@capybara-hq/kernel 0.1.0-rc.10 → 0.1.0-rc.12

package/dist/tools/policy.js

@@ -2,6 +2,7 @@ import { sql } from "kysely";
 import { roleAtLeast } from "../orgs/roles.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
 import { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS, SANDBOX_ASK_TOOL_NAMES, } from "./builtin-names.js";
+import { personalAuth } from "./connector-account-policies.js";
 import { normalizeStoredDefinitionIn } from "./legacy-data.js";
 export { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS } from "./builtin-names.js";
 const RANK = { allow: 0, ask: 1, deny: 2 };
@@ -35,17 +36,51 @@ export function isFixedAsk(tool, visibility, skillWritePolicy) {
     // 私有 agent：缺省 / allow 不问（R4），负责人设为 ask（D10）时与共享 agent 一样固定询问
     return !(builtinOnly && visibility === "private" && skillWritePolicy !== "ask");
 }
-const asOverride = (v) => v === "ask" || v === "deny" ? v : undefined;
+const asSetting = (v) => v === "allow" || v === "ask" || v === "deny" ? v : undefined;
+/** The stricter of the settings that are set (none set: undefined). */
+function combine(...xs) {
+    let out;
+    for (const x of xs)
+        if (x !== undefined)
+            out = out === undefined ? x : stricter(out, x);
+    return out;
+}
 /**
- * An agent's tightening for a call: its policy on the tool key and, for a per-call key
- * (`Platform:<operation>`), on that key, the stricter of the two (a policy can only tighten).
+ * An agent's setting for a call: its policy on the tool key and, for a per-call key
+ * (`Platform:<operation>`), on that key, the stricter of the two; undefined when neither is set.
+ * `allow` counts only for a connector tool ({@link connectorPolicy}); elsewhere an agent's policy
+ * can only tighten ({@link tighteningOf}).
  */
-function overrideOf(policies, toolKey, policyKey) {
-    const own = asOverride(policies?.[toolKey]);
+function settingOf(policies, toolKey, policyKey) {
+    const own = asSetting(policies?.[toolKey]);
     if (policyKey === toolKey)
         return own;
-    const s = stricter(own ?? "allow", asOverride(policies?.[policyKey]));
-    return s === "allow" ? undefined : s;
+    return combine(own, asSetting(policies?.[policyKey]));
+}
+/** An agent setting as a tightening (`allow` tightens nothing). */
+const tighteningOf = (s) => s === "ask" || s === "deny" ? s : undefined;
+/**
+ * A personal-credential connector tool's policy for one call (maintainer decisions 2026-11-09;
+ * an org-credential connector's tool keeps the org default with the agent's tightening only),
+ * highest first:
+ * 1. the org's default `deny` (a tool the org switched off never gets here: it is unavailable);
+ * 2. the member's own `deny` for calls with their connection (`member`): a floor no agent lifts;
+ * 3. the agent's setting (`agent`, from its tools page): `allow` / `ask` / `deny`;
+ * 4. the member's own `allow` / `ask`;
+ * 5. the org's default (`connector_tools.default_policy`, the annotation default unless an org
+ *    admin changed it: `readOnlyHint: true` allows, anything else asks).
+ * Fixed asks (R3, `requiresUserInteraction`), role escalation and grants apply after this.
+ */
+export function connectorPolicy(input) {
+    if (input.orgDefault === "deny")
+        return { policy: "deny", source: "org" };
+    if (input.member === "deny")
+        return { policy: "deny", source: "member" };
+    if (input.agent !== undefined)
+        return { policy: input.agent, source: "agent" };
+    if (input.member !== undefined)
+        return { policy: input.member, source: "member" };
+    return { policy: input.orgDefault, source: "org" };
 }
 /**
  * 执行时的策略判定（spec 3.6 R5：在动作执行那一刻判定）。每次调用都实时读取：
@@ -58,7 +93,7 @@ function overrideOf(policies, toolKey, policyKey) {
  *   parent's current version still tightens it (sub-agents spec §5.3, §9); its "this conversation"
  *   grants are the root conversation's (agent map spec §7); an org agent sub-agent (§5.5): `ctx.agentId` is the
  *   dispatched agent (its current version, its "always" grants) and the parent agent's current
- *   policies apply on top ({@link parentAgentOverride});
+ *   policies apply on top ({@link parentAgentSetting});
  * - 授权表（`conversation_tool_grants` / `tool_grants`），`spec_hash` 与当前定义不一致视为无效（D8），
  *   `connector_id` 与工具的来源连接器不一致也无效（删除后用同一 slug 重新安装的连接器不继承旧授权）；
  * - 工具声明了 `requiredRole`（R1）时，发起人在组织中的当前角色：不是成员 → 拒绝；角色不足 → 按角色升级的审批
@@ -75,11 +110,15 @@ export function createDecidePolicy(db) {
         let connectorDefault = call?.policy ?? tool.defaultPolicy;
         let connectorId = null;
         let hashCurrent = true;
+        /** The member's own setting for a call with their connection (a personal-credential connector). */
+        let memberSetting;
+        /** A personal-credential connector: calls use the acting account's own connection. */
+        let personal = false;
         if (tool.source.kind === "connector") {
             connectorId = tool.source.connectorId;
             const app = await db
                 .selectFrom("connectors")
-                .select(["slug", "status", "deleted_at"])
+                .select(["slug", "status", "deleted_at", "auth"])
                 .where("id", "=", tool.source.connectorId)
                 .where("org_id", "=", ctx.orgId)
                 .executeTakeFirst();
@@ -105,6 +144,19 @@ export function createDecidePolicy(db) {
                 return { unavailable: "Tool is pending review" };
             connectorDefault = row.default_policy;
             hashCurrent = row.spec_hash === tool.specHash;
+            // The call is made with the acting account's own connection (the credential the pipeline
+            // injects for `ctx.accountId`): that account's settings apply, never another's
+            personal = personalAuth(app.auth);
+            if (personal) {
+                const mine = await db
+                    .selectFrom("connector_tool_account_policies")
+                    .select("policy")
+                    .where("connector_id", "=", tool.source.connectorId)
+                    .where("account_id", "=", ctx.accountId)
+                    .where("tool_name", "=", tool.source.name)
+                    .executeTakeFirst();
+                memberSetting = mine?.policy;
+            }
         }
         // 沙箱工具的组织默认（M5 T8）：组织设置 sandboxToolPolicy 为 ask 时，有副作用的沙箱工具至少 ask
         // `orgAsk`: the org setting, not the tool's own default, is what makes it ask
@@ -116,7 +168,7 @@ export function createDecidePolicy(db) {
             }
         }
         // 运行所用版本可能是加 toolPolicies 字段之前保存的：缺省为空
-        const runOverride = overrideOf(agentDef.toolPolicies, tool.key, policyKey);
+        const runSetting = settingOf(agentDef.toolPolicies, tool.key, policyKey);
         const current = await db
             .selectFrom("agents")
             .innerJoin("agent_versions", (j) => j
@@ -130,12 +182,33 @@ export function createDecidePolicy(db) {
             ? undefined
             : await normalizeStoredDefinitionIn(db, ctx.orgId, current.definition);
         const currentPolicies = currentDef?.toolPolicies;
-        const currentOverride = overrideOf(currentPolicies, tool.key, policyKey);
-        let strictest = stricter(runOverride ?? "allow", currentOverride);
+        const currentSetting = settingOf(currentPolicies, tool.key, policyKey);
+        // the run's version, the agent's current version and (a sub-agent) its parent agent's
+        // current version: the stricter of the ones that are set
+        // (an `allow` the owner removed since the run started no longer applies: removing it tightens)
+        const runKept = runSetting === "allow" && current !== undefined && currentSetting === undefined
+            ? undefined
+            : runSetting;
+        let agentSetting = combine(runKept, currentSetting);
         if (ctx.parentConversationId !== undefined && ctx.parentAgentDiffers !== false) {
-            strictest = stricter(strictest, await parentAgentOverride(db, tool.key, policyKey, ctx));
+            agentSetting = combine(agentSetting, await parentAgentSetting(db, tool.key, policyKey, ctx));
+        }
+        let agentOverride = tighteningOf(agentSetting);
+        // A personal-credential connector's tool: the levels of `connectorPolicy` decide its base
+        // policy (an agent's `allow` counts here, below the org's and the member's deny). A connector
+        // with one org credential has no member level and its calls act as the whole org: there the
+        // agent's setting only tightens the org default, as for every other tool (review 2026-11-09)
+        let decidedBy = null;
+        if (tool.source.kind === "connector" && personal) {
+            const r = connectorPolicy({
+                orgDefault: connectorDefault,
+                member: memberSetting,
+                agent: agentSetting,
+            });
+            connectorDefault = r.policy;
+            decidedBy = r.source;
+            agentOverride = undefined;
         }
-        const agentOverride = strictest === "allow" ? undefined : strictest;
         let escalateTo = null;
         if (tool.requiredRole !== undefined) {
             const m = await db
@@ -184,15 +257,17 @@ export function createDecidePolicy(db) {
             // default
             policy: escalateTo !== null
                 ? "role"
-                : agentOverride === "ask"
+                : agentOverride === "ask" || (decidedBy === "agent" && connectorDefault === "ask")
                     ? "agent"
-                    : tool.source.kind === "connector" && connectorDefault === "ask"
-                        ? "connector"
-                        : fixedAsk
-                            ? "fixed"
-                            : orgAsk
-                                ? "org"
-                                : "default",
+                    : decidedBy === "member" && connectorDefault === "ask"
+                        ? "member"
+                        : tool.source.kind === "connector" && connectorDefault === "ask"
+                            ? "connector"
+                            : fixedAsk
+                                ? "fixed"
+                                : orgAsk
+                                    ? "org"
+                                    : "default",
         };
         return { ask };
     };
@@ -203,7 +278,7 @@ export function createDecidePolicy(db) {
  * policy for the same key applies on top, so the parent's owner can tighten a running child too.
  * For a template or general-purpose child the parent conversation has the same agent, already read.
  */
-async function parentAgentOverride(db, toolKey, policyKey, ctx) {
+async function parentAgentSetting(db, toolKey, policyKey, ctx) {
     const row = await db
         .selectFrom("conversations as c")
         .innerJoin("agents as a", "a.id", "c.agent_id")
@@ -216,7 +291,7 @@ async function parentAgentOverride(db, toolKey, policyKey, ctx) {
     // stored raw: an rc version's keys read as current keys, so its deny keeps applying (§8.3)
     const policies = (await normalizeStoredDefinitionIn(db, ctx.orgId, row.definition))
         .toolPolicies;
-    return overrideOf(policies, toolKey, policyKey);
+    return settingOf(policies, toolKey, policyKey);
 }
 /**
  * A grant matching the current definition hash and source connector, keyed by the call's policy key

package/dist/tools/tools.module.js

@@ -26,6 +26,7 @@ import { ApprovalsService } from "./approvals.service.js";
 import { Breaker } from "./breaker.js";
 import { BuiltinTools } from "./builtins/builtin-tools.js";
 import { WebPages } from "./builtins/web/page-cache.js";
+import { ConnectorAccountPolicies } from "./connector-account-policies.js";
 import { ConnectorContent } from "./connector-content.js";
 import { ConnectorsService } from "./connectors.service.js";
 import { Credentials } from "./credentials.js";
@@ -86,6 +87,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,
             OrgExtensionTools,
@@ -103,6 +105,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,
             OrgExtensionTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.10",
+  "version": "0.1.0-rc.12",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -65,7 +65,7 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.7"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.8"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
@@ -74,7 +74,7 @@
     "@types/ws": "^8.18.2",
     "@types/yauzl": "3.4.0",
     "ws": "^8.22.0",
-    "@capybara-hq/testing": "0.1.0-rc.10"
+    "@capybara-hq/testing": "0.1.0-rc.11"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0102_themes.sql

@@ -0,0 +1,64 @@
+-- Themes as a platform component kind (themes spec 2026-11-08-themes-design.md §6, §7): rows and
+-- versions shaped like platform agent templates, with the owner columns of org-owned items; the
+-- `theme` kind in the component scope, switch and install component tables; the person's pick on
+-- the account. Expand-only: the only dropped objects are the three kind checks, re-added wider in
+-- the next statement each.
+
+CREATE TABLE IF NOT EXISTS platform_themes (
+  id text PRIMARY KEY,
+  catalog_item_id uuid REFERENCES catalog_items(id) ON DELETE SET NULL,
+  plugin_name text,
+  name text NOT NULL,
+  description text,
+  description_zh text,
+  current_version integer NOT NULL CHECK (current_version >= 1),
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  -- The owning org (NULL = the platform), the org it was created in (no FK, immutable) and the
+  -- share switch, as on the other platform components (0084).
+  owner_org_id text REFERENCES orgs(id) ON DELETE SET NULL,
+  origin_org_id text,
+  shareable boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_themes_live_name_origin_uq
+  ON platform_themes ((coalesce(plugin_name, '')), name, (coalesce(origin_org_id, '')))
+  WHERE deleted_at IS NULL;
+
+-- One version of a theme: `definition` is the parsed theme file (`ParsedTheme`); fonts and logo
+-- live under `object_prefix` in `deployment/` (NULL for a theme without assets).
+CREATE TABLE IF NOT EXISTS platform_theme_versions (
+  theme_id text NOT NULL REFERENCES platform_themes(id) ON DELETE CASCADE,
+  version integer NOT NULL CHECK (version >= 1),
+  definition jsonb NOT NULL,
+  object_prefix text,
+  catalog_version text,
+  updated_on_own boolean NOT NULL DEFAULT false,
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (theme_id, version)
+);
+
+-- 0081 declared these checks inline, so they carry the default names.
+-- capybara:allow-destructive the check is added back with 'theme' in the next statement; existing rows satisfy it
+ALTER TABLE component_scope_orgs DROP CONSTRAINT IF EXISTS component_scope_orgs_kind_check;
+ALTER TABLE component_scope_orgs ADD CONSTRAINT component_scope_orgs_kind_check
+  CHECK (kind IN ('skill', 'agent_template', 'connector_template', 'theme'));
+-- capybara:allow-destructive the check is added back with 'theme' in the next statement; existing rows satisfy it
+ALTER TABLE component_org_switches DROP CONSTRAINT IF EXISTS component_org_switches_kind_check;
+ALTER TABLE component_org_switches ADD CONSTRAINT component_org_switches_kind_check
+  CHECK (kind IN ('skill', 'agent_template', 'connector_template', 'theme'));
+-- NOT VALID as in 0053: existing rows were checked by the narrower constraint already.
+-- capybara:allow-destructive the check is added back with 'theme' in the next statement; existing rows satisfy it
+ALTER TABLE plugin_install_components DROP CONSTRAINT IF EXISTS plugin_install_components_kind_check;
+ALTER TABLE plugin_install_components ADD CONSTRAINT plugin_install_components_kind_check
+  CHECK (kind IN ('extension', 'connector', 'skill', 'plugin', 'agent_template', 'theme')) NOT VALID;
+
+-- The person's theme (§7): one value across all their orgs; NULL follows the org. No FK: a pick
+-- that is not on in the current org (or no longer exists) is skipped, never an error.
+ALTER TABLE accounts ADD COLUMN IF NOT EXISTS theme text;

package/src/migrations/0103_ui_theme_setting.sql

@@ -0,0 +1,7 @@
+-- The platform default theme setting `uiTheme` (themes spec §7) always has a row: the guards that
+-- refuse taking the default theme away from an org read it FOR SHARE, and the setting's write
+-- locks it FOR UPDATE before checking the chosen theme, so the two serialize on this row.
+-- `{"id": null}` is the built-in theme (the default when the key is missing).
+INSERT INTO deployment_settings (key, value)
+VALUES ('uiTheme', '{"id": null}'::jsonb)
+ON CONFLICT (key) DO NOTHING;

package/src/migrations/0104_connector_tool_account_policies.sql

@@ -0,0 +1,16 @@
+-- A member's own tool policies for their own connection of a personal-credential connector
+-- (maintainer decision 2026-11-09, the connector card's 权限): one row per account, connector and
+-- tool name. They apply to every agent the account uses; an agent's tool policy overrides them, and
+-- a tool the org switched off (or set to deny) stays denied whatever they say.
+CREATE TABLE IF NOT EXISTS capybara.connector_tool_account_policies (
+  org_id text NOT NULL REFERENCES capybara.orgs(id) ON DELETE CASCADE,
+  connector_id text NOT NULL REFERENCES capybara.connectors(id) ON DELETE CASCADE,
+  account_id text NOT NULL REFERENCES capybara.accounts(id) ON DELETE CASCADE,
+  tool_name text NOT NULL,
+  policy text NOT NULL CHECK (policy IN ('allow', 'ask', 'deny')),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (connector_id, account_id, tool_name)
+);
+
+CREATE INDEX IF NOT EXISTS connector_tool_account_policies_account
+  ON capybara.connector_tool_account_policies (account_id);