create-windy 0.8.3 → 0.9.1

package/template/packages/database/drizzle/meta/_journal.json

@@ -449,6 +449,13 @@
       "when": 1789011354550,
       "tag": "0063_license_project_lifecycle",
       "breakpoints": true
+    },
+    {
+      "idx": 64,
+      "version": "7",
+      "when": 1793213711851,
+      "tag": "0064_dsh_skills_diagnostics",
+      "breakpoints": true
     }
   ]
 }

package/template/packages/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/database",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "dependencies": {
-    "@southwind-ai/shared": "workspace:^0.3.0",
+    "@southwind-ai/shared": "workspace:^0.3.2",
     "drizzle-orm": "^0.45.2"
   },
   "exports": {

package/template/packages/database/src/schema/agent-skills.ts

@@ -0,0 +1,65 @@
+import {
+  boolean,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  timestamp,
+  varchar,
+} from "drizzle-orm/pg-core";
+import type {
+  AgentSkillBundle,
+  AgentSkillVersion,
+  AuditEvent,
+} from "@southwind-ai/shared";
+
+export const agentSkillVersions = pgTable(
+  "agent_skill_versions",
+  {
+    tenantId: varchar("tenant_id", { length: 64 }).notNull(),
+    skillKey: varchar("skill_key", { length: 64 }).notNull(),
+    version: integer("version").notNull(),
+    metadata: jsonb("metadata").$type<AgentSkillVersion>().notNull(),
+    bundle: jsonb("bundle").$type<AgentSkillBundle>().notNull(),
+    auditCommitted: boolean("audit_committed").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.tenantId, table.skillKey, table.version] }),
+    index("idx_agent_skill_catalog").on(
+      table.tenantId,
+      table.auditCommitted,
+      table.skillKey,
+    ),
+  ],
+);
+
+export const agentSkillMutations = pgTable(
+  "agent_skill_mutations",
+  {
+    tenantId: varchar("tenant_id", { length: 64 }).notNull(),
+    actorId: varchar("actor_id", { length: 64 }).notNull(),
+    idempotencyKey: varchar("idempotency_key", { length: 160 }).notNull(),
+    requestDigest: varchar("request_digest", { length: 71 }).notNull(),
+    skillKey: varchar("skill_key", { length: 64 }).notNull(),
+    version: integer("version").notNull(),
+    result: jsonb("result").$type<AgentSkillVersion>().notNull(),
+    audit: jsonb("audit").$type<AuditEvent>().notNull(),
+    auditCommitted: boolean("audit_committed").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (table) => [
+    primaryKey({
+      columns: [table.tenantId, table.actorId, table.idempotencyKey],
+    }),
+    index("idx_agent_skill_audit_pending").on(
+      table.auditCommitted,
+      table.createdAt,
+    ),
+  ],
+);

package/template/packages/database/src/schema/diagnostics.ts

@@ -0,0 +1,27 @@
+import {
+  index,
+  integer,
+  pgTable,
+  timestamp,
+  varchar,
+} from "drizzle-orm/pg-core";
+
+export const diagnosticEvents = pgTable(
+  "diagnostic_events",
+  {
+    diagnosticId: varchar("diagnostic_id", { length: 41 }).primaryKey(),
+    requestId: varchar("request_id", { length: 160 }).notNull(),
+    occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    service: varchar("service", { length: 24 }).notNull(),
+    stage: varchar("stage", { length: 24 }).notNull(),
+    method: varchar("method", { length: 16 }).notNull(),
+    route: varchar("route", { length: 256 }).notNull(),
+    statusCode: integer("status_code").notNull(),
+    errorCode: varchar("error_code", { length: 80 }).notNull(),
+  },
+  (table) => [
+    index("idx_diagnostic_events_expiry").on(table.expiresAt),
+    index("idx_diagnostic_events_request").on(table.requestId),
+  ],
+);

package/template/packages/database/src/schema/index.ts

@@ -44,3 +44,11 @@ export * from "./client-agent-workflow-artifact.js";
 export * from "./embedding-runtime.js";
 export * from "./ai-output-artifacts.js";
 // @windy-module system.agent end
+
+// @windy-module system.agent begin
+export * from "./agent-skills.js";
+// @windy-module system.agent end
+
+// @windy-module system.audit begin
+export * from "./diagnostics.js";
+// @windy-module system.audit end

package/template/packages/modules/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/modules",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {

package/template/packages/modules/src/system-admin-routes.ts

@@ -120,6 +120,14 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     "system.audit.read",
     "system.audit",
   ),
+  route(
+    "system.diagnostics",
+    "/admin/system/diagnostics",
+    "错误诊断",
+    "sidebar",
+    "system.diagnostics.read",
+    "system.diagnostics",
+  ),
   // @windy-module system.audit end
   // @windy-module system.agent begin
   route(
@@ -162,6 +170,22 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     "system.agent-workflow.read",
     "system.agent-workflow",
   ),
+  route(
+    "system.agent-skill",
+    "/admin/system/agent-skills",
+    "Agent 技能",
+    "sidebar",
+    "system.agent-skill.read",
+    "system.agent-skill",
+  ),
+  route(
+    "system.agent-workbench",
+    "/admin/system/agent-workbench",
+    "Agent 原生工作台",
+    "sidebar",
+    "system.agent-workbench.use",
+    "system.agent-workbench",
+  ),
   // @windy-module system.agent end
   // @windy-module system.operations begin
   route(

package/template/packages/modules/src/system-admin-ui-catalog.ts

@@ -25,7 +25,7 @@ const definitions = [
   ["system.license", ["system.license"]],
   // @windy-module system.license end
   // @windy-module system.audit begin
-  ["system.audit", ["system.audit"]],
+  ["system.audit", ["system.audit", "system.diagnostics"]],
   // @windy-module system.audit end
   // @windy-module system.storage begin
   ["system.storage", []],
@@ -36,6 +36,8 @@ const definitions = [
     [
       "system.agent-tools",
       "system.agent-debug",
+      "system.agent-skill",
+      "system.agent-workbench",
       "system.agent-session",
       "system.ai-runtime",
       "system.agent-workflow",
@@ -73,13 +75,18 @@ const versionByName = new Map(
 );
 
 export function systemAdminUiManifests(): AdminUiManifest[] {
-  return definitions.map(([name, routeKeys]) => ({
-    name,
-    version: versionByName.get(name) ?? "0.1.0",
-    adminRoutes: routeKeys.map((key) => {
-      const route = routeByKey.get(key);
-      if (!route) throw new Error(`系统 Admin Route 未定义：${key}`);
-      return { ...route };
-    }),
-  }));
+  return definitions.map(([name, routeKeys]) => {
+    const selected = new Set<string>(routeKeys);
+    for (const key of selected) {
+      if (!routeByKey.has(key))
+        throw new Error(`系统 Admin Route 未定义：${key}`);
+    }
+    return {
+      name,
+      version: versionByName.get(name) ?? "0.1.0",
+      adminRoutes: systemAdminRoutes
+        .filter(({ key }) => selected.has(key))
+        .map((route) => ({ ...route })),
+    };
+  });
 }

package/template/packages/modules/src/system-agent-admin-bindings.ts

@@ -1,8 +1,10 @@
 import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { dshApiBindings } from "./system-agent-dsh.js";
 import { binding } from "./system-api-binding.js";
 
 export function systemAgentAdminBindings(): ApiPermissionBinding[] {
   return [
+    ...dshApiBindings(),
     binding(
       "GET",
       "/api/agent/admin/tools",

package/template/packages/modules/src/system-agent-admin-menus.ts

@@ -23,4 +23,24 @@ export const systemAgentAdminMenus: ModuleManifest["menus"] = [
     permissionKey: "system.agent-debug.read",
     featureKey: "system.agent-debug",
   },
+  ...[
+    [
+      "system.agent-workbench",
+      "Agent 原生工作台",
+      "agent-workbench",
+      "use",
+      "messages-square",
+    ],
+    ["system.agent-skill", "Agent 技能", "agent-skills", "read", "library"],
+  ].map(([key, title, path, action, icon], order) => ({
+    key: key!,
+    title: title!,
+    path: `/admin/system/${path}`,
+    type: "menu" as const,
+    visible: true,
+    order: order + 14,
+    icon,
+    permissionKey: `${key}.${action}`,
+    featureKey: key,
+  })),
 ];

package/template/packages/modules/src/system-agent-audit-actions.ts

@@ -1,4 +1,7 @@
+import { dshAuditActionKeys } from "./system-agent-dsh.js";
+
 export const agentAuditActionKeys: ReadonlySet<string> = new Set([
+  ...dshAuditActionKeys,
   "system.agent-tools.read",
   "system.agent-debug.read",
   "agent.debug.recording.read",

package/template/packages/modules/src/system-agent-dsh.ts

@@ -0,0 +1,119 @@
+import { featureKey } from "@southwind-ai/shared";
+import type { ModuleManifest } from "./manifest.js";
+import { binding } from "./system-api-binding.js";
+
+export const dshFeatures: ModuleManifest["features"] = [
+  [
+    "system.agent-workbench",
+    "Agent 原生工作台",
+    "同源 DSH 会话、工作区与个人扩展。",
+  ],
+  [
+    "system.agent-skill",
+    "Agent 技能治理",
+    "DSH 技能版本、共享范围、发布、停用与回滚。",
+  ],
+].map(([key, label, description]) => ({
+  key: featureKey(key!),
+  label: label!,
+  description,
+  module: "system",
+  visible: "visible",
+  enabled: true,
+  stage: "stable",
+  dependencies: [featureKey("system.agent")],
+}));
+
+export const dshAuditActionKeys = [
+  "agent.workbench.access",
+  "agent.skill.read",
+  "agent.skill.publish",
+  "agent.skill.disable",
+  "agent.skill.rollback",
+  "agent.skill.draft",
+  "agent.workflow.preset.read",
+] as const;
+export const dshAuditActions: ModuleManifest["auditActions"] =
+  dshAuditActionKeys.map((key, index) => ({
+    key,
+    label: [
+      "访问原生工作台",
+      "读取Agent技能",
+      "发布Agent技能",
+      "停用Agent技能",
+      "回滚Agent技能",
+      "生成技能草稿",
+      "读取Workflow预设",
+    ][index]!,
+    description: "按当前授权记录Agent治理操作的最小审计摘要。",
+  }));
+
+export function dshApiBindings() {
+  const workbench = (method: "GET" | "POST", path: string) =>
+    binding(
+      method,
+      path,
+      "system.agent-workbench.use",
+      "system.agent-workbench",
+      "agent.workbench.access",
+      false,
+    );
+  return [
+    ...[
+      "/api/agent/workbench",
+      "/api/agent/workbench/admission",
+      "/api/agent/workbench/skills",
+      "/api/agent/native",
+      "/api/agent/native/*",
+    ].map((path) => workbench("GET", path)),
+    ...[
+      "/api/agent/workbench/launch",
+      "/api/agent/native",
+      "/api/agent/native/*",
+    ].map((path) => workbench("POST", path)),
+    binding(
+      "GET",
+      "/api/agent/native/api/remote.mux",
+      "system.agent-workbench.use",
+      "system.agent-workbench",
+      "agent.workbench.access",
+      false,
+    ),
+    ...[
+      "/api/agent/skills",
+      "/api/agent/skills/:key/versions",
+      "/api/agent/skills/:key",
+    ].map((path) =>
+      binding(
+        "GET",
+        path,
+        "system.agent-skill.read",
+        "system.agent-skill",
+        "agent.skill.read",
+      ),
+    ),
+    binding(
+      "POST",
+      "/api/agent/skills",
+      "system.agent-skill.manage",
+      "system.agent-skill",
+      "agent.skill.publish",
+    ),
+    ...["disable", "rollback"].map((action) =>
+      binding(
+        "POST",
+        `/api/agent/skills/:key/${action}`,
+        "system.agent-skill.manage",
+        "system.agent-skill",
+        `agent.skill.${action}`,
+      ),
+    ),
+    binding(
+      "GET",
+      "/api/agent/workflows/presets",
+      "system.agent-workflow.read",
+      "system.agent-workflow",
+      "agent.workflow.preset.read",
+    ),
+  ];
+}

package/template/packages/modules/src/system-api-permissions.ts

@@ -14,6 +14,15 @@ import { systemControlPlaneApiPermissionBindings } from "./system-api-control-pl
 
 export function systemApiPermissionBindings(): ApiPermissionBinding[] {
   return [
+    // @windy-module system.audit begin
+    binding(
+      "GET",
+      "/api/system/diagnostics/:diagnosticId",
+      "system.diagnostics.read",
+      "system.diagnostics",
+      "diagnostic.read",
+    ),
+    // @windy-module system.audit end
     ...systemControlPlaneApiPermissionBindings(),
     binding(
       "GET",

package/template/packages/modules/src/system-audit-actions.ts

@@ -1,4 +1,7 @@
 import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { dshAuditActions } from "./system-agent-dsh.js";
+// @windy-module system.agent end
 
 export const systemAuditActions: ModuleManifest["auditActions"] = [
   "auth.login",
@@ -252,4 +255,12 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   // @windy-module system.agent end
   "security.denied",
   "system.error",
+  {
+    key: "diagnostic.read",
+    label: "查询错误诊断",
+    description: "按当前管理员权限读取脱敏失败索引。",
+  },
+  // @windy-module system.agent begin
+  ...dshAuditActions,
+  // @windy-module system.agent end
 ];

package/template/packages/modules/src/system-features.ts

@@ -1,5 +1,8 @@
 import * as shared from "@southwind-ai/shared";
 import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { dshFeatures } from "./system-agent-dsh.js";
+// @windy-module system.agent end
 
 // @windy-module system.scheduler begin
 const standardAndAdvanced = ["standard", "advanced"].map(
@@ -90,6 +93,7 @@ export const systemFeatures: ModuleManifest["features"] = [
     "审计日志",
     "记录关键配置、权限拒绝与业务操作，支持安全追溯。",
   ),
+  feature("system.diagnostics", "错误诊断", "按诊断编号查询脱敏失败索引。"),
   // @windy-module system.audit end
   // @windy-module system.storage begin
   feature(
@@ -148,6 +152,7 @@ export const systemFeatures: ModuleManifest["features"] = [
       shared.featureKey("system.agent-session"),
     ],
   },
+  ...dshFeatures,
   // @windy-module system.agent end
   // @windy-module system.operations begin
   feature(

package/template/packages/modules/src/system-module-audit-selection.ts

@@ -0,0 +1,25 @@
+import type { ModuleManifest } from "./manifest.js";
+import { auditActionKey } from "./system-module-ownership.js";
+// @windy-module system.agent begin
+import { agentAuditActionKeys } from "./system-agent-audit-actions.js";
+// @windy-module system.agent end
+const agentActions = new Set<string>();
+// @windy-module system.agent begin
+for (const key of agentAuditActionKeys) agentActions.add(key);
+// @windy-module system.agent end
+export function selectSystemAuditActions(
+  name: string,
+  actions: ModuleManifest["auditActions"],
+) {
+  return actions.filter((action) => {
+    const key = auditActionKey(action);
+    if (name === "system.identity")
+      return key === "system.user-directory.query";
+    if (name === "system.agent") return agentActions.has(key);
+    return (
+      name === "system" &&
+      key !== "system.user-directory.query" &&
+      !agentActions.has(key)
+    );
+  });
+}

package/template/packages/modules/src/system-module-catalog.ts

@@ -1,21 +1,9 @@
 import type { ModuleFactory, ModuleManifest } from "./manifest.js";
-import {
-  auditActionKey,
-  permissionResource,
-} from "./system-module-ownership.js";
+import { permissionResource } from "./system-module-ownership.js";
 import { selectSystemMenus } from "./system-module-menu-selection.js";
 import { systemFoundationModule } from "./system-modules.js";
 import { selectSystemJsonSchemas } from "./system-module-schema-catalog.js";
-// @windy-module system.agent begin
-import { agentAuditActionKeys } from "./system-agent-audit-actions.js";
-// @windy-module system.agent end
-
-const catalogAgentModuleNames = new Set<string>();
-const catalogAgentAuditActionKeys = new Set<string>();
-// @windy-module system.agent begin
-catalogAgentModuleNames.add("system.agent");
-for (const key of agentAuditActionKeys) catalogAgentAuditActionKeys.add(key);
-// @windy-module system.agent end
+import { selectSystemAuditActions } from "./system-module-audit-selection.js";
 
 export interface SystemModuleDefinition {
   name: string;
@@ -113,8 +101,8 @@ export const systemModuleDefinitions = [
     label: "审计日志",
     description: "关键操作、权限拒绝和系统异常的安全追溯。",
     dependencies: ["system"],
-    resources: ["audit"],
-    featureKeys: ["system.audit"],
+    resources: ["audit", "diagnostics"],
+    featureKeys: ["system.audit", "system.diagnostics"],
   },
   // @windy-module system.audit end
   // @windy-module system.storage begin
@@ -146,6 +134,8 @@ export const systemModuleDefinitions = [
       "agent",
       "agent-tools",
       "agent-debug",
+      "agent-workbench",
+      "agent-skill",
       "agent-session",
       "agent-workflow",
       "ai-runtime",
@@ -154,6 +144,8 @@ export const systemModuleDefinitions = [
       "system.agent",
       "system.agent-tools",
       "system.agent-debug",
+      "system.agent-workbench",
+      "system.agent-skill",
       "system.agent-session",
       "system.agent-workflow",
       "system.ai-runtime",
@@ -323,22 +315,10 @@ function createSystemCapabilityModule(
       definition.name === "system.data-governance"
         ? aggregate.dataPolicies
         : [],
-    auditActions: isCore
-      ? aggregate.auditActions.filter(
-          (action) =>
-            auditActionKey(action) !== "system.user-directory.query" &&
-            !catalogAgentAuditActionKeys.has(auditActionKey(action)),
-        )
-      : definition.name === "system.identity"
-        ? aggregate.auditActions.filter(
-            (action) =>
-              auditActionKey(action) === "system.user-directory.query",
-          )
-        : catalogAgentModuleNames.has(definition.name)
-          ? aggregate.auditActions.filter((action) =>
-              catalogAgentAuditActionKeys.has(auditActionKey(action)),
-            )
-          : [],
+    auditActions: selectSystemAuditActions(
+      definition.name,
+      aggregate.auditActions,
+    ),
     metadata: {
       kind: "platform-capability",
       ...(definition.runtimeActivation

package/template/packages/modules/src/system-modules.ts

@@ -217,6 +217,17 @@ export function systemFoundationModule(): ModuleManifest {
             permissionKey: "system.audit.read",
             featureKey: "system.audit",
           },
+          {
+            key: "system.diagnostics",
+            title: "错误诊断",
+            type: "menu",
+            order: 25,
+            visible: true,
+            path: "/admin/system/diagnostics",
+            icon: "bug",
+            permissionKey: "system.diagnostics.read",
+            featureKey: "system.diagnostics",
+          },
           // @windy-module system.audit end
         ],
       },
@@ -247,7 +258,7 @@ export function systemFoundationModule(): ModuleManifest {
             key: "system.agent-session",
             title: "Agent 会话",
             type: "menu",
-            order: 14,
+            order: 16,
             visible: true,
             path: "/admin/system/agent-sessions",
             icon: "messages-square",
@@ -258,7 +269,7 @@ export function systemFoundationModule(): ModuleManifest {
             key: "system.ai-runtime",
             title: "AI Runtime 报表",
             type: "menu",
-            order: 15,
+            order: 17,
             visible: true,
             path: "/admin/system/ai-runtime",
             icon: "activity",
@@ -269,7 +280,7 @@ export function systemFoundationModule(): ModuleManifest {
             key: "system.agent-workflow",
             title: "Agent Workflow",
             type: "menu",
-            order: 16,
+            order: 18,
             visible: true,
             path: "/admin/system/agent-workflows",
             icon: "git-fork",

package/template/packages/modules/src/system-permissions.ts

@@ -19,11 +19,14 @@ const systemResourceLabels = {
   profile: "个人设置",
   license: "许可证管理",
   audit: "审计日志",
+  diagnostics: "错误诊断",
   // @windy-module system.agent begin
   agent: "智能代理",
   "agent-session": "Agent 长期会话",
   "agent-tools": "Agent 工具目录",
   "agent-debug": "Agent 调试工作台",
+  "agent-workbench": "Agent 原生工作台",
+  "agent-skill": "Agent 技能治理",
   "agent-workflow": "Agent Workflow",
   "ai-runtime": "AI Runtime 报表",
   // @windy-module system.agent end
@@ -38,6 +41,8 @@ const systemResourceLabels = {
 type SystemResource = keyof typeof systemResourceLabels;
 type SystemAction =
   | "access"
+  | "use"
+  | "execute"
   | "read"
   | "create"
   | "approve"
@@ -128,12 +133,17 @@ export const systemPermissions: ModuleManifest["permissions"] = [
   // @windy-module system.license end
   // @windy-module system.audit begin
   permission("audit", "read"),
+  permission("diagnostics", "read"),
   // @windy-module system.audit end
   // @windy-module system.agent begin
   permission("agent", "read"),
   permission("agent-tools", "read"),
   permission("agent-debug", "read"),
   permission("agent-debug", "manage"),
+  permission("agent-workbench", "use"),
+  permission("agent-skill", "read"),
+  permission("agent-skill", "manage"),
+  permission("agent-skill", "execute"),
   permission("agent-session", "read"),
   permission("agent-session", "manage"),
   permission("agent-workflow", "read", "sensitive-disclosure"),

package/template/packages/server-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/server-sdk",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -68,7 +68,7 @@
   "dependencies": {
     "@southwind-ai/jobs": "workspace:^",
     "@southwind-ai/modules": "workspace:^",
-    "@southwind-ai/shared": "workspace:^0.3.0",
+    "@southwind-ai/shared": "workspace:^0.3.2",
     "@southwind-ai/storage": "workspace:^"
   },
   "exports": {