create-windy 0.8.2 → 0.9.1

package/template/apps/agent-server/runtime/index.ts

@@ -0,0 +1,339 @@
+import { z } from "zod";
+import {
+  authorized,
+  errorValue,
+  json,
+  readJson,
+  runSchema,
+  SafeError,
+  type RunRequest,
+} from "./contracts.js";
+import {
+  configFromEnvironment,
+  modelCoordinate,
+  requireModel,
+  type RuntimeConfig,
+} from "./config.js";
+import { RuntimeStore, terminal } from "./store.js";
+import { executeDshRun } from "./dsh-engine.js";
+import { compatibilityOffer } from "./compatibility.js";
+import { ModelCapacity } from "./capacity.js";
+import { completeDshTask } from "./run-completion.js";
+import {
+  clientCompletion,
+  nativeCompletion,
+  type CompletionAuthority,
+} from "./completions.js";
+import { publicEvent, eventResponse } from "./events.js";
+import { VisionReadiness } from "./vision-readiness.js";
+import { EvaluationPlugin } from "./evaluation-plugin.js";
+import { reportResponse } from "./reporting.js";
+export interface CanonicalOptions {
+  config?: RuntimeConfig;
+}
+export function createCanonicalHandler(options: CanonicalOptions = {}) {
+  const config = options.config ?? configFromEnvironment(),
+    store = new RuntimeStore(
+      config.databasePath,
+      config.providerAuditRetentionDays,
+    ),
+    capacity = new ModelCapacity(config.concurrency);
+  const running = new Map<string, AbortController>(),
+    queue: string[] = [];
+  const vision = new VisionReadiness(config, store, capacity);
+  const evaluations = new EvaluationPlugin(store);
+  let closed = false;
+  const tasks = new Set<Promise<void>>();
+  function pump() {
+    while (!closed && running.size < config.concurrency && queue.length) {
+      const id = queue.shift()!,
+        run = store.get(id);
+      if (terminal(run.status)) continue;
+      const controller = new AbortController();
+      running.set(id, controller);
+      const timeout = setTimeout(
+        () =>
+          controller.abort(
+            new SafeError("RUN_TIMEOUT", "Agent 执行超时", true),
+          ),
+        Math.min(
+          run.request.limits.maxDurationSeconds,
+          config.maxDurationSeconds,
+        ) * 1000,
+      );
+      store.event(id, "run.started", { executionGeneration: 1 }, "running");
+      const task = completeDshTask(
+        executeDshRun(
+          id,
+          run.request,
+          config,
+          store,
+          controller.signal,
+          capacity,
+        ),
+        {
+          id,
+          store,
+          signal: controller.signal,
+          release: () => {
+            clearTimeout(timeout);
+            running.delete(id);
+          },
+        },
+      ).finally(() => {
+        tasks.delete(task);
+        pump();
+      });
+      tasks.add(task);
+    }
+  }
+  function start(body: RunRequest, key: string) {
+    requireModel(config);
+    if (closed)
+      throw new SafeError("RUNTIME_UNAVAILABLE", "运行时正在停止", true, 503);
+    // Idempotent replays do not consume queue capacity.
+    const existing = store.db
+      .prepare("SELECT id FROM runs WHERE idempotency=?")
+      .get(key);
+    if (
+      !existing &&
+      running.size + queue.length >= config.concurrency + config.queueDepth
+    )
+      throw new SafeError("BUDGET_EXCEEDED", "Agent 任务容量已满", true, 429);
+    if (
+      Buffer.byteLength(JSON.stringify(body.input)) > body.limits.maxInputBytes
+    )
+      throw new SafeError("BUDGET_EXCEEDED", "输入超过任务预算", false, 413);
+    const result = store.create(body, key);
+    if (result.fresh) {
+      queue.push(result.run.id);
+      queueMicrotask(pump);
+    }
+    return json({
+      runId: result.run.id,
+      status: result.run.status,
+      eventsUrl: `/api/agent/runs/${result.run.id}/events`,
+    });
+  }
+  async function route(request: Request): Promise<Response | undefined> {
+    const url = new URL(request.url),
+      path = url.pathname;
+    if (path === "/health/live") return json({ status: "live" });
+    if (path === "/health/ready")
+      return closed
+        ? json({ status: "stopping" }, 503)
+        : json({ status: "ready", engine: "dsh", ...capacity.snapshot() });
+    if (path === "/health/vlm-ready") {
+      const snapshot = await vision.inspect();
+      return json(snapshot, snapshot.status === "ready" ? 200 : 503);
+    }
+    const owned =
+      path.startsWith("/api/agent/") ||
+      path.startsWith("/api/internal/client-agent/") ||
+      path.startsWith("/api/internal/ai-runtime-report/") ||
+      [
+        "/health/model-coordinate",
+        "/health/provider-governance",
+        "/metrics",
+      ].includes(path);
+    if (!owned) return undefined;
+    if (!authorized(request, config.internalToken))
+      throw new SafeError("FORBIDDEN", "内部调用认证失败", false, 403);
+    if (path === "/health/model-coordinate")
+      return json(modelCoordinate(config));
+    if (path === "/health/provider-governance")
+      return json(store.auditHealth());
+    if (path === "/api/agent/runtime/compatibility")
+      return json(compatibilityOffer());
+    if (path === "/api/agent/evaluations" && request.method === "POST")
+      return evaluations.handle(request);
+    if (path === "/api/internal/client-agent/health") {
+      requireModel(config);
+      return json({ status: "ready" });
+    }
+    if (
+      path === "/api/internal/client-agent/chat/completions" &&
+      request.method === "POST"
+    )
+      return clientCompletion(request, config, store, capacity);
+    if (path === "/api/agent/runs" && request.method === "POST") {
+      const protocol = request.headers.get("X-Windy-Agent-Runtime-Protocol"),
+        pin = request.headers.get("X-Windy-Agent-Runtime-Offer-Digest");
+      if (
+        (protocol !== null || pin !== null) &&
+        (protocol !== "1" || pin !== compatibilityOffer().offerDigest)
+      )
+        throw new SafeError(
+          "RUNTIME_UNAVAILABLE",
+          "Agent Runtime compatibility pin 不匹配",
+        );
+      const key = request.headers.get("Idempotency-Key")?.trim();
+      if (!key || key.length > 512)
+        throw new SafeError("INVALID_INPUT", "幂等键无效", false, 400);
+      const body = runSchema.parse(await readJson(request, 67108864));
+      if (
+        body.inputModalities.includes("image") ||
+        body.requiredCapabilities.includes("vision")
+      )
+        await vision.assertPin(body.readinessPin);
+      return start(body, key);
+    }
+    if (
+      path.startsWith("/api/internal/ai-runtime-report/") ||
+      path === "/metrics"
+    )
+      return reportResponse(url, store, config);
+    const match =
+      /^\/api\/agent\/runs\/(run_[A-Za-z0-9_-]+)(?:\/(events|result|cancel))?$/.exec(
+        path,
+      );
+    if (!match)
+      return json(
+        {
+          code: "OPERATION_NOT_FOUND",
+          message: "接口不存在",
+          retryable: false,
+        },
+        404,
+      );
+    const id = match[1]!,
+      action = match[2],
+      run = store.get(id),
+      events = store.events(id),
+      last = events.at(-1);
+    if (action === "cancel" && request.method === "POST") {
+      await readJson(request, 8192);
+      if (!terminal(run.status)) {
+        const execution = running.get(id);
+        if (execution) execution.abort();
+        else {
+          const index = queue.indexOf(id);
+          if (index >= 0) queue.splice(index, 1);
+          store.event(id, "run.cancelled", {}, "cancelled");
+        }
+      }
+      return json({ runId: id, status: store.get(id).status });
+    }
+    if (request.method !== "GET")
+      return json(
+        { code: "INVALID_INPUT", message: "请求方法无效", retryable: false },
+        405,
+      );
+    if (action === "events") return eventResponse(request, id, store);
+    if (action === "result") {
+      if (run.status !== "completed")
+        throw new SafeError(
+          run.status === "cancelled"
+            ? "RUN_CANCELLED"
+            : run.status === "failed"
+              ? "RUNTIME_UNAVAILABLE"
+              : "RUN_CONFLICT",
+          "Agent Run 尚未成功完成",
+          run.status !== "cancelled",
+        );
+      if (
+        run.request.outputPolicy.visibility === "internal" &&
+        request.headers.get("X-Windy-Output-Audience") !== "internal"
+      )
+        throw new SafeError("RUN_CONFLICT", "Agent Run 不存在", false, 404);
+      const tools = new Map(
+        events
+          .filter((event) => event.type === "tool.requested")
+          .map((event) => [event.toolCallId, event]),
+      );
+      const sources = events
+        .filter((event) => event.type === "tool.completed")
+        .slice(0, 12)
+        .map((event) => {
+          const tool = tools.get(event.toolCallId);
+          return {
+            toolCallId: event.toolCallId,
+            toolKey: tool?.toolKey,
+            toolLabel: tool?.toolLabel,
+            preview: event.sourcePreview,
+          };
+        });
+      return json({
+        runId: id,
+        status: "completed",
+        output: run.output,
+        sources,
+        ...(request.headers.get("X-Windy-Output-Audience") === "internal"
+          ? { attestation: last?.attestation }
+          : {}),
+      });
+    }
+    return json({
+      runId: id,
+      status: run.status,
+      lastSequence: last?.sequence ?? 0,
+      ...(terminal(run.status) && last
+        ? { terminalEvent: publicEvent(last) }
+        : {}),
+    });
+  }
+  const handler = async (request: Request): Promise<Response | undefined> => {
+    try {
+      return await route(request);
+    } catch (error) {
+      if (error instanceof z.ZodError)
+        return json(
+          errorValue(
+            new SafeError("INVALID_INPUT", "请求格式无效", false, 400),
+          ),
+          400,
+        );
+      return json(
+        errorValue(error),
+        error instanceof SafeError ? error.status : 503,
+      );
+    }
+  };
+  return Object.assign(handler, {
+    handleNativeCompletion: async (
+      request: Request,
+      authority: CompletionAuthority,
+    ) => {
+      try {
+        return await nativeCompletion(
+          request,
+          authority,
+          config,
+          store,
+          capacity,
+        );
+      } catch (error) {
+        if (error instanceof z.ZodError)
+          return json(
+            errorValue(
+              new SafeError("INVALID_INPUT", "请求格式无效", false, 400),
+            ),
+            400,
+          );
+        if (error instanceof SafeError && error.code === "CONTEXT_LIMIT")
+          return json(
+            {
+              error: {
+                code: "context_length_exceeded",
+                type: "invalid_request_error",
+                message:
+                  "Input exceeds the context window (conservative admission)",
+              },
+            },
+            400,
+          );
+        return json(
+          errorValue(error),
+          error instanceof SafeError ? error.status : 503,
+        );
+      }
+    },
+    close: async () => {
+      closed = true;
+      for (const controller of running.values()) controller.abort();
+      await Promise.allSettled(tasks);
+      store.close();
+    },
+    config,
+  });
+}

package/template/apps/agent-server/runtime/internal-output.ts

@@ -0,0 +1,37 @@
+import { createCipheriv, createHash, randomBytes } from "node:crypto";
+import { SafeError, type RunRequest } from "./contracts.js";
+export function protectOutput(
+  secret: string,
+  runId: string,
+  policy: RunRequest["outputPolicy"],
+  output: unknown,
+): unknown {
+  if (policy.visibility !== "internal") return output;
+  if (Buffer.byteLength(secret) < 32)
+    throw new SafeError("FORBIDDEN", "内部输出加密未配置", false, 403);
+  const key = createHash("sha256").update(secret).digest();
+  const keyId = `sha256:${createHash("sha256")
+    .update(
+      Buffer.concat([Buffer.from("windy-agent-internal-output-key-v1\0"), key]),
+    )
+    .digest("hex")}`;
+  if (keyId !== policy.encryptionKeyId)
+    throw new SafeError("FORBIDDEN", "内部输出加密策略已变化", false, 403);
+  const nonce = randomBytes(12),
+    cipher = createCipheriv("aes-256-gcm", key, nonce);
+  cipher.setAAD(
+    Buffer.from(`windy-agent-internal-output-v1\0${keyId}\0${runId}`),
+  );
+  const encrypted = Buffer.concat([
+    cipher.update(JSON.stringify(output)),
+    cipher.final(),
+    cipher.getAuthTag(),
+  ]);
+  return {
+    schemaVersion: 1,
+    kind: "agent-internal-output",
+    algorithm: "A256GCM",
+    keyId,
+    ciphertext: Buffer.concat([nonce, encrypted]).toString("base64url"),
+  };
+}

package/template/apps/agent-server/runtime/isolation.nodecheck.ts

@@ -0,0 +1,287 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createHash, createDecipheriv } from "node:crypto";
+import {
+  runtime,
+  request,
+  input,
+  endpoint,
+  probeImage,
+  providerParallelModes,
+} from "./runtime-test-fixtures.js";
+import { RuntimeStore } from "./store.js";
+test("configured request and run deadlines terminate actual provider calls and release capacity", async () => {
+  const handler = runtime({
+    AI_PROVIDER_REQUEST_TIMEOUT_MS: "1000",
+    AI_PROVIDER_MAX_CONCURRENT_RUNS: "2",
+  });
+  try {
+    const body = input();
+    body.userPrompt = "hold-timeout";
+    const start = await handler(request("/api/agent/runs", "POST", body));
+    const run = (await start!.json()) as { eventsUrl: string };
+    const events = await handler(request(run.eventsUrl));
+    assert.match(await events!.text(), /event: run.failed/);
+    const native = await handler.handleNativeCompletion(
+      new Request("http://runtime/internal/boundary/v1/chat/completions", {
+        method: "POST",
+        body: JSON.stringify({
+          stream: true,
+          messages: [{ role: "user", content: "hold-timeout" }],
+        }),
+      }),
+      { actorId: "actor", signal: new AbortController().signal },
+    );
+    assert.equal(native.status, 503);
+    const retry = await handler(
+      request("/api/agent/runs", "POST", input(), "after-timeout"),
+    );
+    const next = (await retry!.json()) as { eventsUrl: string };
+    const result = await handler(request(next.eventsUrl));
+    assert.match(await result!.text(), /event: run.completed/);
+  } finally {
+    await handler.close();
+  }
+  const bounded = runtime({ AI_PROVIDER_MAX_DURATION_SECONDS: "1" });
+  try {
+    const body = input();
+    body.userPrompt = "hold-timeout";
+    const start = await bounded(request("/api/agent/runs", "POST", body));
+    const run = (await start!.json()) as { eventsUrl: string };
+    const events = await bounded(request(run.eventsUrl));
+    assert.match(await events!.text(), /RUN_TIMEOUT/);
+  } finally {
+    await bounded.close();
+  }
+});
+test("one run cancellation does not interrupt a second DSH agent", async () => {
+  const handler = runtime();
+  try {
+    const body = input();
+    body.userPrompt = "hold-model";
+    const slow = await handler(
+      request("/api/agent/runs", "POST", body, "slow"),
+    );
+    const run = (await slow!.json()) as { runId: string; eventsUrl: string };
+    const slowEvents = await handler(request(run.eventsUrl));
+    const slowText = slowEvents!.text();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    await handler(
+      request(`/api/agent/runs/${run.runId}/cancel`, "POST", {
+        reason: "user",
+      }),
+    );
+    const second = await handler(
+      request("/api/agent/runs", "POST", input(), "other"),
+    );
+    const other = (await second!.json()) as { eventsUrl: string };
+    const events = await handler(request(other.eventsUrl));
+    assert.match(await slowText, /event: run.cancelled/);
+    assert.match(await events!.text(), /event: run.completed/);
+  } finally {
+    await handler.close();
+  }
+});
+test("native queues while leaving Client Agent capacity and cancellation releases the next waiter", async () => {
+  const handler = runtime({ AI_PROVIDER_MAX_CONCURRENT_RUNS: "2" }),
+    controller = new AbortController();
+  const nativeRequest = (content: string) =>
+    new Request("http://runtime/internal/boundary/v1/chat/completions", {
+      method: "POST",
+      body: JSON.stringify({
+        stream: true,
+        messages: [{ role: "user", content }],
+      }),
+    });
+  try {
+    const pending = handler.handleNativeCompletion(
+      nativeRequest("hold-model"),
+      {
+        actorId: "actor-one",
+        signal: controller.signal,
+      },
+    );
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    let admitted = false;
+    const queued = handler
+      .handleNativeCompletion(nativeRequest("normal"), {
+        actorId: "actor-two",
+        signal: AbortSignal.timeout(5000),
+      })
+      .then((response) => {
+        admitted = true;
+        return response;
+      });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    assert.equal(admitted, false);
+    const client = await handler(
+      request("/api/internal/client-agent/chat/completions", "POST", {
+        clientRunId: "client_reserved",
+        operationKey: "browser.query",
+        deploymentKey: "ai.openai-compatible",
+        modelAlias: "browser-default",
+        attempt: 1,
+        messages: [{ role: "user", content: "hello" }],
+        providerDataPolicy: {
+          inputFields: [],
+          envelopeFields: [
+            {
+              field: "user-prompt",
+              classification: "public",
+              dlpAction: "reject",
+            },
+          ],
+        },
+        maxResponseBytes: 1048576,
+      }),
+    );
+    assert.equal(client?.status, 200);
+    assert.match(await client!.text(), /event: windy.meta/);
+    assert.equal(providerParallelModes.at(-1), false);
+    assert.equal(admitted, false);
+    controller.abort();
+    await pending;
+    const response = await queued;
+    assert.equal(response.status, 200);
+    await response.text();
+    assert.equal(providerParallelModes.at(-1), true);
+  } finally {
+    controller.abort();
+    await handler.close();
+  }
+});
+test("native disabled capacity is reported as capacity refusal, while canonical still works", async () => {
+  const handler = runtime({ AI_PROVIDER_MAX_CONCURRENT_RUNS: "1" });
+  try {
+    const denied = await handler.handleNativeCompletion(
+      new Request("http://runtime/internal/boundary/v1/chat/completions", {
+        method: "POST",
+        body: JSON.stringify({
+          stream: true,
+          messages: [{ role: "user", content: "hello" }],
+        }),
+      }),
+      { actorId: "actor", signal: AbortSignal.timeout(5000) },
+    );
+    assert.equal(denied.status, 429);
+    const start = await handler(request("/api/agent/runs", "POST", input()));
+    const run = (await start!.json()) as { eventsUrl: string };
+    assert.match(
+      await (await handler(request(run.eventsUrl)))!.text(),
+      /event: run.completed/,
+    );
+  } finally {
+    await handler.close();
+  }
+});
+test("internal output is encrypted compatibly and excluded from public event/result", async () => {
+  const secret = "integration-only-internal-output-secret",
+    handler = runtime({ AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET: secret });
+  try {
+    const key = createHash("sha256").update(secret).digest(),
+      keyId = `sha256:${createHash("sha256")
+        .update(
+          Buffer.concat([
+            Buffer.from("windy-agent-internal-output-key-v1\0"),
+            key,
+          ]),
+        )
+        .digest("hex")}`;
+    const body = input();
+    body.outputPolicy = { visibility: "internal", encryptionKeyId: keyId };
+    const start = await handler(request("/api/agent/runs", "POST", body));
+    const run = (await start!.json()) as { runId: string; eventsUrl: string };
+    const events = await handler(request(run.eventsUrl));
+    assert.doesNotMatch(await events!.text(), /output.delta/);
+    const denied = await handler(
+      request(`/api/agent/runs/${run.runId}/result`),
+    );
+    assert.equal(denied?.status, 404);
+    const internal = request(`/api/agent/runs/${run.runId}/result`);
+    internal.headers.set("X-Windy-Output-Audience", "internal");
+    const response = await handler(internal);
+    const result = (await response!.json()) as {
+      output: { ciphertext: string };
+    };
+    const raw = Buffer.from(result.output.ciphertext, "base64url"),
+      decipher = createDecipheriv("aes-256-gcm", key, raw.subarray(0, 12));
+    decipher.setAAD(
+      Buffer.from(`windy-agent-internal-output-v1\0${keyId}\0${run.runId}`),
+    );
+    decipher.setAuthTag(raw.subarray(-16));
+    assert.deepEqual(
+      JSON.parse(
+        Buffer.concat([
+          decipher.update(raw.subarray(12, -16)),
+          decipher.final(),
+        ]).toString(),
+      ),
+      { answer: "完成" },
+    );
+  } finally {
+    await handler.close();
+  }
+});
+test("opaque artifact download normalizes image for actual DSH model turn and validates readiness pin", async () => {
+  const handler = runtime({
+    AI_ARTIFACT_URL: `${endpoint}/artifacts`,
+    AI_PROVIDER_CAPABILITIES:
+      "text-generation,vision,structured-output,tool-calling",
+    AI_PROVIDER_INPUT_MODALITIES: "text,image",
+    AI_PROVIDER_DEPLOYMENT_IDENTITY:
+      "windy-deployment-v1_12345678-1234-4123-8123-123456789012",
+    AI_PROVIDER_RELEASE_DIGEST: `sha256:${"a".repeat(64)}`,
+  });
+  try {
+    const health = await handler(request("/health/vlm-ready"));
+    assert.equal(health?.status, 200);
+    const snapshot = (await health!.json()) as { deployment: unknown };
+    const body = input();
+    body.inputModalities = ["text", "image"];
+    body.requiredCapabilities = ["vision"];
+    body.readinessPin = snapshot.deployment;
+    body.limits.maxArtifacts = 1;
+    body.limits.maxPixelsPerArtifact = 100000;
+    body.artifacts = [
+      {
+        value: "opaque-artifact",
+        mediaType: "image/png",
+        byteSize: probeImage.length,
+        sha256: createHash("sha256").update(probeImage).digest("hex"),
+      },
+    ];
+    body.providerDataPolicy.envelopeFields.push({
+      field: "artifact-content",
+      classification: "internal",
+      dlpAction: "reject",
+    });
+    const start = await handler(request("/api/agent/runs", "POST", body));
+    assert.equal(start?.status, 200);
+    const run = (await start!.json()) as { eventsUrl: string };
+    const events = await handler(request(run.eventsUrl));
+    const text = await events!.text();
+    assert.match(text, /event: run.completed/);
+    body.readinessPin = { key: "wrong" };
+    const denied = await handler(
+      request("/api/agent/runs", "POST", body, "invalid-pin"),
+    );
+    assert.equal(denied?.status, 503);
+  } finally {
+    await handler.close();
+  }
+});
+test("runtime store never persists execution grants", () => {
+  const store = new RuntimeStore(":memory:");
+  try {
+    const run = store.create(input(), "grant-test").run;
+    const row = store.db
+      .prepare("SELECT request FROM runs WHERE id=?")
+      .get(run.id) as { request: string };
+    assert.doesNotMatch(row.request, /test-grant/);
+    assert.equal(store.get(run.id).request.executionGrant, "test-grant");
+    store.event(run.id, "run.cancelled", {}, "cancelled");
+    assert.equal(store.get(run.id).request.executionGrant, "");
+  } finally {
+    store.close();
+  }
+});