create-windy 0.9.1 → 0.10.0

package/template/apps/server/src/system/operations.ts

@@ -1,3 +1,9 @@
+import { createEnvironmentPolicyReader } from "./environment-policy-reader.js";
+import { assessFeatureEnvironment } from "./feature-environment-assessment.js";
+import {
+  createEnvironmentProbe,
+  type EnvironmentProbe,
+} from "./host-diagnostics.js";
 import type { FeatureFlagDefinition, HttpMethod } from "@southwind-ai/shared";
 import type { ActiveAuthSession } from "../auth/repository.js";
 import type { RequestGuardContext } from "../guards.js";
@@ -32,6 +38,7 @@ interface OperationRouteContext {
 }
 
 export interface OperationRouteOptions {
+  environmentProbe?: EnvironmentProbe;
   redisHealthProbe?: RedisHealthProbe;
   databaseMonitorProbe?: DatabaseMonitorProbe;
   hostDiskUsageProbe?: HostDiskUsageProbe;
@@ -79,6 +86,8 @@ export function registerSystemOperationRoutes(
     );
   const cpuMonitorProbe = options.cpuMonitorProbe ?? createCpuMonitorProbe();
   const gpuMonitorProbe = options.gpuMonitorProbe ?? createGpuMonitorProbe();
+  const readEnvironmentPolicy = createEnvironmentPolicyReader();
+  const environmentProbe = options.environmentProbe ?? createEnvironmentProbe();
   const onlineUserProvider = options.onlineUserProvider ?? (async () => []);
   app.get("/system/operations", async (rawContext) => {
     const { guardContext } = rawContext as OperationRouteContext;
@@ -90,18 +99,29 @@ export function registerSystemOperationRoutes(
       },
       feature: findSystemFeature(features, "ops"),
     });
-    return decision.allowed
-      ? await createOperationSnapshot(
-          redisHealthProbe,
-          databaseMonitorProbe,
-          hostDiskUsageProbe,
-          systemUsageProbe,
-          importDataUsageProbe,
-          cpuMonitorProbe,
-          gpuMonitorProbe,
-          onlineUserProvider,
-        )
-      : forbidden(decision.reason);
+    if (!decision.allowed) return forbidden(decision.reason);
+    const snapshot = await createOperationSnapshot(
+      redisHealthProbe,
+      databaseMonitorProbe,
+      hostDiskUsageProbe,
+      systemUsageProbe,
+      importDataUsageProbe,
+      cpuMonitorProbe,
+      gpuMonitorProbe,
+      onlineUserProvider,
+      environmentProbe,
+    );
+    const featureAssessment = await assessFeatureEnvironment(
+      await readEnvironmentPolicy(),
+      {
+        environment: snapshot.environment,
+        definitions: runtime.featureDefinitions,
+        resolveEnabled: async (feature) =>
+          (await runtime.resolveFeature(guardContext, feature)).enabled,
+        environmentValues: process.env,
+      },
+    );
+    return { ...snapshot, featureAssessment };
   });
 
   return app;
@@ -123,6 +143,7 @@ async function createOperationSnapshot(
   cpuMonitorProbe: CpuMonitorProbe,
   gpuMonitorProbe: GpuMonitorProbe,
   onlineUserProvider: () => Promise<ActiveAuthSession[]>,
+  environmentProbe: EnvironmentProbe,
 ) {
   const [
     cacheMonitor,
@@ -133,6 +154,7 @@ async function createOperationSnapshot(
     cpuMonitor,
     gpuMonitor,
     activeSessions,
+    environment,
   ] = await Promise.all([
     redisHealthProbe(),
     databaseMonitorProbe(),
@@ -142,9 +164,11 @@ async function createOperationSnapshot(
     cpuMonitorProbe(),
     gpuMonitorProbe(),
     onlineUserProvider(),
+    environmentProbe(),
   ]);
   return {
     generatedAt: new Date().toISOString(),
+    environment,
     onlineUsers: activeSessions.map((session) => ({
       sessionId: session.sessionId,
       userId: session.userId,

package/template/apps/server/src/system/role-authorization-postgres.integration.test.ts

@@ -0,0 +1,181 @@
+// @windy-module system.agent begin
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
+import { resolve } from "node:path";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { agentSourceInvalidations } from "@southwind-ai/database";
+import { createFoundationSnapshot } from "../foundation.js";
+import type { RequestActor } from "../guards.js";
+import { createSystemRepositories } from "./seed.js";
+import { UserAccountPolicy } from "./user-account-policy.js";
+import { invalidateActorAuthorization } from "../agent/session-invalidation/authorization-revocation.js";
+import { ModuleAuthoritativeSourceAccessRegistry } from "../agent/context-memory/authoritative-source-registry.js";
+import { DrizzleSessionInvalidationOutbox } from "../agent/session-persistence/drizzle-invalidation-outbox.js";
+
+const databaseUrl = process.env.ORGANIZATION_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+const originalPermissions = ["home.read", "case.read"];
+const nextPermissions = [
+  ...originalPermissions,
+  "intelligence.read",
+  "analysis.overview.read",
+];
+const actor: RequestActor = {
+  id: "role-test-admin",
+  type: "user",
+  name: "测试管理员",
+  roleCodes: ["super-admin"],
+  permissionKeys: ["system.role.manage"],
+};
+
+describePostgres("角色更新与 Agent 失效事件原子提交", () => {
+  let pool: Pool;
+  let repositories: ReturnType<typeof createSystemRepositories>;
+  let policy: UserAccountPolicy;
+  let failAfterPublish = false;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    await migrate(drizzle(pool), {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__organization_test_migrations",
+    });
+  });
+  beforeEach(async () => {
+    await pool.query(
+      "truncate table users, roles, departments, agent_source_invalidations cascade",
+    );
+    const db = drizzle(pool);
+    repositories = createSystemRepositories(createFoundationSnapshot(), { db });
+    await repositories.departments.all();
+    await repositories.roles.create(
+      {
+        id: "test-role",
+        code: "demo.leader",
+        name: "测试领导",
+        dataScope: "department-and-children",
+        departmentIds: [],
+        permissionKeys: originalPermissions,
+      },
+      actor,
+    );
+    await repositories.users.create(
+      {
+        id: "test-officer",
+        username: "test-officer",
+        displayName: "测试用户",
+        departmentId: "dept_platform",
+        roleIds: ["test-role"],
+      },
+      actor,
+    );
+    const sources = new ModuleAuthoritativeSourceAccessRegistry([
+      {
+        moduleKey: "system.agent",
+        access: {
+          authorizeCurrent: async () => ({
+            outcome: "denied",
+            reason: "authorization-revoked",
+          }),
+        },
+      },
+    ]);
+    const outbox = new DrizzleSessionInvalidationOutbox(db);
+    failAfterPublish = false;
+    policy = new UserAccountPolicy(
+      repositories.users,
+      repositories.roles,
+      undefined,
+      {
+        async publish(event) {
+          const database =
+            repositories.organizationTransaction?.currentDatabase();
+          if (!database) throw new Error("missing organization transaction");
+          // 固定复现日志中的毫秒值；第二次更新也使用该时间，验证 latest + 1。
+          await invalidateActorAuthorization(
+            { ...event, occurredAt: "2026-11-06T15:34:43.424Z", database },
+            sources,
+            outbox,
+          );
+          if (failAfterPublish) throw new Error("forced transaction failure");
+        },
+      },
+    );
+  });
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  async function updatePermissions(permissionKeys: string[]) {
+    return repositories.organizationMutationRunner.run(async () => {
+      const current = await repositories.roles.get("test-role");
+      if (!current) throw new Error("missing role");
+      const updated = await repositories.roles.update(
+        current.id,
+        { permissionKeys },
+        actor,
+      );
+      if (!updated) throw new Error("missing updated role");
+      await policy.afterRoleUpdate(current, updated);
+      return updated;
+    });
+  }
+
+  test("现实时钟下增加、撤回权限均保存，并按 number 精确读取单调序号", async () => {
+    await updatePermissions(nextPermissions);
+    expect((await repositories.roles.get("test-role"))?.permissionKeys).toEqual(
+      nextPermissions,
+    );
+    await updatePermissions(originalPermissions);
+    const rows = await drizzle(pool)
+      .select()
+      .from(agentSourceInvalidations)
+      .orderBy(agentSourceInvalidations.sequence);
+    expect(rows.map(({ sequence }) => sequence)).toEqual([
+      1793979283424, 1793979283425,
+    ]);
+    expect(rows.every(({ cause }) => cause === "authorization-revoked")).toBe(
+      true,
+    );
+    const deliveries = await pool.query(
+      "select count(*)::int as count from agent_source_invalidation_deliveries",
+    );
+    expect(deliveries.rows[0].count).toBeGreaterThan(0);
+    expect((await repositories.roles.get("test-role"))?.permissionKeys).toEqual(
+      originalPermissions,
+    );
+  });
+
+  test("事件追加后发生错误仍同时回滚角色和 outbox", async () => {
+    failAfterPublish = true;
+    await expect(updatePermissions(nextPermissions)).rejects.toThrow(
+      "forced transaction failure",
+    );
+    expect((await repositories.roles.get("test-role"))?.permissionKeys).toEqual(
+      originalPermissions,
+    );
+    expect(await drizzle(pool).select().from(agentSourceInvalidations)).toEqual(
+      [],
+    );
+    expect(
+      (
+        await pool.query(
+          "select count(*)::int as count from agent_source_invalidation_deliveries",
+        )
+      ).rows[0].count,
+    ).toBe(0);
+  });
+});
+// @windy-module system.agent end

package/template/apps/web/Dockerfile

@@ -1,8 +1,11 @@
 # syntax=docker/dockerfile:1
 
-FROM node:24.7.0-alpine AS node
+ARG WINDY_NODE_IMAGE=node:24.7.0-alpine
+ARG WINDY_WEB_BUN_IMAGE=oven/bun:1.3.14-alpine
 
-FROM oven/bun:1.3.14-alpine AS deps
+FROM ${WINDY_NODE_IMAGE} AS node
+
+FROM ${WINDY_WEB_BUN_IMAGE} AS deps
 COPY --from=node /usr/local/bin/node /usr/local/bin/node
 WORKDIR /app
 
@@ -30,7 +33,8 @@ COPY packages/server-sdk/package.json packages/server-sdk/package.json
 COPY packages/shared/package.json packages/shared/package.json
 COPY packages/storage/package.json packages/storage/package.json
 # windy-copy:deps end
-RUN --mount=type=cache,id=windy-bun-1.3.14,target=/root/.bun/install/cache,sharing=shared bun -e 'const child=Bun.spawn(["bun","install","--frozen-lockfile","--no-progress","--backend=copyfile","--linker=hoisted","--ignore-scripts"],{stdin:"inherit",stdout:"inherit",stderr:"inherit"});const heartbeat=setInterval(()=>console.log("[windy] Bun 依赖安装仍在进行"),15000);const exitCode=await child.exited;clearInterval(heartbeat);process.exit(exitCode)' && bun --cwd apps/server -e 'await import("argon2")'
+ARG WINDY_NPM_REGISTRY=https://registry.npmjs.org
+RUN --mount=type=cache,id=windy-bun-1.3.14,target=/root/.bun/install/cache,sharing=shared bun -e 'const child=Bun.spawn(["bun","install","--frozen-lockfile","--no-progress","--filter","*","--filter","!./apps/agent-server","--registry",process.env.WINDY_NPM_REGISTRY||"https://registry.npmjs.org","--backend=copyfile","--linker=hoisted","--ignore-scripts"],{stdin:"inherit",stdout:"inherit",stderr:"inherit"});const started=Date.now();const heartbeat=setInterval(()=>console.log("[windy] Bun 依赖安装尚未完成，已耗时 "+Math.round((Date.now()-started)/1000)+" 秒"),15000);const deadline=setTimeout(()=>{console.error("[windy] Bun 安装超过 300 秒，请检查 npm 下载网络或通过 WINDY_NPM_REGISTRY 指定可用源");child.kill("SIGKILL")},300000);const exitCode=await child.exited;clearInterval(heartbeat);clearTimeout(deadline);process.exit(exitCode)' && bun --cwd apps/server -e 'await import("argon2")'
 
 FROM deps AS build
 # windy-copy:build begin

package/template/apps/web/dev/dev-port.test.ts

@@ -3,26 +3,26 @@ import { selectDevPort, type PortState } from "./dev-port";
 import { windyDevIdentity } from "./dev-identity";
 
 describe("Windy 本地开发端口", () => {
-  test("默认选择 8746", async () => {
+  test("默认选择 28746", async () => {
     const result = await selectDevPort({
       fingerprint: "project-a",
       inspect: async () => ({ kind: "available" }),
     });
 
-    expect(result).toEqual({ kind: "selected", port: 8_746 });
+    expect(result).toEqual({ kind: "selected", port: 28_746 });
   });
 
   test("外部服务或其他 Windy 项目占用时自动递增", async () => {
     const states = new Map<number, PortState>([
-      [8_746, { kind: "occupied" }],
-      [8_747, { kind: "occupied", identity: windyDevIdentity("project-b") }],
+      [28_746, { kind: "occupied" }],
+      [28_747, { kind: "occupied", identity: windyDevIdentity("project-b") }],
     ]);
     const result = await selectDevPort({
       fingerprint: "project-a",
       inspect: async (port) => states.get(port) || { kind: "available" },
     });
 
-    expect(result).toEqual({ kind: "selected", port: 8_748 });
+    expect(result).toEqual({ kind: "selected", port: 28_748 });
   });
 
   test("检测到同一项目时返回已有地址而不启动重复服务", async () => {
@@ -34,7 +34,7 @@ describe("Windy 本地开发端口", () => {
       }),
     });
 
-    expect(result).toEqual({ kind: "existing", port: 8_746 });
+    expect(result).toEqual({ kind: "existing", port: 28_746 });
   });
 
   test("最多扫描 100 个端口", async () => {

package/template/apps/web/dev/dev-port.ts

@@ -1,6 +1,6 @@
 import { isWindyDevIdentity, type WindyDevIdentity } from "./dev-identity";
 
-export const DEFAULT_DEV_PORT = 8_746;
+export const DEFAULT_DEV_PORT = 28_746;
 export const DEV_PORT_SCAN_LIMIT = 100;
 
 export type PortState =

package/template/apps/web/dev/start.ts

@@ -4,7 +4,9 @@ import { projectFingerprint } from "./dev-identity";
 import { selectDevPort } from "./dev-port";
 
 const fingerprint = projectFingerprint(process.cwd());
-const configuredPort = parseConfiguredPort(process.env.WINDY_DEV_PORT);
+const configuredPort = parseConfiguredPort(
+  process.env.WINDY_DEV_PORT ?? process.env.WINDY_WEB_PORT,
+);
 const selection = configuredPort
   ? { kind: "selected" as const, port: configuredPort }
   : await selectDevPort({ fingerprint });
@@ -29,6 +31,9 @@ const child = Bun.spawn(
     env: {
       ...process.env,
       WINDY_DEV_PORT: String(selection.port),
+      API_UPSTREAM:
+        process.env.API_UPSTREAM ??
+        `http://127.0.0.1:${process.env.WINDY_SERVER_PORT ?? "19747"}`,
       WINDY_DEV_FINGERPRINT: fingerprint,
     },
     stdin: "inherit",

package/template/apps/web/index.html

@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" href="/src/assets/windy.svg" type="image/svg+xml" />
     <title>Windy Platform Template</title>
     <!-- Tailwind CSS -->
     <link rel="stylesheet" href="/src/style.css" />

package/template/apps/web/package.json

@@ -13,38 +13,38 @@
   },
   "dependencies": {
     "@antv/g2": "^5.4.8",
-    "@lucide/vue": "^1.23.0",
+    "@lucide/vue": "^1.70.0",
     "@southwind-ai/example-work-order": "workspace:*",
     "@southwind-ai/license": "workspace:*",
     "@southwind-ai/shared": "workspace:*",
-    "@tailwindcss/vite": "^4.3.2",
-    "@tanstack/vue-form": "^1.33.0",
+    "@tailwindcss/vite": "^4.3.4",
+    "@tanstack/vue-form": "^1.33.5",
     "@tanstack/vue-table": "^8.21.3",
     "@vue-flow/core": "^1.48.2",
-    "@vueuse/core": "^14.3.0",
+    "@vueuse/core": "^14.4.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "pinia": "^3.0.4",
     "qrcode": "^1.5.4",
-    "reka-ui": "^2.10.1",
-    "tailwind-merge": "^3.6.0",
-    "tailwindcss": "^4.3.2",
+    "reka-ui": "^2.11.0",
+    "tailwind-merge": "^3.7.0",
+    "tailwindcss": "^4.3.4",
     "vee-validate": "^4.15.1",
-    "vue": "^3.5.39",
-    "vue-router": "^5.1.0",
+    "vue": "^3.5.45",
+    "vue-router": "^5.4.0",
     "vue-sonner": "^2.0.9",
-    "ws": "^8.22.0"
+    "ws": "^8.22.1"
   },
   "devDependencies": {
     "@southwind-ai/modules": "workspace:*",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.2",
-    "@vitejs/plugin-vue": "^6.0.7",
-    "@vue/test-utils": "^2.4.11",
-    "happy-dom": "^20.10.6",
+    "@vitejs/plugin-vue": "^6.0.10",
+    "@vue/test-utils": "^2.5.1",
+    "happy-dom": "^20.14.6",
     "tw-animate-css": "^1.4.0",
-    "vite": "^8.1.4",
-    "vitest": "^4.1.10",
-    "vue-tsc": "^3.3.7"
+    "vite": "^8.3.6",
+    "vitest": "^4.1.12",
+    "vue-tsc": "^3.3.14"
   }
 }

package/template/apps/web/runtime-server.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, mock, test } from "bun:test";
-import { mkdir, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { createWebFetchHandler } from "./runtime-server";
 
 describe("Web 生产同源 API 代理", () => {
@@ -84,3 +86,22 @@ describe("Web 生产同源 API 代理", () => {
     }
   });
 });
+
+test("缺失的构建资源返回 404，业务深链接仍返回 SPA 入口", async () => {
+  const distDir = await mkdtemp(join(tmpdir(), "windy-web-assets-"));
+  try {
+    await Bun.write(join(distDir, "index.html"), "<html>Windy</html>");
+    const handler = createWebFetchHandler({ distDir });
+    const missing = await handler(new Request("http://web/assets/stale.js"));
+    expect(missing.status).toBe(404);
+    expect(missing.headers.get("content-type")).toBe(
+      "text/plain; charset=utf-8",
+    );
+
+    const route = await handler(new Request("http://web/admin/system/users"));
+    expect(route.status).toBe(200);
+    expect(await route.text()).toBe("<html>Windy</html>");
+  } finally {
+    await rm(distDir, { recursive: true, force: true });
+  }
+});

package/template/apps/web/runtime-server.ts

@@ -53,6 +53,12 @@ async function serveStatic(
       },
     });
   }
+  if (pathname.startsWith("/assets/")) {
+    return new Response("Not Found", {
+      status: 404,
+      headers: { "content-type": "text/plain; charset=utf-8" },
+    });
+  }
   return new Response(Bun.file(join(distDir, "index.html")), {
     headers: { "content-type": contentTypes[".html"] },
   });

package/template/apps/web/src/App.vue

@@ -1,10 +1,13 @@
 <script setup lang="ts">
-import AppShell from "@/layout/AppShell.vue";
-import AppLayout from "@/app/layouts/AppLayout.vue";
-import { computed } from "vue";
+import { computed, defineAsyncComponent } from "vue";
 import { useRoute } from "vue-router";
 import { usePlatformSettings } from "@/composables/usePlatformSettings";
 
+const AppShell = defineAsyncComponent(() => import("@/layout/AppShell.vue"));
+const AppLayout = defineAsyncComponent(
+  () => import("@/app/layouts/AppLayout.vue"),
+);
+
 const route = useRoute();
 const platformSettings = usePlatformSettings();
 const layout = computed(() => route.meta.layout);

package/template/apps/web/src/assets/windy.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#164b35"/>
+  <path d="M15 24h20a5 5 0 1 0-5-5M11 33h37a5 5 0 1 0-5-5M17 42h20a5 5 0 1 1-5 5" fill="none" stroke="#fff" stroke-width="4.5" stroke-linecap="round"/>
+</svg>

package/template/apps/web/src/components/auth/LoginForm.vue

@@ -34,7 +34,7 @@ function submit() {
 
 <template>
   <form class="space-y-4" data-testid="login-form" @submit.prevent="submit">
-    <div class="space-y-2">
+    <div class="grid gap-2">
       <label for="username" class="text-sm font-medium">用户名</label>
       <Input
         id="username"
@@ -46,7 +46,7 @@ function submit() {
         required
       />
     </div>
-    <div class="space-y-2">
+    <div class="grid gap-2">
       <label for="password" class="text-sm font-medium">密码</label>
       <Input
         id="password"

package/template/apps/web/src/components/auth/PasswordChangeForm.vue

@@ -48,13 +48,24 @@ const canSubmit = computed(
     newPassword.value === confirmation.value,
 );
 
-function submit() {
+function getInput(): PasswordChangeInput | undefined {
   if (!canSubmit.value) return;
-  emit("submit", {
+  return {
     currentPassword: currentPassword.value,
     newPassword: newPassword.value,
-  });
+  };
+}
+
+function submit() {
+  const input = getInput();
+  if (input) emit("submit", input);
 }
+
+defineExpose({
+  getInput,
+  isDirty: () =>
+    Boolean(currentPassword.value || newPassword.value || confirmation.value),
+});
 </script>
 
 <template>

package/template/apps/web/src/components/common/FormDialog.vue

@@ -84,7 +84,7 @@ async function canClose() {
       </DialogHeader>
 
       <form class="contents" @submit.prevent="emit('submit')">
-        <ModalBody class="space-y-4">
+        <ModalBody class="-m-1 space-y-4 p-1">
           <slot />
         </ModalBody>
 

package/template/apps/web/src/components/license/LicenseFlow.webtest.ts

@@ -25,6 +25,9 @@ describe("License Web 流程", () => {
       "联系系统管理员",
     );
     expect(wrapper.find('[data-testid="machine-code"]').exists()).toBe(false);
+    expect(
+      wrapper.find('[data-testid="machine-code-qr-toggle"]').exists(),
+    ).toBe(false);
     expect(wrapper.text()).not.toContain("客户一");
     expect(wrapper.text()).not.toContain("capability.audit");
   });