create-windy 0.8.3 → 0.10.0

package/template/apps/server/src/app/dsh-workbench-lan-origin.test.ts

@@ -0,0 +1,114 @@
+import { expect, test } from "bun:test";
+import {
+  createDshWebProxy,
+  type DshWebSocketState,
+} from "../../../web/dsh-workbench-proxy.js";
+import { dshFixture } from "./dsh-workbench-test-support.js";
+
+test("HTTP LAN assets retain the browser authority across both product hops", async () => {
+  const previousOrigin = process.env.WINDY_PUBLIC_BASE_URL;
+  let fixture: Awaited<ReturnType<typeof dshFixture>>;
+  try {
+    delete process.env.WINDY_PUBLIC_BASE_URL;
+    fixture = await dshFixture({}, null);
+  } finally {
+    if (previousOrigin === undefined) delete process.env.WINDY_PUBLIC_BASE_URL;
+    else process.env.WINDY_PUBLIC_BASE_URL = previousOrigin;
+  }
+  fixture.state.probe = (request) =>
+    new Response(
+      request.url.endsWith("/internal/workbench/")
+        ? '<html><head><script type="module" crossorigin src="./assets/index.js"></script></head></html>'
+        : "synthetic asset",
+      { headers: { "content-type": "text/html" } },
+    );
+  fixture.app.listen({ hostname: "127.0.0.1", port: 0 });
+  const proxy = createDshWebProxy(fixture.app.server!.url.origin);
+  const web = Bun.serve<DshWebSocketState>({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch: (request, server) => proxy.fetch(request, server),
+    websocket: proxy.websocket,
+  });
+  // An HTTP LAN browser sends Origin for crossorigin assets but no Fetch
+  // Metadata headers. Host changes also model a DHCP address change.
+  const request = (path: string, host: string, origin?: string) =>
+    fetch(new URL(path, web.url), {
+      headers: {
+        host,
+        cookie: `windy.sid=${fixture.login.token}`,
+        ...(origin ? { origin } : {}),
+        "x-forwarded-host": "forged.test",
+        "x-forwarded-proto": "https",
+        "x-windy-public-origin": "https://forged.test",
+      },
+    });
+  try {
+    for (const host of ["192.0.2.10:9746", "192.0.2.20:9746"]) {
+      const entry = await request("/agent/", host);
+      expect(entry.status).toBe(200);
+      expect(await entry.text()).toContain('<base href="/agent/">');
+      for (const asset of ["index.js", "vendor.js", "index.css"]) {
+        const response = await request(
+          `/agent/assets/${asset}`,
+          host,
+          `http://${host}`,
+        );
+        expect(response.status).toBe(200);
+        await response.text();
+        expect(
+          fixture.state.probes.at(-1)!.headers.get("x-windy-public-origin"),
+        ).toBe(`http://${host}`);
+      }
+      for (const origin of [
+        "https://foreign.test",
+        "https://forged.test",
+        "null",
+      ]) {
+        const denied = await request("/agent/assets/index.js", host, origin);
+        expect(denied.status).toBe(403);
+        expect(await denied.json()).toEqual({ error: "INVALID_ORIGIN" });
+      }
+    }
+    fixture.state.permissions = [];
+    const denied = await request(
+      "/agent/assets/index.js",
+      "192.0.2.20:9746",
+      "http://192.0.2.20:9746",
+    );
+    expect(denied.status).toBe(403);
+    await denied.text();
+  } finally {
+    web.stop(true);
+    await fixture.app.stop(true);
+  }
+});
+
+test("the Web proxy cannot override an explicitly configured public origin", async () => {
+  const fixture = await dshFixture();
+  fixture.app.listen({ hostname: "127.0.0.1", port: 0 });
+  const proxy = createDshWebProxy(fixture.app.server!.url.origin);
+  const web = Bun.serve<DshWebSocketState>({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch: (request, server) => proxy.fetch(request, server),
+    websocket: proxy.websocket,
+  });
+  try {
+    for (const origin of ["http://192.0.2.10:9746", "https://windy.test"]) {
+      const response = await fetch(new URL("/agent/assets/index.js", web.url), {
+        headers: {
+          host: "192.0.2.10:9746",
+          cookie: `windy.sid=${fixture.login.token}`,
+          origin,
+        },
+      });
+      expect(response.status).toBe(origin === "https://windy.test" ? 200 : 403);
+      await response.text();
+    }
+    expect(fixture.state.probes).toHaveLength(1);
+  } finally {
+    web.stop(true);
+    await fixture.app.stop(true);
+  }
+});

package/template/apps/server/src/app/dsh-workbench-launch.test.ts

@@ -0,0 +1,70 @@
+import { expect, test } from "bun:test";
+import { actorId, dshFixture } from "./dsh-workbench-test-support.js";
+
+test("logout and expiry close native admission without creating another login", async () => {
+  const fixture = await dshFixture();
+  const admission = await fixture.request("/agent/workbench/admission");
+  expect((await admission.json()).actor.id).toBe(actorId);
+  const actor = await fixture.repository.resolveSessionActor(
+    fixture.login.session.tokenHash,
+    new Date(fixture.state.now),
+  );
+  await fixture.service.logout(fixture.login.token, actor!);
+  expect([401, 403]).toContain(
+    (await fixture.request("/agent/workbench/admission")).status,
+  );
+  expect([401, 403]).toContain(
+    (await fixture.request("/agent/native/")).status,
+  );
+  const expired = await dshFixture();
+  expired.state.now = expired.login.session.expiresAt.getTime() + 1;
+  expect([401, 403]).toContain(
+    (await expired.request("/agent/native/")).status,
+  );
+  expect(fixture.state.probes).toEqual([]);
+});
+
+test("cross-origin writes, installations and browser-supplied internal control paths fail closed", async () => {
+  const fixture = await dshFixture();
+  const invalidRequests: RequestInit[] = [
+    { headers: { origin: "https://evil.test" } },
+    { headers: { origin: "" } },
+    { headers: { "sec-fetch-site": "cross-site" } },
+    { headers: { authorization: "Bearer bax_installation" } },
+    { headers: { authorization: "Bearer car_run" } },
+    { headers: { cookie: "" } },
+  ];
+  for (const init of invalidRequests)
+    expect([401, 403]).toContain(
+      (await fixture.request("/agent/native/api/invoke", "POST", init)).status,
+    );
+  for (const path of [
+    "/windy/internal-bootstrap",
+    "/internal/clear",
+    "/windy/internal-status",
+    "/api/%2Fprivate",
+  ])
+    expect((await fixture.request(`/agent/native${path}`)).status).toBe(404);
+  expect(fixture.state.probes).toEqual([]);
+});
+
+test("the coordinator receives the current login session, not a per-user URL registry", async () => {
+  const fixture = await dshFixture();
+  await fixture.request("/agent/native/");
+  const second = await fixture.service.login("trial", "test-password");
+  if (!second.ok) throw new Error("login failed");
+  await fixture.request("/agent/native/", "GET", {
+    headers: { cookie: `windy.sid=${second.token}` },
+  });
+  expect(
+    fixture.state.probes.map((request) =>
+      request.headers.get("x-windy-product-session"),
+    ),
+  ).toEqual([fixture.login.token, second.token]);
+  expect(
+    await fixture.repository.listUserSessions(
+      actorId,
+      new Date(fixture.state.now),
+    ),
+  ).toHaveLength(2);
+});

package/template/apps/server/src/app/dsh-workbench-origin.test.ts

@@ -0,0 +1,54 @@
+import { expect, test } from "bun:test";
+import { dshFixture } from "./dsh-workbench-test-support.js";
+
+const navigation = {
+  origin: "",
+  "sec-fetch-site": "cross-site",
+  "sec-fetch-mode": "navigate",
+  "sec-fetch-dest": "document",
+};
+
+test("external top-level links can open the native entry and still require a valid login", async () => {
+  const fixture = await dshFixture();
+  fixture.state.probe = () =>
+    new Response("<html><head></head><body>entry</body></html>", {
+      headers: { "content-type": "text/html" },
+    });
+  for (const path of ["/agent/native", "/agent/native/"]) {
+    const response = await fixture.request(path, "GET", {
+      headers: navigation,
+    });
+    expect(response.status).toBe(200);
+    expect(await response.text()).toContain("entry");
+  }
+  expect(fixture.state.probes).toHaveLength(2);
+  const anonymous = await fixture.request("/agent/native", "GET", {
+    headers: { ...navigation, cookie: "" },
+  });
+  expect(anonymous.status).toBe(401);
+  expect(fixture.state.probes).toHaveLength(2);
+});
+
+test("navigation exception does not allow cross-site API reads, embedding, writes or foreign Origin", async () => {
+  const fixture = await dshFixture();
+  for (const [path, method, extra] of [
+    ["/agent/native/api/invoke", "GET", {}],
+    ["/agent/workbench/admission", "GET", {}],
+    ["/agent/native", "POST", {}],
+    ["/agent/native", "GET", { "sec-fetch-dest": "iframe" }],
+    [
+      "/agent/native",
+      "GET",
+      { "sec-fetch-dest": "empty", "sec-fetch-mode": "cors" },
+    ],
+    ["/agent/native", "GET", { "sec-fetch-mode": "websocket" }],
+    ["/agent/native", "GET", { origin: "https://foreign.test" }],
+  ] as const) {
+    const response = await fixture.request(path, method, {
+      headers: { ...navigation, ...extra },
+    });
+    expect(response.status).toBe(403);
+    expect(await response.json()).toEqual({ error: "INVALID_ORIGIN" });
+  }
+  expect(fixture.state.probes).toHaveLength(0);
+});

package/template/apps/server/src/app/dsh-workbench-proxy.ts

@@ -0,0 +1,205 @@
+import type { DshProductSession } from "./dsh-workbench-session.js";
+import { auditDshSkillDraftResponse } from "./dsh-skill-draft-audit.js";
+
+export interface DshWorkbenchOptions {
+  readonly publishedSkills?: (
+    context: import("../guards.js").RequestGuardContext,
+  ) => Promise<
+    readonly import("@southwind-ai/shared").AgentSkillRuntimeBundle[]
+  >;
+  readonly baseUrl?: () => string | undefined;
+  readonly internalToken?: () => string | undefined;
+  readonly fetcher?: (
+    input: string | URL | Request,
+    init?: RequestInit,
+  ) => Promise<Response>;
+  readonly now?: () => number;
+  readonly authorizationIntervalMs?: number;
+}
+
+export const DSH_NATIVE_PREFIX = "/api/agent/native";
+export const DSH_NATIVE_SOCKET = "/agent/native/api/remote.mux";
+export const DSH_NATIVE_STARTUP_TIMEOUT_MS = 75_000;
+export const DSH_NATIVE_REQUEST_TIMEOUT_SECONDS = 90;
+
+export function isDshNativeDocument(request: Request): boolean {
+  return (
+    request.method === "GET" &&
+    new URL(request.url).pathname.replace(/\/$/, "") === DSH_NATIVE_PREFIX
+  );
+}
+
+export function isDshSkillRequest(request: Request): boolean {
+  return (
+    request.method === "POST" &&
+    new URL(request.url).pathname === `${DSH_NATIVE_PREFIX}/windy/skills`
+  );
+}
+
+/** The only destination is the configured Agent Server, never a browser URL. */
+export function dshInternalTarget(
+  options: DshWorkbenchOptions,
+  path: string,
+): URL {
+  const base = new URL(
+    (options.baseUrl ?? (() => process.env.AGENT_SERVER_URL))() ||
+      "http://agent-server:8080",
+  );
+  if (
+    !/^(https?:)$/.test(base.protocol) ||
+    base.username ||
+    base.password ||
+    base.search ||
+    base.hash ||
+    base.pathname !== "/"
+  )
+    throw new Error("Invalid Agent Server endpoint");
+  return new URL(path, base);
+}
+
+export function dshInternalHeaders(
+  options: DshWorkbenchOptions,
+  session: DshProductSession,
+  publicOrigin: string,
+  source: Headers,
+): Headers {
+  const token = (
+    options.internalToken ?? (() => process.env.AGENT_SERVER_INTERNAL_TOKEN)
+  )()?.trim();
+  if (!token || token.length < 32 || /[\r\n]/.test(token))
+    throw new Error("Missing Agent Server credential");
+  const headers = new Headers({
+    authorization: `Bearer ${token}`,
+    "x-windy-actor-id": session.actorId,
+    "x-windy-product-session": session.token,
+    "x-windy-public-origin": publicOrigin,
+  });
+  for (const name of ["accept", "content-type", "range", "if-range"])
+    if (source.has(name)) headers.set(name, source.get(name)!);
+  // Native DSH checks the browser origin too. Never forward a supplied Origin.
+  headers.set("origin", publicOrigin);
+  return headers;
+}
+
+export function dshNativePath(request: Request): string | undefined {
+  const url = new URL(request.url);
+  if (
+    url.pathname !== DSH_NATIVE_PREFIX &&
+    !url.pathname.startsWith(`${DSH_NATIVE_PREFIX}/`)
+  )
+    return;
+  const path = url.pathname.slice(DSH_NATIVE_PREFIX.length) || "/";
+  // Internal control paths and any encoded slash/traversal cannot cross the browser boundary.
+  if (
+    /\/(?:internal(?:[-/]|$)|windy\/internal[-/])/i.test(path) ||
+    /%2f|%5c|%2e|\\/i.test(path)
+  )
+    return;
+  return `/internal/workbench${path}${url.search}`;
+}
+
+export async function proxyDshNative(input: {
+  request: Request;
+  session: DshProductSession;
+  publicOrigin: string;
+  options: DshWorkbenchOptions;
+  completeSkillDraft?(): Promise<Response | void>;
+}): Promise<Response> {
+  const path = dshNativePath(input.request);
+  if (!path) return dshJson({ error: "NOT_FOUND" }, 404);
+  const rootDocument = isDshNativeDocument(input.request);
+  let upstream = await (input.options.fetcher ?? fetch)(
+    dshInternalTarget(input.options, path),
+    {
+      method: input.request.method,
+      headers: dshInternalHeaders(
+        input.options,
+        input.session,
+        input.publicOrigin,
+        input.request.headers,
+      ),
+      body: input.request.method === "GET" ? undefined : input.request.body,
+      redirect: "manual",
+      // Worker startup allows 45s, followed by bootstrap and authorization.
+      // Bound document admission while leaving API/asset streaming unchanged.
+      signal: rootDocument
+        ? AbortSignal.any([
+            input.request.signal,
+            AbortSignal.timeout(DSH_NATIVE_STARTUP_TIMEOUT_MS),
+          ])
+        : isDshSkillRequest(input.request)
+          ? AbortSignal.any([
+              input.request.signal,
+              AbortSignal.timeout(100_000),
+            ])
+          : input.request.signal,
+    },
+  );
+  if (input.completeSkillDraft)
+    upstream = await auditDshSkillDraftResponse({
+      request: input.request,
+      response: upstream,
+      complete: input.completeSkillDraft,
+    });
+  const headers = new Headers();
+  for (const name of [
+    "content-type",
+    "content-disposition",
+    "content-range",
+    "accept-ranges",
+  ])
+    if (upstream.headers.has(name))
+      headers.set(name, upstream.headers.get(name)!);
+  // Native launch credentials/cookies stay inside the trusted coordinator.
+  if (upstream.status >= 300 && upstream.status < 400) {
+    await upstream.body?.cancel();
+    return dshJson({ error: "AGENT_REDIRECT_REJECTED" }, 502);
+  }
+  headers.set("cache-control", "no-store");
+  headers.set("referrer-policy", "no-referrer");
+  headers.set("x-content-type-options", "nosniff");
+  if (rootDocument)
+    headers.set(
+      "content-security-policy",
+      "frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+    );
+  const response = new Response(upstream.body, {
+    status: upstream.status,
+    headers,
+  });
+  if (
+    rootDocument &&
+    response.ok &&
+    headers.get("content-type")?.includes("text/html")
+  ) {
+    const rewritten = new HTMLRewriter()
+      .on("head", {
+        element(element) {
+          // The browser URL stays /agent while every relative native resource
+          // (including remote.mux) must resolve under the /agent/ mount.
+          element.prepend('<base href="/agent/">', { html: true });
+        },
+      })
+      .on("base", {
+        element(element) {
+          element.remove();
+        },
+      })
+      .transform(response);
+    // Bun 1.3.14 can stall when a rewritten, chunked upstream body is returned
+    // directly to Bun.serve. Finish the small entry document before sending it;
+    // assets and API responses retain streaming below.
+    return new Response(await rewritten.text(), {
+      status: response.status,
+      headers,
+    });
+  }
+  return response;
+}
+
+export function dshJson(value: unknown, status = 200): Response {
+  return Response.json(value, {
+    status,
+    headers: { "cache-control": "no-store", "referrer-policy": "no-referrer" },
+  });
+}

package/template/apps/server/src/app/dsh-workbench-session-conflict.test.ts

@@ -0,0 +1,61 @@
+import { expect, test } from "bun:test";
+import { request as httpRequest } from "node:http";
+import { dshFixture } from "./dsh-workbench-test-support.js";
+
+test("product WebSocket admission preserves coordinator session conflict as 409", async () => {
+  const coordinator = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch: () =>
+      Response.json({ error: "WORKBENCH_SESSION_CONFLICT" }, { status: 409 }),
+  });
+  const f = await dshFixture({
+    baseUrl: () => coordinator.url.origin,
+    fetcher: fetch,
+  });
+  f.app.listen({ hostname: "127.0.0.1", port: 0 });
+  const target = new URL("/api/agent/native/api/remote.mux", f.app.server!.url);
+  try {
+    const response = await new Promise<{ status: number; body: string }>(
+      (resolve, reject) => {
+        const client = httpRequest(
+          target,
+          {
+            headers: {
+              cookie: `windy.sid=${f.login.token}`,
+              origin: "https://windy.test",
+              connection: "Upgrade",
+              upgrade: "websocket",
+              "sec-websocket-version": "13",
+              "sec-websocket-key": "c3ludGhldGljLXRlc3QhIQ==",
+            },
+            signal: AbortSignal.timeout(5000),
+          },
+          (incoming) => {
+            let body = "";
+            incoming.on("data", (chunk) => {
+              body += chunk.toString();
+            });
+            incoming.on("end", () => {
+              resolve({ status: incoming.statusCode ?? 0, body });
+            });
+          },
+        );
+        client.on("error", reject);
+        client.on("upgrade", (_incoming, socket) => {
+          socket.destroy();
+          reject(Error("unexpected admitted socket"));
+        });
+        client.end();
+      },
+    );
+    expect(response.status).toBe(409);
+    expect(JSON.parse(response.body)).toMatchObject({
+      error: "WORKBENCH_SESSION_CONFLICT",
+      message: expect.stringContaining("原登录"),
+    });
+  } finally {
+    await f.app.stop(true);
+    await coordinator.stop(true);
+  }
+});

package/template/apps/server/src/app/dsh-workbench-session.ts

@@ -0,0 +1,59 @@
+import {
+  hashSessionToken,
+  readRequestSessionToken,
+} from "../auth/actor-resolver.js";
+import type { AuthRepository } from "../auth/repository.js";
+import type { RequestActor } from "../guards.js";
+export interface DshProductSession {
+  readonly actorId: string;
+  readonly token: string;
+  readonly expiresAt: string;
+}
+
+/** Reuse the actual product login; never create a second API-login session. */
+export async function currentDshProductSession(input: {
+  request: Request;
+  actorId: string;
+  repository: AuthRepository;
+  cookieName: string;
+  now: number;
+}): Promise<
+  (DshProductSession & { readonly actor: RequestActor }) | undefined
+> {
+  if (
+    /^Bearer\s+(?:bax_|car_)/i.test(
+      input.request.headers.get("authorization") ?? "",
+    )
+  )
+    return;
+  const token = readRequestSessionToken(input.request, input.cookieName);
+  if (!token || !/^[A-Za-z0-9_-]{43}$/.test(token)) return;
+  const hash = hashSessionToken(token);
+  const session = await input.repository.findSessionByTokenHash(hash);
+  if (
+    !session ||
+    session.userId !== input.actorId ||
+    session.status !== "active" ||
+    session.revokedAt ||
+    session.expiresAt.getTime() <= input.now ||
+    session.issuedAt.getTime() > input.now
+  )
+    return;
+  const actor = await input.repository.resolveSessionActor(
+    hash,
+    new Date(input.now),
+  );
+  if (
+    !actor ||
+    actor.type !== "user" ||
+    actor.id !== session.userId ||
+    actor.credentialState !== "active"
+  )
+    return;
+  return {
+    actorId: actor.id,
+    token,
+    expiresAt: session.expiresAt.toISOString(),
+    actor,
+  };
+}

package/template/apps/server/src/app/dsh-workbench-socket-audit.test.ts

@@ -0,0 +1,116 @@
+import { expect, test } from "bun:test";
+import WebSocket from "ws";
+import { dshFixture } from "./dsh-workbench-test-support.js";
+
+function opened(socket: WebSocket): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("Socket timeout")), 3000);
+    socket.once("open", () => {
+      clearTimeout(timer);
+      resolve();
+    });
+    // Bun can emit another error while tearing down a rejected upgrade.
+    socket.on("error", () => {
+      clearTimeout(timer);
+      reject(new Error("Socket rejected"));
+    });
+  });
+}
+
+function exchange(socket: WebSocket, message: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("Frame timeout")), 3000);
+    socket.once("message", (value) => {
+      clearTimeout(timer);
+      resolve(value.toString());
+    });
+    socket.send(message);
+  });
+}
+
+test("real WebSocket records one admission before preflight and keeps reauthorization unaudited", async () => {
+  let contacts = 0;
+  let assertAudit = () => {};
+  const coordinator = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(request, server) {
+      contacts++;
+      assertAudit();
+      if (request.headers.get("upgrade") === "websocket") {
+        if (server.upgrade(request)) return;
+        return new Response(null, { status: 400 });
+      }
+      return new Response(null, { status: 204 });
+    },
+    websocket: {
+      message(socket, message) {
+        socket.send(message);
+      },
+    },
+  });
+  const fixture = await dshFixture({
+    baseUrl: () => coordinator.url.origin,
+    fetcher: fetch,
+    authorizationIntervalMs: 25,
+  });
+  const audits = () =>
+    fixture.runtime.auditSink
+      .list()
+      .filter((event) => event.action === "agent.workbench.access");
+  assertAudit = () => expect(audits()).toHaveLength(1);
+  fixture.app.listen({ hostname: "127.0.0.1", port: 0 });
+  const url = new URL(
+    "/api/agent/native/api/remote.mux",
+    fixture.app.server!.url,
+  );
+  url.protocol = "ws:";
+  const socket = new WebSocket(url, {
+    headers: {
+      origin: "https://windy.test",
+      cookie: `windy.sid=${fixture.login.token}`,
+    },
+  });
+  try {
+    await opened(socket);
+    expect(await exchange(socket, "first")).toBe("first");
+    expect(await exchange(socket, "reauthorize")).toBe("reauthorize");
+    expect(contacts).toBe(2);
+    expect(audits()).toHaveLength(1);
+    expect(audits()[0]?.metadata).toEqual({
+      kind: "websocket",
+      phase: "admission",
+    });
+    expect(JSON.stringify(audits())).not.toContain(fixture.login.token);
+  } finally {
+    socket.terminate();
+    void fixture.app.stop(true);
+    void coordinator.stop(true);
+  }
+});
+
+test("WebSocket audit failure rejects before preflight can create a worker", async () => {
+  const fixture = await dshFixture();
+  fixture.runtime.auditSink.recordCriticalEvent = async () => {
+    throw new Error("private audit persistence failure");
+  };
+  fixture.app.listen({ hostname: "127.0.0.1", port: 0 });
+  const url = new URL(
+    "/api/agent/native/api/remote.mux",
+    fixture.app.server!.url,
+  );
+  url.protocol = "ws:";
+  const socket = new WebSocket(url, {
+    headers: {
+      origin: "https://windy.test",
+      cookie: `windy.sid=${fixture.login.token}`,
+    },
+  });
+  try {
+    await expect(opened(socket)).rejects.toThrow("Socket rejected");
+    expect(fixture.state.probes).toEqual([]);
+  } finally {
+    socket.terminate();
+    void fixture.app.stop(true);
+  }
+});