create-windy 0.8.0 → 0.8.2

package/template/apps/agent-server/tests/test_tool_structured_output.py

@@ -0,0 +1,347 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import sqlite3
+from dataclasses import replace
+from pathlib import Path
+from typing import cast
+
+import httpx
+import pytest
+
+from southwind_agent_server.attempt_context import govern_provider_attempt
+from southwind_agent_server.attempt_context_projection import (
+    AttemptContextPreparation,
+    governed_envelope,
+)
+from southwind_agent_server.context_message_digest import canonical_json_digest
+from southwind_agent_server.context_version_port import (
+    PreparedContext,
+    PreparedSource,
+    UnavailableContextVersionPort,
+)
+from southwind_agent_server.contracts import JsonValue, ProviderFieldPolicy
+from southwind_agent_server.engine import (
+    EngineCompleted,
+    EngineRunRequest,
+    SafeEngineError,
+    ToolCompleted,
+)
+from southwind_agent_server.openai_engine import OpenAiCompatibleEngineAdapter
+from southwind_agent_server.tool_host import ToolHostClient
+from tests.openai_provider_test_support import (
+    create_provider,
+    governance,
+    runtime_request,
+    sse_response,
+)
+
+SCHEMA: dict[str, JsonValue] = {
+    "type": "object",
+    "properties": {"total": {"type": "integer"}},
+    "required": ["total"],
+    "additionalProperties": False,
+}
+
+
+def structured_request() -> EngineRunRequest:
+    request = runtime_request("business.records.list")
+    return replace(
+        request,
+        output_schema_key="business.answer.v1",
+        output_schema=SCHEMA,
+        provider_data_policy=request.provider_data_policy.model_copy(
+            update={
+                "envelope_fields": [
+                    *request.provider_data_policy.envelope_fields,
+                    ProviderFieldPolicy(
+                        field="output-schema",
+                        classification="internal",
+                        dlp_action="redact",
+                    ),
+                ]
+            }
+        ),
+    )
+
+
+def test_tool_payload_uses_schema_guidance_without_mutation_or_duplicate() -> None:
+    provider = create_provider(httpx.MockTransport(lambda _: httpx.Response(500)))
+    request = runtime_request("business.records.list")
+    messages: list[dict[str, JsonValue]] = [{"role": "system", "content": "原指令"}]
+    body = provider.request_body(messages, request.allowed_tools, "answer.v1", SCHEMA)
+    payload = json.loads(body)
+    assert "response_format" not in payload
+    assert payload["tools"][0]["function"]["name"] == "business.records.list"
+    assert payload["messages"][0]["content"].startswith("原指令\n\n")
+    assert (
+        json.dumps(SCHEMA, ensure_ascii=False, separators=(",", ":"))
+        in payload["messages"][0]["content"]
+    )
+    assert messages[0]["content"] == "原指令"
+    assert (
+        provider.request_body(
+            payload["messages"], request.allowed_tools, "answer.v1", SCHEMA
+        )
+        == body
+    )
+    plain = json.loads(provider.request_body(messages, (), "answer.v1", SCHEMA))
+    assert plain["messages"] == messages
+    assert plain["response_format"]["json_schema"]["strict"] is True
+
+
+@pytest.mark.parametrize("final", ['{"total":1}', '{"total":"1"}', "```json\n{}\n```"])
+async def test_real_function_round_keeps_strict_final_schema(final: str) -> None:
+    turns = 0
+    calls = 0
+
+    async def provider_handler(request: httpx.Request) -> httpx.Response:
+        nonlocal turns
+        turns += 1
+        body = json.loads(request.content)
+        assert "response_format" not in body
+        assert '"required":["total"]' in body["messages"][0]["content"]
+        if turns == 1:
+            return sse_response(
+                [
+                    {
+                        "choices": [
+                            {
+                                "delta": {
+                                    "tool_calls": [
+                                        {
+                                            "index": 0,
+                                            "id": "call_1",
+                                            "function": {
+                                                "name": "business.records.list",
+                                                "arguments": "{}",
+                                            },
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    }
+                ]
+            )
+        assert body["messages"][-1]["role"] == "tool"
+        return sse_response([{"choices": [{"delta": {"content": final}}]}])
+
+    async def tool_handler(request: httpx.Request) -> httpx.Response:
+        nonlocal calls
+        calls += 1
+        assert json.loads(request.content)["executionGrant"] == "grant_1"
+        return httpx.Response(200, json={"value": {"total": 1}})
+
+    engine = OpenAiCompatibleEngineAdapter(
+        create_provider(httpx.MockTransport(provider_handler)),
+        ToolHostClient("internal-token", transport=httpx.MockTransport(tool_handler)),
+        governance(),
+    )
+    request = structured_request()
+    if final == '{"total":1}':
+        signals = [signal async for signal in engine.execute(request)]
+        assert any(isinstance(signal, ToolCompleted) for signal in signals)
+        assert isinstance(signals[-1], EngineCompleted)
+        assert signals[-1].output == {"total": 1}
+    else:
+        with pytest.raises(SafeEngineError) as denied:
+            _ = [signal async for signal in engine.execute(request)]
+        assert denied.value.code == "OUTPUT_VALIDATION_FAILED"
+    assert turns == 2 and calls == 1
+
+
+async def test_text_tool_call_is_not_executable() -> None:
+    async def provider_handler(_: httpx.Request) -> httpx.Response:
+        return sse_response(
+            [
+                {
+                    "choices": [
+                        {
+                            "delta": {
+                                "content": (
+                                    '{"tool_calls":[{"name":"business.records.list",'
+                                    '"arguments":{}}]}'
+                                )
+                            }
+                        }
+                    ]
+                }
+            ]
+        )
+
+    async def tool_handler(_: httpx.Request) -> httpx.Response:
+        pytest.fail("正文中的工具调用不得执行")
+
+    engine = OpenAiCompatibleEngineAdapter(
+        create_provider(httpx.MockTransport(provider_handler)),
+        ToolHostClient("internal-token", transport=httpx.MockTransport(tool_handler)),
+        governance(),
+    )
+    with pytest.raises(SafeEngineError) as denied:
+        _ = [signal async for signal in engine.execute(structured_request())]
+    assert denied.value.code == "OUTPUT_VALIDATION_FAILED"
+
+
+async def test_governed_guidance_matches_audit_and_context_bytes(
+    tmp_path: Path,
+) -> None:
+    request = structured_request()
+    request = replace(
+        request, output_schema={**SCHEMA, "description": "password=secret"}
+    )
+    provider = create_provider(httpx.MockTransport(lambda _: httpx.Response(500)))
+    audit_path = str(tmp_path / "audit.sqlite3")
+    messages: list[dict[str, JsonValue]] = [
+        {"role": "system", "content": request.instructions},
+        {"role": "user", "content": "历史来源"},
+        {"role": "user", "content": request.user_prompt},
+    ]
+    prepared = await govern_provider_attempt(
+        UnavailableContextVersionPort(),
+        governance(audit_path),
+        provider,
+        request,
+        1,
+        None,
+        messages,
+    )
+    payload = json.loads(prepared.provider_request)
+    assert payload["messages"] == prepared.governed.messages
+    assert "password=secret" not in prepared.provider_request.decode()
+    assert "[REDACTED]" in payload["messages"][0]["content"]
+    with sqlite3.connect(audit_path) as connection:
+        assert connection.execute(
+            "select sent_bytes, decision from provider_attempt_audit"
+        ).fetchone() == (len(prepared.provider_request), "redact")
+    source = PreparedSource(
+        "business", "session", "source-1", "v1", 1, "a" * 64, {}, "历史来源", "user"
+    )
+    envelope = governed_envelope(
+        AttemptContextPreparation(
+            PreparedContext("preparation-1", (source,)), messages, 1
+        ),
+        request.run_id,
+        "attempt-1",
+        prepared.governed.messages,
+        prepared.provider_request,
+        provider.config.deployment_key,
+        provider.config.model,
+        request.prompt_version,
+        (),
+    )
+    entries = cast(list[dict[str, JsonValue]], envelope["messages"])
+    assert entries[0]["content"] == payload["messages"][0]["content"]
+    assert (
+        cast(list[dict[str, JsonValue]], entries[1]["origins"])[0]["sourceId"]
+        == "source-1"
+    )
+    provider_fields = cast(dict[str, JsonValue], envelope["provider"])
+    assert (
+        provider_fields["requestDigest"]
+        == hashlib.sha256(prepared.provider_request).hexdigest()
+    )
+    assert provider_fields["outputSchemaDigest"] == hashlib.sha256(b"null").hexdigest()
+    assert entries[0]["digest"] == canonical_json_digest(payload["messages"][0])
+    assert entries[0]["digest"] != canonical_json_digest(cast(JsonValue, messages[0]))
+
+
+async def test_schema_guidance_still_requires_output_schema_authorization() -> None:
+    request = structured_request()
+    request = replace(
+        request,
+        provider_data_policy=runtime_request(
+            "business.records.list"
+        ).provider_data_policy,
+    )
+    with pytest.raises(SafeEngineError) as denied:
+        await govern_provider_attempt(
+            UnavailableContextVersionPort(),
+            governance(),
+            create_provider(httpx.MockTransport(lambda _: httpx.Response(500))),
+            request,
+            1,
+            None,
+            [{"role": "system", "content": "指令"}],
+        )
+    assert denied.value.code == "FORBIDDEN"
+
+
+async def test_schema_guidance_counts_toward_input_token_budget() -> None:
+    calls = 0
+
+    async def handler(_: httpx.Request) -> httpx.Response:
+        nonlocal calls
+        calls += 1
+        return sse_response([])
+
+    provider = create_provider(httpx.MockTransport(handler))
+    request = structured_request()
+    messages: list[dict[str, JsonValue]] = [
+        {"role": "system", "content": request.instructions},
+        {"role": "user", "content": request.user_prompt},
+    ]
+    original_bytes = len(provider.request_body(messages, request.allowed_tools))
+    assert original_bytes < 1024
+    request = replace(
+        request,
+        output_schema={**SCHEMA, "description": "业务结果字段说明。" * 100},
+        limits=request.limits.model_copy(update={"max_input_tokens": original_bytes}),
+    )
+    engine = OpenAiCompatibleEngineAdapter(
+        provider, ToolHostClient("internal-token"), governance()
+    )
+    with pytest.raises(SafeEngineError) as denied:
+        _ = [signal async for signal in engine.execute(request)]
+    assert denied.value.code == "BUDGET_EXCEEDED"
+    assert calls == 0
+
+
+async def test_tool_schema_respects_model_attempt_limit() -> None:
+    calls = 0
+
+    async def handler(_: httpx.Request) -> httpx.Response:
+        nonlocal calls
+        calls += 1
+        return sse_response(
+            [
+                {
+                    "choices": [
+                        {
+                            "delta": {
+                                "tool_calls": [
+                                    {
+                                        "index": 0,
+                                        "id": "call_1",
+                                        "function": {
+                                            "name": "business.records.list",
+                                            "arguments": "{}",
+                                        },
+                                    }
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        )
+
+    request = structured_request()
+    request = replace(
+        request, limits=request.limits.model_copy(update={"max_model_attempts": 1})
+    )
+    engine = OpenAiCompatibleEngineAdapter(
+        create_provider(httpx.MockTransport(handler)),
+        ToolHostClient(
+            "internal-token",
+            transport=httpx.MockTransport(
+                lambda _: httpx.Response(200, json={"value": {"total": 1}})
+            ),
+        ),
+        governance(),
+    )
+    with pytest.raises(SafeEngineError) as denied:
+        _ = [signal async for signal in engine.execute(request)]
+    assert denied.value.code == "BUDGET_EXCEEDED"
+    assert calls == 1

package/template/apps/server/src/agent/isolated-execution-guard.test.ts

@@ -0,0 +1,194 @@
+import { describe, expect, test } from "bun:test";
+import type { ModuleManifest } from "@southwind-ai/modules";
+import { buildScopeContext } from "../data-access/context.js";
+import { createRequestGuardContext } from "../guards.js";
+import type { InitializedModuleHosts } from "../module-host.js";
+import { createServerRuntime } from "../runtime.js";
+import { IsolatedExecutionGuard } from "./isolated-execution-guard.js";
+import { createTestRunAuthorizationStore } from "./run-authorization.test-support.js";
+import { buildAgentRuntimeRelease } from "./run-release.js";
+
+const definition: NonNullable<ModuleManifest["aiOperations"]>[number] = {
+  key: "business.answer",
+  kind: "agent",
+  featureKey: "business.ai",
+  permissionKey: "business.ai.execute",
+  auditAction: "business.ai.execute",
+  inputSchemaKey: "business.input.v1",
+  outputSchemaKey: "business.output.v1",
+  requiredCapabilities: ["text-generation"],
+  allowedToolKeys: [],
+  dataClassification: "internal",
+  execution: "streaming",
+  toolNetworkPolicy: { mode: "forbidden" },
+  limits: { maxDurationSeconds: 60, maxInputBytes: 4096, maxOutputBytes: 4096 },
+  isolatedExecution: {
+    version: 1,
+    mode: "isolated",
+    languages: ["python"],
+    inputArtifactTypes: ["text/plain"],
+    network: "forbidden",
+    limits: {
+      maxWorkspaceBytes: 4096,
+      maxFileBytes: 2048,
+      maxOutputBytes: 1024,
+      maxDurationSeconds: 30,
+      maxCpuMillis: 30_000,
+      maxMemoryBytes: 134_217_728,
+      maxPids: 4,
+      maxConcurrentProcesses: 1,
+      maxToolCalls: 3,
+      maxToolRounds: 2,
+    },
+  },
+};
+
+const module = {
+  name: "business",
+  version: "0.1.0",
+  features: [
+    {
+      key: "business.ai",
+      enabled: true,
+      module: "business",
+      label: "AI",
+      visible: "visible",
+      stage: "stable",
+    },
+  ],
+  jsonSchemas: [
+    { key: "business.input.v1", schema: { type: "object" } },
+    { key: "business.output.v1", schema: { type: "object" } },
+  ],
+  tools: [],
+  aiOperations: [definition],
+} as unknown as ModuleManifest;
+const hosts = { aiOperationHandlers: [] } as unknown as InitializedModuleHosts;
+
+describe("隔离执行逐次准入", () => {
+  test("运行时或持久预算端口缺失时拒绝，绝不执行宿主脚本", async () => {
+    const fixture = await setup();
+    await expect(
+      fixture.guard().admit(fixture.invocation),
+    ).rejects.toMatchObject({
+      code: "RUNTIME_UNAVAILABLE",
+    });
+  });
+
+  test("当前授权、Run 状态及预算每次复核", async () => {
+    const fixture = await setup();
+    const calls: unknown[] = [];
+    const guard = fixture.guard({
+      state: { status: async () => "running" },
+      budget: {
+        reserve: async (input) => {
+          calls.push(input);
+          return true;
+        },
+      },
+      available: true,
+    });
+    await expect(guard.admit(fixture.invocation)).resolves.toEqual(
+      definition.isolatedExecution!,
+    );
+    expect(calls).toEqual([
+      {
+        runId: "run_1",
+        callId: "call_1",
+        maxToolCalls: 3,
+        maxToolRounds: 2,
+        maxConcurrentProcesses: 1,
+      },
+    ]);
+    await expect(
+      guard.admit({ ...fixture.invocation, language: "node" }),
+    ).rejects.toMatchObject({ code: "EXECUTION_DENIED" });
+
+    const denied = fixture.guard({
+      state: { status: async () => "terminal" },
+      budget: {
+        reserve: async () => {
+          throw new Error("terminal Run must not reserve");
+        },
+      },
+      available: true,
+    });
+    await expect(denied.admit(fixture.invocation)).rejects.toMatchObject({
+      code: "EXECUTION_DENIED",
+    });
+    fixture.actor.permissionKeys = [];
+    await expect(guard.admit(fixture.invocation)).rejects.toMatchObject({
+      code: "EXECUTION_DENIED",
+    });
+    expect(calls).toHaveLength(1);
+  });
+});
+
+async function setup() {
+  const actor = {
+    id: "actor-1",
+    type: "user" as const,
+    name: "测试用户",
+    roleCodes: ["user"],
+    permissionKeys: ["business.ai.execute"],
+    scopeContext: buildScopeContext("actor-1", undefined, [
+      { id: "role-user", code: "user", dataScope: "self", departmentIds: [] },
+    ]),
+  };
+  const runtime = createServerRuntime(
+    {},
+    {
+      featureCatalog: module.features,
+      licenseResolver: { resolve: () => ({ status: "valid" }) },
+    },
+  );
+  const context = createRequestGuardContext(
+    new Request("http://localhost/api/agent/runs"),
+    {
+      resolveActor: () => actor,
+      resolveLicense: () => ({ status: "valid" }),
+    },
+  );
+  const authorizations = createTestRunAuthorizationStore();
+  const grant = await authorizations.issue({
+    operationKey: definition.key,
+    releaseId: buildAgentRuntimeRelease([module], module, definition, undefined)
+      .releaseId,
+    idempotencyKey: "isolated-execution-test",
+    input: { question: "analyze" },
+    authorizationSnapshot: {
+      permissionKey: definition.permissionKey,
+      featureKey: definition.featureKey,
+      allowedToolKeys: [],
+      toolNetworkMode: "forbidden",
+    },
+    context,
+  });
+  await authorizations.bind(grant, "run_1");
+  return {
+    actor,
+    invocation: {
+      executionGrant: grant.token,
+      runId: "run_1",
+      callId: "call_1",
+      language: "python" as const,
+    },
+    guard: (
+      ports: {
+        state?: ConstructorParameters<typeof IsolatedExecutionGuard>[5];
+        budget?: ConstructorParameters<typeof IsolatedExecutionGuard>[6];
+        available?: boolean;
+      } = {},
+    ) =>
+      new IsolatedExecutionGuard(
+        [module],
+        hosts,
+        runtime,
+        authorizations,
+        async () => actor,
+        ports.state,
+        ports.budget,
+        ports.available,
+      ),
+  };
+}