create-windy 0.8.2 → 0.9.1

package/template/apps/server/src/app/dsh-workbench.test.ts

@@ -0,0 +1,213 @@
+import { expect, test } from "bun:test";
+import { loadFoundationModules } from "../foundation.js";
+import { apiRouteKey } from "@southwind-ai/modules";
+import {
+  actorId,
+  dshFixture,
+  internalToken,
+} from "./dsh-workbench-test-support.js";
+
+test("real DSH entry resolves relative assets and transport under /agent/ from the bare URL", async () => {
+  const fixture = await dshFixture();
+  const upstreamHtml = await Bun.file(
+    Bun.resolveSync(
+      "@deepseek-ai/dsh-web-frontend/dist/index.html",
+      import.meta.dir,
+    ),
+  ).text();
+  fixture.state.probe = () =>
+    new Response(upstreamHtml, {
+      headers: { "content-type": "text/html" },
+    });
+  const response = await fixture.request("/agent/native/");
+  const html = await response.text();
+  const baseHref = html.match(/<base\s+href="([^"]+)"/i)?.[1];
+  expect(baseHref).toBe("/agent/");
+  expect(html.indexOf("<base")).toBeLessThan(
+    html.indexOf('<script type="module"'),
+  );
+  const documentBase = new URL(baseHref!, "https://windy.test/agent");
+  const resources = [...html.matchAll(/(?:src|href)="(\.\/[^"]+)"/g)].map(
+    (match) => match[1]!,
+  );
+  expect(resources.length).toBeGreaterThan(4);
+  for (const resource of [...resources, "api/remote.mux", "api/invoke"])
+    expect(new URL(resource, documentBase).pathname.startsWith("/agent/")).toBe(
+      true,
+    );
+});
+
+test("embedded readiness uses one Agent Server and returns only the same-origin mount", async () => {
+  const fixture = await dshFixture();
+  const response = await fixture.request();
+  expect(response.headers.get("cache-control")).toBe("no-store");
+  expect(await response.json()).toEqual({
+    status: "available",
+    path: "/agent/",
+  });
+  const request = fixture.state.probes[0]!;
+  expect(request.url).toBe(
+    "http://agent-runtime.test/internal/workbench-ready",
+  );
+  expect(request.headers.get("authorization")).toBe(`Bearer ${internalToken}`);
+  expect(request.headers.get("x-windy-actor-id")).toBe(actorId);
+  expect(request.headers.get("x-windy-product-session")).toBe(
+    fixture.login.token,
+  );
+  expect(request.headers.get("x-windy-public-origin")).toBe(
+    "https://windy.test",
+  );
+  expect(request.headers.has("cookie")).toBe(false);
+  expect(fixture.state.probes).toHaveLength(1);
+});
+
+test("readiness exposes only approved capacity and model reasons without internal details", async () => {
+  const fixture = await dshFixture();
+  for (const [code, reason] of [
+    ["WORKBENCH_CAPACITY_RESERVED", "capacity-reserved"],
+    ["MODEL_ROUTE_UNAVAILABLE", "model-unconfigured"],
+  ]) {
+    fixture.state.probe = () =>
+      Response.json(
+        {
+          ready: false,
+          code,
+          message: "internal model route",
+          endpoint: "http://private-model:8000",
+        },
+        { status: 503 },
+      );
+    expect(await (await fixture.request()).json()).toEqual({
+      status: "unavailable",
+      reason,
+    });
+  }
+  for (const [status, ready, code] of [
+    [503, false, "PRIVATE_PROVIDER_ERROR"],
+    [401, false, "WORKBENCH_CAPACITY_RESERVED"],
+    [503, true, "MODEL_ROUTE_UNAVAILABLE"],
+  ] as const) {
+    fixture.state.probe = () =>
+      Response.json({ ready, code, message: "private detail" }, { status });
+    expect(await (await fixture.request()).json()).toEqual({
+      status: "unavailable",
+    });
+  }
+});
+
+test("native HTTP preserves payload and removes forged identities and worker credentials", async () => {
+  const fixture = await dshFixture();
+  fixture.state.probe = () =>
+    new Response("native-frontend", {
+      headers: {
+        "content-type": "text/html",
+        "set-cookie": "native-secret=private",
+        "x-worker-token": "private",
+      },
+    });
+  const response = await fixture.request("/agent/native/", "GET", {
+    headers: {
+      "x-windy-actor-id": "user-b",
+      "x-windy-product-session": "forged",
+    },
+  });
+  expect(await response.text()).toBe("native-frontend");
+  expect(response.headers.has("set-cookie")).toBe(false);
+  expect(response.headers.has("x-worker-token")).toBe(false);
+  expect(fixture.state.probes[0]!.url).toBe(
+    "http://agent-runtime.test/internal/workbench/",
+  );
+  expect(fixture.state.probes[0]!.headers.get("x-windy-actor-id")).toBe(
+    actorId,
+  );
+  const payload = JSON.stringify({
+    endpoint: "sessions.create",
+    args: { title: "新会话" },
+  });
+  await fixture.request("/agent/native/api/invoke?transport=http", "POST", {
+    body: payload,
+  });
+  expect(await fixture.state.probes[1]!.text()).toBe(payload);
+  expect(fixture.state.probes[1]!.url).toBe(
+    "http://agent-runtime.test/internal/workbench/api/invoke?transport=http",
+  );
+});
+
+test("every registered native route has a canonical manifest permission, including WS handshake", async () => {
+  const fixture = await dshFixture();
+  const declared = new Map(
+    loadFoundationModules()
+      .flatMap(({ apiPermissions }) => apiPermissions)
+      .map((binding) => [apiRouteKey(binding), binding]),
+  );
+  for (const route of fixture.app.routes)
+    expect(
+      declared.get(
+        apiRouteKey({
+          ...route,
+          method: route.method === "WS" ? "GET" : route.method,
+        }),
+      ),
+    ).toMatchObject({
+      permissionKey: "system.agent-workbench.use",
+      featureKey: "system.agent-workbench",
+    });
+  expect(
+    fixture.app.routes.some(
+      ({ method, path }) =>
+        method === "WS" && path === "/api/agent/native/api/remote.mux",
+    ),
+  ).toBe(true);
+});
+
+test("permission, Feature and License changes block every role before reaching runtime", async () => {
+  const fixture = await dshFixture();
+  const requests = () =>
+    Promise.all([
+      fixture.request(),
+      fixture.request("/agent/workbench/admission"),
+      fixture.request("/agent/workbench/launch", "POST"),
+      fixture.request("/agent/native/"),
+      fixture.request("/agent/native/api/invoke", "POST", { body: "{}" }),
+    ]);
+  for (const role of ["member", "admin", "super-admin"]) {
+    fixture.state.roles = [role];
+    fixture.state.permissions = ["system.agent.read"];
+    for (const response of await requests()) expect(response.status).toBe(403);
+    fixture.state.permissions = [
+      "system.agent.read",
+      "system.agent-workbench.use",
+    ];
+    for (const feature of ["system.agent", "system.agent-workbench"]) {
+      fixture.state.disabledFeature = feature;
+      for (const response of await requests())
+        expect(response.status).toBe(403);
+    }
+    fixture.state.disabledFeature = "";
+    fixture.state.restricted = true;
+    for (const response of await requests()) expect(response.status).toBe(403);
+    fixture.state.restricted = false;
+  }
+  expect(fixture.state.probes).toEqual([]);
+});
+
+test("unavailable, malformed and redirecting readiness never advertise external destinations", async () => {
+  const fixture = await dshFixture();
+  for (const probe of [
+    () => Response.json({ ready: false }),
+    () => Response.json({ publicUrl: "https://elsewhere.test" }),
+    () => new Response("bad"),
+    () => new Response(null, { status: 503 }),
+  ]) {
+    fixture.state.probe = probe;
+    expect(await (await fixture.request()).json()).toEqual({
+      status: "unavailable",
+    });
+  }
+  fixture.state.probe = () =>
+    new Response(null, {
+      status: 302,
+      headers: { location: "https://evil.test/?token=private" },
+    });
+  expect((await fixture.request("/agent/native/")).status).toBe(502);
+});

package/template/apps/server/src/app/dsh-workbench.ts

@@ -0,0 +1,279 @@
+import type { ModuleManifest } from "@southwind-ai/modules";
+import { publicOriginFromEnvironment } from "./workbench-public-origin.js";
+import type { AuthRepository } from "../auth/repository.js";
+import { evaluateAccessGuards } from "../access-guards.js";
+import type { RequestGuardContext } from "../guards.js";
+import { createStaticRouteAuthorizer } from "../module-host/static-route-authorization.js";
+import { findFeature } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/route-types.js";
+import { currentDshProductSession } from "./dsh-workbench-session.js";
+import { auditDshWorkbenchAdmission } from "./dsh-workbench-audit.js";
+import { dshSkillDraftCompletionEvent } from "./dsh-skill-draft-audit.js";
+import {
+  DSH_NATIVE_REQUEST_TIMEOUT_SECONDS,
+  dshInternalHeaders,
+  dshInternalTarget,
+  dshJson,
+  isDshNativeDocument,
+  isDshSkillRequest,
+  proxyDshNative,
+  type DshWorkbenchOptions,
+} from "./dsh-workbench-proxy.js";
+import {
+  registerDshWorkbenchSocket,
+  type DshAuthorization,
+} from "./dsh-workbench-socket.js";
+
+export type { DshWorkbenchOptions } from "./dsh-workbench-proxy.js";
+
+/** The product owns login/RBAC/License; Agent Server owns isolated native runtimes. */
+export function registerDshWorkbenchRoutes(input: {
+  readonly app: RouteApp;
+  readonly modules: readonly ModuleManifest[];
+  readonly runtime: ReturnType<typeof createServerRuntime>;
+  readonly authRepository: AuthRepository;
+  readonly sessionCookieName?: string;
+  readonly publicOrigin?: string;
+  readonly options?: DshWorkbenchOptions;
+  readonly enabled?: boolean;
+}): void {
+  const options = input.options ?? {};
+  const socketAdmissions = new WeakMap<
+    RequestGuardContext,
+    Promise<Response | undefined>
+  >();
+  const authorizer = createStaticRouteAuthorizer(input.runtime, input.modules);
+  const copilot = findFeature(
+    input.modules.flatMap(({ features }) => features),
+    "system.agent-workbench",
+  );
+  const configuredOrigin = input.publicOrigin ?? publicOriginFromEnvironment();
+  const publicOrigin = (request: Request) =>
+    configuredOrigin ?? new URL(request.url).origin;
+  const authorize: DshAuthorization = async (
+    raw,
+    method,
+    path,
+    websocket = false,
+  ) => {
+    const { request, guardContext } = raw as {
+      request: Request;
+      guardContext: RequestGuardContext;
+    };
+    if (input.enabled === false)
+      return dshJson({ error: "AGENT_UNAVAILABLE" }, 503);
+    const origin = request.headers.get("origin");
+    const site = request.headers.get("sec-fetch-site");
+    const pathname = new URL(request.url).pathname;
+    // An external link is a safe document navigation, not a cross-site API call.
+    const entryNavigation =
+      method === "GET" &&
+      !websocket &&
+      ["/api/agent/native", "/api/agent/native/"].includes(pathname) &&
+      request.headers.get("sec-fetch-mode") === "navigate" &&
+      request.headers.get("sec-fetch-dest") === "document";
+    if (
+      (origin && origin !== publicOrigin(request)) ||
+      (site === "cross-site" && !entryNavigation) ||
+      ((method !== "GET" || websocket) && origin !== publicOrigin(request))
+    )
+      return dshJson({ error: "INVALID_ORIGIN" }, 403);
+    const session = await currentDshProductSession({
+      request,
+      actorId: guardContext.actor.id,
+      repository: input.authRepository,
+      cookieName: input.sessionCookieName ?? "windy.sid",
+      now: (options.now ?? Date.now)(),
+    });
+    if (!session) return dshJson({ error: "UNAUTHENTICATED" }, 401);
+    const denied = await authorizer.authorize(guardContext, method, path);
+    if (denied) return denied;
+    const current = await input.runtime.createGuardContextForActor(
+      request,
+      session.actor,
+    );
+    const currentDenied = await authorizer.authorize(current, method, path);
+    if (currentDenied) return currentDenied;
+    if (!copilot) return dshJson({ error: "FORBIDDEN" }, 403);
+    const access = await evaluateAccessGuards(input.runtime, current, {
+      permission: { permissionKey: "system.agent-workbench.use" },
+      feature: copilot,
+    });
+    if (!access.decision.allowed)
+      return dshJson(
+        { error: "FORBIDDEN", reason: access.decision.reason },
+        403,
+      );
+    if (
+      websocket &&
+      request.headers.get("upgrade")?.toLowerCase() === "websocket"
+    ) {
+      // The socket relay retains this request context for later authorization.
+      let audit = socketAdmissions.get(guardContext);
+      if (!audit) {
+        audit = auditDshWorkbenchAdmission({
+          runtime: input.runtime,
+          context: guardContext,
+          actor: session.actor,
+          kind: "websocket",
+        });
+        socketAdmissions.set(guardContext, audit);
+      }
+      const auditDenied = await audit;
+      if (auditDenied) return auditDenied;
+    }
+    return session;
+  };
+  for (const [method, path] of [
+    ["GET", "/agent/workbench"],
+    ["GET", "/agent/workbench/admission"],
+    ["GET", "/agent/workbench/skills"],
+    ["POST", "/agent/workbench/launch"],
+  ] as const) {
+    const handler = async (raw: unknown) => {
+      try {
+        const { request, guardContext } = raw as {
+          request: Request;
+          guardContext: RequestGuardContext;
+        };
+        const session = await authorize(raw, method, `/api${path}`);
+        if (session instanceof Response) return session;
+        if (new URL(request.url).search)
+          return dshJson({ error: "INVALID_REQUEST" }, 400);
+        if (method === "POST" && path.endsWith("/launch")) {
+          const auditDenied = await auditDshWorkbenchAdmission({
+            runtime: input.runtime,
+            context: guardContext,
+            actor: session.actor,
+            kind: "launch",
+          });
+          if (auditDenied) return auditDenied;
+        }
+        if (path.endsWith("/skills")) {
+          if (!options.publishedSkills)
+            return dshJson({ error: "SKILL_UNAVAILABLE" }, 503);
+          const current = await input.runtime.createGuardContextForActor(
+            request,
+            session.actor,
+          );
+          return dshJson(await options.publishedSkills(current));
+        }
+        if (path.endsWith("/admission")) {
+          return dshJson({ actor: session.actor });
+        }
+        const signal = AbortSignal.any([
+          request.signal,
+          AbortSignal.timeout(3_000),
+        ]);
+        const response = await (options.fetcher ?? fetch)(
+          dshInternalTarget(options, "/internal/workbench-ready"),
+          {
+            headers: dshInternalHeaders(
+              options,
+              session,
+              publicOrigin(request),
+              new Headers(),
+            ),
+            signal,
+            redirect: "error",
+          },
+        );
+        const result: unknown = await response.json();
+        if (!response.ok) {
+          const code =
+            response.status === 503 &&
+            result &&
+            typeof result === "object" &&
+            "ready" in result &&
+            result.ready === false &&
+            "code" in result
+              ? result.code
+              : undefined;
+          const reason =
+            code === "WORKBENCH_CAPACITY_RESERVED"
+              ? "capacity-reserved"
+              : code === "MODEL_ROUTE_UNAVAILABLE"
+                ? "model-unconfigured"
+                : undefined;
+          return dshJson({
+            status: "unavailable",
+            ...(reason ? { reason } : {}),
+          });
+        }
+        return dshJson(
+          result &&
+            typeof result === "object" &&
+            "ready" in result &&
+            result.ready === true
+            ? { status: "available", path: "/agent/" }
+            : { status: "unavailable" },
+        );
+      } catch {
+        return dshJson({ status: "unavailable" });
+      }
+    };
+    if (method === "POST") input.app.post(path, handler);
+    else input.app.get(path, handler);
+  }
+  for (const method of ["GET", "POST"] as const) {
+    for (const path of ["/agent/native", "/agent/native/*"]) {
+      const handler = async (raw: unknown) => {
+        try {
+          const { request, guardContext, server } = raw as {
+            request: Request;
+            guardContext: RequestGuardContext;
+            server?: {
+              timeout(request: Request, seconds: number): void;
+            } | null;
+          };
+          // Only the entry document may wait for a cold worker; the proxy's
+          // 75s deadline still returns a controlled failure before this expires.
+          if (isDshNativeDocument(request))
+            server?.timeout(request, DSH_NATIVE_REQUEST_TIMEOUT_SECONDS);
+          // Skill assistance may spend up to 90s on one bounded model call.
+          if (isDshSkillRequest(request)) server?.timeout(request, 110);
+          const session = await authorize(raw, method, `/api${path}`);
+          if (session instanceof Response) return session;
+          if (isDshNativeDocument(request)) {
+            const auditDenied = await auditDshWorkbenchAdmission({
+              runtime: input.runtime,
+              context: guardContext,
+              actor: session.actor,
+              kind: "entry",
+            });
+            if (auditDenied) return auditDenied;
+          }
+          return await proxyDshNative({
+            request,
+            session,
+            publicOrigin: publicOrigin(request),
+            options,
+            completeSkillDraft: async () => {
+              request.signal.throwIfAborted();
+              const current = await authorize(raw, method, `/api${path}`);
+              if (current instanceof Response) return current;
+              request.signal.throwIfAborted();
+              await input.runtime.auditSink.recordCriticalEvent(
+                dshSkillDraftCompletionEvent(
+                  current.actor,
+                  crypto.randomUUID(),
+                ),
+              );
+            },
+          });
+        } catch {
+          return dshJson({ error: "AGENT_UNAVAILABLE" }, 503);
+        }
+      };
+      if (method === "POST") input.app.post(path, handler, { parse: "none" });
+      else input.app.get(path, handler);
+    }
+  }
+  registerDshWorkbenchSocket({
+    app: input.app,
+    authorize,
+    publicOrigin,
+    options,
+  });
+}

package/template/apps/server/src/app/workbench-public-origin.ts

@@ -0,0 +1,16 @@
+/** Only deployment configuration may establish an external HTTPS origin. */
+export function publicOriginFromEnvironment(): string | undefined {
+  const value = process.env.WINDY_PUBLIC_BASE_URL?.trim();
+  if (!value) return;
+  const url = new URL(value);
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.pathname !== "/" ||
+    url.search ||
+    url.hash
+  )
+    throw new Error("Invalid WINDY_PUBLIC_BASE_URL");
+  return url.origin;
+}

package/template/apps/server/src/data-governance/user-plaintext-routes.test.ts

@@ -33,6 +33,9 @@ describe("用户敏感字段 API", () => {
   test("read 或客户端伪造上下文不能调用明文路由", async () => {
     const { app, guardContext, repositories } = await fixture();
     await addSensitiveValues(repositories, guardContext.actor);
+    expect(guardContext.actor.permissionKeys).not.toContain(
+      "system.user.reveal",
+    );
 
     const denied = (await app.invoke("GET", "/system/users/:id/plaintext", {
       guardContext,

package/template/apps/server/src/http-app.ts

@@ -1,3 +1,6 @@
+// @windy-module system.audit begin
+import { createDiagnosticFailureRecorder } from "./observability/diagnostic-failure-recorder.js";
+// @windy-module system.audit end
 import { swagger } from "@elysiajs/swagger";
 import { Elysia } from "elysia";
 import type { RequestGuardContext } from "./guards.js";
@@ -19,6 +22,9 @@ export function createPlatformHttpApp(
   runtime: ServerRuntime,
   observability: PlatformObservability,
 ) {
+  // @windy-module system.audit begin
+  const failures = createDiagnosticFailureRecorder(observability.diagnostics);
+  // @windy-module system.audit end
   const requestStates = new WeakMap<Request, HttpRequestState>();
   return (
     new Elysia({ prefix: "/api" })
@@ -53,6 +59,31 @@ export function createPlatformHttpApp(
         restrictedRequestResponse(runtime, guardContext, request),
       )
       // @windy-module system.license end
+      // @windy-module system.audit begin
+      .mapResponse(async ({ request, responseValue, set, route }) => {
+        const state = requestStates.get(request);
+        if (!state) return;
+        const receipt = await failures.capture({
+          request,
+          requestId: state.guardContext.requestId,
+          route,
+          responseValue,
+          status: set.status,
+        });
+        if (receipt) {
+          set.headers["x-diagnostic-id"] = receipt.diagnosticId;
+          if (responseValue instanceof Response) {
+            const headers = new Headers(responseValue.headers);
+            headers.set("x-diagnostic-id", receipt.diagnosticId);
+            return new Response(responseValue.body, {
+              status: responseValue.status,
+              statusText: responseValue.statusText,
+              headers,
+            });
+          }
+        }
+      })
+      // @windy-module system.audit end
       .onAfterResponse(({ request, responseValue, set }) => {
         const state = requestStates.get(request);
         if (!state) return;

package/template/apps/server/src/mcp/adapter.ts

@@ -144,6 +144,7 @@ function toMcpTool(tool: RegisteredTool): Tool {
     title: tool.label,
     description: tool.description,
     inputSchema: toMcpSchema(tool.inputSchema),
+    _meta: { "windy/moduleKey": tool.module },
     outputSchema: toMcpSchema(tool.outputSchema),
     annotations: {
       title: tool.label,

package/template/apps/server/src/module-composition.test.ts

@@ -5,6 +5,29 @@ import { Elysia } from "elysia";
 import { validateServerModuleComposition } from "./module-composition.js";
 
 describe("Server Module Composition", () => {
+  test("WebSocket 实际注册以 GET 握手校验，未知 Socket 仍拒绝", () => {
+    const path = "/api/auth/users/:id/password";
+    const module = fixture();
+    module.apiPermissions[0]!.method = "GET";
+    const app = new Elysia({ prefix: "/api" }).ws("/auth/users/:id/password", {
+      message() {},
+    });
+    expect(app.routes[0]!.method).toBe("WS");
+    expect(() =>
+      validateServerModuleComposition({
+        modules: [module],
+        routes: app.routes,
+      }),
+    ).not.toThrow();
+    expect(() =>
+      validateServerModuleComposition({
+        modules: [module],
+        routes: [...app.routes, { method: "WS", path: "/api/unregistered" }],
+      }),
+    ).toThrow("HTTP Route 已注册但未在 Manifest 声明：GET /api/unregistered");
+    expect(app.routes[0]!.path).toBe(path);
+  });
+
   test("以 Elysia 实际注册路由作为 API Handler 事实源", () => {
     const app = new Elysia({ prefix: "/api" }).post(
       "/auth/users/:id/password",

package/template/apps/server/src/module-composition.ts

@@ -38,13 +38,20 @@ export interface ServerCompositionInput {
 export function validateServerModuleComposition(
   input: ServerCompositionInput,
 ): void {
+  // Elysia 将升级路由记为 WS；权限绑定使用真实 HTTP 握手方法 GET。
+  const apiRoutes = input.routes.map((route) =>
+    apiRouteKey({
+      ...route,
+      method: route.method.toUpperCase() === "WS" ? "GET" : route.method,
+    }),
+  );
   validateHttpRouteRegistration(
     input.modules,
-    input.routes.map(apiRouteKey),
+    apiRoutes,
     input.frameworkRoutes ?? [],
   );
   validateModuleComposition(input.modules, {
-    apiRoutes: input.routes.map(apiRouteKey),
+    apiRoutes,
     tasks: (input.tasks || []).map(({ key }) => key),
     tools: [...(input.tools?.keys() || [])],
     aiOperations: input.aiOperations,

package/template/apps/server/src/observability/bootstrap.ts

@@ -1,3 +1,9 @@
+// @windy-module system.audit begin
+import {
+  createDiagnosticIndex,
+  type DiagnosticIndex,
+} from "./diagnostic-index.js";
+// @windy-module system.audit end
 import type { AuditWriteStatus } from "../audit/contracts.js";
 import type { FeatureManifestSyncResult } from "../feature/manifest-feature-repository.js";
 import type { RouteApp } from "../system/route-types.js";
@@ -12,6 +18,9 @@ import { registerObservabilityRoutes } from "./routes.js";
 export interface PlatformObservabilityOptions {
   databaseCheck?: () => Promise<void>;
   databaseRequired: boolean;
+  // @windy-module system.audit begin
+  diagnosticIndex?: DiagnosticIndex;
+  // @windy-module system.audit end
   auditStatus(): AuditWriteStatus;
   logger: StructuredRequestLogger;
 }
@@ -25,6 +34,9 @@ export function createPlatformObservability(
   return {
     http,
     metrics,
+    // @windy-module system.audit begin
+    diagnostics: options.diagnosticIndex ?? createDiagnosticIndex(),
+    // @windy-module system.audit end
     register(app: Pick<RouteApp, "get">) {
       registerObservabilityRoutes(app, readiness, metrics);
     },