create-windy 0.8.3 → 0.9.1

package/template/apps/server/src/runtime-development.ts

@@ -1,3 +1,4 @@
+import { systemModuleManifests } from "@southwind-ai/modules";
 import type { RequestActor } from "./guards.js";
 // @windy-module work-order begin
 import { exampleDevelopmentPermissionKeys } from "./example-permissions.js";
@@ -21,50 +22,11 @@ export function developmentAdminActor(): RequestActor {
       },
     ]),
     permissionKeys: [
-      "system.admin.access",
-      "system.menu.read",
-      "system.profile.read",
-      "system.profile.manage",
-      "system.user.read",
-      "system.user.manage",
-      "system.user-directory.read",
-      "system.role.read",
-      "system.role.manage",
-      "system.department.read",
-      "system.department.create",
-      "system.department.manage",
-      "system.menu.manage",
-      "system.dict.read",
-      "system.dict.manage",
-      "system.feature.read",
-      "system.feature.manage",
-      "system.ui-components.read",
-      "system.search.read",
-      "system.search.manage",
-      "system.settings.read",
-      "system.settings.manage",
-      "system.watermark.read",
-      "system.watermark.manage",
-      // @windy-module system.license begin
-      "system.license.read",
-      "system.license.manage",
-      // @windy-module system.license end
-      "system.audit.read",
-      "system.agent.read",
-      "system.ops.read",
-      "system.scheduler.read",
-      "system.scheduler.manage",
-      "system.notification.read",
-      "system.notification.update",
-      "system.notification.manage",
-      "system.bulk-data.manage",
-      "system.storage.read",
-      "system.storage.create",
-      "system.storage.manage",
-      "system.workflow.read",
-      "system.workflow.create",
-      "system.workflow.approve",
-      "system.workflow.manage",
+      ...systemModuleManifests().flatMap((module) =>
+        module.permissions
+          .filter(({ accessRisk }) => !accessRisk || accessRisk === "standard")
+          .map((permission) => permission.key),
+      ),
       // @windy-module work-order begin
       ...exampleDevelopmentPermissionKeys,
       // @windy-module work-order end

package/template/apps/server/src/system/diagnostic-routes.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createServerRuntime } from "../runtime.js";
+import {
+  createDiagnosticIndex,
+  diagnosticRecord,
+  newDiagnosticId,
+} from "../observability/diagnostic-index.js";
+import { FakeRouteApp } from "./route-test-app.js";
+import { registerDiagnosticRoutes } from "./diagnostic-routes.js";
+
+describe("diagnostic lookup", () => {
+  test("只允许 diagnostics.read 查询，并为查询留下审计", async () => {
+    const runtime = createServerRuntime({
+      WINDY_DEV_ADMIN_TOKEN: "admin-token",
+    });
+    const index = createDiagnosticIndex();
+    const id = newDiagnosticId();
+    await index.record(
+      diagnosticRecord({
+        diagnosticId: id,
+        requestId: "internal-req",
+        service: "server",
+        stage: "http",
+        method: "GET",
+        route: "/api/resources/:id",
+        statusCode: 500,
+        errorCode: "UNEXPECTED_FAILURE",
+      }),
+    );
+    const app = new FakeRouteApp();
+    registerDiagnosticRoutes(
+      app,
+      runtime,
+      createFoundationSnapshot().features,
+      index,
+    );
+    const route = "/system/diagnostics/:diagnosticId";
+    const anonymous = await runtime.createGuardContext(
+      new Request("http://localhost/api/system/diagnostics/" + id),
+    );
+    const denied = (await app.invoke("GET", route, {
+      guardContext: anonymous,
+      params: { diagnosticId: id },
+      query: {},
+    })) as Response;
+    expect(denied.status).toBe(403);
+    expect(JSON.stringify(await denied.json())).not.toContain("internal-req");
+
+    const admin = await runtime.createGuardContext(
+      new Request("http://localhost/api/system/diagnostics/" + id, {
+        headers: { authorization: "Bearer admin-token" },
+      }),
+    );
+    const found = (await app.invoke("GET", route, {
+      guardContext: admin,
+      params: { diagnosticId: id },
+      query: {},
+    })) as Response;
+    expect(found.status).toBe(200);
+    expect(found.headers.get("cache-control")).toBe("no-store");
+    expect(await found.json()).toMatchObject({
+      requestId: "internal-req",
+      errorCode: "UNEXPECTED_FAILURE",
+    });
+    expect(runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({ action: "diagnostic.read" }),
+    );
+
+    const expired = (await app.invoke("GET", route, {
+      guardContext: admin,
+      params: { diagnosticId: "diag-00000000-0000-7000-8000-000000000000" },
+      query: {},
+    })) as Response;
+    expect(expired.status).toBe(410);
+    expect(await expired.json()).toEqual({ error: "DIAGNOSTIC_EXPIRED" });
+  });
+});

package/template/apps/server/src/system/diagnostic-routes.ts

@@ -0,0 +1,66 @@
+import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import type { createServerRuntime } from "../runtime.js";
+import {
+  expiredDiagnosticId,
+  validDiagnosticId,
+  type DiagnosticIndex,
+} from "../observability/diagnostic-index.js";
+import { findFeature } from "../route-guards.js";
+import { resourceEvent, routeContext } from "./route-helpers.js";
+import { withPermission } from "./resource-route-support.js";
+import type { RouteApp } from "./route-types.js";
+
+export function registerDiagnosticRoutes(
+  app: Pick<RouteApp, "get">,
+  runtime: ReturnType<typeof createServerRuntime>,
+  features: FeatureFlagDefinition[],
+  index: DiagnosticIndex,
+) {
+  const feature = findFeature(features, "system.diagnostics");
+  if (!feature) throw new Error("错误诊断缺少 system.diagnostics Feature");
+  app.get("/system/diagnostics/:diagnosticId", (raw) => {
+    const { params, guardContext } = routeContext(raw);
+    return withPermission(
+      runtime,
+      guardContext,
+      "GET",
+      "diagnostics",
+      "read",
+      feature,
+      async () => {
+        const id = params.diagnosticId ?? "";
+        if (/^web-[0-9a-f-]{36}$/.test(id))
+          return failure("CLIENT_ONLY_DIAGNOSTIC", 422);
+        if (!validDiagnosticId(id))
+          return failure("INVALID_DIAGNOSTIC_ID", 400);
+        try {
+          await runtime.auditSink.recordCriticalEvent(
+            resourceEvent(
+              guardContext,
+              "diagnostic.read",
+              "diagnostic-events",
+              id,
+            ),
+          );
+          if (expiredDiagnosticId(id))
+            return failure("DIAGNOSTIC_EXPIRED", 410);
+          const record = await index.find(id);
+          return record
+            ? Response.json(record, {
+                headers: { "cache-control": "no-store" },
+              })
+            : failure("DIAGNOSTIC_NOT_FOUND", 404);
+        } catch {
+          return failure("DIAGNOSTIC_INDEX_UNAVAILABLE", 503);
+        }
+      },
+    );
+  });
+}
+
+function failure(error: string, status: number) {
+  return Response.json(
+    { error },
+    { status, headers: { "cache-control": "no-store" } },
+  );
+}

package/template/apps/web/Dockerfile

@@ -1,15 +1,20 @@
 # syntax=docker/dockerfile:1
 
+FROM node:24.7.0-alpine AS node
+
 FROM oven/bun:1.3.14-alpine AS deps
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
 WORKDIR /app
 
 COPY package.json bun.lock ./
 COPY windy.modules.json windy.modules.json
 # windy-copy:deps begin
+COPY apps/agent-server/package.json apps/agent-server/package.json
 COPY apps/license/package.json apps/license/package.json
 COPY apps/server/package.json apps/server/package.json
 COPY apps/signing-service/package.json apps/signing-service/package.json
 COPY apps/web/package.json apps/web/package.json
+COPY apps/windy-gateway/package.json apps/windy-gateway/package.json
 COPY packages/ai-client/package.json packages/ai-client/package.json
 COPY packages/config/package.json packages/config/package.json
 COPY packages/create-windy/package.json packages/create-windy/package.json
@@ -19,6 +24,7 @@ COPY packages/delivery/package.json packages/delivery/package.json
 COPY packages/example-work-order/package.json packages/example-work-order/package.json
 COPY packages/jobs/package.json packages/jobs/package.json
 COPY packages/license-sdk/package.json packages/license-sdk/package.json
+COPY packages/model-gateway/package.json packages/model-gateway/package.json
 COPY packages/modules/package.json packages/modules/package.json
 COPY packages/server-sdk/package.json packages/server-sdk/package.json
 COPY packages/shared/package.json packages/shared/package.json
@@ -39,12 +45,14 @@ COPY packages/storage packages/storage
 # windy-copy:build end
 # Bun 1.3.14 on Linux resolves Vite's relative imports from the .bin symlink
 # instead of its real package entry. Execute the immutable hoisted entry directly.
-RUN cd apps/web && bun ../../node_modules/vite/bin/vite.js build
+RUN cd apps/web && node ../../node_modules/vite/bin/vite.js build
 
 FROM deps AS runner
 COPY apps/web/package.json apps/web/package.json
 COPY apps/web/server.ts apps/web/server.ts
 COPY apps/web/runtime-server.ts apps/web/runtime-server.ts
+COPY apps/web/dsh-workbench-proxy.ts apps/web/dsh-workbench-proxy.ts
+COPY apps/web/dsh-workbench-location.ts apps/web/dsh-workbench-location.ts
 COPY packages/shared packages/shared
 COPY --from=build /app/apps/web/dist apps/web/dist
 ENV NODE_ENV=production

package/template/apps/web/dev/start.ts

@@ -1,3 +1,5 @@
+import { dirname, join } from "node:path";
+import { createRequire } from "node:module";
 import { projectFingerprint } from "./dev-identity";
 import { selectDevPort } from "./dev-port";
 
@@ -14,17 +16,26 @@ if (selection.kind === "existing") {
 }
 
 console.info(`启动 Windy Web：${url}`);
-const child = Bun.spawn(["bunx", "--bun", "vite"], {
-  cwd: process.cwd(),
-  env: {
-    ...process.env,
-    WINDY_DEV_PORT: String(selection.port),
-    WINDY_DEV_FINGERPRINT: fingerprint,
+const child = Bun.spawn(
+  [
+    "node",
+    join(
+      dirname(createRequire(import.meta.url).resolve("vite/package.json")),
+      "bin/vite.js",
+    ),
+  ],
+  {
+    cwd: process.cwd(),
+    env: {
+      ...process.env,
+      WINDY_DEV_PORT: String(selection.port),
+      WINDY_DEV_FINGERPRINT: fingerprint,
+    },
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
   },
-  stdin: "inherit",
-  stdout: "inherit",
-  stderr: "inherit",
-});
+);
 process.exit(await child.exited);
 
 function parseConfiguredPort(value: string | undefined): number | undefined {

package/template/apps/web/dsh-workbench-location.ts

@@ -0,0 +1,21 @@
+/** The pairing and one-use handoff pages remain owned by the product SPA. */
+export function isDshWorkbenchPath(path: string): boolean {
+  const url = new URL(path, "http://web.internal");
+  if (url.pathname === "/agent" || url.pathname === "/agent/")
+    return !url.searchParams.has("handoff");
+  return (
+    url.pathname.startsWith("/agent/") &&
+    url.pathname !== "/agent/connect" &&
+    !url.pathname.startsWith("/agent/connect/")
+  );
+}
+
+export function dshWorkbenchProxyPath(path: string): string {
+  return path.replace(/^\/agent(?:\/|(?=\?|$))/, "/api/agent/native/");
+}
+
+export function dshWorkbenchLoginPath(path: string): string | undefined {
+  const url = new URL(path, "http://web.internal");
+  if (url.pathname !== "/agent" && url.pathname !== "/agent/") return;
+  return `/login?returnTo=${encodeURIComponent(`${url.pathname}${url.search}`)}`;
+}

package/template/apps/web/dsh-workbench-proxy.test.ts

@@ -0,0 +1,121 @@
+import { expect, test } from "bun:test";
+import {
+  dshWorkbenchProxyPath,
+  isDshWorkbenchPath,
+} from "./dsh-workbench-location";
+import { createDshWebProxy } from "./dsh-workbench-proxy";
+
+test("native mount accepts the bare entry and preserves pairing and handoff in the SPA", () => {
+  for (const path of [
+    "/agent",
+    "/agent/",
+    "/agent?session=abc",
+    "/agent/assets/a.js",
+  ])
+    expect(isDshWorkbenchPath(path)).toBe(true);
+  for (const path of [
+    "/agent/connect",
+    "/agent/connect?pairing=abc",
+    "/agent/connect/",
+    "/agent?handoff=one-use",
+    "/agent/?handoff=one-use",
+    "/agents",
+  ])
+    expect(isDshWorkbenchPath(path)).toBe(false);
+  expect(dshWorkbenchProxyPath("/agent")).toBe("/api/agent/native/");
+  expect(dshWorkbenchProxyPath("/agent?session=abc")).toBe(
+    "/api/agent/native/?session=abc",
+  );
+  expect(dshWorkbenchProxyPath("/agent/assets/a.js")).toBe(
+    "/api/agent/native/assets/a.js",
+  );
+});
+
+test("production entry serves the native document directly and retains login redirects", async () => {
+  const requests: Request[] = [];
+  const upstream = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(request) {
+      requests.push(new Request(request.url, { headers: request.headers }));
+      return request.headers.has("cookie")
+        ? new Response("<html>DSH</html>", {
+            headers: { "content-type": "text/html" },
+          })
+        : Response.json({ error: "UNAUTHENTICATED" }, { status: 401 });
+    },
+  });
+  try {
+    const proxy = createDshWebProxy(upstream.url.origin);
+    const server = {} as Parameters<typeof proxy.fetch>[1];
+    const response = await proxy.fetch(
+      new Request("https://windy.test/agent?session=abc", {
+        headers: { cookie: "windy.sid=fixture", "x-windy-actor-id": "forged" },
+      }),
+      server,
+    );
+    expect(response?.status).toBe(200);
+    expect(response?.headers.get("location")).toBeNull();
+    expect(await response?.text()).toBe("<html>DSH</html>");
+    expect(new URL(requests[0]!.url).pathname).toBe("/api/agent/native/");
+    expect(new URL(requests[0]!.url).search).toBe("?session=abc");
+    expect(requests[0]!.headers.get("x-windy-actor-id")).toBeNull();
+    const anonymous = await proxy.fetch(
+      new Request("https://windy.test/agent"),
+      server,
+    );
+    expect(anonymous?.status).toBe(302);
+    expect(anonymous?.headers.get("location")).toBe("/login?returnTo=%2Fagent");
+    const api = await proxy.fetch(
+      new Request("https://windy.test/agent/api/status"),
+      server,
+    );
+    expect(api?.status).toBe(401);
+  } finally {
+    await upstream.stop(true);
+  }
+});
+
+test("production skill generation survives short default idle timeout and strips private browser headers", async () => {
+  let received: Request | undefined;
+  const upstream = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    idleTimeout: 10,
+    async fetch(request) {
+      received = request;
+      const body = await request.json();
+      expect(body).toEqual({ action: "draft", workflow: "整理材料" });
+      await new Promise((resolve) => setTimeout(resolve, 3100));
+      return Response.json({ draft: { name: "synthetic" } });
+    },
+  });
+  const proxy = createDshWebProxy(upstream.url.origin);
+  const web = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    idleTimeout: 1,
+    fetch: proxy.fetch,
+    websocket: proxy.websocket,
+  });
+  try {
+    const response = await fetch(new URL("/agent/windy/skills", web.url), {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-windy-skill-draft-complete": "1",
+      },
+      body: JSON.stringify({ action: "draft", workflow: "整理材料" }),
+      signal: AbortSignal.timeout(10_000),
+    });
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ draft: { name: "synthetic" } });
+    expect(new URL(received!.url).pathname).toBe(
+      "/api/agent/native/windy/skills",
+    );
+    expect(received!.headers.has("x-windy-skill-draft-complete")).toBe(false);
+  } finally {
+    await web.stop(true);
+    await upstream.stop(true);
+  }
+});

package/template/apps/web/dsh-workbench-proxy.ts

@@ -0,0 +1,194 @@
+import WebSocket from "ws";
+import type { Server, ServerWebSocket } from "bun";
+import {
+  dshWorkbenchLoginPath,
+  dshWorkbenchProxyPath,
+} from "./dsh-workbench-location";
+export { isDshWorkbenchPath } from "./dsh-workbench-location";
+
+export interface DshWebSocketState {
+  readonly upstream: WebSocket;
+  readonly pending: (string | Uint8Array)[];
+  client?: ServerWebSocket<DshWebSocketState>;
+  bufferedBytes: number;
+  closed: boolean;
+}
+
+export function createDshWebProxy(apiUpstream?: string) {
+  const target = (request: Request) => {
+    if (!apiUpstream) throw new Error("API_UPSTREAM_NOT_CONFIGURED");
+    const url = new URL(request.url);
+    return new URL(
+      dshWorkbenchProxyPath(`${url.pathname}${url.search}`),
+      apiUpstream,
+    );
+  };
+  return {
+    async fetch(
+      request: Request,
+      server: Server<DshWebSocketState>,
+    ): Promise<Response | undefined> {
+      try {
+        const url = target(request);
+        const headers = new Headers(request.headers);
+        for (const name of [
+          "host",
+          "connection",
+          "content-length",
+          "upgrade",
+          "sec-websocket-key",
+          "sec-websocket-version",
+          "sec-websocket-extensions",
+        ])
+          headers.delete(name);
+        // Bun builds the API request URL from Host. Keep the browser authority
+        // for HTTP LAN deployments without a fixed public base URL, while the
+        // network destination remains the configured API upstream.
+        headers.set("host", new URL(request.url).host);
+        headers.delete("forwarded");
+        headers.delete("x-forwarded-host");
+        headers.delete("x-forwarded-proto");
+        const privateHeaders: string[] = [];
+        headers.forEach((_value, name) => {
+          if (name.startsWith("x-windy-")) privateHeaders.push(name);
+        });
+        for (const name of privateHeaders) headers.delete(name);
+        if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") {
+          const skillRequest =
+            request.method === "POST" &&
+            new URL(request.url).pathname === "/agent/windy/skills";
+          if (skillRequest) server.timeout(request, 120);
+          const response = await fetch(url, {
+            method: request.method,
+            headers,
+            body: ["GET", "HEAD"].includes(request.method)
+              ? undefined
+              : request.body,
+            redirect: "manual",
+            signal: skillRequest
+              ? AbortSignal.any([request.signal, AbortSignal.timeout(115_000)])
+              : request.signal,
+          });
+          const login = dshWorkbenchLoginPath(request.url);
+          if (response.status === 401 && login) {
+            await response.body?.cancel();
+            return new Response(null, {
+              status: 302,
+              headers: { location: login, "cache-control": "no-store" },
+            });
+          }
+          return response;
+        }
+        if (new URL(request.url).pathname !== "/agent/api/remote.mux")
+          return unavailable(404);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        const upstream = new WebSocket(url, { headers: headerRecord(headers) });
+        upstream.binaryType = "arraybuffer";
+        const state: DshWebSocketState = {
+          upstream,
+          pending: [],
+          bufferedBytes: 0,
+          closed: false,
+        };
+        upstream.addEventListener("message", (event) => {
+          const frame =
+            typeof event.data === "string"
+              ? event.data
+              : new Uint8Array(event.data as ArrayBuffer);
+          if (state.client) {
+            if (state.client.send(frame) === 0) close(state, 1013);
+          } else {
+            state.bufferedBytes +=
+              typeof frame === "string"
+                ? Buffer.byteLength(frame)
+                : frame.byteLength;
+            if (state.bufferedBytes > 2_097_152 || state.pending.length >= 128)
+              return close(state, 1013);
+            state.pending.push(frame);
+          }
+        });
+        upstream.addEventListener("close", (event) => {
+          const code = event.code === 1008 ? 1008 : 1011;
+          close(state, code);
+        });
+        const opened = await new Promise<boolean>((resolve) => {
+          const timeout = setTimeout(() => {
+            upstream.close();
+            resolve(false);
+          }, 10_000);
+          const settle = (ok: boolean) => {
+            clearTimeout(timeout);
+            resolve(ok);
+          };
+          upstream.addEventListener("open", () => settle(true), { once: true });
+          upstream.addEventListener("error", () => settle(false), {
+            once: true,
+          });
+          upstream.addEventListener("close", () => settle(false), {
+            once: true,
+          });
+        });
+        if (!opened) {
+          close(state);
+          return unavailable(503);
+        }
+        if (server.upgrade(request, { data: state })) return;
+        close(state);
+        return unavailable(400);
+      } catch {
+        return unavailable(503);
+      }
+    },
+    websocket: {
+      open(client: ServerWebSocket<DshWebSocketState>) {
+        const state = client.data;
+        state.client = client;
+        if (state.upstream.readyState !== WebSocket.OPEN)
+          return close(state, 1011);
+        for (const frame of state.pending)
+          if (client.send(frame) === 0) return close(state, 1013);
+        state.pending.length = 0;
+        state.bufferedBytes = 0;
+      },
+      message(
+        client: ServerWebSocket<DshWebSocketState>,
+        message: string | Buffer,
+      ) {
+        const { upstream } = client.data;
+        if (
+          upstream.readyState !== WebSocket.OPEN ||
+          upstream.bufferedAmount > 8_388_608
+        )
+          return close(client.data, 1013);
+        upstream.send(message);
+      },
+      close(client: ServerWebSocket<DshWebSocketState>) {
+        client.data.closed = true;
+        client.data.pending.length = 0;
+        client.data.upstream.close();
+      },
+    },
+  };
+}
+
+function close(state: DshWebSocketState, code = 1000) {
+  if (state.closed) return;
+  state.closed = true;
+  state.pending.length = 0;
+  state.upstream.close();
+  state.client?.close(code, "Agent disconnected");
+}
+function unavailable(status: number) {
+  return Response.json(
+    { error: "AGENT_UNAVAILABLE" },
+    { status, headers: { "cache-control": "no-store" } },
+  );
+}
+
+function headerRecord(headers: Headers): Record<string, string> {
+  const record: Record<string, string> = {};
+  headers.forEach((value, name) => {
+    record[name] = value;
+  });
+  return record;
+}

package/template/apps/web/package.json

@@ -32,11 +32,13 @@
     "vee-validate": "^4.15.1",
     "vue": "^3.5.39",
     "vue-router": "^5.1.0",
-    "vue-sonner": "^2.0.9"
+    "vue-sonner": "^2.0.9",
+    "ws": "^8.22.0"
   },
   "devDependencies": {
     "@southwind-ai/modules": "workspace:*",
     "@types/qrcode": "^1.5.6",
+    "@types/ws": "^8.18.2",
     "@vitejs/plugin-vue": "^6.0.7",
     "@vue/test-utils": "^2.4.11",
     "happy-dom": "^20.10.6",