create-windy 0.8.3 → 0.9.1

package/template/apps/server/src/app/dsh-workbench-test-support.ts

@@ -0,0 +1,158 @@
+import { Elysia } from "elysia";
+import { licenseVersionKey } from "@southwind-ai/shared";
+import { RepositoryActorResolver } from "../auth/actor-resolver.js";
+import { InMemoryAuthRepository } from "../auth/repository.js";
+import { AuthService } from "../auth/service.js";
+import { loadFoundationModules } from "../foundation.js";
+import { createServerRuntime } from "../runtime.js";
+import {
+  registerDshWorkbenchRoutes,
+  type DshWorkbenchOptions,
+} from "./dsh-workbench.js";
+
+export const actorId = "user-a";
+export const internalToken = "internal-test-token-with-32-characters";
+
+export async function dshFixture(
+  options: DshWorkbenchOptions = {},
+  publicOrigin: string | null = "https://windy.test",
+) {
+  const state = {
+    now: Date.now(),
+    permissions: ["system.agent.read", "system.agent-workbench.use"],
+    roles: [] as string[],
+    disabledFeature: "",
+    restricted: false,
+    probes: [] as Request[],
+    probe: (_request: Request): Response => Response.json({ ready: true }),
+  };
+  class MutableRoleRepository extends InMemoryAuthRepository {
+    override async resolveSessionActor(hash: string, now: Date) {
+      const actor = await super.resolveSessionActor(hash, now);
+      return actor
+        ? {
+            ...actor,
+            permissionKeys: [...state.permissions],
+            roleCodes: [...state.roles],
+          }
+        : undefined;
+    }
+  }
+  const repository = new MutableRoleRepository([
+    {
+      id: actorId,
+      username: "trial",
+      displayName: "Trial",
+      passwordHash: "test-password",
+      credentialState: "active",
+      status: "active",
+      roleCodes: [],
+      permissionKeys: state.permissions,
+    },
+  ]);
+  const service = new AuthService(repository, {
+    now: () => new Date(state.now),
+    sessionTtlSeconds: 36_000,
+    passwordHasher: {
+      hash: async (value) => value,
+      verify: async (hash, value) => hash === value,
+    },
+    auditWriter: { write: () => {} },
+  });
+  const login = await service.login("trial", "test-password");
+  if (!login.ok) throw new Error("Fixture login failed");
+  const resolver = new RepositoryActorResolver(repository, {
+    now: () => new Date(state.now),
+  });
+  const modules = loadFoundationModules();
+  const runtime = createServerRuntime(
+    {},
+    {
+      actorResolver: {
+        resolve: async (request) => {
+          const actor = await resolver.resolve(request);
+          return actor
+            ? {
+                ...actor,
+                permissionKeys: [...state.permissions],
+                roleCodes: [...state.roles],
+              }
+            : undefined;
+        },
+      },
+      featureCatalog: modules.flatMap(({ features }) => features),
+      featureResolver: {
+        resolve: (key) => {
+          const feature = modules
+            .flatMap(({ features }) => features)
+            .find((candidate) => candidate.key === key);
+          return feature
+            ? {
+                key,
+                enabled: feature.enabled && key !== state.disabledFeature,
+                visible: feature.visible,
+                allowedLicenseVersions: feature.allowedLicenseVersions,
+              }
+            : undefined;
+        },
+      },
+      licenseResolver: {
+        resolve: () => ({
+          status: state.restricted ? "expired" : "valid",
+          restricted: state.restricted,
+          versionKey: licenseVersionKey("advanced"),
+        }),
+      },
+    },
+  );
+  const app = new Elysia({ prefix: "/api" }).derive(async ({ request }) => ({
+    guardContext: await runtime.createGuardContext(request),
+  }));
+  registerDshWorkbenchRoutes({
+    app,
+    modules,
+    runtime,
+    authRepository: repository,
+    publicOrigin: publicOrigin ?? undefined,
+    options: {
+      now: () => state.now,
+      internalToken: () => internalToken,
+      baseUrl: () => "http://agent-runtime.test",
+      fetcher: async (input, init) => {
+        const request = new Request(input, init);
+        state.probes.push(request);
+        return state.probe(request);
+      },
+      ...options,
+    },
+  });
+  return {
+    app,
+    state,
+    service,
+    repository,
+    login,
+    runtime,
+    async request(
+      path = "/agent/workbench",
+      method = "GET",
+      init: RequestInit = {},
+    ): Promise<Response> {
+      const headers = new Headers({
+        cookie: `windy.sid=${login.token}`,
+        origin: "https://windy.test",
+        "content-type": "application/json",
+      });
+      new Headers(init.headers).forEach((value, key) =>
+        headers.set(key, value),
+      );
+      return app.handle(
+        new Request(`https://windy.test/api${path}`, {
+          ...init,
+          method,
+          headers,
+        }),
+      );
+    },
+  };
+}

package/template/apps/server/src/app/dsh-workbench.test.ts

@@ -0,0 +1,213 @@
+import { expect, test } from "bun:test";
+import { loadFoundationModules } from "../foundation.js";
+import { apiRouteKey } from "@southwind-ai/modules";
+import {
+  actorId,
+  dshFixture,
+  internalToken,
+} from "./dsh-workbench-test-support.js";
+
+test("real DSH entry resolves relative assets and transport under /agent/ from the bare URL", async () => {
+  const fixture = await dshFixture();
+  const upstreamHtml = await Bun.file(
+    Bun.resolveSync(
+      "@deepseek-ai/dsh-web-frontend/dist/index.html",
+      import.meta.dir,
+    ),
+  ).text();
+  fixture.state.probe = () =>
+    new Response(upstreamHtml, {
+      headers: { "content-type": "text/html" },
+    });
+  const response = await fixture.request("/agent/native/");
+  const html = await response.text();
+  const baseHref = html.match(/<base\s+href="([^"]+)"/i)?.[1];
+  expect(baseHref).toBe("/agent/");
+  expect(html.indexOf("<base")).toBeLessThan(
+    html.indexOf('<script type="module"'),
+  );
+  const documentBase = new URL(baseHref!, "https://windy.test/agent");
+  const resources = [...html.matchAll(/(?:src|href)="(\.\/[^"]+)"/g)].map(
+    (match) => match[1]!,
+  );
+  expect(resources.length).toBeGreaterThan(4);
+  for (const resource of [...resources, "api/remote.mux", "api/invoke"])
+    expect(new URL(resource, documentBase).pathname.startsWith("/agent/")).toBe(
+      true,
+    );
+});
+
+test("embedded readiness uses one Agent Server and returns only the same-origin mount", async () => {
+  const fixture = await dshFixture();
+  const response = await fixture.request();
+  expect(response.headers.get("cache-control")).toBe("no-store");
+  expect(await response.json()).toEqual({
+    status: "available",
+    path: "/agent/",
+  });
+  const request = fixture.state.probes[0]!;
+  expect(request.url).toBe(
+    "http://agent-runtime.test/internal/workbench-ready",
+  );
+  expect(request.headers.get("authorization")).toBe(`Bearer ${internalToken}`);
+  expect(request.headers.get("x-windy-actor-id")).toBe(actorId);
+  expect(request.headers.get("x-windy-product-session")).toBe(
+    fixture.login.token,
+  );
+  expect(request.headers.get("x-windy-public-origin")).toBe(
+    "https://windy.test",
+  );
+  expect(request.headers.has("cookie")).toBe(false);
+  expect(fixture.state.probes).toHaveLength(1);
+});
+
+test("readiness exposes only approved capacity and model reasons without internal details", async () => {
+  const fixture = await dshFixture();
+  for (const [code, reason] of [
+    ["WORKBENCH_CAPACITY_RESERVED", "capacity-reserved"],
+    ["MODEL_ROUTE_UNAVAILABLE", "model-unconfigured"],
+  ]) {
+    fixture.state.probe = () =>
+      Response.json(
+        {
+          ready: false,
+          code,
+          message: "internal model route",
+          endpoint: "http://private-model:8000",
+        },
+        { status: 503 },
+      );
+    expect(await (await fixture.request()).json()).toEqual({
+      status: "unavailable",
+      reason,
+    });
+  }
+  for (const [status, ready, code] of [
+    [503, false, "PRIVATE_PROVIDER_ERROR"],
+    [401, false, "WORKBENCH_CAPACITY_RESERVED"],
+    [503, true, "MODEL_ROUTE_UNAVAILABLE"],
+  ] as const) {
+    fixture.state.probe = () =>
+      Response.json({ ready, code, message: "private detail" }, { status });
+    expect(await (await fixture.request()).json()).toEqual({
+      status: "unavailable",
+    });
+  }
+});
+
+test("native HTTP preserves payload and removes forged identities and worker credentials", async () => {
+  const fixture = await dshFixture();
+  fixture.state.probe = () =>
+    new Response("native-frontend", {
+      headers: {
+        "content-type": "text/html",
+        "set-cookie": "native-secret=private",
+        "x-worker-token": "private",
+      },
+    });
+  const response = await fixture.request("/agent/native/", "GET", {
+    headers: {
+      "x-windy-actor-id": "user-b",
+      "x-windy-product-session": "forged",
+    },
+  });
+  expect(await response.text()).toBe("native-frontend");
+  expect(response.headers.has("set-cookie")).toBe(false);
+  expect(response.headers.has("x-worker-token")).toBe(false);
+  expect(fixture.state.probes[0]!.url).toBe(
+    "http://agent-runtime.test/internal/workbench/",
+  );
+  expect(fixture.state.probes[0]!.headers.get("x-windy-actor-id")).toBe(
+    actorId,
+  );
+  const payload = JSON.stringify({
+    endpoint: "sessions.create",
+    args: { title: "新会话" },
+  });
+  await fixture.request("/agent/native/api/invoke?transport=http", "POST", {
+    body: payload,
+  });
+  expect(await fixture.state.probes[1]!.text()).toBe(payload);
+  expect(fixture.state.probes[1]!.url).toBe(
+    "http://agent-runtime.test/internal/workbench/api/invoke?transport=http",
+  );
+});
+
+test("every registered native route has a canonical manifest permission, including WS handshake", async () => {
+  const fixture = await dshFixture();
+  const declared = new Map(
+    loadFoundationModules()
+      .flatMap(({ apiPermissions }) => apiPermissions)
+      .map((binding) => [apiRouteKey(binding), binding]),
+  );
+  for (const route of fixture.app.routes)
+    expect(
+      declared.get(
+        apiRouteKey({
+          ...route,
+          method: route.method === "WS" ? "GET" : route.method,
+        }),
+      ),
+    ).toMatchObject({
+      permissionKey: "system.agent-workbench.use",
+      featureKey: "system.agent-workbench",
+    });
+  expect(
+    fixture.app.routes.some(
+      ({ method, path }) =>
+        method === "WS" && path === "/api/agent/native/api/remote.mux",
+    ),
+  ).toBe(true);
+});
+
+test("permission, Feature and License changes block every role before reaching runtime", async () => {
+  const fixture = await dshFixture();
+  const requests = () =>
+    Promise.all([
+      fixture.request(),
+      fixture.request("/agent/workbench/admission"),
+      fixture.request("/agent/workbench/launch", "POST"),
+      fixture.request("/agent/native/"),
+      fixture.request("/agent/native/api/invoke", "POST", { body: "{}" }),
+    ]);
+  for (const role of ["member", "admin", "super-admin"]) {
+    fixture.state.roles = [role];
+    fixture.state.permissions = ["system.agent.read"];
+    for (const response of await requests()) expect(response.status).toBe(403);
+    fixture.state.permissions = [
+      "system.agent.read",
+      "system.agent-workbench.use",
+    ];
+    for (const feature of ["system.agent", "system.agent-workbench"]) {
+      fixture.state.disabledFeature = feature;
+      for (const response of await requests())
+        expect(response.status).toBe(403);
+    }
+    fixture.state.disabledFeature = "";
+    fixture.state.restricted = true;
+    for (const response of await requests()) expect(response.status).toBe(403);
+    fixture.state.restricted = false;
+  }
+  expect(fixture.state.probes).toEqual([]);
+});
+
+test("unavailable, malformed and redirecting readiness never advertise external destinations", async () => {
+  const fixture = await dshFixture();
+  for (const probe of [
+    () => Response.json({ ready: false }),
+    () => Response.json({ publicUrl: "https://elsewhere.test" }),
+    () => new Response("bad"),
+    () => new Response(null, { status: 503 }),
+  ]) {
+    fixture.state.probe = probe;
+    expect(await (await fixture.request()).json()).toEqual({
+      status: "unavailable",
+    });
+  }
+  fixture.state.probe = () =>
+    new Response(null, {
+      status: 302,
+      headers: { location: "https://evil.test/?token=private" },
+    });
+  expect((await fixture.request("/agent/native/")).status).toBe(502);
+});

package/template/apps/server/src/app/dsh-workbench.ts

@@ -0,0 +1,279 @@
+import type { ModuleManifest } from "@southwind-ai/modules";
+import { publicOriginFromEnvironment } from "./workbench-public-origin.js";
+import type { AuthRepository } from "../auth/repository.js";
+import { evaluateAccessGuards } from "../access-guards.js";
+import type { RequestGuardContext } from "../guards.js";
+import { createStaticRouteAuthorizer } from "../module-host/static-route-authorization.js";
+import { findFeature } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/route-types.js";
+import { currentDshProductSession } from "./dsh-workbench-session.js";
+import { auditDshWorkbenchAdmission } from "./dsh-workbench-audit.js";
+import { dshSkillDraftCompletionEvent } from "./dsh-skill-draft-audit.js";
+import {
+  DSH_NATIVE_REQUEST_TIMEOUT_SECONDS,
+  dshInternalHeaders,
+  dshInternalTarget,
+  dshJson,
+  isDshNativeDocument,
+  isDshSkillRequest,
+  proxyDshNative,
+  type DshWorkbenchOptions,
+} from "./dsh-workbench-proxy.js";
+import {
+  registerDshWorkbenchSocket,
+  type DshAuthorization,
+} from "./dsh-workbench-socket.js";
+
+export type { DshWorkbenchOptions } from "./dsh-workbench-proxy.js";
+
+/** The product owns login/RBAC/License; Agent Server owns isolated native runtimes. */
+export function registerDshWorkbenchRoutes(input: {
+  readonly app: RouteApp;
+  readonly modules: readonly ModuleManifest[];
+  readonly runtime: ReturnType<typeof createServerRuntime>;
+  readonly authRepository: AuthRepository;
+  readonly sessionCookieName?: string;
+  readonly publicOrigin?: string;
+  readonly options?: DshWorkbenchOptions;
+  readonly enabled?: boolean;
+}): void {
+  const options = input.options ?? {};
+  const socketAdmissions = new WeakMap<
+    RequestGuardContext,
+    Promise<Response | undefined>
+  >();
+  const authorizer = createStaticRouteAuthorizer(input.runtime, input.modules);
+  const copilot = findFeature(
+    input.modules.flatMap(({ features }) => features),
+    "system.agent-workbench",
+  );
+  const configuredOrigin = input.publicOrigin ?? publicOriginFromEnvironment();
+  const publicOrigin = (request: Request) =>
+    configuredOrigin ?? new URL(request.url).origin;
+  const authorize: DshAuthorization = async (
+    raw,
+    method,
+    path,
+    websocket = false,
+  ) => {
+    const { request, guardContext } = raw as {
+      request: Request;
+      guardContext: RequestGuardContext;
+    };
+    if (input.enabled === false)
+      return dshJson({ error: "AGENT_UNAVAILABLE" }, 503);
+    const origin = request.headers.get("origin");
+    const site = request.headers.get("sec-fetch-site");
+    const pathname = new URL(request.url).pathname;
+    // An external link is a safe document navigation, not a cross-site API call.
+    const entryNavigation =
+      method === "GET" &&
+      !websocket &&
+      ["/api/agent/native", "/api/agent/native/"].includes(pathname) &&
+      request.headers.get("sec-fetch-mode") === "navigate" &&
+      request.headers.get("sec-fetch-dest") === "document";
+    if (
+      (origin && origin !== publicOrigin(request)) ||
+      (site === "cross-site" && !entryNavigation) ||
+      ((method !== "GET" || websocket) && origin !== publicOrigin(request))
+    )
+      return dshJson({ error: "INVALID_ORIGIN" }, 403);
+    const session = await currentDshProductSession({
+      request,
+      actorId: guardContext.actor.id,
+      repository: input.authRepository,
+      cookieName: input.sessionCookieName ?? "windy.sid",
+      now: (options.now ?? Date.now)(),
+    });
+    if (!session) return dshJson({ error: "UNAUTHENTICATED" }, 401);
+    const denied = await authorizer.authorize(guardContext, method, path);
+    if (denied) return denied;
+    const current = await input.runtime.createGuardContextForActor(
+      request,
+      session.actor,
+    );
+    const currentDenied = await authorizer.authorize(current, method, path);
+    if (currentDenied) return currentDenied;
+    if (!copilot) return dshJson({ error: "FORBIDDEN" }, 403);
+    const access = await evaluateAccessGuards(input.runtime, current, {
+      permission: { permissionKey: "system.agent-workbench.use" },
+      feature: copilot,
+    });
+    if (!access.decision.allowed)
+      return dshJson(
+        { error: "FORBIDDEN", reason: access.decision.reason },
+        403,
+      );
+    if (
+      websocket &&
+      request.headers.get("upgrade")?.toLowerCase() === "websocket"
+    ) {
+      // The socket relay retains this request context for later authorization.
+      let audit = socketAdmissions.get(guardContext);
+      if (!audit) {
+        audit = auditDshWorkbenchAdmission({
+          runtime: input.runtime,
+          context: guardContext,
+          actor: session.actor,
+          kind: "websocket",
+        });
+        socketAdmissions.set(guardContext, audit);
+      }
+      const auditDenied = await audit;
+      if (auditDenied) return auditDenied;
+    }
+    return session;
+  };
+  for (const [method, path] of [
+    ["GET", "/agent/workbench"],
+    ["GET", "/agent/workbench/admission"],
+    ["GET", "/agent/workbench/skills"],
+    ["POST", "/agent/workbench/launch"],
+  ] as const) {
+    const handler = async (raw: unknown) => {
+      try {
+        const { request, guardContext } = raw as {
+          request: Request;
+          guardContext: RequestGuardContext;
+        };
+        const session = await authorize(raw, method, `/api${path}`);
+        if (session instanceof Response) return session;
+        if (new URL(request.url).search)
+          return dshJson({ error: "INVALID_REQUEST" }, 400);
+        if (method === "POST" && path.endsWith("/launch")) {
+          const auditDenied = await auditDshWorkbenchAdmission({
+            runtime: input.runtime,
+            context: guardContext,
+            actor: session.actor,
+            kind: "launch",
+          });
+          if (auditDenied) return auditDenied;
+        }
+        if (path.endsWith("/skills")) {
+          if (!options.publishedSkills)
+            return dshJson({ error: "SKILL_UNAVAILABLE" }, 503);
+          const current = await input.runtime.createGuardContextForActor(
+            request,
+            session.actor,
+          );
+          return dshJson(await options.publishedSkills(current));
+        }
+        if (path.endsWith("/admission")) {
+          return dshJson({ actor: session.actor });
+        }
+        const signal = AbortSignal.any([
+          request.signal,
+          AbortSignal.timeout(3_000),
+        ]);
+        const response = await (options.fetcher ?? fetch)(
+          dshInternalTarget(options, "/internal/workbench-ready"),
+          {
+            headers: dshInternalHeaders(
+              options,
+              session,
+              publicOrigin(request),
+              new Headers(),
+            ),
+            signal,
+            redirect: "error",
+          },
+        );
+        const result: unknown = await response.json();
+        if (!response.ok) {
+          const code =
+            response.status === 503 &&
+            result &&
+            typeof result === "object" &&
+            "ready" in result &&
+            result.ready === false &&
+            "code" in result
+              ? result.code
+              : undefined;
+          const reason =
+            code === "WORKBENCH_CAPACITY_RESERVED"
+              ? "capacity-reserved"
+              : code === "MODEL_ROUTE_UNAVAILABLE"
+                ? "model-unconfigured"
+                : undefined;
+          return dshJson({
+            status: "unavailable",
+            ...(reason ? { reason } : {}),
+          });
+        }
+        return dshJson(
+          result &&
+            typeof result === "object" &&
+            "ready" in result &&
+            result.ready === true
+            ? { status: "available", path: "/agent/" }
+            : { status: "unavailable" },
+        );
+      } catch {
+        return dshJson({ status: "unavailable" });
+      }
+    };
+    if (method === "POST") input.app.post(path, handler);
+    else input.app.get(path, handler);
+  }
+  for (const method of ["GET", "POST"] as const) {
+    for (const path of ["/agent/native", "/agent/native/*"]) {
+      const handler = async (raw: unknown) => {
+        try {
+          const { request, guardContext, server } = raw as {
+            request: Request;
+            guardContext: RequestGuardContext;
+            server?: {
+              timeout(request: Request, seconds: number): void;
+            } | null;
+          };
+          // Only the entry document may wait for a cold worker; the proxy's
+          // 75s deadline still returns a controlled failure before this expires.
+          if (isDshNativeDocument(request))
+            server?.timeout(request, DSH_NATIVE_REQUEST_TIMEOUT_SECONDS);
+          // Skill assistance may spend up to 90s on one bounded model call.
+          if (isDshSkillRequest(request)) server?.timeout(request, 110);
+          const session = await authorize(raw, method, `/api${path}`);
+          if (session instanceof Response) return session;
+          if (isDshNativeDocument(request)) {
+            const auditDenied = await auditDshWorkbenchAdmission({
+              runtime: input.runtime,
+              context: guardContext,
+              actor: session.actor,
+              kind: "entry",
+            });
+            if (auditDenied) return auditDenied;
+          }
+          return await proxyDshNative({
+            request,
+            session,
+            publicOrigin: publicOrigin(request),
+            options,
+            completeSkillDraft: async () => {
+              request.signal.throwIfAborted();
+              const current = await authorize(raw, method, `/api${path}`);
+              if (current instanceof Response) return current;
+              request.signal.throwIfAborted();
+              await input.runtime.auditSink.recordCriticalEvent(
+                dshSkillDraftCompletionEvent(
+                  current.actor,
+                  crypto.randomUUID(),
+                ),
+              );
+            },
+          });
+        } catch {
+          return dshJson({ error: "AGENT_UNAVAILABLE" }, 503);
+        }
+      };
+      if (method === "POST") input.app.post(path, handler, { parse: "none" });
+      else input.app.get(path, handler);
+    }
+  }
+  registerDshWorkbenchSocket({
+    app: input.app,
+    authorize,
+    publicOrigin,
+    options,
+  });
+}

package/template/apps/server/src/app/workbench-public-origin.ts

@@ -0,0 +1,16 @@
+/** Only deployment configuration may establish an external HTTPS origin. */
+export function publicOriginFromEnvironment(): string | undefined {
+  const value = process.env.WINDY_PUBLIC_BASE_URL?.trim();
+  if (!value) return;
+  const url = new URL(value);
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.pathname !== "/" ||
+    url.search ||
+    url.hash
+  )
+    throw new Error("Invalid WINDY_PUBLIC_BASE_URL");
+  return url.origin;
+}

package/template/apps/server/src/data-governance/user-plaintext-routes.test.ts

@@ -33,6 +33,9 @@ describe("用户敏感字段 API", () => {
   test("read 或客户端伪造上下文不能调用明文路由", async () => {
     const { app, guardContext, repositories } = await fixture();
     await addSensitiveValues(repositories, guardContext.actor);
+    expect(guardContext.actor.permissionKeys).not.toContain(
+      "system.user.reveal",
+    );
 
     const denied = (await app.invoke("GET", "/system/users/:id/plaintext", {
       guardContext,