create-windy 0.8.2 → 0.9.1

package/template/apps/server/src/agent-workflow/preset-routes.test.ts

@@ -0,0 +1,94 @@
+import { expect, test } from "bun:test";
+import { licenseVersionKey } from "@southwind-ai/shared";
+import { loadFoundationModules } from "../foundation.js";
+import { createServerRuntime } from "../runtime.js";
+import { createRequestGuardContext } from "../guards.js";
+import { FakeRouteApp } from "../system/route-test-app.js";
+import {
+  createManifestAuthorizedRouteApp,
+  createStaticRouteAuthorizer,
+} from "../module-host/static-route-authorization.js";
+import { AgentWorkflowPresetRegistry } from "./preset-registry.js";
+import { registerAgentWorkflowPresetRoutes } from "./preset-routes.js";
+
+function fixture(permitted = true) {
+  const modules = loadFoundationModules();
+  const runtime = createServerRuntime(
+    {},
+    {
+      featureCatalog: modules.flatMap((module) => module.features),
+    },
+  );
+  const app = new FakeRouteApp();
+  registerAgentWorkflowPresetRoutes(
+    createManifestAuthorizedRouteApp(
+      app,
+      createStaticRouteAuthorizer(runtime, modules),
+    ),
+    new AgentWorkflowPresetRegistry(modules),
+    runtime,
+    () => true,
+  );
+  const request = new Request("http://windy.test/api/agent/workflows/presets");
+  const context = createRequestGuardContext(request, {
+    resolveLicense: () => ({
+      versionKey: licenseVersionKey("advanced"),
+      status: "valid",
+      restricted: false,
+    }),
+    resolveActor: () => ({
+      id: "preset-reader",
+      type: "user",
+      name: "预设读取用户",
+      roleCodes: [],
+      permissionKeys: permitted ? ["system.agent-workflow.read"] : [],
+    }),
+  });
+  return {
+    runtime,
+    invoke: () =>
+      app.invoke("GET", "/agent/workflows/presets", {
+        request,
+        guardContext: context,
+      }) as Promise<Response>,
+  };
+}
+
+test("preset catalog records only its result count before returning", async () => {
+  const f = fixture();
+  const response = await f.invoke();
+  expect(response.status).toBe(200);
+  expect(await response.json()).toEqual({ items: [] });
+  const events = f.runtime.auditSink
+    .list()
+    .filter((event) => event.action === "agent.workflow.preset.read");
+  expect(events).toHaveLength(1);
+  expect(events[0]).toMatchObject({
+    actor: { id: "preset-reader" },
+    target: { type: "agent-workflow-presets", id: "catalog" },
+    metadata: { itemCount: 0 },
+  });
+});
+
+test("preset catalog audit failure returns no items or private failure", async () => {
+  const f = fixture();
+  f.runtime.auditSink.recordCriticalEvent = async () => {
+    throw new Error("private failure");
+  };
+  const response = await f.invoke();
+  expect(response.status).toBe(503);
+  expect(await response.json()).toEqual({
+    error: "AUDIT_UNAVAILABLE",
+    message: "预设目录审计暂不可用",
+  });
+});
+
+test("denied preset lookup records no successful read", async () => {
+  const f = fixture(false);
+  expect((await f.invoke()).status).toBe(403);
+  expect(
+    f.runtime.auditSink
+      .list()
+      .some((event) => event.action === "agent.workflow.preset.read"),
+  ).toBe(false);
+});

package/template/apps/server/src/agent-workflow/preset-routes.ts

@@ -0,0 +1,45 @@
+import type { RequestGuardContext } from "../guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/route-types.js";
+import type { AgentWorkflowPresetRegistry } from "./preset-registry.js";
+import { resourceEvent } from "../system/route-helpers.js";
+
+/** app 必须经 Manifest StaticRouteAuthorizer 包装，路由不提供发布或启动操作。 */
+export function registerAgentWorkflowPresetRoutes(
+  app: Pick<RouteApp, "get">,
+  registry: AgentWorkflowPresetRegistry,
+  runtime: Pick<
+    ReturnType<typeof createServerRuntime>,
+    "resolveFeature" | "recordDecisions" | "auditSink"
+  >,
+  runtimeAvailable: () => boolean,
+) {
+  app.get("/agent/workflows/presets", async (raw) => {
+    const { guardContext } = raw as { guardContext: RequestGuardContext };
+    const items = await registry.list(
+      guardContext,
+      runtime,
+      runtimeAvailable(),
+    );
+    try {
+      await runtime.auditSink.recordCriticalEvent(
+        resourceEvent(
+          guardContext,
+          "agent.workflow.preset.read",
+          "agent-workflow-presets",
+          "catalog",
+          { itemCount: items.length },
+        ),
+      );
+    } catch {
+      return Response.json(
+        { error: "AUDIT_UNAVAILABLE", message: "预设目录审计暂不可用" },
+        { status: 503, headers: { "cache-control": "no-store" } },
+      );
+    }
+    return Response.json(
+      { items },
+      { headers: { "cache-control": "no-store" } },
+    );
+  });
+}

package/template/apps/server/src/agent-workflow/query-service.ts

@@ -9,6 +9,7 @@ import type {
   AgentWorkflowRepository,
   AgentWorkflowRunSnapshot,
 } from "./repository.js";
+import { projectWorkflowRecording } from "./recording-projection.js";
 
 export class AgentWorkflowQueryService {
   constructor(private readonly repository: AgentWorkflowRepository) {}
@@ -80,6 +81,41 @@ export class AgentWorkflowQueryService {
     return this.requireRelease(releaseId);
   }
 
+  /** Explicit read port: all retry attempts remain facts; no scheduler or result writes. */
+  async recording(runId: string, context: RequestGuardContext) {
+    const snapshot = await this.requireAuthorizedSnapshot(runId, context);
+    const release = await this.requireRelease(snapshot.run.releaseId);
+    const events = await this.repository.readEvents({
+      runId,
+      afterSequence: 0,
+      limit: 1_000,
+    });
+    return {
+      recording: projectWorkflowRecording(snapshot, release.definition, events),
+      truncated: (events.at(-1)?.sequence ?? 0) < snapshot.headSequence,
+    };
+  }
+
+  async recordingsForSession(sessionId: string, context: RequestGuardContext) {
+    const access = currentAccess(context);
+    const candidates = await this.repository.listRunsForActor(
+      access.tenantId,
+      access.actorId,
+      access.scopeDigest,
+      200,
+    );
+    const matched = candidates.filter(({ run }) => run.sessionId === sessionId);
+    const recordings = await Promise.all(
+      matched.map(({ run }) => this.recording(run.runId, context)),
+    );
+    return {
+      items: recordings.map(({ recording }) => recording),
+      truncated:
+        candidates.length === 200 ||
+        recordings.some(({ truncated }) => truncated),
+    };
+  }
+
   async requireAuthorizedSnapshot(
     runId: string,
     context: RequestGuardContext,

package/template/apps/server/src/agent-workflow/recording-projection.contract.test.ts

@@ -0,0 +1,196 @@
+import { expect, test } from "bun:test";
+import type {
+  AgentWorkflowEventEnvelope,
+  AgentWorkflowNodeRun,
+  AgentWorkflowRun,
+} from "@southwind-ai/shared";
+import { projectWorkflowRecording } from "./recording-projection.js";
+
+test("Workflow recording preserves retry attempts, model Run correlation, branch, artifacts and cancellation order", () => {
+  const at = "2026-10-07T00:00:00Z";
+  const run: AgentWorkflowRun = {
+    runId: "workflow_1",
+    releaseId: "release_1",
+    tenantId: "tenant",
+    actorId: "actor-1",
+    routeKey: "workflow.read",
+    inputDigest: "digest",
+    inputReceipt: {
+      schemaKey: "input.v1",
+      value: null,
+      valueDigest: "digest",
+      recordedAt: at,
+    },
+    scopeDigest: "scope",
+    authorizationSnapshotDigest: "auth",
+    toolPolicyDigest: "tools",
+    workspacePolicyDigest: "workspace",
+    executionPolicyDigest: "execution",
+    status: "cancelled",
+    sessionId: "session_1",
+    parentRunId: "workflow_parent",
+    parentNodeRunId: "node_parent",
+    deadlineAt: at,
+    createdAt: at,
+    updatedAt: at,
+    version: 1,
+    budget: {
+      maxDurationSeconds: 60,
+      maxModelAttempts: 3,
+      maxToolCalls: 3,
+      maxSubagents: 1,
+      maxParallelism: 1,
+      maxInputTokens: 100,
+      maxOutputTokens: 100,
+      maxCostMicros: 100,
+    },
+    usage: {
+      durationMs: 2,
+      modelAttempts: 2,
+      toolCalls: 1,
+      subagents: 0,
+      inputTokens: { status: "unknown", reasonCode: "pending" },
+      outputTokens: { status: "unknown", reasonCode: "pending" },
+      cost: { status: "unknown", reasonCode: "pending" },
+    },
+  };
+  const node: AgentWorkflowNodeRun = {
+    nodeRunId: "node_1",
+    runId: "workflow_1",
+    nodeId: "model",
+    nodeType: "model",
+    status: "failed",
+    attempt: 1,
+    maxAttempts: 3,
+    idempotencyKey: "idempotency_1",
+    inputArtifacts: [],
+    outputArtifacts: [],
+    createdAt: at,
+    updatedAt: at,
+    version: 1,
+  };
+  const retried: AgentWorkflowNodeRun = {
+    ...node,
+    nodeRunId: "node_2",
+    previousNodeRunId: "node_1",
+    status: "completed",
+    attempt: 2,
+    resultReceipt: {
+      receiptId: "receipt_2",
+      nodeRunId: "node_2",
+      resultDigest: "digest",
+      selectedBranch: "has-records",
+      artifactIds: ["artifact_1"],
+      recordedAt: at,
+      smallResult: { secret: "not disclosed" },
+      executionEvidence: {
+        source: "agent-runtime-report",
+        agentRunId: "agent_run_2",
+        modelRouteKey: "route",
+        model: "model",
+        modelDeploymentDigest: "deployment",
+        modelConfigurationDigest: "config",
+      },
+    },
+  };
+  const events: AgentWorkflowEventEnvelope[] = [
+    {
+      schemaVersion: 1,
+      eventId: "event_1",
+      workflowRunId: "workflow_1",
+      sequence: 1,
+      occurredAt: at,
+      data: {
+        type: "workflow.node-retry-scheduled",
+        nodeRunId: "node_1",
+        nodeId: "model",
+      },
+    },
+    {
+      schemaVersion: 1,
+      eventId: "event_2",
+      workflowRunId: "workflow_1",
+      sequence: 2,
+      occurredAt: at,
+      data: {
+        type: "workflow.node-completed",
+        nodeRunId: "node_2",
+        nodeId: "model",
+      },
+    },
+    {
+      schemaVersion: 1,
+      eventId: "event_3",
+      workflowRunId: "workflow_1",
+      sequence: 3,
+      occurredAt: at,
+      data: {
+        type: "workflow.node-waiting",
+        nodeRunId: "node_approval",
+        nodeId: "approval",
+      },
+    },
+    {
+      schemaVersion: 1,
+      eventId: "event_4",
+      workflowRunId: "workflow_1",
+      sequence: 4,
+      occurredAt: at,
+      data: { type: "workflow.run-cancelled" },
+    },
+  ];
+  const projected = projectWorkflowRecording(
+    {
+      run,
+      idempotencyKey: "unique",
+      headSequence: 4,
+      recoveryCount: 0,
+      nodeRuns: [
+        node,
+        retried,
+        {
+          ...node,
+          nodeRunId: "node_approval",
+          nodeId: "approval",
+          nodeType: "approval",
+          status: "waiting",
+          adapter: {
+            kind: "approval-work-item",
+            coordinate: "work_item_approved_1",
+          },
+        },
+        {
+          ...node,
+          nodeRunId: "node_unsafe",
+          nodeId: "approval",
+          nodeType: "approval",
+          status: "waiting",
+          adapter: {
+            kind: "approval-work-item",
+            coordinate: "not a safe coordinate",
+          },
+        },
+      ],
+      sideEffects: [],
+    },
+    { workflowKey: "business.review", label: "业务复核" },
+    events,
+  );
+  expect(projected.nodes.slice(0, 2).map(({ attempt }) => attempt)).toEqual([
+    1, 2,
+  ]);
+  expect(projected.nodes[2]?.workItemId).toBe("work_item_approved_1");
+  expect(projected.events[2]?.workItemId).toBe("work_item_approved_1");
+  expect(projected.nodes[3]?.workItemId).toBeUndefined();
+  expect(projected.nodes[1]).toMatchObject({
+    previousNodeRunId: "node_1",
+    agentRunId: "agent_run_2",
+    selectedBranch: "has-records",
+    artifactIds: ["artifact_1"],
+  });
+  expect(projected.events.map(({ sequence }) => sequence)).toEqual([
+    1, 2, 3, 4,
+  ]);
+  expect(projected.parentRunId).toBe("workflow_parent");
+  expect(JSON.stringify(projected)).not.toContain("not disclosed");
+});

package/template/apps/server/src/agent-workflow/recording-projection.ts

@@ -0,0 +1,86 @@
+import type {
+  AgentWorkbenchEventV1,
+  AgentWorkbenchWorkflowV1,
+  AgentWorkflowEventEnvelope,
+} from "@southwind-ai/shared";
+import type { AgentWorkflowRunSnapshot } from "./repository.js";
+
+export function projectWorkflowRecording(
+  snapshot: AgentWorkflowRunSnapshot,
+  label: { workflowKey: string; label: string },
+  events: readonly AgentWorkflowEventEnvelope[],
+): AgentWorkbenchWorkflowV1 {
+  const run = snapshot.run;
+  const workItems = new Map(
+    snapshot.nodeRuns.flatMap((node) =>
+      node.adapter?.kind === "approval-work-item" &&
+      /^[A-Za-z0-9_.:-]{1,200}$/.test(node.adapter.coordinate)
+        ? [[node.nodeRunId, node.adapter.coordinate] as const]
+        : [],
+    ),
+  );
+  return {
+    workflowRunId: run.runId,
+    workflowKey: label.workflowKey,
+    title: label.label,
+    status: run.status,
+    ...(run.sessionId ? { sessionId: run.sessionId } : {}),
+    ...(run.parentRunId ? { parentRunId: run.parentRunId } : {}),
+    ...(run.parentNodeRunId ? { parentNodeRunId: run.parentNodeRunId } : {}),
+    nodes: snapshot.nodeRuns.map((node) => ({
+      nodeRunId: node.nodeRunId,
+      nodeId: node.nodeId,
+      type: node.nodeType,
+      status: node.status,
+      attempt: node.attempt,
+      ...(workItems.has(node.nodeRunId)
+        ? { workItemId: workItems.get(node.nodeRunId)! }
+        : {}),
+      ...(node.previousNodeRunId
+        ? { previousNodeRunId: node.previousNodeRunId }
+        : {}),
+      ...(node.resultReceipt?.executionEvidence
+        ? { agentRunId: node.resultReceipt.executionEvidence.agentRunId }
+        : {}),
+      ...(node.resultReceipt?.selectedBranch
+        ? { selectedBranch: node.resultReceipt.selectedBranch }
+        : {}),
+      artifactIds: [
+        ...new Set([
+          ...node.outputArtifacts.map(({ artifactId }) => artifactId),
+          ...(node.resultReceipt?.artifactIds ?? []),
+        ]),
+      ],
+    })),
+    events: events.map(
+      (event): AgentWorkbenchEventV1 => ({
+        sequence: event.sequence,
+        type: event.data.type,
+        summary: workflowEventLabel(event.data.type),
+        occurredAt: event.occurredAt,
+        workflowRunId: event.workflowRunId,
+        ...("nodeRunId" in event.data
+          ? { nodeRunId: event.data.nodeRunId }
+          : {}),
+        ...("nodeRunId" in event.data && workItems.has(event.data.nodeRunId)
+          ? { workItemId: workItems.get(event.data.nodeRunId)! }
+          : {}),
+        ...("childAgentRunId" in event.data && event.data.childAgentRunId
+          ? { runId: event.data.childAgentRunId }
+          : {}),
+        ...(event.data.type === "workflow.artifact-linked"
+          ? { artifactId: event.data.artifact.artifactId }
+          : {}),
+      }),
+    ),
+  };
+}
+
+function workflowEventLabel(type: string) {
+  if (type.includes("retry")) return "节点重试已记录";
+  if (type.includes("cancel")) return "取消事实已记录";
+  if (type.includes("recover")) return "恢复事实已记录";
+  if (type.includes("artifact")) return "交付件已关联";
+  if (type.includes("delegation")) return "子运行事实已记录";
+  return "工作流事实已记录";
+}

package/template/apps/server/src/ai-runtime-report/service.test.ts

@@ -23,18 +23,21 @@ const feature = {
 };
 
 describe("AI Runtime report service", () => {
-  test("部门范围详情越权统一返回 404", async () => {
+  test("旧引擎详情缺失与部门越权统一明确不可用且不泄露存在性", async () => {
     const runtime = createServerRuntime({}, { featureCatalog: [feature] });
     const remote = new FakeRemote();
     remote.detail = runDetail("department-other");
     const service = createService(runtime, remote);
 
-    await expect(service.run("run_1", context(true))).rejects.toEqual(
-      new AiRuntimeReportError(
-        "AI_RUNTIME_RUN_NOT_FOUND",
-        "Agent Run 不存在",
-        404,
-      ),
+    const expected = new AiRuntimeReportError(
+      "AI_RUNTIME_RUN_NOT_FOUND",
+      "运行详情不可用：记录不在当前范围、已过期或已随旧 Agent 数据重置",
+      404,
+    );
+    await expect(service.run("run_1", context(true))).rejects.toEqual(expected);
+    remote.detail = undefined;
+    await expect(service.run("retired_run", context(true))).rejects.toEqual(
+      expected,
     );
   });
 

package/template/apps/server/src/ai-runtime-report/service.ts

@@ -80,7 +80,7 @@ export class AiRuntimeReportService {
     if (!raw || !reportScopeAllows(scope, raw)) {
       throw new AiRuntimeReportError(
         "AI_RUNTIME_RUN_NOT_FOUND",
-        "Agent Run 不存在",
+        "运行详情不可用：记录不在当前范围、已过期或已随旧 Agent 数据重置",
         404,
       );
     }

package/template/apps/server/src/app/agent-workflow-presets.ts

@@ -0,0 +1,4 @@
+import type { AgentWorkflowPresetRegistration } from "../agent-workflow/preset-registry.js";
+/** Project-owned: registrations reference installed modules and their real business entrypoints. */
+export const projectAgentWorkflowPresets: readonly AgentWorkflowPresetRegistration[] =
+  [];