create-windy 0.8.2 → 0.9.1

package/template/packages/database/drizzle/meta/_journal.json

@@ -449,6 +449,13 @@
       "when": 1789011354550,
       "tag": "0063_license_project_lifecycle",
       "breakpoints": true
+    },
+    {
+      "idx": 64,
+      "version": "7",
+      "when": 1793213711851,
+      "tag": "0064_dsh_skills_diagnostics",
+      "breakpoints": true
     }
   ]
 }

package/template/packages/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/database",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "dependencies": {
-    "@southwind-ai/shared": "workspace:^0.3.0",
+    "@southwind-ai/shared": "workspace:^0.3.2",
     "drizzle-orm": "^0.45.2"
   },
   "exports": {

package/template/packages/database/src/schema/agent-skills.ts

@@ -0,0 +1,65 @@
+import {
+  boolean,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  timestamp,
+  varchar,
+} from "drizzle-orm/pg-core";
+import type {
+  AgentSkillBundle,
+  AgentSkillVersion,
+  AuditEvent,
+} from "@southwind-ai/shared";
+
+export const agentSkillVersions = pgTable(
+  "agent_skill_versions",
+  {
+    tenantId: varchar("tenant_id", { length: 64 }).notNull(),
+    skillKey: varchar("skill_key", { length: 64 }).notNull(),
+    version: integer("version").notNull(),
+    metadata: jsonb("metadata").$type<AgentSkillVersion>().notNull(),
+    bundle: jsonb("bundle").$type<AgentSkillBundle>().notNull(),
+    auditCommitted: boolean("audit_committed").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.tenantId, table.skillKey, table.version] }),
+    index("idx_agent_skill_catalog").on(
+      table.tenantId,
+      table.auditCommitted,
+      table.skillKey,
+    ),
+  ],
+);
+
+export const agentSkillMutations = pgTable(
+  "agent_skill_mutations",
+  {
+    tenantId: varchar("tenant_id", { length: 64 }).notNull(),
+    actorId: varchar("actor_id", { length: 64 }).notNull(),
+    idempotencyKey: varchar("idempotency_key", { length: 160 }).notNull(),
+    requestDigest: varchar("request_digest", { length: 71 }).notNull(),
+    skillKey: varchar("skill_key", { length: 64 }).notNull(),
+    version: integer("version").notNull(),
+    result: jsonb("result").$type<AgentSkillVersion>().notNull(),
+    audit: jsonb("audit").$type<AuditEvent>().notNull(),
+    auditCommitted: boolean("audit_committed").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (table) => [
+    primaryKey({
+      columns: [table.tenantId, table.actorId, table.idempotencyKey],
+    }),
+    index("idx_agent_skill_audit_pending").on(
+      table.auditCommitted,
+      table.createdAt,
+    ),
+  ],
+);

package/template/packages/database/src/schema/diagnostics.ts

@@ -0,0 +1,27 @@
+import {
+  index,
+  integer,
+  pgTable,
+  timestamp,
+  varchar,
+} from "drizzle-orm/pg-core";
+
+export const diagnosticEvents = pgTable(
+  "diagnostic_events",
+  {
+    diagnosticId: varchar("diagnostic_id", { length: 41 }).primaryKey(),
+    requestId: varchar("request_id", { length: 160 }).notNull(),
+    occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    service: varchar("service", { length: 24 }).notNull(),
+    stage: varchar("stage", { length: 24 }).notNull(),
+    method: varchar("method", { length: 16 }).notNull(),
+    route: varchar("route", { length: 256 }).notNull(),
+    statusCode: integer("status_code").notNull(),
+    errorCode: varchar("error_code", { length: 80 }).notNull(),
+  },
+  (table) => [
+    index("idx_diagnostic_events_expiry").on(table.expiresAt),
+    index("idx_diagnostic_events_request").on(table.requestId),
+  ],
+);

package/template/packages/database/src/schema/index.ts

@@ -44,3 +44,11 @@ export * from "./client-agent-workflow-artifact.js";
 export * from "./embedding-runtime.js";
 export * from "./ai-output-artifacts.js";
 // @windy-module system.agent end
+
+// @windy-module system.agent begin
+export * from "./agent-skills.js";
+// @windy-module system.agent end
+
+// @windy-module system.audit begin
+export * from "./diagnostics.js";
+// @windy-module system.audit end

package/template/packages/modules/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/modules",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {

package/template/packages/modules/src/ai-operation-composition.ts

@@ -57,6 +57,15 @@ function validateOperation(
   operation: ModuleAiOperationDefinition,
   catalogs: AiOperationCatalogs,
 ): void {
+  if (
+    operation.visibility !== undefined &&
+    operation.visibility !== "public" &&
+    operation.visibility !== "internal"
+  ) {
+    throw new Error(
+      `AI Operation ${operation.key} visibility 必须为 public 或 internal`,
+    );
+  }
   const strings = [
     operation.key,
     operation.featureKey,

package/template/packages/modules/src/ai-operation-visibility.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test";
+import type { ModuleAiOperationDefinition } from "./manifest.js";
+import { validateModuleComposition } from "./composition.js";
+import { fixture, operation } from "./ai-operation-composition.test-support.js";
+
+describe("AI Operation browser visibility", () => {
+  test.each([undefined, "public", "internal"] as const)(
+    "Explicit %s keeps canonical registration compatible",
+    (visibility) => {
+      const module = fixture("business");
+      module.aiOperations = [
+        {
+          ...operation("business.generate"),
+          ...(visibility ? { visibility } : {}),
+        },
+      ];
+      expect(() => validateModuleComposition([module])).not.toThrow();
+    },
+  );
+
+  test("Unknown visibility fails closed instead of becoming public", () => {
+    const module = fixture("business");
+    module.aiOperations = [
+      {
+        ...operation("business.generate"),
+        visibility: "private",
+      } as unknown as ModuleAiOperationDefinition,
+    ];
+    expect(() => validateModuleComposition([module])).toThrow(
+      "visibility 必须为 public 或 internal",
+    );
+  });
+});

package/template/packages/modules/src/manifest.ts

@@ -234,6 +234,8 @@ export interface AiScreenshotContextBindingV1 {
 export interface ModuleAiOperationDefinition {
   key: string;
   kind: AiOperationKind;
+  /** internal Operation 仅供可信服务端编排，不暴露普通 Agent Run API。 */
+  visibility?: "public" | "internal";
   featureKey: string;
   permissionKey: string;
   auditAction: AuditActionType;

package/template/packages/modules/src/system-admin-routes.ts

@@ -120,8 +120,32 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     "system.audit.read",
     "system.audit",
   ),
+  route(
+    "system.diagnostics",
+    "/admin/system/diagnostics",
+    "错误诊断",
+    "sidebar",
+    "system.diagnostics.read",
+    "system.diagnostics",
+  ),
   // @windy-module system.audit end
   // @windy-module system.agent begin
+  route(
+    "system.agent-tools",
+    "/admin/system/agent-tools",
+    "Agent 工具目录",
+    "sidebar",
+    "system.agent-tools.read",
+    "system.agent-tools",
+  ),
+  route(
+    "system.agent-debug",
+    "/admin/system/agent-debug",
+    "Agent 调试工作台",
+    "sidebar",
+    "system.agent-debug.read",
+    "system.agent-debug",
+  ),
   route(
     "system.agent-session",
     "/admin/system/agent-sessions",
@@ -146,6 +170,22 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     "system.agent-workflow.read",
     "system.agent-workflow",
   ),
+  route(
+    "system.agent-skill",
+    "/admin/system/agent-skills",
+    "Agent 技能",
+    "sidebar",
+    "system.agent-skill.read",
+    "system.agent-skill",
+  ),
+  route(
+    "system.agent-workbench",
+    "/admin/system/agent-workbench",
+    "Agent 原生工作台",
+    "sidebar",
+    "system.agent-workbench.use",
+    "system.agent-workbench",
+  ),
   // @windy-module system.agent end
   // @windy-module system.operations begin
   route(

package/template/packages/modules/src/system-admin-ui-catalog.ts

@@ -25,7 +25,7 @@ const definitions = [
   ["system.license", ["system.license"]],
   // @windy-module system.license end
   // @windy-module system.audit begin
-  ["system.audit", ["system.audit"]],
+  ["system.audit", ["system.audit", "system.diagnostics"]],
   // @windy-module system.audit end
   // @windy-module system.storage begin
   ["system.storage", []],
@@ -33,7 +33,15 @@ const definitions = [
   // @windy-module system.agent begin
   [
     "system.agent",
-    ["system.agent-session", "system.ai-runtime", "system.agent-workflow"],
+    [
+      "system.agent-tools",
+      "system.agent-debug",
+      "system.agent-skill",
+      "system.agent-workbench",
+      "system.agent-session",
+      "system.ai-runtime",
+      "system.agent-workflow",
+    ],
   ],
   // @windy-module system.agent end
   // @windy-module system.operations begin
@@ -67,13 +75,18 @@ const versionByName = new Map(
 );
 
 export function systemAdminUiManifests(): AdminUiManifest[] {
-  return definitions.map(([name, routeKeys]) => ({
-    name,
-    version: versionByName.get(name) ?? "0.1.0",
-    adminRoutes: routeKeys.map((key) => {
-      const route = routeByKey.get(key);
-      if (!route) throw new Error(`系统 Admin Route 未定义：${key}`);
-      return { ...route };
-    }),
-  }));
+  return definitions.map(([name, routeKeys]) => {
+    const selected = new Set<string>(routeKeys);
+    for (const key of selected) {
+      if (!routeByKey.has(key))
+        throw new Error(`系统 Admin Route 未定义：${key}`);
+    }
+    return {
+      name,
+      version: versionByName.get(name) ?? "0.1.0",
+      adminRoutes: systemAdminRoutes
+        .filter(({ key }) => selected.has(key))
+        .map((route) => ({ ...route })),
+    };
+  });
 }

package/template/packages/modules/src/system-agent-admin-bindings.ts

@@ -0,0 +1,44 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { dshApiBindings } from "./system-agent-dsh.js";
+import { binding } from "./system-api-binding.js";
+
+export function systemAgentAdminBindings(): ApiPermissionBinding[] {
+  return [
+    ...dshApiBindings(),
+    binding(
+      "GET",
+      "/api/agent/admin/tools",
+      "system.agent-tools.read",
+      "system.agent-tools",
+      "system.agent-tools.read",
+    ),
+    binding(
+      "GET",
+      "/api/agent/admin/operations",
+      "system.agent-debug.read",
+      "system.agent-debug",
+      "system.agent-debug.read",
+    ),
+    binding(
+      "GET",
+      "/api/agent/admin/session-recordings",
+      "system.agent-debug.read",
+      "system.agent-debug",
+      "agent.debug.recording.read",
+    ),
+    binding(
+      "GET",
+      "/api/agent/admin/session-recordings/:sessionId",
+      "system.agent-debug.read",
+      "system.agent-debug",
+      "agent.debug.recording.replay",
+    ),
+    binding(
+      "POST",
+      "/api/agent/admin/test-sessions",
+      "system.agent-debug.manage",
+      "system.agent-debug",
+      "agent.debug.session.create",
+    ),
+  ];
+}

package/template/packages/modules/src/system-agent-admin-menus.ts

@@ -0,0 +1,46 @@
+import type { ModuleManifest } from "./manifest.js";
+
+export const systemAgentAdminMenus: ModuleManifest["menus"] = [
+  {
+    key: "system.agent-tools",
+    title: "Agent 工具目录",
+    type: "menu",
+    order: 12,
+    visible: true,
+    path: "/admin/system/agent-tools",
+    icon: "wrench",
+    permissionKey: "system.agent-tools.read",
+    featureKey: "system.agent-tools",
+  },
+  {
+    key: "system.agent-debug",
+    title: "Agent 调试工作台",
+    type: "menu",
+    order: 13,
+    visible: true,
+    path: "/admin/system/agent-debug",
+    icon: "flask-conical",
+    permissionKey: "system.agent-debug.read",
+    featureKey: "system.agent-debug",
+  },
+  ...[
+    [
+      "system.agent-workbench",
+      "Agent 原生工作台",
+      "agent-workbench",
+      "use",
+      "messages-square",
+    ],
+    ["system.agent-skill", "Agent 技能", "agent-skills", "read", "library"],
+  ].map(([key, title, path, action, icon], order) => ({
+    key: key!,
+    title: title!,
+    path: `/admin/system/${path}`,
+    type: "menu" as const,
+    visible: true,
+    order: order + 14,
+    icon,
+    permissionKey: `${key}.${action}`,
+    featureKey: key,
+  })),
+];

package/template/packages/modules/src/system-agent-admin-registration.test.ts

@@ -0,0 +1,52 @@
+import { expect, test } from "bun:test";
+import { systemFoundationModule } from "./system-modules.js";
+import { systemModuleManifests } from "./system-module-catalog.js";
+
+// @windy-module system.agent begin
+test("Agent 工作台能力在菜单、路由、API、审计和模块分片一致注册", () => {
+  const manifest = systemFoundationModule();
+  const menus = manifest.menus.flatMap((menu) => menu.children ?? []);
+  for (const key of ["system.agent-tools", "system.agent-debug"]) {
+    expect(manifest.features.some((feature) => feature.key === key)).toBe(true);
+    expect(
+      manifest.permissions.some(
+        ({ key: permission }) => permission === `${key}.read`,
+      ),
+    ).toBe(true);
+    expect(menus.find((menu) => menu.key === key)).toMatchObject({
+      featureKey: key,
+      permissionKey: `${key}.read`,
+    });
+    expect(
+      manifest.adminRoutes.find((route) => route.key === key),
+    ).toMatchObject({ featureKey: key, permissionKey: `${key}.read` });
+  }
+  const bindings = manifest.apiPermissions.filter(({ path }) =>
+    path.startsWith("/api/agent/admin/"),
+  );
+  expect(bindings).toHaveLength(5);
+  const actions = manifest.auditActions.map((action) =>
+    typeof action === "string" ? action : action.key,
+  );
+  expect(
+    bindings.every(
+      ({ auditAction }) => auditAction && actions.includes(auditAction),
+    ),
+  ).toBe(true);
+  expect(bindings.find(({ method }) => method === "POST")).toMatchObject({
+    permissionKey: "system.agent-debug.manage",
+    featureKey: "system.agent-debug",
+  });
+  const agent = systemModuleManifests().find(
+    ({ name }) => name === "system.agent",
+  )!;
+  expect(
+    agent.apiPermissions.filter(({ path }) =>
+      path.startsWith("/api/agent/admin/"),
+    ),
+  ).toHaveLength(5);
+  expect(agent.features.map(({ key }) => key)).toEqual(
+    expect.arrayContaining(["system.agent-tools", "system.agent-debug"]),
+  );
+});
+// @windy-module system.agent end

package/template/packages/modules/src/system-agent-audit-actions.ts

@@ -1,4 +1,12 @@
+import { dshAuditActionKeys } from "./system-agent-dsh.js";
+
 export const agentAuditActionKeys: ReadonlySet<string> = new Set([
+  ...dshAuditActionKeys,
+  "system.agent-tools.read",
+  "system.agent-debug.read",
+  "agent.debug.recording.read",
+  "agent.debug.recording.replay",
+  "agent.debug.session.create",
   "agent.session.read",
   "agent.session.create",
   "agent.session.checkpoint",

package/template/packages/modules/src/system-agent-dsh.ts

@@ -0,0 +1,119 @@
+import { featureKey } from "@southwind-ai/shared";
+import type { ModuleManifest } from "./manifest.js";
+import { binding } from "./system-api-binding.js";
+
+export const dshFeatures: ModuleManifest["features"] = [
+  [
+    "system.agent-workbench",
+    "Agent 原生工作台",
+    "同源 DSH 会话、工作区与个人扩展。",
+  ],
+  [
+    "system.agent-skill",
+    "Agent 技能治理",
+    "DSH 技能版本、共享范围、发布、停用与回滚。",
+  ],
+].map(([key, label, description]) => ({
+  key: featureKey(key!),
+  label: label!,
+  description,
+  module: "system",
+  visible: "visible",
+  enabled: true,
+  stage: "stable",
+  dependencies: [featureKey("system.agent")],
+}));
+
+export const dshAuditActionKeys = [
+  "agent.workbench.access",
+  "agent.skill.read",
+  "agent.skill.publish",
+  "agent.skill.disable",
+  "agent.skill.rollback",
+  "agent.skill.draft",
+  "agent.workflow.preset.read",
+] as const;
+export const dshAuditActions: ModuleManifest["auditActions"] =
+  dshAuditActionKeys.map((key, index) => ({
+    key,
+    label: [
+      "访问原生工作台",
+      "读取Agent技能",
+      "发布Agent技能",
+      "停用Agent技能",
+      "回滚Agent技能",
+      "生成技能草稿",
+      "读取Workflow预设",
+    ][index]!,
+    description: "按当前授权记录Agent治理操作的最小审计摘要。",
+  }));
+
+export function dshApiBindings() {
+  const workbench = (method: "GET" | "POST", path: string) =>
+    binding(
+      method,
+      path,
+      "system.agent-workbench.use",
+      "system.agent-workbench",
+      "agent.workbench.access",
+      false,
+    );
+  return [
+    ...[
+      "/api/agent/workbench",
+      "/api/agent/workbench/admission",
+      "/api/agent/workbench/skills",
+      "/api/agent/native",
+      "/api/agent/native/*",
+    ].map((path) => workbench("GET", path)),
+    ...[
+      "/api/agent/workbench/launch",
+      "/api/agent/native",
+      "/api/agent/native/*",
+    ].map((path) => workbench("POST", path)),
+    binding(
+      "GET",
+      "/api/agent/native/api/remote.mux",
+      "system.agent-workbench.use",
+      "system.agent-workbench",
+      "agent.workbench.access",
+      false,
+    ),
+    ...[
+      "/api/agent/skills",
+      "/api/agent/skills/:key/versions",
+      "/api/agent/skills/:key",
+    ].map((path) =>
+      binding(
+        "GET",
+        path,
+        "system.agent-skill.read",
+        "system.agent-skill",
+        "agent.skill.read",
+      ),
+    ),
+    binding(
+      "POST",
+      "/api/agent/skills",
+      "system.agent-skill.manage",
+      "system.agent-skill",
+      "agent.skill.publish",
+    ),
+    ...["disable", "rollback"].map((action) =>
+      binding(
+        "POST",
+        `/api/agent/skills/:key/${action}`,
+        "system.agent-skill.manage",
+        "system.agent-skill",
+        `agent.skill.${action}`,
+      ),
+    ),
+    binding(
+      "GET",
+      "/api/agent/workflows/presets",
+      "system.agent-workflow.read",
+      "system.agent-workflow",
+      "agent.workflow.preset.read",
+    ),
+  ];
+}

package/template/packages/modules/src/system-ai-api-bindings.ts

@@ -2,6 +2,7 @@ import type { ApiPermissionBinding } from "@southwind-ai/shared";
 import { binding } from "./system-api-binding.js";
 
 // @windy-module system.agent begin
+import { systemAgentAdminBindings } from "./system-agent-admin-bindings.js";
 export function systemAiControlPlaneBindings(): ApiPermissionBinding[] {
   const reports = (
     [
@@ -67,6 +68,7 @@ export function systemAiControlPlaneBindings(): ApiPermissionBinding[] {
     ),
   );
   return [
+    ...systemAgentAdminBindings(),
     ...reports,
     ...read,
     ...execute,

package/template/packages/modules/src/system-api-permissions.ts

@@ -14,6 +14,15 @@ import { systemControlPlaneApiPermissionBindings } from "./system-api-control-pl
 
 export function systemApiPermissionBindings(): ApiPermissionBinding[] {
   return [
+    // @windy-module system.audit begin
+    binding(
+      "GET",
+      "/api/system/diagnostics/:diagnosticId",
+      "system.diagnostics.read",
+      "system.diagnostics",
+      "diagnostic.read",
+    ),
+    // @windy-module system.audit end
     ...systemControlPlaneApiPermissionBindings(),
     binding(
       "GET",

package/template/packages/modules/src/system-audit-actions.ts

@@ -1,4 +1,7 @@
 import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { dshAuditActions } from "./system-agent-dsh.js";
+// @windy-module system.agent end
 
 export const systemAuditActions: ModuleManifest["auditActions"] = [
   "auth.login",
@@ -83,6 +86,31 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   "file.download",
   // @windy-module system.storage end
   // @windy-module system.agent begin
+  {
+    key: "system.agent-tools.read",
+    label: "查看 Agent 工具目录",
+    description: "按当前授权访问 Agent 工作台受控投影。",
+  },
+  {
+    key: "system.agent-debug.read",
+    label: "查看 Agent 调试 Operation",
+    description: "按当前授权访问 Agent 工作台受控投影。",
+  },
+  {
+    key: "agent.debug.recording.read",
+    label: "查询 Agent 回放会话",
+    description: "按当前授权访问 Agent 工作台受控投影。",
+  },
+  {
+    key: "agent.debug.recording.replay",
+    label: "回放 Agent 会话记录",
+    description: "按当前授权访问 Agent 工作台受控投影。",
+  },
+  {
+    key: "agent.debug.session.create",
+    label: "创建 Agent 测试会话",
+    description: "按当前授权访问 Agent 工作台受控投影。",
+  },
   "agent.mcp.access",
   "agent.tool.execute",
   "agent.operation.execute",
@@ -227,4 +255,12 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   // @windy-module system.agent end
   "security.denied",
   "system.error",
+  {
+    key: "diagnostic.read",
+    label: "查询错误诊断",
+    description: "按当前管理员权限读取脱敏失败索引。",
+  },
+  // @windy-module system.agent begin
+  ...dshAuditActions,
+  // @windy-module system.agent end
 ];