@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/tools/outputs.js

@@ -1,6 +1,18 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomUUID } from "node:crypto";
 import { ToolError } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 /** 文本行数（按 `\n` 切分；空串算 1 行，与按行分页读取一致）。 */
 export function countLines(s) {
     let n = 1;
@@ -10,9 +22,10 @@ export function countLines(s) {
 }
 /**
  * 输出存档（spec 5.4）：超大工具结果的全文存进 `capybara.tool_outputs`，保留 `tools.outputRetentionDays` 天。
- * 只能在产生它的会话里读取（同组织别的会话也不行：会话之间可见范围不同），过期即视为不存在（清理由维护任务负责）。
+ * 只能在产生它的会话里读取（同组织别的会话也不行：会话之间可见范围不同），过期即视为不存在（清理由
+ * `output-cleanup` 每小时一次，见 {@link deleteExpiredOutputs}）。
  */
-export class ToolOutputs {
+let ToolOutputs = class ToolOutputs {
     db;
     config;
     constructor(db, config) {
@@ -23,7 +36,7 @@ export class ToolOutputs {
         const id = randomUUID();
         const sizeChars = a.content.length;
         const lineCount = countLines(a.content);
-        const days = this.config().tools.outputRetentionDays;
+        const days = this.config.get().tools.outputRetentionDays;
         await this.db
             .insertInto("tool_outputs")
             .values({
@@ -51,6 +64,37 @@ export class ToolOutputs {
             .executeTakeFirst();
         return row?.content ?? null;
     }
+};
+ToolOutputs = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(KernelConfigService))
+], ToolOutputs);
+export { ToolOutputs };
+/** Rows deleted per statement by {@link deleteExpiredOutputs}. */
+export const OUTPUT_CLEANUP_BATCH = 1000;
+/**
+ * 删除已过期（`expires_at < now()`）的输出存档，每批 `batch` 行，直到删完；返回删除的总行数。
+ * 每批一条独立语句（不开长事务）；多个 worker 同时清理时 `SKIP LOCKED` 互不等待。
+ */
+export async function deleteExpiredOutputs(db, batch = OUTPUT_CLEANUP_BATCH) {
+    let total = 0;
+    for (;;) {
+        const r = await db
+            .deleteFrom("tool_outputs")
+            .where("id", "in", db
+            .selectFrom("tool_outputs")
+            .select("id")
+            .where("expires_at", "<", sql `now()`)
+            .limit(batch)
+            .forUpdate()
+            .skipLocked())
+            .executeTakeFirst();
+        const n = Number(r.numDeletedRows);
+        total += n;
+        if (n < batch)
+            return total;
+    }
 }
 /** 存档不存在 / 过期 / 不属于本会话（模型可见，英文；不区分几种情况，不泄露别处的存档是否存在）。 */
 export const outputNotFoundText = (id) => `Output ${id} not found or expired. Run the tool that produced it again to get a new output id.`;

package/dist/tools/pipeline.d.ts

@@ -1,20 +1,24 @@
 import { type FormAnswer, type InputForm, type Logger } from "@capybara-hq/plugin-sdk";
-import type { Transaction } from "kysely";
 import { type AgentDefinition } from "../agents/definition.js";
-import type { KernelConfig } from "../config/schema.js";
-import type { EventLog } from "../conversations/event-log.js";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
+import { EventLog } from "../conversations/event-log.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { OrgRole } from "../orgs/roles.js";
 import { type ConversationKindForHooks, type HookRunner } from "../runtime/hook-calls.js";
 import { type SubagentParent, type WaitingFor } from "../runtime/loop.js";
 import type { DispatchOutcome } from "../runtime/subagents/dispatch.js";
-import type { ApprovalsService } from "./approvals.service.js";
-import { type Breaker } from "./breaker.js";
+import { SubagentsService } from "../runtime/subagents/subagents.service.js";
+import { ApprovalsService } from "./approvals.service.js";
+import { Breaker } from "./breaker.js";
 import { type AgentToolInputT } from "./builtins/agent.js";
-import { type Credentials } from "./credentials.js";
-import { type ToolOutputs } from "./outputs.js";
-import type { QuestionsService } from "./questions.service.js";
-import type { ResolvedTool, ToolRegistry } from "./registry.js";
+import { Credentials } from "./credentials.js";
+import { ToolDrift } from "./drift.js";
+import { ToolOutputs } from "./outputs.js";
+import { QuestionsService } from "./questions.service.js";
+import { type ResolvedTool, ToolRegistry } from "./registry.js";
 /** 审批被拒绝。 */
 export declare const APPROVAL_DENIED_TEXT = "The user denied this tool call.";
 /**
@@ -94,55 +98,63 @@ export interface PolicyContext {
 }
 /** 管线第 3 阶段：策略判定。 */
 export type DecidePolicy = (tool: ResolvedTool, agentDef: AgentDefinition, ctx: PolicyContext) => Promise<PolicyDecision>;
-/** 测试钩子。 */
+/** The pipeline's test seams (`TOOL_PIPELINE_HOOKS`; the kernel never provides them). */
 export interface ToolPipelineHooks {
-    /** 工具执行返回之后、结果写入日志之前调用：抛错即模拟「工具已执行、结果未记录」时进程崩溃。 */
+    /**
+     * Called after a tool returned and before its result is logged: throwing simulates a crash
+     * between the execution and the record ("executed, result not recorded").
+     */
     afterExecute?(runId: string, callId: string): Promise<void>;
+    /** The policy decision; default {@link createDecidePolicy} (reads policies and grants live). */
+    decidePolicy?: DecidePolicy;
 }
-export interface ToolPipelineDeps {
-    db: KernelDb;
-    eventLog: EventLog;
-    registry: Pick<ToolRegistry, "forAgent" | "findConnector" | "handler">;
-    credentials: Pick<Credentials, "injection" | "onUnauthorized">;
-    breaker: Pick<Breaker, "check" | "failure" | "success">;
-    outputs: Pick<ToolOutputs, "save" | "load">;
+/** Optional provider: the pipeline's {@link ToolPipelineHooks} (tests). */
+export declare const TOOL_PIPELINE_HOOKS: unique symbol;
+/** What the pipeline calls through (the sub-agent dispatch is read at call time). */
+interface PipelineDeps {
+    /** The kernel-schema handle of the current context (its transaction, else the pool). */
+    readonly db: KernelSchemaDb;
+    readonly eventLog: EventLog;
+    readonly registry: Pick<ToolRegistry, "forAgent" | "findConnector" | "handler">;
+    readonly credentials: Pick<Credentials, "injection" | "onUnauthorized">;
+    readonly breaker: Pick<Breaker, "check" | "failure" | "success">;
+    readonly outputs: Pick<ToolOutputs, "save" | "load">;
     /** 策略为 `ask` 时建审批；续跑时读该调用的审批结果。 */
-    approvals: Pick<ApprovalsService, "request" | "forCall">;
+    readonly approvals: Pick<ApprovalsService, "request" | "forCall">;
     /** 处理函数返回 `input_required` 时建输入请求；续跑时读该调用的各轮输入请求。 */
-    questions: Pick<QuestionsService, "ask" | "forCall">;
-    config: () => KernelConfig;
-    log: Logger;
-    /** 默认 {@link createDecidePolicy}（执行时实时读取策略与授权）。 */
-    decidePolicy?: DecidePolicy;
-    hooks?: ToolPipelineHooks;
+    readonly questions: Pick<QuestionsService, "ask" | "forCall">;
+    readonly log: Logger;
+    readonly hooks: ToolPipelineHooks | undefined;
     /**
      * Plugin hooks (`tool.preExecute` policy / observe after policy and approval, `tool.postExecute`
-     * observe after the result). Only the chat pipeline gets it; the eval replay uses
+     * observe after the result). Only the chat pipeline has them; the eval replay uses
      * `RecordedToolPipeline`, which never runs hooks. Also needs `conversationKind: "chat"` (P-18).
      */
-    pluginHooks?: HookRunner;
+    readonly pluginHooks: HookRunner | undefined;
     /**
-     * Ids of an extension's `inline` ui contributions (read live): a plugin tool's `ToolResult.card`
-     * must name one of them, otherwise it is dropped with a warning. Absent: cards are dropped.
+     * Ids of an extension's `inline` ui contributions (read live, no alias): a plugin tool's
+     * `ToolResult.card` must name one of them, otherwise it is dropped with a warning.
      */
-    inlineViews?: (plugin: string) => ReadonlySet<string>;
+    inlineViews(plugin: string): ReadonlySet<string>;
     /**
      * 连接器在调用途中报告工具清单变了（MCP `notifications/tools/list_changed`）：内核安排一次该连接器的漂移检查。
      * 不等待、不抛错（实现自己吞掉错误）。
      */
-    onToolsChanged?: (orgId: string, connectorId: string) => void;
+    onToolsChanged(orgId: string, connectorId: string): void;
     /**
      * Dispatches the sub-agent of an `agent` call (sub-agents spec §7.1; `dispatchSubagent`). Without
      * it, `agent` calls reach the builtin's guard, which refuses them.
      */
-    subagents?: {
+    readonly subagents: {
         dispatch(a: {
             ctx: ToolStepContext;
             callId: string;
             input: AgentToolInputT;
         }): Promise<DispatchOutcome>;
-    };
+    } | undefined;
 }
+/** The sub-agent dispatch the pipeline calls (`SubagentsService.dispatch`). */
+export type SubagentDispatch = NonNullable<PipelineDeps["subagents"]>["dispatch"];
 /** tools 节点处理一步工具调用所需的上下文。 */
 export interface ToolStepContext {
     orgId: string;
@@ -204,13 +216,6 @@ export type ExecOutcome =
     connectorName: string;
     message: string;
 };
-type KernelTrx = Transaction<KernelDatabase>;
-/**
- * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
- * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
- * approval); the timeout is a safety net.
- */
-export declare function subagentsWait(runId: string, step: number, config: Pick<KernelConfig, "tools" | "runtime">, now?: number): WaitingFor;
 /**
  * 工具执行管线（spec 5.4 / 6.2）：每个阶段是独立函数——
  * `resolveOutputRefs` → `validateInput` → `decidePolicy` → `execute`（超时、熔断）→ `renderResult` / `spillIfLarge`
@@ -219,9 +224,15 @@ export declare function subagentsWait(runId: string, step: number, config: Pick<
  * 有副作用不盲目重跑（spec 4.3）：执行前写 `tool_call_started`；续跑时「有开始无结果」的调用记为结果未知，不再执行。
  */
 export declare class ToolPipeline {
-    private readonly deps;
+    private readonly config;
+    readonly txHost: TransactionHost;
     private readonly decide;
-    constructor(deps: ToolPipelineDeps);
+    private readonly deps;
+    constructor(kdb: KernelDb, eventLog: EventLog, 
+    /** The `agent` tool's sub-agent dispatch; absent (tests): `agent` calls are refused. */
+    subagents: Pick<SubagentsService, "dispatch"> | undefined, registry: Pick<ToolRegistry, "forAgent" | "findConnector" | "handler">, credentials: Pick<Credentials, "injection" | "onUnauthorized">, breaker: Pick<Breaker, "check" | "failure" | "success">, outputs: Pick<ToolOutputs, "save" | "load">, approvals: Pick<ApprovalsService, "request" | "forCall">, questions: Pick<QuestionsService, "ask" | "forCall">, config: Pick<KernelConfigService, "get">, log: Logger, 
+    /** Plugin hooks and inline ui contributions; absent (tests): no hooks, cards dropped. */
+    host: Pick<ExtensionHost, "hooks" | "current"> | undefined, drift: Pick<ToolDrift, "onToolsChanged"> | undefined, txHost: TransactionHost, hooks?: ToolPipelineHooks);
     /**
      * tools 节点：按顺序处理本步 assistant 消息里的全部 `tool_call`，每个调用都以一条 `tool_result` 结束
      * （之后才回到 prepare 构建下一次请求，保持「已记录调用、未记录结果之间不构建请求」的不变式）。
@@ -241,19 +252,22 @@ export declare class ToolPipeline {
      * result, from the replica that writes it (spec §11).
      */
     private finishAgentCall;
+    /** {@link stopOpenAgentCalls} in a transaction of its own (a stop seen by the tools node). */
+    private stopOpenAgentCallsNow;
     /**
-     * Writes, in `t`, the `tool_result` of every open `agent` call of a run that is being stopped
+     * Writes, in the caller's transaction (`mandatory`), the `tool_result` of every open `agent` call
+     * of a run that is being stopped
      * (sub-agents spec §12: a person stopped it while it waited on sub-agents, or its deadline or a
      * stop hit its tools node after a dispatch). A call whose child already ended gets the child's
      * result (and the missing `subagent_finished`); one whose child is still active gets
      * {@link AGENT_STOPPED_WITH_RUN_TEXT}. The caller stops those children after its commit.
      *
-     * Like every `agent` result (see {@link finishAgentCall}), each is audited `tool.called` in `t`
+     * Like every `agent` result (see {@link finishAgentCall}), each is audited `tool.called` in it
      * (duration: the child's, or the time since the dispatch) and fires `tool.postExecute`, through
      * `fire()`, which the caller runs after its commit. Returns the steps and calls written (the
      * caller must not write a "not executed" result for them) and the highest seq written.
      */
-    stopOpenAgentCalls(t: KernelTrx, runId: string, agent?: AgentDefinition): Promise<{
+    stopOpenAgentCalls(runId: string, agent?: AgentDefinition): Promise<{
         steps: number[];
         callIds: Set<string>;
         toSeq: number | null;
@@ -318,5 +332,7 @@ export declare class ToolPipeline {
      * 放行依据（审批人 / 授权 / 策略）。不含参数、结果与凭据。
      */
     private writeResult;
+    /** The result's events and audit rows in one transaction (see {@link writeResult}). */
+    private writeResultIn;
 }
 export {};

package/dist/tools/pipeline.js

@@ -1,25 +1,47 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { ToolError, validateInputForm, validateToolDisplay, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Optional } from "@nestjs/common";
 import { normalizeStoredDefinition } from "../agents/definition.js";
+import { EventLog } from "../conversations/event-log.js";
 import { ToolViewSchema } from "../conversations/events.js";
 import { clipText } from "../extensions/hooks.js";
+import { ExtensionHost } from "../extensions/host.js";
 import { ExtensionUnloadedError, PLUGIN_UNLOADED_TOOL_ERROR } from "../extensions/inflight.js";
 import { audit } from "../identity/audit.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { UNKNOWN_RESULT_TEXT } from "../runtime/context/pairing.js";
 import { fireObserve, hookDeniedAudit, hookDeniedEvent, hookScope, } from "../runtime/hook-calls.js";
-import { subagentsWaitId, subagentWaitingIdemKey, } from "../runtime/loop.js";
+import { subagentsWait, subagentWaitingIdemKey, } from "../runtime/loop.js";
 import { assistantIdemKey, MAX_MODEL_ATTEMPTS, modelCallIdemKey } from "../runtime/model-call.js";
 import { TERMINAL_STATUSES } from "../runtime/run-finish.js";
 import { childResult, dispatchOfCall, finishedEvent, } from "../runtime/subagents/child.js";
 import { forkSeqOfCall, pairStoppedForks } from "../runtime/subagents/skill-fork.js";
+import { SubagentsService } from "../runtime/subagents/subagents.service.js";
 import { skillLoadOfferedIn } from "../skills/catalog.js";
-import { breakerOpenMessage } from "./breaker.js";
+import { ApprovalsService } from "./approvals.service.js";
+import { Breaker, breakerOpenMessage } from "./breaker.js";
 import { AGENT_STOPPED_WITH_RUN_TEXT, AGENT_TOOL, AgentToolInput, } from "./builtins/agent.js";
 import { isAlwaysLoaded, notLoadedText } from "./builtins/tool-search.js";
-import { CredentialMissing } from "./credentials.js";
+import { CredentialMissing, Credentials } from "./credentials.js";
+import { ToolDrift } from "./drift.js";
 import { ElicitationSession } from "./elicitation.js";
-import { renderResult, resolveOutputRefs, spillIfLarge } from "./outputs.js";
+import { renderResult, resolveOutputRefs, spillIfLarge, ToolOutputs } from "./outputs.js";
 import { createDecidePolicy } from "./policy.js";
+import { QuestionsService } from "./questions.service.js";
 import { redactDeep, redactorFor } from "./redact.js";
+import { ToolRegistry, } from "./registry.js";
 import { runResourceTool } from "./resources.js";
 import { validateInput } from "./validate.js";
 // ---- 模型可见文案（英文） ----
@@ -60,22 +82,10 @@ const invalidFormText = (key, problems) => `Tool ${key} returned an invalid inpu
 const stateTooLargeText = (key) => `Tool ${key} returned input state larger than ${MAX_INPUT_STATE_BYTES / 1024} KB.`;
 const personalMissingText = (connectorName) => `The user has not connected ${connectorName}. A connect card was shown; ask the user to connect, then retry.`;
 const orgMissingText = (connectorName) => `${connectorName} has no organization credential configured; ask an organization admin to set it up.`;
+/** Optional provider: the pipeline's {@link ToolPipelineHooks} (tests). */
+export const TOOL_PIPELINE_HOOKS = Symbol("TOOL_PIPELINE_HOOKS");
 /** `runCall` dispatched a sub-agent: the call stays open until the child run finishes. */
 const OPEN = "open";
-/**
- * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
- * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
- * approval); the timeout is a safety net.
- */
-export function subagentsWait(runId, step, config, now = Date.now()) {
-    const ms = config.tools.approvalTimeoutHours * 3_600_000 + config.runtime.maxRunSeconds * 1000 + 600_000;
-    return {
-        kind: "subagents",
-        id: subagentsWaitId(runId, step),
-        expiresAt: new Date(now + ms).toISOString(),
-        step,
-    };
-}
 const approvalAuthorization = (a) => ({
     approvalId: a.id,
     approvedByAccountId: a.decidedBy,
@@ -143,12 +153,47 @@ const inputWait = (q) => ({
  *
  * 有副作用不盲目重跑（spec 4.3）：执行前写 `tool_call_started`；续跑时「有开始无结果」的调用记为结果未知，不再执行。
  */
-export class ToolPipeline {
-    deps;
+let ToolPipeline = class ToolPipeline {
+    config;
+    txHost;
     decide;
-    constructor(deps) {
-        this.deps = deps;
-        this.decide = deps.decidePolicy ?? createDecidePolicy(deps.db);
+    deps;
+    constructor(kdb, eventLog, 
+    /** The `agent` tool's sub-agent dispatch; absent (tests): `agent` calls are refused. */
+    subagents, registry, credentials, breaker, outputs, approvals, questions, config, log, 
+    /** Plugin hooks and inline ui contributions; absent (tests): no hooks, cards dropped. */
+    host, drift, txHost, hooks) {
+        this.config = config;
+        this.txHost = txHost;
+        this.deps = {
+            get db() {
+                return kdb.db;
+            },
+            eventLog,
+            registry,
+            credentials,
+            breaker,
+            outputs,
+            approvals,
+            questions,
+            log,
+            hooks,
+            get pluginHooks() {
+                return host?.hooks;
+            },
+            inlineViews: (plugin) => new Set((host?.current(plugin)?.manifest.ui ?? [])
+                .filter((c) => c.place === "inline" && c.aliasOf === undefined)
+                .map((c) => c.id)),
+            onToolsChanged: (orgId, connectorId) => {
+                void drift?.onToolsChanged(orgId, connectorId);
+            },
+            get subagents() {
+                return subagents ? { dispatch: (a) => subagents.dispatch(a) } : undefined;
+            },
+        };
+        const decide = hooks?.decidePolicy;
+        // the default policy reads live, on the context's handle
+        this.decide = decide ?? ((tool, def, c) => createDecidePolicy(kdb.db)(tool, def, c));
     }
     /**
      * tools 节点：按顺序处理本步 assistant 消息里的全部 `tool_call`，每个调用都以一条 `tool_result` 结束
@@ -203,9 +248,7 @@ export class ToolPipeline {
             // their calls get their results now, and the children are stopped after the run's terminal
             // commit (spec §12)
             if (ctx.signal.aborted) {
-                const stopped = await this.deps.db
-                    .transaction()
-                    .execute((t) => this.stopOpenAgentCalls(t, ctx.runId, ctx.agent));
+                const stopped = await this.stopOpenAgentCallsNow(ctx.runId, ctx.agent);
                 if (stopped.toSeq !== null) {
                     await eventLog.notify(ctx.conversationId, stopped.toSeq);
                 }
@@ -214,7 +257,7 @@ export class ToolPipeline {
             }
             return {
                 kind: "suspended",
-                waitingFor: subagentsWait(ctx.runId, ctx.step, this.deps.config()),
+                waitingFor: subagentsWait(ctx.runId, ctx.step, this.config.get()),
             };
         }
         return { kind: "done" };
@@ -268,19 +311,25 @@ export class ToolPipeline {
         }
         return true;
     }
+    /** {@link stopOpenAgentCalls} in a transaction of its own (a stop seen by the tools node). */
+    async stopOpenAgentCallsNow(runId, agent) {
+        return this.stopOpenAgentCalls(runId, agent);
+    }
     /**
-     * Writes, in `t`, the `tool_result` of every open `agent` call of a run that is being stopped
+     * Writes, in the caller's transaction (`mandatory`), the `tool_result` of every open `agent` call
+     * of a run that is being stopped
      * (sub-agents spec §12: a person stopped it while it waited on sub-agents, or its deadline or a
      * stop hit its tools node after a dispatch). A call whose child already ended gets the child's
      * result (and the missing `subagent_finished`); one whose child is still active gets
      * {@link AGENT_STOPPED_WITH_RUN_TEXT}. The caller stops those children after its commit.
      *
-     * Like every `agent` result (see {@link finishAgentCall}), each is audited `tool.called` in `t`
+     * Like every `agent` result (see {@link finishAgentCall}), each is audited `tool.called` in it
      * (duration: the child's, or the time since the dispatch) and fires `tool.postExecute`, through
      * `fire()`, which the caller runs after its commit. Returns the steps and calls written (the
      * caller must not write a "not executed" result for them) and the highest seq written.
      */
-    async stopOpenAgentCalls(t, runId, agent) {
+    async stopOpenAgentCalls(runId, agent) {
+        const t = this.deps.db;
         // phase D: the run's fork invocation without a report gets one (a fork has no tool call)
         const forks = await pairStoppedForks(t, this.deps.eventLog, runId);
         const none = {
@@ -395,7 +444,7 @@ export class ToolPipeline {
         }
         if (calls.length === 0)
             return none;
-        const written = await this.deps.eventLog.append(conversationId, events, t);
+        const written = await this.deps.eventLog.appendIn(conversationId, events);
         for (const c of calls) {
             const approval = await t
                 .selectFrom("approvals")
@@ -719,7 +768,7 @@ export class ToolPipeline {
         const card = outcome.kind === "result" && tool.source.kind === "plugin"
             ? this.cardOf(outcome.result, tool.source.plugin, tool.key)
             : undefined;
-        const cfg = this.deps.config().tools;
+        const cfg = this.config.get().tools;
         const spilled = await spillIfLarge(rendered.text, {
             // 内置工具可给更低的转存阈值（沙箱 bash 30000 字符）
             spillChars: Math.min(cfg.outputSpillChars, tool.spillChars ?? Number.POSITIVE_INFINITY),
@@ -880,7 +929,7 @@ export class ToolPipeline {
                 ctx.parent !== undefined && { sandboxConversationId: ctx.parent.conversationId }),
         };
         // 内置工具可按输入给自己的时限（沙箱 bash 按命令超时加余量）；缺省 tools.timeoutMs
-        const timeoutMs = tool.timeoutMs?.(input) ?? this.deps.config().tools.timeoutMs;
+        const timeoutMs = tool.timeoutMs?.(input) ?? this.config.get().tools.timeoutMs;
         try {
             const r = await this.bounded(ctx.signal, (signal) => handler(input, { ...base, signal }), undefined, timeoutMs);
             if (r === "timeout") {
@@ -898,7 +947,7 @@ export class ToolPipeline {
         }
     }
     async executeConnector(tool, source, input, ctx, resume) {
-        const { db, registry, breaker, credentials, config } = this.deps;
+        const { db, registry, breaker, credentials } = this.deps;
         const { orgId } = ctx;
         const connectorId = source.connectorId;
         const app = await db
@@ -1011,7 +1060,7 @@ export class ToolPipeline {
                     onElicit: elicit.handle,
                     onToolsChanged: () => {
                         try {
-                            this.deps.onToolsChanged?.(orgId, connectorId);
+                            this.deps.onToolsChanged(orgId, connectorId);
                         }
                         catch (err) {
                             this.deps.log.warn("tools changed notification failed", {
@@ -1037,7 +1086,7 @@ export class ToolPipeline {
                 return ask;
             if (r === "timeout") {
                 await breaker.failure(orgId, connectorId);
-                return { kind: "error", message: timeoutText(tool.key, config().tools.timeoutMs) };
+                return { kind: "error", message: timeoutText(tool.key, this.config.get().tools.timeoutMs) };
             }
             // 工具自己报告的错误（isError）说明服务可用，也算成功。
             await breaker.success(orgId, connectorId);
@@ -1084,7 +1133,7 @@ export class ToolPipeline {
     /** 额外参与竞速的信号（不传给 work）：中止时以 `Stopped` 抛出，由调用方判断原因。 */
     interrupt, 
     /** 时限（毫秒），缺省 `tools.timeoutMs`。 */
-    timeoutMs = this.deps.config().tools.timeoutMs) {
+    timeoutMs = this.config.get().tools.timeoutMs) {
         if (runSignal.aborted)
             return "aborted";
         const timeout = new AbortController();
@@ -1157,7 +1206,7 @@ export class ToolPipeline {
         if (c === undefined)
             return undefined;
         const x = (typeof c === "object" && c !== null ? c : {});
-        const views = this.deps.inlineViews?.(plugin);
+        const views = this.deps.inlineViews(plugin);
         const keyOk = x.key === undefined || (typeof x.key === "string" && x.key !== "" && x.key.length <= 200);
         if (typeof x.view !== "string" || !views?.has(x.view) || !keyOk) {
             this.deps.log.warn("tool returned an inline card that is not an inline view of its extension; dropped", {
@@ -1205,32 +1254,64 @@ export class ToolPipeline {
             await this.deps.eventLog.append(ctx.conversationId, events);
             return;
         }
-        const written = await this.deps.db.transaction().execute(async (t) => {
-            const out = await this.deps.eventLog.append(ctx.conversationId, events, t);
-            for (const a of audits)
-                await audit(t, a);
-            if (callAudit === undefined)
-                return out;
-            await audit(t, {
-                actorAccountId: ctx.accountId,
-                orgId: ctx.orgId,
-                action: "tool.called",
-                target: ctx.conversationId,
-                detail: {
-                    toolKey,
-                    isError: r.isError,
-                    durationMs: callAudit.durationMs,
-                    agentId: ctx.agentId,
-                    agentVersion: ctx.agentVersion,
-                    conversationId: ctx.conversationId,
-                    runId: ctx.runId,
-                    callId,
-                    ...(callAudit.connectorId !== null && { connectorId: callAudit.connectorId }),
-                    ...callAudit.authorization,
-                },
-            });
+        const written = await this.writeResultIn(ctx, callId, toolKey, r, events, callAudit, audits);
+        await this.deps.eventLog.notify(ctx.conversationId, Math.max(...written.map((e) => e.seq)));
+    }
+    /** The result's events and audit rows in one transaction (see {@link writeResult}). */
+    async writeResultIn(ctx, callId, toolKey, r, events, callAudit, audits) {
+        const t = this.deps.db;
+        const out = await this.deps.eventLog.appendIn(ctx.conversationId, events);
+        for (const a of audits)
+            await audit(t, a);
+        if (callAudit === undefined)
             return out;
+        await audit(t, {
+            actorAccountId: ctx.accountId,
+            orgId: ctx.orgId,
+            action: "tool.called",
+            target: ctx.conversationId,
+            detail: {
+                toolKey,
+                isError: r.isError,
+                durationMs: callAudit.durationMs,
+                agentId: ctx.agentId,
+                agentVersion: ctx.agentVersion,
+                conversationId: ctx.conversationId,
+                runId: ctx.runId,
+                callId,
+                ...(callAudit.connectorId !== null && { connectorId: callAudit.connectorId }),
+                ...callAudit.authorization,
+            },
         });
-        await this.deps.eventLog.notify(ctx.conversationId, Math.max(...written.map((e) => e.seq)));
+        return out;
     }
-}
+};
+__decorate([
+    Transactional()
+], ToolPipeline.prototype, "stopOpenAgentCallsNow", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ToolPipeline.prototype, "stopOpenAgentCalls", null);
+__decorate([
+    Transactional()
+], ToolPipeline.prototype, "writeResultIn", null);
+ToolPipeline = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(EventLog)),
+    __param(2, Inject(SubagentsService)),
+    __param(3, Inject(ToolRegistry)),
+    __param(4, Inject(Credentials)),
+    __param(5, Inject(Breaker)),
+    __param(6, Inject(ToolOutputs)),
+    __param(7, Inject(ApprovalsService)),
+    __param(8, Inject(QuestionsService)),
+    __param(9, Inject(KernelConfigService)),
+    __param(10, Inject(KERNEL_LOGGER)),
+    __param(11, Inject(ExtensionHost)),
+    __param(12, Inject(ToolDrift)),
+    __param(13, Inject(TransactionHost)),
+    __param(14, Optional()),
+    __param(14, Inject(TOOL_PIPELINE_HOOKS))
+], ToolPipeline);
+export { ToolPipeline };

package/dist/tools/policy.d.ts

@@ -1,4 +1,4 @@
-import type { KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { DecidePolicy } from "./pipeline.js";
 import type { ResolvedTool, ToolPolicy } from "./registry.js";
 /**
@@ -57,4 +57,4 @@ export declare function isFixedAsk(tool: ResolvedTool, visibility?: "private" |
  *
  * 结果为 `ask` 时返回审批请求，默认指向发起人本人；记住的授权把 `ask` 放行时返回 `{ grant }`（按 allow 执行）。
  */
-export declare function createDecidePolicy(db: KernelDb): DecidePolicy;
+export declare function createDecidePolicy(db: KernelSchemaDb): DecidePolicy;

package/dist/tools/questions.controller.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import type { QuestionsService, QuestionView } from "./questions.service.js";
+import { QuestionsService, type QuestionView } from "./questions.service.js";
 /** 回答体：`answer` 的形状由服务按表单校验（`validateAnswer`，不符 → `validation_failed`）。 */
 declare const AnswerBody: z.ZodObject<{
     answer: z.ZodRecord<z.ZodString, z.ZodUnknown>;