@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/runtime/loop.d.ts

@@ -1,4 +1,5 @@
 import type { AgentDefinition } from "../agents/definition.js";
+import type { KernelConfig } from "../config/schema.js";
 import type { ConversationEvent } from "../conversations/events.js";
 import type { StreamSink } from "./model-call.js";
 /** 一次运行交给 loop 的上下文（spec 4.4）。 */
@@ -52,7 +53,7 @@ export interface SubagentParent {
     otherAgent?: boolean;
 }
 /**
- * 运行在等什么人处理：审批（`approvals` 行）或输入请求（`questions` 行，统一承载 `ask_user`、
+ * 运行在等什么人处理：审批（`approvals` 行）或输入请求（`questions` 行，统一承载 `AskUserQuestion`、
  * 插件工具的 `input_required` 与 MCP elicitation）。`expiresAt` 为 ISO 时间。
  * `subagents` (phase C, spec §7.2): sub-agents dispatched in a step are still running; the id is
  * `sa-<runId>-<step>` (no `:`, it is part of BullMQ job ids).
@@ -91,3 +92,9 @@ export type LoopOutcome =
 export interface AgentLoop {
     run(ctx: LoopContext): Promise<LoopOutcome>;
 }
+/**
+ * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
+ * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
+ * approval); the timeout is a safety net.
+ */
+export declare function subagentsWait(runId: string, step: number, config: Pick<KernelConfig, "tools" | "runtime">, now?: number): WaitingFor;

package/dist/runtime/loop.js

@@ -5,3 +5,17 @@
 export const subagentWaitingIdemKey = (childRunId, waitId) => `subagent_waiting:${childRunId}:${waitId}`;
 /** The id of a run's `subagents` wait in `step` (part of BullMQ job ids, so no `:`). */
 export const subagentsWaitId = (runId, step) => `sa-${runId}-${step}`;
+/**
+ * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
+ * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
+ * approval); the timeout is a safety net.
+ */
+export function subagentsWait(runId, step, config, now = Date.now()) {
+    const ms = config.tools.approvalTimeoutHours * 3_600_000 + config.runtime.maxRunSeconds * 1000 + 600_000;
+    return {
+        kind: "subagents",
+        id: subagentsWaitId(runId, step),
+        expiresAt: new Date(now + ms).toISOString(),
+        step,
+    };
+}

package/dist/runtime/maintenance-queue.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The kernel maintenance queue (no `:`): wait timeouts (`wait-timeout`, see waits.ts), one-off
+ * maintenance (sandbox destruction, connector drift, directory sync); no periodic jobs any more
+ * (they are `@LockedCron` / `@LockedInterval` jobs). The queue has one Worker (started on the `worker` role only) that
+ * dispatches by job name to the registered handlers. Separate from the run queues: their handler,
+ * stalled and failure handling assume "one job = one run"; maintenance jobs are short, with no
+ * conversation lock or quota. A leaf module, so providers that add jobs (orgs/directory-sync.ts)
+ * import the name without importing the worker (which imports their scheduler ids back).
+ */
+export declare const MAINTENANCE_QUEUE_NAME = "cap-kernel-maintenance";

package/dist/runtime/maintenance-queue.js

@@ -0,0 +1,10 @@
+/**
+ * The kernel maintenance queue (no `:`): wait timeouts (`wait-timeout`, see waits.ts), one-off
+ * maintenance (sandbox destruction, connector drift, directory sync); no periodic jobs any more
+ * (they are `@LockedCron` / `@LockedInterval` jobs). The queue has one Worker (started on the `worker` role only) that
+ * dispatches by job name to the registered handlers. Separate from the run queues: their handler,
+ * stalled and failure handling assume "one job = one run"; maintenance jobs are short, with no
+ * conversation lock or quota. A leaf module, so providers that add jobs (orgs/directory-sync.ts)
+ * import the name without importing the worker (which imports their scheduler ids back).
+ */
+export const MAINTENANCE_QUEUE_NAME = "cap-kernel-maintenance";

package/dist/runtime/maintenance.d.ts

@@ -1,80 +1,51 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
-import { type Job, type JobsOptions } from "bullmq";
-import type { KernelDb } from "../db/kernel-schema.js";
+import { WorkerHost } from "@nestjs/bullmq";
+import type { Job, Queue, Worker } from "bullmq";
+import { ScheduledRuns } from "../infra/schedule/scheduled-runs.js";
+import type { KernelLogger } from "../log.js";
+import { DirectorySync } from "../orgs/directory-sync.js";
+import { SandboxService } from "../sandbox/sandbox.service.js";
+import { ToolDrift } from "../tools/drift.js";
+import { Waits } from "./waits.js";
+export { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
+/** The maintenance worker's concurrency (as the hand-made worker had). */
+export declare const MAINTENANCE_CONCURRENCY = 5;
 /**
- * 内核维护队列（不含 `:`）：等待超时任务（`wait-timeout`，见 waits.ts）与周期性维护（输出存档清理、
- * 工具漂移检测（见 tools/drift.ts）、等待兜底扫描（`wait-sweep`，见 waits.ts）、沙箱的空闲休眠与不活跃销毁
- * （见 sandbox/lifecycle.ts）等）。整个队列只有一个 Worker（只在 `worker` 角色上启动），
- * 按任务名分派给登记的处理函数。
- * 与运行队列分开：运行 worker 的处理函数、stalled / 失败处理都按「一个任务 = 一次运行」设计；
- * 维护任务短、无会话锁与配额。
+ * The one consumer of `cap-kernel-maintenance` (decision R11 of the Nest kernel spec): dispatches
+ * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` →
+ * {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
+ * {@link DirectorySync}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
+ * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
+ * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
+ * name is warned and completes. The producers are the domains' own (same names, ids and options).
  */
-export declare const MAINTENANCE_QUEUE_NAME = "cap-kernel-maintenance";
-/** 输出存档清理：任务名、job scheduler id（不含 `:`）、周期与每批删除行数。 */
-export declare const OUTPUT_CLEANUP_JOB = "output-cleanup";
-export declare const OUTPUT_CLEANUP_SCHEDULER_ID = "output-cleanup-hourly";
-export declare const OUTPUT_CLEANUP_EVERY_MS = 3600000;
-export declare const OUTPUT_CLEANUP_BATCH = 1000;
-/**
- * Periodic marketplace refresh (C26): job name and job scheduler id (no `:`), every
- * `marketplaces.refreshIntervalMinutes`. One scheduler for all replicas; the handler refreshes each
- * enabled marketplace in turn (see catalog/marketplaces.service.ts). The values keep their old
- * names: the scheduler id is stored in Redis, and renaming it would leave the old scheduler behind.
- */
-export declare const MARKETPLACES_REFRESH_JOB = "catalogs-refresh";
-export declare const MARKETPLACES_REFRESH_SCHEDULER_ID = "catalogs-refresh-every";
-/**
- * Cleanup of plugin (app bundle) import staging (T25, F-AE): job name and job scheduler id (no
- * `:`), hourly; deletes expired (24-hour) staging rows and their object storage prefixes (see
- * catalog/plugin-import.ts `PluginImport.cleanupExpired`). The values keep their old names: the
- * scheduler id is stored in Redis, so renaming it would leave the old scheduler behind.
- */
-export declare const PLUGIN_STAGING_CLEANUP_JOB = "app-staging-cleanup";
-export declare const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-hourly";
-export declare const PLUGIN_STAGING_CLEANUP_EVERY_MS = 3600000;
-/** 维护任务的处理函数（`token` 供 `moveToDelayed` 等使用）。 */
-export type MaintenanceHandler = (job: Job, token: string | undefined) => Promise<void>;
-/** 由其他模块登记的周期任务（如漂移检测）：scheduler id 与任务名不含 `:`，周期在登记时读取。 */
-export interface MaintenanceSchedule {
-    id: string;
-    name: string;
-    everyMs: () => number;
-}
-/**
- * 删除已过期（`expires_at < now()`）的输出存档，每批 `batch` 行，直到删完；返回删除的总行数。
- * 每批一条独立语句（不开长事务）；多个 worker 同时清理时 `SKIP LOCKED` 互不等待。
- */
-export declare function deleteExpiredOutputs(db: KernelDb, batch?: number): Promise<number>;
-export interface MaintenanceDeps {
-    db: KernelDb;
-    redisUrl: string;
-    log: Pick<Logger, "error" | "warn" | "info">;
+export declare class MaintenanceProcessor extends WorkerHost<Worker> {
+    private readonly waits;
+    private readonly sandbox;
+    private readonly drift;
+    private readonly directory;
+    private readonly scheduled;
+    private readonly log;
+    private readonly queue;
+    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyFor">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
+    /**
+     * Removes the retired job schedulers (`RETIRED_SCHEDULER_IDS`, runtime/retired-schedulers.ts): every fixed-period
+     * maintenance job is a `@LockedCron` / `@LockedInterval` now. Idempotent; called once when a
+     * worker role starts.
+     */
+    removeRetiredSchedulers(): Promise<void>;
+    process(job: Job, token?: string): Promise<void>;
+    /** Starts consuming (worker role, after the extensions loaded; built with `autorun: false`). */
+    start(): void;
+    private dispatch;
+    failed(job: Job | undefined, err: Error): void;
+    error(err: Error): void;
 }
 /**
- * 维护队列的生产方与（worker 角色上的）唯一 Worker。状态都在 Redis / PG，没有进程内定时器：
- * 周期任务用 BullMQ job scheduler（`upsertJobScheduler` 幂等，多副本重复调用只有一个 scheduler）。
+ * The maintenance queue's consumer: {@link MaintenanceProcessor}. Imported only by the worker role
+ * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by
+ * itself: the worker role (`WorkerRole`) removes the retired job schedulers and starts it after the
+ * extensions loaded.
  */
-export declare class Maintenance {
-    private readonly d;
-    private queue;
-    private queueConn;
-    private worker;
-    private workerConn;
-    private closed;
-    private readonly handlers;
-    private readonly schedules;
-    constructor(d: MaintenanceDeps);
-    /** 登记某个任务名的处理函数（构造期调用；Worker 启动前后都可）。 */
-    handle(name: string, fn: MaintenanceHandler): void;
-    /** 登记一个周期任务（构造期调用；`ensureSchedules` 时一并 upsert）。 */
-    schedule(s: MaintenanceSchedule): void;
-    /** 投递一个维护任务。 */
-    add(name: string, data: unknown, opts: JobsOptions): Promise<void>;
-    /** 登记周期任务的 job scheduler（幂等；worker 角色启动时调用）。 */
-    ensureSchedules(): Promise<void>;
-    /** 启动维护队列的 Worker（只在含 `worker` 角色的进程）。 */
-    startWorker(): void;
-    close(): Promise<void>;
-    private getQueue;
-    private process;
+export declare class MaintenanceModule {
 }

package/dist/runtime/maintenance.js

@@ -1,148 +1,150 @@
-import { Queue, Worker } from "bullmq";
-import { sql } from "kysely";
-import { withJobContext } from "../log-context.js";
-import { bullConnection } from "./run-queue.js";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { getQueueToken, OnWorkerEvent, WorkerHost } from "@nestjs/bullmq";
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { configuredProcessor } from "../infra/queue/configured-processor.js";
+import { QueueModule } from "../infra/queue/queue.module.js";
+import { removeRetiredSchedulers } from "../infra/queue/retired-schedulers.js";
+import { runJob } from "../infra/queue/run-job.js";
+import { KernelScheduleModule } from "../infra/schedule/schedule.module.js";
+import { ScheduledRuns } from "../infra/schedule/scheduled-runs.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { DIRECTORY_SYNC_JOB, DirectorySync } from "../orgs/directory-sync.js";
+import { OrgsModule } from "../orgs/orgs.module.js";
+import { runSandboxDestroyFor, SANDBOX_DESTROY_FOR_JOB } from "../sandbox/jobs.js";
+import { SandboxModule } from "../sandbox/sandbox.module.js";
+import { SandboxService } from "../sandbox/sandbox.service.js";
+import { ToolDrift } from "../tools/drift.js";
+import { DRIFT_CONNECTOR_JOB } from "../tools/job-ids.js";
+import { ToolsModule } from "../tools/tools.module.js";
+import { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
+import { RETIRED_SCHEDULER_IDS } from "./retired-schedulers.js";
+import { RuntimeModule } from "./runtime.module.js";
+import { WAIT_TIMEOUT_JOB, Waits } from "./waits.js";
+export { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
+/** The maintenance worker's concurrency (as the hand-made worker had). */
+export const MAINTENANCE_CONCURRENCY = 5;
 /**
- * 内核维护队列（不含 `:`）：等待超时任务（`wait-timeout`，见 waits.ts）与周期性维护（输出存档清理、
- * 工具漂移检测（见 tools/drift.ts）、等待兜底扫描（`wait-sweep`，见 waits.ts）、沙箱的空闲休眠与不活跃销毁
- * （见 sandbox/lifecycle.ts）等）。整个队列只有一个 Worker（只在 `worker` 角色上启动），
- * 按任务名分派给登记的处理函数。
- * 与运行队列分开：运行 worker 的处理函数、stalled / 失败处理都按「一个任务 = 一次运行」设计；
- * 维护任务短、无会话锁与配额。
+ * The one consumer of `cap-kernel-maintenance` (decision R11 of the Nest kernel spec): dispatches
+ * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` →
+ * {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
+ * {@link DirectorySync}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
+ * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
+ * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
+ * name is warned and completes. The producers are the domains' own (same names, ids and options).
  */
-export const MAINTENANCE_QUEUE_NAME = "cap-kernel-maintenance";
-/** 输出存档清理：任务名、job scheduler id（不含 `:`）、周期与每批删除行数。 */
-export const OUTPUT_CLEANUP_JOB = "output-cleanup";
-export const OUTPUT_CLEANUP_SCHEDULER_ID = "output-cleanup-hourly";
-export const OUTPUT_CLEANUP_EVERY_MS = 3_600_000;
-export const OUTPUT_CLEANUP_BATCH = 1000;
-/**
- * Periodic marketplace refresh (C26): job name and job scheduler id (no `:`), every
- * `marketplaces.refreshIntervalMinutes`. One scheduler for all replicas; the handler refreshes each
- * enabled marketplace in turn (see catalog/marketplaces.service.ts). The values keep their old
- * names: the scheduler id is stored in Redis, and renaming it would leave the old scheduler behind.
- */
-export const MARKETPLACES_REFRESH_JOB = "catalogs-refresh";
-export const MARKETPLACES_REFRESH_SCHEDULER_ID = "catalogs-refresh-every";
-/**
- * Cleanup of plugin (app bundle) import staging (T25, F-AE): job name and job scheduler id (no
- * `:`), hourly; deletes expired (24-hour) staging rows and their object storage prefixes (see
- * catalog/plugin-import.ts `PluginImport.cleanupExpired`). The values keep their old names: the
- * scheduler id is stored in Redis, so renaming it would leave the old scheduler behind.
- */
-export const PLUGIN_STAGING_CLEANUP_JOB = "app-staging-cleanup";
-export const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-hourly";
-export const PLUGIN_STAGING_CLEANUP_EVERY_MS = 3_600_000;
-/**
- * 删除已过期（`expires_at < now()`）的输出存档，每批 `batch` 行，直到删完；返回删除的总行数。
- * 每批一条独立语句（不开长事务）；多个 worker 同时清理时 `SKIP LOCKED` 互不等待。
- */
-export async function deleteExpiredOutputs(db, batch = OUTPUT_CLEANUP_BATCH) {
-    let total = 0;
-    for (;;) {
-        const r = await db
-            .deleteFrom("tool_outputs")
-            .where("id", "in", db
-            .selectFrom("tool_outputs")
-            .select("id")
-            .where("expires_at", "<", sql `now()`)
-            .limit(batch)
-            .forUpdate()
-            .skipLocked())
-            .executeTakeFirst();
-        const n = Number(r.numDeletedRows);
-        total += n;
-        if (n < batch)
-            return total;
-    }
-}
-/**
- * 维护队列的生产方与（worker 角色上的）唯一 Worker。状态都在 Redis / PG，没有进程内定时器：
- * 周期任务用 BullMQ job scheduler（`upsertJobScheduler` 幂等，多副本重复调用只有一个 scheduler）。
- */
-export class Maintenance {
-    d;
+let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
+    waits;
+    sandbox;
+    drift;
+    directory;
+    scheduled;
+    log;
     queue;
-    queueConn;
-    worker;
-    workerConn;
-    closed = false;
-    handlers = new Map();
-    schedules = [];
-    constructor(d) {
-        this.d = d;
-        this.handle(OUTPUT_CLEANUP_JOB, async () => {
-            const n = await deleteExpiredOutputs(d.db);
-            if (n > 0)
-                d.log.info("expired tool outputs deleted", { count: n });
-        });
-    }
-    /** 登记某个任务名的处理函数（构造期调用；Worker 启动前后都可）。 */
-    handle(name, fn) {
-        this.handlers.set(name, fn);
+    constructor(waits, sandbox, drift, directory, scheduled, log, queue) {
+        super();
+        this.waits = waits;
+        this.sandbox = sandbox;
+        this.drift = drift;
+        this.directory = directory;
+        this.scheduled = scheduled;
+        this.log = log;
+        this.queue = queue;
     }
-    /** 登记一个周期任务（构造期调用；`ensureSchedules` 时一并 upsert）。 */
-    schedule(s) {
-        this.schedules.push(s);
+    /**
+     * Removes the retired job schedulers (`RETIRED_SCHEDULER_IDS`, runtime/retired-schedulers.ts): every fixed-period
+     * maintenance job is a `@LockedCron` / `@LockedInterval` now. Idempotent; called once when a
+     * worker role starts.
+     */
+    removeRetiredSchedulers() {
+        return removeRetiredSchedulers(this.queue, RETIRED_SCHEDULER_IDS);
     }
-    /** 投递一个维护任务。 */
-    async add(name, data, opts) {
-        await this.getQueue().add(name, data, opts);
-    }
-    /** 登记周期任务的 job scheduler（幂等；worker 角色启动时调用）。 */
-    async ensureSchedules() {
-        await this.getQueue().upsertJobScheduler(OUTPUT_CLEANUP_SCHEDULER_ID, { every: OUTPUT_CLEANUP_EVERY_MS }, {
-            name: OUTPUT_CLEANUP_JOB,
-            data: {},
-            opts: { removeOnComplete: true, removeOnFail: 100 },
-        });
-        for (const s of this.schedules) {
-            await this.getQueue().upsertJobScheduler(s.id, { every: s.everyMs() }, { name: s.name, data: {}, opts: { removeOnComplete: true, removeOnFail: 100 } });
-        }
+    process(job, token) {
+        return runJob(MAINTENANCE_QUEUE_NAME, job, () => this.dispatch(job, token));
     }
-    /** 启动维护队列的 Worker（只在含 `worker` 角色的进程）。 */
-    startWorker() {
-        if (this.worker || this.closed)
-            return;
-        this.workerConn = bullConnection(this.d.redisUrl, this.d.log);
-        this.worker = new Worker(MAINTENANCE_QUEUE_NAME, (job, token) => withJobContext(MAINTENANCE_QUEUE_NAME, job, () => this.process(job, token)), {
-            connection: this.workerConn,
-            concurrency: 5,
-        });
-        this.worker.on("error", (err) => this.d.log.error("maintenance worker error", { err }));
-        this.worker.on("failed", (job, err) => this.d.log.error("maintenance job failed", { name: job?.name, jobId: job?.id, err }));
+    /** Starts consuming (worker role, after the extensions loaded; built with `autorun: false`). */
+    start() {
+        void this.worker.run().catch((err) => this.error(err));
     }
-    async close() {
-        this.closed = true;
-        const w = this.worker;
-        const q = this.queue;
-        this.worker = undefined;
-        this.queue = undefined;
-        await w?.close().catch(() => { });
-        await q?.close().catch(() => { });
-        for (const c of [this.workerConn, this.queueConn]) {
-            if (c)
-                await c.quit().catch(() => c.disconnect());
+    async dispatch(job, token) {
+        switch (job.name) {
+            case WAIT_TIMEOUT_JOB:
+                await this.waits.processTimeout(job, token);
+                return;
+            case SANDBOX_DESTROY_FOR_JOB:
+                await runSandboxDestroyFor(this.sandbox, this.log, job);
+                return;
+            case DRIFT_CONNECTOR_JOB: {
+                const { orgId, connectorId, trigger } = job.data;
+                await this.drift.check(orgId, connectorId, trigger);
+                return;
+            }
+            case DIRECTORY_SYNC_JOB:
+                await this.directory.runSyncJob(job.data);
+                return;
+            default:
+                if (await this.scheduled.runNow(job.name))
+                    return;
+                this.log.warn("unknown maintenance job", { name: job.name, jobId: job.id });
         }
-        this.workerConn = undefined;
-        this.queueConn = undefined;
     }
-    getQueue() {
-        if (this.closed)
-            throw new Error("maintenance queue is closed");
-        if (!this.queue) {
-            this.queueConn = bullConnection(this.d.redisUrl, this.d.log);
-            this.queue = new Queue(MAINTENANCE_QUEUE_NAME, { connection: this.queueConn });
-            this.queue.on("error", (err) => this.d.log.error("maintenance queue error", { err }));
-        }
-        return this.queue;
+    failed(job, err) {
+        this.log.error("maintenance job failed", { name: job?.name, jobId: job?.id, err });
     }
-    async process(job, token) {
-        const fn = this.handlers.get(job.name);
-        if (!fn) {
-            this.d.log.warn("unknown maintenance job", { name: job.name, jobId: job.id });
-            return;
-        }
-        await fn(job, token);
+    error(err) {
+        this.log.error("maintenance worker error", { err });
     }
-}
+};
+__decorate([
+    OnWorkerEvent("failed")
+], MaintenanceProcessor.prototype, "failed", null);
+__decorate([
+    OnWorkerEvent("error")
+], MaintenanceProcessor.prototype, "error", null);
+MaintenanceProcessor = __decorate([
+    Injectable(),
+    __param(0, Inject(Waits)),
+    __param(1, Inject(SandboxService)),
+    __param(2, Inject(ToolDrift)),
+    __param(3, Inject(DirectorySync)),
+    __param(4, Inject(ScheduledRuns)),
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
+], MaintenanceProcessor);
+export { MaintenanceProcessor };
+/**
+ * The maintenance queue's consumer: {@link MaintenanceProcessor}. Imported only by the worker role
+ * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by
+ * itself: the worker role (`WorkerRole`) removes the retired job schedulers and starts it after the
+ * extensions loaded.
+ */
+let MaintenanceModule = class MaintenanceModule {
+};
+MaintenanceModule = __decorate([
+    Module({
+        imports: [
+            // the periodic jobs' bodies (a periodic job's name enqueued here runs it once)
+            KernelScheduleModule,
+            RuntimeModule,
+            SandboxModule,
+            ToolsModule,
+            OrgsModule,
+            QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
+        ],
+        providers: [
+            configuredProcessor(MaintenanceProcessor, MAINTENANCE_QUEUE_NAME, {
+                concurrency: MAINTENANCE_CONCURRENCY,
+            }),
+        ],
+        exports: [MaintenanceProcessor],
+    })
+], MaintenanceModule);
+export { MaintenanceModule };

package/dist/runtime/model-call.d.ts

@@ -1,14 +1,15 @@
 import { type ContentBlock, type Logger, type ModelProvider, type ModelRequest, type ModelStreamEvent, type ModelUsage, type StopReason } from "@capybara-hq/plugin-sdk";
 import type { AgentDefinition } from "../agents/definition.js";
-import type { KernelConfig } from "../config/schema.js";
 import type { EventLog } from "../conversations/event-log.js";
-import type { KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import type { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import type { ToolRegistry, UnavailableTool } from "../tools/registry.js";
 import { type BuildModelRequestInput, type MediaBytes, type MediaInfo, type ModelCallMeta, type RequestTool } from "./context/build.js";
 import { type ConversationKindForHooks, type HookRunner } from "./hook-calls.js";
 import type { SubagentParent } from "./loop.js";
 import { MediaCache } from "./media-cache.js";
 import { type ProviderRegistry } from "./providers.js";
+import type { StepLog } from "./step-log.js";
 import type { UsageReporter } from "./usage-report.js";
 /** 单轮收尾的尾部提醒（模型可见，英文；spec 6 轮次额度收尾）。 */
 export declare const WRAP_UP_REMINDER = "Step limit reached. Do not call tools. Summarize what you found and what remains for the user.";
@@ -28,12 +29,14 @@ export type StreamSink = (delta: {
     text?: string;
 }) => void;
 export interface ModelStepDeps {
-    db: KernelDb;
+    db: KernelSchemaDb;
     eventLog: EventLog;
+    /** The step's transactional writes (a model call with its tool specs, a denial with its audit row, a sub-agent's counted usage). */
+    stepLog: Pick<StepLog, "appendCounted" | "appendAudited" | "appendWithSpecs">;
     registry: Pick<ProviderRegistry, "resolve">;
     /** 工具注册表：每步开始时解析 agent 引用的工具（状态可能在步骤之间变化）。 */
     tools: Pick<ToolRegistry, "forAgent">;
-    config: () => KernelConfig;
+    config: Pick<KernelConfigService, "get">;
     log: Logger;
     /**
      * 会话附件（构建请求时解析日志里的媒体引用；见 AttachmentsService）。未提供时媒体引用一律按「不再可用」处理。