@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.10

package/dist/ui/views.controller.js

@@ -8,17 +8,23 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { UI_LIMITS } from "@capybara-hq/plugin-sdk";
-import { Body, Controller, Get, HttpCode, Inject, Param, Post, Query, Req, Res, } from "@nestjs/common";
+import { Controller, Get, HttpCode, Inject, Post, Req, Res } from "@nestjs/common";
 import { z } from "zod";
-import { API_TOKENS, EMBED_TOKENS, ORG_UI_STREAMS, SESSIONS, UI_VIEWS } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
+import { ApiTokenService } from "../identity/api-tokens.js";
 import { credentialCheck } from "../identity/credential-check.js";
 import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { SessionService } from "../identity/sessions.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
-import { EMBED_TOKEN_TTL_SECONDS } from "./embed-token.js";
+import { EMBED_TOKEN_TTL_SECONDS, EmbedTokens } from "./embed-token.js";
+import { OrgUiStreams } from "./ui-stream.js";
+import { UiViews } from "./views.js";
 const BEARER_RE = /^Bearer\s+(\S+)$/i;
 const Locale = z.enum(["zh", "en"]).default("en");
 const Id = z.string().min(1).max(100);
+/** The contribution named in a view / action / embed path (`:plugin/:id`). */
+const ContributionParams = z.object({ plugin: Id, id: Id });
 const ViewQuery = z
     .object({
     conversationId: z.string().min(1).max(100).optional(),
@@ -65,6 +71,14 @@ const EmbedTokenBody = z
     .default({});
 /** 嵌入页的同源代理前缀（网页 `/plugin-ui/<plugin>/<rest>` → 内核 `/plugins/<plugin>/ui/<rest>`）。 */
 const embedSrc = (plugin, path) => `/plugin-ui/${plugin}/${path.replace(/^\/ui\//, "")}`;
+class UiContributionParamsDto extends createZodDto(ContributionParams, "UiContributionParams") {
+}
+class UiViewQueryDto extends createZodDto(ViewQuery, "UiViewQuery") {
+}
+class UiActionBodyDto extends createZodDto(ActionBody, "UiActionBody") {
+}
+class UiEmbedTokenBodyDto extends createZodDto(EmbedTokenBody, "UiEmbedTokenBody") {
+}
 /**
  * 插件界面（第一档：渲染 schema；第二档：嵌入应用），会话鉴权、`ui.use`（只给人用，服务令牌 403）：
  * - `GET  /api/v1/orgs/:orgId/ui/contributions` → `{ items: { plugin, id, title, place, legacyPlace?, kind, path?, icon }[] }`
@@ -102,7 +116,7 @@ let UiController = class UiController {
         requireUser(principal);
         return { items: await this.views.contributions(org.orgId, org.role) };
     }
-    async view(principal, org, plugin, id, q) {
+    async view(principal, org, { plugin, id }, q) {
         const p = requireUser(principal);
         const view = await this.views.render({
             orgId: org.orgId,
@@ -119,7 +133,7 @@ let UiController = class UiController {
         });
         return { view };
     }
-    async action(principal, org, plugin, id, body) {
+    async action(principal, org, { plugin, id }, body) {
         const p = requireUser(principal);
         return this.views.act({
             orgId: org.orgId,
@@ -135,7 +149,7 @@ let UiController = class UiController {
             ...(body.answer !== undefined && { answer: body.answer }),
         });
     }
-    async embedToken(principal, org, plugin, id, body) {
+    async embedToken(principal, org, { plugin, id }, body) {
         const p = requireUser(principal);
         const target = await this.views.embed({
             orgId: org.orgId,
@@ -202,10 +216,6 @@ let UiController = class UiController {
         res.flushHeaders();
         handle.begin();
     }
-    /** 停机：关闭本进程的全部组织刷新流。 */
-    onModuleDestroy() {
-        this.streams.closeAll();
-    }
 };
 __decorate([
     Get("contributions"),
@@ -218,9 +228,8 @@ __decorate([
     OrgAction("ui.use"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Param("plugin", new ZodPipe(Id))),
-    __param(3, Param("id", new ZodPipe(Id))),
-    __param(4, Query(new ZodPipe(ViewQuery)))
+    __param(2, ZParam(UiContributionParamsDto)),
+    __param(3, ZQuery(UiViewQueryDto))
 ], UiController.prototype, "view", null);
 __decorate([
     Post("actions/:plugin/:id"),
@@ -228,9 +237,8 @@ __decorate([
     OrgAction("ui.use"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Param("plugin", new ZodPipe(Id))),
-    __param(3, Param("id", new ZodPipe(Id))),
-    __param(4, Body(new ZodPipe(ActionBody)))
+    __param(2, ZParam(UiContributionParamsDto)),
+    __param(3, ZBody(UiActionBodyDto))
 ], UiController.prototype, "action", null);
 __decorate([
     Post("embeds/:plugin/:id/token"),
@@ -238,9 +246,8 @@ __decorate([
     OrgAction("ui.use"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Param("plugin", new ZodPipe(Id))),
-    __param(3, Param("id", new ZodPipe(Id))),
-    __param(4, Body(new ZodPipe(EmbedTokenBody)))
+    __param(2, ZParam(UiContributionParamsDto)),
+    __param(3, ZBody(UiEmbedTokenBodyDto))
 ], UiController.prototype, "embedToken", null);
 __decorate([
     Get("stream"),
@@ -252,10 +259,10 @@ __decorate([
 ], UiController.prototype, "stream", null);
 UiController = __decorate([
     Controller("api/v1/orgs/:orgId/ui"),
-    __param(0, Inject(UI_VIEWS)),
-    __param(1, Inject(ORG_UI_STREAMS)),
-    __param(2, Inject(SESSIONS)),
-    __param(3, Inject(API_TOKENS)),
-    __param(4, Inject(EMBED_TOKENS))
+    __param(0, Inject(UiViews)),
+    __param(1, Inject(OrgUiStreams)),
+    __param(2, Inject(SessionService)),
+    __param(3, Inject(ApiTokenService)),
+    __param(4, Inject(EmbedTokens))
 ], UiController);
 export { UiController };

package/dist/ui/views.d.ts

@@ -1,7 +1,12 @@
 import { type FormAnswer, type Logger, type UiActionResult, type UiContribution, type UiIcon, type UiView } from "@capybara-hq/plugin-sdk";
-import type { KernelDb } from "../db/kernel-schema.js";
-import type { ExtensionHost } from "../extensions/host.js";
+import { ConversationsService } from "../conversations/conversations.service.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { PreviewerRegistry } from "../files/previewers.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import type { OrgRole } from "../orgs/roles.js";
+export { callExtension } from "./call-extension.js";
 /** 插件 render / action 的时限（spec §4.2：慢的插件只让那个标签失败）。 */
 export declare const UI_CALL_TIMEOUT_MS = 5000;
 /** 列出贡献接口的一项。 */
@@ -29,42 +34,6 @@ export interface UiEmbedTarget {
     /** Only a `file-preview` embed: the one file the token is for. */
     fileId?: string;
 }
-export interface UiViewsDeps {
-    host: Pick<ExtensionHost, "uiContributions">;
-    /** Names of the extensions enabled in the organization (`extension_org_configs.enabled` plus required bootstrap plugins, `enabled.ts`), queried every time, not cached. */
-    enabledPlugins(orgId: string): Promise<Set<string>>;
-    /** 调用者能否访问这个对话（与会话 SSE 流同一判定）。 */
-    canAccessConversation(orgId: string, conversationId: string, accountId: string): Promise<boolean>;
-    /**
-     * Throws unless the caller may write to the conversation: a sub-agent's is read-only (409
-     * `conversation.read_only`, sub-agents spec §6.1). Checked before an action (final review m3).
-     */
-    checkWritable?(orgId: string, conversationId: string, accountId: string): Promise<void>;
-    /**
-     * A `file-preview` embed token: whether that extension's previewer with `embed: contribution`
-     * takes this file of the conversation (the viewer must read it; not found throws 404).
-     */
-    previewEmbedAllowed?(t: {
-        orgId: string;
-        accountId: string;
-        conversationId: string;
-        fileId: string;
-        plugin: string;
-        contribution: string;
-    }): Promise<boolean>;
-    /**
-     * The `card` a `tool_result` of this conversation recorded for `callId` (`ToolResult.card`), or
-     * null. An inline card request is served only when it matches (the card is attested by the log).
-     */
-    recordedCard?(conversationId: string, callId: string): Promise<{
-        plugin: string;
-        view: string;
-        key?: string;
-    } | null>;
-    log: Pick<Logger, "warn">;
-    /** 默认 {@link UI_CALL_TIMEOUT_MS}（测试可调小）。 */
-    timeoutMs?: number;
-}
 /** 取视图 / 执行动作的调用者与目标（身份来自内核鉴权）。 */
 export interface UiTarget {
     orgId: string;
@@ -87,7 +56,7 @@ export interface UiTarget {
  * The card a `tool_result` of the conversation recorded for `callId`, or null (the inline-card
  * attestation of {@link UiViewsDeps.recordedCard}). Scans one conversation's tool results.
  */
-export declare function recordedCard(db: KernelDb, conversationId: string, callId: string): Promise<{
+export declare function recordedCard(db: KernelSchemaDb, conversationId: string, callId: string): Promise<{
     plugin: string;
     view: string;
     key?: string;
@@ -106,12 +75,11 @@ export declare function dropForeignOpens(view: UiView, panels: ReadonlySet<strin
  * - 调用带 5 秒时限与中止信号：render 抛错 502 `ui.render_failed`、action 抛错 502 `ui.action_failed`、
  *   超时 504 `ui.timeout`、返回非法视图 502
  *   `ui.invalid_view`，都记告警日志、不写对话日志（这些不是模型可见的内容）。
- * 不依赖 Nest；不保存跨请求状态。
+ * 不保存跨请求状态。
  */
 export declare class UiViews {
     private readonly d;
-    private readonly timeoutMs;
-    constructor(d: UiViewsDeps);
+    constructor(host: ExtensionHost, conversations: ConversationsService, previewers: PreviewerRegistry, db: KernelDb, log: Pick<Logger, "warn">, effective: Pick<EffectiveConfigs, "get">);
     /** 该组织、该角色可见的界面贡献：插件已启用且已加载；kind view 的要求插件注册了 render；组织页面要 member 以上。 */
     contributions(orgId: string, role: OrgRole): Promise<UiContributionItem[]>;
     /**
@@ -138,18 +106,3 @@ export declare class UiViews {
     /** 非法结果：记告警（列出前几条问题）并 502 `ui.invalid_view`。 */
     private check;
 }
-/**
- * Calls an extension with a time limit and an abort signal (plugin views, actions and file
- * previewers): over the limit the signal aborts and the call is 504 `ui.timeout`; a throw is
- * `failCode` (502) without echoing the extension's message. An `ApiError` thrown by `fn` passes.
- */
-export declare function callExtension<T>(o: {
-    log: Pick<Logger, "warn">;
-    plugin: string;
-    what: string;
-    fields: Record<string, unknown>;
-    timeoutMs: number;
-    failCode: "ui.render_failed" | "ui.action_failed";
-    failMessage: string;
-    fn: (signal: AbortSignal) => Promise<T>;
-}): Promise<T>;

package/dist/ui/views.js

@@ -1,7 +1,25 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { normalizePlace, validateUiView, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
+import { ConversationsService } from "../conversations/conversations.service.js";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs, NEEDS_CONFIG_REASON } from "../extensions/effective-config.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { PreviewerRegistry } from "../files/previewers.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { callExtension } from "./call-extension.js";
 import { canUsePlace, isConversationPlace, UUID_RE } from "./registry.js";
+export { callExtension } from "./call-extension.js";
 /** 插件 render / action 的时限（spec §4.2：慢的插件只让那个标签失败）。 */
 export const UI_CALL_TIMEOUT_MS = 5_000;
 /**
@@ -79,14 +97,24 @@ function actionResultProblems(r) {
  * - 调用带 5 秒时限与中止信号：render 抛错 502 `ui.render_failed`、action 抛错 502 `ui.action_failed`、
  *   超时 504 `ui.timeout`、返回非法视图 502
  *   `ui.invalid_view`，都记告警日志、不写对话日志（这些不是模型可见的内容）。
- * 不依赖 Nest；不保存跨请求状态。
+ * 不保存跨请求状态。
  */
-export class UiViews {
+let UiViews = class UiViews {
     d;
-    timeoutMs;
-    constructor(d) {
-        this.d = d;
-        this.timeoutMs = d.timeoutMs ?? UI_CALL_TIMEOUT_MS;
+    constructor(host, conversations, previewers, db, log, effective) {
+        this.d = {
+            host,
+            effective,
+            // org config rows plus the required bootstrap plugins
+            enabledPlugins: (orgId) => host.enabledPlugins(orgId),
+            canAccessConversation: (orgId, id, accountId) => conversations.isAccessible(orgId, id, accountId),
+            checkWritable: async (orgId, id, accountId) => {
+                await conversations.writable(orgId, id, accountId);
+            },
+            previewEmbedAllowed: (t) => previewers.embedAllowed(t),
+            recordedCard: (conversationId, callId) => recordedCard(db.db, conversationId, callId),
+            log,
+        };
     }
     /** 该组织、该角色可见的界面贡献：插件已启用且已加载；kind view 的要求插件注册了 render；组织页面要 member 以上。 */
     async contributions(orgId, role) {
@@ -197,7 +225,18 @@ export class UiViews {
             throw notFound();
         if (!(await this.d.enabledPlugins(t.orgId)).has(t.plugin))
             throw notFound();
-        const base = { orgId: t.orgId, accountId: t.accountId, role: t.role, locale: t.locale };
+        // spec A §6: the extension is not called for an org whose effective config is not valid
+        const effective = await this.d.effective.get(t.orgId, t.plugin);
+        if (!effective.ok) {
+            throw new ApiError("extension.needs_config", `Extension ${t.plugin} ${NEEDS_CONFIG_REASON}`);
+        }
+        const base = {
+            orgId: t.orgId,
+            accountId: t.accountId,
+            role: t.role,
+            locale: t.locale,
+            config: effective.config,
+        };
         if (!isConversationPlace(entry.contribution.place)) {
             if (t.item !== undefined || t.card !== undefined) {
                 throw new ApiError("validation_failed", "item and callId are for conversation views");
@@ -248,7 +287,7 @@ export class UiViews {
             plugin: t.plugin,
             what,
             fields: { plugin: t.plugin, contribution: t.id, orgId: t.orgId },
-            timeoutMs: this.timeoutMs,
+            timeoutMs: UI_CALL_TIMEOUT_MS,
             failCode: what === "render" ? "ui.render_failed" : "ui.action_failed",
             failMessage: `Plugin ${t.plugin} failed to ${what} ${t.id}`,
             fn,
@@ -266,41 +305,14 @@ export class UiViews {
         });
         throw new ApiError("ui.invalid_view", `Plugin ${t.plugin} returned an invalid view`);
     }
-}
-/**
- * Calls an extension with a time limit and an abort signal (plugin views, actions and file
- * previewers): over the limit the signal aborts and the call is 504 `ui.timeout`; a throw is
- * `failCode` (502) without echoing the extension's message. An `ApiError` thrown by `fn` passes.
- */
-export async function callExtension(o) {
-    const ac = new AbortController();
-    let timer;
-    const timeout = new Promise((resolve) => {
-        timer = setTimeout(() => {
-            ac.abort(new Error(`plugin ui ${o.what} timed out`));
-            resolve("timeout");
-        }, o.timeoutMs);
-    });
-    try {
-        const r = await Promise.race([
-            Promise.resolve()
-                .then(() => o.fn(ac.signal))
-                .then((value) => ({ value })),
-            timeout,
-        ]);
-        if (r === "timeout") {
-            o.log.warn(`plugin ui ${o.what} timed out`, { ...o.fields, timeoutMs: o.timeoutMs });
-            throw new ApiError("ui.timeout", `Plugin ${o.plugin} did not respond within ${o.timeoutMs / 1000}s`);
-        }
-        return r.value;
-    }
-    catch (e) {
-        if (e instanceof ApiError)
-            throw e;
-        o.log.warn(`plugin ui ${o.what} failed`, { ...o.fields, err: e });
-        throw new ApiError(o.failCode, o.failMessage);
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
+};
+UiViews = __decorate([
+    Injectable(),
+    __param(0, Inject(ExtensionHost)),
+    __param(1, Inject(ConversationsService)),
+    __param(2, Inject(PreviewerRegistry)),
+    __param(3, Inject(KernelDb)),
+    __param(4, Inject(KERNEL_LOGGER)),
+    __param(5, Inject(EffectiveConfigs))
+], UiViews);
+export { UiViews };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.0",
+  "version": "0.1.0-rc.10",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -31,14 +31,22 @@
   ],
   "dependencies": {
     "@fastify/cookie": "^11.1.3",
+    "@fastify/static": "^9.3.0",
+    "@fastify/websocket": "^11.3.7",
     "@langchain/core": "^1.2.18",
     "@langchain/langgraph": "^1.5.1",
     "@langchain/langgraph-checkpoint": "^1.2.0",
+    "@nestjs/bullmq": "12.0.0",
     "@nestjs/common": "^12.1.3",
     "@nestjs/core": "^12.1.3",
     "@nestjs/platform-fastify": "^12.1.3",
+    "@nestjs/schedule": "12.0.2",
+    "@nestjs/swagger": "12.0.5",
+    "@nestjs/terminus": "12.1.0",
+    "@nestjs/throttler": "6.7.1",
     "ajv": "^8.20.0",
     "bullmq": "^6.3.15",
+    "cron": "4.4.0",
     "es-module-lexer": "2.3.2",
     "fastify": "5.12.5",
     "find-my-way": "9.9.0",
@@ -47,6 +55,8 @@
     "jose": "^6.2.12",
     "kysely": "^0.29.6",
     "pg": "^8.23.1",
+    "pino": "10.4.0",
+    "pino-pretty": "13.2.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "^7.8.2",
     "semver": "^7.8.5",
@@ -55,14 +65,16 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.0"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.7"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
     "@types/pg": "^8.23.1",
     "@types/semver": "^7.8.0",
+    "@types/ws": "^8.18.2",
     "@types/yauzl": "3.4.0",
-    "@capybara-hq/testing": "0.1.0-rc.0"
+    "ws": "^8.22.0",
+    "@capybara-hq/testing": "0.1.0-rc.10"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0063_tool_keys_claude_code.sql

@@ -0,0 +1,220 @@
+-- Tool naming (spec docs/superpowers/specs/2026-10-29-tool-naming-claude-code-design.md §8.2):
+-- the release candidates' tool keys in mutable state become the current keys. Builtins by the
+-- frozen map of packages/kernel/src/tools/legacy-keys.ts (LEGACY_BUILTINS); an rc `<x>__<tool>`
+-- key becomes `mcp__<x>__<tool>` when `x` is a connector of the row's org (or the row records its
+-- connector) and `plugin__<x>__<tool>` when `x` is an extension of the deployment
+-- (extension_installs, or extension_name_owners for config-declared ones); when both or neither,
+-- the row stays and the kernel's startup notice `tools.legacy_key_unmapped` counts it.
+-- Keys in the current format never match. A grant whose new key already exists for the same
+-- owner is left as it is (the primary key). Decided approvals and answered questions are
+-- history and stay. Logs and recordings are never rewritten (§8). Idempotent: a second run
+-- matches nothing it could change.
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE tool_grants g
+SET tool_key = m.new_key
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE g.tool_key = m.old_key
+  AND NOT EXISTS (
+    SELECT 1 FROM tool_grants x
+    WHERE x.org_id = g.org_id AND x.account_id = g.account_id AND x.agent_id = g.agent_id
+      AND x.tool_key = m.new_key
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE tool_grants g
+SET tool_key = CASE
+  WHEN g.connector_id IS NOT NULL OR (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = g.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(g.tool_key, '__', 1))
+    AND split_part(g.tool_key, '__', 1) NOT IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  ) THEN 'mcp__' || g.tool_key
+  ELSE 'plugin__' || g.tool_key
+END
+WHERE g.tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND g.tool_key !~ '^(mcp|plugin)__'
+  AND (
+    g.connector_id IS NOT NULL
+    OR (
+      EXISTS (SELECT 1 FROM connectors c
+              WHERE c.org_id = g.org_id AND c.deleted_at IS NULL
+                AND c.slug = split_part(g.tool_key, '__', 1))
+    ) <> (
+      split_part(g.tool_key, '__', 1) IN (
+        SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+    )
+  )
+  AND NOT EXISTS (
+    SELECT 1 FROM tool_grants x
+    WHERE x.org_id = g.org_id AND x.account_id = g.account_id AND x.agent_id = g.agent_id
+      AND x.tool_key IN ('mcp__' || g.tool_key, 'plugin__' || g.tool_key)
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE conversation_tool_grants g
+SET tool_key = m.new_key
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE g.tool_key = m.old_key
+  AND NOT EXISTS (
+    SELECT 1 FROM conversation_tool_grants x
+    WHERE x.conversation_id = g.conversation_id AND x.tool_key = m.new_key
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE conversation_tool_grants g
+SET tool_key = CASE
+  WHEN g.connector_id IS NOT NULL OR (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = v.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(g.tool_key, '__', 1))
+    AND split_part(g.tool_key, '__', 1) NOT IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  ) THEN 'mcp__' || g.tool_key
+  ELSE 'plugin__' || g.tool_key
+END
+FROM conversations v
+WHERE v.id = g.conversation_id
+  AND g.tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND g.tool_key !~ '^(mcp|plugin)__'
+  AND (
+    g.connector_id IS NOT NULL
+    OR (
+      EXISTS (SELECT 1 FROM connectors c
+              WHERE c.org_id = v.org_id AND c.deleted_at IS NULL
+                AND c.slug = split_part(g.tool_key, '__', 1))
+    ) <> (
+      split_part(g.tool_key, '__', 1) IN (
+        SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+    )
+  )
+  AND NOT EXISTS (
+    SELECT 1 FROM conversation_tool_grants x
+    WHERE x.conversation_id = g.conversation_id
+      AND x.tool_key IN ('mcp__' || g.tool_key, 'plugin__' || g.tool_key)
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys of pending approvals in place (resumed by run and call id, never by key)
+UPDATE approvals a
+SET tool_key = m.new_key
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE a.status = 'pending' AND a.tool_key = m.old_key;
+
+-- capybara:allow-destructive rewrites rc tool keys of pending approvals in place (resumed by run and call id, never by key)
+UPDATE approvals a
+SET tool_key = CASE
+  WHEN a.connector_id IS NOT NULL OR (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = a.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(a.tool_key, '__', 1))
+    AND split_part(a.tool_key, '__', 1) NOT IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  ) THEN 'mcp__' || a.tool_key
+  ELSE 'plugin__' || a.tool_key
+END
+WHERE a.status = 'pending'
+  AND a.tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND a.tool_key !~ '^(mcp|plugin)__'
+  AND (
+    a.connector_id IS NOT NULL
+    OR (
+      EXISTS (SELECT 1 FROM connectors c
+              WHERE c.org_id = a.org_id AND c.deleted_at IS NULL
+                AND c.slug = split_part(a.tool_key, '__', 1))
+    ) <> (
+      split_part(a.tool_key, '__', 1) IN (
+        SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+    )
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys of pending questions in place (resumed by run and call id, never by key)
+UPDATE questions q
+SET spec = jsonb_set(q.spec, '{toolKey}', to_jsonb(m.new_key))
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE q.status = 'pending' AND q.spec->>'toolKey' = m.old_key;
+
+-- capybara:allow-destructive rewrites rc tool keys of pending questions in place (resumed by run and call id, never by key)
+UPDATE questions q
+SET spec = jsonb_set(
+  q.spec,
+  '{toolKey}',
+  to_jsonb(CASE
+    WHEN EXISTS (SELECT 1 FROM connectors c
+                 WHERE c.org_id = q.org_id AND c.deleted_at IS NULL
+                   AND c.slug = split_part(q.spec->>'toolKey', '__', 1))
+    THEN 'mcp__' || (q.spec->>'toolKey')
+    ELSE 'plugin__' || (q.spec->>'toolKey')
+  END)
+)
+WHERE q.status = 'pending'
+  AND q.spec->>'toolKey' ~ '^[a-z0-9][a-z0-9_-]*__.' AND q.spec->>'toolKey' !~ '^(mcp|plugin)__'
+  AND (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = q.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(q.spec->>'toolKey', '__', 1))
+  ) <> (
+    split_part(q.spec->>'toolKey', '__', 1) IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  );
+
+-- What the startup notice counts (rows the statements above could not map), each over a partial
+-- index holding only such rows, so the count at every start reads nearly empty indexes. The
+-- predicate is the one of countLegacyToolKeys (packages/kernel/src/tools/legacy-data.ts).
+CREATE INDEX IF NOT EXISTS tool_grants_legacy_key_idx ON tool_grants (org_id)
+  WHERE (tool_key = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write', 'sandbox_edit',
+    'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write', 'ask_user',
+    'read_tool_output', 'tool_search', 'agent']::text[])
+    OR (tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND tool_key !~ '^(mcp|plugin)__'));
+CREATE INDEX IF NOT EXISTS conversation_tool_grants_legacy_key_idx
+  ON conversation_tool_grants (conversation_id)
+  WHERE (tool_key = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write', 'sandbox_edit',
+    'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write', 'ask_user',
+    'read_tool_output', 'tool_search', 'agent']::text[])
+    OR (tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND tool_key !~ '^(mcp|plugin)__'));
+CREATE INDEX IF NOT EXISTS approvals_legacy_key_idx ON approvals (org_id)
+  WHERE status = 'pending'
+    AND (tool_key = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write', 'sandbox_edit',
+    'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write', 'ask_user',
+    'read_tool_output', 'tool_search', 'agent']::text[])
+    OR (tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND tool_key !~ '^(mcp|plugin)__'));
+CREATE INDEX IF NOT EXISTS questions_legacy_key_idx ON questions (org_id)
+  WHERE status = 'pending'
+    AND ((spec->>'toolKey') = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write',
+    'sandbox_edit', 'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write',
+    'ask_user', 'read_tool_output', 'tool_search', 'agent']::text[])
+    OR ((spec->>'toolKey') ~ '^[a-z0-9][a-z0-9_-]*__.' AND (spec->>'toolKey') !~ '^(mcp|plugin)__'));
+
+-- Read before Write / Edit (spec §4.5): EventLog.latestFileState reads the latest tool_result of
+-- a conversation whose view names a file, on every Write and Edit. Without this index it scans
+-- the conversation's events backwards through the primary key, filtering each payload (EXPLAIN
+-- on a 20 000-event conversation: every row removed by the filter for a path never read); with
+-- it, one index probe. Partial: only tool_result rows. Built without CONCURRENTLY (a migration
+-- runs in one transaction), which locks conversation_events against writes while it builds: this
+-- assumes release-candidate-sized event tables, as the event indexes of 0025 and 0040 did. A
+-- deployment with a large table builds it CONCURRENTLY by hand before upgrading; IF NOT EXISTS
+-- then skips it here.
+CREATE INDEX IF NOT EXISTS conversation_events_file_state_idx
+  ON conversation_events (conversation_id, ((payload->'view'->'file'->>'path')), seq DESC)
+  WHERE type = 'tool_result';

package/src/migrations/0064_account_last_org.sql

@@ -0,0 +1,7 @@
+-- The organization an account last chose as its current one: a new web session (login, SSO, setup,
+-- an accepted invitation) starts in it while the account is still a member and the org is not
+-- deleted, so people don't pick their org again at every sign-in. Written with the session's
+-- current org by `PUT /me/current-org`; NULL = never chosen (a new session then starts in the only
+-- org when there is exactly one). Additive: older replicas never read or write it.
+ALTER TABLE capybara.accounts
+  ADD COLUMN IF NOT EXISTS last_org_id text REFERENCES capybara.orgs(id) ON DELETE SET NULL;