create-windy 0.8.3 → 0.10.0

package/template/apps/agent-server/runtime/reporting.ts

@@ -0,0 +1,219 @@
+import { json, SafeError } from "./contracts.js";
+import { ENGINE_ID } from "./compatibility.js";
+import { terminal, type RuntimeStore, type StoredRun } from "./store.js";
+import type { RuntimeConfig } from "./config.js";
+import { reportBreakdown } from "./report-breakdown.js";
+const unknownUsage = () => ({
+  inputTokens: null,
+  outputTokens: null,
+  cachedInputTokens: null,
+  reasoningTokens: null,
+  totalTokens: null,
+});
+export function reportResponse(
+  url: URL,
+  store: RuntimeStore,
+  config: RuntimeConfig,
+): Response {
+  if (url.pathname === "/metrics") {
+    const row = store.db
+      .prepare("SELECT COUNT(*) AS count FROM runs")
+      .get() as { count: number };
+    return new Response(
+      `# TYPE windy_agent_runs_total counter\nwindy_agent_runs_total ${row.count}\n`,
+      {
+        headers: {
+          "content-type": "text/plain; version=0.0.4",
+          "cache-control": "no-store",
+        },
+      },
+    );
+  }
+  const ids = store.db
+    .prepare("SELECT id FROM runs ORDER BY created_at DESC LIMIT 10000")
+    .all() as { id: string }[];
+  const rows = ids.map((row) => store.get(row.id));
+  const detail = /^\/api\/internal\/ai-runtime-report\/runs\/([^/]+)$/.exec(
+    url.pathname,
+  );
+  if (detail) {
+    const run = store.get(detail[1]!);
+    const events = store.events(run.id),
+      last = events.at(-1);
+    const safeError = last?.error as { code?: string } | undefined;
+    return json({
+      ...projectRun(run, store, config),
+      releaseId: String(run.request.release.releaseId ?? "unknown"),
+      traceId: run.request.traceId || run.id,
+      safeErrorCode: safeError?.code ?? null,
+      attempts: store.attempts(run.id),
+      trajectory: {
+        available: true,
+        events: events
+          .filter((event) => event.type !== "output.delta")
+          .map((event) => ({
+            sequence: event.sequence,
+            sequenceEnd: event.sequence,
+            type: event.type,
+            title: event.type,
+            ...(typeof event.toolKey === "string"
+              ? { toolKey: event.toolKey }
+              : {}),
+          })),
+      },
+    });
+  }
+  const mode = url.searchParams.get("scopeMode") ?? "none",
+    actorIds = url.searchParams.getAll("scopeActorId"),
+    departments = url.searchParams.getAll("scopeDepartmentId"),
+    selected = url.searchParams.get("actorId");
+  const range = url.searchParams.get("range") ?? "day";
+  if (
+    !["all", "bounded", "none"].includes(mode) ||
+    !["day", "month", "retained"].includes(range)
+  )
+    throw new SafeError("INVALID_INPUT", "报表范围无效", false, 400);
+  const days = range === "day" ? 1 : range === "month" ? 30 : 90,
+    since = Date.now() - days * 86400000;
+  const scoped = rows.filter((run) => {
+    if (Date.parse(run.createdAt) < since) return false;
+    const actor = run.request.reporting?.actorId,
+      department = run.request.reporting?.departmentId;
+    if (selected && actor !== selected) return false;
+    return (
+      mode === "all" ||
+      (mode === "bounded" &&
+        ((typeof actor === "string" && actorIds.includes(actor)) ||
+          (typeof department === "string" && departments.includes(department))))
+    );
+  });
+  if (url.pathname.endsWith("/runs")) {
+    const page = Number(url.searchParams.get("page") ?? 1),
+      pageSize = Number(url.searchParams.get("pageSize") ?? 20);
+    if (
+      !Number.isInteger(page) ||
+      page < 1 ||
+      !Number.isInteger(pageSize) ||
+      pageSize < 1 ||
+      pageSize > 100
+    )
+      throw new SafeError("INVALID_INPUT", "分页无效", false, 400);
+    return json({
+      items: scoped
+        .slice((page - 1) * pageSize, page * pageSize)
+        .map((run) => projectRun(run, store, config)),
+      total: scoped.length,
+      page,
+      pageSize,
+    });
+  }
+  if (!url.pathname.endsWith("/summary"))
+    return json(
+      {
+        code: "OPERATION_NOT_FOUND",
+        message: "报表接口不存在",
+        retryable: false,
+      },
+      404,
+    );
+  const projected = scoped.map((run) => projectRun(run, store, config)),
+    completed = scoped.filter((run) => run.status === "completed").length,
+    failed = scoped.filter((run) => run.status === "failed").length,
+    cancelled = scoped.filter((run) => run.status === "cancelled").length;
+  const measured = projected.filter((run) => run.usage.totalTokens !== null);
+  const sum = (field: "inputTokens" | "outputTokens" | "totalTokens") =>
+    measured.length
+      ? measured.reduce((total, run) => total + (run.usage[field] ?? 0), 0)
+      : null;
+  return json({
+    generatedAt: new Date().toISOString(),
+    reportingAvailableFrom: rows.at(-1)?.createdAt ?? null,
+    retentionDays: 90,
+    runs: {
+      total: scoped.length,
+      completed,
+      failed,
+      cancelled,
+      inProgress: scoped.length - completed - failed - cancelled,
+      successRate: completed + failed ? completed / (completed + failed) : null,
+    },
+    cache: {
+      hit: 0,
+      miss: 0,
+      unknown: projected.length,
+      hitRate: null,
+      tokenRate: null,
+      coverageRate: 0,
+    },
+    tokens: {
+      input: sum("inputTokens"),
+      output: sum("outputTokens"),
+      total: sum("totalTokens"),
+      cachedInput: null,
+      reasoning: null,
+      coverageRate: projected.length ? measured.length / projected.length : 0,
+    },
+    ...reportBreakdown(scoped, store),
+  });
+}
+function projectRun(
+  run: StoredRun,
+  store: RuntimeStore,
+  config: RuntimeConfig,
+) {
+  const events = store.events(run.id),
+    usageEvents = events.filter((event) => event.type === "usage.reported");
+  const attempts = store.attempts(run.id),
+    latest = attempts.at(-1);
+  const usage = unknownUsage() as {
+    inputTokens: number | null;
+    outputTokens: number | null;
+    cachedInputTokens: number | null;
+    reasoningTokens: number | null;
+    totalTokens: number | null;
+  };
+  if (usageEvents.length) {
+    usage.inputTokens = 0;
+    usage.outputTokens = 0;
+    usage.totalTokens = 0;
+    for (const event of usageEvents) {
+      const value = event.usage as {
+        inputTokens: number;
+        outputTokens: number;
+        totalTokens: number;
+      };
+      usage.inputTokens += value.inputTokens;
+      usage.outputTokens += value.outputTokens;
+      usage.totalTokens += value.totalTokens;
+    }
+  }
+  return {
+    runId: run.id,
+    engineId: ENGINE_ID,
+    operationKey: run.request.operationKey,
+    actorId: run.request.reporting?.actorId ?? null,
+    departmentId: run.request.reporting?.departmentId ?? null,
+    status: run.status,
+    startedAt: events.some((event) => event.type === "run.started")
+      ? run.createdAt
+      : null,
+    finishedAt: terminal(run.status) ? (latest?.finishedAt ?? null) : null,
+    durationMs:
+      terminal(run.status) && typeof latest?.finishedAt === "string"
+        ? Math.max(0, Date.parse(latest.finishedAt) - Date.parse(run.createdAt))
+        : null,
+    attemptCount: attempts.length,
+    modelDeployments: attempts.length
+      ? [
+          {
+            deploymentKey: config.deploymentKey,
+            model: config.model,
+            attemptCount: attempts.length,
+          },
+        ]
+      : [],
+    models: attempts.length ? [config.model] : [],
+    cacheStatus: "unknown",
+    usage,
+  };
+}

package/template/apps/agent-server/runtime/run-completion.ts

@@ -0,0 +1,39 @@
+import { SafeError, errorValue } from "./contracts.js";
+import { terminal, type RuntimeStore } from "./store.js";
+
+/** Publish terminal state only after DSH cleanup and scheduler release finish. */
+export async function completeDshTask(
+  execution: Promise<{ output: unknown; attestation: unknown }>,
+  input: {
+    id: string;
+    store: RuntimeStore;
+    signal: AbortSignal;
+    release: () => void;
+  },
+): Promise<void> {
+  const { id, store, signal, release } = input;
+  let output: Awaited<typeof execution> | undefined;
+  let failure: unknown;
+  try {
+    output = await execution;
+    signal.throwIfAborted();
+  } catch (error) {
+    failure = error;
+  } finally {
+    // executeDshRun resolves/rejects after handle and fibers are disposed.
+    release();
+  }
+  if (terminal(store.get(id).status)) return;
+  if (output && !failure && !signal.aborted) {
+    store.complete(id, output.output, output.attestation);
+  } else if (signal.aborted && !(signal.reason instanceof SafeError)) {
+    store.event(id, "run.cancelled", {}, "cancelled");
+  } else {
+    store.event(
+      id,
+      "run.failed",
+      { error: errorValue(signal.aborted ? signal.reason : failure) },
+      "failed",
+    );
+  }
+}

package/template/apps/agent-server/runtime/run-request-digest.ts

@@ -0,0 +1,18 @@
+import { digest, type RunRequest } from "./contracts.js";
+
+/** A new HTTP/durable attempt has a new trace, but the execution is unchanged. */
+export function runRequestDigest(request: RunRequest) {
+  return digest({ ...request, traceId: "" });
+}
+
+export function matchesRunRequestDigest(
+  request: RunRequest,
+  storedDigest: string,
+  storedRequest: string,
+) {
+  if (storedDigest === runRequestDigest(request)) return true;
+  // Old rows hashed the trace too. Reconstruct only that old trace; credentials,
+  // actor, input, prompt, release and governance must still match the old hash.
+  const previous = JSON.parse(storedRequest) as RunRequest;
+  return storedDigest === digest({ ...request, traceId: previous.traceId });
+}

package/template/apps/agent-server/runtime/runtime-test-fixtures.ts

@@ -0,0 +1,264 @@
+import { after, before } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { createCanonicalHandler } from "./index.js";
+import { configFromEnvironment } from "./config.js";
+import { runSchema } from "./contracts.js";
+import { canonicalDigest } from "./context-plugin.js";
+import { createHash } from "node:crypto";
+export const probeImage = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAGUlEQVR4nGP4z8BAEiJN9aiG0VBiGEpJAwCQ+f8B0adKSwAAAABJRU5ErkJggg==",
+  "base64",
+);
+export const internalToken = "test-internal-auth-token-32-bytes";
+export const providerParallelModes: boolean[] = [];
+export const providerPayloads: Record<string, unknown>[] = [];
+export let endpoint = "",
+  providerCalls = 0;
+export const contextState = {
+  valid: true,
+  revokeAfterCommit: false,
+  phases: [] as string[],
+  committedDigest: "",
+};
+const server = createServer(async (request, response) => {
+  let raw = "";
+  for await (const bytes of request) raw += bytes;
+  if (request.url === "/api/internal/agent/context-versions") {
+    const body = JSON.parse(raw);
+    contextState.phases.push(body.phase);
+    assert.equal(request.headers.authorization, `Bearer ${internalToken}`);
+    assert.equal(body.authorizationGrant, "test-grant");
+    if (!contextState.valid) {
+      response.writeHead(403).end();
+      return;
+    }
+    if (body.phase === "prepare") {
+      const content = "当前身份可读的业务上下文",
+        role = "system";
+      response.end(
+        JSON.stringify({
+          preparationId: "prepared-context",
+          sources: [
+            {
+              reference: {
+                ...body.sources[0],
+                version: "1",
+                sequence: 1,
+                digest: canonicalDigest({ role, content }),
+                validity: {
+                  status: "valid",
+                  checkedAt: new Date().toISOString(),
+                },
+              },
+              content,
+              role,
+            },
+          ],
+        }),
+      );
+      return;
+    }
+    if (body.phase === "commit") {
+      const envelope = body.governedEnvelope;
+      assert.equal(envelope.messages[1].origins[0].type, "context-source");
+      contextState.committedDigest = envelope.provider.requestDigest;
+      response.end(
+        JSON.stringify({
+          contextVersionId: "context-v1",
+          digest: "b".repeat(64),
+          status: "active",
+          providerRequestDigest: contextState.committedDigest,
+        }),
+      );
+      if (contextState.revokeAfterCommit) contextState.valid = false;
+      return;
+    }
+    response.end(JSON.stringify({ status: "aborted" }));
+    return;
+  }
+  if (request.url === "/tokenize") {
+    response.setHeader("content-type", "application/json");
+    response.end(JSON.stringify({ count: 10 }));
+    return;
+  }
+  if (request.url === "/api/internal/agent/tools/execute") {
+    const body = JSON.parse(raw);
+    assert.equal(body.executionGrant, "test-grant");
+    assert.equal(request.headers.authorization, `Bearer ${internalToken}`);
+    response.setHeader("content-type", "application/json");
+    response.end(JSON.stringify({ value: { count: 3 } }));
+    return;
+  }
+  if (request.url === "/artifacts") {
+    assert.equal(request.headers["x-ai-artifact-ref"], "opaque-artifact");
+    response.setHeader("content-type", "image/png");
+    response.end(probeImage);
+    return;
+  }
+  if (request.url !== "/v1/chat/completions") {
+    response.writeHead(404).end();
+    return;
+  }
+  providerCalls++;
+  if (contextState.committedDigest) {
+    assert.equal(
+      createHash("sha256").update(raw).digest("hex"),
+      contextState.committedDigest,
+    );
+    contextState.committedDigest = "";
+  }
+  const body = JSON.parse(raw);
+  providerPayloads.push(body);
+  assert.equal(body.model, "test-model");
+  assert.equal(typeof body.parallel_tool_calls, "boolean");
+  providerParallelModes.push(body.parallel_tool_calls);
+  if (body.tools?.length && body.response_format) {
+    response
+      .writeHead(400, { "content-type": "application/json" })
+      .end(JSON.stringify({ error: { code: "incompatible_response_format" } }));
+    return;
+  }
+  if (body.tools?.length) {
+    assert.match(body.tools[0].function.description, /业务工具 test.count/);
+    assert.match(
+      JSON.stringify(body.messages),
+      /最终答案必须只包含符合以下 JSON Schema/,
+    );
+  }
+  if (body.stream === false) {
+    response.setHeader("content-type", "application/json");
+    response.end(
+      JSON.stringify({
+        model: "test-model",
+        choices: [{ message: { content: '{"color":"red"}' } }],
+      }),
+    );
+    return;
+  }
+  response.setHeader("content-type", "text/event-stream");
+  const last = body.messages.at(-1);
+  const tools = body.tools?.length;
+  const chunk =
+    tools && last.role !== "tool"
+      ? {
+          choices: [
+            {
+              delta: {
+                tool_calls: [
+                  {
+                    index: 0,
+                    id: "provider_call_1",
+                    type: "function",
+                    function: {
+                      name: body.tools[0].function.name,
+                      arguments: "{}",
+                    },
+                  },
+                ],
+              },
+              finish_reason: "tool_calls",
+            },
+          ],
+        }
+      : {
+          choices: [
+            { delta: { content: '{"answer":"完成"}' }, finish_reason: "stop" },
+          ],
+        };
+  if (JSON.stringify(body.messages).includes("hold-model"))
+    await new Promise((resolve) => setTimeout(resolve, 150));
+  if (JSON.stringify(body.messages).includes("hold-timeout"))
+    await new Promise((resolve) => setTimeout(resolve, 1200));
+  response.write(`data: ${JSON.stringify(chunk)}\n\n`);
+  response.end(
+    `data: ${JSON.stringify({ choices: [], usage: { prompt_tokens: 10, completion_tokens: 8 } })}\n\ndata: [DONE]\n\n`,
+  );
+});
+before(async () => {
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  endpoint = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+});
+after(async () => {
+  await new Promise<void>((resolve, reject) =>
+    server.close((error) => (error ? reject(error) : resolve())),
+  );
+});
+export function runtime(overrides: NodeJS.ProcessEnv = {}) {
+  const config = configFromEnvironment({
+    AGENT_SERVER_INTERNAL_TOKEN: internalToken,
+    QWEN_API_URL: `${endpoint}/v1`,
+    QWEN_MODEL: "test-model",
+    AI_TOOL_HOST_URL: endpoint,
+    AGENT_RUNTIME_DATABASE_PATH: ":memory:",
+    AI_PROVIDER_MAX_CONCURRENT_RUNS: "",
+    AI_PROVIDER_MAX_QUEUE_DEPTH: "",
+    ...overrides,
+  });
+  return createCanonicalHandler({ config });
+}
+export function input(tools = false) {
+  return runSchema.parse({
+    operationKey: "test.operation",
+    input: {},
+    instructions: "请完成任务",
+    userPrompt: "查询数量",
+    outputSchema: {
+      type: "object",
+      properties: { answer: { type: "string" } },
+      required: ["answer"],
+      additionalProperties: false,
+    },
+    providerEgress: {
+      mode: "configured-endpoint",
+      deploymentKey: "ai.openai-compatible",
+    },
+    providerDataPolicy: {
+      inputFields: [],
+      envelopeFields: [
+        "instructions",
+        "user-prompt",
+        "tool-definitions",
+        "output-schema",
+        "provider-output",
+        "tool-results",
+      ].map((field) => ({
+        field,
+        classification: "internal",
+        dlpAction: "reject",
+      })),
+    },
+    toolNetworkPolicy: { mode: "forbidden" },
+    allowedTools: tools
+      ? [
+          {
+            key: "test.count",
+            label: "计数",
+            description: "获取数量",
+            inputSchema: { type: "object", additionalProperties: false },
+            approval: "none",
+          },
+        ]
+      : [],
+    executionGrant: "test-grant",
+    toolHostUrl: endpoint,
+    release: { releaseId: "test-release" },
+  });
+}
+export function request(
+  path: string,
+  method = "GET",
+  body?: unknown,
+  key = "test-key",
+) {
+  return new Request(`http://runtime${path}`, {
+    method,
+    headers: {
+      authorization: `Bearer ${internalToken}`,
+      "content-type": "application/json",
+      "Idempotency-Key": key,
+    },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  });
+}

package/template/apps/agent-server/runtime/runtime.nodecheck.ts

@@ -0,0 +1,150 @@
+import { test } from "node:test";
+import { businessToolName } from "./tool-name.js";
+import assert from "node:assert/strict";
+import {
+  runtime,
+  request,
+  input,
+  providerCalls,
+  providerParallelModes,
+} from "./runtime-test-fixtures.js";
+test("DSH owns actual model/tool loop and preserves canonical replay, result and idempotency", async () => {
+  const handler = runtime(),
+    beforeModes = providerParallelModes.length;
+  try {
+    const body = input(true),
+      started = await handler(request("/api/agent/runs", "POST", body));
+    assert.equal(started?.status, 200);
+    const run = (await started!.json()) as { runId: string; eventsUrl: string };
+    const replay = await handler(
+      request("/api/agent/runs", "POST", {
+        ...body,
+        traceId: "durable-retry-request",
+      }),
+    );
+    assert.equal(
+      ((await replay!.json()) as { runId: string }).runId,
+      run.runId,
+    );
+    const events = await handler(request(run.eventsUrl));
+    const text = await events!.text();
+    assert.match(text, /event: run.completed/);
+    assert.match(text, /event: tool.requested/);
+    assert.match(text, /event: tool.completed/);
+    assert.doesNotMatch(text, /sourceSnapshotDigest/);
+    const result = await handler(
+      request(`/api/agent/runs/${run.runId}/result`),
+    );
+    assert.equal(result?.status, 200);
+    const value = (await result!.json()) as {
+      output: unknown;
+      sources: unknown[];
+    };
+    assert.deepEqual(value.output, { answer: "完成" });
+    assert.equal(value.sources.length, 1);
+    assert.match(text, /"source":"provider-reported"/);
+    const detail = await handler(
+      request(`/api/internal/ai-runtime-report/runs/${run.runId}`),
+    );
+    const report = (await detail!.json()) as {
+      attempts: unknown[];
+      attemptCount: number;
+    };
+    assert.equal(report.attemptCount, 2);
+    assert.equal(report.attempts.length, 2);
+    const summary = await handler(
+      request("/api/internal/ai-runtime-report/summary?scopeMode=all"),
+    );
+    const summaryBody = (await summary!.json()) as {
+      byModel: unknown[];
+      activity: unknown[];
+    };
+    assert.equal(summaryBody.byModel.length, 1);
+    assert.equal(summaryBody.activity.length, 1);
+    assert.ok(providerCalls >= 2);
+    assert.deepEqual(providerParallelModes.slice(beforeModes), [false, false]);
+    const conflict = await handler(
+      request("/api/agent/runs", "POST", { ...body, userPrompt: "different" }),
+    );
+    assert.equal(conflict?.status, 409);
+  } finally {
+    await handler.close();
+  }
+});
+test("canonical routes fail closed without internal authentication and governance blocks unauthorized egress", async () => {
+  const handler = runtime(),
+    beforeCalls = providerCalls;
+  try {
+    const denied = await handler(
+      new Request("http://runtime/api/agent/runtime/compatibility"),
+    );
+    assert.equal(denied?.status, 403);
+    const body = input();
+    body.providerDataPolicy.envelopeFields = [];
+    const start = await handler(request("/api/agent/runs", "POST", body));
+    const run = (await start!.json()) as { eventsUrl: string };
+    const events = await handler(request(run.eventsUrl));
+    assert.match(await events!.text(), /FORBIDDEN/);
+    assert.equal(providerCalls, beforeCalls);
+  } finally {
+    await handler.close();
+  }
+});
+test("business tool aliases remain stable and explicitly identify the domain key", () => {
+  const name = businessToolName("case.search");
+  assert.match(name, /^[A-Za-z0-9_-]{1,64}$/);
+  assert.equal(businessToolName("case.search"), name);
+  assert.notEqual(businessToolName("case_search"), name);
+});
+test("output schema permission remains required when native tools disable response_format", async () => {
+  const handler = runtime(),
+    beforeCalls = providerCalls;
+  try {
+    const body = input(true);
+    body.providerDataPolicy.envelopeFields =
+      body.providerDataPolicy.envelopeFields.filter(
+        (rule) => rule.field !== "output-schema",
+      );
+    const start = await handler(request("/api/agent/runs", "POST", body));
+    const run = (await start!.json()) as { eventsUrl: string };
+    const events = await handler(request(run.eventsUrl));
+    assert.match(await events!.text(), /FORBIDDEN/);
+    assert.equal(providerCalls, beforeCalls);
+  } finally {
+    await handler.close();
+  }
+});
+test("Client Agent completion keeps windy meta, model alias and OpenAI SSE", async () => {
+  const handler = runtime();
+  try {
+    const response = await handler(
+      request("/api/internal/client-agent/chat/completions", "POST", {
+        clientRunId: "client_run_1",
+        operationKey: "browser.query",
+        deploymentKey: "ai.openai-compatible",
+        modelAlias: "browser-default",
+        attempt: 1,
+        messages: [{ role: "user", content: "hello" }],
+        providerDataPolicy: {
+          inputFields: [],
+          envelopeFields: [
+            {
+              field: "user-prompt",
+              classification: "public",
+              dlpAction: "reject",
+            },
+          ],
+        },
+        maxResponseBytes: 1048576,
+      }),
+    );
+    assert.equal(response?.status, 200);
+    const text = await response!.text();
+    assert.match(text, /event: windy.meta/);
+    assert.match(text, /browser-default/);
+    assert.equal(providerParallelModes.at(-1), false);
+    assert.match(text, /\[DONE\]/);
+  } finally {
+    await handler.close();
+  }
+});