create-windy 0.8.3 → 0.10.0

package/template/packages/modules/src/system-agent-dsh.ts

@@ -0,0 +1,119 @@
+import { featureKey } from "@southwind-ai/shared";
+import type { ModuleManifest } from "./manifest.js";
+import { binding } from "./system-api-binding.js";
+
+export const dshFeatures: ModuleManifest["features"] = [
+  [
+    "system.agent-workbench",
+    "Agent 原生工作台",
+    "同源 DSH 会话、工作区与个人扩展。",
+  ],
+  [
+    "system.agent-skill",
+    "Agent 技能治理",
+    "DSH 技能版本、共享范围、发布、停用与回滚。",
+  ],
+].map(([key, label, description]) => ({
+  key: featureKey(key!),
+  label: label!,
+  description,
+  module: "system",
+  visible: "visible",
+  enabled: true,
+  stage: "stable",
+  dependencies: [featureKey("system.agent")],
+}));
+
+export const dshAuditActionKeys = [
+  "agent.workbench.access",
+  "agent.skill.read",
+  "agent.skill.publish",
+  "agent.skill.disable",
+  "agent.skill.rollback",
+  "agent.skill.draft",
+  "agent.workflow.preset.read",
+] as const;
+export const dshAuditActions: ModuleManifest["auditActions"] =
+  dshAuditActionKeys.map((key, index) => ({
+    key,
+    label: [
+      "访问原生工作台",
+      "读取Agent技能",
+      "发布Agent技能",
+      "停用Agent技能",
+      "回滚Agent技能",
+      "生成技能草稿",
+      "读取Workflow预设",
+    ][index]!,
+    description: "按当前授权记录Agent治理操作的最小审计摘要。",
+  }));
+
+export function dshApiBindings() {
+  const workbench = (method: "GET" | "POST", path: string) =>
+    binding(
+      method,
+      path,
+      "system.agent-workbench.use",
+      "system.agent-workbench",
+      "agent.workbench.access",
+      false,
+    );
+  return [
+    ...[
+      "/api/agent/workbench",
+      "/api/agent/workbench/admission",
+      "/api/agent/workbench/skills",
+      "/api/agent/native",
+      "/api/agent/native/*",
+    ].map((path) => workbench("GET", path)),
+    ...[
+      "/api/agent/workbench/launch",
+      "/api/agent/native",
+      "/api/agent/native/*",
+    ].map((path) => workbench("POST", path)),
+    binding(
+      "GET",
+      "/api/agent/native/api/remote.mux",
+      "system.agent-workbench.use",
+      "system.agent-workbench",
+      "agent.workbench.access",
+      false,
+    ),
+    ...[
+      "/api/agent/skills",
+      "/api/agent/skills/:key/versions",
+      "/api/agent/skills/:key",
+    ].map((path) =>
+      binding(
+        "GET",
+        path,
+        "system.agent-skill.read",
+        "system.agent-skill",
+        "agent.skill.read",
+      ),
+    ),
+    binding(
+      "POST",
+      "/api/agent/skills",
+      "system.agent-skill.manage",
+      "system.agent-skill",
+      "agent.skill.publish",
+    ),
+    ...["disable", "rollback"].map((action) =>
+      binding(
+        "POST",
+        `/api/agent/skills/:key/${action}`,
+        "system.agent-skill.manage",
+        "system.agent-skill",
+        `agent.skill.${action}`,
+      ),
+    ),
+    binding(
+      "GET",
+      "/api/agent/workflows/presets",
+      "system.agent-workflow.read",
+      "system.agent-workflow",
+      "agent.workflow.preset.read",
+    ),
+  ];
+}

package/template/packages/modules/src/system-ai-api-bindings.ts

@@ -22,15 +22,6 @@ export function systemAiControlPlaneBindings(): ApiPermissionBinding[] {
   );
   const read = [
     "/api/agent/workflows/readiness",
-    "/api/internal/ai/artifacts",
-    "/api/document/runs/:runId/events",
-    "/api/document/runs/:runId/result",
-    "/api/speech/runs/:runId/events",
-    "/api/speech/runs/:runId/result",
-    "/api/speech/runs/:runId/artifact",
-    "/api/embeddings/runs/:runId/events",
-    "/api/embeddings/runs/:runId/result",
-    "/api/internal/embeddings/runs/:runId/artifacts/:itemId",
     "/api/agent/runs/:runId/events",
     "/api/agent/runs/:runId/result",
   ].map((path) =>
@@ -44,13 +35,6 @@ export function systemAiControlPlaneBindings(): ApiPermissionBinding[] {
     ),
   );
   const execute = [
-    "/api/document/runs",
-    "/api/document/runs/:runId/cancel",
-    "/api/speech/runs",
-    "/api/speech/runs/:runId/cancel",
-    "/api/embeddings",
-    "/api/embeddings/runs",
-    "/api/embeddings/runs/:runId/cancel",
     "/api/agent/runs",
     "/api/agent/runs/:runId/cancel",
     "/api/agent/runs/:runId/attach",

package/template/packages/modules/src/system-api-control-plane.ts

@@ -3,6 +3,9 @@ import { binding } from "./system-api-binding.js";
 // @windy-module system.agent begin
 import { systemAiControlPlaneBindings } from "./system-ai-api-bindings.js";
 // @windy-module system.agent end
+// @windy-module system.media-runtime begin
+import { systemMediaApiBindings } from "./system-media-api-bindings.js";
+// @windy-module system.media-runtime end
 
 /**
  * 不走资源 CRUD 的平台入口仍必须进入 Manifest。
@@ -17,13 +20,18 @@ export function systemControlPlaneApiPermissionBindings(): ApiPermissionBinding[
     // @windy-module system.agent begin
     ...systemAiControlPlaneBindings(),
     // @windy-module system.agent end
+    // @windy-module system.media-runtime begin
+    ...systemMediaApiBindings(),
+    // @windy-module system.media-runtime end
     // @windy-module system.license begin
+    // 基础运行投影不依赖管理权限或管理 Feature；Handler 仍强制 user 登录态。
     binding(
       "GET",
       "/api/license/runtime",
       "system.license.read",
-      "system.license",
+      undefined,
       "data.read",
+      true,
     ),
     binding(
       "POST",

package/template/packages/modules/src/system-api-permissions.ts

@@ -14,6 +14,22 @@ import { systemControlPlaneApiPermissionBindings } from "./system-api-control-pl
 
 export function systemApiPermissionBindings(): ApiPermissionBinding[] {
   return [
+    // @windy-module system.audit begin
+    binding(
+      "GET",
+      "/api/system/diagnostics",
+      "system.diagnostics.read",
+      "system.diagnostics",
+      "diagnostic.read",
+    ),
+    binding(
+      "GET",
+      "/api/system/diagnostics/:diagnosticId",
+      "system.diagnostics.read",
+      "system.diagnostics",
+      "diagnostic.read",
+    ),
+    // @windy-module system.audit end
     ...systemControlPlaneApiPermissionBindings(),
     binding(
       "GET",

package/template/packages/modules/src/system-api-watermark.ts

@@ -25,5 +25,26 @@ export function watermarkApiPermissionBindings(): ApiPermissionBinding[] {
       "system.watermark",
       "config.update",
     ),
+    binding(
+      "GET",
+      "/api/system/settings/watermark/yaml",
+      "system.watermark.read",
+      "system.watermark",
+      "data.read",
+    ),
+    binding(
+      "POST",
+      "/api/system/settings/watermark/yaml/preview",
+      "system.watermark.manage",
+      "system.watermark",
+      "data.read",
+    ),
+    binding(
+      "POST",
+      "/api/system/settings/watermark/yaml",
+      "system.watermark.manage",
+      "system.watermark",
+      "config.update",
+    ),
   ];
 }

package/template/packages/modules/src/system-audit-actions.ts

@@ -1,4 +1,7 @@
 import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { dshAuditActions } from "./system-agent-dsh.js";
+// @windy-module system.agent end
 
 export const systemAuditActions: ModuleManifest["auditActions"] = [
   "auth.login",
@@ -82,6 +85,9 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   "file.upload.abort",
   "file.download",
   // @windy-module system.storage end
+  // @windy-module system.media-runtime begin
+  "agent.operation.execute",
+  // @windy-module system.media-runtime end
   // @windy-module system.agent begin
   {
     key: "system.agent-tools.read",
@@ -110,7 +116,6 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   },
   "agent.mcp.access",
   "agent.tool.execute",
-  "agent.operation.execute",
   {
     key: "agent.session.read",
     label: "读取 Agent 长期会话",
@@ -252,4 +257,12 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   // @windy-module system.agent end
   "security.denied",
   "system.error",
+  {
+    key: "diagnostic.read",
+    label: "查询错误诊断",
+    description: "按当前管理员权限读取脱敏失败索引。",
+  },
+  // @windy-module system.agent begin
+  ...dshAuditActions,
+  // @windy-module system.agent end
 ];

package/template/packages/modules/src/system-features.ts

@@ -1,5 +1,8 @@
 import * as shared from "@southwind-ai/shared";
 import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { dshFeatures } from "./system-agent-dsh.js";
+// @windy-module system.agent end
 
 // @windy-module system.scheduler begin
 const standardAndAdvanced = ["standard", "advanced"].map(
@@ -10,8 +13,8 @@ const standardAndAdvanced = ["standard", "advanced"].map(
 export const systemFeatures: ModuleManifest["features"] = [
   feature(
     "system.admin",
-    "Windy 管理面",
-    "平台管理员、运维与授权审计人员使用的控制面准入能力。",
+    "Windy 管理面板",
+    "允许平台管理员、运维人员和获授权的审计人员访问 Windy 管理面板。",
   ),
   feature("system.runtime", "运行状态", "健康、就绪与指标等部署运行状态入口。"),
   feature(
@@ -90,6 +93,11 @@ export const systemFeatures: ModuleManifest["features"] = [
     "审计日志",
     "记录关键配置、权限拒绝与业务操作，支持安全追溯。",
   ),
+  feature(
+    "system.diagnostics",
+    "错误诊断",
+    "分页查看脱敏失败日志，也可按诊断编号定位记录。",
+  ),
   // @windy-module system.audit end
   // @windy-module system.storage begin
   feature(
@@ -98,6 +106,20 @@ export const systemFeatures: ModuleManifest["features"] = [
     "受控文件上传、续传、下载、过期和底层对象生命周期。",
   ),
   // @windy-module system.storage end
+  // @windy-module system.media-runtime begin
+  feature(
+    "system.ai-artifact",
+    "AI 文件引用",
+    "受控运行时读取已授权的输入文件。",
+  ),
+  feature(
+    "system.document",
+    "文档识别与 OCR",
+    "控制文档识别与 OCR运行时和业务入口。",
+  ),
+  feature("system.speech", "语音处理", "控制语音处理运行时和业务入口。"),
+  feature("system.embedding", "向量嵌入", "控制向量嵌入运行时和业务入口。"),
+  // @windy-module system.media-runtime end
   // @windy-module system.agent begin
   feature(
     "system.agent",
@@ -148,6 +170,7 @@ export const systemFeatures: ModuleManifest["features"] = [
       shared.featureKey("system.agent-session"),
     ],
   },
+  ...dshFeatures,
   // @windy-module system.agent end
   // @windy-module system.operations begin
   feature(

package/template/packages/modules/src/system-media-api-bindings.ts

@@ -0,0 +1,97 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { binding } from "./system-api-binding.js";
+
+export function systemMediaApiBindings(): ApiPermissionBinding[] {
+  return [
+    binding(
+      "GET",
+      "/api/internal/ai/artifacts",
+      "system.ai-artifact.read",
+      "system.ai-artifact",
+      "data.read",
+      true,
+    ),
+    ...outputArtifactBindings(),
+    ...runtimeBindings(
+      "system.document",
+      ["/api/document/runs/:runId/events", "/api/document/runs/:runId/result"],
+      ["/api/document/runs", "/api/document/runs/:runId/cancel"],
+    ),
+    ...runtimeBindings(
+      "system.speech",
+      [
+        "/api/speech/runs/:runId/events",
+        "/api/speech/runs/:runId/result",
+        "/api/speech/runs/:runId/artifact",
+      ],
+      ["/api/speech/runs", "/api/speech/runs/:runId/cancel"],
+    ),
+    ...runtimeBindings(
+      "system.embedding",
+      [
+        "/api/embeddings/runs/:runId/events",
+        "/api/embeddings/runs/:runId/result",
+        "/api/internal/embeddings/runs/:runId/artifacts/:itemId",
+      ],
+      [
+        "/api/embeddings",
+        "/api/embeddings/runs",
+        "/api/embeddings/runs/:runId/cancel",
+      ],
+    ),
+  ];
+}
+
+function runtimeBindings(
+  feature: "system.document" | "system.speech" | "system.embedding",
+  read: readonly string[],
+  execute: readonly string[],
+): ApiPermissionBinding[] {
+  return [
+    ...read.map((path) =>
+      binding(
+        "GET",
+        path,
+        `${feature}.read`,
+        feature,
+        "data.read",
+        path.startsWith("/api/internal/"),
+      ),
+    ),
+    ...execute.map((path) =>
+      binding(
+        "POST",
+        path,
+        `${feature}.read`,
+        feature,
+        "agent.operation.execute",
+        false,
+      ),
+    ),
+  ];
+}
+
+function outputArtifactBindings(): ApiPermissionBinding[] {
+  const root = "/api/internal/ai/output-artifacts";
+  const routes = [
+    ["GET", ""],
+    ["GET", "/health/ready"],
+    ["POST", "/scopes/:scope/grants/:generation/accept"],
+    ["POST", "/scopes/:scope/artifacts"],
+    ["PUT", "/scopes/:scope/artifacts/:artifactId/parts/:partNumber"],
+    ["POST", "/scopes/:scope/artifacts/:artifactId/complete"],
+    ["POST", "/scopes/:scope/seal"],
+    ["DELETE", "/scopes/:scope/open"],
+    ["DELETE", "/scopes/:scope"],
+  ] as const;
+  return routes.map(([method, suffix]) =>
+    binding(
+      method,
+      root + suffix,
+      "system.ai-artifact.read",
+      "system.ai-artifact",
+      method === "GET" ? "data.read" : "agent.operation.execute",
+      true,
+    ),
+  );
+}

package/template/packages/modules/src/system-module-audit-selection.ts

@@ -0,0 +1,27 @@
+import type { ModuleManifest } from "./manifest.js";
+import { auditActionKey } from "./system-module-ownership.js";
+// @windy-module system.agent begin
+import { agentAuditActionKeys } from "./system-agent-audit-actions.js";
+// @windy-module system.agent end
+const agentActions = new Set<string>();
+// @windy-module system.agent begin
+for (const key of agentAuditActionKeys) agentActions.add(key);
+// @windy-module system.agent end
+export function selectSystemAuditActions(
+  name: string,
+  actions: ModuleManifest["auditActions"],
+) {
+  return actions.filter((action) => {
+    const key = auditActionKey(action);
+    if (name === "system.identity")
+      return key === "system.user-directory.query";
+    if (key === "agent.operation.execute")
+      return name === "system.media-runtime";
+    if (name === "system.agent") return agentActions.has(key);
+    return (
+      name === "system" &&
+      key !== "system.user-directory.query" &&
+      !agentActions.has(key)
+    );
+  });
+}

package/template/packages/modules/src/system-module-catalog.test.ts

@@ -34,6 +34,9 @@ describe("系统能力模块目录", () => {
       // @windy-module system.storage begin
       "system.storage",
       // @windy-module system.storage end
+      // @windy-module system.media-runtime begin
+      "system.media-runtime",
+      // @windy-module system.media-runtime end
       // @windy-module system.agent begin
       "system.agent",
       // @windy-module system.agent end
@@ -130,6 +133,7 @@ describe("系统能力模块目录", () => {
   });
 
   // @windy-module system.agent begin
+  // @windy-module system.agent-ui begin
   test("AI Runtime 能力与专用审计动作归属 system.agent", () => {
     const agent = systemModuleManifests().find(
       ({ name }) => name === "system.agent",
@@ -162,10 +166,13 @@ describe("系统能力模块目录", () => {
       ]),
     );
   });
+  // @windy-module system.agent-ui end
 
+  // @windy-module system.agent end
+  // @windy-module system.media-runtime begin
   test("Embedding Run API 声明用户 Guard 与内部 Artifact 边界", () => {
     const agent = systemModuleManifests().find(
-      ({ name }) => name === "system.agent",
+      ({ name }) => name === "system.media-runtime",
     );
     const bindings = new Map(
       agent?.apiPermissions.map((binding) => [
@@ -174,8 +181,8 @@ describe("系统能力模块目录", () => {
       ]),
     );
     const guarded = {
-      permissionKey: "system.agent.read",
-      featureKey: "system.agent",
+      permissionKey: "system.embedding.read",
+      featureKey: "system.embedding",
       anonymous: false,
     };
 
@@ -208,13 +215,13 @@ describe("系统能力模块目录", () => {
     ).toEqual({
       method: "GET",
       path: "/api/internal/embeddings/runs/:runId/artifacts/:itemId",
-      permissionKey: "system.agent.read",
-      featureKey: "system.agent",
+      permissionKey: "system.embedding.read",
+      featureKey: "system.embedding",
       auditAction: "data.read",
       anonymous: true,
     });
   });
-  // @windy-module system.agent end
+  // @windy-module system.media-runtime end
 
   // @windy-module system.data-governance begin
   test("能力声明归属到对应模块而不是继续挂在 system 聚合项", () => {