create-windy 0.8.3 → 0.9.1

package/template/apps/agent-server/tests/test_config.py

@@ -1,106 +0,0 @@
-from __future__ import annotations
-
-import pytest
-
-from southwind_agent_server.config import (
-    EnvironmentSecretResolver,
-    OpenAiCompatibleConfig,
-    normalize_base_url,
-)
-
-
-def test_server_config_uses_secret_ref_and_normalizes_endpoint() -> None:
-    environment = {
-        "QWEN_API_URL": "https://example.com/compatible-mode/v1/",
-        "QWEN_MODEL": "qwen-plus",
-        "QWEN_API_KEY": "server-secret",
-        "AI_PROVIDER_HTTPS_HOST_ALLOWLIST": "example.com",
-        "AI_PROVIDER_CAPABILITIES": "text-generation,vision",
-        "AI_PROVIDER_INPUT_MODALITIES": "text,image",
-    }
-    config = OpenAiCompatibleConfig.from_environment(environment)
-    assert config is not None
-    assert config.base_url == "https://example.com/compatible-mode/v1"
-    assert config.https_host_allowlist == ("example.com",)
-    assert config.capabilities == ("text-generation", "vision")
-    assert config.input_modalities == ("text", "image")
-    assert str(config.api_key_ref) == "[SecretRef]"
-    resolver = EnvironmentSecretResolver(environment)
-    assert config.api_key_ref is not None
-    assert resolver.resolve(config.api_key_ref) == "server-secret"
-
-
-@pytest.mark.parametrize(
-    "endpoint",
-    [
-        "http://public.example.com/v1",
-        "http://169.254.169.254/v1",
-        "https://user:pass@example.com/v1",
-        "https://example.com/v1?token=secret",
-    ],
-)
-def test_rejects_unsafe_endpoint(endpoint: str) -> None:
-    with pytest.raises(ValueError):
-        normalize_base_url(endpoint)
-
-
-def test_allows_private_http_endpoint() -> None:
-    assert normalize_base_url("http://qwen.internal:9000/v1/") == (
-        "http://qwen.internal:9000/v1"
-    )
-    assert normalize_base_url("http://10.20.30.40:8000/v1") == (
-        "http://10.20.30.40:8000/v1"
-    )
-
-
-def test_https_endpoint_must_match_exact_host_allowlist() -> None:
-    with pytest.raises(ValueError) as captured:
-        OpenAiCompatibleConfig.from_environment(
-            {
-                "QWEN_API_URL": "https://api.example.com/v1",
-                "QWEN_MODEL": "qwen-plus",
-                "AI_PROVIDER_HTTPS_HOST_ALLOWLIST": "example.com",
-            }
-        )
-    assert "api.example.com" not in str(captured.value)
-
-    config = OpenAiCompatibleConfig.from_environment(
-        {
-            "QWEN_API_URL": "https://api.example.com/v1",
-            "QWEN_MODEL": "qwen-plus",
-            "AI_PROVIDER_HTTPS_HOST_ALLOWLIST": "api.example.com",
-        }
-    )
-    assert config is not None
-    assert config.https_host_allowlist == ("api.example.com",)
-
-
-@pytest.mark.parametrize(
-    "allowlist",
-    [
-        "*.example.com",
-        "https://example.com",
-        "example.com:443",
-        "example.com,example.com",
-    ],
-)
-def test_rejects_unsafe_or_duplicate_https_host_allowlist(
-    allowlist: str,
-) -> None:
-    with pytest.raises(ValueError):
-        OpenAiCompatibleConfig.from_environment(
-            {
-                "QWEN_API_URL": "https://example.com/v1",
-                "QWEN_MODEL": "qwen-plus",
-                "AI_PROVIDER_HTTPS_HOST_ALLOWLIST": allowlist,
-            }
-        )
-
-
-def test_partial_deployment_fails_fast_without_leaking_value() -> None:
-    marker = "DO-NOT-LEAK"
-    with pytest.raises(ValueError) as captured:
-        OpenAiCompatibleConfig.from_environment(
-            {"QWEN_API_URL": marker, "QWEN_MODEL": ""}
-        )
-    assert marker not in str(captured.value)

package/template/apps/agent-server/tests/test_fingerprint.py

@@ -1,10 +0,0 @@
-from southwind_agent_server.contracts import StartRunRequest
-from southwind_agent_server.fingerprint import request_fingerprint, resolved_release
-
-
-def test_legacy_release_is_scoped_to_operation() -> None:
-    first = StartRunRequest(operation_key="business.first", input=None)
-    second = StartRunRequest(operation_key="business.second", input=None)
-
-    assert resolved_release(first)["releaseId"] != resolved_release(second)["releaseId"]
-    assert request_fingerprint(first) != request_fingerprint(second)

package/template/apps/agent-server/tests/test_multimodal.py

@@ -1,81 +0,0 @@
-from __future__ import annotations
-
-import pytest
-
-from southwind_agent_server.contracts import JsonValue
-from southwind_agent_server.engine import PreparedArtifact, SafeEngineError
-from southwind_agent_server.multimodal import (
-    attach_artifacts,
-    final_output,
-    response_format,
-)
-
-
-def test_typed_image_part_and_json_schema_output() -> None:
-    artifact = PreparedArtifact(
-        media_type="image/png",
-        data_url="data:image/png;base64,AAAA",
-        byte_size=3,
-        sha256="a" * 64,
-    )
-    messages = attach_artifacts(
-        [{"role": "user", "content": "提取可见字段"}],
-        (artifact,),
-    )
-    assert messages[0]["content"] == [
-        {"type": "text", "text": "提取可见字段"},
-        {
-            "type": "image_url",
-            "image_url": {
-                "url": "data:image/png;base64,AAAA",
-                "detail": "auto",
-            },
-        },
-    ]
-    schema: dict[str, JsonValue] = {
-        "type": "object",
-        "required": ["name"],
-        "properties": {"name": {"type": "string"}},
-    }
-    assert response_format("evidence.output.v1", schema) == {
-        "type": "json_schema",
-        "json_schema": {
-            "name": "evidence_output_v1",
-            "strict": True,
-            "schema": schema,
-        },
-    }
-    assert final_output('{"name":"票据"}', schema) == {"name": "票据"}
-    with pytest.raises(SafeEngineError) as invalid:
-        final_output('{"name":42}', schema)
-    assert invalid.value.code == "OUTPUT_VALIDATION_FAILED"
-
-
-def test_supervisor_final_answer_schema_rejects_intermediate_text() -> None:
-    schema: dict[str, JsonValue] = {
-        "type": "object",
-        "properties": {
-            "finalAnswer": {
-                "type": "object",
-                "properties": {
-                    "schemaVersion": {"const": 1},
-                    "text": {"type": "string", "minLength": 1},
-                },
-                "required": ["schemaVersion", "text"],
-                "additionalProperties": False,
-            },
-            "nodes": {"type": "array"},
-        },
-        "required": ["finalAnswer"],
-        "additionalProperties": False,
-    }
-    assert final_output(
-        '{"finalAnswer":{"schemaVersion":1,"text":"最终回答"},"nodes":[]}',
-        schema,
-    ) == {
-        "finalAnswer": {"schemaVersion": 1, "text": "最终回答"},
-        "nodes": [],
-    }
-    with pytest.raises(SafeEngineError) as invalid:
-        final_output('{"nodes":[{"text":"中间节点","total":2}]}', schema)
-    assert invalid.value.code == "OUTPUT_VALIDATION_FAILED"

package/template/apps/agent-server/tests/test_openai_provider.py

@@ -1,320 +0,0 @@
-from __future__ import annotations
-
-import json
-import sqlite3
-import tempfile
-
-import httpx
-import pytest
-
-from southwind_agent_server.contracts import ProviderEgress
-from southwind_agent_server.engine import (
-    EngineRunRequest,
-    SafeEngineError,
-    ToolCompleted,
-    ToolRequested,
-)
-from southwind_agent_server.openai_engine import OpenAiCompatibleEngineAdapter
-from southwind_agent_server.tool_host import ToolHostClient, canonical_tool_call_id
-from tests.openai_provider_test_support import (
-    create_provider,
-    governance,
-    runtime_request,
-    sse_response,
-)
-
-
-async def test_provider_stream_and_vision_probe_use_bounded_safe_protocol() -> None:
-    async def handler(request: httpx.Request) -> httpx.Response:
-        assert request.url.path.endswith("/chat/completions")
-        body = json.loads(request.content)
-        if body["messages"][0]["content"] != "你好":
-            assert body["messages"][0]["content"][1]["type"] == "image_url"
-            return sse_response(
-                [
-                    {
-                        "model": "qwen-compatible",
-                        "choices": [{"delta": {"content": '{"color":"red"}'}}],
-                    }
-                ]
-            )
-        return sse_response(
-            [
-                {"choices": [{"delta": {"content": "你"}}]},
-                {
-                    "choices": [{"delta": {"content": "好"}}],
-                    "usage": {
-                        "prompt_tokens": 2,
-                        "completion_tokens": 2,
-                        "total_tokens": 4,
-                    },
-                },
-            ]
-        )
-
-    provider = create_provider(httpx.MockTransport(handler))
-    provider.config = provider.config.__class__(
-        **{
-            **provider.config.__dict__,
-            "capabilities": ("text-generation", "vision"),
-            "input_modalities": ("text", "image"),
-        }
-    )
-    await provider.probe_vision()
-    turn = await provider.complete_turn(
-        [{"role": "user", "content": "你好"}],
-        (),
-    )
-    assert turn.text_deltas == ["你", "好"]
-    assert turn.usage.source == "provider-reported"
-    assert turn.usage.input_tokens == 2
-    assert turn.usage.output_tokens == 2
-    assert turn.usage.total_tokens == 4
-    assert turn.usage.cached_input_tokens is None
-    assert turn.usage.cache_status == "unknown"
-    assert turn.usage.first_token_latency_ms is not None
-
-
-async def test_provider_reports_cache_reasoning_model_without_fabricating() -> None:
-    async def handler(_request: httpx.Request) -> httpx.Response:
-        return sse_response(
-            [
-                {
-                    "model": "provider-model-v2",
-                    "choices": [{"delta": {"content": "完成"}}],
-                    "usage": {
-                        "prompt_tokens": 10,
-                        "completion_tokens": 4,
-                        "total_tokens": 14,
-                        "prompt_tokens_details": {"cached_tokens": 6},
-                        "completion_tokens_details": {"reasoning_tokens": 3},
-                    },
-                }
-            ]
-        )
-
-    turn = await create_provider(httpx.MockTransport(handler)).complete_turn(
-        [{"role": "user", "content": "hi"}], ()
-    )
-
-    assert turn.reported_model == "provider-model-v2"
-    assert turn.usage.cached_input_tokens == 6
-    assert turn.usage.reasoning_tokens == 3
-    assert turn.usage.cache_status == "hit"
-
-
-async def test_provider_rejects_impossible_cached_token_fact() -> None:
-    async def handler(_request: httpx.Request) -> httpx.Response:
-        return sse_response(
-            [
-                {
-                    "choices": [{"delta": {"content": "完成"}}],
-                    "usage": {
-                        "prompt_tokens": 2,
-                        "prompt_tokens_details": {"cached_tokens": 3},
-                    },
-                }
-            ]
-        )
-
-    turn = await create_provider(httpx.MockTransport(handler)).complete_turn(
-        [{"role": "user", "content": "hi"}], ()
-    )
-
-    assert turn.usage.input_tokens == 2
-    assert turn.usage.cached_input_tokens is None
-    assert turn.usage.cache_status == "unknown"
-
-
-async def test_provider_error_never_leaks_body_or_secret() -> None:
-    marker = "upstream-secret-body"
-
-    async def handler(_request: httpx.Request) -> httpx.Response:
-        return httpx.Response(500, text=marker)
-
-    provider = create_provider(httpx.MockTransport(handler))
-    with pytest.raises(SafeEngineError) as captured:
-        await provider.complete_turn([], ())
-    assert captured.value.code == "PROVIDER_UNAVAILABLE"
-    assert marker not in str(captured.value)
-    assert "server-secret" not in str(captured.value)
-
-
-async def test_engine_executes_only_allowed_tool_through_host() -> None:
-    provider_calls = 0
-    provider_body_bytes: list[int] = []
-    tool_requests: list[dict[str, object]] = []
-
-    async def provider_handler(request: httpx.Request) -> httpx.Response:
-        nonlocal provider_calls
-        provider_calls += 1
-        provider_body_bytes.append(len(request.content))
-        if provider_calls == 1:
-            return sse_response(
-                [
-                    {
-                        "choices": [
-                            {
-                                "delta": {
-                                    "tool_calls": [
-                                        {
-                                            "index": 0,
-                                            "id": "call_1",
-                                            "function": {
-                                                "name": "business.records.list",
-                                                "arguments": '{"page":2}',
-                                            },
-                                        }
-                                    ]
-                                }
-                            }
-                        ]
-                    }
-                ]
-            )
-        return sse_response([{"choices": [{"delta": {"content": "共有一条记录"}}]}])
-
-    async def tool_handler(request: httpx.Request) -> httpx.Response:
-        assert request.headers["authorization"] == "Bearer internal-token"
-        tool_requests.append(json.loads(request.content))
-        return httpx.Response(200, json={"value": {"total": 1}})
-
-    audit_path = tempfile.NamedTemporaryFile(suffix=".sqlite3", delete=False).name
-    engine = OpenAiCompatibleEngineAdapter(
-        create_provider(httpx.MockTransport(provider_handler)),
-        ToolHostClient(
-            "internal-token",
-            transport=httpx.MockTransport(tool_handler),
-        ),
-        governance(audit_path),
-    )
-    signals = [
-        signal
-        async for signal in engine.execute(runtime_request("business.records.list"))
-    ]
-    assert any(isinstance(signal, ToolRequested) for signal in signals)
-    assert any(isinstance(signal, ToolCompleted) for signal in signals)
-    assert tool_requests[0] == {
-        "executionGrant": "grant_1",
-        "runId": "run_1",
-        "toolCallId": canonical_tool_call_id(
-            "run_1",
-            "business.records.list",
-            {"page": 2},
-        ),
-        "toolKey": "business.records.list",
-        "arguments": {"page": 2},
-    }
-    assert signals[-1].output == {"text": "共有一条记录"}  # type: ignore[union-attr]
-    audits = (
-        sqlite3.connect(audit_path)
-        .execute(
-            """
-        select attempt, sent_bytes, decision
-        from provider_attempt_audit order by attempt
-        """
-        )
-        .fetchall()
-    )
-    assert audits == [
-        (1, provider_body_bytes[0], "allow"),
-        (2, provider_body_bytes[1], "allow"),
-    ]
-
-
-async def test_engine_denies_unknown_model_tool_before_host_callback() -> None:
-    tool_called = False
-
-    async def provider_handler(_request: httpx.Request) -> httpx.Response:
-        return sse_response(
-            [
-                {
-                    "choices": [
-                        {
-                            "delta": {
-                                "tool_calls": [
-                                    {
-                                        "index": 0,
-                                        "id": "call_bad",
-                                        "function": {
-                                            "name": "business.admin.delete",
-                                            "arguments": "{}",
-                                        },
-                                    }
-                                ]
-                            }
-                        }
-                    ]
-                }
-            ]
-        )
-
-    async def tool_handler(_request: httpx.Request) -> httpx.Response:
-        nonlocal tool_called
-        tool_called = True
-        return httpx.Response(200, json={"value": None})
-
-    engine = OpenAiCompatibleEngineAdapter(
-        create_provider(httpx.MockTransport(provider_handler)),
-        ToolHostClient(
-            "internal-token",
-            transport=httpx.MockTransport(tool_handler),
-        ),
-        governance(),
-    )
-    with pytest.raises(SafeEngineError) as captured:
-        async for _signal in engine.execute(runtime_request("business.records.list")):
-            pass
-    assert captured.value.code == "TOOL_DENIED"
-    assert tool_called is False
-
-
-async def test_engine_denies_provider_before_network_without_explicit_egress() -> None:
-    provider_called = False
-
-    async def provider_handler(_request: httpx.Request) -> httpx.Response:
-        nonlocal provider_called
-        provider_called = True
-        return sse_response([])
-
-    engine = OpenAiCompatibleEngineAdapter(
-        create_provider(httpx.MockTransport(provider_handler)),
-        ToolHostClient("internal-token"),
-        governance(),
-    )
-    request = runtime_request("business.records.list")
-    request = EngineRunRequest(
-        **{
-            **request.__dict__,
-            "provider_egress": ProviderEgress(mode="forbidden"),
-        }
-    )
-
-    with pytest.raises(SafeEngineError) as captured:
-        async for _signal in engine.execute(request):
-            pass
-    assert captured.value.code == "FORBIDDEN"
-    assert provider_called is False
-
-
-async def test_engine_denies_mismatched_provider_deployment() -> None:
-    engine = OpenAiCompatibleEngineAdapter(
-        create_provider(httpx.MockTransport(lambda _request: sse_response([]))),
-        ToolHostClient("internal-token"),
-        governance(),
-    )
-    request = runtime_request("business.records.list")
-    request = EngineRunRequest(
-        **{
-            **request.__dict__,
-            "provider_egress": ProviderEgress(
-                mode="configured-endpoint",
-                deployment_key="ai.other-deployment",
-            ),
-        }
-    )
-
-    with pytest.raises(SafeEngineError) as captured:
-        async for _signal in engine.execute(request):
-            pass
-    assert captured.value.code == "FORBIDDEN"

package/template/apps/agent-server/tests/test_postgres_report_status.py

@@ -1,59 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, cast
-
-from southwind_agent_server.postgres_report_status import (
-    start_or_resume_run,
-)
-
-
-async def test_start_or_resume_abandons_only_unfinished_running_attempts() -> None:
-    connection = FakeConnection()
-
-    abandoned = await start_or_resume_run(
-        cast(Any, connection),
-        "run_1",
-        200.0,
-    )
-
-    assert abandoned == 2
-    assert len(connection.queries) == 2
-    query, parameters = connection.queries[1]
-    assert "set outcome = 'abandoned'" in query
-    assert "outcome = 'running'" in query
-    assert "finished_at is null" in query
-    assert parameters == (200.0, 200.0, "run_1")
-
-
-class FakeConnection:
-    def __init__(self) -> None:
-        self.queries: list[tuple[str, tuple[object, ...]]] = []
-
-    def transaction(self) -> FakeTransaction:
-        return FakeTransaction()
-
-    async def execute(
-        self,
-        query: str,
-        parameters: tuple[object, ...],
-    ) -> FakeCursor:
-        self.queries.append((query, parameters))
-        return FakeCursor(2 if "set outcome = 'abandoned'" in query else 1)
-
-
-class FakeTransaction:
-    async def __aenter__(self) -> None:
-        return None
-
-    async def __aexit__(
-        self,
-        exception_type: object,
-        exception: object,
-        traceback: object,
-    ) -> None:
-        return None
-
-
-class FakeCursor:
-    def __init__(self, rowcount: int) -> None:
-        self.rowcount = rowcount