create-windy 0.8.3 → 0.10.0

package/template/apps/agent-server/runtime/vision-readiness.ts

@@ -0,0 +1,200 @@
+import type { RuntimeConfig } from "./config.js";
+import type { RuntimeStore } from "./store.js";
+import type { ModelCapacity } from "./capacity.js";
+import { SafeError, digest } from "./contracts.js";
+import { boundedBody } from "./tool-plugin.js";
+import { governProvider } from "./governance.js";
+const probeImage =
+  "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAGUlEQVR4nGP4z8BAEiJN9aiG0VBiGEpJAwCQ+f8B0adKSwAAAABJRU5ErkJggg==";
+export class VisionReadiness {
+  private cached?: { expires: number; snapshot: Record<string, unknown> };
+  private pending?: Promise<Record<string, unknown>>;
+  constructor(
+    private config: RuntimeConfig,
+    private store: RuntimeStore,
+    private capacity: ModelCapacity,
+  ) {}
+  inspect(): Promise<Record<string, unknown>> {
+    if (this.cached && this.cached.expires > Date.now())
+      return Promise.resolve(this.cached.snapshot);
+    if (!this.pending)
+      this.pending = this.probe().finally(() => {
+        this.pending = undefined;
+      });
+    return this.pending;
+  }
+  async assertPin(pin: unknown) {
+    const snapshot = await this.inspect(),
+      deployment = snapshot.deployment;
+    if (
+      snapshot.status !== "ready" ||
+      !pin ||
+      !deployment ||
+      typeof pin !== "object" ||
+      typeof deployment !== "object" ||
+      ["key", "identity", "releaseDigest", "offersDigest"].some(
+        (key) =>
+          (pin as Record<string, unknown>)[key] !==
+          (deployment as Record<string, unknown>)[key],
+      )
+    )
+      throw new SafeError(
+        "RUNTIME_UNAVAILABLE",
+        "VLM Runtime 当前不可用",
+        true,
+        503,
+      );
+  }
+  private async probe(): Promise<Record<string, unknown>> {
+    const { config } = this;
+    const unavailable = (configured: boolean, code: string) => ({
+      schemaVersion: 1,
+      status: "unavailable",
+      configured,
+      runtimeKind: "agent",
+      observedAt: new Date().toISOString(),
+      downstreamProbe: { status: "not-run", reason: code },
+      deployment: null,
+      offers: [],
+      unavailableReasons: [
+        {
+          code: configured ? "RESOURCE_UNAVAILABLE" : "RUNTIME_NOT_CONFIGURED",
+          retryable: configured,
+        },
+      ],
+    });
+    if (
+      !config.model ||
+      !config.baseUrl ||
+      !config.capabilities.includes("vision") ||
+      !config.inputModalities.includes("image") ||
+      !/^windy-deployment-v1_[0-9a-f-]{36}$/.test(config.deploymentIdentity) ||
+      !/^sha256:[0-9a-f]{64}$/.test(config.releaseDigest)
+    )
+      return unavailable(false, "NOT_CONFIGURED");
+    const started = Date.now(),
+      checkedAt = new Date(started).toISOString();
+    let release: (() => void) | undefined;
+    try {
+      release = this.capacity.acquire();
+      const governed = governProvider(
+        [
+          {
+            role: "user",
+            content: [
+              {
+                type: "text",
+                text: '观察图片的主色。只返回 JSON 对象 {"color":"red"}。',
+              },
+              {
+                type: "image_url",
+                image_url: { url: probeImage, detail: "low" },
+              },
+            ],
+          },
+        ],
+        [],
+        undefined,
+        {
+          inputFields: [],
+          envelopeFields: ["user-prompt", "artifact-content"].map((field) => ({
+            field,
+            classification: "public",
+            dlpAction: "reject",
+          })),
+        },
+        this.store,
+        {
+          operationKey: "dsh.vision-readiness",
+          deploymentKey: config.deploymentKey,
+          attempt: 1,
+        },
+      );
+      const response = await fetch(`${config.baseUrl}/chat/completions`, {
+        method: "POST",
+        signal: AbortSignal.timeout(20000),
+        redirect: "error",
+        headers: {
+          "content-type": "application/json",
+          ...(config.apiKey
+            ? { authorization: `Bearer ${config.apiKey}` }
+            : {}),
+        },
+        body: JSON.stringify({
+          model: config.model,
+          messages: governed.messages,
+          stream: false,
+          parallel_tool_calls: false,
+          max_tokens: 128,
+          ...config.generation,
+        }),
+      });
+      if (!response.ok) {
+        await response.body?.cancel();
+        return unavailable(true, "UNHEALTHY");
+      }
+      const body = JSON.parse(await boundedBody(response, 16384)) as {
+        model?: string;
+        choices?: { message?: { content?: string } }[];
+      };
+      let value: unknown = JSON.parse(
+        body.choices?.[0]?.message?.content ?? "null",
+      );
+      if (Array.isArray(value) && value.length === 1) value = value[0];
+      if (
+        JSON.stringify(value) !== '{"color":"red"}' ||
+        body.model !== config.model
+      )
+        return unavailable(true, "UNHEALTHY");
+      const offers = [
+        {
+          variant: "vision",
+          capabilities: ["text-generation", "vision"],
+          inputModalities: ["text", "image"],
+          outputModalities: ["text"],
+          limits: {
+            maxDurationSeconds: 300,
+            maxInputBytes: 67108864,
+            maxOutputBytes: config.maxResponseBytes,
+            maxArtifacts: 16,
+            maxPixelsPerArtifact: 100000000,
+            maxConcurrentRuns: config.concurrency,
+            maxQueueDepth: config.queueDepth,
+          },
+        },
+      ];
+      const deployment = {
+        key: config.deploymentKey,
+        identity: config.deploymentIdentity,
+        releaseDigest: config.releaseDigest,
+        offersDigest: digest(offers),
+      };
+      const expires = started + 60000;
+      const snapshot = {
+        schemaVersion: 1,
+        status: "ready",
+        configured: true,
+        runtimeKind: "agent",
+        observedAt: new Date().toISOString(),
+        downstreamProbe: {
+          status: "passed",
+          checkedAt,
+          validUntil: new Date(expires).toISOString(),
+          latencyMs: Date.now() - started,
+          deploymentIdentity: deployment.identity,
+          releaseDigest: deployment.releaseDigest,
+          offersDigest: deployment.offersDigest,
+        },
+        deployment,
+        offers,
+        unavailableReasons: [],
+      };
+      this.cached = { expires, snapshot };
+      return snapshot;
+    } catch {
+      return unavailable(true, "CONNECTION_FAILED");
+    } finally {
+      release?.();
+    }
+  }
+}

package/template/apps/agent-server/scripts/confinement-check.mjs

@@ -0,0 +1,103 @@
+// Opt-in Linux fixture; invoked in the unified image by test-confinement.ts.
+import assert from "node:assert/strict";
+import { writeFileSync, existsSync } from "node:fs";
+import { Context } from "@deepseek-ai/cordis";
+import { probe } from "@deepseek-ai/node-addon-system/landlock-run";
+import WindySubprocess from "../plugins/subprocess.mjs";
+const output = {
+  platform: process.platform,
+  architecture: process.arch,
+  uid: process.getuid(),
+  landlock: probe(),
+  checks: [],
+};
+assert.equal(output.architecture, process.env.WINDY_EXPECTED_ARCH);
+assert.equal(output.uid, 20000);
+assert.equal(output.landlock, "full");
+writeFileSync("/outside/unconfined-control", "allowed-before-fence");
+const ctx = new Context();
+const fiber = ctx.plugin(WindySubprocess);
+await fiber.await();
+const adapter = ctx.get("subprocess");
+async function execute(name, argv) {
+  const handle = adapter.spawn({
+    argv,
+    cwd: "/workspace",
+    stdio: {
+      stdin: "ignore",
+      stdout: { maxBytes: 8192 },
+      stderr: { maxBytes: 8192 },
+    },
+    graceMs: 500,
+    signal: AbortSignal.timeout(10000),
+  });
+  const result = await handle.done;
+  const stdout = handle.collected.stdout.readFrom(0).text,
+    stderr = handle.collected.stderr.readFrom(0).text;
+  assert.equal(result.exitCode, 0, `${name}: ${stderr}`);
+  assert.equal(await handle.waitForExit(AbortSignal.timeout(3000)), true);
+  output.checks.push({
+    name,
+    exitCode: result.exitCode,
+    stdout: stdout.trim(),
+  });
+}
+try {
+  await execute("python-write-workspace", [
+    "/opt/venv/bin/python",
+    "-c",
+    `from pathlib import Path; Path('python.txt').write_text('中文'); assert Path('python.txt').read_text()=='中文'; print('passed')`,
+  ]);
+  await execute("node-write-workspace", [
+    "/usr/local/bin/node",
+    "-e",
+    `const fs=require('node:fs');fs.writeFileSync('node.txt','allowed');if(fs.readFileSync('node.txt','utf8')!=='allowed')process.exit(2);console.log('passed')`,
+  ]);
+  await execute("outside-write-denied", [
+    "/opt/venv/bin/python",
+    "-c",
+    `import errno; from pathlib import Path\ntry: Path('/outside/escaped').write_text('denied')\nexcept OSError as e: assert e.errno in (errno.EACCES,errno.EPERM);print('passed')\nelse: raise AssertionError('outside write allowed')`,
+  ]);
+  await execute("network-socket-denied", [
+    "/opt/venv/bin/python",
+    "-c",
+    `import socket,errno\ntry: socket.socket()\nexcept OSError as e: assert e.errno==errno.EPERM;print('passed')\nelse: raise AssertionError('socket allowed')`,
+  ]);
+  await execute("inherited-child-network-and-file-denied", [
+    "/opt/venv/bin/python",
+    "-c",
+    `import subprocess\ncode="import errno,socket\\ntry: socket.socket()\\nexcept OSError as e: assert e.errno==errno.EPERM\\nelse: raise AssertionError('child socket allowed')\\ntry: open('/outside/child-escaped','w')\\nexcept OSError as e: assert e.errno in (errno.EACCES,errno.EPERM)\\nelse: raise AssertionError('child outside write allowed')\\nprint('passed')"\nr=subprocess.run(['/opt/venv/bin/python','-c',code],capture_output=True,text=True); assert r.returncode==0,r.stderr; print(r.stdout.strip())`,
+  ]);
+  const terminal = await adapter.spawnTerminal({
+    argv: [
+      "/opt/venv/bin/python",
+      "-c",
+      `import socket,errno; from pathlib import Path\nPath('terminal.txt').write_text('allowed')\ntry: socket.socket()\nexcept OSError as e: assert e.errno==errno.EPERM\nelse: raise AssertionError('terminal socket allowed')\ntry: Path('/outside/terminal-escaped').write_text('denied')\nexcept OSError as e: assert e.errno in (errno.EACCES,errno.EPERM)\nelse: raise AssertionError('terminal outside write allowed')\nprint('passed')`,
+    ],
+    cwd: "/workspace",
+    rows: 24,
+    cols: 80,
+    terminalType: "xterm",
+    graceMs: 500,
+    signal: AbortSignal.timeout(10000),
+  });
+  let terminalText = "";
+  const terminalOutput = (async () => {
+    for await (const data of terminal.output) terminalText += data.toString();
+  })();
+  const terminalResult = await terminal.done;
+  await terminalOutput;
+  assert.equal(terminalResult.exitCode, 0, terminalText);
+  await terminal.terminate();
+  output.checks.push({
+    name: "pty-workspace-and-network-file-fence",
+    exitCode: terminalResult.exitCode,
+    stdout: terminalText.trim(),
+  });
+  assert.equal(existsSync("/outside/terminal-escaped"), false);
+  assert.equal(existsSync("/outside/escaped"), false);
+  assert.equal(existsSync("/outside/child-escaped"), false);
+  console.log(JSON.stringify(output, null, 2));
+} finally {
+  await fiber.dispose();
+}

package/template/apps/agent-server/scripts/coordinator-check.mjs

@@ -0,0 +1,344 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { createServer } from "node:http";
+import { readFile, writeFile, stat, chown } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import WebSocket from "/app/node_modules/ws/wrapper.mjs";
+const exec = promisify(execFile);
+const sessions = new Map([
+  ["a".repeat(43), "alpha"],
+  ["b".repeat(43), "beta"],
+]);
+let mcpCalls = 0;
+let admissionUnavailable = false;
+let sharedAllowed = true,
+  sharedVersion = 1;
+const product = createServer(async (req, res) => {
+  const token = req.headers.authorization?.slice(7);
+  const actor = sessions.get(token);
+  if (req.url === "/api/agent/workbench/admission") {
+    if (admissionUnavailable) {
+      res.writeHead(503).end();
+      return;
+    }
+    res.writeHead(actor ? 200 : 401, { "content-type": "application/json" });
+    res.end(JSON.stringify({ actor: { type: "user", id: actor } }));
+    return;
+  }
+  if (req.url === "/api/platform/branding") {
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(
+      JSON.stringify({
+        softwareName: "Windy 验收",
+        logoUrl: "/fixture-logo.png",
+      }),
+    );
+    return;
+  }
+  if (req.url === "/api/agent/workbench/skills") {
+    assert.ok(actor);
+    if (!sharedAllowed) {
+      res.writeHead(403).end();
+      return;
+    }
+    res.writeHead(200, { "content-type": "application/json" });
+    const content = `---\nname: governed-review\ndescription: 核对授权资料\n---\n读取 references/check.md 并保留来源。\n`;
+    const files = [
+      {
+        path: "SKILL.md",
+        contentBase64: Buffer.from(content).toString("base64"),
+      },
+      {
+        path: "references/check.md",
+        contentBase64: Buffer.from(`Authorized ${actor} attachment`).toString(
+          "base64",
+        ),
+      },
+    ].sort((left, right) =>
+      left.path < right.path ? -1 : left.path > right.path ? 1 : 0,
+    );
+    const digest = `sha256:${createHash("sha256").update(JSON.stringify(files)).digest("hex")}`;
+    res.end(
+      JSON.stringify({
+        items: [
+          { key: "governed-review", version: sharedVersion, digest, files },
+        ],
+      }),
+    );
+    return;
+  }
+  if (req.url === "/api/mcp") {
+    assert.ok(actor);
+    mcpCalls++;
+    const parts = [];
+    for await (const part of req) parts.push(part);
+    const value = JSON.parse(Buffer.concat(parts).toString() || "{}");
+    if (value.id === undefined) {
+      res.writeHead(202);
+      res.end();
+      return;
+    }
+    const result =
+      value.method === "initialize"
+        ? {
+            protocolVersion: "2025-03-26",
+            capabilities: { tools: {} },
+            serverInfo: { name: "fixture", version: "1" },
+          }
+        : value.method === "tools/list"
+          ? { tools: [] }
+          : {};
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(JSON.stringify({ jsonrpc: "2.0", id: value.id, result }));
+    return;
+  }
+  res.writeHead(404);
+  res.end();
+});
+await new Promise((r) => product.listen(9747, "127.0.0.1", r));
+Object.assign(process.env, {
+  PORT: "8080",
+  AGENT_SERVER_INTERNAL_TOKEN: "fixture-internal-credential-at-least-32",
+  AI_TOOL_HOST_URL: "http://127.0.0.1:9747",
+  AGENT_CONTEXT_HOST_URL: "http://127.0.0.1:9747",
+  AGENT_RUNTIME_DATABASE_PATH: "/app/data/agent/embedded-dsh.sqlite",
+  AGENT_DSH_MAX_USERS: "2",
+  WINDY_APP_ROOT: "/app/apps/agent-server",
+});
+await writeFile("/app/data/agent/legacy-fixture.sqlite", "retired-secret", {
+  mode: 0o644,
+});
+await writeFile(
+  "/app/data/agent/legacy-user-fixture.sqlite",
+  "retired-uid10001-secret",
+  { mode: 0o644 },
+);
+await chown("/app/data/agent/legacy-user-fixture.sqlite", 10001, 10001);
+const { startAgentServer } =
+  await import("/app/apps/agent-server/dist/main.js");
+const app = await startAgentServer(8080);
+const headers = (id) => ({
+  authorization: "Bearer fixture-internal-credential-at-least-32",
+  "x-windy-actor-id": id === "a" ? "alpha" : "beta",
+  "x-windy-product-session": id.repeat(43),
+  "x-windy-public-origin": "http://localhost:18749",
+});
+async function call(id, path = "/", init = {}) {
+  return fetch("http://127.0.0.1:8080/internal/workbench" + path, {
+    ...init,
+    headers: { ...headers(id), ...init.headers },
+    signal: AbortSignal.timeout(60000),
+  });
+}
+try {
+  let r = await call("a");
+  assert.equal(r.status, 200);
+  const html = await r.text();
+  assert.ok(html.includes("__DSH_BOOT__"));
+  assert.equal(r.headers.get("set-cookie"), null);
+  r = await call("b");
+  assert.equal(r.status, 200);
+  await r.text();
+  const oldUserFile = await stat("/app/data/agent/legacy-user-fixture.sqlite");
+  assert.equal(oldUserFile.uid, 0);
+  assert.equal(oldUserFile.mode & 0o777, 0o600);
+  const workers = [...app.manager.workers.values()];
+  assert.equal(workers.length, 2);
+  const [a, b] = workers;
+  assert.notEqual(a.port, b.port);
+  assert.notEqual(a.token, b.token);
+  assert.notEqual(a.cookie, b.cookie);
+  const sa = await stat(a.home),
+    sb = await stat(b.home);
+  assert.notEqual(sa.uid, sb.uid);
+  assert.equal(sa.mode & 0o777, 0o700);
+  assert.equal(sb.mode & 0o777, 0o700);
+  await writeFile(a.home + "/workspace/private.txt", "only-alpha");
+  let denied = false;
+  try {
+    await exec(
+      "node",
+      [
+        "-e",
+        `require('fs').readFileSync(${JSON.stringify(a.home + "/workspace/private.txt")})`,
+      ],
+      { uid: sb.uid, gid: sb.uid },
+    );
+  } catch {
+    denied = true;
+  }
+  assert.ok(denied);
+  const { stdout: environ } = await exec(
+    "node",
+    [
+      "-e",
+      `process.stdout.write(require('fs').readFileSync('/proc/${a.child.pid}/environ','utf8'))`,
+    ],
+    { uid: sa.uid, gid: sa.uid },
+  );
+  assert.ok(!environ.includes("fixture-internal-credential-at-least-32"));
+  assert.ok(!environ.includes("a".repeat(43)));
+  assert.ok(!environ.includes("QWEN_API_KEY="));
+  const readPublished = async (worker) => {
+    const response = await fetch(
+      "http://127.0.0.1:8080/internal/boundary/skills",
+      { headers: { authorization: `Bearer ${worker.token}` } },
+    );
+    return { status: response.status, value: await response.json() };
+  };
+  const published = await readPublished(a);
+  assert.equal(published.status, 200);
+  const publishedRoot = published.value.items[0].root;
+  const publishedStat = await stat(publishedRoot);
+  assert.equal(publishedStat.uid, 0);
+  assert.equal(publishedStat.gid, sa.uid);
+  assert.equal(publishedStat.mode & 0o777, 0o550);
+  const attachment = publishedRoot + "/references/check.md";
+  assert.equal((await stat(attachment)).mode & 0o777, 0o440);
+  const ownAttachment = await exec(
+    "node",
+    [
+      "-e",
+      `process.stdout.write(require('fs').readFileSync(${JSON.stringify(attachment)},'utf8'))`,
+    ],
+    { uid: sa.uid, gid: sa.uid },
+  );
+  assert.equal(ownAttachment.stdout, "Authorized alpha attachment");
+  await assert.rejects(
+    exec(
+      "node",
+      ["-e", `require('fs').readFileSync(${JSON.stringify(attachment)})`],
+      { uid: sb.uid, gid: sb.uid },
+    ),
+  );
+  await assert.rejects(
+    exec(
+      "node",
+      [
+        "-e",
+        `require('fs').writeFileSync(${JSON.stringify(attachment)},'forged')`,
+      ],
+      { uid: sa.uid, gid: sa.uid },
+    ),
+  );
+  sharedVersion = 2;
+  const replacementSkills = await readPublished(a);
+  assert.equal(replacementSkills.value.items[0].version, 2);
+  await assert.rejects(stat(publishedRoot));
+  sharedAllowed = false;
+  const deniedSkills = await readPublished(a);
+  assert.equal(deniedSkills.status, 200);
+  assert.deepEqual(deniedSkills.value.items, []);
+  await assert.rejects(stat(replacementSkills.value.items[0].root));
+  sharedAllowed = true;
+  const boot = await call("a", "/windy/internal-bootstrap");
+  assert.equal(boot.status, 503);
+  const handoff = await call("a", "/windy/handoff", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      conversationId: "fixture",
+      context: { text: "Synthetic user context" },
+    }),
+  });
+  assert.equal(handoff.status, 200);
+  assert.match((await handoff.json()).sessionId, /^[A-Za-z0-9_-]+$/);
+  const brand = await call("a", "/windy/branding");
+  assert.equal((await brand.json()).softwareName, "Windy 验收");
+  const catalog = await call(
+    "a",
+    "/windy/tool-catalog?query=discover_business_tools",
+  );
+  assert.equal(catalog.status, 200);
+  assert.ok(
+    (await catalog.json()).items.some(
+      (tool) => tool.name === "discover_business_tools",
+    ),
+  );
+  const summarySkill = await readFile(
+    "/app/apps/agent-server/plugins/skills/windy-data-summary/SKILL.md",
+    "utf8",
+  );
+  assert.match(summarySkill, /name: windy-data-summary/);
+  const ws = new WebSocket(
+    "ws://127.0.0.1:8080/internal/workbench/api/remote.mux",
+    { headers: headers("a") },
+  );
+  await new Promise((resolve, reject) => {
+    ws.once("open", resolve);
+    ws.once("error", reject);
+  });
+  const paused = new Promise((resolve) => ws.once("close", resolve));
+  const originalPid = a.child.pid;
+  admissionUnavailable = true;
+  assert.equal((await call("a")).status, 503);
+  await Promise.race([
+    paused,
+    new Promise((_, reject) =>
+      setTimeout(
+        () => reject(Error("temporary admission did not close transport")),
+        7000,
+      ),
+    ),
+  ]);
+  assert.equal(a.controller.signal.aborted, false);
+  assert.equal(app.manager.workers.size, 2);
+  admissionUnavailable = false;
+  const recovered = await call("a");
+  assert.equal(recovered.status, 200);
+  assert.ok((await recovered.text()).includes("__DSH_BOOT__"));
+  assert.equal(a.child.pid, originalPid);
+  assert.equal(app.manager.workers.get(a.key), a);
+  const recoveredWs = new WebSocket(
+    "ws://127.0.0.1:8080/internal/workbench/api/remote.mux",
+    { headers: headers("a") },
+  );
+  await new Promise((resolve, reject) => {
+    recoveredWs.once("open", resolve);
+    recoveredWs.once("error", reject);
+  });
+  const closed = new Promise((resolve) => recoveredWs.once("close", resolve));
+  sessions.delete("a".repeat(43));
+  await Promise.race([
+    closed,
+    new Promise((_, reject) =>
+      setTimeout(() => reject(Error("revocation timeout")), 7000),
+    ),
+  ]);
+  assert.equal((await call("a")).status, 401);
+  assert.equal((await call("b")).status, 200);
+  assert.equal(app.manager.workers.size, 1);
+  assert.equal(
+    (await stat("/app/data/agent/legacy-fixture.sqlite")).mode & 0o777,
+    0o600,
+  );
+  console.log(
+    JSON.stringify({
+      nativeHtml: true,
+      independentUid: true,
+      privateCookies: true,
+      noBrowserCookieLeak: true,
+      crossUserFileDenied: true,
+      credentialScrubbing: true,
+      mcpBoundToActor: mcpCalls > 0,
+      genericToolCatalogMounted: true,
+      genericSkillBundled: true,
+      publishedSkillActorIsolation: true,
+      publishedSkillReadOnly: true,
+      publishedSkillVersionRevocation: true,
+      webSocketNativeHandshake: true,
+      temporaryAdmissionPreservesWorker: true,
+      recoveredNativeHtml: true,
+      oldTransportClosed: true,
+      logoutKillsWorker: true,
+      otherUserSurvives: true,
+      legacyFileMode:
+        (await stat("/app/data/agent/legacy-fixture.sqlite")).mode & 0o777,
+    }),
+  );
+} finally {
+  await app.close();
+  product.closeAllConnections();
+  await new Promise((r) => product.close(r));
+}