@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/tools/pipeline.js

@@ -1,25 +1,49 @@
-import { ToolError, validateInputForm, validateToolDisplay, } from "@capybara-hq/plugin-sdk";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { parseToolKey, ToolError, validateInputForm, validateToolDisplay, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Optional } from "@nestjs/common";
 import { normalizeStoredDefinition } from "../agents/definition.js";
+import { EventLog } from "../conversations/event-log.js";
 import { ToolViewSchema } from "../conversations/events.js";
 import { clipText } from "../extensions/hooks.js";
+import { ExtensionHost } from "../extensions/host.js";
 import { ExtensionUnloadedError, PLUGIN_UNLOADED_TOOL_ERROR } from "../extensions/inflight.js";
 import { audit } from "../identity/audit.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { UNKNOWN_RESULT_TEXT } from "../runtime/context/pairing.js";
 import { fireObserve, hookDeniedAudit, hookDeniedEvent, hookScope, } from "../runtime/hook-calls.js";
-import { subagentsWaitId, subagentWaitingIdemKey, } from "../runtime/loop.js";
+import { subagentsWait, subagentWaitingIdemKey, } from "../runtime/loop.js";
 import { assistantIdemKey, MAX_MODEL_ATTEMPTS, modelCallIdemKey } from "../runtime/model-call.js";
 import { TERMINAL_STATUSES } from "../runtime/run-finish.js";
 import { childResult, dispatchOfCall, finishedEvent, } from "../runtime/subagents/child.js";
 import { forkSeqOfCall, pairStoppedForks } from "../runtime/subagents/skill-fork.js";
+import { SubagentsService } from "../runtime/subagents/subagents.service.js";
 import { skillLoadOfferedIn } from "../skills/catalog.js";
-import { breakerOpenMessage } from "./breaker.js";
+import { ApprovalsService } from "./approvals.service.js";
+import { Breaker, breakerOpenMessage } from "./breaker.js";
+import { TOOL_SEARCH } from "./builtin-names.js";
 import { AGENT_STOPPED_WITH_RUN_TEXT, AGENT_TOOL, AgentToolInput, } from "./builtins/agent.js";
 import { isAlwaysLoaded, notLoadedText } from "./builtins/tool-search.js";
-import { CredentialMissing } from "./credentials.js";
+import { CredentialMissing, Credentials } from "./credentials.js";
+import { ToolDrift } from "./drift.js";
 import { ElicitationSession } from "./elicitation.js";
-import { renderResult, resolveOutputRefs, spillIfLarge } from "./outputs.js";
+import { legacyHint, legacyToolInput, legacyToolKey } from "./legacy-keys.js";
+import { renderResult, resolveOutputRefs, spillIfLarge, ToolOutputs } from "./outputs.js";
 import { createDecidePolicy } from "./policy.js";
+import { QuestionsService } from "./questions.service.js";
 import { redactDeep, redactorFor } from "./redact.js";
+import { ToolRegistry, } from "./registry.js";
 import { runResourceTool } from "./resources.js";
 import { validateInput } from "./validate.js";
 // ---- 模型可见文案（英文） ----
@@ -45,8 +69,27 @@ export const RUN_STOPPED_TEXT = "The run was stopped before this tool call was e
 export const RUN_STOPPED_DURING_TEXT = "The run was stopped while this tool call was running; its outcome is unknown. Verify before retrying.";
 const timeoutText = (key, ms) => `Tool ${key} timed out after ${ms / 1000}s. The operation may or may not have completed; verify before retrying.`;
 const failedText = (key, errName) => `Tool ${key} failed (${errName}). The operation may not have completed; check before retrying or try another approach.`;
-const unknownToolText = (name, keys, toolSearch) => `Unknown tool "${name}". Available tools: ${keys.length === 0 ? "(none)" : keys.join(", ")}.` +
-    (toolSearch ? " Use tool_search to load other tools." : "");
+/**
+ * Is a logged call key the `Agent` tool: the current key, or the rc `agent` of a call dispatched
+ * before the rename (spec §9; a builtin maps without a scope)?
+ */
+const isAgentCallKey = (key) => key === AGENT_TOOL || legacyToolKey(key) === AGENT_TOOL;
+/** The connector slugs and extension names among the run's tools (to read old `<x>__<tool>` keys). */
+const legacyScopeOf = (tools) => {
+    const connectorSlugs = new Set();
+    const extensionNames = new Set();
+    for (const t of tools) {
+        const p = parseToolKey(t.key);
+        if (p?.kind === "connector")
+            connectorSlugs.add(p.slug);
+        else if (p?.kind === "extension")
+            extensionNames.add(p.plugin);
+    }
+    return { connectorSlugs, extensionNames };
+};
+const unknownToolText = (name, keys, toolSearch, hint = null) => `Unknown tool "${name}". Available tools: ${keys.length === 0 ? "(none)" : keys.join(", ")}.` +
+    (toolSearch ? " Use ToolSearch to load other tools." : "") +
+    (hint === null ? "" : ` ${hint}`);
 const unavailableText = (name, reason) => `Tool "${name}" is unavailable: ${reason}.`;
 const deniedText = (key) => `Tool ${key} is denied by policy.`;
 /** Longest hook reason quoted in {@link hookDeniedText}. */
@@ -60,22 +103,10 @@ const invalidFormText = (key, problems) => `Tool ${key} returned an invalid inpu
 const stateTooLargeText = (key) => `Tool ${key} returned input state larger than ${MAX_INPUT_STATE_BYTES / 1024} KB.`;
 const personalMissingText = (connectorName) => `The user has not connected ${connectorName}. A connect card was shown; ask the user to connect, then retry.`;
 const orgMissingText = (connectorName) => `${connectorName} has no organization credential configured; ask an organization admin to set it up.`;
+/** Optional provider: the pipeline's {@link ToolPipelineHooks} (tests). */
+export const TOOL_PIPELINE_HOOKS = Symbol("TOOL_PIPELINE_HOOKS");
 /** `runCall` dispatched a sub-agent: the call stays open until the child run finishes. */
 const OPEN = "open";
-/**
- * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
- * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
- * approval); the timeout is a safety net.
- */
-export function subagentsWait(runId, step, config, now = Date.now()) {
-    const ms = config.tools.approvalTimeoutHours * 3_600_000 + config.runtime.maxRunSeconds * 1000 + 600_000;
-    return {
-        kind: "subagents",
-        id: subagentsWaitId(runId, step),
-        expiresAt: new Date(now + ms).toISOString(),
-        step,
-    };
-}
 const approvalAuthorization = (a) => ({
     approvalId: a.id,
     approvedByAccountId: a.decidedBy,
@@ -143,12 +174,47 @@ const inputWait = (q) => ({
  *
  * 有副作用不盲目重跑（spec 4.3）：执行前写 `tool_call_started`；续跑时「有开始无结果」的调用记为结果未知，不再执行。
  */
-export class ToolPipeline {
-    deps;
+let ToolPipeline = class ToolPipeline {
+    config;
+    txHost;
     decide;
-    constructor(deps) {
-        this.deps = deps;
-        this.decide = deps.decidePolicy ?? createDecidePolicy(deps.db);
+    deps;
+    constructor(kdb, eventLog, 
+    /** The `Agent` tool's sub-agent dispatch; absent (tests): `Agent` calls are refused. */
+    subagents, registry, credentials, breaker, outputs, approvals, questions, config, log, 
+    /** Plugin hooks and inline ui contributions; absent (tests): no hooks, cards dropped. */
+    host, drift, txHost, hooks) {
+        this.config = config;
+        this.txHost = txHost;
+        this.deps = {
+            get db() {
+                return kdb.db;
+            },
+            eventLog,
+            registry,
+            credentials,
+            breaker,
+            outputs,
+            approvals,
+            questions,
+            log,
+            hooks,
+            get pluginHooks() {
+                return host?.hooks;
+            },
+            inlineViews: (plugin) => new Set((host?.current(plugin)?.manifest.ui ?? [])
+                .filter((c) => c.place === "inline" && c.aliasOf === undefined)
+                .map((c) => c.id)),
+            onToolsChanged: (orgId, connectorId) => {
+                void drift?.onToolsChanged(orgId, connectorId);
+            },
+            get subagents() {
+                return subagents ? { dispatch: (a) => subagents.dispatch(a) } : undefined;
+            },
+        };
+        const decide = hooks?.decidePolicy;
+        // the default policy reads live, on the context's handle
+        this.decide = decide ?? ((tool, def, c) => createDecidePolicy(kdb.db)(tool, def, c));
     }
     /**
      * tools 节点：按顺序处理本步 assistant 消息里的全部 `tool_call`，每个调用都以一条 `tool_result` 结束
@@ -168,7 +234,7 @@ export class ToolPipeline {
             // 每步实时解析（连接器 / 插件状态可能在模型调用之后变化）
             if (!resolved) {
                 // the request builder's rule: a skills catalog snapshot (even an empty one) or a person's
-                // skill invocation in the log → skill_load is offered (see skillLoadOffered)
+                // skill invocation in the log → Skill is offered (see skillLoadOffered)
                 const skillLoad = await skillLoadOfferedIn(this.deps.db, this.deps.eventLog, ctx.conversationId);
                 resolved = await this.deps.registry.forAgent(ctx.orgId, {
                     tools: ctx.agent.tools ?? [],
@@ -178,13 +244,13 @@ export class ToolPipeline {
             }
             return resolved;
         };
-        // `agent` calls whose sub-agent still runs (spec §7.1): a dispatch never blocks later calls;
+        // `Agent` calls whose sub-agent still runs (spec §7.1): a dispatch never blocks later calls;
         // once every call was handled, the step waits for them
         let open = 0;
         for (const call of calls) {
             if (await eventLog.findByIdem(ctx.conversationId, idem.result(ctx.runId, call.id)))
                 continue;
-            if (call.name === AGENT_TOOL) {
+            if (isAgentCallKey(call.name)) {
                 const row = await dispatchOfCall(this.deps.db, ctx.runId, call.id);
                 if (row) {
                     if (!(await this.finishAgentCall(ctx, row, call, resolve)))
@@ -203,9 +269,7 @@ export class ToolPipeline {
             // their calls get their results now, and the children are stopped after the run's terminal
             // commit (spec §12)
             if (ctx.signal.aborted) {
-                const stopped = await this.deps.db
-                    .transaction()
-                    .execute((t) => this.stopOpenAgentCalls(t, ctx.runId, ctx.agent));
+                const stopped = await this.stopOpenAgentCallsNow(ctx.runId, ctx.agent);
                 if (stopped.toSeq !== null) {
                     await eventLog.notify(ctx.conversationId, stopped.toSeq);
                 }
@@ -214,13 +278,13 @@ export class ToolPipeline {
             }
             return {
                 kind: "suspended",
-                waitingFor: subagentsWait(ctx.runId, ctx.step, this.deps.config()),
+                waitingFor: subagentsWait(ctx.runId, ctx.step, this.config.get()),
             };
         }
         return { kind: "done" };
     }
     /**
-     * An `agent` call that was dispatched (spec §7.1 "already dispatched"): when its child run is
+     * An `Agent` call that was dispatched (spec §7.1 "already dispatched"): when its child run is
      * terminal, writes the parent's `subagent_finished` (if the child's finisher did not) and the
      * call's `tool_result` from the child's log, and returns true; else false (still open).
      *
@@ -236,12 +300,13 @@ export class ToolPipeline {
         const r = await childResult(this.deps.eventLog, row, { modelGiven });
         if (!r)
             return false;
-        // No spec-hash check as in processCall: an `agent` call writes no tool_call_started holding
+        // No spec-hash check as in processCall: an `Agent` call writes no tool_call_started holding
         // the executed definition's hash, and its description changes with the roster and limits
         // while the child runs. The call's approval (forCall: its latest) is by construction the one
         // that let this dispatch start, since a dispatch happens only after an approved decision.
         const approval = await this.deps.approvals.forCall(ctx.runId, call.id);
-        await this.writeResult(ctx, row.parentCallId, AGENT_TOOL, { content: r.content, isError: r.isError }, [finishedEvent(row, r.finished)], {
+        // the result keeps the logged key (`agent` for a call dispatched before the rename, spec §9)
+        await this.writeResult(ctx, row.parentCallId, call.name, { content: r.content, isError: r.isError }, [finishedEvent(row, r.finished)], {
             durationMs: r.finished.durationMs,
             connectorId: null,
             ...(approval?.status === "approved" && {
@@ -268,19 +333,25 @@ export class ToolPipeline {
         }
         return true;
     }
+    /** {@link stopOpenAgentCalls} in a transaction of its own (a stop seen by the tools node). */
+    async stopOpenAgentCallsNow(runId, agent) {
+        return this.stopOpenAgentCalls(runId, agent);
+    }
     /**
-     * Writes, in `t`, the `tool_result` of every open `agent` call of a run that is being stopped
+     * Writes, in the caller's transaction (`mandatory`), the `tool_result` of every open `Agent` call
+     * of a run that is being stopped
      * (sub-agents spec §12: a person stopped it while it waited on sub-agents, or its deadline or a
      * stop hit its tools node after a dispatch). A call whose child already ended gets the child's
      * result (and the missing `subagent_finished`); one whose child is still active gets
      * {@link AGENT_STOPPED_WITH_RUN_TEXT}. The caller stops those children after its commit.
      *
-     * Like every `agent` result (see {@link finishAgentCall}), each is audited `tool.called` in `t`
+     * Like every `Agent` result (see {@link finishAgentCall}), each is audited `tool.called` in it
      * (duration: the child's, or the time since the dispatch) and fires `tool.postExecute`, through
      * `fire()`, which the caller runs after its commit. Returns the steps and calls written (the
      * caller must not write a "not executed" result for them) and the highest seq written.
      */
-    async stopOpenAgentCalls(t, runId, agent) {
+    async stopOpenAgentCalls(runId, agent) {
+        const t = this.deps.db;
         // phase D: the run's fork invocation without a report gets one (a fork has no tool call)
         const forks = await pairStoppedForks(t, this.deps.eventLog, runId);
         const none = {
@@ -324,6 +395,8 @@ export class ToolPipeline {
             return none;
         const conversationId = run.conversation_id;
         const inputs = new Map();
+        // the logged key of each call (`agent` for a call dispatched before the rename, spec §9)
+        const names = new Map();
         const events = [];
         const calls = [];
         for (const d of dispatches) {
@@ -345,8 +418,11 @@ export class ToolPipeline {
                     .executeTakeFirst();
                 const content = msg?.payload?.content ?? [];
                 for (const b of content) {
-                    if (b.type === "tool_call" && b.id !== undefined)
+                    if (b.type === "tool_call" && b.id !== undefined) {
                         inputs.set(b.id, b.input);
+                        if (b.name !== undefined)
+                            names.set(b.id, b.name);
+                    }
                 }
             }
             const input = inputs.get(d.parent_call_id);
@@ -386,7 +462,7 @@ export class ToolPipeline {
                 payload: {
                     step: d.step,
                     callId: d.parent_call_id,
-                    toolKey: AGENT_TOOL,
+                    toolKey: names.get(d.parent_call_id) ?? AGENT_TOOL,
                     content: r.content,
                     isError: r.isError,
                 },
@@ -395,7 +471,7 @@ export class ToolPipeline {
         }
         if (calls.length === 0)
             return none;
-        const written = await this.deps.eventLog.append(conversationId, events, t);
+        const written = await this.deps.eventLog.appendIn(conversationId, events);
         for (const c of calls) {
             const approval = await t
                 .selectFrom("approvals")
@@ -529,36 +605,48 @@ export class ToolPipeline {
             await this.writeResult(ctx, call.id, key, { content, isError: true });
             return undefined;
         };
-        const tool = resolved.tools.find((t) => t.key === call.name);
+        let tool = resolved.tools.find((t) => t.key === call.name);
+        // A call logged before the tool keys were renamed (spec 8.1): the request that issued it offered
+        // the old key. It runs as the current tool with translated input; the result keeps the logged key.
+        let legacy = false;
+        if (!tool) {
+            const next = legacyToolKey(call.name, legacyScopeOf(resolved.tools));
+            const current = next === null ? undefined : resolved.tools.find((t) => t.key === next);
+            if (current && (await this.requestToolKeys(ctx))?.has(call.name) === true) {
+                tool = current;
+                legacy = true;
+            }
+        }
         if (!tool) {
             const why = resolved.unavailable.find((u) => u.ref === call.name) ??
                 resolved.hidden?.find((u) => u.ref === call.name);
             if (why)
                 return fail(unavailableText(call.name, why.reason));
             let keys = resolved.tools.map((t) => t.key);
-            // tool_search 模式：目录可能很大，只列内置工具与发出本次调用的请求里带了定义的工具
+            // ToolSearch 模式：目录可能很大，只列内置工具与发出本次调用的请求里带了定义的工具
             if (resolved.toolSearch === true) {
                 const sent = await this.sentTools(ctx);
                 if (sent !== null)
                     keys = keys.filter((k) => isAlwaysLoaded(k) || sent.has(k));
             }
             keys.sort();
-            return fail(unknownToolText(call.name, keys, keys.includes("tool_search")));
+            return fail(unknownToolText(call.name, keys, keys.includes(TOOL_SEARCH), legacyHint(call.name)));
         }
-        // tool_search 模式下，模型只能调用请求里带了完整定义的工具：目录里有、但发出本次调用的请求没加载 →
-        // 明确错误，不自动加载（spec 5.5 / 6.3）。同一步里先 tool_search 再调用刚加载的工具同样报错。
-        if (resolved.toolSearch === true && !isAlwaysLoaded(tool.key)) {
+        const outKey = legacy ? call.name : tool.key;
+        // ToolSearch 模式下，模型只能调用请求里带了完整定义的工具：目录里有、但发出本次调用的请求没加载 →
+        // 明确错误，不自动加载（spec 5.5 / 6.3）。同一步里先 ToolSearch 再调用刚加载的工具同样报错。
+        if (!legacy && resolved.toolSearch === true && !isAlwaysLoaded(tool.key)) {
             const sent = await this.sentTools(ctx);
             if (sent !== null && !sent.has(tool.key))
-                return fail(notLoadedText(tool.key), tool.key);
+                return fail(notLoadedText(tool.key), outKey);
         }
         let input;
         try {
-            input = await resolveOutputRefs(call.input, (id) => this.deps.outputs.load({ orgId: ctx.orgId, conversationId: ctx.conversationId }, id));
+            input = await resolveOutputRefs(legacy ? legacyToolInput(call.name, call.input) : call.input, (id) => this.deps.outputs.load({ orgId: ctx.orgId, conversationId: ctx.conversationId }, id));
         }
         catch (e) {
             if (e instanceof ToolError)
-                return fail(e.message, tool.key);
+                return fail(e.message, outKey);
             throw e;
         }
         // 连接器工具的 schema 来自连接器（不受信任）：去掉有风险的关键字并限制大小 / 层数
@@ -567,7 +655,7 @@ export class ToolPipeline {
             log: this.deps.log,
         });
         if (invalid !== null)
-            return fail(invalid, tool.key);
+            return fail(invalid, outKey);
         const decision = await this.decide(tool, ctx.agent, {
             orgId: ctx.orgId,
             accountId: ctx.accountId,
@@ -580,15 +668,19 @@ export class ToolPipeline {
             }),
         });
         if (decision === "deny")
-            return fail(deniedText(tool.key), tool.key);
+            return fail(deniedText(tool.key), outKey);
         if (typeof decision === "object" && "unavailable" in decision) {
-            return fail(unavailableText(tool.key, decision.unavailable), tool.key);
+            return fail(unavailableText(tool.key, decision.unavailable), outKey);
         }
         // 该调用已有审批（续跑）→ 按审批结果；没有且策略为 ask → 建审批并等待
         // （不写 tool_call_started：此时尚未开始执行）。
         let approval = await this.deps.approvals.forCall(ctx.runId, call.id);
         // 批准的是旧定义（等待期间工具定义变了）：原批准不适用于当前定义，策略仍需审批时按新定义重新审批。
-        const stale = approval?.status === "approved" && approval.specHash !== tool.specHash;
+        // An in-flight rc call (spec §9) is the exception: its approval was asked under the rc definition
+        // of the same call, and the rename changed every builtin's definition; the person approved this
+        // very call, so the approval stands.
+        const approvedHere = approval?.status === "approved" && (legacy || approval.specHash === tool.specHash);
+        const stale = approval?.status === "approved" && !approvedHere;
         if ((!approval || stale) && typeof decision === "object" && "ask" in decision) {
             approval = await this.deps.approvals.request({
                 attempt: (approval?.attempt ?? 0) + 1,
@@ -608,10 +700,10 @@ export class ToolPipeline {
         }
         if (approval && approval.status !== "approved") {
             const refused = this.refusalText(approval);
-            return refused === null ? approvalWait(approval) : fail(refused, tool.key);
+            return refused === null ? approvalWait(approval) : fail(refused, outKey);
         }
         // 走到这里即放行：在（与当前定义一致的）审批下执行，否则是授权或策略放行
-        const authorization = approval?.status === "approved" && approval.specHash === tool.specHash
+        const authorization = approval?.status === "approved" && approvedHere
             ? approvalAuthorization(approval)
             : typeof decision === "object" && "grant" in decision
                 ? { grant: decision.grant }
@@ -626,7 +718,7 @@ export class ToolPipeline {
             // written with the call's tool_result, so a call with a logged denial never runs again anyway.
             const prior = await this.deps.eventLog.findByIdem(ctx.conversationId, idem.hookDenied(ctx.runId, call.id));
             if (prior?.type === "hook_denied") {
-                return fail(hookDeniedText(prior.payload.plugin, prior.payload.reason), tool.key);
+                return fail(hookDeniedText(prior.payload.plugin, prior.payload.reason), outKey);
             }
         }
         // payload only built when a tool hook is registered (zero overhead otherwise)
@@ -648,7 +740,7 @@ export class ToolPipeline {
             catch (e) {
                 // run() rejects only when the run's signal aborted: an abort, never a deny
                 if (ctx.signal.aborted)
-                    return fail(RUN_STOPPED_TEXT, tool.key);
+                    return fail(RUN_STOPPED_TEXT, outKey);
                 throw e;
             }
             if (!verdict.allowed) {
@@ -666,20 +758,20 @@ export class ToolPipeline {
                     step: ctx.step,
                     callId: call.id,
                 });
-                await this.writeResult(ctx, call.id, tool.key, { content: hookDeniedText(verdict.plugin, verdict.reason), isError: true }, [event], undefined, [hookDeniedAudit(site, event.payload, verdict)]);
+                await this.writeResult(ctx, call.id, outKey, { content: hookDeniedText(verdict.plugin, verdict.reason), isError: true }, [event], undefined, [hookDeniedAudit(site, event.payload, verdict)]);
                 return undefined;
             }
         }
-        // `agent` (sub-agents spec §7.1): no tool_call_started; the dispatch is made durable in one
+        // `Agent` (sub-agents spec §7.1): no tool_call_started; the dispatch is made durable in one
         // transaction (its marker is the subagent_dispatches row) and the call stays open
         const dispatcher = this.deps.subagents;
         if (tool.source.kind === "builtin" && tool.key === AGENT_TOOL && dispatcher) {
             const parsed = AgentToolInput.safeParse(input);
             if (!parsed.success) {
-                return fail("Invalid agent call: pass description and prompt, and optionally subagent_type, model or resume.", tool.key);
+                return fail("Invalid agent call: pass description and prompt, and optionally subagent_type, model or resume.", outKey);
             }
             const r = await dispatcher.dispatch({ ctx, callId: call.id, input: parsed.data });
-            return r.kind === "refused" ? fail(r.content, tool.key) : OPEN;
+            return r.kind === "refused" ? fail(r.content, outKey) : OPEN;
         }
         await this.deps.eventLog.append(ctx.conversationId, [
             {
@@ -702,7 +794,7 @@ export class ToolPipeline {
         const rendered = outcome.kind === "result"
             ? renderResult(outcome.result)
             : { text: outcome.message, contentTypes: [], isError: true };
-        // 内置工具（tool_search）报告的已加载工具：只认本步可用、非内置的 key，写进 tool_result（日志即事实源）
+        // 内置工具（ToolSearch）报告的已加载工具：只认本步可用、非内置的 key，写进 tool_result（日志即事实源）
         const loadedTools = outcome.kind === "result" && tool.source.kind === "builtin"
             ? loadedFrom(outcome.result, resolved.tools)
             : [];
@@ -719,7 +811,7 @@ export class ToolPipeline {
         const card = outcome.kind === "result" && tool.source.kind === "plugin"
             ? this.cardOf(outcome.result, tool.source.plugin, tool.key)
             : undefined;
-        const cfg = this.deps.config().tools;
+        const cfg = this.config.get().tools;
         const spilled = await spillIfLarge(rendered.text, {
             // 内置工具可给更低的转存阈值（沙箱 bash 30000 字符）
             spillChars: Math.min(cfg.outputSpillChars, tool.spillChars ?? Number.POSITIVE_INFINITY),
@@ -746,7 +838,7 @@ export class ToolPipeline {
                 },
             ]
             : [];
-        await this.writeResult(ctx, call.id, tool.key, {
+        await this.writeResult(ctx, call.id, outKey, {
             content: spilled.content,
             isError: rendered.isError,
             ...(spilled.outputId !== undefined && { outputId: spilled.outputId }),
@@ -787,9 +879,24 @@ export class ToolPipeline {
         }
         return undefined;
     }
+    /**
+     * Every tool key the request that issued this step's calls offered (`request.tools` plus the
+     * `catalog` keys), in any mode; null when its model_call is not found. Used to tell a call to an
+     * old key that was offered (in flight across the rename) from one that never was.
+     */
+    async requestToolKeys(ctx) {
+        for (let attempt = MAX_MODEL_ATTEMPTS; attempt >= 1; attempt--) {
+            const e = await this.deps.eventLog.findByIdem(ctx.conversationId, modelCallIdemKey(ctx.runId, ctx.step, attempt));
+            if (e?.type !== "model_call")
+                continue;
+            const { tools, catalog } = e.payload.request;
+            return new Set([...(tools ?? []), ...(catalog ?? [])].map((t) => t.key));
+        }
+        return null;
+    }
     /**
      * 发出本步调用的请求里带了完整定义的工具 key：本步最后一次尝试的 `model_call.request.tools`
-     * （`assistant_message` 来自最后一次尝试）。该请求不在 tool_search 模式（没有 `catalog`，工具全部发送）
+     * （`assistant_message` 来自最后一次尝试）。该请求不在 ToolSearch 模式（没有 `catalog`，工具全部发送）
      * 或找不到 model_call 时返回 null（不做加载检查）。已加载集合由此从日志得出，不放进程内存。
      */
     async sentTools(ctx) {
@@ -863,7 +970,7 @@ export class ToolPipeline {
         const handler = this.deps.registry.handler(tool.source);
         if (!handler)
             return { kind: "error", message: `Tool ${tool.key} is no longer available.` };
-        // 插件处理函数只拿到 SDK 的 ToolCallContext；内置工具另外拿到本步解析出的工具（tool_search 用）
+        // 插件处理函数只拿到 SDK 的 ToolCallContext；内置工具另外拿到本步解析出的工具（ToolSearch 用）
         const base = {
             orgId: ctx.orgId,
             accountId: ctx.accountId,
@@ -880,7 +987,7 @@ export class ToolPipeline {
                 ctx.parent !== undefined && { sandboxConversationId: ctx.parent.conversationId }),
         };
         // 内置工具可按输入给自己的时限（沙箱 bash 按命令超时加余量）；缺省 tools.timeoutMs
-        const timeoutMs = tool.timeoutMs?.(input) ?? this.deps.config().tools.timeoutMs;
+        const timeoutMs = tool.timeoutMs?.(input) ?? this.config.get().tools.timeoutMs;
         try {
             const r = await this.bounded(ctx.signal, (signal) => handler(input, { ...base, signal }), undefined, timeoutMs);
             if (r === "timeout") {
@@ -898,7 +1005,7 @@ export class ToolPipeline {
         }
     }
     async executeConnector(tool, source, input, ctx, resume) {
-        const { db, registry, breaker, credentials, config } = this.deps;
+        const { db, registry, breaker, credentials } = this.deps;
         const { orgId } = ctx;
         const connectorId = source.connectorId;
         const app = await db
@@ -1011,7 +1118,7 @@ export class ToolPipeline {
                     onElicit: elicit.handle,
                     onToolsChanged: () => {
                         try {
-                            this.deps.onToolsChanged?.(orgId, connectorId);
+                            this.deps.onToolsChanged(orgId, connectorId);
                         }
                         catch (err) {
                             this.deps.log.warn("tools changed notification failed", {
@@ -1037,7 +1144,7 @@ export class ToolPipeline {
                 return ask;
             if (r === "timeout") {
                 await breaker.failure(orgId, connectorId);
-                return { kind: "error", message: timeoutText(tool.key, config().tools.timeoutMs) };
+                return { kind: "error", message: timeoutText(tool.key, this.config.get().tools.timeoutMs) };
             }
             // 工具自己报告的错误（isError）说明服务可用，也算成功。
             await breaker.success(orgId, connectorId);
@@ -1084,7 +1191,7 @@ export class ToolPipeline {
     /** 额外参与竞速的信号（不传给 work）：中止时以 `Stopped` 抛出，由调用方判断原因。 */
     interrupt, 
     /** 时限（毫秒），缺省 `tools.timeoutMs`。 */
-    timeoutMs = this.deps.config().tools.timeoutMs) {
+    timeoutMs = this.config.get().tools.timeoutMs) {
         if (runSignal.aborted)
             return "aborted";
         const timeout = new AbortController();
@@ -1157,7 +1264,7 @@ export class ToolPipeline {
         if (c === undefined)
             return undefined;
         const x = (typeof c === "object" && c !== null ? c : {});
-        const views = this.deps.inlineViews?.(plugin);
+        const views = this.deps.inlineViews(plugin);
         const keyOk = x.key === undefined || (typeof x.key === "string" && x.key !== "" && x.key.length <= 200);
         if (typeof x.view !== "string" || !views?.has(x.view) || !keyOk) {
             this.deps.log.warn("tool returned an inline card that is not an inline view of its extension; dropped", {
@@ -1205,32 +1312,64 @@ export class ToolPipeline {
             await this.deps.eventLog.append(ctx.conversationId, events);
             return;
         }
-        const written = await this.deps.db.transaction().execute(async (t) => {
-            const out = await this.deps.eventLog.append(ctx.conversationId, events, t);
-            for (const a of audits)
-                await audit(t, a);
-            if (callAudit === undefined)
-                return out;
-            await audit(t, {
-                actorAccountId: ctx.accountId,
-                orgId: ctx.orgId,
-                action: "tool.called",
-                target: ctx.conversationId,
-                detail: {
-                    toolKey,
-                    isError: r.isError,
-                    durationMs: callAudit.durationMs,
-                    agentId: ctx.agentId,
-                    agentVersion: ctx.agentVersion,
-                    conversationId: ctx.conversationId,
-                    runId: ctx.runId,
-                    callId,
-                    ...(callAudit.connectorId !== null && { connectorId: callAudit.connectorId }),
-                    ...callAudit.authorization,
-                },
-            });
+        const written = await this.writeResultIn(ctx, callId, toolKey, r, events, callAudit, audits);
+        await this.deps.eventLog.notify(ctx.conversationId, Math.max(...written.map((e) => e.seq)));
+    }
+    /** The result's events and audit rows in one transaction (see {@link writeResult}). */
+    async writeResultIn(ctx, callId, toolKey, r, events, callAudit, audits) {
+        const t = this.deps.db;
+        const out = await this.deps.eventLog.appendIn(ctx.conversationId, events);
+        for (const a of audits)
+            await audit(t, a);
+        if (callAudit === undefined)
             return out;
+        await audit(t, {
+            actorAccountId: ctx.accountId,
+            orgId: ctx.orgId,
+            action: "tool.called",
+            target: ctx.conversationId,
+            detail: {
+                toolKey,
+                isError: r.isError,
+                durationMs: callAudit.durationMs,
+                agentId: ctx.agentId,
+                agentVersion: ctx.agentVersion,
+                conversationId: ctx.conversationId,
+                runId: ctx.runId,
+                callId,
+                ...(callAudit.connectorId !== null && { connectorId: callAudit.connectorId }),
+                ...callAudit.authorization,
+            },
         });
-        await this.deps.eventLog.notify(ctx.conversationId, Math.max(...written.map((e) => e.seq)));
+        return out;
     }
-}
+};
+__decorate([
+    Transactional()
+], ToolPipeline.prototype, "stopOpenAgentCallsNow", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ToolPipeline.prototype, "stopOpenAgentCalls", null);
+__decorate([
+    Transactional()
+], ToolPipeline.prototype, "writeResultIn", null);
+ToolPipeline = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(EventLog)),
+    __param(2, Inject(SubagentsService)),
+    __param(3, Inject(ToolRegistry)),
+    __param(4, Inject(Credentials)),
+    __param(5, Inject(Breaker)),
+    __param(6, Inject(ToolOutputs)),
+    __param(7, Inject(ApprovalsService)),
+    __param(8, Inject(QuestionsService)),
+    __param(9, Inject(KernelConfigService)),
+    __param(10, Inject(KERNEL_LOGGER)),
+    __param(11, Inject(ExtensionHost)),
+    __param(12, Inject(ToolDrift)),
+    __param(13, Inject(TransactionHost)),
+    __param(14, Optional()),
+    __param(14, Inject(TOOL_PIPELINE_HOOKS))
+], ToolPipeline);
+export { ToolPipeline };