create-windy 0.6.18 → 0.6.20

package/template/apps/agent-server/src/southwind_agent_server/runtime_compatibility.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+
+SCHEMA_VERSION = 1
+PROTOCOL_VERSION = 1
+RUNTIME_KIND = "agent"
+COMPATIBILITY_PATH = "/api/agent/runtime/compatibility"
+PROTOCOL_HEADER = "X-Windy-Agent-Runtime-Protocol"
+OFFER_DIGEST_HEADER = "X-Windy-Agent-Runtime-Offer-Digest"
+TOOL_CALLBACK_CONTRACT_VERSION = 1
+TOOL_CALLBACK_AUTHENTICATION = "windy-internal-bearer-v1"
+PROTOCOL_FEATURES = (
+    "canonical-sse-replay.v1",
+    "execution-grant-forwarding.v1",
+    "operation-release-attestation.v1",
+    "run-cancel.v1",
+    "run-lifecycle.v1",
+    "runtime-reporting.v1",
+    "tool-callback.v1",
+)
+
+_STABLE_VALUE = re.compile(r"^[a-z0-9][a-z0-9._-]{0,159}$")
+
+
+class RuntimeCompatibilityError(ValueError):
+    pass
+
+
+def runtime_compatibility_offer(engine_id: str) -> dict[str, object]:
+    if not _STABLE_VALUE.fullmatch(engine_id):
+        raise RuntimeCompatibilityError("Agent Runtime engineId invalid")
+    protocol_versions = [PROTOCOL_VERSION]
+    protocol_features = sorted(PROTOCOL_FEATURES)
+    tool_callback: dict[str, object] = {
+        "contractVersion": TOOL_CALLBACK_CONTRACT_VERSION,
+        "authentication": TOOL_CALLBACK_AUTHENTICATION,
+    }
+    release_digest = _digest(
+        {
+            "runtimeKind": RUNTIME_KIND,
+            "engineId": engine_id,
+            "protocolVersions": protocol_versions,
+        }
+    )
+    capabilities_digest = _digest(
+        {
+            "protocolFeatures": protocol_features,
+            "toolCallback": tool_callback,
+        }
+    )
+    body: dict[str, object] = {
+        "schemaVersion": SCHEMA_VERSION,
+        "runtimeKind": RUNTIME_KIND,
+        "engineId": engine_id,
+        "protocolVersions": protocol_versions,
+        "protocolFeatures": protocol_features,
+        "toolCallback": tool_callback,
+        "releaseDigest": release_digest,
+        "capabilitiesDigest": capabilities_digest,
+    }
+    return {**body, "offerDigest": _digest(body)}
+
+
+def validate_runtime_compatibility_pin(
+    protocol_header: str | None,
+    offer_digest_header: str | None,
+    engine_id: str,
+) -> None:
+    if protocol_header is None and offer_digest_header is None:
+        return
+    if protocol_header is None or offer_digest_header is None:
+        raise RuntimeCompatibilityError("Agent Runtime compatibility pin incomplete")
+    if protocol_header != str(PROTOCOL_VERSION):
+        raise RuntimeCompatibilityError("Agent Runtime protocol unsupported")
+    expected = runtime_compatibility_offer(engine_id)["offerDigest"]
+    if offer_digest_header != expected:
+        raise RuntimeCompatibilityError("Agent Runtime offer digest mismatch")
+
+
+def _digest(value: object) -> str:
+    encoded = json.dumps(
+        value,
+        ensure_ascii=False,
+        separators=(",", ":"),
+    ).encode()
+    return f"sha256:{hashlib.sha256(encoded).hexdigest()}"

package/template/apps/agent-server/tests/test_runtime_compatibility.py

@@ -0,0 +1,119 @@
+from __future__ import annotations
+
+import json
+from collections.abc import AsyncIterator
+from pathlib import Path
+from typing import cast
+
+import httpx
+import pytest
+
+from southwind_agent_server.app import create_app
+from southwind_agent_server.deterministic import DeterministicEngineAdapter
+from southwind_agent_server.runtime_compatibility import (
+    runtime_compatibility_offer,
+)
+
+TOKEN = "runtime-compatibility-test-token"
+
+
+@pytest.fixture
+async def client() -> AsyncIterator[httpx.AsyncClient]:
+    app = create_app(DeterministicEngineAdapter(), internal_token=TOKEN)
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app),
+        base_url="http://agent.test",
+    ) as value:
+        yield value
+
+
+async def test_compatibility_offer_is_authenticated_and_matches_public_fixture(
+    client: httpx.AsyncClient,
+) -> None:
+    denied = await client.get("/api/agent/runtime/compatibility")
+    allowed = await client.get(
+        "/api/agent/runtime/compatibility",
+        headers={"Authorization": f"Bearer {TOKEN}"},
+    )
+
+    assert denied.status_code == 403
+    assert allowed.status_code == 200
+    assert allowed.json() == public_fixture()
+
+
+async def test_start_accepts_legacy_without_pin(
+    client: httpx.AsyncClient,
+) -> None:
+    legacy = await start(client, "legacy-pin")
+
+    assert legacy.status_code == 200
+
+
+async def test_start_accepts_complete_matching_pin(
+    client: httpx.AsyncClient,
+) -> None:
+    offer = runtime_compatibility_offer("windy.direct.openai-compatible.v1")
+    pinned = await start(
+        client,
+        "current-pin",
+        {
+            "X-Windy-Agent-Runtime-Protocol": "1",
+            "X-Windy-Agent-Runtime-Offer-Digest": str(offer["offerDigest"]),
+        },
+    )
+
+    assert pinned.status_code == 200
+
+
+@pytest.mark.parametrize(
+    "headers",
+    [
+        {"X-Windy-Agent-Runtime-Protocol": "1"},
+        {"X-Windy-Agent-Runtime-Offer-Digest": "sha256:" + "0" * 64},
+        {
+            "X-Windy-Agent-Runtime-Protocol": "2",
+            "X-Windy-Agent-Runtime-Offer-Digest": "sha256:" + "0" * 64,
+        },
+        {
+            "X-Windy-Agent-Runtime-Protocol": "1",
+            "X-Windy-Agent-Runtime-Offer-Digest": "sha256:" + "0" * 64,
+        },
+    ],
+)
+async def test_start_rejects_partial_or_incompatible_pin_before_admission(
+    client: httpx.AsyncClient,
+    headers: dict[str, str],
+) -> None:
+    response = await start(client, "rejected-pin", headers)
+
+    assert response.status_code == 409
+    assert response.json() == {
+        "code": "RUNTIME_UNAVAILABLE",
+        "message": "Agent Runtime compatibility pin 不匹配",
+        "requestId": response.json()["requestId"],
+        "retryable": False,
+    }
+
+
+async def start(
+    client: httpx.AsyncClient,
+    key: str,
+    headers: dict[str, str] | None = None,
+) -> httpx.Response:
+    return await client.post(
+        "/api/agent/runs",
+        headers={
+            "Authorization": f"Bearer {TOKEN}",
+            "Idempotency-Key": key,
+            **(headers or {}),
+        },
+        json={"operationKey": "test.echo", "input": {"text": key}},
+    )
+
+
+def public_fixture() -> dict[str, object]:
+    path = (
+        Path(__file__).parents[3]
+        / "packages/server-sdk/contracts/agent-runtime-compatibility/v1/offer.json"
+    )
+    return cast(dict[str, object], json.loads(path.read_text(encoding="utf8")))

package/template/apps/server/src/agent/remote-runtime-compatibility.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createAgentRuntimeCompatibilityOfferV1 } from "@southwind-ai/server-sdk";
+import type { AgentRuntimeOperation } from "./run-contracts.js";
+import { RemoteAgentRuntime } from "./remote-runtime.js";
+
+const servers: Bun.Server<unknown>[] = [];
+
+afterEach(() => {
+  for (const server of servers.splice(0)) server.stop(true);
+});
+
+describe("RemoteAgentRuntime compatibility", () => {
+  test("V1 协商成功后固定协议版本与 Offer 摘要", async () => {
+    let startHeaders: Headers | undefined;
+    const offer = createAgentRuntimeCompatibilityOfferV1(
+      "windy.direct.openai-compatible.v1",
+    );
+    const server = Bun.serve({
+      port: 0,
+      fetch(request) {
+        if (isCompatibilityRequest(request)) return Response.json(offer);
+        startHeaders = request.headers;
+        return accepted("run_pinned");
+      },
+    });
+    servers.push(server);
+    const runtime = remote(server, "require-v1");
+
+    await runtime.start(agentOperation(), "pinned-1");
+
+    expect(startHeaders?.get("x-windy-agent-runtime-protocol")).toBe("1");
+    expect(startHeaders?.get("x-windy-agent-runtime-offer-digest")).toBe(
+      offer.offerDigest,
+    );
+    expect(startHeaders?.get("authorization")).toBe("Bearer test-token");
+  });
+
+  test("prefer-v1 只对旧 Runtime 的 404 回退为 legacy", async () => {
+    let starts = 0;
+    const server = Bun.serve({
+      port: 0,
+      fetch(request) {
+        if (isCompatibilityRequest(request)) {
+          return new Response(null, { status: 404 });
+        }
+        starts += 1;
+        return accepted("run_legacy");
+      },
+    });
+    servers.push(server);
+
+    await expect(
+      remote(server, "prefer-v1").start(agentOperation(), "legacy-1"),
+    ).resolves.toEqual({
+      runId: "run_legacy",
+      status: "accepted",
+      eventsUrl: "/api/agent/runs/run_legacy/events",
+    });
+    expect(starts).toBe(1);
+  });
+
+  test("require-v1 拒绝旧 Runtime，畸形 Offer 也不会降级", async () => {
+    for (const response of [
+      new Response(null, { status: 404 }),
+      Response.json({ schemaVersion: 1 }),
+    ]) {
+      let starts = 0;
+      const server = Bun.serve({
+        port: 0,
+        fetch(request) {
+          if (isCompatibilityRequest(request)) return response.clone();
+          starts += 1;
+          return Response.json({});
+        },
+      });
+      servers.push(server);
+
+      await expect(
+        remote(server, "require-v1").start(agentOperation(), "required-1"),
+      ).rejects.toMatchObject({
+        code: "RUNTIME_UNAVAILABLE",
+        retryable: false,
+      });
+      expect(starts).toBe(0);
+    }
+  });
+});
+
+function remote(server: Bun.Server<unknown>, mode: "prefer-v1" | "require-v1") {
+  return new RemoteAgentRuntime({
+    baseUrl: server.url.toString(),
+    internalToken: "test-token",
+    toolHostUrl: "http://server.internal",
+    compatibilityMode: mode,
+  });
+}
+
+function isCompatibilityRequest(request: Request): boolean {
+  return new URL(request.url).pathname === "/api/agent/runtime/compatibility";
+}
+
+function accepted(runId: string): Response {
+  return Response.json({
+    runId,
+    status: "accepted",
+    eventsUrl: `/api/agent/runs/${runId}/events`,
+  });
+}
+
+function agentOperation(): AgentRuntimeOperation {
+  return {
+    kind: "agent",
+    operationKey: "business.answer",
+    input: { question: "你好" },
+    inputModalities: ["text"],
+    requiredCapabilities: ["text-generation"],
+    artifacts: [],
+    instructions: "回答业务问题",
+    userPrompt: "你好",
+    outputSchemaKey: "business.output.v1",
+    allowedTools: [],
+    limits: {
+      maxDurationSeconds: 60,
+      maxInputBytes: 4_096,
+      maxOutputBytes: 4_096,
+    },
+    providerEgress: {
+      mode: "configured-endpoint",
+      deploymentKey: "ai.openai-compatible",
+    },
+    providerDataPolicy: { inputFields: [], envelopeFields: [] },
+    toolNetworkPolicy: { mode: "forbidden" },
+    executionGrant: "grant_1",
+    release: {
+      releaseId: "release_test",
+      operationVersion: "1.0.0",
+      workflowVersion: "workflow-1",
+      promptVersion: "prompt-1",
+      routeVersion: "route-1",
+      outputSchemaVersion: "output-schema-1",
+      toolSchemaVersion: "schema-1",
+      manifestDigest: "0".repeat(64),
+    },
+    traceId: "trace_1",
+    reporting: { actorId: "user_1", actorType: "user" },
+  };
+}

package/template/apps/server/src/agent/remote-runtime.ts

@@ -1,8 +1,16 @@
-import type {
-  AgentRuntimeOperation,
-  AgentRuntimePort,
-  AgentRuntimeStartResponse,
+import {
+  AgentRuntimeError,
+  type AgentRuntimeOperation,
+  type AgentRuntimePort,
+  type AgentRuntimeStartResponse,
 } from "./run-contracts.js";
+import {
+  AGENT_RUNTIME_COMPATIBILITY_PATH_V1,
+  AGENT_RUNTIME_OFFER_DIGEST_HEADER_V1,
+  AGENT_RUNTIME_PROTOCOL_HEADER_V1,
+  localAgentRuntimeCompatibilityRequirementsV1,
+  negotiateAgentRuntimeCompatibilityV1,
+} from "@southwind-ai/server-sdk";
 import { assertVisionReadinessPin } from "./vision-readiness-pin.js";
 import {
   parseRemoteStart,
@@ -15,6 +23,8 @@ export interface RemoteAgentRuntimeOptions {
   internalToken: string;
   toolHostUrl: string;
   timeoutMs?: number;
+  /** Legacy is the default for direct callers; platform composition opts into rolling V1. */
+  compatibilityMode?: "prefer-v1" | "require-v1";
 }
 
 export class RemoteAgentRuntime implements AgentRuntimePort {
@@ -33,6 +43,7 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
     request: AgentRuntimeOperation,
     idempotencyKey: string,
   ): Promise<AgentRuntimeStartResponse> {
+    const compatibilityHeaders = await this.compatibilityHeaders();
     if (request.readinessPin) {
       await assertVisionReadinessPin(request.readinessPin, () => this.health());
     }
@@ -103,6 +114,7 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
       headers: {
         "content-type": "application/json",
         "idempotency-key": idempotencyKey,
+        ...compatibilityHeaders,
       },
       body: JSON.stringify(remoteRequest),
     });
@@ -160,6 +172,38 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
     return { deploymentKey, model };
   }
 
+  private async compatibilityHeaders(): Promise<Record<string, string>> {
+    const mode = this.options.compatibilityMode;
+    if (!mode) return {};
+    let response: Response;
+    try {
+      response = await this.request(AGENT_RUNTIME_COMPATIBILITY_PATH_V1);
+    } catch {
+      throw new AgentRuntimeError(
+        "RUNTIME_UNAVAILABLE",
+        "Agent Runtime compatibility 探测失败",
+        true,
+      );
+    }
+    if (response.status === 404 && mode === "prefer-v1") return {};
+    if (!response.ok) throw await remoteRuntimeError(response);
+    let value: unknown;
+    try {
+      value = await readBoundedCompatibilityOffer(response);
+    } catch {
+      throw incompatibleRuntime("CONTRACT_INVALID");
+    }
+    const negotiation = negotiateAgentRuntimeCompatibilityV1(
+      value,
+      localAgentRuntimeCompatibilityRequirementsV1(),
+    );
+    if (!negotiation.ok) throw incompatibleRuntime(negotiation.code);
+    return {
+      [AGENT_RUNTIME_PROTOCOL_HEADER_V1]: String(negotiation.protocolVersion),
+      [AGENT_RUNTIME_OFFER_DIGEST_HEADER_V1]: negotiation.offer.offerDigest,
+    };
+  }
+
   private async request(
     path: string,
     init: RequestInit = {},
@@ -187,6 +231,24 @@ export class RemoteAgentRuntime implements AgentRuntimePort {
   }
 }
 
+function incompatibleRuntime(code: string): AgentRuntimeError {
+  return new AgentRuntimeError(
+    "RUNTIME_UNAVAILABLE",
+    `Agent Runtime compatibility 不匹配（${code}）`,
+    false,
+  );
+}
+
+async function readBoundedCompatibilityOffer(
+  response: Response,
+): Promise<unknown> {
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > 64 * 1_024) {
+    throw new Error("Agent Runtime compatibility Offer 超过上限");
+  }
+  return JSON.parse(new TextDecoder().decode(bytes)) as unknown;
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }

package/template/apps/server/src/agent/runtime-bootstrap.ts

@@ -104,6 +104,7 @@ export function registerAgentPlatformRuntime(input: AgentPlatformRuntimeInput) {
     baseUrl: agentServerUrl,
     internalToken,
     toolHostUrl: process.env.AGENT_TOOL_HOST_URL || "http://server:9747",
+    compatibilityMode: "prefer-v1",
   });
   const clientAgentSessionRuntime = createClientAgentSessionRuntime({
     app: input.app,

package/template/apps/web/src/components/common/FormDialog.vue

@@ -34,6 +34,7 @@ const props = withDefaults(
     loading: false,
     submitDisabled: false,
     preventOutsideClose: false,
+    contentClass: "sm:max-w-2xl",
   },
 );
 

package/template/apps/web/src/components/common/ModalLayout.webtest.ts

@@ -33,6 +33,7 @@ describe("Modal 布局", () => {
       "min-h-[min(12rem,calc(100dvh-2rem))]",
     );
     expect(content?.className).toContain("overflow-hidden");
+    expect(content?.className).toContain("sm:max-w-2xl");
     expect(body?.className).toContain("overflow-y-auto");
     expect(footer?.className).toContain("shrink-0");
 

package/template/apps/web/src/components/ui/dialog/DialogContent.vue

@@ -44,7 +44,7 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits);
       v-bind="{ ...$attrs, ...forwarded }"
       :class="
         cn(
-          'bg-popover text-popover-foreground data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 ring-foreground/10 fixed top-1/2 left-1/2 z-50 flex min-h-[min(12rem,calc(100dvh-2rem))] max-h-[calc(100dvh-2rem)] w-full max-w-[calc(100%-2rem)] -translate-x-1/2 -translate-y-1/2 flex-col gap-4 overflow-hidden rounded-xl p-4 text-sm ring-1 duration-100 outline-none sm:max-w-sm',
+          'bg-popover text-popover-foreground data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 ring-foreground/10 fixed top-1/2 left-1/2 z-50 flex min-h-[min(12rem,calc(100dvh-2rem))] max-h-[calc(100dvh-2rem)] w-full max-w-[calc(100%-2rem)] -translate-x-1/2 -translate-y-1/2 flex-col gap-4 overflow-hidden rounded-xl p-4 text-sm ring-1 duration-100 outline-none sm:max-w-xl',
           props.class,
         )
       "

package/template/apps/web/src/components/ui/dialog/DialogScrollContent.vue

@@ -35,7 +35,7 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits);
       <DialogContent
         :class="
           cn(
-            'relative z-50 grid w-full max-w-lg my-8 gap-4 border border-border bg-background p-6 shadow-lg duration-200 sm:rounded-lg md:w-full',
+            'relative z-50 my-8 grid w-full max-w-2xl gap-4 border border-border bg-background p-6 shadow-lg duration-200 sm:rounded-lg md:w-full',
             props.class,
           )
         "

package/template/apps/web/src/pages/system/components/SystemResourceEditor.vue

@@ -52,6 +52,7 @@ const title = computed(() => (props.item ? "编辑记录" : "新增记录"));
       ref="resourceForm"
       :item="item"
       :defaults="defaults"
+      :permissions="permissions || []"
       :department-create-mode="departmentCreateMode"
       @submit="emit('submit', $event)"
     />