create-windy 0.9.1 → 0.10.1

package/template/packages/database/drizzle/meta/_journal.json

@@ -456,6 +456,27 @@
       "when": 1793213711851,
       "tag": "0064_dsh_skills_diagnostics",
       "breakpoints": true
+    },
+    {
+      "idx": 65,
+      "version": "7",
+      "when": 1793897949256,
+      "tag": "0065_durable_job_lease_snapshot_lookup",
+      "breakpoints": true
+    },
+    {
+      "idx": 66,
+      "version": "7",
+      "when": 1793979537210,
+      "tag": "0066_agent_source_sequence_bigint",
+      "breakpoints": true
+    },
+    {
+      "idx": 67,
+      "version": "7",
+      "when": 1793983613438,
+      "tag": "0067_media_runtime_access",
+      "breakpoints": true
     }
   ]
 }

package/template/packages/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/database",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@southwind-ai/shared": "workspace:^0.3.2",
-    "drizzle-orm": "^0.45.2"
+    "drizzle-orm": "^0.45.4"
   },
   "exports": {
     ".": "./index.ts"
@@ -25,6 +25,6 @@
     "access": "public"
   },
   "devDependencies": {
-    "pg": "^8.22.0"
+    "pg": "^8.23.1"
   }
 }

package/template/packages/database/src/schema/agent-session.ts

@@ -1,5 +1,6 @@
 import { sql } from "drizzle-orm";
 import {
+  bigint,
   check,
   doublePrecision,
   index,
@@ -148,7 +149,7 @@ export const agentContextSources = pgTable(
     sourceKind: varchar("source_kind", { length: 48 }).notNull(),
     sourceId: varchar("source_id", { length: 256 }).notNull(),
     sourceVersion: varchar("source_version", { length: 160 }).notNull(),
-    sourceSequence: integer("source_sequence").notNull(),
+    sourceSequence: bigint("source_sequence", { mode: "number" }).notNull(),
     sourceDigest: varchar("source_digest", { length: 71 }).notNull(),
     validityStatus: varchar("validity_status", { length: 16 }).notNull(),
     validityReason: varchar("validity_reason", { length: 32 }),
@@ -238,7 +239,7 @@ export const agentMemorySources = pgTable(
     sourceKind: varchar("source_kind", { length: 48 }).notNull(),
     sourceId: varchar("source_id", { length: 256 }).notNull(),
     sourceVersion: varchar("source_version", { length: 160 }).notNull(),
-    sourceSequence: integer("source_sequence").notNull(),
+    sourceSequence: bigint("source_sequence", { mode: "number" }).notNull(),
     sourceDigest: varchar("source_digest", { length: 71 }).notNull(),
     validityStatus: varchar("validity_status", { length: 16 }).notNull(),
     validityReason: varchar("validity_reason", { length: 32 }),
@@ -270,7 +271,7 @@ export const agentSourceInvalidations = pgTable(
     sourceKind: varchar("source_kind", { length: 48 }).notNull(),
     sourceId: varchar("source_id", { length: 256 }).notNull(),
     sourceVersion: varchar("source_version", { length: 160 }).notNull(),
-    sequence: integer("sequence").notNull(),
+    sequence: bigint("sequence", { mode: "number" }).notNull(),
     sourceDigest: varchar("source_digest", { length: 71 }),
     cause: varchar("cause", { length: 32 }).notNull(),
     status: varchar("status", { length: 24 }).notNull().default("pending"),

package/template/packages/database/src/schema/durable-jobs.ts

@@ -147,6 +147,10 @@ export const durableJobLeases = pgTable(
       .on(table.stageId)
       .where(sql`${table.status} = 'active'`),
     index("idx_durable_job_leases_expiry").on(table.status, table.expiresAt),
+    index("idx_durable_job_leases_job_acquired").on(
+      table.jobId,
+      table.acquiredAt,
+    ),
     check("ck_durable_job_leases_fencing", sql`${table.fencingToken} > 0`),
   ],
 );

package/template/packages/database/src/schema/index.ts

@@ -41,9 +41,11 @@ export * from "./agent-session-receipt.js";
 export * from "./agent-session.js";
 export * from "./client-agent.js";
 export * from "./client-agent-workflow-artifact.js";
+// @windy-module system.agent end
+// @windy-module system.media-runtime begin
 export * from "./embedding-runtime.js";
 export * from "./ai-output-artifacts.js";
-// @windy-module system.agent end
+// @windy-module system.media-runtime end
 
 // @windy-module system.agent begin
 export * from "./agent-skills.js";

package/template/packages/database/src/schema-durable-recovery.test.ts

@@ -1,7 +1,7 @@
 // @windy-module system.scheduler begin
 import { describe, expect, test } from "bun:test";
 import { getTableConfig } from "drizzle-orm/pg-core";
-import { durableJobRecoveries } from "./schema/index.js";
+import { durableJobLeases, durableJobRecoveries } from "./schema/index.js";
 
 describe("durable job recovery schema", () => {
   test("人工恢复事实按任务与外部请求幂等", async () => {
@@ -27,5 +27,25 @@ describe("durable job recovery schema", () => {
       'CREATE UNIQUE INDEX "uk_durable_job_recoveries_idempotency"',
     );
   });
+  test("历史租约查找索引覆盖所有状态并支持按获取时间排序", async () => {
+    const name = "idx_durable_job_leases_job_acquired";
+    const index = getTableConfig(durableJobLeases).indexes.find(
+      ({ config }) => config.name === name,
+    );
+    expect(index?.config.columns).toEqual([
+      expect.objectContaining({ name: "job_id" }),
+      expect.objectContaining({ name: "acquired_at" }),
+    ]);
+    expect(index?.config.where).toBeUndefined();
+    const migration = await Bun.file(
+      new URL(
+        "../drizzle/0065_durable_job_lease_snapshot_lookup.sql",
+        import.meta.url,
+      ),
+    ).text();
+    expect(migration).toMatch(
+      /CREATE INDEX "idx_durable_job_leases_job_acquired" ON "durable_job_leases" USING btree \("job_id","acquired_at"\);/,
+    );
+  });
 });
 // @windy-module system.scheduler end

package/template/packages/database/src/schema-source-sequence.test.ts

@@ -0,0 +1,24 @@
+// @windy-module system.agent begin
+import { describe, expect, test } from "bun:test";
+import {
+  agentContextSources,
+  agentMemorySources,
+  agentSourceInvalidations,
+} from "./schema/agent-session.js";
+
+describe("来源序号持久化范围", () => {
+  test("来源坐标使用 bigint，读取毫秒序号仍为精确 number", () => {
+    for (const column of [
+      agentContextSources.sourceSequence,
+      agentMemorySources.sourceSequence,
+      agentSourceInvalidations.sequence,
+    ]) {
+      expect(column.getSQLType()).toBe("bigint");
+      expect(column.mapFromDriverValue("1793979283424")).toBe(1793979283424);
+      expect(column.mapFromDriverValue(String(Number.MAX_SAFE_INTEGER))).toBe(
+        Number.MAX_SAFE_INTEGER,
+      );
+    }
+  });
+});
+// @windy-module system.agent end

package/template/packages/example-work-order/package.json

@@ -10,8 +10,8 @@
     "@southwind-ai/modules": "workspace:*",
     "@southwind-ai/server-sdk": "workspace:*",
     "@southwind-ai/shared": "workspace:*",
-    "drizzle-orm": "^0.45.2",
-    "zod": "^4.4.3"
+    "drizzle-orm": "^0.45.4",
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "vue": "^3.5.0"

package/template/packages/modules/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/modules",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {

package/template/packages/modules/src/admin-ui-boundary.test.ts

@@ -0,0 +1,33 @@
+import { expect, test } from "bun:test";
+
+// Inspect the resolved graph before tree-shaking: Vite dev serves these imports
+// even when production could eliminate unused exports.
+test("browser admin UI entry does not traverse full platform assembly", async () => {
+  const loaded: string[] = [];
+  const result = await Bun.build({
+    entrypoints: [import.meta.dir + "/admin-ui-entry.ts"],
+    target: "browser",
+    write: false,
+    plugins: [
+      {
+        name: "record-browser-dependencies",
+        setup(build) {
+          build.onLoad({ filter: /\.[cm]?[jt]s$/ }, (args) => {
+            loaded.push(args.path.split("/").at(-1)!);
+            return undefined;
+          });
+        },
+      },
+    ],
+  });
+  expect(result.success).toBe(true);
+  expect(loaded).toContain("system-module-definitions.ts");
+  expect(loaded).not.toContain("system-module-catalog.ts");
+  expect(loaded).not.toContain("system-modules.ts");
+  expect(
+    loaded.filter((name) =>
+      /^system-agent-|^system-ai-|^system-api-/.test(name),
+    ),
+  ).toEqual([]);
+  expect(loaded).not.toContain("system-audit-actions.ts");
+});

package/template/packages/modules/src/composition.ts

@@ -1,4 +1,3 @@
-import type { MenuNode } from "@southwind-ai/shared";
 import type {
   ModuleImplementationBindings,
   ModuleManifest,
@@ -10,7 +9,11 @@ import {
   validateCapabilityKeyAlignment,
 } from "./capability-guard-validation.js";
 import { validateImplementationBindings } from "./implementation-bindings.js";
-import { composeModuleMenus } from "./menu-composition.js";
+import {
+  composeModuleMenus,
+  flattenMenus,
+  validateMenuRoutes,
+} from "./menu-composition.js";
 import { validateCapabilityCatalogs } from "./catalog-validation.js";
 import {
   snapshotModuleManifestSecrets,
@@ -125,9 +128,13 @@ export function validateModuleComposition(
   validateImplementationBindings(
     {
       adminRoutes: adminRoutes.map(({ key }) => key),
-      apiRoutes: apiRoutes.map(apiRouteKey),
+      apiRoutes: apiRoutes
+        .map(apiRouteKey)
+        .filter((key) => !implementations.unavailableApiRoutes?.has(key)),
       tasks: tasks.map(({ key }) => key),
-      tools: tools.map(({ key }) => key),
+      tools: tools
+        .map(({ key }) => key)
+        .filter((key) => !implementations.unavailableTools?.has(key)),
       providers: providers.map(({ key }) => key),
     },
     aiOperations,
@@ -304,26 +311,6 @@ function validateReferences(
   }
 }
 
-function validateMenuRoutes(
-  menus: readonly MenuNode[],
-  routes: readonly ModuleManifest["adminRoutes"][number][],
-): void {
-  const byPath = new Map(routes.map((route) => [route.path, route]));
-  for (const menu of menus) {
-    if (!menu.path) continue;
-    const route = byPath.get(menu.path);
-    if (!route)
-      throw new Error(`菜单 ${menu.key} 缺少 Admin Route：${menu.path}`);
-    if (
-      route.directAccess !== "admin-admission" &&
-      (route.permissionKey !== menu.permissionKey ||
-        route.featureKey !== menu.featureKey)
-    ) {
-      throw new Error(`菜单 ${menu.key} 与 Admin Route Guard 不一致`);
-    }
-  }
-}
-
 function validateSchemaMigrations(
   schemas: readonly ModuleManifest["schemaExports"][number][],
 ): void {
@@ -342,7 +329,3 @@ function unique(label: string, values: readonly string[]): Set<string> {
   }
   return result;
 }
-
-function flattenMenus(menus: readonly MenuNode[]): MenuNode[] {
-  return menus.flatMap((menu) => [menu, ...flattenMenus(menu.children || [])]);
-}

package/template/packages/modules/src/manifest.ts

@@ -291,6 +291,8 @@ export interface ModuleManifest {
 export type ModuleFactory = () => ModuleManifest;
 
 export interface ModuleImplementationBindings {
+  unavailableApiRoutes?: ReadonlySet<string>;
+  unavailableTools?: ReadonlySet<string>;
   adminRoutes?: readonly string[];
   apiRoutes?: readonly string[];
   tasks?: readonly string[];

package/template/packages/modules/src/menu-composition.ts

@@ -52,3 +52,27 @@ function assertSameMenuShell(left: MenuNode, right: MenuNode): void {
     }
   }
 }
+
+export function validateMenuRoutes(
+  menus: readonly MenuNode[],
+  routes: readonly ModuleManifest["adminRoutes"][number][],
+): void {
+  const byPath = new Map(routes.map((route) => [route.path, route]));
+  for (const menu of menus) {
+    if (!menu.path) continue;
+    const route = byPath.get(menu.path);
+    if (!route)
+      throw new Error(`菜单 ${menu.key} 缺少 Admin Route：${menu.path}`);
+    if (
+      route.directAccess !== "admin-admission" &&
+      (route.permissionKey !== menu.permissionKey ||
+        route.featureKey !== menu.featureKey)
+    ) {
+      throw new Error(`菜单 ${menu.key} 与 Admin Route Guard 不一致`);
+    }
+  }
+}
+
+export function flattenMenus(menus: readonly MenuNode[]): MenuNode[] {
+  return menus.flatMap((menu) => [menu, ...flattenMenus(menu.children || [])]);
+}

package/template/packages/modules/src/system-admin-routes.ts

@@ -129,7 +129,7 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     "system.diagnostics",
   ),
   // @windy-module system.audit end
-  // @windy-module system.agent begin
+  // @windy-module system.agent-ui begin
   route(
     "system.agent-tools",
     "/admin/system/agent-tools",
@@ -186,7 +186,7 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     "system.agent-workbench.use",
     "system.agent-workbench",
   ),
-  // @windy-module system.agent end
+  // @windy-module system.agent-ui end
   // @windy-module system.operations begin
   route(
     "system.ops",

package/template/packages/modules/src/system-admin-ui-catalog.ts

@@ -1,6 +1,6 @@
 import type { AdminUiManifest } from "./admin-ui-manifest.js";
 import { systemAdminRoutes } from "./system-admin-routes.js";
-import { systemModuleDefinitions } from "./system-module-catalog.js";
+import { systemModuleDefinitions } from "./system-module-definitions.js";
 
 const definitions = [
   ["system", ["system.feature", "system.ui-components"]],
@@ -30,10 +30,14 @@ const definitions = [
   // @windy-module system.storage begin
   ["system.storage", []],
   // @windy-module system.storage end
+  // @windy-module system.media-runtime begin
+  ["system.media-runtime", []],
+  // @windy-module system.media-runtime end
   // @windy-module system.agent begin
   [
     "system.agent",
     [
+      // @windy-module system.agent-ui begin
       "system.agent-tools",
       "system.agent-debug",
       "system.agent-skill",
@@ -41,6 +45,7 @@ const definitions = [
       "system.agent-session",
       "system.ai-runtime",
       "system.agent-workflow",
+      // @windy-module system.agent-ui end
     ],
   ],
   // @windy-module system.agent end

package/template/packages/modules/src/system-ai-api-bindings.ts

@@ -22,15 +22,6 @@ export function systemAiControlPlaneBindings(): ApiPermissionBinding[] {
   );
   const read = [
     "/api/agent/workflows/readiness",
-    "/api/internal/ai/artifacts",
-    "/api/document/runs/:runId/events",
-    "/api/document/runs/:runId/result",
-    "/api/speech/runs/:runId/events",
-    "/api/speech/runs/:runId/result",
-    "/api/speech/runs/:runId/artifact",
-    "/api/embeddings/runs/:runId/events",
-    "/api/embeddings/runs/:runId/result",
-    "/api/internal/embeddings/runs/:runId/artifacts/:itemId",
     "/api/agent/runs/:runId/events",
     "/api/agent/runs/:runId/result",
   ].map((path) =>
@@ -44,13 +35,6 @@ export function systemAiControlPlaneBindings(): ApiPermissionBinding[] {
     ),
   );
   const execute = [
-    "/api/document/runs",
-    "/api/document/runs/:runId/cancel",
-    "/api/speech/runs",
-    "/api/speech/runs/:runId/cancel",
-    "/api/embeddings",
-    "/api/embeddings/runs",
-    "/api/embeddings/runs/:runId/cancel",
     "/api/agent/runs",
     "/api/agent/runs/:runId/cancel",
     "/api/agent/runs/:runId/attach",

package/template/packages/modules/src/system-api-control-plane.ts

@@ -3,6 +3,9 @@ import { binding } from "./system-api-binding.js";
 // @windy-module system.agent begin
 import { systemAiControlPlaneBindings } from "./system-ai-api-bindings.js";
 // @windy-module system.agent end
+// @windy-module system.media-runtime begin
+import { systemMediaApiBindings } from "./system-media-api-bindings.js";
+// @windy-module system.media-runtime end
 
 /**
  * 不走资源 CRUD 的平台入口仍必须进入 Manifest。
@@ -17,13 +20,18 @@ export function systemControlPlaneApiPermissionBindings(): ApiPermissionBinding[
     // @windy-module system.agent begin
     ...systemAiControlPlaneBindings(),
     // @windy-module system.agent end
+    // @windy-module system.media-runtime begin
+    ...systemMediaApiBindings(),
+    // @windy-module system.media-runtime end
     // @windy-module system.license begin
+    // 基础运行投影不依赖管理权限或管理 Feature；Handler 仍强制 user 登录态。
     binding(
       "GET",
       "/api/license/runtime",
       "system.license.read",
-      "system.license",
+      undefined,
       "data.read",
+      true,
     ),
     binding(
       "POST",

package/template/packages/modules/src/system-api-permissions.ts

@@ -15,6 +15,13 @@ import { systemControlPlaneApiPermissionBindings } from "./system-api-control-pl
 export function systemApiPermissionBindings(): ApiPermissionBinding[] {
   return [
     // @windy-module system.audit begin
+    binding(
+      "GET",
+      "/api/system/diagnostics",
+      "system.diagnostics.read",
+      "system.diagnostics",
+      "diagnostic.read",
+    ),
     binding(
       "GET",
       "/api/system/diagnostics/:diagnosticId",

package/template/packages/modules/src/system-api-watermark.ts

@@ -25,5 +25,26 @@ export function watermarkApiPermissionBindings(): ApiPermissionBinding[] {
       "system.watermark",
       "config.update",
     ),
+    binding(
+      "GET",
+      "/api/system/settings/watermark/yaml",
+      "system.watermark.read",
+      "system.watermark",
+      "data.read",
+    ),
+    binding(
+      "POST",
+      "/api/system/settings/watermark/yaml/preview",
+      "system.watermark.manage",
+      "system.watermark",
+      "data.read",
+    ),
+    binding(
+      "POST",
+      "/api/system/settings/watermark/yaml",
+      "system.watermark.manage",
+      "system.watermark",
+      "config.update",
+    ),
   ];
 }

package/template/packages/modules/src/system-audit-actions.ts

@@ -85,6 +85,9 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   "file.upload.abort",
   "file.download",
   // @windy-module system.storage end
+  // @windy-module system.media-runtime begin
+  "agent.operation.execute",
+  // @windy-module system.media-runtime end
   // @windy-module system.agent begin
   {
     key: "system.agent-tools.read",
@@ -113,7 +116,6 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   },
   "agent.mcp.access",
   "agent.tool.execute",
-  "agent.operation.execute",
   {
     key: "agent.session.read",
     label: "读取 Agent 长期会话",

package/template/packages/modules/src/system-features.ts

@@ -13,8 +13,8 @@ const standardAndAdvanced = ["standard", "advanced"].map(
 export const systemFeatures: ModuleManifest["features"] = [
   feature(
     "system.admin",
-    "Windy 管理面",
-    "平台管理员、运维与授权审计人员使用的控制面准入能力。",
+    "Windy 管理面板",
+    "允许平台管理员、运维人员和获授权的审计人员访问 Windy 管理面板。",
   ),
   feature("system.runtime", "运行状态", "健康、就绪与指标等部署运行状态入口。"),
   feature(
@@ -93,7 +93,11 @@ export const systemFeatures: ModuleManifest["features"] = [
     "审计日志",
     "记录关键配置、权限拒绝与业务操作，支持安全追溯。",
   ),
-  feature("system.diagnostics", "错误诊断", "按诊断编号查询脱敏失败索引。"),
+  feature(
+    "system.diagnostics",
+    "错误诊断",
+    "分页查看脱敏失败日志，也可按诊断编号定位记录。",
+  ),
   // @windy-module system.audit end
   // @windy-module system.storage begin
   feature(
@@ -102,6 +106,20 @@ export const systemFeatures: ModuleManifest["features"] = [
     "受控文件上传、续传、下载、过期和底层对象生命周期。",
   ),
   // @windy-module system.storage end
+  // @windy-module system.media-runtime begin
+  feature(
+    "system.ai-artifact",
+    "AI 文件引用",
+    "受控运行时读取已授权的输入文件。",
+  ),
+  feature(
+    "system.document",
+    "文档识别与 OCR",
+    "控制文档识别与 OCR运行时和业务入口。",
+  ),
+  feature("system.speech", "语音处理", "控制语音处理运行时和业务入口。"),
+  feature("system.embedding", "向量嵌入", "控制向量嵌入运行时和业务入口。"),
+  // @windy-module system.media-runtime end
   // @windy-module system.agent begin
   feature(
     "system.agent",

package/template/packages/modules/src/system-media-api-bindings.ts

@@ -0,0 +1,97 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { binding } from "./system-api-binding.js";
+
+export function systemMediaApiBindings(): ApiPermissionBinding[] {
+  return [
+    binding(
+      "GET",
+      "/api/internal/ai/artifacts",
+      "system.ai-artifact.read",
+      "system.ai-artifact",
+      "data.read",
+      true,
+    ),
+    ...outputArtifactBindings(),
+    ...runtimeBindings(
+      "system.document",
+      ["/api/document/runs/:runId/events", "/api/document/runs/:runId/result"],
+      ["/api/document/runs", "/api/document/runs/:runId/cancel"],
+    ),
+    ...runtimeBindings(
+      "system.speech",
+      [
+        "/api/speech/runs/:runId/events",
+        "/api/speech/runs/:runId/result",
+        "/api/speech/runs/:runId/artifact",
+      ],
+      ["/api/speech/runs", "/api/speech/runs/:runId/cancel"],
+    ),
+    ...runtimeBindings(
+      "system.embedding",
+      [
+        "/api/embeddings/runs/:runId/events",
+        "/api/embeddings/runs/:runId/result",
+        "/api/internal/embeddings/runs/:runId/artifacts/:itemId",
+      ],
+      [
+        "/api/embeddings",
+        "/api/embeddings/runs",
+        "/api/embeddings/runs/:runId/cancel",
+      ],
+    ),
+  ];
+}
+
+function runtimeBindings(
+  feature: "system.document" | "system.speech" | "system.embedding",
+  read: readonly string[],
+  execute: readonly string[],
+): ApiPermissionBinding[] {
+  return [
+    ...read.map((path) =>
+      binding(
+        "GET",
+        path,
+        `${feature}.read`,
+        feature,
+        "data.read",
+        path.startsWith("/api/internal/"),
+      ),
+    ),
+    ...execute.map((path) =>
+      binding(
+        "POST",
+        path,
+        `${feature}.read`,
+        feature,
+        "agent.operation.execute",
+        false,
+      ),
+    ),
+  ];
+}
+
+function outputArtifactBindings(): ApiPermissionBinding[] {
+  const root = "/api/internal/ai/output-artifacts";
+  const routes = [
+    ["GET", ""],
+    ["GET", "/health/ready"],
+    ["POST", "/scopes/:scope/grants/:generation/accept"],
+    ["POST", "/scopes/:scope/artifacts"],
+    ["PUT", "/scopes/:scope/artifacts/:artifactId/parts/:partNumber"],
+    ["POST", "/scopes/:scope/artifacts/:artifactId/complete"],
+    ["POST", "/scopes/:scope/seal"],
+    ["DELETE", "/scopes/:scope/open"],
+    ["DELETE", "/scopes/:scope"],
+  ] as const;
+  return routes.map(([method, suffix]) =>
+    binding(
+      method,
+      root + suffix,
+      "system.ai-artifact.read",
+      "system.ai-artifact",
+      method === "GET" ? "data.read" : "agent.operation.execute",
+      true,
+    ),
+  );
+}

package/template/packages/modules/src/system-module-audit-selection.ts

@@ -15,6 +15,8 @@ export function selectSystemAuditActions(
     const key = auditActionKey(action);
     if (name === "system.identity")
       return key === "system.user-directory.query";
+    if (key === "agent.operation.execute")
+      return name === "system.media-runtime";
     if (name === "system.agent") return agentActions.has(key);
     return (
       name === "system" &&