create-windy 0.8.3 → 0.10.0

package/template/apps/agent-server/native/request.ts

@@ -0,0 +1,61 @@
+import { request as httpRequest } from "node:http";
+
+/** node:http preserves the explicit virtual Host required by DSH cookie audiences. */
+export function nativeRequest(
+  url: string,
+  input: {
+    method?: string;
+    headers: Headers;
+    body?: ArrayBuffer;
+    signal: AbortSignal;
+  },
+): Promise<Response> {
+  const target = new URL(url);
+  if (target.protocol !== "http:" || target.hostname !== "127.0.0.1")
+    throw new Error("Invalid native transport target");
+  const headers: Record<string, string> = {};
+  input.headers.forEach((value, key) => {
+    headers[key] = value;
+  });
+  return new Promise((accept, reject) => {
+    const pending = httpRequest(
+      target,
+      { method: input.method ?? "GET", headers, signal: input.signal },
+      (incoming) => {
+        const result = new Headers();
+        for (let index = 0; index < incoming.rawHeaders.length; index += 2)
+          result.append(
+            incoming.rawHeaders[index]!,
+            incoming.rawHeaders[index + 1]!,
+          );
+        const iterator = incoming[Symbol.asyncIterator]();
+        const body = new ReadableStream<Uint8Array>({
+          async pull(controller) {
+            try {
+              const next = await iterator.next();
+              if (next.done) controller.close();
+              else controller.enqueue(next.value);
+            } catch (error) {
+              controller.error(error);
+            }
+          },
+          cancel() {
+            incoming.destroy();
+          },
+        });
+        const status = incoming.statusCode ?? 502;
+        accept(
+          new Response(
+            [204, 205, 304].includes(status) || input.method === "HEAD"
+              ? null
+              : body,
+            { status, headers: result },
+          ),
+        );
+      },
+    );
+    pending.once("error", reject);
+    if (input.body) pending.write(Buffer.from(input.body));
+    pending.end();
+  });
+}

package/template/apps/agent-server/native/session-conflict.test.ts

@@ -0,0 +1,235 @@
+import { expect, test } from "bun:test";
+import { EventEmitter } from "node:events";
+import type { ChildProcess } from "node:child_process";
+import { PassThrough } from "node:stream";
+import type { IncomingMessage, Server } from "node:http";
+import { WorkbenchManager, type NativeWorker } from "./manager.js";
+import { actorKey, type WorkbenchAuthority } from "./config.js";
+import { WorkbenchSessionConflict } from "./session-conflict.js";
+import { WorkbenchAuthorizationUnavailable } from "./authorization.js";
+import { workbenchHandshake, workbenchHttp } from "./http.js";
+import { createBoundary } from "./boundary.js";
+import { attachWorkbenchSockets } from "./socket.js";
+
+const original: WorkbenchAuthority = {
+  actorId: "same-actor",
+  session: "a".repeat(43),
+  publicOrigin: "http://fixture.test",
+};
+const other = { ...original, session: "b".repeat(43) };
+function fixture(
+  authorize: (authority: WorkbenchAuthority) => Promise<boolean> = async () =>
+    true,
+) {
+  let starts = 0;
+  const make = (authority: WorkbenchAuthority): NativeWorker => ({
+    uid: 20000,
+    key: actorKey(authority.actorId),
+    authority,
+    token: "t".repeat(43),
+    port: 0,
+    cookie: "native=fixture",
+    home: "/synthetic/current-user",
+    child: Object.assign(new EventEmitter(), {
+      exitCode: 0,
+      signalCode: null,
+    }) as ChildProcess,
+    controller: new AbortController(),
+    admissionController: new AbortController(),
+  });
+  const manager = new WorkbenchManager({
+    gateOrigin: "http://fixture.test",
+    authorize,
+  });
+  const worker = make(original);
+  manager.workers.set(worker.key, worker);
+  // Replace only the OS-spawn seam; exercise actual get/authorization/stop logic.
+  (
+    manager as unknown as {
+      start(key: string, authority: WorkbenchAuthority): Promise<NativeWorker>;
+    }
+  ).start = async (_key, authority) => {
+    starts++;
+    const next = make(authority);
+    manager.workers.set(next.key, next);
+    return next;
+  };
+  return { manager, worker, starts: () => starts };
+}
+function request(authority = other) {
+  return new Request(
+    "http://fixture.test/internal/workbench/windy/tool-catalog",
+    {
+      method: "POST",
+      headers: {
+        "x-windy-actor-id": authority.actorId,
+        "x-windy-product-session": authority.session,
+        "x-windy-public-origin": authority.publicOrigin,
+      },
+      body: '{"action":"get"}',
+    },
+  );
+}
+
+test("同账号新登录或不同入口返回409，不终止或复用旧登录的Worker", async () => {
+  const f = fixture();
+  try {
+    for (const authority of [
+      other,
+      { ...original, publicOrigin: "http://other.test" },
+    ]) {
+      const response = await workbenchHttp(request(authority), f.manager);
+      expect(response.status).toBe(409);
+      expect(await response.json()).toMatchObject({
+        error: "WORKBENCH_SESSION_CONFLICT",
+        message: expect.stringContaining("原登录"),
+      });
+      expect(f.manager.workers.get(f.worker.key)).toBe(f.worker);
+      expect(f.worker.controller.signal.aborted).toBe(false);
+      expect(f.worker.admissionController.signal.aborted).toBe(false);
+    }
+    expect(await f.manager.get(original)).toBe(f.worker);
+    expect(f.starts()).toBe(0);
+  } finally {
+    await f.manager.close();
+  }
+});
+
+test("内部握手预检重新授权且只返回204或明确冲突，不输出会话/Worker数据", async () => {
+  const f = fixture();
+  const probe = (authority: WorkbenchAuthority) =>
+    new Request("http://fixture.test/internal/workbench-handshake", {
+      headers: request(authority).headers,
+    });
+  try {
+    const same = await workbenchHandshake(probe(original), f.manager);
+    expect(same.status).toBe(204);
+    expect(await same.text()).toBe("");
+    expect((await workbenchHandshake(probe(other), f.manager)).status).toBe(
+      409,
+    );
+    expect(f.starts()).toBe(0);
+    expect(f.worker.controller.signal.aborted).toBe(false);
+  } finally {
+    await f.manager.close();
+  }
+});
+
+test("冲突请求不影响原登录在途模型完成，原输出可完整读回", async () => {
+  const before = [
+    process.env.AI_PROVIDER_MAX_CONCURRENT_RUNS,
+    process.env.AGENT_DSH_MAX_ACTIVE_RUNS,
+  ];
+  process.env.AI_PROVIDER_MAX_CONCURRENT_RUNS = "2";
+  process.env.AGENT_DSH_MAX_ACTIVE_RUNS = "1";
+  const f = fixture();
+  let ready!: () => void,
+    finish!: (value: Response) => void,
+    signal!: AbortSignal;
+  const started = new Promise<void>((resolve) => {
+    ready = resolve;
+  });
+  const boundary = createBoundary({
+    manager: f.manager,
+    completion: async (input) => {
+      signal = input.signal;
+      ready();
+      return new Promise<Response>((resolve) => {
+        finish = resolve;
+      });
+    },
+  });
+  try {
+    const turn = boundary(
+      new Request("http://fixture.test/internal/boundary/v1/chat/completions", {
+        method: "POST",
+        headers: { authorization: `Bearer ${f.worker.token}` },
+        body: "{}",
+      }),
+    );
+    await started;
+    expect((await workbenchHttp(request(), f.manager)).status).toBe(409);
+    expect(signal.aborted).toBe(false);
+    finish(new Response("original-turn-complete"));
+    expect(await (await turn).text()).toBe("original-turn-complete");
+    expect(f.starts()).toBe(0);
+  } finally {
+    await f.manager.close();
+    for (const [index, key] of [
+      "AI_PROVIDER_MAX_CONCURRENT_RUNS",
+      "AGENT_DSH_MAX_ACTIVE_RUNS",
+    ].entries()) {
+      if (before[index] === undefined) delete process.env[key];
+      else process.env[key] = before[index];
+    }
+  }
+});
+
+test("真实退出/撤权结束旧绑定后才可新建，临时超时不视为退出", async () => {
+  let state: "allowed" | "denied" | "timeout" = "allowed";
+  const f = fixture(async (authority) => {
+    if (authority.session !== original.session) return true;
+    if (state === "timeout")
+      throw new WorkbenchAuthorizationUnavailable("timeout");
+    return state === "allowed";
+  });
+  try {
+    state = "timeout";
+    await expect(f.manager.current(f.worker)).rejects.toBeInstanceOf(
+      WorkbenchAuthorizationUnavailable,
+    );
+    expect(f.worker.controller.signal.aborted).toBe(false);
+    await expect(f.manager.get(other)).rejects.toBeInstanceOf(
+      WorkbenchSessionConflict,
+    );
+    state = "allowed";
+    expect(await f.manager.current(f.worker)).toBe(true);
+    state = "denied";
+    expect(await f.manager.current(f.worker)).toBe(false);
+    expect(f.worker.controller.signal.aborted).toBe(true);
+    const next = await f.manager.get(other);
+    expect(next.authority.session).toBe(other.session);
+    expect(next.home).toBe(f.worker.home);
+    expect(f.starts()).toBe(1);
+  } finally {
+    await f.manager.close();
+  }
+});
+
+test("WebSocket握手冲突使用409而非401/403且保留原Worker", async () => {
+  const f = fixture();
+  const server = new EventEmitter();
+  const socket = new PassThrough();
+  let raw = "";
+  socket.on("data", (data) => {
+    raw += data.toString();
+  });
+  const ended = new Promise<void>((resolve) => socket.once("end", resolve));
+  const detach = attachWorkbenchSockets(
+    server as Server,
+    f.manager,
+    () => true,
+  );
+  const headers: Record<string, string> = {};
+  request().headers.forEach((value, key) => {
+    headers[key] = value;
+  });
+  try {
+    server.emit(
+      "upgrade",
+      {
+        url: "/internal/workbench/api/remote.mux",
+        headers,
+      } as IncomingMessage,
+      socket,
+      Buffer.alloc(0),
+    );
+    await ended;
+    expect(raw).toContain("HTTP/1.1 409 Conflict");
+    expect(f.worker.controller.signal.aborted).toBe(false);
+  } finally {
+    socket.destroy();
+    detach();
+    await f.manager.close();
+  }
+});

package/template/apps/agent-server/native/session-conflict.ts

@@ -0,0 +1,21 @@
+/** A different login must not reuse or terminate another login's live worker. */
+export class WorkbenchSessionConflict extends Error {
+  readonly code = "WORKBENCH_SESSION_CONFLICT";
+  constructor() {
+    super(
+      "该账号已由另一个登录会话或访问入口使用 Agent。请返回原登录继续，或先退出原登录，等待释放后重试。",
+    );
+    this.name = "WorkbenchSessionConflict";
+  }
+}
+export function sessionConflictResponse(
+  error: WorkbenchSessionConflict,
+): Response {
+  return Response.json(
+    { error: error.code, message: error.message },
+    {
+      status: 409,
+      headers: { "cache-control": "no-store" },
+    },
+  );
+}

package/template/apps/agent-server/native/shared-skills.test.ts

@@ -0,0 +1,128 @@
+import { expect, test } from "bun:test";
+import { createHash } from "node:crypto";
+import { mkdtemp, mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { NativeWorker } from "./manager.js";
+import { parseBundles, publishedSkills } from "./shared-skills.js";
+
+type File = { path: string; contentBase64: string };
+const digest = (files: File[]) =>
+  `sha256:${createHash("sha256")
+    .update(
+      JSON.stringify(
+        [...files].sort((left, right) =>
+          left.path < right.path ? -1 : left.path > right.path ? 1 : 0,
+        ),
+      ),
+    )
+    .digest("hex")}`;
+const bundle = () => {
+  const files = [
+    {
+      path: "SKILL.md",
+      contentBase64: Buffer.from("# Review").toString("base64"),
+    },
+  ];
+  return { key: "governed-review", version: 1, digest: digest(files), files };
+};
+
+test("published skill materialization rejects traversal, duplicate paths and unbounded inputs", () => {
+  expect(parseBundles({ items: [bundle()] })).toHaveLength(1);
+  expect(parseBundles([bundle()])).toHaveLength(1);
+  for (const path of [
+    "../foreign",
+    "/etc/passwd",
+    "x/../../foreign",
+    "x\\foreign",
+    ".dsh/secret",
+    "a:b",
+  ]) {
+    const item = bundle();
+    item.files.push({ path, contentBase64: "YQ==" });
+    expect(() => parseBundles([item])).toThrow();
+  }
+  const duplicate = bundle();
+  duplicate.files.push(duplicate.files[0]!);
+  expect(() => parseBundles([duplicate])).toThrow();
+  expect(() => parseBundles([bundle(), bundle()])).toThrow();
+  expect(() => parseBundles([{ ...bundle(), files: [] }])).toThrow();
+  expect(() => parseBundles([{ ...bundle(), digest: "changed" }])).toThrow();
+});
+
+test("bundle digests bind canonical sorted file bytes and reject changed content or digest", () => {
+  const item = bundle();
+  item.files.unshift({
+    path: "references/核验说明.md",
+    contentBase64: Buffer.from("verified").toString("base64"),
+  });
+  item.digest = digest(item.files);
+  const normalized = parseBundles([item])[0]!;
+  expect(normalized.files.map(({ path }) => path)).toEqual([
+    "SKILL.md",
+    "references/核验说明.md",
+  ]);
+  expect(normalized.digest).toBe(item.digest);
+  expect(
+    parseBundles([{ ...item, files: [...item.files].reverse() }])[0]!.digest,
+  ).toBe(item.digest);
+  const changed = structuredClone(item);
+  changed.files[0]!.contentBase64 = Buffer.from("forged").toString("base64");
+  expect(() => parseBundles([changed])).toThrow(
+    "PUBLISHED_SKILL_DIGEST_MISMATCH",
+  );
+  expect(() =>
+    parseBundles([{ ...item, digest: `sha256:${"f".repeat(64)}` }]),
+  ).toThrow("PUBLISHED_SKILL_DIGEST_MISMATCH");
+  const equivalent = bundle();
+  equivalent.files[0]!.contentBase64 = "YR==";
+  equivalent.digest = digest([{ path: "SKILL.md", contentBase64: "YQ==" }]);
+  expect(parseBundles([equivalent])[0]!.files[0]!.contentBase64).toBe("YQ==");
+});
+
+test("skill-only denial clears old files and preserves personal discovery only after fresh admission", async () => {
+  const root = await mkdtemp(join(tmpdir(), "windy-shared-skills-denial-"));
+  const managed = join(root, "managed-skills", "actor");
+  const worker = {
+    key: "actor",
+    uid: 20000,
+    home: join(root, "dsh", "actor"),
+    authority: {
+      actorId: "actor",
+      session: "s".repeat(43),
+      publicOrigin: "https://product.example",
+    },
+  } as unknown as NativeWorker;
+  const originalFetch = globalThis.fetch;
+  try {
+    for (const [skillStatus, admitted, expected] of [
+      [403, true, 200],
+      [403, false, 401],
+      [401, true, 401],
+    ] as const) {
+      await mkdir(managed, { recursive: true });
+      await writeFile(join(managed, "old-copy"), "private old skill");
+      let admissionCalls = 0;
+      globalThis.fetch = (async (input: string | URL | Request) => {
+        const path = new URL(String(input)).pathname;
+        if (path.endsWith("/admission")) {
+          admissionCalls++;
+          return admitted
+            ? Response.json({ actor: { id: "actor", type: "user" } })
+            : new Response(null, { status: 401 });
+        }
+        expect(path).toBe("/api/agent/workbench/skills");
+        return new Response(null, { status: skillStatus });
+      }) as typeof fetch;
+      const response = await publishedSkills(worker, AbortSignal.timeout(5000));
+      expect(response.status).toBe(expected);
+      if (expected === 200)
+        expect(await response.json()).toEqual({ items: [] });
+      expect(admissionCalls).toBe(skillStatus === 403 ? 1 : 0);
+      await expect(stat(managed)).rejects.toThrow();
+    }
+  } finally {
+    globalThis.fetch = originalFetch;
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/template/apps/agent-server/native/shared-skills.ts

@@ -0,0 +1,240 @@
+import { createHash } from "node:crypto";
+import {
+  mkdir,
+  writeFile,
+  chown,
+  chmod,
+  readdir,
+  rm,
+  lstat,
+} from "node:fs/promises";
+import { dirname, join } from "node:path";
+import type { NativeWorker } from "./manager.js";
+import { boundedBody } from "./boundary.js";
+import { authorizeWorkbench, productOrigin } from "./authorization.js";
+
+interface PublishedBundle {
+  key: string;
+  version: number;
+  digest: string;
+  files: { path: string; contentBase64: string }[];
+}
+
+const pending = new Map<string, Promise<unknown>>();
+
+function validFilePath(path: string): boolean {
+  return path
+    .split("/")
+    .every(
+      (part) =>
+        part.length > 0 &&
+        part.length <= 100 &&
+        !part.startsWith(".") &&
+        [...part].every(
+          (char) =>
+            char.charCodeAt(0) >= 32 &&
+            char.charCodeAt(0) !== 127 &&
+            char !== "\\" &&
+            char !== ":",
+        ),
+    );
+}
+
+/** Product authorization is repeated before every discovery or body read. */
+export async function publishedSkills(
+  worker: NativeWorker,
+  signal: AbortSignal,
+): Promise<Response> {
+  const prior = pending.get(worker.key) ?? Promise.resolve();
+  const operation = prior
+    .catch(() => {})
+    .then(async () => {
+      const response = await fetch(
+        `${productOrigin()}/api/agent/workbench/skills`,
+        {
+          headers: { authorization: `Bearer ${worker.authority.session}` },
+          signal,
+          redirect: "error",
+        },
+      );
+      if (!response.ok) {
+        await response.body?.cancel();
+        // Revoked Skill access must not leave old read-only copies discoverable.
+        if (response.status === 401 || response.status === 403)
+          await rm(
+            join(dirname(dirname(worker.home)), "managed-skills", worker.key),
+            { recursive: true, force: true },
+          );
+        if (response.status === 403) {
+          if (!(await authorizeWorkbench(worker.authority, signal)))
+            return Response.json({ error: "UNAUTHENTICATED" }, { status: 401 });
+          return Response.json(
+            { items: [] },
+            { headers: { "cache-control": "no-store" } },
+          );
+        }
+        return Response.json(
+          { error: "SHARED_SKILLS_UNAVAILABLE" },
+          {
+            status:
+              response.status === 401 || response.status === 403
+                ? response.status
+                : 503,
+          },
+        );
+      }
+      const value: unknown = JSON.parse(
+        new TextDecoder().decode(
+          await boundedBody(
+            new Request("http://internal/skills", {
+              method: "POST",
+              body: response.body,
+              duplex: "half",
+            } as RequestInit),
+            24 * 1024 * 1024,
+          ),
+        ),
+      );
+      const bundles = parseBundles(value);
+      signal.throwIfAborted();
+      const uid = worker.uid;
+      if (!Number.isSafeInteger(uid) || uid < 20000)
+        throw new Error("INVALID_SKILL_OWNER");
+      const base = join(dirname(dirname(worker.home)), "managed-skills");
+      await secureDirectory(base, 0, 0o711);
+      const root = join(base, worker.key);
+      await secureDirectory(root, uid, 0o550);
+      const retained = new Set<string>();
+      const items = [];
+      for (const bundle of bundles) {
+        signal.throwIfAborted();
+        const key = createHash("sha256")
+          .update(`${bundle.key}\0${bundle.version}\0${bundle.digest}`)
+          .digest("hex");
+        retained.add(key);
+        const target = join(root, key);
+        await secureDirectory(target, uid, 0o550);
+        for (const file of bundle.files) {
+          const path = join(target, file.path);
+          let parent = target;
+          for (const segment of file.path.split("/").slice(0, -1)) {
+            parent = join(parent, segment);
+            await secureDirectory(parent, uid, 0o550);
+          }
+          // The whole parent chain is coordinator-owned; the worker cannot replace inodes.
+          await writeFile(path, Buffer.from(file.contentBase64, "base64"), {
+            mode: 0o440,
+          });
+          await chown(path, 0, uid);
+          await chmod(path, 0o440);
+        }
+        const markdown = bundle.files.find((file) => file.path === "SKILL.md")!;
+        items.push({
+          key: bundle.key,
+          version: bundle.version,
+          digest: bundle.digest,
+          root: target,
+          markdown: Buffer.from(markdown.contentBase64, "base64").toString(
+            "utf8",
+          ),
+        });
+      }
+      for (const entry of await readdir(root))
+        if (!retained.has(entry))
+          await rm(join(root, entry), { recursive: true, force: true });
+      signal.throwIfAborted();
+      return Response.json(
+        { items },
+        { headers: { "cache-control": "no-store" } },
+      );
+    });
+  pending.set(worker.key, operation);
+  try {
+    return await operation;
+  } finally {
+    if (pending.get(worker.key) === operation) pending.delete(worker.key);
+  }
+}
+
+async function secureDirectory(path: string, gid: number, mode: number) {
+  await mkdir(path, { recursive: true, mode });
+  const value = await lstat(path);
+  if (!value.isDirectory() || value.isSymbolicLink() || value.uid !== 0)
+    throw new Error("INVALID_MANAGED_SKILL_DIRECTORY");
+  await chown(path, 0, gid);
+  await chmod(path, mode);
+}
+
+export function parseBundles(value: unknown): PublishedBundle[] {
+  const rows = Array.isArray(value)
+    ? value
+    : value && typeof value === "object" && "items" in value
+      ? value.items
+      : undefined;
+  if (!Array.isArray(rows) || rows.length > 128)
+    throw new Error("INVALID_PUBLISHED_SKILLS");
+  let total = 0;
+  const keys = new Set<string>();
+  return rows.map((row: unknown) => {
+    if (!row || typeof row !== "object")
+      throw new Error("INVALID_PUBLISHED_SKILL");
+    const item = row as Record<string, unknown>;
+    if (
+      typeof item.key !== "string" ||
+      !/^[a-zA-Z0-9._-]{1,160}$/.test(item.key) ||
+      keys.has(item.key) ||
+      !Number.isSafeInteger(item.version) ||
+      Number(item.version) < 1 ||
+      typeof item.digest !== "string" ||
+      !/^sha256:[a-f0-9]{64}$/.test(item.digest) ||
+      !Array.isArray(item.files) ||
+      item.files.length > 128
+    )
+      throw new Error("INVALID_PUBLISHED_SKILL");
+    keys.add(item.key);
+    const paths = new Set<string>();
+    const files = item.files.map((file: unknown) => {
+      if (!file || typeof file !== "object")
+        throw new Error("INVALID_PUBLISHED_SKILL_FILE");
+      const entry = file as Record<string, unknown>;
+      if (
+        typeof entry.path !== "string" ||
+        entry.path.length > 240 ||
+        !validFilePath(entry.path) ||
+        paths.has(entry.path) ||
+        typeof entry.contentBase64 !== "string" ||
+        !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(
+          entry.contentBase64,
+        )
+      )
+        throw new Error("INVALID_PUBLISHED_SKILL_FILE");
+      const size = Buffer.byteLength(entry.contentBase64, "base64");
+      total += size;
+      if (size > 4 * 1024 * 1024 || total > 16 * 1024 * 1024)
+        throw new Error("PUBLISHED_SKILLS_LIMIT");
+      paths.add(entry.path);
+      return {
+        path: entry.path,
+        contentBase64: Buffer.from(entry.contentBase64, "base64").toString(
+          "base64",
+        ),
+      };
+    });
+    if (!paths.has("SKILL.md"))
+      throw new Error("PUBLISHED_SKILL_MARKDOWN_REQUIRED");
+    files.sort((left, right) =>
+      left.path < right.path ? -1 : left.path > right.path ? 1 : 0,
+    );
+    const digest = `sha256:${createHash("sha256")
+      .update(JSON.stringify(files))
+      .digest("hex")}`;
+    if (digest !== item.digest)
+      throw new Error("PUBLISHED_SKILL_DIGEST_MISMATCH");
+    return {
+      key: item.key,
+      version: Number(item.version),
+      digest,
+      files,
+    };
+  });
+}