@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/ui/views.js

@@ -1,7 +1,24 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { normalizePlace, validateUiView, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
+import { ConversationsService } from "../conversations/conversations.service.js";
 import { ApiError } from "../errors.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { PreviewerRegistry } from "../files/previewers.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { callExtension } from "./call-extension.js";
 import { canUsePlace, isConversationPlace, UUID_RE } from "./registry.js";
+export { callExtension } from "./call-extension.js";
 /** 插件 render / action 的时限（spec §4.2：慢的插件只让那个标签失败）。 */
 export const UI_CALL_TIMEOUT_MS = 5_000;
 /**
@@ -79,14 +96,23 @@ function actionResultProblems(r) {
  * - 调用带 5 秒时限与中止信号：render 抛错 502 `ui.render_failed`、action 抛错 502 `ui.action_failed`、
  *   超时 504 `ui.timeout`、返回非法视图 502
  *   `ui.invalid_view`，都记告警日志、不写对话日志（这些不是模型可见的内容）。
- * 不依赖 Nest；不保存跨请求状态。
+ * 不保存跨请求状态。
  */
-export class UiViews {
+let UiViews = class UiViews {
     d;
-    timeoutMs;
-    constructor(d) {
-        this.d = d;
-        this.timeoutMs = d.timeoutMs ?? UI_CALL_TIMEOUT_MS;
+    constructor(host, conversations, previewers, db, log) {
+        this.d = {
+            host,
+            // org config rows plus the required bootstrap plugins
+            enabledPlugins: (orgId) => host.enabledPlugins(orgId),
+            canAccessConversation: (orgId, id, accountId) => conversations.isAccessible(orgId, id, accountId),
+            checkWritable: async (orgId, id, accountId) => {
+                await conversations.writable(orgId, id, accountId);
+            },
+            previewEmbedAllowed: (t) => previewers.embedAllowed(t),
+            recordedCard: (conversationId, callId) => recordedCard(db.db, conversationId, callId),
+            log,
+        };
     }
     /** 该组织、该角色可见的界面贡献：插件已启用且已加载；kind view 的要求插件注册了 render；组织页面要 member 以上。 */
     async contributions(orgId, role) {
@@ -248,7 +274,7 @@ export class UiViews {
             plugin: t.plugin,
             what,
             fields: { plugin: t.plugin, contribution: t.id, orgId: t.orgId },
-            timeoutMs: this.timeoutMs,
+            timeoutMs: UI_CALL_TIMEOUT_MS,
             failCode: what === "render" ? "ui.render_failed" : "ui.action_failed",
             failMessage: `Plugin ${t.plugin} failed to ${what} ${t.id}`,
             fn,
@@ -266,41 +292,13 @@ export class UiViews {
         });
         throw new ApiError("ui.invalid_view", `Plugin ${t.plugin} returned an invalid view`);
     }
-}
-/**
- * Calls an extension with a time limit and an abort signal (plugin views, actions and file
- * previewers): over the limit the signal aborts and the call is 504 `ui.timeout`; a throw is
- * `failCode` (502) without echoing the extension's message. An `ApiError` thrown by `fn` passes.
- */
-export async function callExtension(o) {
-    const ac = new AbortController();
-    let timer;
-    const timeout = new Promise((resolve) => {
-        timer = setTimeout(() => {
-            ac.abort(new Error(`plugin ui ${o.what} timed out`));
-            resolve("timeout");
-        }, o.timeoutMs);
-    });
-    try {
-        const r = await Promise.race([
-            Promise.resolve()
-                .then(() => o.fn(ac.signal))
-                .then((value) => ({ value })),
-            timeout,
-        ]);
-        if (r === "timeout") {
-            o.log.warn(`plugin ui ${o.what} timed out`, { ...o.fields, timeoutMs: o.timeoutMs });
-            throw new ApiError("ui.timeout", `Plugin ${o.plugin} did not respond within ${o.timeoutMs / 1000}s`);
-        }
-        return r.value;
-    }
-    catch (e) {
-        if (e instanceof ApiError)
-            throw e;
-        o.log.warn(`plugin ui ${o.what} failed`, { ...o.fields, err: e });
-        throw new ApiError(o.failCode, o.failMessage);
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
+};
+UiViews = __decorate([
+    Injectable(),
+    __param(0, Inject(ExtensionHost)),
+    __param(1, Inject(ConversationsService)),
+    __param(2, Inject(PreviewerRegistry)),
+    __param(3, Inject(KernelDb)),
+    __param(4, Inject(KERNEL_LOGGER))
+], UiViews);
+export { UiViews };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-rc.3",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -31,14 +31,21 @@
   ],
   "dependencies": {
     "@fastify/cookie": "^11.1.3",
+    "@fastify/static": "^9.3.0",
     "@langchain/core": "^1.2.18",
     "@langchain/langgraph": "^1.5.1",
     "@langchain/langgraph-checkpoint": "^1.2.0",
+    "@nestjs/bullmq": "12.0.0",
     "@nestjs/common": "^12.1.3",
     "@nestjs/core": "^12.1.3",
     "@nestjs/platform-fastify": "^12.1.3",
+    "@nestjs/schedule": "12.0.2",
+    "@nestjs/swagger": "12.0.5",
+    "@nestjs/terminus": "12.1.0",
+    "@nestjs/throttler": "6.7.1",
     "ajv": "^8.20.0",
     "bullmq": "^6.3.15",
+    "cron": "4.4.0",
     "es-module-lexer": "2.3.2",
     "fastify": "5.12.5",
     "find-my-way": "9.9.0",
@@ -57,14 +64,14 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.0"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.1"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
     "@types/pg": "^8.23.1",
     "@types/semver": "^7.8.0",
     "@types/yauzl": "3.4.0",
-    "@capybara-hq/testing": "0.1.0-rc.2"
+    "@capybara-hq/testing": "0.1.0-rc.3"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0063_tool_keys_claude_code.sql

@@ -0,0 +1,220 @@
+-- Tool naming (spec docs/superpowers/specs/2026-10-29-tool-naming-claude-code-design.md §8.2):
+-- the release candidates' tool keys in mutable state become the current keys. Builtins by the
+-- frozen map of packages/kernel/src/tools/legacy-keys.ts (LEGACY_BUILTINS); an rc `<x>__<tool>`
+-- key becomes `mcp__<x>__<tool>` when `x` is a connector of the row's org (or the row records its
+-- connector) and `plugin__<x>__<tool>` when `x` is an extension of the deployment
+-- (extension_installs, or extension_name_owners for config-declared ones); when both or neither,
+-- the row stays and the kernel's startup notice `tools.legacy_key_unmapped` counts it.
+-- Keys in the current format never match. A grant whose new key already exists for the same
+-- owner is left as it is (the primary key). Decided approvals and answered questions are
+-- history and stay. Logs and recordings are never rewritten (§8). Idempotent: a second run
+-- matches nothing it could change.
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE tool_grants g
+SET tool_key = m.new_key
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE g.tool_key = m.old_key
+  AND NOT EXISTS (
+    SELECT 1 FROM tool_grants x
+    WHERE x.org_id = g.org_id AND x.account_id = g.account_id AND x.agent_id = g.agent_id
+      AND x.tool_key = m.new_key
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE tool_grants g
+SET tool_key = CASE
+  WHEN g.connector_id IS NOT NULL OR (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = g.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(g.tool_key, '__', 1))
+    AND split_part(g.tool_key, '__', 1) NOT IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  ) THEN 'mcp__' || g.tool_key
+  ELSE 'plugin__' || g.tool_key
+END
+WHERE g.tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND g.tool_key !~ '^(mcp|plugin)__'
+  AND (
+    g.connector_id IS NOT NULL
+    OR (
+      EXISTS (SELECT 1 FROM connectors c
+              WHERE c.org_id = g.org_id AND c.deleted_at IS NULL
+                AND c.slug = split_part(g.tool_key, '__', 1))
+    ) <> (
+      split_part(g.tool_key, '__', 1) IN (
+        SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+    )
+  )
+  AND NOT EXISTS (
+    SELECT 1 FROM tool_grants x
+    WHERE x.org_id = g.org_id AND x.account_id = g.account_id AND x.agent_id = g.agent_id
+      AND x.tool_key IN ('mcp__' || g.tool_key, 'plugin__' || g.tool_key)
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE conversation_tool_grants g
+SET tool_key = m.new_key
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE g.tool_key = m.old_key
+  AND NOT EXISTS (
+    SELECT 1 FROM conversation_tool_grants x
+    WHERE x.conversation_id = g.conversation_id AND x.tool_key = m.new_key
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys in place (the old keys no longer name a tool; the kernel reads only the new ones)
+UPDATE conversation_tool_grants g
+SET tool_key = CASE
+  WHEN g.connector_id IS NOT NULL OR (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = v.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(g.tool_key, '__', 1))
+    AND split_part(g.tool_key, '__', 1) NOT IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  ) THEN 'mcp__' || g.tool_key
+  ELSE 'plugin__' || g.tool_key
+END
+FROM conversations v
+WHERE v.id = g.conversation_id
+  AND g.tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND g.tool_key !~ '^(mcp|plugin)__'
+  AND (
+    g.connector_id IS NOT NULL
+    OR (
+      EXISTS (SELECT 1 FROM connectors c
+              WHERE c.org_id = v.org_id AND c.deleted_at IS NULL
+                AND c.slug = split_part(g.tool_key, '__', 1))
+    ) <> (
+      split_part(g.tool_key, '__', 1) IN (
+        SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+    )
+  )
+  AND NOT EXISTS (
+    SELECT 1 FROM conversation_tool_grants x
+    WHERE x.conversation_id = g.conversation_id
+      AND x.tool_key IN ('mcp__' || g.tool_key, 'plugin__' || g.tool_key)
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys of pending approvals in place (resumed by run and call id, never by key)
+UPDATE approvals a
+SET tool_key = m.new_key
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE a.status = 'pending' AND a.tool_key = m.old_key;
+
+-- capybara:allow-destructive rewrites rc tool keys of pending approvals in place (resumed by run and call id, never by key)
+UPDATE approvals a
+SET tool_key = CASE
+  WHEN a.connector_id IS NOT NULL OR (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = a.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(a.tool_key, '__', 1))
+    AND split_part(a.tool_key, '__', 1) NOT IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  ) THEN 'mcp__' || a.tool_key
+  ELSE 'plugin__' || a.tool_key
+END
+WHERE a.status = 'pending'
+  AND a.tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND a.tool_key !~ '^(mcp|plugin)__'
+  AND (
+    a.connector_id IS NOT NULL
+    OR (
+      EXISTS (SELECT 1 FROM connectors c
+              WHERE c.org_id = a.org_id AND c.deleted_at IS NULL
+                AND c.slug = split_part(a.tool_key, '__', 1))
+    ) <> (
+      split_part(a.tool_key, '__', 1) IN (
+        SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+    )
+  );
+
+-- capybara:allow-destructive rewrites rc tool keys of pending questions in place (resumed by run and call id, never by key)
+UPDATE questions q
+SET spec = jsonb_set(q.spec, '{toolKey}', to_jsonb(m.new_key))
+FROM (VALUES
+  ('sandbox_bash', 'Bash'), ('sandbox_read', 'Read'), ('sandbox_write', 'Write'),
+  ('sandbox_edit', 'Edit'), ('sandbox_glob', 'Glob'), ('sandbox_grep', 'Grep'),
+  ('sandbox_deliver', 'Deliver'), ('skill_load', 'Skill'), ('skill_write', 'SkillWrite'),
+  ('ask_user', 'AskUserQuestion'), ('read_tool_output', 'ReadToolOutput'),
+  ('tool_search', 'ToolSearch'), ('agent', 'Agent')
+) AS m(old_key, new_key)
+WHERE q.status = 'pending' AND q.spec->>'toolKey' = m.old_key;
+
+-- capybara:allow-destructive rewrites rc tool keys of pending questions in place (resumed by run and call id, never by key)
+UPDATE questions q
+SET spec = jsonb_set(
+  q.spec,
+  '{toolKey}',
+  to_jsonb(CASE
+    WHEN EXISTS (SELECT 1 FROM connectors c
+                 WHERE c.org_id = q.org_id AND c.deleted_at IS NULL
+                   AND c.slug = split_part(q.spec->>'toolKey', '__', 1))
+    THEN 'mcp__' || (q.spec->>'toolKey')
+    ELSE 'plugin__' || (q.spec->>'toolKey')
+  END)
+)
+WHERE q.status = 'pending'
+  AND q.spec->>'toolKey' ~ '^[a-z0-9][a-z0-9_-]*__.' AND q.spec->>'toolKey' !~ '^(mcp|plugin)__'
+  AND (
+    EXISTS (SELECT 1 FROM connectors c
+            WHERE c.org_id = q.org_id AND c.deleted_at IS NULL
+              AND c.slug = split_part(q.spec->>'toolKey', '__', 1))
+  ) <> (
+    split_part(q.spec->>'toolKey', '__', 1) IN (
+      SELECT name FROM extension_installs UNION SELECT name FROM extension_name_owners)
+  );
+
+-- What the startup notice counts (rows the statements above could not map), each over a partial
+-- index holding only such rows, so the count at every start reads nearly empty indexes. The
+-- predicate is the one of countLegacyToolKeys (packages/kernel/src/tools/legacy-data.ts).
+CREATE INDEX IF NOT EXISTS tool_grants_legacy_key_idx ON tool_grants (org_id)
+  WHERE (tool_key = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write', 'sandbox_edit',
+    'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write', 'ask_user',
+    'read_tool_output', 'tool_search', 'agent']::text[])
+    OR (tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND tool_key !~ '^(mcp|plugin)__'));
+CREATE INDEX IF NOT EXISTS conversation_tool_grants_legacy_key_idx
+  ON conversation_tool_grants (conversation_id)
+  WHERE (tool_key = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write', 'sandbox_edit',
+    'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write', 'ask_user',
+    'read_tool_output', 'tool_search', 'agent']::text[])
+    OR (tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND tool_key !~ '^(mcp|plugin)__'));
+CREATE INDEX IF NOT EXISTS approvals_legacy_key_idx ON approvals (org_id)
+  WHERE status = 'pending'
+    AND (tool_key = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write', 'sandbox_edit',
+    'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write', 'ask_user',
+    'read_tool_output', 'tool_search', 'agent']::text[])
+    OR (tool_key ~ '^[a-z0-9][a-z0-9_-]*__.' AND tool_key !~ '^(mcp|plugin)__'));
+CREATE INDEX IF NOT EXISTS questions_legacy_key_idx ON questions (org_id)
+  WHERE status = 'pending'
+    AND ((spec->>'toolKey') = ANY (ARRAY['sandbox_bash', 'sandbox_read', 'sandbox_write',
+    'sandbox_edit', 'sandbox_glob', 'sandbox_grep', 'sandbox_deliver', 'skill_load', 'skill_write',
+    'ask_user', 'read_tool_output', 'tool_search', 'agent']::text[])
+    OR ((spec->>'toolKey') ~ '^[a-z0-9][a-z0-9_-]*__.' AND (spec->>'toolKey') !~ '^(mcp|plugin)__'));
+
+-- Read before Write / Edit (spec §4.5): EventLog.latestFileState reads the latest tool_result of
+-- a conversation whose view names a file, on every Write and Edit. Without this index it scans
+-- the conversation's events backwards through the primary key, filtering each payload (EXPLAIN
+-- on a 20 000-event conversation: every row removed by the filter for a path never read); with
+-- it, one index probe. Partial: only tool_result rows. Built without CONCURRENTLY (a migration
+-- runs in one transaction), which locks conversation_events against writes while it builds: this
+-- assumes release-candidate-sized event tables, as the event indexes of 0025 and 0040 did. A
+-- deployment with a large table builds it CONCURRENTLY by hand before upgrading; IF NOT EXISTS
+-- then skips it here.
+CREATE INDEX IF NOT EXISTS conversation_events_file_state_idx
+  ON conversation_events (conversation_id, ((payload->'view'->'file'->>'path')), seq DESC)
+  WHERE type = 'tool_result';

package/dist/http/health.controller.d.ts

@@ -1,26 +0,0 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
-import type { FastifyReply } from "fastify";
-/** 一项就绪检查：成功 resolve，失败 reject。 */
-export type ReadinessCheck = () => Promise<void>;
-/** 健康检查参数。 */
-export interface HealthOptions {
-    checks: Record<string, ReadinessCheck>;
-    isStopping: () => boolean;
-    log: Logger;
-    /** 单项检查超时，默认 2s。 */
-    timeoutMs?: number;
-}
-/**
- * `GET /healthz`（进程存活，恒 200）与 `GET /readyz`（依赖就绪）。
- * readyz 的 body 只给出每项检查的 `"ok"` / `"error"`，失败原因只进日志（已打码），不进响应——
- * 驱动的错误信息可能带连接串。停机开始后 readyz 立即 503，不再执行检查。
- * 标为 `@Public()`：挂载内核 API 时全局 AuthGuard 也作用于这里。
- */
-export declare class HealthController {
-    private readonly opts;
-    constructor(opts: HealthOptions);
-    healthz(): {
-        ok: true;
-    };
-    readyz(reply: FastifyReply): Promise<Record<string, unknown>>;
-}

package/dist/http/health.controller.js

@@ -1,79 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { Controller, Get, Inject, Res } from "@nestjs/common";
-import { Public } from "../identity/principal.js";
-import { HEALTH_OPTIONS } from "./tokens.js";
-/** 单项检查的超时：依赖挂起（如 Redis 正在重连、命令进了离线队列）时也要尽快给出 503。 */
-const CHECK_TIMEOUT_MS = 2_000;
-function withTimeout(p, ms) {
-    let timer;
-    const timeout = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
-        timer.unref();
-    });
-    return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
-}
-/**
- * `GET /healthz`（进程存活，恒 200）与 `GET /readyz`（依赖就绪）。
- * readyz 的 body 只给出每项检查的 `"ok"` / `"error"`，失败原因只进日志（已打码），不进响应——
- * 驱动的错误信息可能带连接串。停机开始后 readyz 立即 503，不再执行检查。
- * 标为 `@Public()`：挂载内核 API 时全局 AuthGuard 也作用于这里。
- */
-let HealthController = class HealthController {
-    opts;
-    constructor(opts) {
-        this.opts = opts;
-    }
-    healthz() {
-        return { ok: true };
-    }
-    async readyz(reply) {
-        const { opts } = this;
-        const stopping = () => {
-            reply.code(503);
-            return { ok: false, stopping: true };
-        };
-        if (opts.isStopping())
-            return stopping();
-        const timeoutMs = opts.timeoutMs ?? CHECK_TIMEOUT_MS;
-        const names = Object.keys(opts.checks);
-        const results = await Promise.allSettled(names.map((n) => withTimeout(opts.checks[n](), timeoutMs)));
-        const body = {};
-        let ok = true;
-        results.forEach((r, i) => {
-            const name = names[i];
-            if (r.status === "fulfilled") {
-                body[name] = "ok";
-            }
-            else {
-                ok = false;
-                body[name] = "error";
-                opts.log.warn("readiness check failed", { check: name, err: r.reason });
-            }
-        });
-        if (opts.isStopping())
-            return stopping();
-        reply.code(ok ? 200 : 503);
-        return { ok, ...body };
-    }
-};
-__decorate([
-    Get("healthz")
-], HealthController.prototype, "healthz", null);
-__decorate([
-    Get("readyz"),
-    __param(0, Res({ passthrough: true }))
-], HealthController.prototype, "readyz", null);
-HealthController = __decorate([
-    Controller(),
-    Public(),
-    __param(0, Inject(HEALTH_OPTIONS))
-], HealthController);
-export { HealthController };

package/dist/http/tokens.d.ts

@@ -1,131 +0,0 @@
-/** 内核 logger（`Logger`）的注入令牌。 */
-export declare const KERNEL_LOG: unique symbol;
-/** 健康检查参数（`HealthOptions`）的注入令牌。 */
-export declare const HEALTH_OPTIONS: unique symbol;
-/** 内核 schema 视图（`KernelDb`）的注入令牌。 */
-export declare const KERNEL_DB: unique symbol;
-/** 内核共享 Redis 连接（ioredis `Redis`）的注入令牌。 */
-export declare const KERNEL_REDIS: unique symbol;
-/** 当前配置的取值函数（`() => KernelConfig`，热更新后返回新配置）的注入令牌。 */
-export declare const KERNEL_CONFIG: unique symbol;
-/** `AccountsService` 的注入令牌。 */
-export declare const ACCOUNTS: unique symbol;
-/** `SessionService` 的注入令牌。 */
-export declare const SESSIONS: unique symbol;
-/** `ApiTokenService` 的注入令牌。 */
-export declare const API_TOKENS: unique symbol;
-/** `SettingsService` 的注入令牌。 */
-export declare const SETTINGS: unique symbol;
-/** `LoginRateLimiter` 的注入令牌。 */
-export declare const RATE_LIMITER: unique symbol;
-/** `OrgsService` 的注入令牌。 */
-export declare const ORGS: unique symbol;
-/** `OrgSettingsService`（组织设置）的注入令牌。 */
-export declare const ORG_SETTINGS: unique symbol;
-/** `MembersService` 的注入令牌。 */
-export declare const MEMBERS: unique symbol;
-/** `InvitationsService` 的注入令牌。 */
-export declare const INVITATIONS: unique symbol;
-/** `SetupService` 的注入令牌。 */
-export declare const SETUP: unique symbol;
-/** Injection token for `OrgExtensionConfigs`. */
-export declare const ORG_EXTENSION_CONFIGS: unique symbol;
-/** `ProviderRegistry` 的注入令牌。 */
-export declare const PROVIDER_REGISTRY: unique symbol;
-/** `AgentsService` 的注入令牌。 */
-export declare const AGENTS: unique symbol;
-/** `AgentTemplatesService` (agent templates from plugins). */
-export declare const AGENT_TEMPLATES: unique symbol;
-/** 内核总线（`createBus(..., "kernel")`，`ExtensionContext["bus"]`）的注入令牌。 */
-export declare const KERNEL_BUS: unique symbol;
-/** `EventLog` 的注入令牌。 */
-export declare const EVENT_LOG: unique symbol;
-/** `ConversationsService` 的注入令牌。 */
-export declare const CONVERSATIONS: unique symbol;
-/** `AttachmentsService`（对话附件）的注入令牌。 */
-export declare const ATTACHMENTS: unique symbol;
-/** `SkillsService`（技能库）的注入令牌。 */
-export declare const SKILLS: unique symbol;
-/** `SkillInvoker` (a person's skill invocation, phase D). */
-export declare const SKILL_INVOKER: unique symbol;
-/** `SkillChangesService`（agent 自写技能与技能变更审批）的注入令牌。 */
-export declare const SKILL_CHANGES: unique symbol;
-/** `InboxService`（收件箱汇总）的注入令牌。 */
-export declare const INBOX: unique symbol;
-/** `ConversationOutputs`（网页读工具输出存档）的注入令牌。 */
-export declare const CONVERSATION_OUTPUTS: unique symbol;
-/** `ConversationArtifacts`（产物下载）的注入令牌。 */
-export declare const CONVERSATION_ARTIFACTS: unique symbol;
-/** `ConversationFiles` (file outputs list and text content, UI refresh B). */
-export declare const CONVERSATION_FILES: unique symbol;
-export declare const FILE_PREVIEWERS: unique symbol;
-/** `ConversationQueue` (queued messages, UI refresh B). */
-export declare const CONVERSATION_QUEUE: unique symbol;
-/** `ConversationSandboxStatus`（对话沙箱状态）的注入令牌。 */
-export declare const CONVERSATION_SANDBOX: unique symbol;
-/** `ConversationToolInfo` (tool titles, kinds and key arguments for the conversation page). */
-export declare const CONVERSATION_TOOLS: unique symbol;
-/** `ConversationStreams`（本进程持有的会话 SSE 连接）的注入令牌。 */
-export declare const CONVERSATION_STREAMS: unique symbol;
-/** 连接器凭据（`Credentials`）的注入令牌。 */
-export declare const CREDENTIALS: unique symbol;
-/** `ToolRegistry` 的注入令牌。 */
-export declare const TOOL_REGISTRY: unique symbol;
-/** `ConnectorsService` 的注入令牌。 */
-export declare const CONNECTORS: unique symbol;
-/** `ConnectorContent`（连接器的 prompts / resources，供斜杠命令与 @ 引用）的注入令牌。 */
-export declare const CONNECTOR_CONTENT: unique symbol;
-/** `ApprovalsService`（工具调用审批与授权）的注入令牌。 */
-export declare const APPROVALS: unique symbol;
-/** `QuestionsService`（工具调用的输入请求）的注入令牌。 */
-export declare const QUESTIONS: unique symbol;
-/** `OAuthFlow`（OAuth 授权码连接流程）的注入令牌。 */
-export declare const OAUTH_FLOW: unique symbol;
-/** `ExternalIdentities`（外部身份 ↔ 账号）的注入令牌。 */
-export declare const EXTERNAL_IDENTITIES: unique symbol;
-/** `IdentityBinding`（IM 身份的一次性绑定链接）的注入令牌。 */
-export declare const IDENTITY_BINDING: unique symbol;
-/** `SsoFlow`（第三方登录）的注入令牌。 */
-export declare const SSO_FLOW: unique symbol;
-/** `Offboarding`（成员离职处理）的注入令牌。 */
-export declare const OFFBOARDING: unique symbol;
-/** `ChannelConnections`（组织的渠道连接）的注入令牌。 */
-export declare const CHANNEL_CONNECTIONS: unique symbol;
-/** `DirectorySync`（通讯录同步）的注入令牌。 */
-export declare const DIRECTORY_SYNC: unique symbol;
-/** `UiViews`（插件视图：列出贡献、render / action）的注入令牌。 */
-export declare const UI_VIEWS: unique symbol;
-/** `EmbedTokens`（嵌入应用的短期令牌，签发 / 校验）的注入令牌。 */
-export declare const EMBED_TOKENS: unique symbol;
-/** `OrgUiStreams`（组织级界面刷新 SSE）的注入令牌。 */
-export declare const ORG_UI_STREAMS: unique symbol;
-/** `PricesService`（模型价格表）的注入令牌。 */
-export declare const PRICES: unique symbol;
-/** `TrajectoryService`（轨迹查看器）的注入令牌。 */
-export declare const TRAJECTORIES: unique symbol;
-/** `EvalSetsService`（评测集与用例）的注入令牌。 */
-export declare const EVAL_SETS: unique symbol;
-/** `EvalRunsService`（评测运行）的注入令牌。 */
-export declare const EVAL_RUNS: unique symbol;
-/** `ModelPurposesService`（模型用途映射）的注入令牌。 */
-export declare const MODEL_PURPOSES: unique symbol;
-/** Injection token for `ExtensionInstalls` (extension package imports and install records). */
-export declare const EXTENSION_INSTALLS: unique symbol;
-/** Injection token for `ExtensionAdmin` (deployment-level extension list, status and web approval, enterprise admins). */
-export declare const EXTENSION_ADMIN: unique symbol;
-/** Deployment-level extension install / enable / disable / uninstall (`ExtensionAdminOps`). */
-export declare const EXTENSION_ADMIN_OPS: unique symbol;
-/** Deployment-level extension config (`ExtensionDeploymentConfigService`). */
-export declare const EXTENSION_DEPLOYMENT_CONFIGS: unique symbol;
-/** The enterprise catalog (`CatalogService`). */
-export declare const CATALOG: unique symbol;
-/** Plugin (app bundle) import: prepare / confirm and staging cleanup (`PluginImport`). */
-export declare const PLUGIN_IMPORT: unique symbol;
-/** Marketplaces (`MarketplacesService`). */
-export declare const MARKETPLACES: unique symbol;
-/** Organizations browse and install from the enterprise catalog (`OrgCatalogService`). */
-export declare const ORG_CATALOG: unique symbol;
-/** Catalog requests and approvals (`CatalogRequestsService`). */
-export declare const CATALOG_REQUESTS: unique symbol;
-/** Org install and uninstall of plugins (app bundles) (`PluginInstaller`). */
-export declare const PLUGIN_INSTALLER: unique symbol;