create-windy 0.6.12 → 0.6.15

package/template/apps/server/src/agent/remote-runtime.ts

@@ -1,13 +1,14 @@
 import type {
   AgentRuntimeOperation,
   AgentRuntimePort,
-  AgentRuntimeRunStatus,
   AgentRuntimeStartResponse,
-  AgentRuntimeStatusResponse,
-  AgentRuntimeTerminalEvent,
 } from "./run-contracts.js";
-import { AgentRuntimeError } from "./run-contracts.js";
 import { assertVisionReadinessPin } from "./vision-readiness-pin.js";
+import {
+  parseRemoteStart,
+  parseRemoteStatus,
+  remoteRuntimeError,
+} from "./remote-runtime-response.js";
 
 export interface RemoteAgentRuntimeOptions {
   baseUrl: string;
@@ -61,6 +62,27 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
           : {
               maxPixelsPerArtifact: request.limits.maxPixelsPerArtifact,
             }),
+        ...(request.limits.maxModelAttempts === undefined
+          ? {}
+          : { maxModelAttempts: request.limits.maxModelAttempts }),
+        ...(request.limits.maxToolCalls === undefined
+          ? {}
+          : { maxToolCalls: request.limits.maxToolCalls }),
+        ...(request.limits.maxSubagents === undefined
+          ? {}
+          : { maxSubagents: request.limits.maxSubagents }),
+        ...(request.limits.maxParallelism === undefined
+          ? {}
+          : { maxParallelism: request.limits.maxParallelism }),
+        ...(request.limits.maxInputTokens === undefined
+          ? {}
+          : { maxInputTokens: request.limits.maxInputTokens }),
+        ...(request.limits.maxOutputTokens === undefined
+          ? {}
+          : { maxOutputTokens: request.limits.maxOutputTokens }),
+        ...(request.limits.maxCostMicros === undefined
+          ? {}
+          : { maxCostMicros: request.limits.maxCostMicros }),
       },
       providerEgress: request.providerEgress,
       providerDataPolicy: request.providerDataPolicy,
@@ -68,10 +90,12 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
       ...(request.readinessPin === undefined
         ? {}
         : { readinessPin: request.readinessPin }),
+      ...(request.modelPin === undefined ? {} : { modelPin: request.modelPin }),
       executionGrant: request.executionGrant,
       release: request.release,
       traceId: request.traceId,
       reporting: request.reporting,
+      ...(request.longSession ? { longSession: request.longSession } : {}),
       toolHostUrl: this.options.toolHostUrl,
     };
     const response = await this.request("/api/agent/runs", {
@@ -82,8 +106,8 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
       },
       body: JSON.stringify(remoteRequest),
     });
-    if (!response.ok) throw await remoteError(response);
-    return parseStart(await response.json());
+    if (!response.ok) throw await remoteRuntimeError(response);
+    return parseRemoteStart(await response.json());
   }
 
   events(runId: string, cursor: number, signal?: AbortSignal) {
@@ -99,8 +123,8 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
       `/api/agent/runs/${encodeURIComponent(runId)}`,
       { signal },
     );
-    if (!response.ok) throw await remoteError(response);
-    return parseStatus(await response.json());
+    if (!response.ok) throw await remoteRuntimeError(response);
+    return parseRemoteStatus(await response.json());
   }
 
   result(runId: string, signal?: AbortSignal) {
@@ -122,6 +146,20 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
     return this.request("/health/vlm-ready", { signal });
   }
 
+  async modelCoordinate(signal?: AbortSignal) {
+    const response = await this.request("/health/model-coordinate", { signal });
+    const value: unknown = await response.json();
+    if (!response.ok || !isRecord(value)) {
+      throw new Error("Agent Runtime Model coordinate unavailable");
+    }
+    const deploymentKey = text(value.deploymentKey);
+    const model = text(value.model);
+    if (!deploymentKey || !model) {
+      throw new Error("Agent Runtime Model coordinate invalid");
+    }
+    return { deploymentKey, model };
+  }
+
   private async request(
     path: string,
     init: RequestInit = {},
@@ -149,107 +187,6 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
   }
 }
 
-function parseStart(value: unknown): AgentRuntimeStartResponse {
-  if (!isRecord(value)) throw new Error("Agent Runtime 创建响应无效");
-  const runId = text(value.runId);
-  const status = text(value.status);
-  const eventsUrl = text(value.eventsUrl);
-  if (!runId || !status || !runStatuses.has(status) || !eventsUrl) {
-    throw new Error("Agent Runtime 创建响应字段无效");
-  }
-  return {
-    runId,
-    status: status as AgentRuntimeRunStatus,
-    eventsUrl,
-  };
-}
-
-function parseStatus(value: unknown): AgentRuntimeStatusResponse {
-  if (!isRecord(value)) throw new Error("Agent Runtime 状态响应无效");
-  const runId = text(value.runId);
-  const status = text(value.status);
-  const lastSequence = value.lastSequence;
-  if (
-    !runId ||
-    !status ||
-    !runStatuses.has(status) ||
-    !Number.isSafeInteger(lastSequence) ||
-    Number(lastSequence) < 0
-  ) {
-    throw new Error("Agent Runtime 状态字段无效");
-  }
-  const terminalEvent =
-    value.terminalEvent === undefined
-      ? undefined
-      : parseTerminalEvent(value.terminalEvent, runId);
-  const terminalStatus = ["completed", "failed", "cancelled"].includes(status);
-  if (
-    terminalStatus !== Boolean(terminalEvent) ||
-    (terminalEvent && terminalEvent.sequence !== Number(lastSequence)) ||
-    (terminalEvent && terminalEvent.type !== `run.${status}`)
-  ) {
-    throw new Error("Agent Runtime 状态与终态事件不一致");
-  }
-  return {
-    runId,
-    status: status as AgentRuntimeRunStatus,
-    lastSequence: Number(lastSequence),
-    ...(terminalEvent ? { terminalEvent } : {}),
-  };
-}
-
-const runStatuses: ReadonlySet<string> = new Set<AgentRuntimeRunStatus>([
-  "accepted",
-  "running",
-  "awaiting-approval",
-  "completed",
-  "failed",
-  "cancelled",
-]);
-
-function parseTerminalEvent(
-  value: unknown,
-  expectedRunId: string,
-): AgentRuntimeTerminalEvent {
-  if (!isRecord(value)) throw new Error("Agent Runtime 终态事件无效");
-  const type = value.type;
-  const runId = text(value.runId);
-  const sequence = value.sequence;
-  if (
-    !["run.completed", "run.failed", "run.cancelled"].includes(String(type)) ||
-    runId !== expectedRunId ||
-    !Number.isSafeInteger(sequence) ||
-    Number(sequence) <= 0
-  ) {
-    throw new Error("Agent Runtime 终态事件字段无效");
-  }
-  if (type !== "run.failed") {
-    return {
-      type: type as "run.completed" | "run.cancelled",
-      runId,
-      sequence: Number(sequence),
-    };
-  }
-  if (!isRecord(value.error)) throw new Error("Agent Runtime 失败事件无效");
-  const code = text(value.error.code);
-  const message = text(value.error.message);
-  const requestId = text(value.error.requestId);
-  if (
-    !code ||
-    !message ||
-    !requestId ||
-    typeof value.error.retryable !== "boolean"
-  ) {
-    throw new Error("Agent Runtime 失败字段无效");
-  }
-  return {
-    type,
-    runId,
-    sequence: Number(sequence),
-    error: { code, message, requestId, retryable: value.error.retryable },
-  };
-}
-
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -265,6 +202,13 @@ interface RemoteStartRunRequest extends Omit<AgentRuntimeOperation, "limits"> {
     maxOutputBytes: number;
     maxArtifacts?: number;
     maxPixelsPerArtifact?: number;
+    maxModelAttempts?: number;
+    maxToolCalls?: number;
+    maxSubagents?: number;
+    maxParallelism?: number;
+    maxInputTokens?: number;
+    maxOutputTokens?: number;
+    maxCostMicros?: number;
   };
   toolHostUrl: string;
 }
@@ -279,47 +223,3 @@ function normalizeInternalUrl(raw: string): string {
   }
   return url.toString().replace(/\/$/, "");
 }
-
-async function remoteError(response: Response): Promise<AgentRuntimeError> {
-  try {
-    const value = (await response.json()) as {
-      code?: unknown;
-      message?: unknown;
-      retryable?: unknown;
-    };
-    if (
-      typeof value.code === "string" &&
-      typeof value.message === "string" &&
-      typeof value.retryable === "boolean" &&
-      value.message.length <= 200
-    ) {
-      return new AgentRuntimeError(
-        knownRemoteCode(value.code),
-        value.message,
-        value.retryable,
-      );
-    }
-  } catch {
-    // Provider 或代理正文不可透传。
-  }
-  return new AgentRuntimeError(
-    "RUNTIME_UNAVAILABLE",
-    `Agent Runtime 请求失败（HTTP ${response.status}）`,
-    response.status >= 500,
-  );
-}
-
-function knownRemoteCode(
-  code: string,
-): ConstructorParameters<typeof AgentRuntimeError>[0] {
-  return [
-    "CAPABILITY_UNAVAILABLE",
-    "MODEL_ROUTE_UNAVAILABLE",
-    "RUN_CONFLICT",
-    "FORBIDDEN",
-    "BUDGET_EXCEEDED",
-    "INVALID_INPUT",
-  ].includes(code)
-    ? (code as ConstructorParameters<typeof AgentRuntimeError>[0])
-    : "RUNTIME_UNAVAILABLE";
-}

package/template/apps/server/src/agent/run-audit.ts

@@ -7,7 +7,7 @@ import type {
   AgentRuntimeArtifact,
   AgentRuntimeRelease,
 } from "./run-contracts.js";
-import { debugActorAuditMetadata } from "./run-debug-authorization.js";
+import { projectedActorAuditMetadata } from "./actor-projection-audit.js";
 
 export function auditAgentRun(input: {
   readonly runtime: ReturnType<typeof createServerRuntime>;
@@ -27,7 +27,7 @@ export function auditAgentRun(input: {
     target: { type: "agent-run", id: input.runId, label: input.operationKey },
     requestId: input.context.requestId,
     metadata: {
-      ...debugActorAuditMetadata(input.context.actor),
+      ...projectedActorAuditMetadata(input.context.actor),
       artifactCount: input.artifacts.length,
       artifactBytes: input.artifacts.reduce(
         (total, item) => total + item.byteSize,

package/template/apps/server/src/agent/run-authorization.test.ts

@@ -161,6 +161,33 @@ describe("Agent Run 持久授权绑定", () => {
     ).rejects.toMatchObject({ message: "Agent Run 不存在或不可访问" });
   });
 
+  test("相同幂等坐标不能切换案件 Memory Scope", async () => {
+    const store = new AgentRunAuthorizationStore(
+      new InMemoryAgentRunBindingRepository(),
+      secret,
+    );
+    const currentContext = context("actor-1", "role-1");
+    await store.issue({
+      operationKey: "business.answer",
+      releaseId: "release-1",
+      idempotencyKey: "request-case-scope",
+      input: { question: "same" },
+      authorizationSnapshot: { ...snapshot, memoryScopeCaseId: "case-1" },
+      context: currentContext,
+    });
+
+    await expect(
+      store.issue({
+        operationKey: "business.answer",
+        releaseId: "release-1",
+        idempotencyKey: "request-case-scope",
+        input: { question: "same" },
+        authorizationSnapshot: { ...snapshot, memoryScopeCaseId: "case-2" },
+        context: currentContext,
+      }),
+    ).rejects.toMatchObject({ message: "Agent Run 不存在或不可访问" });
+  });
+
   test("升级前绑定保留普通授权，但零值承诺不能通过输入验证", async () => {
     const sourceStore = new AgentRunAuthorizationStore(
       new InMemoryAgentRunBindingRepository(),

package/template/apps/server/src/agent/run-authorization.ts

@@ -11,6 +11,7 @@ import {
   commitAgentRunInput,
   sameInputCommitment,
 } from "./run-input-commitment.js";
+import { sameAgentRunDelegationSnapshot } from "./agent-run-delegation-policy.js";
 
 export interface AgentExecutionAuthorization {
   readonly binding: AgentRunBinding;
@@ -33,6 +34,7 @@ export class AgentRunAuthorizationStore {
     operationKey: string;
     releaseId: string;
     idempotencyKey: string;
+    sessionId?: string;
     input: ModuleAiJsonValue;
     authorizationSnapshot: AgentRunAuthorizationSnapshot;
     context: RequestGuardContext;
@@ -44,6 +46,7 @@ export class AgentRunAuthorizationStore {
       input.context.actor.id,
       input.operationKey,
       input.idempotencyKey,
+      ...(input.sessionId ? [`session:${input.sessionId}`] : []),
     ].join("\u0000");
     const idempotencyHash = this.hmac(`idempotency\u0000${coordinate}`);
     const token = `grant_${this.hmac(`token\u0000${coordinate}`)}`;
@@ -51,6 +54,7 @@ export class AgentRunAuthorizationStore {
     const candidate: AgentRunBinding = {
       bindingId: `binding_${idempotencyHash.slice(0, 40)}`,
       operationKey: input.operationKey,
+      ...(input.sessionId ? { sessionId: input.sessionId } : {}),
       actorId: input.context.actor.id,
       idempotencyHash,
       tokenHash,
@@ -129,6 +133,26 @@ export class AgentRunAuthorizationStore {
     return binding;
   }
 
+  async findRunByIdempotency(input: {
+    readonly actorId: string;
+    readonly operationKey: string;
+    readonly idempotencyKey: string;
+    readonly sessionId?: string;
+  }) {
+    const coordinate = [
+      input.actorId,
+      input.operationKey,
+      input.idempotencyKey,
+      ...(input.sessionId ? [`session:${input.sessionId}`] : []),
+    ].join("\u0000");
+    const binding = await this.repository.findByIdempotencyHash(
+      this.hmac(`idempotency\u0000${coordinate}`),
+    );
+    return binding?.expiresAt && binding.expiresAt > this.now()
+      ? binding.runId
+      : undefined;
+  }
+
   async verifyRunInput(
     operationKey: string,
     runId: string,
@@ -147,6 +171,35 @@ export class AgentRunAuthorizationStore {
     return binding;
   }
 
+  async currentCaseIdForRun(
+    runId: string,
+    sessionId: string,
+    context: RequestGuardContext,
+  ) {
+    const binding = await this.repository.findByRunId(runId);
+    const scope = captureAuthorizationScope(context.actor.scopeContext);
+    if (
+      !binding ||
+      binding.expiresAt <= this.now() ||
+      binding.sessionId !== sessionId ||
+      binding.actorId !== context.actor.id ||
+      binding.scopeHash !== scope.hash
+    ) {
+      throw new AgentRunAuthorizationError();
+    }
+    return binding.authorizationSnapshot.memoryScopeCaseId;
+  }
+
+  async modelPinForRun(runId: string) {
+    const binding = await this.repository.findByRunId(runId);
+    if (!binding || binding.expiresAt <= this.now()) {
+      throw new AgentRunAuthorizationError();
+    }
+    return binding.authorizationSnapshot.modelPin
+      ? structuredClone(binding.authorizationSnapshot.modelPin)
+      : undefined;
+  }
+
   assertCurrentScope(
     binding: AgentRunBinding,
     context: RequestGuardContext,
@@ -179,6 +232,7 @@ function sameAuthorization(
   return (
     existing.bindingId === candidate.bindingId &&
     existing.operationKey === candidate.operationKey &&
+    existing.sessionId === candidate.sessionId &&
     existing.actorId === candidate.actorId &&
     existing.tokenHash === candidate.tokenHash &&
     existing.inputDigestCommitment === candidate.inputDigestCommitment &&
@@ -199,10 +253,15 @@ function sameSnapshot(
     left.permissionKey === right.permissionKey &&
     left.featureKey === right.featureKey &&
     left.toolNetworkMode === right.toolNetworkMode &&
+    left.memoryScopeCaseId === right.memoryScopeCaseId &&
+    left.runtimeBudgetDigest === right.runtimeBudgetDigest &&
+    left.modelPin?.deploymentKey === right.modelPin?.deploymentKey &&
+    left.modelPin?.model === right.modelPin?.model &&
     left.allowedToolKeys.length === right.allowedToolKeys.length &&
     left.allowedToolKeys.every(
       (key, index) => key === right.allowedToolKeys[index],
-    )
+    ) &&
+    sameAgentRunDelegationSnapshot(left.delegation, right.delegation)
   );
 }
 

package/template/apps/server/src/agent/run-binding-repository.ts

@@ -6,6 +6,7 @@ import type {
 export interface AgentRunBinding {
   readonly bindingId: string;
   readonly runId?: string;
+  readonly sessionId?: string;
   readonly operationKey: string;
   readonly actorId: string;
   readonly idempotencyHash: string;
@@ -28,6 +29,7 @@ export interface AgentRunBindingRepository {
     boundAt: number,
   ): Promise<AgentRunBinding | undefined>;
   findByRunId(runId: string): Promise<AgentRunBinding | undefined>;
+  findByIdempotencyHash(hash: string): Promise<AgentRunBinding | undefined>;
   findByTokenHash(tokenHash: string): Promise<AgentRunBinding | undefined>;
   deleteUnbound(bindingId: string): Promise<void>;
   prune(expiredBefore: number): Promise<void>;
@@ -69,6 +71,13 @@ export class InMemoryAgentRunBindingRepository implements AgentRunBindingReposit
     return found ? clone(found) : undefined;
   }
 
+  async findByIdempotencyHash(hash: string) {
+    const found = [...this.#bindings.values()].find(
+      ({ idempotencyHash }) => idempotencyHash === hash,
+    );
+    return found ? clone(found) : undefined;
+  }
+
   async findByTokenHash(tokenHash: string) {
     const found = [...this.#bindings.values()].find(
       (binding) => binding.tokenHash === tokenHash,

package/template/apps/server/src/agent/run-browser-authorization.ts

@@ -0,0 +1,79 @@
+import { evaluateAccessGuards } from "../access-guards.js";
+import type { RequestGuardContext } from "../guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import {
+  AgentRunAuthorizationError,
+  type AgentRunAuthorizationStore,
+} from "./run-authorization.js";
+import { inaccessibleRun } from "./run-errors.js";
+import type { RegisteredOperation } from "./run-operation-registry.js";
+import type { AgentRunSessionLinkPort } from "./session-run-link.js";
+import {
+  type AgentRunSessionBindingAuthorizer,
+  authorizeAgentRunSessionWrite,
+} from "./run-session-authorization.js";
+
+type GuardRuntime = Pick<
+  ReturnType<typeof createServerRuntime>,
+  "recordDecisions" | "resolveFeature"
+>;
+
+export async function authorizeAgentRunBrowser(input: {
+  readonly operations: ReadonlyMap<string, RegisteredOperation>;
+  readonly authorizations: AgentRunAuthorizationStore;
+  readonly runtime: GuardRuntime;
+  readonly operationKey: string;
+  readonly runId: string;
+  readonly context: RequestGuardContext;
+}) {
+  const operation = input.operations.get(input.operationKey);
+  if (!operation || operation.definition.kind !== "agent") {
+    throw inaccessibleRun();
+  }
+  let binding: Awaited<ReturnType<AgentRunAuthorizationStore["authorizeBrowser"]>>;
+  try {
+    binding = await input.authorizations.authorizeBrowser(
+      input.operationKey,
+      input.runId,
+      input.context,
+    );
+  } catch (error) {
+    if (error instanceof AgentRunAuthorizationError) throw inaccessibleRun();
+    throw error;
+  }
+  const decision = await evaluateAccessGuards(input.runtime, input.context, {
+    permission: { permissionKey: operation.definition.permissionKey },
+    feature: operation.feature,
+  });
+  if (!decision.decision.allowed) throw inaccessibleRun();
+  return { operation, binding };
+}
+
+export async function authorizeAgentRunMutation(input: {
+  readonly operations: ReadonlyMap<string, RegisteredOperation>;
+  readonly authorizations: AgentRunAuthorizationStore;
+  readonly runtime: GuardRuntime;
+  readonly operationKey: string;
+  readonly runId: string;
+  readonly context: RequestGuardContext;
+  readonly requestedSessionId?: string;
+  readonly sessionAuthorizer: AgentRunSessionBindingAuthorizer;
+  readonly sessionLinks?: AgentRunSessionLinkPort;
+}) {
+  const authorized = await authorizeAgentRunBrowser(input);
+  if (
+    input.requestedSessionId &&
+    authorized.binding.sessionId !== input.requestedSessionId
+  ) throw inaccessibleRun();
+  const sessionId = authorized.binding.sessionId;
+  if (sessionId) {
+    await authorizeAgentRunSessionWrite({
+      authorizer: input.sessionAuthorizer,
+      links: input.sessionLinks,
+      sessionId,
+      runId: input.runId,
+      context: input.context,
+    });
+  }
+  return { operation: authorized.operation, sessionId };
+}

package/template/apps/server/src/agent/run-contracts.ts

@@ -34,12 +34,21 @@ export interface AgentRuntimeOperation {
     maxOutputBytes: number;
     maxArtifacts?: number;
     maxPixelsPerArtifact?: number;
+    maxModelAttempts?: number;
+    maxToolCalls?: number;
+    maxSubagents?: number;
+    maxParallelism?: number;
+    maxInputTokens?: number;
+    maxOutputTokens?: number;
+    maxCostMicros?: number;
   };
   providerEgress: AiProviderEgressPolicy;
   providerDataPolicy: AiProviderDataPolicy;
   toolNetworkPolicy: AiToolNetworkPolicy;
   /** Host-attested VLM deployment facts; never supplied by a business Module. */
   readinessPin?: AiRuntimeDeploymentV1;
+  /** Workflow model call only: server-frozen deployment/model coordinate. */
+  modelPin?: { readonly deploymentKey: string; readonly model: string };
   executionGrant: string;
   release: AgentRuntimeRelease;
   traceId: string;
@@ -48,6 +57,16 @@ export interface AgentRuntimeOperation {
     actorType: "anonymous" | "user" | "service";
     departmentId?: string;
   };
+  longSession?: {
+    readonly sessionId: string;
+    readonly turnId: string;
+    readonly caseId?: string;
+    readonly sources: readonly {
+      readonly moduleKey: string;
+      readonly kind: string;
+      readonly id: string;
+    }[];
+  };
 }
 
 export interface AgentRuntimeRelease {
@@ -128,6 +147,10 @@ export interface AgentRuntimePort {
     signal?: AbortSignal,
   ): Promise<Response>;
   health(signal?: AbortSignal): Promise<Response>;
+  modelCoordinate?(signal?: AbortSignal): Promise<{
+    readonly deploymentKey: string;
+    readonly model: string;
+  }>;
 }
 
 export class AgentRuntimeError extends Error {

package/template/apps/server/src/agent/run-facade.test-support.ts

@@ -10,8 +10,9 @@ import { createTestRunAuthorizationStore } from "./run-authorization.test-suppor
 
 export async function createRunFacadeFixture(
   permissionKeys: string[] = ["business.ai.execute", "business.records.read"],
+  options: { workflowOnly?: boolean } = {},
 ) {
-  const module = runFacadeManifest();
+  const module = runFacadeManifest(options.workflowOnly);
   const prepared: unknown[] = [];
   const hosts = await initializeModuleHosts({
     modules: [module],
@@ -90,7 +91,7 @@ export function guardContext(permissionKeys: string[]) {
   );
 }
 
-export function runFacadeManifest(): ModuleManifest {
+export function runFacadeManifest(workflowOnly = false): ModuleManifest {
   return {
     name: "business",
     version: "0.1.0",
@@ -144,13 +145,13 @@ export function runFacadeManifest(): ModuleManifest {
         },
       },
     ],
-    aiOperations: [agentOperation()],
+    aiOperations: [agentOperation(workflowOnly)],
     providers: [],
     auditActions: ["business.ai.execute", "business.records.read"],
   };
 }
 
-function agentOperation() {
+function agentOperation(workflowOnly: boolean) {
   return {
     key: "business.answer",
     kind: "agent" as const,
@@ -187,6 +188,18 @@ function agentOperation() {
         },
       ],
     },
+    ...(workflowOnly
+      ? {
+          clientExecution: {
+            mode: "governed-session" as const,
+            launchAuthority: "workflow-artifact" as const,
+            maxSteps: 4,
+            maxRequestBytes: 4096,
+            maxResponseBytes: 4096,
+            maxConcurrentRequests: 1,
+          },
+        }
+      : {}),
     toolNetworkPolicy: { mode: "forbidden" as const },
     limits: {
       maxDurationSeconds: 60,

package/template/apps/server/src/agent/run-facade.test.ts

@@ -96,6 +96,22 @@ describe("Guarded Agent Run facade", () => {
     expect(fixture.prepared).toEqual([]);
   });
 
+  test("workflow-only Client Operation 不允许普通 Agent Run 直接启动", async () => {
+    const fixture = await createRunFacadeFixture(undefined, {
+      workflowOnly: true,
+    });
+    await expect(
+      fixture.facade.start(
+        "business.answer",
+        { question: "绕过 Workflow" },
+        "request-workflow-bypass",
+        fixture.context,
+      ),
+    ).rejects.toMatchObject({ code: "OPERATION_NOT_FOUND", status: 404 });
+    expect(fixture.remote.started).toEqual([]);
+    expect(fixture.prepared).toEqual([]);
+  });
+
   test("恢复时权限已收回会返回不泄露 Run 存在性的 404", async () => {
     const fixture = await createRunFacadeFixture();
     await fixture.facade.start(