const artifacts = new AiArtifactRuntime(
+      new AiArtifactCodec("screenshot-integration-secret-32-bytes"),
+      emptyHosts(),
+      serverRuntime,
+      modules[0]!.features,
+      storage,
+      async () => undefined,
+    );
+    const runtimes: NonNullable<
+      ReturnType<typeof createScreenshotIntakeRuntimeV2>
+    >[] = [];
+    const restart = () => {
+      const value = createScreenshotIntakeRuntimeV2({
+        modules,
+        runtime: serverRuntime,
+        artifacts,
+        storage,
+        db,
+        registry: {
+          resolve: () => ({ operationKey: "evidence.image.inspect" }),
+        },
+      });
+      if (!value) throw new Error("Screenshot Runtime 未创建");
+      runtimes.push(value);
+      return value;
+    };
+    const context = guard();
+    const bytes = png();
+    try {
+      const created = restart();
+      const plan = await created.create(declaration(bytes), context, signal());
+      await created.dispose();
+
+      await expect(
+        restart().upload(
+          plan.intakeToken,
+          "image/png",
+          bytes,
+          guard("actor-2"),
+        ),
+      ).rejects.toThrow("Screenshot Intake");
+
+      const uploader = restart();
+      await uploader.upload(plan.intakeToken, "image/png", bytes, context);
+      await uploader.dispose();
+
+      const uploadRetry = restart();
+      await uploadRetry.upload(plan.intakeToken, "image/png", bytes, context);
+      await uploadRetry.dispose();
+
+      const reserver = restart();
+      const first = await reserver.reserve(
+        plan.intakeToken,
+        "evidence.image.inspect",
+        screenshotDeployment,
+        context,
+      );
+      expect(first.artifact.value).toStartWith("v1.");
+      expect(first.artifact.sha256).toBe(
+        "b1ff9c8ea3a780bad09b346c423d2d0e46815926879b18e841d928376a946640",
+      );
+      await reserver.dispose();
+
+      const binder = restart();
+      const recovered = await binder.reserve(
+        plan.intakeToken,
+        "evidence.image.inspect",
+        screenshotDeployment,
+        context,
+      );
+      await recovered.bind("run-canonical");
+      await binder.dispose();
+
+      const retry = restart();
+      const idempotent = await retry.reserve(
+        plan.intakeToken,
+        "evidence.image.inspect",
+        screenshotDeployment,
+        context,
+      );
+      await idempotent.bind("run-canonical");
+      const [row] = await db
+        .select()
+        .from((await import("@southwind-ai/database")).agentScreenshotIntakes);
+      expect(row).toMatchObject({ status: "bound", runId: "run-canonical" });
+    } finally {
+      await Promise.allSettled(runtimes.map((value) => value.dispose()));
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+function record(): PersistentScreenshotIntake {
+  return {
+    intakeId: "intake-1",
+    tokenHash: "a".repeat(64),
+    actorId: "user-1",
+    actorType: "user",
+    scopeHash: "b".repeat(64),
+    moduleName: "evidence",
+    operationKey: "evidence.image.inspect",
+    purpose: "agent.screenshot.evidence.image.inspect",
+    pageId: "case-detail",
+    contextDigest: `sha256:${"c".repeat(64)}`,
+    deployment: {
+      key: "ai.openai-compatible",
+      identity: "deployment-1",
+      releaseDigest: `sha256:${"d".repeat(64)}` as `sha256:${string}`,
+      offersDigest: `sha256:${"e".repeat(64)}` as `sha256:${string}`,
+    },
+    mediaType: "image/png",
+    byteSize: 70,
+    pixels: 1,
+    status: "created" as const,
+    createdAt: 0,
+    expiresAt: 10_000,
+  };
+}
+
+function declaration(bytes: Uint8Array) {
+  return {
+    pageId: "case-detail",
+    contextDigest: `sha256:${"c".repeat(64)}`,
+    mediaType: "image/png" as const,
+    byteSize: bytes.byteLength,
+    pixels: 1,
+  };
+}
+
+function png(): Uint8Array {
+  return Uint8Array.from(
+    Buffer.from(
+      "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4z8AAAAMBAQDJ/pLvAAAAAElFTkSuQmCC",
+      "base64",
+    ),
+  );
+}
+
+function signal() {
+  return AbortSignal.timeout(5_000);
+}
+
+function runtime(modules: readonly ModuleManifest[]) {
+  return createServerRuntime(
+    {},
+    {
+      featureCatalog: modules.flatMap(({ features }) => features),
+      licenseResolver: { resolve: () => ({ status: "valid" }) },
+    },
+  );
+}
+
+function guard(actorId = "actor-1") {
+  return createRequestGuardContext(
+    new Request("http://windy.test/api/agent/screenshots"),
+    {
+      resolveActor: () => ({
+        id: actorId,
+        type: "user",
+        name: "测试用户",
+        roleCodes: ["user"],
+        permissionKeys: ["evidence.ai.execute"],
+        scopeContext: buildScopeContext(actorId, undefined, [
+          {
+            id: "role-user",
+            code: "user",
+            dataScope: "self",
+            departmentIds: [],
+          },
+        ]),
+      }),
+      resolveLicense: () => ({ status: "valid" }),
+    },
+  );
+}
+
+function emptyHosts(): InitializedModuleHosts {
+  return {
+    uploadPurposesOf: () => [],
+    resourceFileAccessPoliciesOf: () => [],
+  } as unknown as InitializedModuleHosts;
+}