create-windy 0.8.2 → 0.9.1

package/template/packages/modules/src/system-features.ts

@@ -1,5 +1,8 @@
 import * as shared from "@southwind-ai/shared";
 import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { dshFeatures } from "./system-agent-dsh.js";
+// @windy-module system.agent end
 
 // @windy-module system.scheduler begin
 const standardAndAdvanced = ["standard", "advanced"].map(
@@ -90,6 +93,7 @@ export const systemFeatures: ModuleManifest["features"] = [
     "审计日志",
     "记录关键配置、权限拒绝与业务操作，支持安全追溯。",
   ),
+  feature("system.diagnostics", "错误诊断", "按诊断编号查询脱敏失败索引。"),
   // @windy-module system.audit end
   // @windy-module system.storage begin
   feature(
@@ -129,6 +133,26 @@ export const systemFeatures: ModuleManifest["features"] = [
     dependencies: [shared.featureKey("system.agent")],
     allowedLicenseVersions: [shared.licenseVersionKey("advanced")],
   },
+  {
+    ...feature(
+      "system.agent-tools",
+      "Agent 工具目录",
+      "查看已安装模块工具的契约、治理规则和当前调用条件。",
+    ),
+    dependencies: [shared.featureKey("system.agent")],
+  },
+  {
+    ...feature(
+      "system.agent-debug",
+      "Agent 调试工作台",
+      "创建受治理的测试会话，回放授权业务会话并定位实际调用流程。",
+    ),
+    dependencies: [
+      shared.featureKey("system.agent"),
+      shared.featureKey("system.agent-session"),
+    ],
+  },
+  ...dshFeatures,
   // @windy-module system.agent end
   // @windy-module system.operations begin
   feature(

package/template/packages/modules/src/system-module-audit-selection.ts

@@ -0,0 +1,25 @@
+import type { ModuleManifest } from "./manifest.js";
+import { auditActionKey } from "./system-module-ownership.js";
+// @windy-module system.agent begin
+import { agentAuditActionKeys } from "./system-agent-audit-actions.js";
+// @windy-module system.agent end
+const agentActions = new Set<string>();
+// @windy-module system.agent begin
+for (const key of agentAuditActionKeys) agentActions.add(key);
+// @windy-module system.agent end
+export function selectSystemAuditActions(
+  name: string,
+  actions: ModuleManifest["auditActions"],
+) {
+  return actions.filter((action) => {
+    const key = auditActionKey(action);
+    if (name === "system.identity")
+      return key === "system.user-directory.query";
+    if (name === "system.agent") return agentActions.has(key);
+    return (
+      name === "system" &&
+      key !== "system.user-directory.query" &&
+      !agentActions.has(key)
+    );
+  });
+}

package/template/packages/modules/src/system-module-catalog.ts

@@ -1,17 +1,9 @@
 import type { ModuleFactory, ModuleManifest } from "./manifest.js";
+import { permissionResource } from "./system-module-ownership.js";
 import { selectSystemMenus } from "./system-module-menu-selection.js";
 import { systemFoundationModule } from "./system-modules.js";
 import { selectSystemJsonSchemas } from "./system-module-schema-catalog.js";
-// @windy-module system.agent begin
-import { agentAuditActionKeys } from "./system-agent-audit-actions.js";
-// @windy-module system.agent end
-
-const catalogAgentModuleNames = new Set<string>();
-const catalogAgentAuditActionKeys = new Set<string>();
-// @windy-module system.agent begin
-catalogAgentModuleNames.add("system.agent");
-for (const key of agentAuditActionKeys) catalogAgentAuditActionKeys.add(key);
-// @windy-module system.agent end
+import { selectSystemAuditActions } from "./system-module-audit-selection.js";
 
 export interface SystemModuleDefinition {
   name: string;
@@ -109,8 +101,8 @@ export const systemModuleDefinitions = [
     label: "审计日志",
     description: "关键操作、权限拒绝和系统异常的安全追溯。",
     dependencies: ["system"],
-    resources: ["audit"],
-    featureKeys: ["system.audit"],
+    resources: ["audit", "diagnostics"],
+    featureKeys: ["system.audit", "system.diagnostics"],
   },
   // @windy-module system.audit end
   // @windy-module system.storage begin
@@ -138,9 +130,22 @@ export const systemModuleDefinitions = [
       "system.scheduler",
       "system.workflow",
     ],
-    resources: ["agent", "agent-session", "agent-workflow", "ai-runtime"],
+    resources: [
+      "agent",
+      "agent-tools",
+      "agent-debug",
+      "agent-workbench",
+      "agent-skill",
+      "agent-session",
+      "agent-workflow",
+      "ai-runtime",
+    ],
     featureKeys: [
       "system.agent",
+      "system.agent-tools",
+      "system.agent-debug",
+      "system.agent-workbench",
+      "system.agent-skill",
       "system.agent-session",
       "system.agent-workflow",
       "system.ai-runtime",
@@ -310,22 +315,10 @@ function createSystemCapabilityModule(
       definition.name === "system.data-governance"
         ? aggregate.dataPolicies
         : [],
-    auditActions: isCore
-      ? aggregate.auditActions.filter(
-          (action) =>
-            auditActionKey(action) !== "system.user-directory.query" &&
-            !catalogAgentAuditActionKeys.has(auditActionKey(action)),
-        )
-      : definition.name === "system.identity"
-        ? aggregate.auditActions.filter(
-            (action) =>
-              auditActionKey(action) === "system.user-directory.query",
-          )
-        : catalogAgentModuleNames.has(definition.name)
-          ? aggregate.auditActions.filter((action) =>
-              catalogAgentAuditActionKeys.has(auditActionKey(action)),
-            )
-          : [],
+    auditActions: selectSystemAuditActions(
+      definition.name,
+      aggregate.auditActions,
+    ),
     metadata: {
       kind: "platform-capability",
       ...(definition.runtimeActivation
@@ -334,14 +327,3 @@ function createSystemCapabilityModule(
     },
   };
 }
-
-function auditActionKey(
-  action: ModuleManifest["auditActions"][number],
-): string {
-  return typeof action === "string" ? action : action.key;
-}
-
-function permissionResource(permissionKey: string): string {
-  const parts = permissionKey.split(".");
-  return parts.length >= 3 ? parts.slice(1, -1).join(".") : "";
-}

package/template/packages/modules/src/system-module-ownership.ts

@@ -0,0 +1,12 @@
+import type { ModuleManifest } from "./manifest.js";
+
+export function auditActionKey(
+  action: ModuleManifest["auditActions"][number],
+): string {
+  return typeof action === "string" ? action : action.key;
+}
+
+export function permissionResource(permissionKey: string): string {
+  const parts = permissionKey.split(".");
+  return parts.length >= 3 ? parts.slice(1, -1).join(".") : "";
+}

package/template/packages/modules/src/system-modules.ts

@@ -4,6 +4,7 @@ import {
   systemAgentToolSchemas,
   systemAgentTools,
 } from "./system-agent-tools.js";
+import { systemAgentAdminMenus } from "./system-agent-admin-menus.js";
 import { systemAgentSupervisorSchemas } from "./system-agent-supervisor.js";
 // @windy-module system.agent end
 import { systemAdminRoutes } from "./system-admin-routes.js";
@@ -216,6 +217,17 @@ export function systemFoundationModule(): ModuleManifest {
             permissionKey: "system.audit.read",
             featureKey: "system.audit",
           },
+          {
+            key: "system.diagnostics",
+            title: "错误诊断",
+            type: "menu",
+            order: 25,
+            visible: true,
+            path: "/admin/system/diagnostics",
+            icon: "bug",
+            permissionKey: "system.diagnostics.read",
+            featureKey: "system.diagnostics",
+          },
           // @windy-module system.audit end
         ],
       },
@@ -241,11 +253,12 @@ export function systemFoundationModule(): ModuleManifest {
           },
           // @windy-module system.operations end
           // @windy-module system.agent begin
+          ...systemAgentAdminMenus,
           {
             key: "system.agent-session",
             title: "Agent 会话",
             type: "menu",
-            order: 14,
+            order: 16,
             visible: true,
             path: "/admin/system/agent-sessions",
             icon: "messages-square",
@@ -256,7 +269,7 @@ export function systemFoundationModule(): ModuleManifest {
             key: "system.ai-runtime",
             title: "AI Runtime 报表",
             type: "menu",
-            order: 15,
+            order: 17,
             visible: true,
             path: "/admin/system/ai-runtime",
             icon: "activity",
@@ -267,7 +280,7 @@ export function systemFoundationModule(): ModuleManifest {
             key: "system.agent-workflow",
             title: "Agent Workflow",
             type: "menu",
-            order: 16,
+            order: 18,
             visible: true,
             path: "/admin/system/agent-workflows",
             icon: "git-fork",

package/template/packages/modules/src/system-permissions.ts

@@ -19,9 +19,14 @@ const systemResourceLabels = {
   profile: "个人设置",
   license: "许可证管理",
   audit: "审计日志",
+  diagnostics: "错误诊断",
   // @windy-module system.agent begin
   agent: "智能代理",
   "agent-session": "Agent 长期会话",
+  "agent-tools": "Agent 工具目录",
+  "agent-debug": "Agent 调试工作台",
+  "agent-workbench": "Agent 原生工作台",
+  "agent-skill": "Agent 技能治理",
   "agent-workflow": "Agent Workflow",
   "ai-runtime": "AI Runtime 报表",
   // @windy-module system.agent end
@@ -36,6 +41,8 @@ const systemResourceLabels = {
 type SystemResource = keyof typeof systemResourceLabels;
 type SystemAction =
   | "access"
+  | "use"
+  | "execute"
   | "read"
   | "create"
   | "approve"
@@ -126,9 +133,17 @@ export const systemPermissions: ModuleManifest["permissions"] = [
   // @windy-module system.license end
   // @windy-module system.audit begin
   permission("audit", "read"),
+  permission("diagnostics", "read"),
   // @windy-module system.audit end
   // @windy-module system.agent begin
   permission("agent", "read"),
+  permission("agent-tools", "read"),
+  permission("agent-debug", "read"),
+  permission("agent-debug", "manage"),
+  permission("agent-workbench", "use"),
+  permission("agent-skill", "read"),
+  permission("agent-skill", "manage"),
+  permission("agent-skill", "execute"),
   permission("agent-session", "read"),
   permission("agent-session", "manage"),
   permission("agent-workflow", "read", "sensitive-disclosure"),

package/template/packages/server-sdk/index.ts

@@ -78,6 +78,8 @@ export type {
   ModuleAgentSessionGetInputV1,
   ModuleAgentSessionListInputV1,
   ModuleAgentSessionMessageV1,
+  ModuleAgentSessionRunReferenceV1,
+  ModuleAgentSessionWorkflowReferenceV1,
   ModuleAgentSessionPageV1,
   ModuleAgentSessionProviderV1,
   ModuleAgentSessionSummaryV1,

package/template/packages/server-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/server-sdk",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -68,7 +68,7 @@
   "dependencies": {
     "@southwind-ai/jobs": "workspace:^",
     "@southwind-ai/modules": "workspace:^",
-    "@southwind-ai/shared": "workspace:^0.3.0",
+    "@southwind-ai/shared": "workspace:^0.3.2",
     "@southwind-ai/storage": "workspace:^"
   },
   "exports": {

package/template/packages/server-sdk/src/agent-session-provider.ts

@@ -43,6 +43,25 @@ export interface ModuleAgentSessionMessageV1 {
 
 export interface ModuleAgentSessionV1 extends ModuleAgentSessionSummaryV1 {
   readonly messages: readonly ModuleAgentSessionMessageV1[];
+  /** Provider 返回了有界历史窗口；不得把该窗口当作完整会话。 */
+  readonly truncated?: boolean;
+  /** 当前 get() 已按业务来源重授权的关联事实；Host 仍逐 Run/Workflow 重授权。 */
+  readonly runRefs?: readonly ModuleAgentSessionRunReferenceV1[];
+  readonly workflowRefs?: readonly ModuleAgentSessionWorkflowReferenceV1[];
+}
+
+export interface ModuleAgentSessionRunReferenceV1 {
+  readonly runId: string;
+  readonly operationKey: string;
+  readonly messageSequence?: number;
+  readonly sessionId?: string;
+  readonly turnId?: string;
+  readonly workflowRunId?: string;
+}
+
+export interface ModuleAgentSessionWorkflowReferenceV1 {
+  readonly workflowRunId: string;
+  readonly messageSequence?: number;
 }
 
 /**

package/template/packages/shared/index.ts

@@ -2,6 +2,8 @@ export * from "./src/audit.js";
 export * from "./src/ai-operation-readiness.js";
 // @windy-module system.agent begin
 export * from "./src/ai-runtime-report.js";
+export * from "./src/agent-admin-catalog.js";
+export * from "./src/agent-workbench.js";
 export * from "./src/agent-workflow.js";
 export * from "./src/agent-workflow-events.js";
 export * from "./src/agent-workflow-evaluation.js";
@@ -33,3 +35,15 @@ export * from "./src/stable-key.js";
 export * from "./src/workflow.js";
 
 export * from "./src/license-console-capabilities.js";
+
+// @windy-module system.agent begin
+export * from "./src/agent-skills.js";
+// @windy-module system.agent end
+
+// @windy-module system.audit begin
+export * from "./src/diagnostics.js";
+// @windy-module system.audit end
+
+// @windy-module system.agent begin
+export * from "./src/agent-workflow-presets.js";
+// @windy-module system.agent end

package/template/packages/shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/shared",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {

package/template/packages/shared/src/agent-admin-catalog.ts

@@ -0,0 +1,73 @@
+import type { JsonObject } from "./json.js";
+import type { CandidateRole } from "./workflow.js";
+
+/** Public, bounded categories; never include raw Guard events or Provider bodies. */
+export type AgentAdminAvailabilityReason =
+  | "allowed"
+  | "permission-denied"
+  | "feature-unavailable"
+  | "license-unavailable"
+  | "scope-unavailable"
+  | "runtime-unavailable"
+  | "workflow-only"
+  | "internal-operation"
+  | "unsupported-operation"
+  | "handler-unavailable"
+  | "governance-unavailable";
+
+export interface AgentAdminToolCatalogItem {
+  readonly key: string;
+  readonly label: string;
+  readonly description: string;
+  readonly module: string;
+  readonly operation: "query" | "command" | "background";
+  readonly featureKey: string;
+  readonly permissionKey: string;
+  readonly auditAction: string;
+  readonly scopeMode: "platform" | "request";
+  readonly executionMode: "host" | "sandbox";
+  readonly dataClassification: "public" | "internal" | "sensitive";
+  readonly approval: "none" | "required";
+  readonly approvalRoles?: readonly CandidateRole[];
+  readonly approvalTimeoutSeconds?: number;
+  readonly idempotency: "none" | "supported" | "required";
+  readonly limits: AgentAdminCatalogLimits;
+  readonly inputSchemaKey: string;
+  readonly outputSchemaKey: string;
+  readonly inputSchema: JsonObject;
+  readonly outputSchema: JsonObject;
+  readonly allowedOperationKeys: readonly string[];
+  /** Current Guard + Scope eligibility, not an execution or approval grant. */
+  readonly allowed: boolean;
+  readonly availabilityReason: AgentAdminAvailabilityReason;
+}
+
+export interface AgentAdminCatalogLimits {
+  readonly maxDurationSeconds: number;
+  readonly maxInputBytes: number;
+  readonly maxOutputBytes: number;
+}
+
+export interface AgentAdminOperationCatalogItem {
+  readonly key: string;
+  readonly module: string;
+  readonly moduleLabel: string;
+  readonly kind: string;
+  readonly visibility: "public" | "internal";
+  readonly execution: string;
+  readonly featureKey: string;
+  readonly permissionKey: string;
+  readonly auditAction: string;
+  readonly dataClassification: "public" | "internal" | "sensitive";
+  readonly requiredCapabilities: readonly string[];
+  readonly inputModalities: readonly string[];
+  readonly inputSchemaKey: string;
+  readonly outputSchemaKey: string;
+  readonly inputSchema?: JsonObject;
+  readonly outputSchema?: JsonObject;
+  readonly allowedToolKeys: readonly string[];
+  readonly limits: AgentAdminCatalogLimits;
+  readonly launchAuthority: "direct" | "workflow-artifact";
+  readonly selectable: boolean;
+  readonly availabilityReason: AgentAdminAvailabilityReason;
+}

package/template/packages/shared/src/agent-skills.ts

@@ -0,0 +1,68 @@
+/** DSH 技能是工作方法与文件包，不能授予业务权限或承载可执行授权。 */
+export type AgentSkillScope = "personal" | "department" | "tenant";
+export type AgentSkillOrigin = "builtin" | "shared";
+export type AgentSkillStatus = "published" | "disabled";
+export interface AgentSkillRequirement {
+  readonly toolKey: string;
+  readonly featureKey: string;
+  readonly permissionKey: string;
+}
+export interface AgentSkillFile {
+  readonly path: string;
+  readonly contentBase64: string;
+}
+export interface AgentSkillBundle {
+  readonly name: string;
+  readonly displayName: string;
+  readonly description: string;
+  readonly digest: string;
+  readonly files: readonly AgentSkillFile[];
+}
+export interface AgentSkillVersion {
+  readonly key: string;
+  readonly version: number;
+  readonly tenantId: string;
+  readonly ownerActorId: string;
+  readonly departmentId?: string;
+  readonly scope: AgentSkillScope;
+  readonly origin: AgentSkillOrigin;
+  readonly status: AgentSkillStatus;
+  readonly name: string;
+  readonly description: string;
+  readonly digest: string;
+  readonly requirements: readonly AgentSkillRequirement[];
+  readonly safetyConstraints: readonly string[];
+  readonly createdAt: string;
+  readonly createdBy: string;
+  readonly restoredFromVersion?: number;
+  readonly source: string;
+}
+export interface AgentSkillGovernanceItem {
+  readonly skill: AgentSkillVersion;
+  readonly available: boolean;
+  readonly governable: boolean;
+}
+export interface ImportAgentSkillRequest {
+  readonly format: "markdown" | "zip";
+  /** SKILL.md 正文，或 ZIP 的标准 base64。 */
+  readonly content: string;
+  readonly scope: AgentSkillScope;
+  readonly expectedVersion: number;
+  readonly requirements?: readonly AgentSkillRequirement[];
+  readonly safetyConstraints?: readonly string[];
+}
+export interface AgentSkillCommandRequest {
+  readonly expectedVersion: number;
+  readonly version?: number;
+}
+export interface PublishedAgentSkillBundle {
+  readonly skill: AgentSkillVersion;
+  readonly bundle: AgentSkillBundle;
+}
+
+export interface AgentSkillRuntimeBundle {
+  readonly key: string;
+  readonly version: number;
+  readonly digest: string;
+  readonly files: readonly AgentSkillFile[];
+}

package/template/packages/shared/src/agent-workbench.ts

@@ -0,0 +1,100 @@
+import type { JsonValue } from "./json.js";
+
+export type AgentWorkbenchRecordingSourceV1 = "harness" | "business";
+export type AgentWorkbenchCorrelationStatusV1 =
+  | "complete"
+  | "partial"
+  | "missing";
+
+export interface AgentWorkbenchEventV1 {
+  readonly sequence: number;
+  readonly type: string;
+  readonly summary: string;
+  readonly occurredAt?: string;
+  readonly runId?: string;
+  readonly turnId?: string;
+  readonly stepId?: string;
+  readonly modelAttemptId?: string;
+  readonly attemptSequence?: number;
+  readonly toolCallId?: string;
+  readonly toolKey?: string;
+  readonly workItemId?: string;
+  readonly artifactId?: string;
+  readonly workflowRunId?: string;
+  readonly nodeRunId?: string;
+  readonly outcome?: string;
+  readonly usage?: {
+    readonly inputTokens?: number;
+    readonly outputTokens?: number;
+    readonly totalTokens?: number;
+    readonly costMicros?: number;
+  };
+}
+
+export interface AgentWorkbenchRunV1 {
+  readonly runId: string;
+  readonly operationKey: string;
+  readonly sessionId?: string;
+  readonly turnId?: string;
+  readonly messageSequence?: number;
+  readonly status: string;
+  readonly events: readonly AgentWorkbenchEventV1[];
+  readonly result?: { readonly output?: JsonValue; readonly status?: string };
+  readonly correlationStatus: AgentWorkbenchCorrelationStatusV1;
+  readonly missing: readonly string[];
+}
+
+export interface AgentWorkbenchWorkflowV1 {
+  readonly workflowRunId: string;
+  readonly sessionId?: string;
+  readonly messageSequence?: number;
+  readonly workflowKey: string;
+  readonly title: string;
+  readonly status: string;
+  readonly parentRunId?: string;
+  readonly parentNodeRunId?: string;
+  readonly nodes: readonly {
+    readonly nodeRunId: string;
+    readonly nodeId: string;
+    readonly type: string;
+    readonly status: string;
+    readonly attempt: number;
+    readonly previousNodeRunId?: string;
+    readonly agentRunId?: string;
+    readonly workItemId?: string;
+    readonly selectedBranch?: string;
+    readonly artifactIds: readonly string[];
+  }[];
+  readonly events: readonly AgentWorkbenchEventV1[];
+}
+
+export interface AgentWorkbenchRecordingSummaryV1 {
+  readonly source: AgentWorkbenchRecordingSourceV1;
+  readonly sessionId: string;
+  readonly title: string;
+  readonly updatedAt: string;
+  readonly operationKey?: string;
+  readonly sessionStatus?: "active" | "archived";
+}
+
+export interface AgentWorkbenchRecordingV1 extends AgentWorkbenchRecordingSummaryV1 {
+  readonly mode: "read-only";
+  readonly sideEffectPolicy: "no-reexecution";
+  readonly correlationStatus: AgentWorkbenchCorrelationStatusV1;
+  readonly messages: readonly {
+    readonly sequence: number;
+    readonly role: "user" | "assistant";
+    readonly content: string;
+    readonly createdAt: string;
+  }[];
+  readonly timeline: readonly AgentWorkbenchEventV1[];
+  /** Parent forks retain separate original ledger sequences, never renumbered. */
+  readonly segments?: readonly {
+    readonly sessionId: string;
+    readonly throughSequence: number;
+    readonly timeline: readonly AgentWorkbenchEventV1[];
+  }[];
+  readonly runs: readonly AgentWorkbenchRunV1[];
+  readonly workflows: readonly AgentWorkbenchWorkflowV1[];
+  readonly missing: readonly string[];
+}

package/template/packages/shared/src/agent-workflow-presets.ts

@@ -0,0 +1,26 @@
+import type { AgentWorkflowBudget } from "./agent-workflow-run.js";
+import type { AgentWorkflowNodeType } from "./agent-workflow-definition.js";
+
+export interface AgentWorkflowPresetSummary {
+  readonly key: string;
+  readonly moduleKey: string;
+  readonly label: string;
+  readonly description: string;
+  readonly workflowKey: string;
+  readonly version: string;
+  readonly budget: AgentWorkflowBudget;
+  readonly nodes: readonly {
+    readonly id: string;
+    readonly label: string;
+    readonly type: AgentWorkflowNodeType;
+  }[];
+  readonly availability: "available" | "unavailable";
+  readonly safeCode?: string;
+  readonly blockedReason?: string;
+  /** 由所属模块注册的业务入口；目录本身不发布或启动 Workflow。 */
+  readonly entry?: { readonly path: string; readonly label: string };
+}
+
+export interface AgentWorkflowPresetListResponse {
+  readonly items: readonly AgentWorkflowPresetSummary[];
+}

package/template/packages/shared/src/diagnostics.ts

@@ -0,0 +1,13 @@
+/** 可向授权运维人员公开的失败索引，不包含业务正文、异常堆栈或身份凭据。 */
+export interface DiagnosticRecord {
+  readonly diagnosticId: string;
+  readonly requestId: string;
+  readonly occurredAt: string;
+  readonly expiresAt: string;
+  readonly service: "server";
+  readonly stage: "http";
+  readonly method: string;
+  readonly route: string;
+  readonly statusCode: number;
+  readonly errorCode: string;
+}

package/template/packages/shared/src/rbac.ts

@@ -24,6 +24,7 @@ export type PermissionAction =
   | "reveal"
   | "approve"
   | "execute"
+  | "use"
   | "retry"
   | "manage";