create-windy 0.9.1 → 0.10.1

package/template/apps/server/src/startup-composition-validation.test.ts

@@ -2,6 +2,38 @@ import { describe, expect, test } from "bun:test";
 import { validateCompositionBeforeStartup } from "./startup-composition-validation.js";
 
 describe("完整 Server Composition 启动前门禁", () => {
+  test("生产启动的真实装配子进程隔离审计存储且不改变父进程环境", () => {
+    const moduleUrl = new URL(
+      "./startup-composition-validation.ts",
+      import.meta.url,
+    );
+    const result = Bun.spawnSync({
+      cmd: [
+        process.execPath,
+        "--eval",
+        `
+        const { validateCompositionBeforeStartup } = await import(${JSON.stringify(moduleUrl.href)});
+        validateCompositionBeforeStartup(["bun", "src/index.ts"]);
+        if (process.env.NODE_ENV !== "production") throw new Error("parent environment changed");
+        if (process.env.DATABASE_URL !== "postgres://unreachable.invalid/validation-must-not-connect")
+          throw new Error("parent database configuration changed");
+      `,
+      ],
+      env: {
+        ...process.env,
+        NODE_ENV: "production",
+        DATABASE_URL:
+          "postgres://unreachable.invalid/validation-must-not-connect",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(new TextDecoder().decode(result.stderr)).not.toContain(
+      "AuditWriteUnavailableError",
+    );
+    expect(result.exitCode).toBe(0);
+  }, 15000);
+
   test("正常启动先执行无数据库验证子进程", () => {
     let databaseUrlSeen = "not-called";
     validateCompositionBeforeStartup(

package/template/apps/server/src/startup-finalization.ts

@@ -11,6 +11,7 @@ import { installPlatformShutdown } from "./startup-shutdown.js";
 export function finalizePlatformStartup(input: {
   app: Parameters<typeof listenPlatformServer>[0];
   modules: ModuleManifest[];
+  disabledFeatureKeys?: ReadonlySet<string>;
   hosts: InitializedModuleHosts;
   tasks?: readonly { key: string }[];
   tools?: ReadonlyMap<string, unknown>;
@@ -24,6 +25,7 @@ export function finalizePlatformStartup(input: {
 }): void {
   validateInstalledRuntime({
     modules: input.modules,
+    disabledFeatureKeys: input.disabledFeatureKeys,
     routes: input.app.routes,
     tasks: input.tasks ?? [],
     tools: input.tools ?? new Map(),

package/template/apps/server/src/startup-runtime.ts

@@ -0,0 +1,77 @@
+import type { bootstrapServerModules } from "./module-bootstrap.js";
+import { createComposedAuthRuntime } from "./auth/composition.js";
+import { createServerRuntime } from "./runtime.js";
+import { createHttpObservability } from "./platform-http-runtime.js";
+import { resolveAiRuntimeConfiguration } from "./system/ai-runtime-configuration.js";
+import { createAuthorizationInvalidationComposition } from "./system/authorization-invalidation-composition.js";
+// @windy-module system.license begin
+import { createLicenseRuntimeActivation } from "./license/activation.js";
+// @windy-module system.license end
+
+type ModuleBootstrap = Awaited<ReturnType<typeof bootstrapServerModules>>;
+interface StartupRuntimeInput {
+  platformConfig: Parameters<typeof bootstrapServerModules>[0];
+  persistence: Parameters<typeof bootstrapServerModules>[1];
+  logger: Parameters<typeof createHttpObservability>[2];
+}
+
+/** Bind runtime policy and audit before constructing services or registering routes. */
+export async function createStartupRuntime(
+  { platformConfig, persistence, logger }: StartupRuntimeInput,
+  {
+    foundationSnapshot,
+    systemRepositories,
+  }: Pick<ModuleBootstrap, "foundationSnapshot" | "systemRepositories">,
+) {
+  const features = foundationSnapshot.features;
+  // @windy-module system.license begin
+  const licenseActivation = createLicenseRuntimeActivation(
+    process.env,
+    foundationSnapshot.platform.licenseEnabled,
+    persistence?.licenseResolver,
+  );
+  // @windy-module system.license end
+  const { aiRuntimeSwitches, disabledAiFeatures } =
+    await resolveAiRuntimeConfiguration(platformConfig.enableAI, features);
+  const runtime = createServerRuntime(process.env, {
+    actorResolver: persistence?.actorResolver,
+    // @windy-module system.license begin
+    licenseResolver: licenseActivation.resolver,
+    licenseEnforced: licenseActivation.enforced,
+    // @windy-module system.license end
+    featureResolver: persistence ? systemRepositories.features : undefined,
+    featureCatalog: features,
+    disabledFeatureKeys: disabledAiFeatures,
+    disabledModuleNames: new Set(foundationSnapshot.disabledModuleNames),
+    // @windy-module system.audit begin
+    auditReader: persistence?.auditReader,
+    auditWriter: persistence?.auditWriter,
+    // @windy-module system.audit end
+  });
+  const observability = createHttpObservability(runtime, persistence, logger);
+  const authorizationInvalidation = createAuthorizationInvalidationComposition({
+    platformConfig,
+    persistence,
+    repositories: systemRepositories,
+  });
+  // @windy-module system.license begin
+  licenseActivation.runtime.setAuditSink(runtime.auditSink);
+  // @windy-module system.license end
+  const auth = createComposedAuthRuntime({
+    repositories: systemRepositories,
+    platformConfig,
+    persistence,
+    runtime,
+  });
+  return {
+    ...auth,
+    runtime,
+    observability,
+    authorizationInvalidation,
+    aiRuntimeSwitches,
+    disabledAiFeatures,
+    // @windy-module system.license begin
+    licenseActivation,
+    // @windy-module system.license end
+  };
+}

package/template/apps/server/src/system/ai-runtime-build.ts

@@ -0,0 +1,3 @@
+import type { AiRuntimeKind } from "@southwind-ai/shared";
+
+export const excludedAiRuntimes: readonly AiRuntimeKind[] = [];

package/template/apps/server/src/system/ai-runtime-configuration.test.ts

@@ -0,0 +1,36 @@
+import { expect, test } from "bun:test";
+import {
+  featureKey,
+  parseEnvironmentPolicy,
+  type FeatureFlagDefinition,
+} from "@southwind-ai/shared";
+import { applyAiRuntimePolicy } from "./ai-runtime-configuration.js";
+
+const document: FeatureFlagDefinition = {
+  key: featureKey("system.document"),
+  module: "system.media-runtime",
+  label: "OCR",
+  enabled: true,
+  visible: "visible",
+  stage: "stable",
+};
+const profile = parseEnvironmentPolicy({
+  schemaVersion: 1,
+  build: { modules: ["system.media-runtime"] },
+  runtime: { agent: false, document: true, speech: false, embedding: false },
+  features: [],
+});
+
+test("YAML 显式启用 OCR 时拒绝关闭总开关的冲突配置", () => {
+  expect(() => applyAiRuntimePolicy(false, [document], profile)).toThrow(
+    "PLATFORM_ENABLE_AI_RUNTIME",
+  );
+  const enabled = applyAiRuntimePolicy(true, [document], profile);
+  expect(enabled.aiRuntimeSwitches.document).toBe(true);
+  expect(enabled.disabledAiFeatures.has("system.document")).toBe(false);
+});
+
+test("缺省预设时保留旧总开关行为", () => {
+  const disabled = applyAiRuntimePolicy(false, [document], undefined);
+  expect(disabled.disabledAiFeatures.has("system.document")).toBe(true);
+});

package/template/apps/server/src/system/ai-runtime-configuration.ts

@@ -0,0 +1,58 @@
+import { configureProjectAntivirus } from "../app/antivirus-composition.js";
+import { excludedAiRuntimes } from "./ai-runtime-build.js";
+import {
+  AI_RUNTIME_KINDS,
+  type FeatureFlagDefinition,
+  type EnvironmentPolicy,
+} from "@southwind-ai/shared";
+import { createEnvironmentPolicyReader } from "./environment-policy-reader.js";
+
+export async function resolveAiRuntimeConfiguration(
+  enableAI: boolean,
+  features: readonly FeatureFlagDefinition[],
+) {
+  const environmentPolicy = await createEnvironmentPolicyReader()();
+  if (environmentPolicy.status === "invalid")
+    throw new Error(environmentPolicy.message);
+  const policy =
+    environmentPolicy.status === "available"
+      ? environmentPolicy.policy
+      : undefined;
+  const settings = applyAiRuntimePolicy(enableAI, features, policy);
+  await configureProjectAntivirus(policy?.antivirus);
+  return settings;
+}
+
+export function applyAiRuntimePolicy(
+  enableAI: boolean,
+  features: readonly FeatureFlagDefinition[],
+  policy: EnvironmentPolicy | undefined,
+) {
+  const aiRuntimeSwitches = { ...policy?.runtime };
+  for (const kind of AI_RUNTIME_KINDS) {
+    const omitted =
+      excludedAiRuntimes.includes(kind) ||
+      !features.some(({ key }) => key === `system.${kind}`);
+    if (omitted && aiRuntimeSwitches[kind] === true) {
+      throw new Error(`环境预设启用了未随包交付的运行时：${kind}`);
+    }
+    if (!enableAI && aiRuntimeSwitches[kind] === true) {
+      throw new Error(
+        `环境预设启用了 ${kind}，但 PLATFORM_ENABLE_AI_RUNTIME 已关闭`,
+      );
+    }
+    if (omitted || policy?.build.runtimes?.[kind] === false)
+      aiRuntimeSwitches[kind] = false;
+  }
+  const disabledAiFeatures = new Set(
+    AI_RUNTIME_KINDS.filter(
+      (kind) => !enableAI || aiRuntimeSwitches?.[kind] === false,
+    ).map((kind) => `system.${kind}`),
+  );
+  if (
+    !enableAI ||
+    AI_RUNTIME_KINDS.every((kind) => aiRuntimeSwitches?.[kind] === false)
+  )
+    disabledAiFeatures.add("system.ai-artifact");
+  return { aiRuntimeSwitches, disabledAiFeatures };
+}

package/template/apps/server/src/system/diagnostic-routes.test.ts

@@ -67,6 +67,51 @@ describe("diagnostic lookup", () => {
       expect.objectContaining({ action: "diagnostic.read" }),
     );
 
+    const list = (query: Record<string, string>, guardContext = admin) =>
+      app.invoke("GET", "/system/diagnostics", {
+        guardContext,
+        params: {},
+        query,
+      }) as Promise<Response>;
+    expect((await list({}, anonymous)).status).toBe(403);
+    expect((await list({ pageSize: "0" })).status).toBe(400);
+    const older = diagnosticRecord(
+      {
+        diagnosticId: newDiagnosticId(),
+        requestId: "older",
+        service: "server",
+        stage: "http",
+        method: "GET",
+        route: "/api/resources",
+        statusCode: 503,
+        errorCode: "RUNTIME_UNAVAILABLE",
+      },
+      new Date(Date.now() - 1_000),
+    );
+    await index.record(older);
+    await index.record({
+      ...older,
+      diagnosticId: newDiagnosticId(),
+      expiresAt: older.occurredAt,
+    });
+    const firstPage = await list({ page: "1", pageSize: "1" });
+    expect(firstPage.headers.get("cache-control")).toBe("no-store");
+    expect(await firstPage.json()).toMatchObject({
+      total: 2,
+      items: [{ diagnosticId: id }],
+    });
+    const secondPage = await list({ page: "2", pageSize: "1" });
+    expect(await secondPage.json()).toMatchObject({
+      total: 2,
+      items: [{ requestId: "older" }],
+    });
+    expect(runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({
+        action: "diagnostic.read",
+        metadata: expect.objectContaining({ page: 2, pageSize: 1 }),
+      }),
+    );
+
     const expired = (await app.invoke("GET", route, {
       guardContext: admin,
       params: { diagnosticId: "diag-00000000-0000-7000-8000-000000000000" },

package/template/apps/server/src/system/diagnostic-routes.ts

@@ -5,6 +5,7 @@ import {
   validDiagnosticId,
   type DiagnosticIndex,
 } from "../observability/diagnostic-index.js";
+import { parsePagination } from "../pagination.js";
 import { findFeature } from "../route-guards.js";
 import { resourceEvent, routeContext } from "./route-helpers.js";
 import { withPermission } from "./resource-route-support.js";
@@ -18,6 +19,40 @@ export function registerDiagnosticRoutes(
 ) {
   const feature = findFeature(features, "system.diagnostics");
   if (!feature) throw new Error("错误诊断缺少 system.diagnostics Feature");
+  app.get("/system/diagnostics", (raw) => {
+    const { query, guardContext } = routeContext(raw);
+    return withPermission(
+      runtime,
+      guardContext,
+      "GET",
+      "diagnostics",
+      "read",
+      feature,
+      async () => {
+        const pagination = parsePagination(query);
+        if (pagination instanceof Response) return pagination;
+        try {
+          await runtime.auditSink.recordCriticalEvent(
+            resourceEvent(
+              guardContext,
+              "diagnostic.read",
+              "diagnostic-events",
+              undefined,
+              {
+                page: pagination.page,
+                pageSize: pagination.pageSize,
+              },
+            ),
+          );
+          return Response.json(await index.list(pagination), {
+            headers: { "cache-control": "no-store" },
+          });
+        } catch {
+          return failure("DIAGNOSTIC_INDEX_UNAVAILABLE", 503);
+        }
+      },
+    );
+  });
   app.get("/system/diagnostics/:diagnosticId", (raw) => {
     const { params, guardContext } = routeContext(raw);
     return withPermission(

package/template/apps/server/src/system/environment-policy-reader.test.ts

@@ -0,0 +1,74 @@
+import { parseEnvironmentPolicy } from "@southwind-ai/shared";
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createEnvironmentPolicyReader } from "./environment-policy-reader.js";
+
+test("bounded policy reader rejects invalid, oversized and symlink files without exposing contents", async () => {
+  const directory = await mkdtemp(join(tmpdir(), "windy-policy-"));
+  try {
+    const file = join(directory, "policy.yaml");
+    await writeFile(file, "private-secret-input");
+    const result = await createEnvironmentPolicyReader(file)();
+    expect(result.status).toBe("invalid");
+    expect(JSON.stringify(result)).not.toContain("private-secret-input");
+    await writeFile(file, " ".repeat(128 * 1024 + 1));
+    expect((await createEnvironmentPolicyReader(file)()).status).toBe(
+      "invalid",
+    );
+    await writeFile(
+      file,
+      "schemaVersion: 1\nbuild: { modules: [] }\nfeatures: []\n",
+    );
+    expect((await createEnvironmentPolicyReader(file)()).status).toBe(
+      "available",
+    );
+    const link = join(directory, "link");
+    await symlink(file, link);
+    expect((await createEnvironmentPolicyReader(link)()).status).toBe(
+      "invalid",
+    );
+    expect((await createEnvironmentPolicyReader(directory)()).status).toBe(
+      "invalid",
+    );
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test.skipIf(process.platform === "win32")(
+  "FIFO policy paths fail without waiting for a writer",
+  async () => {
+    const directory = await mkdtemp(join(tmpdir(), "windy-policy-fifo-"));
+    try {
+      const file = join(directory, "fifo");
+      const command = Bun.spawn(["mkfifo", file]);
+      expect(await command.exited).toBe(0);
+      expect((await createEnvironmentPolicyReader(file)()).status).toBe(
+        "invalid",
+      );
+    } finally {
+      await rm(directory, { recursive: true, force: true });
+    }
+  },
+  2000,
+);
+
+test("运行时开关保留显式关闭，拒绝未知能力和非布尔值", () => {
+  const base = { schemaVersion: 1, build: { modules: [] }, features: [] };
+  expect(parseEnvironmentPolicy(base).runtime).toBeUndefined();
+  const runtime = {
+    agent: false,
+    document: true,
+    speech: false,
+    embedding: false,
+  };
+  expect(parseEnvironmentPolicy({ ...base, runtime }).runtime).toEqual(runtime);
+  expect(() =>
+    parseEnvironmentPolicy({ ...base, runtime: { agent: "false" } }),
+  ).toThrow();
+  expect(() =>
+    parseEnvironmentPolicy({ ...base, runtime: { typo: true } }),
+  ).toThrow();
+});

package/template/apps/server/src/system/environment-policy-reader.ts

@@ -0,0 +1,62 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import {
+  parseEnvironmentPolicy,
+  type EnvironmentPolicy,
+} from "@southwind-ai/shared";
+
+/** Never return YAML contents or secrets in diagnostics. Reads are bounded even if a file grows. */
+export function createEnvironmentPolicyReader(
+  path = process.env.WINDY_ENVIRONMENT_PROFILE_FILE,
+) {
+  let cached: { at: number; result: EnvironmentPolicyRead } | undefined;
+  return async (): Promise<EnvironmentPolicyRead> => {
+    if (!path)
+      return {
+        status: "not-configured",
+        message: "未配置环境预设；不自动推断功能依赖。",
+      };
+    if (cached && Date.now() - cached.at < 5000) return cached.result;
+    let result: EnvironmentPolicyRead;
+    try {
+      const handle = await open(
+        path,
+        constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK,
+      );
+      try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() || metadata.size > 128 * 1024)
+          throw new Error("invalid file");
+        const buffer = Buffer.alloc(128 * 1024 + 1);
+        let bytesRead = 0;
+        while (bytesRead < buffer.length) {
+          const chunk = await handle.read(
+            buffer,
+            bytesRead,
+            buffer.length - bytesRead,
+            bytesRead,
+          );
+          if (chunk.bytesRead === 0) break;
+          bytesRead += chunk.bytesRead;
+        }
+        if (bytesRead > 128 * 1024) throw new Error("oversized");
+        const policy = parseEnvironmentPolicy(
+          Bun.YAML.parse(buffer.subarray(0, bytesRead).toString("utf8")),
+        );
+        result = { status: "available", policy };
+      } finally {
+        await handle.close();
+      }
+    } catch {
+      result = {
+        status: "invalid",
+        message: "环境预设不可读、超出大小限制或格式无效；未改变任何功能。",
+      };
+    }
+    cached = { at: Date.now(), result };
+    return result;
+  };
+}
+export type EnvironmentPolicyRead =
+  | { status: "available"; policy: EnvironmentPolicy }
+  | { status: "not-configured" | "invalid"; message: string };

package/template/apps/server/src/system/feature-environment-assessment.test.ts

@@ -0,0 +1,148 @@
+import { expect, test } from "bun:test";
+import { featureKey, type FeatureFlagDefinition } from "@southwind-ai/shared";
+import type { EnvironmentSnapshot } from "../../../../packages/shared/src/environment-assessment.js";
+import { parseEnvironmentPolicy } from "../../../../packages/shared/src/environment-policy.js";
+import {
+  assessFeatureEnvironment,
+  type FeatureAssessmentInput,
+} from "./feature-environment-assessment.js";
+
+const feature: FeatureFlagDefinition = {
+  key: featureKey("example.ocr"),
+  label: "CPU OCR",
+  module: "example",
+  enabled: true,
+  visible: "visible",
+  stage: "stable",
+};
+function input(): FeatureAssessmentInput {
+  return {
+    definitions: [feature],
+    resolveEnabled: async () => true,
+    environment: {
+      generatedAt: new Date().toISOString(),
+      process: {
+        scope: "process",
+        platform: "linux",
+        architecture: "arm64",
+        nodeVersion: "test",
+        containerized: true,
+        logicalCpuCount: 2,
+        memoryTotalBytes: 1024,
+      },
+      host: { status: "not-configured", message: "unknown" },
+    },
+  };
+}
+function policy(
+  execution: "cpu" | "local-gpu" | "remote" = "cpu",
+  extra: Record<string, unknown> = {},
+) {
+  return {
+    status: "available" as const,
+    policy: parseEnvironmentPolicy({
+      schemaVersion: 1,
+      build: { modules: ["system"] },
+      features: [{ key: "example.ocr", title: "OCR", execution, ...extra }],
+    }),
+  };
+}
+test("missing host GPU evidence is unknown; CPU OCR is not disabled by missing GPU", async () => {
+  expect(
+    (await assessFeatureEnvironment(policy("local-gpu"), input())).features[0]
+      ?.status,
+  ).toBe("unknown");
+  expect(
+    (await assessFeatureEnvironment(policy("cpu"), input())).features[0]
+      ?.status,
+  ).toBe("available");
+});
+test("software support and missing configuration are distinct from hardware", async () => {
+  expect(
+    (
+      await assessFeatureEnvironment(
+        policy("cpu", { supportedArchitectures: ["x64"] }),
+        input(),
+      )
+    ).features[0]?.status,
+  ).toBe("software");
+  const result = await assessFeatureEnvironment(
+    policy("remote", { requiredEnvironmentKeys: ["MODEL_TOKEN"] }),
+    input(),
+  );
+  expect(result.features[0]?.status).toBe("configuration");
+  const configured = {
+    ...input(),
+    environmentValues: { MODEL_TOKEN: "do-not-leak" },
+  };
+  expect(
+    JSON.stringify(
+      await assessFeatureEnvironment(
+        policy("remote", { requiredEnvironmentKeys: ["MODEL_TOKEN"] }),
+        configured,
+      ),
+    ),
+  ).not.toContain("do-not-leak");
+});
+test("remote execution does not require local GPU or local model memory", async () => {
+  const result = await assessFeatureEnvironment(
+    policy("remote", { minMemoryGiB: 64 }),
+    input(),
+  );
+  expect(result.features[0]?.status).toBe("available");
+});
+test("valid insufficient host memory is hardware; stale evidence cannot reject hardware", async () => {
+  const value = input();
+  value.environment.host = {
+    status: "available",
+    message: "fixture",
+    report: {
+      collectedAt: new Date().toISOString(),
+      facts: { memoryTotalBytes: 1024 ** 3 },
+    } as NonNullable<EnvironmentSnapshot["host"]["report"]>,
+  };
+  expect(
+    (await assessFeatureEnvironment(policy("cpu", { minMemoryGiB: 8 }), value))
+      .features[0]?.status,
+  ).toBe("hardware");
+  value.environment.host.status = "stale";
+  expect(
+    (await assessFeatureEnvironment(policy("cpu", { minMemoryGiB: 8 }), value))
+      .features[0]?.status,
+  ).toBe("unknown");
+});
+test("package absence, explicit disable and resolver failure retain distinct states", async () => {
+  expect(
+    (await assessFeatureEnvironment(policy(), { ...input(), definitions: [] }))
+      .features[0]?.status,
+  ).toBe("not-packaged");
+  expect(
+    (
+      await assessFeatureEnvironment(policy(), {
+        ...input(),
+        resolveEnabled: async () => false,
+      })
+    ).features[0]?.status,
+  ).toBe("disabled");
+  expect(
+    (
+      await assessFeatureEnvironment(policy(), {
+        ...input(),
+        resolveEnabled: async () => {
+          throw new Error("private");
+        },
+      })
+    ).features[0]?.status,
+  ).toBe("unknown");
+});
+test("unknown policy fields, duplicate feature keys and invalid booleans are rejected", () => {
+  expect(() => policy("cpu", { recommendedEnabled: "false" })).toThrow();
+  expect(() => policy("cpu", { secretlyEnable: true })).toThrow();
+  const parsed = policy().policy;
+  expect(() =>
+    parseEnvironmentPolicy({
+      ...parsed,
+      features: [...parsed.features, ...parsed.features],
+    }),
+  ).toThrow();
+});