create-windy 0.6.11 → 0.6.14

package/template/apps/server/src/agent-workflow/routes.ts

@@ -0,0 +1,307 @@
+import type { RequestGuardContext } from "../guards.js";
+import type { RouteApp } from "../system/routes.js";
+import { AgentWorkflowDefinitionError } from "./definition-validation.js";
+import { AgentWorkflowEvaluationServiceError } from "./evaluation-service.js";
+import {
+  AgentWorkflowQueryError,
+  type AgentWorkflowQueryService,
+} from "./query-service.js";
+import { AgentWorkflowRepositoryConflict } from "./repository.js";
+import { AgentWorkflowStateError } from "./state-machine.js";
+import { AgentWorkflowAuthorizationError } from "./authorization.js";
+import { AgentWorkflowCommandError } from "./command-facade.js";
+import { AgentWorkflowEvaluationRepositoryConflict } from "./evaluation-repository.js";
+import { AgentWorkflowWaitSignalError } from "./wait-signal-service.js";
+import type { AgentWorkflowArtifactPort } from "./node-execution-ports.js";
+import { AgentWorkflowArtifactAccessError } from "./artifact-access-error.js";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+
+interface WorkflowRouteContext {
+  readonly body?: unknown;
+  readonly params: Record<string, string | undefined>;
+  readonly request: Request;
+  readonly guardContext: RequestGuardContext;
+}
+
+export interface AgentWorkflowCommandFacade {
+  publish(body: unknown, context: RequestGuardContext): Promise<unknown>;
+  createRun(
+    body: unknown,
+    context: RequestGuardContext,
+    signal: AbortSignal,
+  ): Promise<unknown>;
+  cancel(
+    runId: string,
+    body: unknown,
+    context: RequestGuardContext,
+    signal: AbortSignal,
+  ): Promise<unknown>;
+  recover(
+    runId: string,
+    body: unknown,
+    context: RequestGuardContext,
+    signal: AbortSignal,
+  ): Promise<unknown>;
+  signal(
+    runId: string,
+    nodeRunId: string,
+    signalKey: string,
+    body: unknown,
+    context: RequestGuardContext,
+    signal: AbortSignal,
+  ): Promise<unknown>;
+  evaluate(body: unknown, context: RequestGuardContext): Promise<unknown>;
+  getEvaluation(
+    evaluationId: string,
+    context: RequestGuardContext,
+  ): Promise<unknown>;
+}
+
+export function registerAgentWorkflowRoutes(
+  app: RouteApp,
+  runtime?: {
+    readonly query: AgentWorkflowQueryService;
+    readonly commands: AgentWorkflowCommandFacade;
+    readonly artifacts: AgentWorkflowArtifactPort;
+    readonly readiness: {
+      readonly modelNodes:
+        | {
+            readonly status: "available";
+            readonly pricingCatalogDigest: string;
+          }
+        | { readonly status: "unavailable"; readonly safeCode: string };
+    };
+  },
+) {
+  app.get("/agent/workflows/readiness", (raw) =>
+    handle(raw, async () => required(runtime).readiness),
+  );
+  app.get("/agent/workflows/releases/:releaseId", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).query.release(param(route, "releaseId")),
+    ),
+  );
+  app.get("/agent/workflows/runs", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).query.list(
+        route.guardContext,
+        integerQuery(route.request, "limit", 100, 1, 200),
+      ),
+    ),
+  );
+  app.get("/agent/workflows/runs/:runId", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).query.detail(param(route, "runId"), route.guardContext),
+    ),
+  );
+  app.get("/agent/workflows/runs/:runId/events", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).query.events(
+        param(route, "runId"),
+        route.guardContext,
+        integerQuery(route.request, "afterSequence", 0, 0, 2_147_483_647),
+        integerQuery(route.request, "limit", 200, 1, 1_000),
+      ),
+    ),
+  );
+  app.get("/agent/workflows/evaluations/:evaluationId", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).commands.getEvaluation(
+        param(route, "evaluationId"),
+        route.guardContext,
+      ),
+    ),
+  );
+  app.get("/agent/workflows/artifacts/:artifactId/resolve", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).artifacts.resolve({
+        artifactId: param(route, "artifactId"),
+        actorId: route.guardContext.actor.id,
+        scopeDigest: routeScopeDigest(route.guardContext),
+        signal: route.request.signal,
+      }),
+    ),
+  );
+  app.get("/agent/workflows/artifacts/open", async (raw) => {
+    const route = raw as WorkflowRouteContext;
+    try {
+      const token = new URL(route.request.url).searchParams.get("token");
+      if (!token) throw new AgentWorkflowRouteInputError("token");
+      const opened = await required(runtime).artifacts.open({
+        token,
+        actorId: route.guardContext.actor.id,
+        scopeDigest: routeScopeDigest(route.guardContext),
+        signal: route.request.signal,
+      });
+      return new Response(opened.body, {
+        headers: {
+          "cache-control": "private, no-store",
+          "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(opened.filename)}`,
+          "content-length": String(opened.artifact.byteSize),
+          "content-type": opened.contentType,
+        },
+      });
+    } catch (error) {
+      return routeError(error, route.guardContext.requestId);
+    }
+  });
+  app.post("/agent/workflows/releases", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).commands.publish(route.body, route.guardContext),
+    ),
+  );
+  app.post("/agent/workflows/runs", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).commands.createRun(
+        route.body,
+        route.guardContext,
+        route.request.signal,
+      ),
+    ),
+  );
+  app.post("/agent/workflows/runs/:runId/cancel", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).commands.cancel(
+        param(route, "runId"),
+        route.body,
+        route.guardContext,
+        route.request.signal,
+      ),
+    ),
+  );
+  app.post("/agent/workflows/runs/:runId/recover", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).commands.recover(
+        param(route, "runId"),
+        route.body,
+        route.guardContext,
+        route.request.signal,
+      ),
+    ),
+  );
+  app.post(
+    "/agent/workflows/runs/:runId/nodes/:nodeRunId/signals/:signalKey",
+    (raw) =>
+      handle(raw, (route) =>
+        required(runtime).commands.signal(
+          param(route, "runId"),
+          param(route, "nodeRunId"),
+          param(route, "signalKey"),
+          route.body,
+          route.guardContext,
+          route.request.signal,
+        ),
+      ),
+  );
+  app.post("/agent/workflows/evaluations", (raw) =>
+    handle(raw, (route) =>
+      required(runtime).commands.evaluate(route.body, route.guardContext),
+    ),
+  );
+  return app;
+}
+
+async function handle(
+  raw: unknown,
+  operation: (route: WorkflowRouteContext) => Promise<unknown>,
+) {
+  const route = raw as WorkflowRouteContext;
+  try {
+    return json(await operation(route));
+  } catch (error) {
+    return routeError(error, route.guardContext.requestId);
+  }
+}
+
+function required<T>(value: T | undefined): T {
+  if (!value) throw new AgentWorkflowRuntimeUnavailable();
+  return value;
+}
+
+function param(route: WorkflowRouteContext, key: string) {
+  const value = route.params[key];
+  if (!value?.trim() || value.length > 256) {
+    throw new AgentWorkflowRouteInputError(key);
+  }
+  return value;
+}
+
+function integerQuery(
+  request: Request,
+  key: string,
+  fallback: number,
+  minimum: number,
+  maximum: number,
+) {
+  const raw = new URL(request.url).searchParams.get(key);
+  if (raw === null) return fallback;
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new AgentWorkflowRouteInputError(key);
+  }
+  return value;
+}
+
+function routeError(error: unknown, requestId: string) {
+  if (error instanceof AgentWorkflowQueryError) {
+    return json(
+      { code: error.code, requestId, retryable: false },
+      error.status,
+    );
+  }
+  if (error instanceof AgentWorkflowWaitSignalError) {
+    return json(
+      { code: error.code, requestId, retryable: false },
+      error.status,
+    );
+  }
+  if (error instanceof AgentWorkflowArtifactAccessError) {
+    return json(
+      { code: error.code, requestId, retryable: false },
+      error.status,
+    );
+  }
+  if (
+    error instanceof AgentWorkflowCommandError ||
+    error instanceof AgentWorkflowAuthorizationError
+  ) {
+    const status =
+      error instanceof AgentWorkflowCommandError ? error.status : 403;
+    return json({ code: error.code, requestId, retryable: false }, status);
+  }
+  if (
+    error instanceof AgentWorkflowRouteInputError ||
+    error instanceof AgentWorkflowDefinitionError ||
+    error instanceof AgentWorkflowEvaluationServiceError
+  ) {
+    return json(
+      { code: "INVALID_WORKFLOW_REQUEST", requestId, retryable: false },
+      400,
+    );
+  }
+  if (
+    error instanceof AgentWorkflowRepositoryConflict ||
+    error instanceof AgentWorkflowEvaluationRepositoryConflict ||
+    error instanceof AgentWorkflowStateError
+  ) {
+    return json({ code: error.code, requestId, retryable: false }, 409);
+  }
+  return json(
+    { code: "AGENT_WORKFLOW_UNAVAILABLE", requestId, retryable: true },
+    503,
+  );
+}
+
+function json(body: unknown, status = 200) {
+  return Response.json(body, {
+    status,
+    headers: { "cache-control": "no-store" },
+  });
+}
+
+class AgentWorkflowRouteInputError extends Error {}
+class AgentWorkflowRuntimeUnavailable extends Error {}
+
+function routeScopeDigest(context: RequestGuardContext) {
+  return `sha256:${captureAuthorizationScope(context.actor.scopeContext).hash}`;
+}

package/template/apps/server/src/agent-workflow/runtime-composition.ts

@@ -0,0 +1,308 @@
+import type { ModuleManifest } from "@southwind-ai/modules";
+import {
+  DurableHandlerError,
+  type DurableHandlerRegistry,
+} from "@southwind-ai/jobs";
+import { isAgentWorkflowTerminal } from "@southwind-ai/shared";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { RequestGuardContext } from "../guards.js";
+import type { DurableJobService } from "../jobs/service.js";
+import type { DurableJobWorker } from "../jobs/worker.js";
+import type { DurableArtifactService } from "../jobs/artifact-service.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { WorkflowService } from "../workflow/service.js";
+import type { GovernedToolRegistry } from "../agent/tool-registry.js";
+import type { AgentRuntimePort } from "../agent/run-contracts.js";
+import type { AgentRunFacade } from "../agent/run-facade.js";
+import type { AgentRunAuthorizationStore } from "../agent/run-authorization.js";
+import type { AiRuntimeReportRemotePort } from "../ai-runtime-report/contracts.js";
+import type { SessionEventLogService } from "../agent/session-log/service.js";
+import type { RequestActor } from "../guards.js";
+import type { AuthoritativeSourceAccessPort } from "../agent/session-invalidation/contracts.js";
+import { ProductionAgentWorkflowCommandFacade } from "./command-facade.js";
+import { DrizzleWorkflowBudgetLedger } from "./drizzle-budget-ledger.js";
+import { DrizzleWorkflowEffectCommandFence } from "./drizzle-effect-command-fence.js";
+import { DrizzleAgentWorkflowEvaluationRepository } from "./drizzle-evaluation-repository.js";
+import { DrizzleAgentWorkflowRepository } from "./drizzle-repository.js";
+import { DrizzleAgentWorkflowEvaluationEvidenceReader } from "./evaluation-evidence-reader.js";
+import { AgentWorkflowEvaluationService } from "./evaluation-service.js";
+import { createPlatformAgentWorkflowNodeAdapters } from "./platform-node-adapters.js";
+import { AgentWorkflowQueryService } from "./query-service.js";
+import { AgentWorkflowScheduler } from "./scheduler.js";
+import { AgentWorkflowService } from "./service.js";
+import { AgentWorkflowWaitSignalService } from "./wait-signal-service.js";
+import { CanonicalAgentWorkflowModelExecutionPort } from "./canonical-agent-run-port.js";
+import { AgentWorkflowModelPricingCatalog } from "./model-pricing-catalog.js";
+import type { AgentWorkflowEvaluationToolRegistration } from "./evaluation-tool-registration.js";
+import type { AgentWorkflowWorkspacePolicyDefinition } from "./workspace-policy.js";
+import { DrizzleAgentWorkflowDelegationExecutionPort } from "./drizzle-delegation-port.js";
+import { DrizzleDelegatedAgentToolAuthorization } from "./drizzle-delegated-tool-authorization.js";
+import { DrizzleAgentWorkflowArtifactPort } from "./drizzle-artifact-port.js";
+import { ProductionAgentWorkflowArtifactSourceAuthorization } from "./artifact-source-authorization.js";
+import { createProductionWorkflowArtifactPolicies } from "./artifact-policy.js";
+import { ProductionDelegationAuthorization } from "./delegation-execution-authorization.js";
+import { DurableAgentWorkflowContinuationRuntime } from "./durable-continuation-runtime.js";
+import {
+  agentWorkflowContinuationOutcome,
+  authorizeOrCancelContinuation,
+  deferAgentWorkflowRecovery,
+} from "./durable-continuation-driver.js";
+import {
+  driveWorkflowBatch,
+  type AgentWorkflowSchedulerCommandPort,
+} from "./command-drive.js";
+import {
+  createProductionWorkflowConditions,
+  createProductionWorkspacePolicies,
+} from "./production-node-policies.js";
+
+export function composeProductionAgentWorkflowRuntime(input: {
+  readonly db?: NodePgDatabase;
+  readonly modules: readonly ModuleManifest[];
+  readonly runtime: ReturnType<typeof createServerRuntime>;
+  readonly tools: GovernedToolRegistry;
+  readonly approvalWorkflow: WorkflowService;
+  readonly jobs: DurableJobService;
+  readonly jobWorker: DurableJobWorker;
+  readonly jobRegistry: DurableHandlerRegistry;
+  readonly jobArtifacts: DurableArtifactService;
+  readonly artifactAccessSecret?: string;
+  readonly artifactSources?: AuthoritativeSourceAccessPort;
+  readonly modelPricingJson?: string;
+  readonly evaluationTools?: AgentWorkflowEvaluationToolRegistration;
+  readonly workspacePolicies?: readonly AgentWorkflowWorkspacePolicyDefinition[];
+  readonly onContinuationError: (error: unknown) => void;
+  readonly agentFacade?: AgentRunFacade;
+  readonly agentRemote?: AgentRuntimePort;
+  readonly agentReports?: AiRuntimeReportRemotePort;
+  readonly agentAuthorizations?: AgentRunAuthorizationStore;
+  readonly sessionLog?: SessionEventLogService;
+  readonly resolveActor?: (
+    actorId: string,
+  ) => Promise<RequestActor | undefined>;
+}) {
+  if (
+    !input.db ||
+    !input.agentFacade ||
+    !input.agentRemote ||
+    !input.agentReports ||
+    !input.agentAuthorizations ||
+    !input.sessionLog ||
+    !input.resolveActor ||
+    !input.artifactAccessSecret ||
+    !input.artifactSources
+  )
+    return undefined;
+  const resolveActor = input.resolveActor;
+  const repository = new DrizzleAgentWorkflowRepository(input.db);
+  const effectFence = new DrizzleWorkflowEffectCommandFence(input.db);
+  const budgetLedger = new DrizzleWorkflowBudgetLedger(input.db);
+  const service = new AgentWorkflowService(
+    repository,
+    effectFence,
+    budgetLedger,
+  );
+  const query = new AgentWorkflowQueryService(repository);
+  const waitSignals = new AgentWorkflowWaitSignalService(repository);
+  const workspacePolicies = createProductionWorkspacePolicies(
+    input.workspacePolicies,
+  );
+  const artifactSourceAuthorization =
+    new ProductionAgentWorkflowArtifactSourceAuthorization(
+      input.artifactSources,
+      resolveActor,
+    );
+  const artifacts = new DrizzleAgentWorkflowArtifactPort(
+    input.db,
+    input.jobArtifacts,
+    createProductionWorkflowArtifactPolicies(),
+    artifactSourceAuthorization,
+    input.artifactAccessSecret,
+  );
+  const modelPricing = AgentWorkflowModelPricingCatalog.fromJson(
+    input.modelPricingJson,
+  );
+  const agentRuns = new CanonicalAgentWorkflowModelExecutionPort(
+    input.agentFacade,
+    input.agentRemote,
+    input.agentReports,
+    input.agentAuthorizations,
+    modelPricing,
+  );
+  const delegationAuthorization = new ProductionDelegationAuthorization(
+    input.tools,
+    input.runtime,
+    workspacePolicies,
+    input.modules,
+    agentRuns,
+    repository,
+  );
+  const delegations = new DrizzleAgentWorkflowDelegationExecutionPort(
+    input.db,
+    repository,
+    budgetLedger,
+    input.sessionLog,
+    agentRuns,
+    delegationAuthorization,
+    resolveActor,
+    artifactSourceAuthorization,
+  );
+  const delegatedToolAuthorization = new DrizzleDelegatedAgentToolAuthorization(
+    input.db,
+    repository,
+    delegationAuthorization,
+  );
+  const evaluationRepository = new DrizzleAgentWorkflowEvaluationRepository(
+    input.db,
+  );
+  const evaluations = new AgentWorkflowEvaluationService(
+    evaluationRepository,
+    new DrizzleAgentWorkflowEvaluationEvidenceReader(
+      input.db,
+      input.tools,
+      input.evaluationTools,
+    ),
+  );
+  const createScheduler = (context: RequestGuardContext) =>
+    new AgentWorkflowScheduler(
+      repository,
+      service,
+      effectFence,
+      createPlatformAgentWorkflowNodeAdapters({
+        context,
+        workflow: input.approvalWorkflow,
+        jobs: input.jobs,
+        jobWorker: input.jobWorker,
+        tools: input.tools,
+        agentRuns,
+        delegations,
+        conditions: createProductionWorkflowConditions(),
+        artifacts,
+      }),
+    );
+  const continuations = new DurableAgentWorkflowContinuationRuntime(
+    input.jobs,
+    input.jobWorker,
+    input.jobRegistry,
+    repository,
+    {
+      execute: async ({ payload, context }) => {
+        const snapshot = await repository.getSnapshot(payload.runId);
+        if (!snapshot || isAgentWorkflowTerminal(snapshot.run.status)) return;
+        if (payload.sourceSequence > snapshot.headSequence) {
+          throw new DurableHandlerError(
+            "AGENT_WORKFLOW_CONTINUATION_SEQUENCE_INVALID",
+            "Agent Workflow continuation sequence 超前",
+            false,
+          );
+        }
+        const current = await authorizeOrCancelContinuation({
+          runId: payload.runId,
+          repository,
+          modules: input.modules,
+          runtime: input.runtime,
+          tools: input.tools,
+          workspacePolicies,
+          resolveActor,
+          createScheduler,
+          signal: context.signal,
+        });
+        if (!current) return;
+        const scheduler = schedulerFor(current.context, context.jobId);
+        if (payload.mode === "recover") {
+          await scheduler.recover({
+            runId: payload.runId,
+            authorizationFence: current.authorization.fence,
+            at: new Date().toISOString(),
+            signal: context.signal,
+          });
+          return;
+        }
+        await driveWorkflowBatch({
+          repository,
+          scheduler,
+          runId: payload.runId,
+          authorizationFence: current.authorization.fence,
+          signal: context.signal,
+        });
+      },
+    },
+    input.onContinuationError,
+  );
+  function schedulerFor(
+    context: RequestGuardContext,
+    causeId = "command",
+  ): AgentWorkflowSchedulerCommandPort {
+    const scheduler = createScheduler(context);
+    const continuationPort = continuations.port(causeId);
+    const port: AgentWorkflowSchedulerCommandPort = {
+      advance: (command) => scheduler.advance(command),
+      cancel: (command) => scheduler.cancel(command),
+      recover: async (command) => {
+        let result: unknown;
+        try {
+          result = await scheduler.recover(command);
+        } catch (error) {
+          if (!command.signal.aborted) throw error;
+          await deferAgentWorkflowRecovery({
+            repository,
+            port: continuationPort,
+            runId: command.runId,
+            reason: "request-aborted",
+          });
+          return { outcome: "deferred" };
+        }
+        if (agentWorkflowContinuationOutcome(result) === "completed") {
+          await driveWorkflowBatch({
+            repository,
+            scheduler: port,
+            runId: command.runId,
+            authorizationFence: command.authorizationFence,
+            signal: command.signal,
+          });
+        } else {
+          await deferAgentWorkflowRecovery({
+            repository,
+            port: continuationPort,
+            runId: command.runId,
+            reason: "recovery-pending",
+          });
+        }
+        return result;
+      },
+      ...continuationPort,
+    };
+    return port;
+  }
+  continuations.start();
+  return {
+    query,
+    artifacts,
+    delegatedToolAuthorization,
+    readiness: {
+      modelNodes: modelPricing
+        ? {
+            status: "available" as const,
+            pricingCatalogDigest: modelPricing.digest,
+          }
+        : {
+            status: "unavailable" as const,
+            safeCode: "MODEL_PRICING_UNAVAILABLE",
+          },
+    },
+    commands: new ProductionAgentWorkflowCommandFacade(
+      repository,
+      service,
+      query,
+      evaluations,
+      evaluationRepository,
+      input.modules,
+      input.runtime,
+      input.tools,
+      waitSignals,
+      artifacts,
+      workspacePolicies,
+      schedulerFor,
+    ),
+  };
+}