create-windy 0.8.3 → 0.10.0

package/template/apps/agent-server/native/extensions.test.ts

@@ -0,0 +1,190 @@
+import { expect, test } from "bun:test";
+import { Context } from "@deepseek-ai/cordis";
+import { FileSystemSkillProvider } from "@deepseek-ai/dsh-skill-filesystem";
+import { runPluginCommand } from "@deepseek-ai/dsh-plugin-manager/operations";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { packageManager, prepareNativeProfile } from "./extensions.js";
+import { userExtensionsEnabled } from "./config.js";
+import { nativeProfile } from "./profile.js";
+
+test("development extensions expose upstream UI while model routing stays managed", () => {
+  expect(userExtensionsEnabled("1")).toBe(true);
+  expect(userExtensionsEnabled("false")).toBe(false);
+  expect(() => userExtensionsEnabled("yes")).toThrow();
+  for (const enabled of [true, false]) {
+    const profile = nativeProfile({
+      appRoot: "/app",
+      gateUrl: "http://gate/internal/boundary",
+      model: "shared",
+      contextWindow: 32768,
+      maxOutputTokens: 4096,
+      userExtensions: enabled,
+    });
+    for (const id of [
+      "plugin-manager",
+      "hmr",
+      "client-hmr",
+      "settings",
+      "config-editor",
+      "ui-plugin-manager",
+    ])
+      expect(profile).toContainEqual({ id, disabled: !enabled });
+    // Agent tools cannot silently install code; management is a human UI action.
+    expect(profile).toContainEqual({
+      id: "tool-plugin-manager",
+      disabled: true,
+    });
+    expect(
+      profile.find((row) => "id" in row && row.id === "llm-pi-ai"),
+    ).toMatchObject({
+      config: {
+        providers: { windy: { baseURL: "http://gate/internal/boundary/v1" } },
+      },
+    });
+  }
+});
+
+test("official installer adds a local fixture, restart preserves it, removal updates selection", async () => {
+  const home = await mkdtemp(join(tmpdir(), "windy-extension-install-"));
+  try {
+    const profile = await prepareNativeProfile(home);
+    const fixture = join(home, "fixture-bundle");
+    await mkdir(fixture);
+    await writeFile(
+      join(fixture, "package.json"),
+      JSON.stringify({
+        name: "@southwind-ai/test-extension",
+        version: "1.0.0",
+        private: true,
+        dsh: { bundle: { patch: "./cordis.patch.yml" } },
+      }),
+    );
+    await writeFile(join(fixture, "cordis.patch.yml"), "[]\n");
+    const require = createRequire(import.meta.url);
+    const context = {
+      profile: "web",
+      dir: profile,
+      home,
+      cwd: home,
+      installAnchor: require.resolve("@deepseek-ai/dsh/package.json"),
+    };
+    const options = {
+      ...packageManager(),
+      command: "node",
+      execution: "service" as const,
+      outputBytes: 16384,
+      idleTimeoutMs: 20000,
+    };
+    const installed = await runPluginCommand(
+      context,
+      ["add", `file:${fixture}`, "--offline", "--ignore-scripts"],
+      options,
+    );
+    expect(installed.exitCode).toBe(0);
+    const manifest = await readFile(join(profile, "package.json"), "utf8");
+    expect(JSON.parse(manifest).dsh.profile.bundles).toContain(
+      "@southwind-ai/test-extension",
+    );
+    const lock = await readFile(join(profile, "pnpm-lock.yaml"), "utf8");
+    await writeFile(
+      join(profile, "cordis.patch.yml"),
+      "- id: test-extension\n  disabled: true\n",
+    );
+    await writeFile(
+      join(home, "cordis.patch.yml"),
+      "# personal home patch\n[]\n",
+    );
+    await prepareNativeProfile(home);
+    expect(await readFile(join(profile, "package.json"), "utf8")).toBe(
+      manifest,
+    );
+    expect(await readFile(join(profile, "pnpm-lock.yaml"), "utf8")).toBe(lock);
+    expect(await readFile(join(profile, "cordis.patch.yml"), "utf8")).toContain(
+      "test-extension",
+    );
+    expect(await readFile(join(home, "cordis.patch.yml"), "utf8")).toContain(
+      "personal home patch",
+    );
+    const removed = await runPluginCommand(
+      context,
+      ["remove", "@southwind-ai/test-extension"],
+      options,
+    );
+    expect(removed.exitCode).toBe(0);
+    expect(
+      JSON.parse(await readFile(join(profile, "package.json"), "utf8")).dsh
+        .profile.bundles,
+    ).not.toContain("@southwind-ai/test-extension");
+  } finally {
+    await rm(home, { recursive: true, force: true });
+  }
+}, 30000);
+
+test("official skill provider discovers, loads, edits and removes only the current workspace skill", async () => {
+  const home = await mkdtemp(join(tmpdir(), "windy-extension-skill-"));
+  const workspace = join(home, "workspace");
+  const own = join(workspace, ".dsh", "skills", "my-report");
+  const other = join(home, "other-user", ".dsh", "skills", "private-report");
+  const ctx = new Context();
+  let invalidations = 0;
+  const provider = new FileSystemSkillProvider(
+    ctx,
+    {
+      signal: new AbortController().signal,
+      invalidate() {
+        invalidations++;
+      },
+    },
+    {
+      dshHome: join(home, "user-dsh"),
+      agentsHome: join(home, "user-agents"),
+      watch: true,
+      watchPollIntervalMs: 10,
+      watchStabilityThresholdMs: 10,
+    },
+  );
+  const lookup = { cwd: workspace };
+  const list = async () => {
+    const result = await provider.list(lookup);
+    return Array.isArray(result) ? result : result.candidates;
+  };
+  try {
+    await mkdir(workspace, { recursive: true });
+    expect(await list()).toEqual([]);
+    await mkdir(own, { recursive: true });
+    await mkdir(other, { recursive: true });
+    const body =
+      "---\nname: my-report\ndescription: 我的合成报告技能\n---\n只输出合成验收标记：SKILL_OK";
+    await writeFile(join(own, "SKILL.md"), body);
+    await writeFile(
+      join(other, "SKILL.md"),
+      body.replace("my-report", "private-report"),
+    );
+    for (let wait = 0; wait < 200 && invalidations === 0; wait++)
+      await Bun.sleep(10);
+    expect(invalidations).toBeGreaterThan(0);
+    const found = (await list()).find((skill) => skill.name === "my-report");
+    expect(found).toBeDefined();
+    expect((await list()).map((skill) => skill.name)).not.toContain(
+      "private-report",
+    );
+    expect((await provider.get(found!, lookup))?.content).toContain("SKILL_OK");
+    await writeFile(
+      join(own, "SKILL.md"),
+      body.replace("SKILL_OK", "SKILL_EDITED"),
+    );
+    expect((await provider.get(found!, lookup))?.content).toContain(
+      "SKILL_EDITED",
+    );
+    await rm(own, { recursive: true });
+    expect((await list()).map((skill) => skill.name)).not.toContain(
+      "my-report",
+    );
+  } finally {
+    await provider.dispose();
+    await rm(home, { recursive: true, force: true });
+  }
+});

package/template/apps/agent-server/native/extensions.ts

@@ -0,0 +1,31 @@
+import { initProfile } from "@deepseek-ai/dsh-app-boot";
+import { createRequire } from "node:module";
+import { writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+/** Initialize once: installed bundles, lockfiles and personal patches survive worker restarts. */
+export async function prepareNativeProfile(home: string) {
+  const profile = join(home, "profiles", "web");
+  initProfile(profile, ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app"]);
+  try {
+    await writeFile(join(home, "cordis.patch.yml"), "[]\n", {
+      mode: 0o600,
+      flag: "wx",
+    });
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+  }
+  return profile;
+}
+
+/** Upstream package operations require pnpm semantics; project workspaces still use Bun. */
+export function packageManager() {
+  const require = createRequire(import.meta.url);
+  // pnpm publicly exports its package manifest as its root entry.
+  const cli = join(dirname(require.resolve("pnpm")), "bin", "pnpm.mjs");
+  return {
+    command: process.execPath,
+    args: [cli],
+    env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" },
+  };
+}

package/template/apps/agent-server/native/host-profile.test.ts

@@ -0,0 +1,91 @@
+import { expect, test } from "bun:test";
+import type { DshHostConfiguration } from "../host-contracts.js";
+import { defaultHostFixture } from "./host-test-fixture.js";
+import { nativeProfile } from "./profile.js";
+import { hostPresetId, hostReplacements } from "./host-profile.js";
+
+const config = {
+  appRoot: "/app/agent",
+  gateUrl: "http://127.0.0.1:8080/internal/boundary",
+  model: "synthetic",
+  contextWindow: 32768,
+  maxOutputTokens: 4096,
+};
+
+test("an existing deployment preset remains consistent across registry, handoff and child agents", () => {
+  const rows = nativeProfile(config, {
+    ...defaultHostFixture,
+    presetId: "sharp",
+    skillDirectories: ["project/skills"],
+    plugins: [
+      {
+        key: "business-sessions",
+        path: "project/business-sessions/index.mjs",
+        replaces: ["session-controller"],
+      },
+    ],
+  });
+  expect(rows).toContainEqual({ id: "session-controller", disabled: true });
+  expect(
+    rows.find((row) => "id" in row && row.id === "tool-subagent"),
+  ).toMatchObject({ config: { agentPreset: "sharp" } });
+  const inserted = rows.flatMap((row) => ("insert" in row ? row.insert : []));
+  expect(
+    inserted.find((row) => row?.id === "windy-agent-preset-registry"),
+  ).toMatchObject({ config: { default: "sharp" } });
+  expect(inserted.find((row) => row?.id === "windy-access")).toMatchObject({
+    config: { presetId: "sharp" },
+  });
+  expect(inserted.find((row) => row?.id === "preset-sharp")).toMatchObject({
+    config: { id: "sharp" },
+  });
+  expect(
+    inserted.find((row) => row?.id === "project-business-sessions"),
+  ).toMatchObject({ name: "/app/agent/project/business-sessions/index.mjs" });
+  expect(
+    inserted.find((row) => row?.id === "windy-skill-library"),
+  ).toMatchObject({
+    config: { extraDefaultSkillDirs: ["/app/agent/project/skills"] },
+  });
+});
+
+test("project service replacement cannot disable model, authorization or budget owners", () => {
+  expect(hostPresetId(defaultHostFixture)).toBe("windy");
+  expect(hostReplacements(defaultHostFixture)).toEqual([]);
+  for (const value of [
+    { presetId: "../escape" },
+    { plugins: [{ key: "unsafe", path: "/external/plugin.mjs" }] },
+    { plugins: [{ key: "unsafe", path: "../plugin.mjs" }] },
+    {
+      plugins: [
+        { key: "unsafe", path: "project/plugin.mjs", replaces: ["agent-loop"] },
+      ],
+    },
+    {
+      plugins: [
+        { key: "same", path: "project/one.mjs" },
+        { key: "same", path: "project/two.mjs" },
+      ],
+    },
+    {
+      plugins: [
+        {
+          key: "one",
+          path: "project/one.mjs",
+          replaces: ["session-controller"],
+        },
+        {
+          key: "two",
+          path: "project/two.mjs",
+          replaces: ["session-controller"],
+        },
+      ],
+    },
+  ])
+    expect(() =>
+      nativeProfile(config, {
+        ...defaultHostFixture,
+        ...value,
+      } as DshHostConfiguration),
+    ).toThrow();
+});

package/template/apps/agent-server/native/host-profile.ts

@@ -0,0 +1,33 @@
+import type { DshHostConfiguration } from "../host-contracts.js";
+
+export function hostPresetId(host: DshHostConfiguration): string {
+  const id = host.presetId ?? "windy";
+  if (!/^[a-z][a-z0-9-]{0,63}$/.test(id))
+    throw new Error("Invalid deployment preset identity");
+  return id;
+}
+
+export function hostReplacements(host: DshHostConfiguration): string[] {
+  const keys = new Set<string>();
+  const replacements = new Set<string>();
+  for (const plugin of host.plugins) {
+    if (!/^[a-z][a-z0-9-]{0,63}$/.test(plugin.key) || keys.has(plugin.key))
+      throw new Error("Duplicate or invalid project plugin key");
+    keys.add(plugin.key);
+    if (
+      !plugin.path ||
+      plugin.path.startsWith("/") ||
+      plugin.path.includes("\\") ||
+      plugin.path
+        .split("/")
+        .some((part) => !part || part === "." || part === "..")
+    )
+      throw new Error("Invalid project plugin path");
+    for (const replaced of plugin.replaces ?? []) {
+      if (replaced !== "session-controller" || replacements.has(replaced))
+        throw new Error("Unsupported or duplicate project service replacement");
+      replacements.add(replaced);
+    }
+  }
+  return [...replacements];
+}

package/template/apps/agent-server/native/host-test-fixture.ts

@@ -0,0 +1,13 @@
+import type { DshHostConfiguration } from "../host-contracts.js";
+
+/** Explicit platform defaults; downstream project composition may override these. */
+export const defaultHostFixture: DshHostConfiguration = {
+  presetId: "windy",
+  assistantName: "Windy Agent",
+  assistantDescription: "处理授权资料、查询业务信息并交付可核验的工作成果。",
+  workspaceLabel: "我的工作区",
+  instructions: [],
+  skillDirectories: [],
+  plugins: [],
+  boundaryRoutes: [],
+};

package/template/apps/agent-server/native/http.ts

@@ -0,0 +1,129 @@
+import { authorityFrom } from "./config.js";
+import { boundedBody, productOrigin } from "./boundary.js";
+import { WorkbenchManager } from "./manager.js";
+import { nativeRequest } from "./request.js";
+import { workerTransportSignal } from "./lifecycle.js";
+import {
+  WorkbenchSessionConflict,
+  sessionConflictResponse,
+} from "./session-conflict.js";
+import {
+  isWorkbenchAuthorizationUnavailable,
+  authorizationUnavailableResponse,
+} from "./authorization.js";
+
+export function workerPath(raw: string): string {
+  const url = new URL(raw);
+  const path = url.pathname.slice("/internal/workbench".length) || "/";
+  const decoded = decodeURIComponent(path);
+  if (
+    decoded.includes("\\") ||
+    decoded.startsWith("//") ||
+    decoded.split("/").includes("..") ||
+    decoded.startsWith("/windy/internal-") ||
+    decoded === "/connect"
+  )
+    throw new Error("INVALID_NATIVE_PATH");
+  return `${path}${url.search}`;
+}
+
+async function handleWorkbenchHttp(
+  request: Request,
+  manager: WorkbenchManager,
+): Promise<Response> {
+  const authority = authorityFrom(request);
+  if (!(await manager.authorizeAuthority(authority, request.signal)))
+    return new Response(null, { status: 401 });
+  const path = workerPath(request.url);
+  if (path === "/windy/branding") {
+    const response = await fetch(`${productOrigin()}/api/platform/branding`, {
+      redirect: "error",
+      signal: request.signal,
+    });
+    return new Response(response.body, {
+      status: response.status,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+      },
+    });
+  }
+  const worker = await manager.get(authority);
+  if (!(await manager.current(worker)))
+    return new Response(null, { status: 401 });
+  const headers = new Headers({
+    host: new URL(authority.publicOrigin).host,
+    origin: authority.publicOrigin,
+    cookie: worker.cookie,
+  });
+  for (const key of ["content-type", "accept", "range", "if-none-match"])
+    if (request.headers.has(key)) headers.set(key, request.headers.get(key)!);
+  const response = await nativeRequest(
+    `http://127.0.0.1:${worker.port}${path}`,
+    {
+      method: request.method,
+      headers,
+      signal: AbortSignal.any([request.signal, workerTransportSignal(worker)]),
+      ...(request.body
+        ? { body: await boundedBody(request, 64 * 1024 * 1024) }
+        : {}),
+    },
+  );
+  const resultHeaders = new Headers(response.headers);
+  resultHeaders.delete("set-cookie");
+  resultHeaders.delete("content-length");
+  resultHeaders.delete("content-encoding");
+  resultHeaders.set("cache-control", "no-store");
+  // Native launch-token/connect redirects never reach the product browser.
+  if (response.status >= 300 && response.status < 400)
+    return Response.json(
+      { error: "WORKBENCH_AUTHENTICATION_FAILED" },
+      { status: 502 },
+    );
+  return new Response(response.body, {
+    status: response.status,
+    headers: resultHeaders,
+  });
+}
+
+export async function workbenchHttp(
+  request: Request,
+  manager: WorkbenchManager,
+): Promise<Response> {
+  try {
+    return await handleWorkbenchHttp(request, manager);
+  } catch (error) {
+    if (error instanceof WorkbenchSessionConflict)
+      return sessionConflictResponse(error);
+    if (isWorkbenchAuthorizationUnavailable(error))
+      return authorizationUnavailableResponse();
+    throw error;
+  }
+}
+
+/** Internal-token protected by the coordinator; returns no worker/session data. */
+export async function workbenchHandshake(
+  request: Request,
+  manager: WorkbenchManager,
+): Promise<Response> {
+  if (request.method !== "GET" || new URL(request.url).search)
+    return new Response(null, { status: 404 });
+  try {
+    const authority = authorityFrom(request);
+    if (!(await manager.authorizeAuthority(authority, request.signal)))
+      return new Response(null, { status: 401 });
+    const worker = await manager.get(authority);
+    if (!(await manager.current(worker)))
+      return new Response(null, { status: 401 });
+    return new Response(null, {
+      status: 204,
+      headers: { "cache-control": "no-store" },
+    });
+  } catch (error) {
+    if (error instanceof WorkbenchSessionConflict)
+      return sessionConflictResponse(error);
+    if (isWorkbenchAuthorizationUnavailable(error))
+      return authorizationUnavailableResponse();
+    throw error;
+  }
+}