create-windy 0.8.3 → 0.10.0

package/template/apps/web/src/router/platform-admin-route-bindings.ts

@@ -2,18 +2,23 @@ import type { SystemResourceKey } from "@/pages/system/resource-config";
 
 export type PlatformAdminPageKey =
   | "resource"
+  // @windy-module system.audit begin
+  | "diagnostics"
+  // @windy-module system.audit end
   | "settings"
   | "profile"
   | "license"
   | "notification"
   | "operations"
-  // @windy-module system.agent begin
+  // @windy-module system.agent-ui begin
   | "agent-tools"
+  | "agent-skills"
+  | "agent-native"
   | "agent-debug"
   | "agent-session"
   | "agent-workflow"
   | "ai-runtime"
-  // @windy-module system.agent end
+  // @windy-module system.agent-ui end
   | "configuration"
   | "ui-components";
 
@@ -54,6 +59,7 @@ export const platformAdminRouteBindings: readonly PlatformAdminRouteBinding[] =
     // @windy-module system.license end
     // @windy-module system.audit begin
     { routeKey: "system.audit", page: "resource", resourceKey: "auditLogs" },
+    { routeKey: "system.diagnostics", page: "diagnostics" },
     // @windy-module system.audit end
     // @windy-module system.notification begin
     { routeKey: "system.notification", page: "notification" },
@@ -61,13 +67,15 @@ export const platformAdminRouteBindings: readonly PlatformAdminRouteBinding[] =
     // @windy-module system.operations begin
     { routeKey: "system.ops", page: "operations" },
     // @windy-module system.operations end
-    // @windy-module system.agent begin
+    // @windy-module system.agent-ui begin
     { routeKey: "system.agent-tools", page: "agent-tools" },
+    { routeKey: "system.agent-skill", page: "agent-skills" },
+    { routeKey: "system.agent-workbench", page: "agent-native" },
     { routeKey: "system.agent-debug", page: "agent-debug" },
     { routeKey: "system.agent-session", page: "agent-session" },
     { routeKey: "system.agent-workflow", page: "agent-workflow" },
     { routeKey: "system.ai-runtime", page: "ai-runtime" },
-    // @windy-module system.agent end
+    // @windy-module system.agent-ui end
     // @windy-module system.configuration begin
     { routeKey: "system.config", page: "configuration" },
     // @windy-module system.configuration end

package/template/apps/web/src/services/agent-skills-api.ts

@@ -0,0 +1,55 @@
+import type {
+  AgentSkillBundle,
+  AgentSkillCommandRequest,
+  AgentSkillGovernanceItem,
+  AgentSkillVersion,
+  ImportAgentSkillRequest,
+} from "@southwind-ai/shared";
+import { apiRequest } from "./http";
+export type {
+  AgentSkillGovernanceItem,
+  AgentSkillVersion,
+  ImportAgentSkillRequest,
+};
+export function listGovernedAgentSkills(signal?: AbortSignal) {
+  return apiRequest<readonly AgentSkillGovernanceItem[]>("/agent/skills", {
+    signal,
+  });
+}
+export function readAgentSkill(key: string, signal?: AbortSignal) {
+  return apiRequest<{ skill: AgentSkillVersion; bundle: AgentSkillBundle }>(
+    `/agent/skills/${encodeURIComponent(key)}`,
+    { signal },
+  );
+}
+export function listAgentSkillVersions(key: string, signal?: AbortSignal) {
+  return apiRequest<readonly AgentSkillVersion[]>(
+    `/agent/skills/${encodeURIComponent(key)}/versions`,
+    { signal },
+  );
+}
+export function importAgentSkill(
+  input: ImportAgentSkillRequest,
+  idempotencyKey: string,
+) {
+  return apiRequest<AgentSkillVersion>("/agent/skills", {
+    method: "POST",
+    headers: { "idempotency-key": idempotencyKey },
+    body: JSON.stringify(input),
+  });
+}
+export function governAgentSkill(
+  key: string,
+  action: "disable" | "rollback",
+  input: AgentSkillCommandRequest,
+  idempotencyKey: string,
+) {
+  return apiRequest<AgentSkillVersion>(
+    `/agent/skills/${encodeURIComponent(key)}/${action}`,
+    {
+      method: "POST",
+      headers: { "idempotency-key": idempotencyKey },
+      body: JSON.stringify(input),
+    },
+  );
+}

package/template/apps/web/src/services/agent-workflow-api.ts

@@ -1,4 +1,9 @@
 import { apiRequest } from "./http";
+import type { AgentWorkflowPresetListResponse } from "@southwind-ai/shared";
+export type {
+  AgentWorkflowPresetListResponse,
+  AgentWorkflowPresetSummary,
+} from "@southwind-ai/shared";
 
 export type AgentWorkflowRunStatus =
   | "accepted"
@@ -179,3 +184,10 @@ export function getAgentWorkflowRun(runId: string, signal?: AbortSignal) {
 function requestOptions(signal?: AbortSignal): { signal?: AbortSignal } {
   return signal ? { signal } : {};
 }
+
+export function listAgentWorkflowPresets(signal?: AbortSignal) {
+  return apiRequest<AgentWorkflowPresetListResponse>(
+    "/agent/workflows/presets",
+    requestOptions(signal),
+  );
+}

package/template/apps/web/src/services/diagnostics-api.ts

@@ -0,0 +1,24 @@
+import type { DiagnosticRecord, PageResult } from "@southwind-ai/shared";
+import { apiRequest } from "./http";
+
+export type { DiagnosticRecord } from "@southwind-ai/shared";
+
+export function getDiagnostic(id: string, signal: AbortSignal) {
+  return apiRequest<DiagnosticRecord>(
+    `/system/diagnostics/${encodeURIComponent(id)}`,
+    { signal, cache: "no-store" },
+    { suppressFailureHandler: true },
+  );
+}
+
+export function listDiagnostics(
+  page: number,
+  pageSize: number,
+  signal: AbortSignal,
+) {
+  return apiRequest<PageResult<DiagnosticRecord>>(
+    `/system/diagnostics?page=${page}&pageSize=${pageSize}`,
+    { signal, cache: "no-store" },
+    { suppressFailureHandler: true },
+  );
+}

package/template/apps/web/src/services/http.ts

@@ -25,6 +25,7 @@ export interface ApiClientOptions {
 export interface ApiFailure {
   kind: "internal" | "maintenance" | "network";
   requestId?: string;
+  diagnosticId?: string;
 }
 
 export class ApiError extends Error {
@@ -34,6 +35,7 @@ export class ApiError extends Error {
     readonly code?: string,
     readonly reason?: string,
     readonly requestId?: string,
+    readonly diagnosticId?: string,
   ) {
     super(message);
     this.name = "ApiError";
@@ -87,6 +89,7 @@ export function createApiClient(options: ApiClientOptions) {
         failureHandler?.({
           kind: result.status === 503 ? "maintenance" : "internal",
           requestId: error.requestId,
+          ...(error.diagnosticId ? { diagnosticId: error.diagnosticId } : {}),
         });
       }
       throw error;
@@ -126,6 +129,9 @@ export function createApiClient(options: ApiClientOptions) {
 }
 
 async function readApiError(response: Response): Promise<ApiError> {
+  const diagnosticId = diagnosticIdFrom(
+    response.headers.get("x-diagnostic-id"),
+  );
   try {
     const payload = (await response.json()) as {
       error?: string;
@@ -142,6 +148,7 @@ async function readApiError(response: Response): Promise<ApiError> {
       payload.error,
       payload.reason,
       response.headers.get("x-request-id") || undefined,
+      diagnosticId,
     );
   } catch {
     return new ApiError(
@@ -150,10 +157,21 @@ async function readApiError(response: Response): Promise<ApiError> {
       undefined,
       undefined,
       response.headers.get("x-request-id") || undefined,
+      diagnosticId,
     );
   }
 }
 
+/** Server diagnostic coordinates remain separate from request correlation IDs. */
+export function diagnosticIdFrom(value: unknown): string | undefined {
+  return typeof value === "string" &&
+    /^diag-[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(
+      value,
+    )
+    ? value
+    : undefined;
+}
+
 function configuredDevelopmentToken(): string | undefined {
   if (!import.meta.env.DEV || import.meta.env.VITE_DEV_AUTH_BYPASS !== "1") {
     return undefined;

package/template/apps/web/src/services/http.webtest.ts

@@ -110,6 +110,57 @@ describe("Web HTTP 会话策略", () => {
     ]);
   });
 
+  test.each([true, false])(
+    "保留服务端诊断编号且兼容 JSON/非 JSON 错误响应：%s",
+    async (json) => {
+      const diagnosticId = "diag-019a1234-5678-7000-8000-000000000001";
+      const headers = {
+        "x-request-id": "req-diagnostic",
+        "x-diagnostic-id": diagnosticId,
+      };
+      const client = createApiClient({
+        apiBase: "/api",
+        fetcher: async () =>
+          json
+            ? Response.json({ error: "UNAVAILABLE" }, { status: 503, headers })
+            : new Response("proxy unavailable", { status: 503, headers }),
+      });
+      const failures = vi.fn();
+      client.setFailureHandler(failures);
+      await expect(client.request("/failure")).rejects.toMatchObject({
+        status: 503,
+        requestId: "req-diagnostic",
+        diagnosticId,
+      });
+      expect(failures).toHaveBeenCalledWith({
+        kind: "maintenance",
+        requestId: "req-diagnostic",
+        diagnosticId,
+      });
+    },
+  );
+
+  test("不把 Request ID 或任意响应头伪装为服务端诊断编号", async () => {
+    const client = createApiClient({
+      apiBase: "/api",
+      fetcher: async () =>
+        Response.json(
+          { error: "UNAVAILABLE" },
+          {
+            status: 503,
+            headers: {
+              "x-request-id": "req-preserved",
+              "x-diagnostic-id": "not-a-diagnostic",
+            },
+          },
+        ),
+    });
+    await expect(client.request("/failure")).rejects.toMatchObject({
+      requestId: "req-preserved",
+      diagnosticId: undefined,
+    });
+  });
+
   test("传输失败进入网络异常，调用方可显式抑制全局错误页", async () => {
     const failures = vi.fn();
     const fetcher = vi.fn<typeof fetch>(async () => {

package/template/apps/web/src/services/operations-api.ts

@@ -1,5 +1,7 @@
 import { apiRequest } from "./http";
 import type {
+  EnvironmentAssessmentSnapshot,
+  EnvironmentSnapshot,
   PageResult,
   SchedulerManualTriggerResponse,
   SchedulerOperationsSnapshot,
@@ -9,6 +11,8 @@ import type {
 } from "@southwind-ai/shared";
 
 export interface OperationSnapshot {
+  environment?: EnvironmentSnapshot;
+  featureAssessment?: EnvironmentAssessmentSnapshot;
   generatedAt: string;
   onlineUsers: Array<{
     sessionId: string;

package/template/apps/web/src/services/platform-settings-api.ts

@@ -1,4 +1,4 @@
-import { apiRequest } from "./http";
+import { apiRequest, apiResponse } from "./http";
 import type {
   PlatformBrandingSettings,
   PlatformWatermarkPolicy,
@@ -42,3 +42,37 @@ export function updatePlatformWatermarkPolicy(
     body: JSON.stringify(policy),
   });
 }
+
+const WATERMARK_YAML_PATH = "/system/settings/watermark/yaml";
+
+export interface WatermarkYamlPreview {
+  revision: string;
+  changes: {
+    key:
+      | "enabled"
+      | "density"
+      | "contentFields"
+      | "opacityPercent"
+      | "fontSize";
+    before: boolean | string | number | string[];
+    after: boolean | string | number | string[];
+  }[];
+}
+
+export async function exportWatermarkYaml() {
+  return (await apiResponse(WATERMARK_YAML_PATH)).blob();
+}
+
+export function previewWatermarkYaml(yaml: string) {
+  return apiRequest<WatermarkYamlPreview>(`${WATERMARK_YAML_PATH}/preview`, {
+    method: "POST",
+    body: JSON.stringify({ yaml }),
+  });
+}
+
+export function importWatermarkYaml(yaml: string, revision: string) {
+  return apiRequest<PlatformWatermarkPolicy>(WATERMARK_YAML_PATH, {
+    method: "POST",
+    body: JSON.stringify({ yaml, revision }),
+  });
+}

package/template/apps/web/vite.config.ts

@@ -1,3 +1,10 @@
+// @windy-module system.agent begin
+import {
+  isDshWorkbenchPath,
+  dshWorkbenchProxyPath,
+  dshWorkbenchLoginPath,
+} from "./dsh-workbench-location";
+// @windy-module system.agent end
 import { spawnSync } from "node:child_process";
 import { fileURLToPath, URL } from "node:url";
 import tailwindcss from "@tailwindcss/vite";
@@ -11,7 +18,9 @@ import { adminUiModuleRegistryPlugin } from "./src/router/admin-ui-module-regist
 
 const fingerprint =
   process.env.WINDY_DEV_FINGERPRINT || projectFingerprint(process.cwd());
-const devPort = Number(process.env.WINDY_DEV_PORT || 8_746);
+const devPort = Number(
+  process.env.WINDY_DEV_PORT || process.env.WINDY_WEB_PORT || 28_746,
+);
 const usePolling = process.env.WINDY_DEV_USE_POLLING === "1";
 const adminUiValidatorEntry = fileURLToPath(
   new URL("./scripts/validate-admin-ui-composition.ts", import.meta.url),
@@ -43,7 +52,43 @@ export default defineConfig({
     strictPort: true,
     watch: usePolling ? { usePolling: true, interval: 200 } : undefined,
     proxy: {
-      "/api": process.env.API_UPSTREAM ?? "http://localhost:9747",
+      // @windy-module system.agent begin
+      "^/agent(?:$|[/?])": {
+        target:
+          process.env.API_UPSTREAM ??
+          `http://127.0.0.1:${process.env.WINDY_SERVER_PORT ?? "19747"}`,
+        ws: true,
+        bypass: (request) =>
+          isDshWorkbenchPath(request.url ?? "/") ? undefined : "/index.html",
+        rewrite: dshWorkbenchProxyPath,
+        configure(proxy) {
+          proxy.on("proxyReq", (upstream, request) => {
+            for (const name of Object.keys(request.headers))
+              if (
+                name.startsWith("x-windy-") ||
+                name.startsWith("x-forwarded-") ||
+                name === "forwarded"
+              )
+                upstream.removeHeader(name);
+          });
+          proxy.on("proxyRes", (response, request) => {
+            const login = dshWorkbenchLoginPath(
+              (request.url ?? "/").replace(
+                /^\/api\/agent\/native\/(?=\?|$)/,
+                "/agent",
+              ),
+            );
+            if (response.statusCode === 401 && login) {
+              response.statusCode = 302;
+              response.headers.location = login;
+            }
+          });
+        },
+      },
+      // @windy-module system.agent end
+      "/api":
+        process.env.API_UPSTREAM ??
+        `http://127.0.0.1:${process.env.WINDY_SERVER_PORT ?? "19747"}`,
     },
   },
 });

package/template/deploy/dsh/README.md

@@ -0,0 +1,5 @@
+# 内置 DSH 的构建资料
+
+DSH通过`apps/agent-server` Bun workspace和原有Agent Server镜像交付；用户从Windy同源`/agent`进入。此目录只保存离线文档工具的依赖锁及说明，不创建独立DSH服务、端口或镜像栈。
+
+运行、隔离、容量和验证边界见[内置接入方案](../../docs/architecture/embedded-dsh-integration.md)，构建与重置步骤见[迁移运维](../../docs/operations/dsh-agent-migration.md)。

package/template/deploy/dsh/documents/README.md

@@ -0,0 +1,9 @@
+# Agent 离线文档工具
+
+Python仅供文档工具使用，Agent执行内核由Node/DSH承担。`requirements.in`描述直接依赖，`requirements.lock`固定完整版本与hash；Agent Server镜像在构建时下载wheel，最终环境从本地归档离线安装。运行时不安装新包。
+
+工具源位于`apps/agent-server/documents`，包括Office读写、工作区边界、报告与烟雾探针。只能处理当前用户已授权的工作区文件；正式业务回存仍走所属模块服务和审批。
+
+DOCX在线预览沿用DSH官方`office-to-pdf`、固定`libreoffice-kit-wasm@0.1.5`与PDF.js。完整WASM包、许可证、源码配方和完整性清单随同Agent镜像保存；Python包或系统LibreOffice不替代该预览链路。
+
+更新依赖时使用实际解析结果生成锁，验证Linux原生架构与文档产物。禁止只改hash或在运行容器下载补丁。配置、资源限制和验收说明见[迁移运维](../../../docs/operations/dsh-agent-migration.md)。

package/template/deploy/dsh/documents/requirements.in

@@ -0,0 +1,6 @@
+# Direct dependencies. Install requirements.lock with --require-hashes instead.
+python-docx==1.2.0
+openpyxl==3.1.5
+pypdf==6.20.1
+reportlab==5.0.1
+defusedxml==0.7.1

package/template/deploy/dsh/documents/requirements.lock

@@ -0,0 +1,72 @@
+# Resolved from PyPI release metadata on 2026-10-15; no sdists or runtime downloads.
+# Supported wheels: CPython 3.12/3.14, Linux glibc amd64/aarch64, macOS arm64/x86_64.
+# Production runtime is Python 3.12; 3.14 wheels support host-only smoke checks.
+# Online: python -m pip install --only-binary=:all: --require-hashes -r requirements.lock
+# Offline: add --no-index --find-links=/wheelhouse to the same command.
+
+python-docx==1.2.0 \
+    --hash=sha256:3fd478f3250fbbbfd3b94fe1e985955737c145627498896a8a6bf81f4baf66c7
+
+openpyxl==3.1.5 \
+    --hash=sha256:5282c12b107bffeef825f4617dc029afaf41d0ea60823bbb665ef3079dc79de2
+
+pypdf==6.20.1 \
+    --hash=sha256:aa5a55ddcffdc5e5ab291d5decb23f6383f4e56f8e3263dc39af41fff03885ad
+
+reportlab==5.0.1 \
+    --hash=sha256:1c36e6bb0e71780c72331eba60da7f602e8d4389a8723825af71342e49d791e8
+
+defusedxml==0.7.1 \
+    --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
+
+lxml==6.1.3 \
+    --hash=sha256:0c0710ac085a157b593c38fbcacd950f15c4afa8e2057527185875ab302752bc \
+    --hash=sha256:2221e88679d1351e9a40aaee54bc65679b9795bbd0160bc3d5e36b163344eb75 \
+    --hash=sha256:28a23fefdb345b2d4d0ff2860571b5ff9a89a28b6a120f720e8fb0324d346626 \
+    --hash=sha256:2bec13085dc8ef48a3fe62f7dfcacfeda2c785cdf19cc8eeda2bb9ed081da165 \
+    --hash=sha256:2cae5d5c90a62d9139c512a0cb1aad1d182b022b5740daea2617eb5bf7fc658e \
+    --hash=sha256:379f8a75cf6eb7eef0af074b55f49ab73b868388a98de14646abcdfa4564bb11 \
+    --hash=sha256:4f4db7c7e954d289d71878938348b3d91b904a3e8210a11939359fb758a58e7d \
+    --hash=sha256:545ccc14fb05485f48b4439ec35beb16d5b5280eb6c81c658bd4707a2a119414 \
+    --hash=sha256:5a143e6207579de8baeded4eaac9134413200359f1969d636f0bfb98ee8c3c8f \
+    --hash=sha256:623c8799c17128753c65699f1c3aa32402657393a9ad6db09ed8b98ddf76611d \
+    --hash=sha256:8db38ff3fb7aee7d6a82ae4da2eef1178656fe1216841fbd24870062a9d60473 \
+    --hash=sha256:909f4e927bb051f7740d6367285fc60cdcfdaf0258c2dba4ff5ba7eadadc250c \
+    --hash=sha256:a1cec0f99b9b914d39176347a93b7610dc09324491aee1cbc57cd291a41a1d55 \
+    --hash=sha256:a7eb78ba28b187e1e9203a55c60fcf70df2d22cb205fe6d51b9383d6097419f0 \
+    --hash=sha256:b37772102d44bb6628186accca3a121b1fa3a6b3d97518a8c29a5229ca4c0d0a \
+    --hash=sha256:c6c0c13128a32eb04a51357e56a094e13aa8e6d3d1884de2e9ae923f6915e1a8 \
+    --hash=sha256:f683dc6300317700025e41d89a43e0276692ded16113a3c43eab704d605c58e5 \
+    --hash=sha256:f6b9d2aad499c769ee8287609ab0e6de99d8bcea99c6e6c2e64945259fd52fb2
+
+typing-extensions==4.16.0 \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8
+
+et-xmlfile==2.0.0 \
+    --hash=sha256:7a91720bc756843502c3b7504c77b8fe44217c85c537d85037f0f536151b2caa
+
+pillow==12.3.0 \
+    --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \
+    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
+    --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \
+    --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \
+    --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \
+    --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \
+    --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \
+    --hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \
+    --hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \
+    --hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \
+    --hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \
+    --hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7
+
+charset-normalizer==3.5.2 \
+    --hash=sha256:34276fd796040bf0993ab33a369aa572e6979c7aab225a88893667ad8eac8f7a \
+    --hash=sha256:3d31298449090ab8d47b7b1b2a555ff73cac7ed438a08b7ac160980c7ebed649 \
+    --hash=sha256:6bd128f206a7752ae1f2ab6c61bf8a24ba28913a10df8b14c2637b973ff97a80 \
+    --hash=sha256:8d86d6fc60743dc916eb79e2eb1ec4818e21e427731543af40a3021851174a13 \
+    --hash=sha256:b6b751274acb69d77b3323d6b7dbaa3c7fdfc1eb829b7eb61d262f32e1af9685 \
+    --hash=sha256:b91363207bd9dc966a691e959bb47f64b30f7ac4b072be9968b366982f7db77c \
+    --hash=sha256:dca9ab98072a5a54ebacebdc45f53e645336b320c667410b061be1ca588ae709 \
+    --hash=sha256:ed2a239c0ea213acc1908150a3037257083c7c083128f1a4cec2ec4b97dca491 \
+    --hash=sha256:f0aa869112ef88429ae17820d99c3dd9504c9e9c671d3c246f3d7442cb051084 \
+    --hash=sha256:fcff63213e8e6e47770541a4607175404f47cbb3ebea7b6058cc82d524a0e424

package/template/deploy/environment/windy.environment.example.yaml

@@ -0,0 +1,53 @@
+# Windy 环境与功能预设示例。复制为 windy.environment.yaml 后按项目修改。
+# 首次生成：create-windy my-app --environment-profile windy.environment.yaml
+# 运行时：Server 用 WINDY_ENVIRONMENT_PROFILE_FILE 指向此文件的只读挂载路径。
+# build 控制生成裁剪，runtime 控制 Server 启动装配，features 提供评估建议。
+schemaVersion: 1
+build:
+  # 只填写 Windy 分发目录中存在的 Module；必需模块及依赖会自动补齐。
+  # 纯 CPU OCR 选择媒体运行时，Agent 作为独立模块按需选择。
+  modules:
+    - system
+    - system.identity
+    - system.settings
+    - system.configuration
+    - system.audit
+    - system.operations
+    - system.media-runtime
+  runtimes:
+    agent: false
+    document: true
+    speech: false
+    embedding: false
+# runtime 缺省时沿用原有启动设置。使用以下组合时须开启 PLATFORM_ENABLE_AI_RUNTIME。
+runtime:
+  agent: false
+  document: true
+  speech: false
+  embedding: false
+antivirus:
+  packaged: false
+  enabled: false
+features:
+  - key: system.ops
+    title: 系统运维总览
+    execution: none # none / cpu / local-gpu / remote
+    recommendedEnabled: true # 只是建议；管理员复核后在功能管理确认。
+
+
+# 添加业务功能时，使用其 Manifest 中真实存在的 Feature Key，不填猜测的模块名。
+# 例如 CPU OCR（下面是占位示例，需换成业务正式 Key 后再启用）：
+# - key: example.cpu-ocr
+#   title: CPU 文档识别
+#   execution: cpu
+#   recommendedEnabled: true
+#   supportedPlatforms: [linux]            # 依据软件适配证据填写，不靠硬件猜测。
+#   supportedArchitectures: [arm64, x64]    # 当前应用进程架构；外部推理节点需另验收。
+#   minMemoryGiB: 8                        # 已验证的最低要求，不承诺处理速度。
+#   requiredEnvironmentKeys: [DOCUMENT_SERVER_URL] # 只检查是否配置，绝不显示凭据值。
+#
+# 本地 GPU 模型使用 local-gpu；缺少 NVIDIA 查询证据返回未知，不认定“没有 GPU”。
+# 远程模型使用 remote，不会因本机无 GPU/内存少而直接判定不可用。
+# 病毒扫描为独立可选功能，可选择不扫描；不能用 GPU 条件控制它。
+# 未注册的 Feature 显示“未随包交付/请核对 Key”，未知条件不自动关闭功能。
+# 通过声明条件不代表模型 readiness、驱动兼容、识别质量或业务性能验收通过。

package/template/docker-compose.yml

@@ -49,10 +49,11 @@ services:
       WINDY_CONTAINERIZED: "1"
       BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD: "true"
       WINDY_SYSTEM_USAGE_PATHS: /app/data/audit
-      PLATFORM_ENABLE_AI: ${PLATFORM_ENABLE_AI:-false}
+      PLATFORM_ENABLE_AI_RUNTIME: ${PLATFORM_ENABLE_AI_RUNTIME:-${PLATFORM_ENABLE_AI:-false}}
+
       AGENT_SERVER_URL: http://agent-server:8080
-      WINDY_PUBLIC_BASE_URL: ${WINDY_PUBLIC_BASE_URL:-http://localhost:9747}
       AGENT_TOOL_HOST_URL: http://server:9747
+      WINDY_PUBLIC_BASE_URL: "${WINDY_PUBLIC_BASE_URL:-}"
       TOOL_SANDBOX_SOCKET: /run/windy-tool-sandbox/worker.sock
       AGENT_SERVER_INTERNAL_TOKEN: ${AGENT_SERVER_INTERNAL_TOKEN:-}
       WINDY_AGENT_WORKFLOW_MODEL_PRICING_JSON: ${WINDY_AGENT_WORKFLOW_MODEL_PRICING_JSON:-}
@@ -74,6 +75,7 @@ services:
       - ./apps/server:/app/apps/server
       - ./packages:/app/packages
       - server-audit-data:/app/data/audit
+
       - server-storage-data:/app/data/storage
       - tool-sandbox-ipc:/run/windy-tool-sandbox
     depends_on:
@@ -161,23 +163,38 @@ services:
       context: .
       dockerfile: apps/agent-server/Dockerfile
       args:
-        WINDY_PYPI_INDEX_URL: ${WINDY_PYPI_INDEX_URL:-http://mirrors.cloud.tencent.com/pypi/simple}
+        WINDY_AGENT_NATIVE_REGISTRY: ${WINDY_AGENT_NATIVE_REGISTRY:-https://registry.npmjs.org}
+        WINDY_PYPI_INDEX_URL: ${WINDY_PYPI_INDEX_URL:-https://pypi.org/simple}
+    cap_drop: ["ALL"]
+    cap_add: ["SETUID", "SETGID", "CHOWN", "DAC_OVERRIDE", "KILL"]
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 512
+    mem_limit: ${AGENT_SERVER_MEMORY_LIMIT:-4g}
+    cpus: ${AGENT_SERVER_CPU_LIMIT:-2}
     environment:
       AGENT_SERVER_INTERNAL_TOKEN: ${AGENT_SERVER_INTERNAL_TOKEN:-}
       AGENT_CONTEXT_HOST_URL: http://server:9747
-      AGENT_RUN_STORE_PATH: /app/data/agent/runs.sqlite3
-      AGENT_DATABASE_URL: postgresql://windy:${POSTGRES_PASSWORD}@postgres:5432/windy
-      AGENT_RUN_ENCRYPTION_SECRET: ${AGENT_RUN_ENCRYPTION_SECRET:-}
-      OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: ${OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
-      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
-      AI_PROVIDER_AUDIT_STORE_PATH: /app/data/agent/provider-audit.sqlite3
+      AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET: ${AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET:-}
+      AGENT_RUNTIME_DATABASE_PATH: /app/data/agent/embedded-dsh.sqlite
+      AI_TOOL_HOST_URL: http://server:9747
+      AI_ARTIFACT_URL: http://server:9747/api/internal/ai/artifacts
+      AGENT_DSH_HOME: /app/data/agent/dsh
+      AGENT_DSH_MAX_USERS: ${AGENT_DSH_MAX_USERS:-2}
+      AGENT_DSH_USER_EXTENSIONS: ${AGENT_DSH_USER_EXTENSIONS:-1}
+      AGENT_DSH_MAX_ACTIVE_RUNS: ${AGENT_DSH_MAX_ACTIVE_RUNS:-2}
+      AGENT_DSH_WORKSPACE_MAX_BYTES: ${AGENT_DSH_WORKSPACE_MAX_BYTES:-536870912}
       AI_PROVIDER_AUDIT_RETENTION_DAYS: ${AI_PROVIDER_AUDIT_RETENTION_DAYS:-90}
       QWEN_API_URL: ${QWEN_API_URL:-}
       QWEN_API_KEY: ${QWEN_API_KEY:-}
       QWEN_MODEL: ${QWEN_MODEL:-}
+      QWEN_STRUCTURED_OUTPUT_MODE: ${QWEN_STRUCTURED_OUTPUT_MODE:-json_schema}
       AI_PROVIDER_HTTPS_HOST_ALLOWLIST: ${AI_PROVIDER_HTTPS_HOST_ALLOWLIST:-}
-      AI_PROVIDER_CONNECT_TIMEOUT_MS: ${AI_PROVIDER_CONNECT_TIMEOUT_MS:-5000}
       AI_PROVIDER_REQUEST_TIMEOUT_MS: ${AI_PROVIDER_REQUEST_TIMEOUT_MS:-60000}
+      AI_PROVIDER_CONTEXT_TOKENS: ${AI_PROVIDER_CONTEXT_TOKENS:-}
+      AI_PROVIDER_TOKENIZE_PATH: ${AI_PROVIDER_TOKENIZE_PATH:-}
+      AI_PROVIDER_OUTPUT_RESERVE_TOKENS: ${AI_PROVIDER_OUTPUT_RESERVE_TOKENS:-4096}
+      AI_PROVIDER_CONTEXT_SAFETY_TOKENS: ${AI_PROVIDER_CONTEXT_SAFETY_TOKENS:-512}
       AI_PROVIDER_MAX_RESPONSE_BYTES: ${AI_PROVIDER_MAX_RESPONSE_BYTES:-2097152}
       AI_PROVIDER_MAX_DURATION_SECONDS: ${AI_PROVIDER_MAX_DURATION_SECONDS:-300}
       AI_PROVIDER_MAX_INPUT_BYTES: ${AI_PROVIDER_MAX_INPUT_BYTES:-67108864}
@@ -197,7 +214,6 @@ services:
         condition: service_completed_successfully
       server:
         condition: service_started
-
   document-server:
     profiles: ["document"]
     build:

package/template/docs/adr/0004-embedded-dsh-runtime.md

@@ -0,0 +1,9 @@
+# 内置 DSH 接管通用 Agent 执行
+
+日期：2026-10-29。状态：接受。
+
+Windy采用sharp-sword验证过的官方DSH嵌入模式，用Node/TypeScript Agent Server替换Python Direct Engine。DSH负责通用模型循环、原生会话、工作区与插件；Windy保留canonical Run、身份/授权、工具审批、审计、Artifact、长期业务Session/Memory与Workflow义务。
+
+该决定不改变ADR0003的业务Session事实源。DSH原生历史不是业务事实库，不将模型总结自动升级为领域事实。共享技能统一为DSH文件包及宿主版本治理，退役旧Code Skill执行依赖。
+
+取舍：复用公开上游能力，减少双引擎与业务项目维护负担；接受固定预发布版本的升级复核责任、Linux隔离要求及当前单副本SQLite边界。允许重置旧Agent专用数据，不提供旧Python历史迁移，业务数据库及文件保留。实现见[架构](../architecture/embedded-dsh-integration.md)。