@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/tools/registry.js

@@ -1,38 +1,34 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { createHash } from "node:crypto";
+import { connectorToolKey, extensionToolKey } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
+import { builtinDisabled, connectorToolDisabled, extensionToolDisabled, } from "../agents/definition.js";
+import { EffectiveConfigs, NEEDS_CONFIG_REASON } from "../extensions/effective-config.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
 import { estimateTokens } from "../runtime/context/tokens.js";
 import { SUBAGENT_LIMIT_DEFAULTS, subagentLimits } from "../runtime/subagents/limits.js";
 import { resolveRoster } from "../runtime/subagents/roster.js";
-import { AGENT_TOOL, agentToolSpec } from "./builtins/agent.js";
-import { SANDBOX_TOOL_NAMES } from "./builtins/sandbox/names.js";
-import { toolKey, toolKeyIssue } from "./naming.js";
-/**
- * 内核内置工具的名字（Task 10 / Task 19 实现；M5 T8 加沙箱工具）。保存 agent 时内置工具引用按这份清单校验，
- * 不依赖当前是否已注册，避免实现落地顺序影响已保存的定义；运行时未注册的照常报不可用。
- * `skill_write`（M5 T15）由 agent 定义显式引用才可用（负责人决定 agent 能否改自己的技能）。
- */
-export const BUILTIN_TOOL_NAMES = [
-    "ask_user",
-    "read_tool_output",
-    "tool_search",
-    "skill_load",
-    "skill_write",
-    ...SANDBOX_TOOL_NAMES,
-    // phase C: dispatches sub-agents; its description is built per agent from the roster
-    "agent",
-];
-/** 键排序、去掉 undefined 的 JSON（jsonb 不保留键顺序，指纹必须与顺序无关）。 */
-export function canonicalJson(v) {
-    if (Array.isArray(v))
-        return `[${v.map(canonicalJson).join(",")}]`;
-    if (v !== null && typeof v === "object") {
-        const entries = Object.entries(v)
-            .filter(([, x]) => x !== undefined)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-        return `{${entries.map(([k, x]) => `${JSON.stringify(k)}:${canonicalJson(x)}`).join(",")}}`;
-    }
-    return JSON.stringify(v);
-}
+import { AGENT_BUILTIN_NAMES, AGENT_TOOL, BASH_COMPANION_TOOLS, BUILTIN, SEND_MESSAGE, SKILL_LOAD, SUBAGENT_HANDBACK, TOOL_SEARCH, } from "./builtin-names.js";
+import { agentToolSpec } from "./builtins/agent.js";
+import { BuiltinTools } from "./builtins/builtin-tools.js";
+import { canonicalJson } from "./canonical-json.js";
+import { legacyKeySaveText } from "./legacy-keys.js";
+import { toolKeyIssue } from "./naming.js";
+import { OrgToolSwitches, toolTurnedOffReason } from "./org-tool-switches.js";
+export { BUILTIN_TOOL_NAMES } from "./builtin-names.js";
+export { canonicalJson } from "./canonical-json.js";
 /** The first 16 hex digits of sha256(canonicalJson(v)): a fingerprint independent of key order. */
 export function contentHash(v) {
     return createHash("sha256").update(canonicalJson(v)).digest("hex").slice(0, 16);
@@ -63,10 +59,8 @@ export function specHash(spec) {
 export function policyFromAnnotations(a) {
     return a?.readOnlyHint === true ? "allow" : "ask";
 }
-/** 内置 `tool_search` 的名字（由注册表按组织设置与阈值自动加入，不进 agent 定义）。 */
-const TOOL_SEARCH = "tool_search";
-/** 内置 `skill_load` 的名字（对话日志里有技能目录快照时由注册表自动加入，不进 agent 定义）。 */
-const SKILL_LOAD = "skill_load";
+// `ToolSearch` is added by the registry by org setting and threshold, `Skill` when the log has a
+// skills catalog snapshot; neither comes from agent definitions (`./builtin-names.ts`).
 /** 工具定义（模型可见三项）的估算 token 数（与请求估算同一口径）。 */
 function estimateToolTokens(tools) {
     return estimateTokens([], [], tools.map((t) => ({
@@ -80,31 +74,74 @@ const sourceId = (s) => s.kind === "builtin"
     : s.kind === "plugin"
         ? `plugin:${s.plugin}:${s.name}`
         : `connector:${s.connectorId}:${s.name}`;
+/** A builtin as a resolved tool (with `spec`, which `Agent` builds per definition). */
+const builtinTool = (b, spec) => ({
+    key: b.spec.name,
+    source: { kind: "builtin", name: b.spec.name },
+    spec,
+    specHash: specHash(spec),
+    defaultPolicy: b.defaultPolicy,
+    ...(b.timeoutMs !== undefined && { timeoutMs: b.timeoutMs }),
+    ...(b.spillChars !== undefined && { spillChars: b.spillChars }),
+    ...(b.callPolicy !== undefined && { callPolicy: b.callPolicy }),
+});
 /**
- * Tool registry: resolves the references in an agent definition into the tools available for this
- * run. Not cached (reads PG and the host live every time), so changes take effect right away across
- * replicas.
+ * Tool registry: resolves what an agent has for this run (tools default-on spec §4): everything
+ * the org offers minus the definition's `disabledTools`. Not cached (reads PG and the host live
+ * every time), so changes take effect right away across replicas.
  *
- * Availability:
- * - builtin: in `builtins`;
- * - extension tools: the extension is loaded and registered the tool, and this org enabled the
- *   extension (`extension_org_configs.enabled`, spec 2.2 "installed at deployment level, enabled at
- *   org level"; required bootstrap plugins are enabled in every org, `enabled.ts`);
- * - connector tools: the connector belongs to this org, is not deleted or disabled, the connector is
- *   installed, the tool status is `enabled` and the key is valid.
- *   `tools: "all"` takes only enabled tools; disabled / pending-review ones count as deliberately
- *   turned off by an admin and are not reported; named tools report their reason one by one.
- * Only the first of a key is kept; the same source referenced twice is deduplicated silently,
- * different sources with the same key report a duplicate.
+ * What is offered:
+ * - builtins: every {@link AGENT_BUILTIN_NAMES} entry registered here that can run (`unavailable`
+ *   says why not), `TaskOutput` / `TaskStop` with `Bash`, `Agent` while its roster is not empty;
+ * - extension tools: every tool registered by an extension loaded on this replica and enabled in
+ *   the org (`extension_org_configs.enabled`; required bootstrap plugins are enabled in every org,
+ *   `enabled.ts`), whose effective config for the org is valid (layering spec A §6) and that the
+ *   org did not switch off (§7: the org's switch wins);
+ * - connector tools: every enabled tool of every live, active connector of the org whose
+ *   connector extension is installed, with a valid key.
+ * What cannot be offered goes to `hidden` with the reason; nothing is reported to the model as
+ * unavailable except two sources with one key (the first wins).
  */
-export class ToolRegistry {
-    deps;
-    constructor(deps) {
-        this.deps = deps;
+let ToolRegistry = class ToolRegistry {
+    db;
+    host;
+    extensions;
+    builtinTools;
+    effective;
+    switches;
+    config;
+    constructor(db, 
+    /** Extension tools and the organization's enabled extensions. */
+    host, 
+    /** The installed connectors (`connector@1`, from the extension registry). */
+    extensions, builtinTools, 
+    /**
+     * The extensions' effective config per org (layering spec A §6): an extension tool is
+     * unavailable in an org whose effective config is not valid.
+     */
+    effective, 
+    /** The org's switches of single extension tools (layering spec A §7). */
+    switches, 
+    /**
+     * `tools.searchThreshold*` and the sub-agent limits. Absent (some tests): `ToolSearch` is never
+     * offered and the sub-agent limits are the schema defaults.
+     */
+    config) {
+        this.db = db;
+        this.host = host;
+        this.extensions = extensions;
+        this.builtinTools = builtinTools;
+        this.effective = effective;
+        this.switches = switches;
+        this.config = config;
+    }
+    /** The kernel's builtin tools (`ToolSearch` is added by {@link forAgent}, not by definitions). */
+    get builtins() {
+        return this.builtinTools.list();
     }
     /** `host.list("connector")` 中 `kind` 匹配的第一个实现；未安装返回 undefined。 */
     findConnector(kind) {
-        for (const e of this.deps.host.list("connector")) {
+        for (const e of this.extensions.list("connector")) {
             const impl = e.impl;
             if (impl?.kind === kind)
                 return impl;
@@ -127,10 +164,10 @@ export class ToolRegistry {
      */
     handler(source) {
         if (source.kind === "builtin") {
-            return this.deps.builtins.find((b) => b.spec.name === source.name)?.run;
+            return this.builtins.find((b) => b.spec.name === source.name)?.run;
         }
         if (source.kind === "plugin") {
-            const t = this.deps.host
+            const t = this.host
                 .tools()
                 .find((x) => x.plugin === source.plugin && x.spec.name === source.name);
             if (!t)
@@ -141,93 +178,140 @@ export class ToolRegistry {
     }
     /** The registered builtin tools' specs (display metadata for `tools/info.ts`). */
     builtinSpecs() {
-        return this.deps.builtins.map((b) => b.spec);
+        return this.builtins.map((b) => b.spec);
     }
     /** The loaded extensions' registered tool specs, with their extension's name. */
     extensionToolSpecs() {
-        return this.deps.host.tools().map((t) => ({ plugin: t.plugin, spec: t.spec }));
+        return this.host.tools().map((t) => ({ plugin: t.plugin, spec: t.spec }));
     }
     /** 已安装连接器的 kind 列表（去重，按加载顺序）。 */
     connectorKinds() {
-        return [...new Set(this.deps.host.list("connector").map((e) => e.impl.kind))];
+        return [...new Set(this.extensions.list("connector").map((e) => e.impl.kind))];
+    }
+    /**
+     * The connector kinds `orgId` can create connectors of: the `connector@1` implementations loaded
+     * on this replica whose extension is enabled in the org (the first implementation of a kind, as
+     * {@link findConnector} picks it), sorted by kind.
+     */
+    async connectorKindsFor(orgId) {
+        const enabled = await this.enabledPlugins(orgId);
+        const out = new Map();
+        for (const e of this.extensions.list("connector")) {
+            const kind = e.impl?.kind;
+            if (typeof kind !== "string" || out.has(kind))
+                continue;
+            out.set(kind, e.plugin);
+        }
+        return [...out]
+            .filter(([, plugin]) => enabled.has(plugin))
+            .map(([kind, plugin]) => ({ kind, plugin }))
+            .sort((a, b) => a.kind.localeCompare(b.kind));
+    }
+    /** True when `kind` is one of {@link connectorKindsFor}: loaded here and enabled in the org. */
+    async connectorKindAvailable(orgId, kind) {
+        return (await this.connectorKindsFor(orgId)).some((k) => k.kind === kind);
     }
     /**
-     * 保存 agent 时校验工具引用（只看「存在」，停用 / 待复核 / 插件未启用等运行时状态不拒绝，由 `forAgent` 报不可用）：
-     * - 内置：名字在 {@link BUILTIN_TOOL_NAMES} 中；
-     * - 插件：插件已加载且注册了该工具，key 合法；
-     * - 连接器：连接器属于本组织且未删除；点名的工具必须在连接器的工具快照中。
-     * 不同来源拼出同一个 key 也报出来（不截断、不猜）。
-     * 返回 `keys`：这些引用可能产生的全部工具 key（`"all"` 含连接器当前所有工具，不论状态），供校验 `toolPolicies`。
+     * Checks a definition's `disabledTools` on save (existence only): a builtin an agent can turn off
+     * ({@link AGENT_BUILTIN_NAMES}), an extension loaded here and the tools it registered, a live
+     * connector of the org and tools of its snapshot. An entry equal to one of `kept` (the current
+     * version's) is not re-checked: a connector deleted or an extension uninstalled later never
+     * blocks other edits. Returns `keys`: every tool key the agent could have, on or turned off (all
+     * its builtins, every loaded extension's tools, every tool of the org's live connectors in any
+     * status), the keys `toolPolicies` may use.
      */
-    async checkRefs(orgId, refs) {
+    async checkDisabled(orgId, disabled, kept = []) {
         const issues = [];
-        const owner = new Map();
-        const pluginTools = this.deps.host.tools();
-        const connectorIds = [
-            ...new Set(refs.flatMap((r) => (r.kind === "connector" ? [r.connectorId] : []))),
-        ];
-        const apps = await this.loadConnectors(orgId, connectorIds);
-        const claim = (path, key, source) => {
-            const prev = owner.get(key);
-            if (prev === undefined)
-                owner.set(key, source);
-            else if (prev !== source) {
-                issues.push({ path, message: `Tool key "${key}" is already used by another tool` });
-            }
-        };
-        refs.forEach((ref, i) => {
-            const path = `tools.${i}`;
+        const keys = new Set();
+        for (const name of AGENT_BUILTIN_NAMES)
+            keys.add(name);
+        for (const name of BASH_COMPANION_TOOLS)
+            keys.add(name);
+        const pluginTools = this.host.tools();
+        for (const t of pluginTools)
+            keys.add(extensionToolKey(t.plugin, t.spec.name));
+        const apps = await this.loadOrgConnectors(orgId, { includeDeleted: false });
+        for (const app of apps)
+            for (const t of app.tools)
+                keys.add(connectorToolKey(app.slug, t.name));
+        const builtins = new Set(AGENT_BUILTIN_NAMES);
+        const keptJson = new Set(kept.map((r) => canonicalJson(r)));
+        disabled.forEach((ref, i) => {
+            const path = `disabledTools.${i}`;
+            if (keptJson.has(canonicalJson(ref)))
+                return;
             if (ref.kind === "builtin") {
-                if (!BUILTIN_TOOL_NAMES.includes(ref.name)) {
-                    issues.push({ path, message: `Built-in tool "${ref.name}" does not exist` });
-                    return;
+                if (!builtins.has(ref.name)) {
+                    const renamed = legacyKeySaveText(ref.name);
+                    issues.push({
+                        path,
+                        message: renamed !== null
+                            ? `Built-in tool ${renamed}`
+                            : `"${ref.name}" is not a built-in tool an agent can turn off`,
+                    });
                 }
-                claim(path, ref.name, `builtin:${ref.name}`);
             }
             else if (ref.kind === "plugin") {
-                const key = toolKey(ref.plugin, ref.name);
-                if (!pluginTools.some((x) => x.plugin === ref.plugin && x.spec.name === ref.name)) {
-                    issues.push({ path, message: `Plugin tool "${key}" does not exist` });
+                const own = pluginTools.filter((x) => x.plugin === ref.plugin);
+                if (own.length === 0) {
+                    issues.push({ path, message: `Extension "${ref.plugin}" has no tools` });
                     return;
                 }
-                const issue = toolKeyIssue(key);
-                if (issue) {
-                    issues.push({ path, message: issue });
+                if (ref.tools === "all")
                     return;
+                for (const name of ref.tools) {
+                    if (!own.some((x) => x.spec.name === name)) {
+                        issues.push({
+                            path,
+                            message: `Extension tool "${extensionToolKey(ref.plugin, name)}" does not exist`,
+                        });
+                    }
                 }
-                claim(path, key, `plugin:${ref.plugin}:${ref.name}`);
             }
             else {
-                const app = apps.get(ref.connectorId);
-                if (!app || app.deleted) {
+                const app = apps.find((a) => a.id === ref.connectorId);
+                if (!app) {
                     issues.push({ path, message: `Connector "${ref.connectorId}" does not exist` });
                     return;
                 }
-                const names = ref.tools === "all" ? app.tools.map((t) => t.name) : [...new Set(ref.tools)];
-                for (const name of names) {
+                if (ref.tools === "all")
+                    return;
+                for (const name of ref.tools) {
                     if (!app.tools.some((t) => t.name === name)) {
                         issues.push({
                             path,
                             message: `Tool "${name}" does not exist in connector ${app.slug}`,
                         });
-                        continue;
                     }
-                    claim(path, toolKey(app.slug, name), `connector:${app.id}:${name}`);
                 }
             }
         });
-        return { keys: new Set(owner.keys()), issues };
+        return { keys, issues };
     }
     /**
-     * 解析 agent 引用的工具（见类注释），再判定是否启用 `tool_search`：组织设置 `toolSearch === "on"`，且
-     * 可用工具数 > `tools.searchThresholdTools` 或其定义的估算 token > `tools.searchThresholdTokens`。
-     * 启用时把内置 `tool_search` 追加到末尾。定义里显式引用的 `tool_search` 忽略（由这里按设置管理）。
-     * `skillLoad`：对话日志里有技能目录快照（`skills_catalog`，Ruling M17）→ 加入内置 `skill_load`（始终完整加载）；
-     * 定义里显式引用的 `skill_load` 同样忽略。
+     * Resolves what the agent has (see the class comment), then decides on `ToolSearch`: the org
+     * setting `toolSearch === "on"` and more than `tools.searchThresholdTools` tools or more than
+     * `tools.searchThresholdTokens` estimated definition tokens; when on, the builtin `ToolSearch` is
+     * appended. `skillLoad`: the log has a skills catalog snapshot (`skills_catalog`, Ruling M17) →
+     * the builtin `Skill` is added (always fully loaded).
      */
     async forAgent(orgId, def) {
-        const { tools, unavailable, hidden } = await this.resolve(orgId, def);
-        const sl = def.skillLoad === true && this.deps.builtins.find((x) => x.spec.name === SKILL_LOAD);
+        const resolved = await this.resolve(orgId, def);
+        const { unavailable, hidden } = resolved;
+        const tools = filterSubagentTools(resolved.tools, def.subagentTools);
+        // `SendMessage` to an agent that has `Agent` (to reach its sub-agents) or a parent;
+        // `SubagentHandback` to a sub-agent only; a fork invocation's child reports by its reply
+        const toParent = def.child === true && def.forkChild !== true;
+        const messageTools = [
+            ...(toParent || tools.some((t) => t.key === AGENT_TOOL) ? [SEND_MESSAGE] : []),
+            ...(toParent ? [SUBAGENT_HANDBACK] : []),
+        ];
+        for (const name of messageTools) {
+            const b = this.builtins.find((x) => x.spec.name === name);
+            if (b)
+                tools.push(builtinTool(b, b.spec));
+        }
+        const sl = def.skillLoad === true && this.builtins.find((x) => x.spec.name === SKILL_LOAD);
         if (sl) {
             tools.push({
                 key: SKILL_LOAD,
@@ -240,7 +324,7 @@ export class ToolRegistry {
         }
         const toolSearch = await this.searchActive(orgId, tools);
         if (toolSearch) {
-            const b = this.deps.builtins.find((x) => x.spec.name === TOOL_SEARCH);
+            const b = this.builtins.find((x) => x.spec.name === TOOL_SEARCH);
             tools.push({
                 key: TOOL_SEARCH,
                 source: { kind: "builtin", name: TOOL_SEARCH },
@@ -251,18 +335,27 @@ export class ToolRegistry {
         }
         return { tools, unavailable, hidden, toolSearch };
     }
-    /** 是否启用 `tool_search`（见 {@link forAgent}）；先比阈值，超过才读组织设置。 */
+    /** 是否启用 `ToolSearch`（见 {@link forAgent}）；先比阈值，超过才读组织设置。 */
     async searchActive(orgId, tools) {
-        const cfg = this.deps.config?.().tools;
-        if (!cfg || !this.deps.builtins.some((b) => b.spec.name === TOOL_SEARCH))
+        const cfg = this.config?.get().tools;
+        if (!cfg || !this.builtins.some((b) => b.spec.name === TOOL_SEARCH))
             return false;
         const over = tools.length > cfg.searchThresholdTools ||
             estimateToolTokens(tools) > cfg.searchThresholdTokens;
         if (!over)
             return false;
-        return (await readOrgSettings(this.deps.db, orgId)).toolSearch === "on";
+        return (await readOrgSettings(this.db.db, orgId)).toolSearch === "on";
     }
     async resolve(orgId, def) {
+        const disabled = def.disabledTools ?? [];
+        const scope = {
+            orgId,
+            ...(def.sandboxConversationId !== undefined && {
+                conversationId: def.sandboxConversationId,
+            }),
+            ...(def.replay === true && { replay: true }),
+            memo: new Map(),
+        };
         const tools = [];
         const unavailable = [];
         const hidden = [];
@@ -281,201 +374,226 @@ export class ToolRegistry {
                 });
             }
         };
-        const enabledPlugins = def.tools.some((r) => r.kind === "plugin")
-            ? await this.enabledPlugins(orgId)
-            : new Set();
-        const connectorIds = [
-            ...new Set(def.tools.flatMap((r) => (r.kind === "connector" ? [r.connectorId] : []))),
-        ];
-        const apps = await this.loadConnectors(orgId, connectorIds);
-        const pluginTools = this.deps.host.tools();
-        for (const ref of def.tools) {
-            if (ref.kind === "builtin") {
-                if (ref.name === TOOL_SEARCH || ref.name === SKILL_LOAD)
-                    continue;
-                const b = this.deps.builtins.find((x) => x.spec.name === ref.name);
-                if (!b) {
-                    unavailable.push({ ref: ref.name, reason: "Built-in tool does not exist" });
-                    continue;
-                }
-                const why = b.unavailable?.() ?? null;
-                if (why !== null) {
-                    unavailable.push({ ref: ref.name, reason: why });
+        // builtins
+        for (const name of AGENT_BUILTIN_NAMES) {
+            if (builtinDisabled(disabled, name))
+                continue;
+            const b = this.builtins.find((x) => x.spec.name === name);
+            if (!b)
+                continue;
+            const why = (await b.unavailable?.(scope)) ?? null;
+            if (why !== null) {
+                hidden.push({ ref: name, reason: why });
+                continue;
+            }
+            // `Agent`: the description lists this definition's roster (sub-agents spec §4.3); with an
+            // empty roster there is nothing to dispatch, so the tool is not offered at all
+            let spec = b.spec;
+            if (name === AGENT_TOOL) {
+                const roster = await resolveRoster(this.db.db, orgId, { subagents: def.subagents });
+                if (roster.length === 0)
                     continue;
+                spec = agentToolSpec(roster, await this.maxConcurrentSubagents(orgId));
+            }
+            add(builtinTool(b, spec));
+            // `TaskOutput` and `TaskStop` come with an available `Bash` (background Bash spec §2)
+            if (name === BUILTIN.Bash) {
+                for (const companion of BASH_COMPANION_TOOLS) {
+                    const c = this.builtins.find((x) => x.spec.name === companion);
+                    if (c && ((await c.unavailable?.(scope)) ?? null) === null) {
+                        add(builtinTool(c, c.spec));
+                    }
                 }
-                // `agent`: the description lists this definition's roster (sub-agents spec §4.3); with an
-                // empty roster there is nothing to dispatch, so the tool is not offered at all
-                let spec = b.spec;
-                if (b.spec.name === AGENT_TOOL) {
-                    const roster = await resolveRoster(this.deps.db, orgId, { subagents: def.subagents });
-                    if (roster.length === 0)
-                        continue;
-                    spec = agentToolSpec(roster, await this.maxConcurrentSubagents(orgId));
-                }
-                add({
-                    key: b.spec.name,
-                    source: { kind: "builtin", name: b.spec.name },
-                    spec,
-                    specHash: specHash(spec),
-                    defaultPolicy: b.defaultPolicy,
-                    ...(b.timeoutMs !== undefined && { timeoutMs: b.timeoutMs }),
-                    ...(b.spillChars !== undefined && { spillChars: b.spillChars }),
-                });
             }
-            else if (ref.kind === "plugin") {
-                const key = toolKey(ref.plugin, ref.name);
-                const t = pluginTools.find((x) => x.plugin === ref.plugin && x.spec.name === ref.name);
-                if (!t) {
-                    unavailable.push({ ref: key, reason: "Plugin tool does not exist" });
+        }
+        // extension tools: the extensions enabled in the org
+        const pluginTools = this.host.tools();
+        if (pluginTools.length > 0) {
+            const [enabledPlugins, offKeys] = await Promise.all([
+                this.enabledPlugins(orgId),
+                this.switches.offKeys(orgId),
+            ]);
+            // one effective config read per extension and resolution, however many tools it has
+            const configured = new Map();
+            const configuredIn = (plugin) => {
+                let ok = configured.get(plugin);
+                if (!ok) {
+                    ok = this.effective.get(orgId, plugin).then((e) => e.ok);
+                    configured.set(plugin, ok);
+                }
+                return ok;
+            };
+            for (const t of pluginTools) {
+                if (!enabledPlugins.has(t.plugin))
+                    continue;
+                if (extensionToolDisabled(disabled, t.plugin, t.spec.name))
+                    continue;
+                const key = extensionToolKey(t.plugin, t.spec.name);
+                // the pipeline refuses such calls too (a resumed step), this keeps them from the model
+                if (offKeys.has(key)) {
+                    hidden.push({ ref: key, reason: toolTurnedOffReason(key) });
                     continue;
                 }
-                if (!enabledPlugins.has(ref.plugin)) {
-                    unavailable.push({
-                        ref: key,
-                        reason: `Plugin ${ref.plugin} is not enabled in this organization`,
-                    });
+                if (!(await configuredIn(t.plugin))) {
+                    hidden.push({ ref: key, reason: `Plugin ${t.plugin} ${NEEDS_CONFIG_REASON}` });
                     continue;
                 }
                 const issue = toolKeyIssue(key);
                 if (issue) {
-                    unavailable.push({ ref: key, reason: issue });
+                    hidden.push({ ref: key, reason: issue });
                     continue;
                 }
                 add({
                     key,
-                    source: { kind: "plugin", plugin: ref.plugin, name: ref.name },
+                    source: { kind: "plugin", plugin: t.plugin, name: t.spec.name },
                     spec: t.spec,
                     specHash: specHash(t.spec),
                     defaultPolicy: t.spec.defaultPolicy ?? policyFromAnnotations(t.spec.annotations),
                 });
             }
-            else {
-                const app = apps.get(ref.connectorId);
-                if (!app) {
-                    unavailable.push({ ref: `app:${ref.connectorId}`, reason: "App does not exist" });
+        }
+        // connector tools: the org's live connectors
+        for (const app of await this.loadOrgConnectors(orgId, { includeDeleted: false })) {
+            if (disabled.some((r) => r.kind === "connector" && r.connectorId === app.id && r.tools === "all")) {
+                continue;
+            }
+            const all = connectorToolKey(app.slug, "*");
+            if (app.status !== "active") {
+                hidden.push({ ref: all, reason: `App ${app.slug} is disabled` });
+                continue;
+            }
+            if (!this.findConnector(app.connector)) {
+                hidden.push({
+                    ref: all,
+                    reason: `Connector ${app.connector} for app ${app.slug} is not installed`,
+                });
+                continue;
+            }
+            for (const t of app.tools) {
+                if (connectorToolDisabled(disabled, app.id, t.name))
                     continue;
-                }
-                const all = toolKey(app.slug, "*");
-                if (app.deleted) {
-                    unavailable.push({ ref: all, reason: `App ${app.slug} was deleted` });
+                const key = connectorToolKey(app.slug, t.name);
+                // 远端已不再提供（漂移检测置停用并标记，见 drift.ts）
+                if (t.gone) {
+                    hidden.push({ ref: key, reason: `Tool no longer exists in app ${app.slug}` });
                     continue;
                 }
-                if (app.status !== "active") {
-                    unavailable.push({ ref: all, reason: `App ${app.slug} is disabled` });
+                if (t.status === "disabled") {
+                    hidden.push({ ref: key, reason: "Tool is disabled" });
                     continue;
                 }
-                if (!this.findConnector(app.connector)) {
-                    unavailable.push({
-                        ref: all,
-                        reason: `Connector ${app.connector} for app ${app.slug} is not installed`,
-                    });
+                if (t.status === "pending_review") {
+                    hidden.push({ ref: key, reason: "Tool is pending review" });
                     continue;
                 }
-                const wanted = ref.tools === "all"
-                    ? app.tools
-                    : ref.tools.map((name) => app.tools.find((t) => t.name === name) ?? { name, missing: true });
-                // 「all」里未启用的工具不算 agent 点名要的，不进 unavailable（不提醒），只记进 hidden 备查
-                const notEnabled = ref.tools === "all" ? hidden : unavailable;
-                for (const t of wanted) {
-                    const key = toolKey(app.slug, t.name);
-                    // 远端已不再提供（漂移检测置停用并标记，见 drift.ts）：与「没有这一行」同一个事实
-                    if ("missing" in t || t.gone) {
-                        notEnabled.push({ ref: key, reason: `Tool no longer exists in app ${app.slug}` });
-                        continue;
-                    }
-                    if (t.status === "disabled") {
-                        notEnabled.push({ ref: key, reason: "Tool is disabled" });
-                        continue;
-                    }
-                    if (t.status === "pending_review") {
-                        notEnabled.push({ ref: key, reason: "Tool is pending review" });
-                        continue;
-                    }
-                    const issue = toolKeyIssue(key);
-                    if (issue) {
-                        unavailable.push({ ref: key, reason: issue });
-                        continue;
-                    }
-                    add({
-                        key,
-                        source: {
-                            kind: "connector",
-                            connectorId: app.id,
-                            name: t.name,
-                            ...(t.source === "resources" && { resources: true }),
-                        },
-                        spec: t.spec,
-                        specHash: t.specHash,
-                        defaultPolicy: t.defaultPolicy,
-                    });
+                const issue = toolKeyIssue(key);
+                if (issue) {
+                    hidden.push({ ref: key, reason: issue });
+                    continue;
                 }
+                add({
+                    key,
+                    source: {
+                        kind: "connector",
+                        connectorId: app.id,
+                        name: t.name,
+                        ...(t.source === "resources" && { resources: true }),
+                    },
+                    spec: t.spec,
+                    specHash: t.specHash,
+                    defaultPolicy: t.defaultPolicy,
+                });
             }
         }
         return { tools, unavailable, hidden };
     }
     /**
-     * `subagents.maxConcurrentPerRun` with the organization's override, for the `agent` tool's
+     * `subagents.maxConcurrentPerConversation` with the organization's override, for the `Agent` tool's
      * description (§4.3). A change of the limit changes the tool's spec hash; replays read the
      * definition logged by hash, so no drift reason is involved. Without config (some tests): the
      * schema default.
      */
     async maxConcurrentSubagents(orgId) {
-        const config = this.deps.config ?? (() => ({ subagents: SUBAGENT_LIMIT_DEFAULTS }));
-        return (await subagentLimits(this.deps.db, config, orgId)).maxConcurrentPerRun;
+        const cfg = this.config;
+        const config = cfg ?? { get: () => ({ subagents: SUBAGENT_LIMIT_DEFAULTS }) };
+        return (await subagentLimits(this.db.db, config, orgId)).maxConcurrentPerConversation;
+    }
+    /** The extensions enabled in the org (`extensions/enabled.ts`, through the host). */
+    async enabledExtensions(orgId) {
+        return this.host.enabledPlugins(orgId);
     }
     /** Plugins the organization enabled (built-in plugins always count as enabled, C14). */
     async enabledPlugins(orgId) {
-        return this.deps.host.enabledPlugins(orgId);
+        return this.host.enabledPlugins(orgId);
     }
-    async loadConnectors(orgId, ids) {
-        const out = new Map();
-        if (ids.length === 0)
-            return out;
-        // 软删除的连接器也读出来，只为给出「已删除」这个更准确的原因（slug 可能已被新连接器复用，按 id 区分）
-        const apps = await this.deps.db
+    /** The org's connectors (live ones, sorted by slug) with their tool snapshots (by name). */
+    async loadOrgConnectors(orgId, _opts) {
+        const apps = await this.db
             .selectFrom("connectors")
-            .select(["id", "slug", "connector", "status", "deleted_at"])
+            .select(["id", "slug", "connector", "status"])
             .where("org_id", "=", orgId)
-            .where("id", "in", ids)
+            .where("deleted_at", "is", null)
+            .orderBy("slug")
+            .orderBy("id")
             .execute();
-        const live = apps.filter((a) => a.deleted_at === null).map((a) => a.id);
-        const toolRows = live.length === 0
-            ? []
-            : await this.deps.db
-                .selectFrom("connector_tools")
-                .select([
-                "connector_id",
-                "name",
-                "spec",
-                "spec_hash",
-                "status",
-                "default_policy",
-                "source",
-                "missing_since",
-            ])
-                .where("connector_id", "in", live)
-                .orderBy("name")
-                .execute();
-        for (const a of apps) {
-            out.set(a.id, {
-                id: a.id,
-                slug: a.slug,
-                connector: a.connector,
-                status: a.status,
-                deleted: a.deleted_at !== null,
-                tools: toolRows
-                    .filter((t) => t.connector_id === a.id)
-                    .map((t) => ({
-                    name: t.name,
-                    spec: t.spec,
-                    specHash: t.spec_hash,
-                    status: t.status,
-                    defaultPolicy: t.default_policy,
-                    source: t.source,
-                    gone: t.missing_since !== null,
-                })),
-            });
-        }
-        return out;
+        if (apps.length === 0)
+            return [];
+        const toolRows = await this.db
+            .selectFrom("connector_tools")
+            .select([
+            "connector_id",
+            "name",
+            "spec",
+            "spec_hash",
+            "status",
+            "default_policy",
+            "source",
+            "missing_since",
+        ])
+            .where("connector_id", "in", apps.map((a) => a.id))
+            .orderBy("name")
+            .execute();
+        return apps.map((a) => ({
+            id: a.id,
+            slug: a.slug,
+            connector: a.connector,
+            status: a.status,
+            tools: toolRows
+                .filter((t) => t.connector_id === a.id)
+                .map((t) => ({
+                name: t.name,
+                spec: t.spec,
+                specHash: t.spec_hash,
+                status: t.status,
+                defaultPolicy: t.default_policy,
+                source: t.source,
+                gone: t.missing_since !== null,
+            })),
+        }));
     }
+};
+ToolRegistry = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(ExtensionHost)),
+    __param(2, Inject(ExtensionRegistry)),
+    __param(3, Inject(BuiltinTools)),
+    __param(4, Inject(EffectiveConfigs)),
+    __param(5, Inject(OrgToolSwitches)),
+    __param(6, Inject(KernelConfigService))
+], ToolRegistry);
+export { ToolRegistry };
+/**
+ * `tools` narrowed by a sub-agent's key filter (tools default-on spec §4): `deny` keys removed,
+ * and with `allow` only its keys kept. `TaskOutput` / `TaskStop` follow `Bash`, as they come with
+ * it. Without a filter the list is returned as it is.
+ */
+export function filterSubagentTools(tools, filter) {
+    if (filter === undefined)
+        return tools;
+    const companions = new Set(BASH_COMPANION_TOOLS);
+    const deny = new Set(filter.deny ?? []);
+    const allow = filter.allow === undefined ? null : new Set(filter.allow);
+    const keep = (key) => !deny.has(key) && (allow === null || allow.has(key));
+    return tools.filter((t) => (companions.has(t.key) ? keep(BUILTIN.Bash) : keep(t.key)));
 }