@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/tools/breaker.d.ts

@@ -1,5 +1,5 @@
 import type { Redis } from "ioredis";
-import type { KernelConfig } from "../config/schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 /** 熔断器键：每个组织 × 连接器一个 hash（`f` = 连续失败次数，`o` = 打开到期的毫秒时间戳）。 */
 export declare const breakerKey: (orgId: string, connectorId: string) => string;
 export type BreakerState = {
@@ -19,7 +19,7 @@ export declare function breakerOpenMessage(connectorName: string, failures: numb
 export declare class Breaker {
     private readonly redis;
     private readonly config;
-    constructor(redis: Redis, config: () => KernelConfig);
+    constructor(redis: Redis, config: Pick<KernelConfigService, "get">);
     check(orgId: string, connectorId: string): Promise<BreakerState>;
     /** 记一次失败，返回当前连续失败次数。 */
     failure(orgId: string, connectorId: string): Promise<number>;

package/dist/tools/breaker.js

@@ -1,3 +1,15 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { REDIS } from "../infra/tokens.js";
 /** 熔断器键：每个组织 × 连接器一个 hash（`f` = 连续失败次数，`o` = 打开到期的毫秒时间戳）。 */
 export const breakerKey = (orgId, connectorId) => `capk:breaker:${orgId}:${connectorId}`;
 /**
@@ -47,7 +59,7 @@ export function breakerOpenMessage(connectorName, failures, retryAfterSeconds) {
  * `tools.breakerOpenSeconds` 秒，期间直接拒绝；到期后半开放行，成功清零、失败立即重新打开。
  * 状态只在 Redis（多副本共享），计数与打开状态都带 TTL。
  */
-export class Breaker {
+let Breaker = class Breaker {
     redis;
     config;
     constructor(redis, config) {
@@ -62,11 +74,17 @@ export class Breaker {
     }
     /** 记一次失败，返回当前连续失败次数。 */
     async failure(orgId, connectorId) {
-        const { breakerFailures, breakerOpenSeconds } = this.config().tools;
+        const { breakerFailures, breakerOpenSeconds } = this.config.get().tools;
         return Number(await this.redis.eval(FAILURE, 1, breakerKey(orgId, connectorId), breakerFailures, breakerOpenSeconds * 1000, COUNT_TTL_MS));
     }
     /** 调用成功：清零。 */
     async success(orgId, connectorId) {
         await this.redis.del(breakerKey(orgId, connectorId));
     }
-}
+};
+Breaker = __decorate([
+    Injectable(),
+    __param(0, Inject(REDIS)),
+    __param(1, Inject(KernelConfigService))
+], Breaker);
+export { Breaker };

package/dist/tools/builtin-names.d.ts

@@ -0,0 +1,73 @@
+import type { AgentToolRef } from "../agents/definition.js";
+import type { ToolKind } from "./info.js";
+/**
+ * The names (model-visible keys) of the kernel's builtin tools, following Claude Code (tool naming
+ * spec §4.1). Plain constants: `BuiltinTools`, the tool factories, the registry, policy and the
+ * runtime import them from here. The web keeps its own copy (`apps/web/src/lib/agents.ts`,
+ * `lib/timeline.ts`), checked equal by `test/tools/builtin-names.test.ts`. The release-candidate
+ * names are in `legacy-keys.ts`, never here.
+ */
+export declare const BUILTIN: {
+    readonly Bash: "Bash";
+    readonly Read: "Read";
+    readonly Write: "Write";
+    readonly Edit: "Edit";
+    readonly Glob: "Glob";
+    readonly Grep: "Grep";
+    readonly Deliver: "Deliver";
+    readonly Skill: "Skill";
+    readonly SkillWrite: "SkillWrite";
+    readonly AskUserQuestion: "AskUserQuestion";
+    readonly ReadToolOutput: "ReadToolOutput";
+    readonly ToolSearch: "ToolSearch";
+    readonly Agent: "Agent";
+};
+export type BuiltinName = (typeof BUILTIN)[keyof typeof BUILTIN];
+/** The builtin tools that run in the conversation's sandbox. */
+export declare const SANDBOX_TOOL_NAMES: readonly BuiltinName[];
+/** Sandbox tools that need approval when the org setting `sandboxToolPolicy` is `ask` (not the read-only ones). */
+export declare const SANDBOX_ASK_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * Every builtin name. Saving an agent checks builtin refs against this list, not against what is
+ * registered now, so the order the implementations land in never affects a saved definition.
+ * `SkillWrite` is available only when a definition names it; `ToolSearch` and `Skill` are added
+ * by the registry; `Agent` dispatches sub-agents and its description is built per agent.
+ */
+export declare const BUILTIN_TOOL_NAMES: readonly BuiltinName[];
+/** The builtin that loads a skill (added by the registry when the log has a skills catalog). */
+export declare const SKILL_LOAD: "Skill";
+/** The builtin that searches the tool catalog (added by the registry by org setting and threshold). */
+export declare const TOOL_SEARCH: "ToolSearch";
+/** The builtin that dispatches sub-agents. */
+export declare const AGENT_TOOL: "Agent";
+/**
+ * Tool keys on the spec 3.6 R3 fixed list ("allowed is not confirmed"): their policy is at least
+ * `ask` and remembered grants never let them through. `SkillWrite` changes shared skills.
+ * Connector and extension tools express the same rule with `annotations.requiresUserInteraction`.
+ */
+export declare const R3_FIXED_ASK_TOOL_KEYS: ReadonlySet<string>;
+/**
+ * R3 keys that apply only to shared agents: a private agent's skills are not shared, so its
+ * `SkillWrite` takes effect without asking (R4).
+ */
+export declare const R3_SHARED_AGENT_ONLY_TOOL_KEYS: ReadonlySet<string>;
+/**
+ * Tools a sub-agent never gets (sub-agents spec §5.3, §5.5): `Agent` (depth 1), `AskUserQuestion`
+ * (the person does not see the child), `Deliver` (delivering files is the parent's job) and
+ * `SkillWrite`.
+ */
+export declare const CHILD_REMOVED_TOOLS: readonly ["Agent", "AskUserQuestion", "Deliver", "SkillWrite"];
+/**
+ * The tools of a new agent created without `tools` (`ToolSearch` is added by the registry, never
+ * by a definition). Only for create requests; updates and stored versions get no defaults.
+ */
+export declare const DEFAULT_AGENT_TOOLS: AgentToolRef[];
+/** Kinds of the builtin tools (display only); a builtin missing here is a plain `tool`. */
+export declare const BUILTIN_TOOL_KINDS: Readonly<Record<string, ToolKind>>;
+/**
+ * Input fields left out when matching a replayed call with a recorded one (full-run replay), per
+ * tool: display-only arguments the model writes that do not change what the tool does. `Bash`'s
+ * `description` became required in UI refresh B, so a recording without it and a replayed call
+ * with one (or a different wording) still match.
+ */
+export declare const MATCH_IGNORED_FIELDS: Readonly<Record<string, readonly string[]>>;

package/dist/tools/builtin-names.js

@@ -0,0 +1,116 @@
+/**
+ * The names (model-visible keys) of the kernel's builtin tools, following Claude Code (tool naming
+ * spec §4.1). Plain constants: `BuiltinTools`, the tool factories, the registry, policy and the
+ * runtime import them from here. The web keeps its own copy (`apps/web/src/lib/agents.ts`,
+ * `lib/timeline.ts`), checked equal by `test/tools/builtin-names.test.ts`. The release-candidate
+ * names are in `legacy-keys.ts`, never here.
+ */
+export const BUILTIN = {
+    Bash: "Bash",
+    Read: "Read",
+    Write: "Write",
+    Edit: "Edit",
+    Glob: "Glob",
+    Grep: "Grep",
+    Deliver: "Deliver",
+    Skill: "Skill",
+    SkillWrite: "SkillWrite",
+    AskUserQuestion: "AskUserQuestion",
+    ReadToolOutput: "ReadToolOutput",
+    ToolSearch: "ToolSearch",
+    Agent: "Agent",
+};
+/** The builtin tools that run in the conversation's sandbox. */
+export const SANDBOX_TOOL_NAMES = [
+    BUILTIN.Bash,
+    BUILTIN.Read,
+    BUILTIN.Write,
+    BUILTIN.Edit,
+    BUILTIN.Glob,
+    BUILTIN.Grep,
+    BUILTIN.Deliver,
+];
+/** Sandbox tools that need approval when the org setting `sandboxToolPolicy` is `ask` (not the read-only ones). */
+export const SANDBOX_ASK_TOOL_NAMES = new Set([
+    BUILTIN.Bash,
+    BUILTIN.Write,
+    BUILTIN.Edit,
+    BUILTIN.Deliver,
+]);
+/**
+ * Every builtin name. Saving an agent checks builtin refs against this list, not against what is
+ * registered now, so the order the implementations land in never affects a saved definition.
+ * `SkillWrite` is available only when a definition names it; `ToolSearch` and `Skill` are added
+ * by the registry; `Agent` dispatches sub-agents and its description is built per agent.
+ */
+export const BUILTIN_TOOL_NAMES = [
+    BUILTIN.AskUserQuestion,
+    BUILTIN.ReadToolOutput,
+    BUILTIN.ToolSearch,
+    BUILTIN.Skill,
+    BUILTIN.SkillWrite,
+    ...SANDBOX_TOOL_NAMES,
+    BUILTIN.Agent,
+];
+/** The builtin that loads a skill (added by the registry when the log has a skills catalog). */
+export const SKILL_LOAD = BUILTIN.Skill;
+/** The builtin that searches the tool catalog (added by the registry by org setting and threshold). */
+export const TOOL_SEARCH = BUILTIN.ToolSearch;
+/** The builtin that dispatches sub-agents. */
+export const AGENT_TOOL = BUILTIN.Agent;
+/**
+ * Tool keys on the spec 3.6 R3 fixed list ("allowed is not confirmed"): their policy is at least
+ * `ask` and remembered grants never let them through. `SkillWrite` changes shared skills.
+ * Connector and extension tools express the same rule with `annotations.requiresUserInteraction`.
+ */
+export const R3_FIXED_ASK_TOOL_KEYS = new Set([BUILTIN.SkillWrite]);
+/**
+ * R3 keys that apply only to shared agents: a private agent's skills are not shared, so its
+ * `SkillWrite` takes effect without asking (R4).
+ */
+export const R3_SHARED_AGENT_ONLY_TOOL_KEYS = new Set([
+    BUILTIN.SkillWrite,
+]);
+/**
+ * Tools a sub-agent never gets (sub-agents spec §5.3, §5.5): `Agent` (depth 1), `AskUserQuestion`
+ * (the person does not see the child), `Deliver` (delivering files is the parent's job) and
+ * `SkillWrite`.
+ */
+export const CHILD_REMOVED_TOOLS = [
+    BUILTIN.Agent,
+    BUILTIN.AskUserQuestion,
+    BUILTIN.Deliver,
+    BUILTIN.SkillWrite,
+];
+/**
+ * The tools of a new agent created without `tools` (`ToolSearch` is added by the registry, never
+ * by a definition). Only for create requests; updates and stored versions get no defaults.
+ */
+export const DEFAULT_AGENT_TOOLS = [
+    { kind: "builtin", name: BUILTIN.AskUserQuestion },
+    { kind: "builtin", name: BUILTIN.ReadToolOutput },
+];
+/** Kinds of the builtin tools (display only); a builtin missing here is a plain `tool`. */
+export const BUILTIN_TOOL_KINDS = {
+    [BUILTIN.Bash]: "command",
+    [BUILTIN.Read]: "read",
+    [BUILTIN.Write]: "edit",
+    [BUILTIN.Edit]: "edit",
+    [BUILTIN.Glob]: "search",
+    [BUILTIN.Grep]: "search",
+    [BUILTIN.Deliver]: "tool",
+    [BUILTIN.ToolSearch]: "meta",
+    [BUILTIN.Skill]: "meta",
+    [BUILTIN.SkillWrite]: "meta",
+    [BUILTIN.ReadToolOutput]: "meta",
+    [BUILTIN.AskUserQuestion]: "meta",
+};
+/**
+ * Input fields left out when matching a replayed call with a recorded one (full-run replay), per
+ * tool: display-only arguments the model writes that do not change what the tool does. `Bash`'s
+ * `description` became required in UI refresh B, so a recording without it and a replayed call
+ * with one (or a different wording) still match.
+ */
+export const MATCH_IGNORED_FIELDS = {
+    [BUILTIN.Bash]: ["description"],
+};

package/dist/tools/builtins/agent.d.ts

@@ -3,15 +3,15 @@ import { z } from "zod";
 import type { EventPayload } from "../../conversations/events.js";
 import { type RosterEntry } from "../../runtime/subagents/roster.js";
 import type { BuiltinTool } from "../registry.js";
+export { AGENT_TOOL } from "../builtin-names.js";
 /**
- * The `agent` builtin tool (sub-agents spec §4): dispatches a sub-agent. Its description is built
+ * The `Agent` builtin tool (sub-agents spec §4): dispatches a sub-agent. Its description is built
  * per parent agent version from the roster ({@link agentToolSpec}); the tool pipeline handles the
  * call itself (dispatch, suspend, resume), so {@link agentTool}'s `run` is only a guard.
  */
-export declare const AGENT_TOOL = "agent";
 /** How a sub-agent's run ended (`subagent_finished.status`). */
 export type SubagentStatus = EventPayload<"subagent_finished">["status"];
-/** The input of an `agent` call (§4.2). */
+/** The input of an `Agent` call (§4.2). */
 export declare const AgentToolInput: z.ZodObject<{
     description: z.ZodString;
     prompt: z.ZodString;
@@ -26,7 +26,7 @@ export declare const AgentToolInput: z.ZodObject<{
 }, z.core.$strict>;
 export type AgentToolInputT = z.infer<typeof AgentToolInput>;
 /**
- * The `agent` tool definition of a parent agent version (§4.3): the fixed text with
+ * The `Agent` tool definition of a parent agent version (§4.3): the fixed text with
  * `maxConcurrent`, then one line per roster entry in roster order. Built at tool resolution, so the
  * spec hash changes with the roster or the limit (logged per request in `tool_specs`).
  */
@@ -45,7 +45,7 @@ export declare const AGENT_REFUSALS: {
 };
 /**
  * The parent run was stopped while this sub-agent worked (§4.4, §12): the result of a stopped
- * parent's open `agent` call, and the text of a child stopped with its parent.
+ * parent's open `Agent` call, and the text of a child stopped with its parent.
  */
 export declare const AGENT_STOPPED_WITH_RUN_TEXT = "The run was stopped while this sub-agent was working; it was stopped too.";
 /**
@@ -65,7 +65,7 @@ export declare function agentResultText(r: {
     ownModel?: boolean;
     abortedBy?: "user" | "parent";
     /**
-     * Phase D: the report of a person's fork invocation, whose parent need not have the `agent`
+     * Phase D: the report of a person's fork invocation, whose parent need not have the `Agent`
      * tool: the status line leaves out the resume hint (batch 3 review m2).
      */
     noResumeHint?: boolean;
@@ -75,7 +75,7 @@ export declare function agentResultText(r: {
 };
 /**
  * The builtin. `defaultPolicy: "allow"` (§4.6): a sub-agent runs only tools its parent may run,
- * each under its own policy. The tool pipeline dispatches `agent` calls itself; `run` answers only
+ * each under its own policy. The tool pipeline dispatches `Agent` calls itself; `run` answers only
  * when a call reaches it anyway.
  */
 export declare const agentTool: BuiltinTool;

package/dist/tools/builtins/agent.js

@@ -1,12 +1,8 @@
 import { z } from "zod";
 import { ROSTER_DESCRIPTION_MAX } from "../../runtime/subagents/roster.js";
-/**
- * The `agent` builtin tool (sub-agents spec §4): dispatches a sub-agent. Its description is built
- * per parent agent version from the roster ({@link agentToolSpec}); the tool pipeline handles the
- * call itself (dispatch, suspend, resume), so {@link agentTool}'s `run` is only a guard.
- */
-export const AGENT_TOOL = "agent";
-/** The input of an `agent` call (§4.2). */
+import { AGENT_TOOL } from "../builtin-names.js";
+export { AGENT_TOOL } from "../builtin-names.js";
+/** The input of an `Agent` call (§4.2). */
 export const AgentToolInput = z
     .object({
     description: z.string().min(1).max(80),
@@ -86,7 +82,7 @@ function rosterLine(e) {
         : `${line} (the agent "${inert(e.agentName).replaceAll('"', "'")}", with its own tools and model)`;
 }
 /**
- * The `agent` tool definition of a parent agent version (§4.3): the fixed text with
+ * The `Agent` tool definition of a parent agent version (§4.3): the fixed text with
  * `maxConcurrent`, then one line per roster entry in roster order. Built at tool resolution, so the
  * spec hash changes with the roster or the limit (logged per request in `tool_specs`).
  */
@@ -105,7 +101,7 @@ export function agentToolSpec(roster, maxConcurrent) {
  * `agentToolSpec([general-purpose], 4)`.
  */
 const SPEC = {
-    name: "agent",
+    name: "Agent",
     description: "Dispatch a sub-agent: a fresh agent with its own context that works on one task and returns its " +
         "final reply as this tool's result. The sub-agent sees only your prompt, not this conversation, so " +
         "include everything it needs and say what its final reply must contain. It shares your sandbox " +
@@ -134,7 +130,7 @@ export const AGENT_REFUSALS = {
 };
 /**
  * The parent run was stopped while this sub-agent worked (§4.4, §12): the result of a stopped
- * parent's open `agent` call, and the text of a child stopped with its parent.
+ * parent's open `Agent` call, and the text of a child stopped with its parent.
  */
 export const AGENT_STOPPED_WITH_RUN_TEXT = "The run was stopped while this sub-agent was working; it was stopped too.";
 /** `12345` → `12,345` (no locale data involved, so the text is the same on every replica). */
@@ -210,7 +206,7 @@ export function agentResultText(r) {
 }
 /**
  * The builtin. `defaultPolicy: "allow"` (§4.6): a sub-agent runs only tools its parent may run,
- * each under its own policy. The tool pipeline dispatches `agent` calls itself; `run` answers only
+ * each under its own policy. The tool pipeline dispatches `Agent` calls itself; `run` answers only
  * when a call reaches it anyway.
  */
 export const agentTool = {

package/dist/tools/builtins/ask-user.d.ts

@@ -1,5 +1,5 @@
 import { type FormAnswer, type InputForm } from "@capybara-hq/plugin-sdk";
-import type { KernelConfig } from "../../config/schema.js";
+import type { KernelConfigService } from "../../infra/config/kernel-config.service.js";
 import type { BuiltinTool } from "../registry.js";
 interface Question {
     question: string;
@@ -18,11 +18,11 @@ export declare function questionsForm(questions: Question[]): InputForm;
 /** 答案 → 给模型的结果文本：`User answered: "<question>" = "<answer>"; …`。 */
 export declare function answerText(questions: Question[], answer: FormAnswer): string;
 /**
- * 内置工具 `ask_user`：用通用的输入请求机制实现——首次调用返回 `input_required`，
+ * 内置工具 `AskUserQuestion`：用通用的输入请求机制实现——首次调用返回 `input_required`，
  * 内核暂停运行并展示表单；用户回答（或超时）后用同一 input 再次调用，按 `ctx.resume` 生成结果。
  * 默认 allow（提问本身就是让用户参与，不再审批）。
  */
 export declare function askUserTool(deps: {
-    config: () => KernelConfig;
+    config: Pick<KernelConfigService, "get">;
 }): BuiltinTool;
 export {};

package/dist/tools/builtins/ask-user.js

@@ -1,6 +1,6 @@
 import { ToolError } from "@capybara-hq/plugin-sdk";
 const SPEC = {
-    name: "ask_user",
+    name: "AskUserQuestion",
     description: "Ask the user one or more multiple-choice questions and wait for the answers. Use it when you " +
         "need the user's preference or decision to continue, or when a request is ambiguous; do not use " +
         "it for questions you can answer yourself. Each question has a short header, 2-4 options with a " +
@@ -103,7 +103,7 @@ const text = (t, zh, en) => ({
     display: { summary: { zh, en } },
 });
 /**
- * 内置工具 `ask_user`：用通用的输入请求机制实现——首次调用返回 `input_required`，
+ * 内置工具 `AskUserQuestion`：用通用的输入请求机制实现——首次调用返回 `input_required`，
  * 内核暂停运行并展示表单；用户回答（或超时）后用同一 input 再次调用，按 `ctx.resume` 生成结果。
  * 默认 allow（提问本身就是让用户参与，不再审批）。
  */
@@ -132,7 +132,7 @@ export function askUserTool(deps) {
                     throw new ToolError(`Option labels must be unique within a question; "${q.question}" has duplicates. Provide distinct labels.`);
                 }
             }
-            const state = { hours: deps.config().tools.approvalTimeoutHours };
+            const state = { hours: deps.config.get().tools.approvalTimeoutHours };
             return { kind: "input_required", form: questionsForm(questions), state };
         },
     };

package/dist/tools/builtins/builtin-tools.d.ts

@@ -0,0 +1,21 @@
+import { AttachmentsService } from "../../conversations/attachments.service.js";
+import { EventLog } from "../../conversations/event-log.js";
+import { KernelConfigService } from "../../infra/config/kernel-config.service.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { SandboxService } from "../../sandbox/sandbox.service.js";
+import { SkillChangesService } from "../../skills/changes.service.js";
+import { StorageService } from "../../storage/storage.service.js";
+import { ToolOutputs } from "../outputs.js";
+import type { BuiltinTool } from "../registry.js";
+/**
+ * The kernel's builtin tools, built once from the injected services (their specs: names,
+ * descriptions and schemas, are the factories' own and unchanged). `ToolSearch` and `Skill`
+ * are added to a run by the registry (`forAgent`: organization setting and threshold, a skills
+ * catalog snapshot), not by agent definitions; `SkillWrite` only when a definition names it.
+ */
+export declare class BuiltinTools {
+    private readonly tools;
+    constructor(db: KernelDb, config: KernelConfigService, outputs: ToolOutputs, storage: StorageService, skillChanges: SkillChangesService, attachments: AttachmentsService, eventLog: EventLog, sandbox: SandboxService);
+    /** The builtin tools, in a fixed order. */
+    list(): readonly BuiltinTool[];
+}

package/dist/tools/builtins/builtin-tools.js

@@ -0,0 +1,80 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { AttachmentsService } from "../../conversations/attachments.service.js";
+import { EventLog } from "../../conversations/event-log.js";
+import { KernelConfigService } from "../../infra/config/kernel-config.service.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { SandboxService } from "../../sandbox/sandbox.service.js";
+import { SkillChangesService } from "../../skills/changes.service.js";
+import { StorageService } from "../../storage/storage.service.js";
+import { ToolOutputs } from "../outputs.js";
+import { agentTool } from "./agent.js";
+import { askUserTool } from "./ask-user.js";
+import { readToolOutputTool } from "./read-tool-output.js";
+import { sandboxTools } from "./sandbox/index.js";
+import { skillLoadTool } from "./skill-load.js";
+import { skillWriteTool } from "./skill-write.js";
+import { toolSearchTool } from "./tool-search.js";
+/**
+ * The kernel's builtin tools, built once from the injected services (their specs: names,
+ * descriptions and schemas, are the factories' own and unchanged). `ToolSearch` and `Skill`
+ * are added to a run by the registry (`forAgent`: organization setting and threshold, a skills
+ * catalog snapshot), not by agent definitions; `SkillWrite` only when a definition names it.
+ */
+let BuiltinTools = class BuiltinTools {
+    tools;
+    constructor(db, config, outputs, storage, skillChanges, attachments, eventLog, sandbox) {
+        const sandboxDeps = {
+            sandbox,
+            attachments,
+            storage,
+            eventLog,
+            config,
+        };
+        this.tools = [
+            askUserTool({ config }),
+            readToolOutputTool({ outputs, config }),
+            toolSearchTool(),
+            // dispatches sub-agents; the tool pipeline handles its calls (sub-agents spec §4, §7.1)
+            agentTool,
+            ...sandboxTools(sandboxDeps),
+            // 技能加载：对话日志里有技能目录快照时由注册表自动加入（Ruling M17）
+            skillLoadTool({
+                storage,
+                config,
+                sandbox,
+                attachments,
+                eventLog,
+                get db() {
+                    return db.db;
+                },
+            }),
+            // 自写技能：agent 定义显式引用才可用
+            skillWriteTool({ changes: skillChanges }),
+        ];
+    }
+    /** The builtin tools, in a fixed order. */
+    list() {
+        return this.tools;
+    }
+};
+BuiltinTools = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(KernelConfigService)),
+    __param(2, Inject(ToolOutputs)),
+    __param(3, Inject(StorageService)),
+    __param(4, Inject(SkillChangesService)),
+    __param(5, Inject(AttachmentsService)),
+    __param(6, Inject(EventLog)),
+    __param(7, Inject(SandboxService))
+], BuiltinTools);
+export { BuiltinTools };

package/dist/tools/builtins/read-tool-output.d.ts

@@ -1,4 +1,4 @@
-import type { KernelConfig } from "../../config/schema.js";
+import type { KernelConfigService } from "../../infra/config/kernel-config.service.js";
 import { type ToolOutputs } from "../outputs.js";
 import type { BuiltinTool } from "../registry.js";
 /**
@@ -11,8 +11,8 @@ export declare function readPage(id: string, content: string, opts: {
     charOffset: number;
     budget: number;
 }): string;
-/** 内置工具 `read_tool_output`：读本会话未过期的输出存档（只读、默认 allow）。 */
+/** 内置工具 `ReadToolOutput`：读本会话未过期的输出存档（只读、默认 allow）。 */
 export declare function readToolOutputTool(deps: {
     outputs: Pick<ToolOutputs, "load">;
-    config: () => KernelConfig;
+    config: Pick<KernelConfigService, "get">;
 }): BuiltinTool;

package/dist/tools/builtins/read-tool-output.js

@@ -8,7 +8,7 @@ const DEFAULT_LIMIT = 200;
  */
 const FOOTER_RESERVE = 200;
 const SPEC = {
-    name: "read_tool_output",
+    name: "ReadToolOutput",
     description: "Read a saved tool output by its id, page by page. Large tool results are truncated in the " +
         "conversation and saved in full; the truncation notice gives the output id. Lines are numbered " +
         "from 0. Each call returns up to `limit` lines starting at line `offset`, capped at a maximum " +
@@ -85,7 +85,7 @@ export function readPage(id, content, opts) {
     const footer = `[Lines ${offset}–${last} of ${total}]`;
     return [parts.join("\n"), ...(cut === null ? [] : [cut]), footer].join("\n");
 }
-/** 内置工具 `read_tool_output`：读本会话未过期的输出存档（只读、默认 allow）。 */
+/** 内置工具 `ReadToolOutput`：读本会话未过期的输出存档（只读、默认 allow）。 */
 export function readToolOutputTool(deps) {
     return {
         spec: SPEC,
@@ -95,7 +95,7 @@ export function readToolOutputTool(deps) {
             const content = await deps.outputs.load({ orgId: ctx.orgId, conversationId: ctx.conversationId }, id);
             if (content === null)
                 throw new ToolError(outputNotFoundText(id));
-            const cfg = deps.config().tools;
+            const cfg = deps.config.get().tools;
             const budget = Math.max(1, Math.min(cfg.maxResultReadChars, cfg.outputSpillChars - FOOTER_RESERVE));
             return {
                 content: [

package/dist/tools/builtins/sandbox/bash.d.ts

@@ -1,16 +1,16 @@
-import { type ExecResult } from "@capybara-hq/plugin-sdk";
+import type { ExecResult } from "@capybara-hq/plugin-sdk";
 import type { BuiltinTool } from "../../registry.js";
 import { type SandboxToolDeps } from "./common.js";
-/** 不给 `timeoutSeconds` 时的命令超时（秒），不超过 `sandbox.limits.maxCommandSeconds`。 */
+/** The command timeout in seconds when `timeout` is not given, at most `sandbox.limits.maxCommandSeconds`. */
 export declare const BASH_DEFAULT_TIMEOUT_SECONDS = 120;
 /** The longest `description` (the shell row shows it instead of the command). */
 export declare const BASH_DESCRIPTION_MAX_CHARS = 120;
-/** bash 结果超过这么多字符即转存（走现有输出存档，模型用 read_tool_output 分页读）。 */
+/** bash 结果超过这么多字符即转存（走现有输出存档，模型用 ReadToolOutput 分页读）。 */
 export declare const BASH_SPILL_CHARS = 30000;
 /**
  * 命令结果 → 给模型的文本。`budgetClamped`：运行的时限把超时收紧到了 `seconds`（Ruling M20），超时说明改为
- * 指向 `runtime.maxRunSeconds`，而不是让模型加大 timeoutSeconds。
+ * 指向 `runtime.maxRunSeconds`，而不是让模型加大 timeout。
  */
 export declare function formatExec(r: ExecResult, seconds: number, budgetClamped?: boolean): string;
-/** 内置工具 `sandbox_bash`：在本对话的沙箱里执行命令。 */
+/** 内置工具 `Bash`：在本对话的沙箱里执行命令。 */
 export declare function sandboxBashTool(deps: SandboxToolDeps): BuiltinTool;