create-windy 0.6.12 → 0.6.14

package/template/apps/server/src/runtime-adk-debug.test.ts

@@ -1,270 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import type { ModuleManifest } from "@southwind-ai/modules";
-import { buildActorScopeContexts } from "./data-access/context.js";
-import { projectedModuleUserId, type RequestActor } from "./guards.js";
-import { createAdkDebugRuntime } from "./runtime-adk-debug.js";
-
-const token = "debug-token-012345678901234567890123";
-
-describe("ADK Web 专用调试身份", () => {
-  test("只在 canonical Run 与只读 debug-session 路径委托真实用户", async () => {
-    const runtime = createRuntime();
-    expect(
-      runtime.claimsRequest(request("/api/foundation", "GET", token)),
-    ).toBeTrue();
-    const actor = await runtime.resolveRequest(
-      request("/api/agent/runs", "POST", token),
-    );
-
-    expect(actor).toMatchObject({
-      id: "service_adk_debug",
-      type: "service",
-      roleCodes: ["adk-debug"],
-      permissionKeys: ["customer.copilot.execute", "customer.records.read"],
-    });
-    expect(actor && projectedModuleUserId(actor)).toBe("user_dev_admin");
-    expect(actor?.scopeContext?.actorId).toBe("user_dev_admin");
-    expect(actor?.permissionKeys).not.toContain("customer.admin.manage");
-    expect(
-      await runtime.resolveRequest(request("/api/foundation", "GET", token)),
-    ).toBeUndefined();
-    expect(
-      await runtime.resolveRequest(
-        request("/api/agent/debug/sessions/v1", "GET", token),
-      ),
-    ).toMatchObject({ id: "service_adk_debug" });
-    expect(
-      await runtime.resolveRequest(
-        request(
-          "/api/agent/debug/sessions/v1/wdbg1_" + "a".repeat(43),
-          "GET",
-          token,
-        ),
-      ),
-    ).toMatchObject({ id: "service_adk_debug" });
-    expect(
-      await runtime.resolveRequest(
-        request("/api/agent/debug/sessions/v1", "POST", token),
-      ),
-    ).toBeUndefined();
-    expect(
-      await runtime.resolveRequest(
-        request("/api/agent/debug/sessions/v1/one/events", "GET", token),
-      ),
-    ).toBeUndefined();
-    expect(
-      await runtime.resolveRequest(
-        request("/api/agent/runs/run_1/result", "GET"),
-      ),
-    ).toBeUndefined();
-  });
-
-  test("持久 Run 的 Tool Host 可恢复同一个受限身份", async () => {
-    const runtime = createRuntime();
-
-    expect(
-      (await runtime.resolveActor("service_adk_debug"))?.permissionKeys,
-    ).toEqual(["customer.copilot.execute", "customer.records.read"]);
-    expect(runtime.operationForActor("service_adk_debug")).toBe(
-      "customer.copilot.global",
-    );
-    expect(await runtime.resolveActor("user_dev_admin")).toBeUndefined();
-  });
-
-  test("数据用户不存在或本身缺少闭包权限时拒绝委托", async () => {
-    expect(
-      await createRuntime({ dataActor: undefined }).resolveRequest(
-        request("/api/agent/runs", "POST", token),
-      ),
-    ).toBeUndefined();
-    expect(
-      await createRuntime({
-        dataActor: actor(["customer.copilot.execute"]),
-      }).resolveRequest(request("/api/agent/runs", "POST", token)),
-    ).toBeUndefined();
-    expect(
-      await createRuntime({
-        dataActor: { ...actor(), id: "user_other" },
-      }).resolveRequest(request("/api/agent/runs", "POST", token)),
-    ).toBeUndefined();
-  });
-
-  test("非开发环境、短 Token、未知 Operation 和未知 Tool 均 fail closed", async () => {
-    expect(
-      await createAdkDebugRuntime(
-        {
-          NODE_ENV: "production",
-          WINDY_ADK_DEBUG_OPERATION_KEY: "customer.copilot.global",
-          WINDY_ADK_DEBUG_DATA_ACTOR_ID: "user_dev_admin",
-          WINDY_ADK_DEBUG_TOKEN: token,
-        },
-        [manifest()],
-      ).resolveRequest(request("/api/agent/runs", "POST", token)),
-    ).toBeUndefined();
-    expect(() =>
-      createAdkDebugRuntime(
-        {
-          NODE_ENV: "development",
-          WINDY_ADK_DEBUG_OPERATION_KEY: "customer.copilot.global",
-          WINDY_ADK_DEBUG_DATA_ACTOR_ID: "user_dev_admin",
-          WINDY_ADK_DEBUG_TOKEN: "short",
-        },
-        [manifest()],
-        () => actor(),
-      ),
-    ).toThrow("至少 32");
-    expect(() =>
-      createAdkDebugRuntime(
-        {
-          NODE_ENV: "development",
-          WINDY_ADK_DEBUG_OPERATION_KEY: "customer.copilot.global",
-          WINDY_ADK_DEBUG_DATA_ACTOR_ID: "user_dev_admin",
-          WINDY_ADK_DEBUG_TOKEN: token,
-          AGENT_SERVER_INTERNAL_TOKEN: token,
-        },
-        [manifest()],
-        () => actor(),
-      ),
-    ).toThrow("内部服务 Token");
-    expect(() => createRuntime({ operationKey: "customer.unknown" })).toThrow(
-      "Operation 必须唯一存在",
-    );
-    expect(() =>
-      createRuntime({ allowedToolKeys: ["customer.unknown"] }),
-    ).toThrow("Tool 必须唯一存在");
-  });
-});
-
-function createRuntime(
-  overrides: {
-    operationKey?: string;
-    allowedToolKeys?: string[];
-    dataActor?: RequestActor;
-  } = {},
-) {
-  const dataActor = Object.hasOwn(overrides, "dataActor")
-    ? overrides.dataActor
-    : actor();
-  return createAdkDebugRuntime(
-    {
-      NODE_ENV: "development",
-      WINDY_ADK_DEBUG_OPERATION_KEY:
-        overrides.operationKey ?? "customer.copilot.global",
-      WINDY_ADK_DEBUG_DATA_ACTOR_ID: "user_dev_admin",
-      WINDY_ADK_DEBUG_TOKEN: token,
-    },
-    [manifest(overrides.allowedToolKeys)],
-    (actorId) => (actorId === "user_dev_admin" ? dataActor : undefined),
-  );
-}
-
-function actor(
-  permissionKeys = [
-    "customer.copilot.execute",
-    "customer.records.read",
-    "customer.admin.manage",
-  ],
-): RequestActor {
-  return {
-    id: "user_dev_admin",
-    type: "user",
-    name: "开发管理员",
-    displayName: "开发管理员",
-    roleCodes: ["super-admin"],
-    permissionKeys,
-    ...buildActorScopeContexts("user_dev_admin", "dept_platform", [
-      {
-        id: "role_super_admin",
-        code: "super-admin",
-        dataScope: "all",
-        departmentIds: [],
-      },
-    ]),
-  };
-}
-
-function request(path: string, method: string, bearer = "") {
-  return new Request(`http://localhost${path}`, {
-    method,
-    headers: bearer ? { authorization: `Bearer ${bearer}` } : undefined,
-  });
-}
-
-function manifest(
-  allowedToolKeys = ["customer.records.search"],
-): ModuleManifest {
-  return {
-    name: "customer",
-    version: "0.1.0",
-    label: "客户",
-    description: "客户",
-    menus: [],
-    adminRoutes: [],
-    permissions: [
-      permission("customer.copilot.execute"),
-      permission("customer.records.read"),
-      permission("customer.admin.manage"),
-    ],
-    apiPermissions: [],
-    features: [],
-    migrations: [],
-    schemaExports: [],
-    tasks: [],
-    tools: [
-      {
-        key: "customer.records.search",
-        label: "查询记录",
-        description: "查询记录",
-        inputSchemaKey: "customer.records.input.v1",
-        outputSchemaKey: "customer.records.output.v1",
-        operation: "query",
-        permissionKey: "customer.records.read",
-        featureKey: "customer.records",
-        auditAction: "customer.records.read",
-        scopeMode: "request",
-        dataClassification: "internal",
-        idempotency: "none",
-        approval: "none",
-        limits: {
-          maxDurationSeconds: 10,
-          maxInputBytes: 4096,
-          maxOutputBytes: 4096,
-        },
-      },
-    ],
-    aiOperations: [
-      {
-        key: "customer.copilot.global",
-        kind: "agent",
-        featureKey: "customer.copilot",
-        permissionKey: "customer.copilot.execute",
-        auditAction: "customer.copilot.execute",
-        inputSchemaKey: "customer.copilot.input.v1",
-        outputSchemaKey: "customer.copilot.output.v1",
-        requiredCapabilities: ["text-generation"],
-        allowedToolKeys,
-        dataClassification: "internal",
-        execution: "streaming",
-        limits: {
-          maxDurationSeconds: 60,
-          maxInputBytes: 4096,
-          maxOutputBytes: 4096,
-        },
-      },
-    ],
-    providers: [],
-    auditActions: [],
-  };
-}
-
-function permission(key: string) {
-  return {
-    key,
-    label: key,
-    module: "customer",
-    moduleLabel: "客户",
-    resource: key,
-    resourceLabel: key,
-    action: "manage" as const,
-  };
-}

package/template/apps/server/src/runtime-adk-debug.ts

@@ -1,164 +0,0 @@
-import { timingSafeEqual } from "node:crypto";
-import type { ModuleManifest } from "@southwind-ai/modules";
-import { readBearerToken } from "./auth/bearer-token.js";
-import { isServerScopeContext } from "./data-access/context.js";
-import { loadFoundationModules } from "./foundation.js";
-import { bindModuleUserProjection, type RequestActor } from "./guards.js";
-
-const debugActorId = "service_adk_debug";
-const minimumTokenBytes = 32;
-
-export type AdkDebugActorResolver = (
-  actorId: string,
-) => Promise<RequestActor | undefined> | RequestActor | undefined;
-
-export function createAdkDebugRuntime(
-  env: Record<string, string | undefined>,
-  modules: readonly ModuleManifest[] = loadFoundationModules(),
-  actorResolver?: AdkDebugActorResolver,
-) {
-  const operationKey = env.WINDY_ADK_DEBUG_OPERATION_KEY?.trim();
-  if (env.NODE_ENV !== "development" || !operationKey) {
-    return disabledRuntime();
-  }
-  const dataActorId = env.WINDY_ADK_DEBUG_DATA_ACTOR_ID?.trim();
-  if (!dataActorId) {
-    throw new Error("ADK Web 调试必须选择真实开发数据用户");
-  }
-  if (!actorResolver) {
-    throw new Error("ADK Web 调试数据用户解析器未配置");
-  }
-  const token = env.WINDY_ADK_DEBUG_TOKEN?.trim();
-  if (!token || Buffer.byteLength(token) < minimumTokenBytes) {
-    throw new Error("ADK Web 调试 Token 必须至少 32 字节");
-  }
-  const internalToken = env.AGENT_SERVER_INTERNAL_TOKEN?.trim();
-  if (internalToken && secureEqual(token, internalToken)) {
-    throw new Error("ADK Web 调试 Token 不能复用 Agent 内部服务 Token");
-  }
-  const permissionKeys = resolvePermissionClosure(modules, operationKey);
-  const claimsRequest = (request: Request) => {
-    const provided = readBearerToken(request);
-    return Boolean(provided && secureEqual(provided, token));
-  };
-
-  return {
-    claimsRequest,
-    async resolveRequest(request: Request): Promise<RequestActor | undefined> {
-      if (!claimsRequest(request) || !isAdkDebugRequest(request)) {
-        return undefined;
-      }
-      return resolveDelegatedActor(actorResolver, dataActorId, permissionKeys);
-    },
-    async resolveActor(actorId: string): Promise<RequestActor | undefined> {
-      return actorId === debugActorId
-        ? resolveDelegatedActor(actorResolver, dataActorId, permissionKeys)
-        : undefined;
-    },
-    operationForActor(actorId: string): string | undefined {
-      return actorId === debugActorId ? operationKey : undefined;
-    },
-    usesToken(candidate: string | undefined): boolean {
-      return Boolean(candidate && secureEqual(candidate, token));
-    },
-  };
-}
-
-async function resolveDelegatedActor(
-  resolver: AdkDebugActorResolver,
-  dataActorId: string,
-  permissionKeys: string[],
-): Promise<RequestActor | undefined> {
-  const user = await resolver(dataActorId);
-  if (
-    !user ||
-    user.id !== dataActorId ||
-    user.type !== "user" ||
-    !isServerScopeContext(user.scopeContext) ||
-    user.scopeContext.actorId !== user.id ||
-    !permissionKeys.every((key) => user.permissionKeys.includes(key))
-  ) {
-    return undefined;
-  }
-  return bindModuleUserProjection(
-    {
-      id: debugActorId,
-      type: "service",
-      name: "ADK 开发调试",
-      displayName: `ADK 开发调试（${user.displayName || user.name}）`,
-      roleCodes: ["adk-debug"],
-      permissionKeys: [...permissionKeys],
-      dataAccess: user.dataAccess,
-      scopeContext: user.scopeContext,
-    },
-    user.id,
-  );
-}
-
-function resolvePermissionClosure(
-  modules: readonly ModuleManifest[],
-  operationKey: string,
-): string[] {
-  const operations = modules.flatMap((module) =>
-    (module.aiOperations ?? [])
-      .filter(({ key }) => key === operationKey)
-      .map((operation) => ({ module, operation })),
-  );
-  if (operations.length !== 1) {
-    throw new Error(`ADK Web 调试 Operation 必须唯一存在：${operationKey}`);
-  }
-  const [{ operation }] = operations;
-  if (operation.kind !== "agent") {
-    throw new Error(`ADK Web 只能调试 Agent Operation：${operationKey}`);
-  }
-  const toolPermissions = operation.allowedToolKeys.map((toolKey) => {
-    const tools = modules.flatMap((module) =>
-      module.tools.filter(({ key }) => key === toolKey),
-    );
-    if (tools.length !== 1) {
-      throw new Error(`ADK Web 调试 Tool 必须唯一存在：${toolKey}`);
-    }
-    return tools[0]!.permissionKey;
-  });
-  return [...new Set([operation.permissionKey, ...toolPermissions])];
-}
-
-function isAdkDebugRequest(request: Request): boolean {
-  const path = new URL(request.url).pathname.replace(/\/+$/, "");
-  if (
-    request.method === "GET" &&
-    /^\/api\/agent\/debug\/sessions\/v1(?:\/[^/]+)?$/.test(path)
-  ) {
-    return true;
-  }
-  if (request.method === "POST" && path === "/api/agent/runs") return true;
-  const match = path.match(
-    /^\/api\/agent\/runs\/[^/]+\/(events|result|cancel|attach)$/,
-  );
-  if (!match) return false;
-  return match[1] === "events" || match[1] === "result"
-    ? request.method === "GET"
-    : request.method === "POST";
-}
-
-function secureEqual(left: string, right: string): boolean {
-  const leftBytes = Buffer.from(left);
-  const rightBytes = Buffer.from(right);
-  return (
-    leftBytes.length === rightBytes.length &&
-    timingSafeEqual(leftBytes, rightBytes)
-  );
-}
-
-function disabledRuntime() {
-  return {
-    claimsRequest: (_request: Request): boolean => false,
-    resolveRequest: async (
-      _request: Request,
-    ): Promise<RequestActor | undefined> => undefined,
-    resolveActor: async (_actorId: string): Promise<RequestActor | undefined> =>
-      undefined,
-    operationForActor: (_actorId: string): string | undefined => undefined,
-    usesToken: (_candidate: string | undefined) => false,
-  };
-}

package/template/apps/server/src/runtime-request-actor.test.ts

@@ -1,55 +0,0 @@
-import { expect, test } from "bun:test";
-import type { RequestActor } from "./guards.js";
-import { resolveRequestActor } from "./runtime-request-actor.js";
-
-const debugActor: RequestActor = {
-  id: "service_adk_debug",
-  type: "service",
-  name: "ADK 开发调试",
-  roleCodes: ["adk-debug"],
-  permissionKeys: ["analysis.copilot.execute"],
-};
-
-test("保留凭据命中后不回退普通认证", async () => {
-  let standardCalls = 0;
-  const request = new Request("http://localhost/api/foundation");
-  const actor = await resolveRequestActor(
-    request,
-    () => {
-      standardCalls += 1;
-      return {
-        id: "user_regular",
-        type: "user",
-        name: "普通用户",
-        roleCodes: ["user"],
-        permissionKeys: [],
-      };
-    },
-    {
-      claimsRequest: () => true,
-      resolveRequest: () => undefined,
-    },
-  );
-
-  expect(actor).toBeUndefined();
-  expect(standardCalls).toBe(0);
-});
-
-test("保留凭据在 canonical 路径始终解析为专用主体", async () => {
-  const actor = await resolveRequestActor(
-    new Request("http://localhost/api/agent/runs", { method: "POST" }),
-    () => ({
-      id: "user_regular",
-      type: "user",
-      name: "普通用户",
-      roleCodes: ["user"],
-      permissionKeys: ["analysis.copilot.execute"],
-    }),
-    {
-      claimsRequest: () => true,
-      resolveRequest: () => debugActor,
-    },
-  );
-
-  expect(actor).toBe(debugActor);
-});

package/template/apps/server/src/runtime-request-actor.ts

@@ -1,22 +0,0 @@
-import type { RequestActor } from "./guards.js";
-
-export interface ReservedRequestActorResolver {
-  claimsRequest(request: Request): boolean;
-  resolveRequest(
-    request: Request,
-  ): Promise<RequestActor | undefined> | RequestActor | undefined;
-}
-
-export async function resolveRequestActor(
-  request: Request,
-  resolveStandard: () =>
-    | Promise<RequestActor | undefined>
-    | RequestActor
-    | undefined,
-  reserved?: ReservedRequestActorResolver,
-): Promise<RequestActor | undefined> {
-  if (reserved?.claimsRequest(request)) {
-    return reserved.resolveRequest(request);
-  }
-  return resolveStandard();
-}

package/template/docker-compose.agent-debug.yml

@@ -1,58 +0,0 @@
-services:
-  server:
-    environment:
-      PLATFORM_ENABLE_AI: "true"
-      WINDY_ADK_DEBUG_TOKEN: ${ADK_DEBUG_PLATFORM_TOKEN:?请先由 create-windy doctor 修复本地调试 Token}
-      WINDY_ADK_DEBUG_OPERATION_KEY: ${WINDY_ADK_DEBUG_OPERATION_KEY:?项目尚未选择 ADK Web 调试 Operation}
-      WINDY_ADK_DEBUG_DATA_ACTOR_ID: ${WINDY_ADK_DEBUG_DATA_ACTOR_ID:?项目尚未选择 ADK Web 真实开发数据用户}
-
-  adk-web-debug:
-    profiles: ["agent-debug"]
-    build:
-      context: .
-      dockerfile: apps/agent-server/Dockerfile
-      args:
-        WINDY_PYPI_INDEX_URL: ${WINDY_PYPI_INDEX_URL:-http://mirrors.cloud.tencent.com/pypi/simple}
-    environment:
-      ADK_DEBUG_PLATFORM_URL: http://server:9747
-      ADK_DEBUG_PLATFORM_TOKEN: ${ADK_DEBUG_PLATFORM_TOKEN:?请先由 create-windy doctor 修复本地调试 Token}
-      ADK_DEBUG_OPERATION_KEY: ${WINDY_ADK_DEBUG_OPERATION_KEY:?项目尚未选择 ADK Web 调试 Operation}
-    command:
-      [
-        "adk",
-        "web",
-        "--host",
-        "0.0.0.0",
-        "--port",
-        "8000",
-        "--no-reload",
-        "--session_service_uri",
-        "windy-debug://v1",
-        "--artifact_service_uri",
-        "memory://",
-        "--logo-text",
-        "Windy ADK 真实 Run 调试",
-        "--logo-image-url",
-        "data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%2F%3E",
-        "/app/apps/agent-server/adk_web_agents",
-      ]
-    ports:
-      - "127.0.0.1:8000:8000"
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "python",
-          "-c",
-          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/', timeout=3)",
-        ]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    depends_on:
-      server:
-        condition: service_started
-      agent-server:
-        condition: service_healthy
-      tool-sandbox:
-        condition: service_started

package/template/scripts/dev-adk-web.ts

@@ -1,107 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { resolve } from "node:path";
-
-interface DebugProjectConfig {
-  schemaVersion: 1;
-  textOperation: { key: string; dataActorId: string } | null;
-}
-
-export async function readDebugOperationConfig(
-  path = resolve("apps/agent-server/project/adk-web-debug.json"),
-): Promise<{ operationKey: string; dataActorId: string }> {
-  let value: unknown;
-  try {
-    value = JSON.parse(await readFile(path, "utf8"));
-  } catch (error) {
-    throw new Error(`ADK Web 项目调试配置不可读：${path}`, {
-      cause: error,
-    });
-  }
-  if (!isDebugProjectConfig(value)) {
-    throw new Error("ADK Web 项目调试配置格式无效");
-  }
-  const key = value.textOperation?.key.trim();
-  const dataActorId = value.textOperation?.dataActorId.trim();
-  if (!key || !dataActorId) {
-    throw new Error(
-      "请先在 apps/agent-server/project/adk-web-debug.json 选择文本 Operation 与真实开发数据用户",
-    );
-  }
-  return { operationKey: key, dataActorId };
-}
-
-export async function runAdkWeb(): Promise<number> {
-  const { operationKey, dataActorId } = await readDebugOperationConfig();
-  const child = Bun.spawn(
-    [
-      "docker",
-      "compose",
-      "-f",
-      "docker-compose.yml",
-      "-f",
-      "docker-compose.agent-debug.yml",
-      "--profile",
-      "agent",
-      "--profile",
-      "agent-debug",
-      "up",
-      "--build",
-      "adk-web-debug",
-    ],
-    {
-      cwd: process.cwd(),
-      env: {
-        ...process.env,
-        WINDY_ADK_DEBUG_OPERATION_KEY: operationKey,
-        WINDY_ADK_DEBUG_DATA_ACTOR_ID: dataActorId,
-      },
-      stdin: "inherit",
-      stdout: "inherit",
-      stderr: "inherit",
-    },
-  );
-  return child.exited;
-}
-
-function isDebugProjectConfig(value: unknown): value is DebugProjectConfig {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const record = value as Record<string, unknown>;
-  if (
-    Object.keys(record).sort().join(",") !== "schemaVersion,textOperation" ||
-    record.schemaVersion !== 1
-  ) {
-    return false;
-  }
-  if (record.textOperation === null) return true;
-  if (
-    !record.textOperation ||
-    typeof record.textOperation !== "object" ||
-    Array.isArray(record.textOperation)
-  ) {
-    return false;
-  }
-  const operation = record.textOperation as Record<string, unknown>;
-  return (
-    Object.keys(operation).sort().join(",") === "dataActorId,key" &&
-    isIdentifier(operation.key) &&
-    isIdentifier(operation.dataActorId)
-  );
-}
-
-function isIdentifier(value: unknown): value is string {
-  return (
-    typeof value === "string" &&
-    Boolean(value.trim()) &&
-    value.length <= 200 &&
-    !/\s/.test(value)
-  );
-}
-
-if (import.meta.main) {
-  try {
-    process.exitCode = await runAdkWeb();
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-  }
-}