create-windy 0.6.12 → 0.6.15

package/template/apps/server/src/agent/agent-run-delegation-policy.ts

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+import type {
+  AgentDelegationGrant,
+  AgentRunAuthorizationSnapshot,
+  AgentWorkflowBudget,
+} from "@southwind-ai/shared";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+import { canonicalJson } from "../agent-workflow/canonical-json.js";
+import type { RequestGuardContext } from "../guards.js";
+import type { RegisteredOperation } from "./run-operation-registry.js";
+
+export interface AgentRunDelegationPolicy {
+  readonly grant: AgentDelegationGrant;
+}
+
+export function resolveAgentRunExecutionPolicy(
+  operation: RegisteredOperation,
+  context: RequestGuardContext,
+  delegation?: AgentRunDelegationPolicy,
+  runtimeBudget?: AgentWorkflowBudget,
+  modelPin?: { readonly deploymentKey: string; readonly model: string },
+) {
+  if (!delegation) {
+    return {
+      allowedTools: operation.tools,
+      requiredCapabilities: operation.definition.requiredCapabilities,
+      allowedToolKeys: [...operation.definition.allowedToolKeys],
+      authorizationDelegation: undefined,
+      workflowBudget: runtimeBudget
+        ? structuredClone(runtimeBudget)
+        : undefined,
+      budgetDigest: runtimeBudget ? digestValue(runtimeBudget) : undefined,
+      modelPin,
+    };
+  }
+  const ceiling = delegation.grant.capabilityCeiling;
+  const currentScope = `sha256:${
+    captureAuthorizationScope(context.actor.scopeContext).hash
+  }`;
+  const operationTools = new Map(
+    operation.tools.map((tool) => [tool.key, tool]),
+  );
+  const allowedToolKeys = unique(ceiling.allowedToolKeys);
+  if (
+    delegation.grant.status !== "created" &&
+    delegation.grant.status !== "running"
+  ) {
+    throw new Error("DELEGATED_AGENT_GRANT_TERMINAL");
+  }
+  if (
+    currentScope !== ceiling.scopeDigest ||
+    operation.definition.requiredCapabilities.length !== 1 ||
+    operation.definition.requiredCapabilities[0] !== ceiling.capabilityKey ||
+    !ceiling.requiredFeatureKeys.includes(operation.definition.featureKey) ||
+    !ceiling.requiredPermissionKeys.includes(
+      operation.definition.permissionKey,
+    ) ||
+    allowedToolKeys.some(
+      (key) =>
+        !operation.definition.allowedToolKeys.includes(key) ||
+        !operationTools.has(key),
+    ) ||
+    !digest(ceiling.policyDigest) ||
+    !digest(ceiling.scopePolicyDigest) ||
+    !ceiling.workspaceId.trim()
+  ) {
+    throw new Error("DELEGATED_AGENT_GRANT_EXPANSION");
+  }
+  const authorizationDelegation: NonNullable<
+    AgentRunAuthorizationSnapshot["delegation"]
+  > = {
+    delegationId: delegation.grant.delegationId,
+    policyDigest: ceiling.policyDigest,
+    budgetDigest: digestValue(delegation.grant.budget),
+    workspaceId: ceiling.workspaceId,
+    workspacePolicyKey: ceiling.workspacePolicyKey,
+    scopeDigest: ceiling.scopeDigest,
+    scopePolicyDigest: ceiling.scopePolicyDigest,
+    capabilityKey: ceiling.capabilityKey,
+    requiredFeatureKeys: [...ceiling.requiredFeatureKeys],
+    requiredPermissionKeys: [...ceiling.requiredPermissionKeys],
+  };
+  return {
+    allowedTools: allowedToolKeys.map((key) => operationTools.get(key)!),
+    requiredCapabilities: [ceiling.capabilityKey],
+    allowedToolKeys,
+    authorizationDelegation,
+    workflowBudget: structuredClone(delegation.grant.budget),
+    budgetDigest: digestValue(delegation.grant.budget),
+    modelPin,
+  };
+}
+
+export function sameAgentRunDelegationSnapshot(
+  left: AgentRunAuthorizationSnapshot["delegation"],
+  right: AgentRunAuthorizationSnapshot["delegation"],
+) {
+  return canonicalJson(left ?? null) === canonicalJson(right ?? null);
+}
+
+function unique(values: readonly string[]) {
+  const result = [...new Set(values)].sort();
+  if (result.length !== values.length || result.some((key) => !key.trim())) {
+    throw new Error("DELEGATED_AGENT_TOOL_CEILING_INVALID");
+  }
+  return result;
+}
+
+function digest(value: string) {
+  return /^sha256:[a-f0-9]{64}$/.test(value);
+}
+
+function digestValue(value: unknown) {
+  return `sha256:${createHash("sha256").update(canonicalJson(value)).digest("hex")}`;
+}

package/template/apps/server/src/agent/agent-session-bootstrap.ts

@@ -0,0 +1,23 @@
+import type { InitializedModuleHosts } from "../module-host.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/routes.js";
+import { AgentSessionFacadeV1 } from "./agent-session-facade.js";
+import { AgentSessionIdCodecV1 } from "./agent-session-id.js";
+import { registerAgentSessionRoutesV1 } from "./agent-session-routes.js";
+
+export function registerAgentSessions(input: {
+  app: RouteApp;
+  hosts: InitializedModuleHosts;
+  runtime: ReturnType<typeof createServerRuntime>;
+  secret: string;
+}) {
+  if (!input.hosts.agentSessionProviders.length) return;
+  registerAgentSessionRoutesV1(
+    input.app,
+    new AgentSessionFacadeV1(
+      input.hosts,
+      input.runtime,
+      new AgentSessionIdCodecV1(input.secret),
+    ),
+  );
+}

package/template/apps/server/src/agent/{debug-session-facade-provider-failure.test.ts → agent-session-facade-provider-failure.test.ts}

@@ -1,26 +1,22 @@
 import { describe, expect, test } from "bun:test";
 import type { ModuleManifest } from "@southwind-ai/modules";
 import {
-  MODULE_DEBUG_SESSION_SCHEMA_VERSION,
-  type ModuleDebugSessionProviderV1,
+  MODULE_AGENT_SESSION_SCHEMA_VERSION,
+  type ModuleAgentSessionProviderV1,
 } from "@southwind-ai/server-sdk";
 import { featureKey } from "@southwind-ai/shared";
-import {
-  bindModuleUserProjection,
-  createRequestGuardContext,
-  type RequestActor,
-} from "../guards.js";
+import { createRequestGuardContext, type RequestActor } from "../guards.js";
 import type { InitializedModuleHosts } from "../module-host.js";
 import { manifest } from "../module-host/test-fixtures.js";
 import { createServerRuntime } from "../runtime.js";
-import { DebugSessionFacadeV1 } from "./debug-session-facade.js";
-import { DebugSessionIdCodecV1 } from "./debug-session-id.js";
+import { AgentSessionFacadeV1 } from "./agent-session-facade.js";
+import { AgentSessionIdCodecV1 } from "./agent-session-id.js";
 
 const OPERATION_KEY = "known.copilot.global";
 const SOURCE_ID = "conversation-sensitive-42";
 const SECRET_FAILURE = `provider failed for ${SOURCE_ID}`;
 
-describe("ADK 调试会话 Provider 故障隔离", () => {
+describe("Agent 会话 Provider 故障隔离", () => {
   test("一个 Provider 故障时 fail closed，避免把 partial 伪装成完整列表", async () => {
     const failing = provider("known.failing-history", {
       list: async () => {
@@ -53,11 +49,10 @@ describe("ADK 调试会话 Provider 故障隔离", () => {
       action: "known.copilot.history.read",
       outcome: "failure",
       target: {
-        type: "agent-debug-session-provider",
+        type: "agent-session-provider",
         id: "known.failing-history",
       },
       metadata: {
-        debugDataActorId: "user_dev_admin",
         mode: "list",
         phase: "list",
         failureCode: "PROVIDER_UNAVAILABLE",
@@ -130,7 +125,7 @@ describe("ADK 调试会话 Provider 故障隔离", () => {
   });
 });
 
-function failingProvider(key: string): ModuleDebugSessionProviderV1 {
+function failingProvider(key: string): ModuleAgentSessionProviderV1 {
   return provider(key, {
     list: async () => {
       throw new Error(SECRET_FAILURE);
@@ -141,10 +136,10 @@ function failingProvider(key: string): ModuleDebugSessionProviderV1 {
 
 function provider(
   key: string,
-  methods: Pick<ModuleDebugSessionProviderV1, "list" | "get">,
-): ModuleDebugSessionProviderV1 {
+  methods: Pick<ModuleAgentSessionProviderV1, "list" | "get">,
+): ModuleAgentSessionProviderV1 {
   return {
-    schemaVersion: MODULE_DEBUG_SESSION_SCHEMA_VERSION,
+    schemaVersion: MODULE_AGENT_SESSION_SCHEMA_VERSION,
     key,
     operationKeys: [OPERATION_KEY],
     featureKey: "known.copilot",
@@ -154,10 +149,10 @@ function provider(
   };
 }
 
-function createFixture(providers: readonly ModuleDebugSessionProviderV1[]) {
-  const module = debugManifest();
+function createFixture(providers: readonly ModuleAgentSessionProviderV1[]) {
+  const module = agentManifest();
   const hosts = {
-    debugSessionProviders: providers.map((provider) => ({
+    agentSessionProviders: providers.map((provider) => ({
       moduleName: "known",
       provider,
     })),
@@ -173,25 +168,21 @@ function createFixture(providers: readonly ModuleDebugSessionProviderV1[]) {
       licenseResolver: { resolve: () => ({ status: "valid" }) },
     },
   );
-  const runtime = {
-    ...base,
-    agentDebugOperationForActor: (actorId: string) =>
-      actorId === "service_adk_debug" ? OPERATION_KEY : undefined,
-  };
+  const runtime = base;
   const context = createRequestGuardContext(
-    new Request("http://localhost/api/agent/debug/sessions/v1"),
+    new Request("http://localhost/api/agent/sessions/v1"),
     {
-      resolveActor: () => bindModuleUserProjection(actor(), "user_dev_admin"),
+      resolveActor: () => actor(),
       resolveLicense: () => ({ status: "valid" }),
       licenseEnforced: false,
     },
   );
   return {
     context,
-    facade: new DebugSessionFacadeV1(
+    facade: new AgentSessionFacadeV1(
       hosts,
       runtime,
-      new DebugSessionIdCodecV1("test-secret-012345678901234567890123456789"),
+      new AgentSessionIdCodecV1("test-secret-012345678901234567890123456789"),
     ),
     runtime,
   };
@@ -199,10 +190,10 @@ function createFixture(providers: readonly ModuleDebugSessionProviderV1[]) {
 
 function actor(): RequestActor {
   return {
-    id: "service_adk_debug",
-    type: "service",
-    name: "ADK Debug",
-    roleCodes: ["adk-debug"],
+    id: "user_dev_admin",
+    type: "user",
+    name: "开发管理员",
+    roleCodes: ["analyst"],
     permissionKeys: ["known.copilot.execute"],
   };
 }
@@ -221,7 +212,7 @@ function signal(): AbortSignal {
   return new AbortController().signal;
 }
 
-function debugManifest(): ModuleManifest {
+function agentManifest(): ModuleManifest {
   return manifest("known", {
     features: [
       {

package/template/apps/server/src/agent/{debug-session-facade.test.ts → agent-session-facade.test.ts}

@@ -1,29 +1,25 @@
 import { describe, expect, test } from "bun:test";
 import type { ModuleManifest } from "@southwind-ai/modules";
 import {
-  MODULE_DEBUG_SESSION_SCHEMA_VERSION,
-  type ModuleDebugSessionProviderV1,
+  MODULE_AGENT_SESSION_SCHEMA_VERSION,
+  type ModuleAgentSessionProviderV1,
 } from "@southwind-ai/server-sdk";
 import { featureKey } from "@southwind-ai/shared";
-import {
-  bindModuleUserProjection,
-  createRequestGuardContext,
-  type RequestActor,
-} from "../guards.js";
+import { createRequestGuardContext, type RequestActor } from "../guards.js";
 import { initializeModuleHosts } from "../module-host.js";
 import { manifest } from "../module-host/test-fixtures.js";
 import { createServerRuntime } from "../runtime.js";
 import {
-  DebugSessionFacadeError,
-  DebugSessionFacadeV1,
-} from "./debug-session-facade.js";
-import { DebugSessionIdCodecV1 } from "./debug-session-id.js";
+  AgentSessionFacadeError,
+  AgentSessionFacadeV1,
+} from "./agent-session-facade.js";
+import { AgentSessionIdCodecV1 } from "./agent-session-id.js";
 
 const OPERATION_KEY = "known.copilot.global";
 const SOURCE_ID = "conversation-private-42";
 
-describe("ADK 调试会话 V1 facade", () => {
-  test("投影真实业务用户并只返回不透明 ID 与有界通用 DTO", async () => {
+describe("Agent 会话 V1 facade", () => {
+  test("使用当前登录用户并只返回不透明 ID 与有界通用 DTO", async () => {
     const seenActors: string[] = [];
     const fixture = await createFixture({
       list: async ({ actor }) => {
@@ -54,7 +50,7 @@ describe("ADK 调试会话 V1 facade", () => {
 
     const listed = await fixture.facade.list(fixture.context, signal());
     const id = listed.sessions[0]?.id;
-    expect(id).toMatch(/^wdbg1_/);
+    expect(id).toMatch(/^wags1_/);
     expect(JSON.stringify(listed)).not.toContain(SOURCE_ID);
     expect(listed.sessions[0]).toMatchObject({
       title: "历史研判",
@@ -81,9 +77,9 @@ describe("ADK 调试会话 V1 facade", () => {
       .filter(({ action }) => action === "known.copilot.history.read");
     expect(audits).toHaveLength(2);
     expect(audits[0]?.metadata).toMatchObject({
-      debugDataActorId: "user_dev_admin",
       mode: "list",
     });
+    expect(audits[0]?.actor.id).toBe("user_dev_admin");
   });
 
   test("每次详情读取重新 list 授权，未知和非法 ID 同形安全失败", async () => {
@@ -154,7 +150,7 @@ describe("ADK 调试会话 V1 facade", () => {
     });
   });
 
-  test("非调试身份、缺少权限与 Provider 越界响应均 fail closed", async () => {
+  test("缺少权限与 Provider 越界响应均 fail closed", async () => {
     const fixture = await createFixture({
       list: async () => ({ sessions: [summary()], truncated: false }),
       get: async () => ({
@@ -186,12 +182,12 @@ describe("ADK 调试会话 V1 facade", () => {
     );
     await expect(
       forbidden.facade.list(forbidden.context, signal()),
-    ).rejects.toBeInstanceOf(DebugSessionFacadeError);
+    ).rejects.toBeInstanceOf(AgentSessionFacadeError);
 
-    const ordinaryContext = createContext(
-      { ...actor(), id: "user_ordinary", type: "user" },
-      false,
-    );
+    const ordinaryContext = createContext({
+      ...actor([]),
+      id: "user_ordinary",
+    });
     await expect(
       fixture.facade.list(ordinaryContext, signal()),
     ).rejects.toMatchObject({ code: "FORBIDDEN", status: 403 });
@@ -199,12 +195,12 @@ describe("ADK 调试会话 V1 facade", () => {
 });
 
 async function createFixture(
-  methods: Pick<ModuleDebugSessionProviderV1, "list" | "get">,
+  methods: Pick<ModuleAgentSessionProviderV1, "list" | "get">,
   permissionKeys = ["known.copilot.execute"],
 ) {
-  const module = debugManifest();
-  const provider: ModuleDebugSessionProviderV1 = {
-    schemaVersion: MODULE_DEBUG_SESSION_SCHEMA_VERSION,
+  const module = agentManifest();
+  const provider: ModuleAgentSessionProviderV1 = {
+    schemaVersion: MODULE_AGENT_SESSION_SCHEMA_VERSION,
     key: "known.copilot.history",
     operationKeys: [OPERATION_KEY],
     featureKey: "known.copilot",
@@ -218,7 +214,7 @@ async function createFixture(
       {
         manifest: module,
         setup(host) {
-          host.registerDebugSessionProviders([provider]);
+          host.registerAgentSessionProviders([provider]);
         },
       },
     ],
@@ -230,31 +226,24 @@ async function createFixture(
       licenseResolver: { resolve: () => ({ status: "valid" }) },
     },
   );
-  const runtime = {
-    ...base,
-    agentDebugOperationForActor: (actorId: string) =>
-      actorId === "service_adk_debug" ? OPERATION_KEY : undefined,
-  };
-  const context = createContext(actor(permissionKeys), true);
+  const runtime = base;
+  const context = createContext(actor(permissionKeys));
   return {
     context,
-    facade: new DebugSessionFacadeV1(
+    facade: new AgentSessionFacadeV1(
       hosts,
       runtime,
-      new DebugSessionIdCodecV1("test-secret-012345678901234567890123456789"),
+      new AgentSessionIdCodecV1("test-secret-012345678901234567890123456789"),
     ),
     runtime,
   };
 }
 
-function createContext(value: RequestActor, projected: boolean) {
-  const actorValue = projected
-    ? bindModuleUserProjection(value, "user_dev_admin")
-    : value;
+function createContext(value: RequestActor) {
   return createRequestGuardContext(
-    new Request("http://localhost/api/agent/debug/sessions/v1"),
+    new Request("http://localhost/api/agent/sessions/v1"),
     {
-      resolveActor: () => actorValue,
+      resolveActor: () => value,
       resolveLicense: () => ({ status: "valid" }),
       licenseEnforced: false,
     },
@@ -265,10 +254,10 @@ function actor(
   permissionKeys: string[] = ["known.copilot.execute"],
 ): RequestActor {
   return {
-    id: "service_adk_debug",
-    type: "service",
-    name: "ADK Debug",
-    roleCodes: ["adk-debug"],
+    id: "user_dev_admin",
+    type: "user",
+    name: "开发管理员",
+    roleCodes: ["analyst"],
     permissionKeys,
   };
 }
@@ -287,7 +276,7 @@ function signal(): AbortSignal {
   return new AbortController().signal;
 }
 
-function debugManifest(): ModuleManifest {
+function agentManifest(): ModuleManifest {
   return manifest("known", {
     features: [
       {