@capybara-hq/kernel 0.1.0-rc.11 → 0.1.0-rc.12

package/dist/agents/agents.schemas.d.ts

@@ -33,6 +33,7 @@ export declare const AgentCreateDefinition: z.ZodObject<{
         tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
     }, z.core.$strict>], "kind">>>;
     toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        allow: "allow";
         ask: "ask";
         deny: "deny";
     }>>>;
@@ -116,6 +117,7 @@ export declare const AgentCreateBody: z.ZodObject<{
             tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
         }, z.core.$strict>], "kind">>>;
         toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+            allow: "allow";
             ask: "ask";
             deny: "deny";
         }>>>;
@@ -231,6 +233,7 @@ export declare const AgentUpdateBody: z.ZodObject<{
             tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
         }, z.core.$strict>], "kind">>>;
         toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+            allow: "allow";
             ask: "ask";
             deny: "deny";
         }>>>;

package/dist/agents/agents.service.js

@@ -8,6 +8,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
+import { parseToolKey } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
@@ -310,7 +311,16 @@ let AgentsService = class AgentsService {
                 message: "subagentTools is set only on a sub-agent's definition at dispatch",
             });
         }
-        for (const key of Object.keys(def.toolPolicies)) {
+        for (const [key, policy] of Object.entries(def.toolPolicies)) {
+            // `allow` counts only for a connector tool (decision 2026-11-09): elsewhere a policy only
+            // tightens, so an `allow` there is refused rather than kept as a no-op
+            if (policy === "allow" && parseToolKey(key)?.kind !== "connector") {
+                details.push({
+                    path: `toolPolicies.${key}`,
+                    message: `"allow" applies only to a connector's tools; "${key}" can only be tightened (ask or deny)`,
+                });
+                continue;
+            }
             if (!isToolPolicyKey(key, keys)) {
                 // an rc key (tool naming spec §8.3): saving writes current keys only, so name them
                 const renamed = legacyKeySaveText(key, keys);

package/dist/agents/definition.d.ts

@@ -196,6 +196,7 @@ export declare const AgentDefinitionSchema: z.ZodObject<{
         deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        allow: "allow";
         ask: "ask";
         deny: "deny";
     }>>>;

package/dist/agents/definition.js

@@ -207,10 +207,14 @@ export const AgentDefinitionSchema = z.object({
      */
     subagentTools: SubagentToolsSchema.optional(),
     /**
-     * Tightened policies by tool key (`ask` / `deny` only, never `allow`); keys are tools the agent
-     * could have (on or turned off). Older definitions without it read as empty.
+     * Policies by tool key; keys are tools the agent could have (on or turned off). `ask` / `deny`
+     * tighten any tool. `allow` is accepted only on a connector tool key and counts only for a
+     * personal-credential connector's tool (decision 2026-11-09): it overrides the org default and
+     * the member's own 询问, never the org's or the member's 禁止 (`tools/policy.ts`
+     * `connectorPolicy`); on any other tool it changes nothing. Older definitions without it read as
+     * empty.
      */
-    toolPolicies: z.record(z.string(), z.enum(["ask", "deny"])).default({}),
+    toolPolicies: z.record(z.string(), z.enum(["allow", "ask", "deny"])).default({}),
     /**
      * 技能（M5 T13）：`orgSkills` 是引用的组织技能 id（保存时校验属于本组织且未删除，不可重复）。
      * agent 自己的技能（`scope=agent`）自动对它生效，不进定义。可省略（较早保存的定义也没有），按空处理；

package/dist/agents/org-templates.js

@@ -200,6 +200,10 @@ extensionTools = []) {
     const toolPolicies = {};
     const connectorPolicies = new Map();
     for (const [k, v] of Object.entries(def.toolPolicies ?? {})) {
+        // a template only tightens: an agent's `allow` (a connector tool's, decision 2026-11-09)
+        // is not carried into it
+        if (v === "allow")
+            continue;
         const parsed = parseToolKey(k);
         if (parsed !== null && parsed.kind !== "connector" && TOOL_KEY_RE.test(k)) {
             toolPolicies[k] = v;

package/dist/agents/pending-connectors.service.js

@@ -134,7 +134,7 @@ let PendingConnectorsService = class PendingConnectorsService {
             }
             const k = connectorToolKey(c.slug, n);
             const prev = toolPolicies[k];
-            if (prev === undefined || RANK[p] > RANK[prev])
+            if (prev === undefined || prev === "allow" || RANK[p] > RANK[prev])
                 toolPolicies[k] = p;
         }
         // tools are on by default (tools default-on spec §3): binding an entry that names some tools

package/dist/catalog/component-scope.controller.d.ts

@@ -1,4 +1,5 @@
 import type { z } from "zod";
+import { PluginIcons } from "../extensions/plugin-icons.js";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
 import { ComponentParams, ComponentDisabledSchema as DisabledBody, ComponentIdSchema as IdParams, ComponentListQuery as ListQuery, OrgComponentListQuery, ComponentScopePreviewSchema as PreviewBody, ComponentScopeSchema as ScopeBody, ComponentShownSchema as ShownBody, ComponentSwitchBody as SwitchBody, ComponentTemplateVersionSchema as TemplateVersionBody } from "./component-scope.schemas.js";
@@ -13,7 +14,8 @@ import { PlatformComponents, type UploadedComponentVersion } from "./platform-co
 export declare class AdminComponentsController {
     private readonly scope;
     private readonly components;
-    constructor(scope: ComponentScopeService, components: PlatformComponents);
+    private readonly icons;
+    constructor(scope: ComponentScopeService, components: PlatformComponents, icons: PluginIcons);
     /**
      * Updates a platform skill on its own (spec §7.2): the skill package (zip) as the raw body
      * (`application/octet-stream`, at most `packages.maxBytes`). The package keeps the skill's name
@@ -26,9 +28,14 @@ export declare class AdminComponentsController {
     }): Promise<UploadedComponentVersion>;
     /** Updates a platform agent template on its own: `{ content }` is the template markdown file. */
     uploadAgentTemplateVersion(principal: Principal, p: z.infer<typeof IdParams>, body: z.infer<typeof TemplateVersionBody>): Promise<UploadedComponentVersion>;
-    /** `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on). */
+    /**
+     * `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on),
+     * each with its display name and its plugin's icon (`icon`, the admin route; null without one).
+     */
     list(q: z.infer<typeof ListQuery>): Promise<{
-        components: ComponentView[];
+        components: (ComponentView & {
+            icon: string | null;
+        })[];
     }>;
     /**
      * A component's versions, newest first: `{ versions: [{ version, catalogVersion, updatedOnOwn,
@@ -65,14 +72,19 @@ export declare class AdminComponentsController {
  */
 export declare class OrgComponentsController {
     private readonly scope;
-    constructor(scope: ComponentScopeService);
+    private readonly icons;
+    constructor(scope: ComponentScopeService, icons: PluginIcons);
     /**
      * The platform components offered to the org (`?kind=`, `?itemId=`: only those; Task 10): each
      * with its state in the org (`on`, `locked` for `all`, the org's `switch`) and whether an org
-     * admin may switch it. Members read it (the workspace pages are read-only for them).
+     * admin may switch it. Members read it (the workspace pages are read-only for them). Each has
+     * its display name and `icon`, its plugin's icon on the org's catalog route (null without one,
+     * or when the org's catalog does not show the plugin to the reader: the share gate holds).
      */
     list(org: OrgContext, q: z.infer<typeof OrgComponentListQuery>): Promise<{
-        components: OrgOfferedComponentView[];
+        components: (OrgOfferedComponentView & {
+            icon: string | null;
+        })[];
     }>;
     setSwitch(principal: Principal, org: OrgContext, p: z.infer<typeof ComponentParams>, body: z.infer<typeof SwitchBody>): Promise<{
         component: OrgComponentView;

package/dist/catalog/component-scope.controller.js

@@ -9,6 +9,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Controller, Get, HttpCode, Inject, Post, Put, Req } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { orgIconScope, PluginIcons } from "../extensions/plugin-icons.js";
 import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
@@ -36,6 +37,16 @@ class ComponentShownBody extends createZodDto(ShownBody, "ComponentShownBody") {
 }
 class ComponentSwitchBody extends createZodDto(SwitchBody, "ComponentSwitchBody") {
 }
+/**
+ * Each component with `icon`: its plugin's icon URL on the reader's route (null without one, for
+ * a component without a plugin, or when the reader may not see the plugin; maintainer decision
+ * 2026-11-09: a connector template without an icon of its own shows its plugin's).
+ */
+async function withIcons(icons, rows, scope) {
+    const ids = rows.flatMap((r) => (r.itemId === null ? [] : [r.itemId]));
+    const urls = await icons.ofItems(ids, scope);
+    return rows.map((r) => ({ ...r, icon: r.itemId === null ? null : (urls.get(r.itemId) ?? null) }));
+}
 const actorOpts = (actor) => {
     const tokenId = patTokenId(actor);
     return tokenId !== undefined ? { actorTokenId: tokenId } : {};
@@ -49,9 +60,11 @@ const actorOpts = (actor) => {
 let AdminComponentsController = class AdminComponentsController {
     scope;
     components;
-    constructor(scope, components) {
+    icons;
+    constructor(scope, components, icons) {
         this.scope = scope;
         this.components = components;
+        this.icons = icons;
     }
     /**
      * Updates a platform skill on its own (spec §7.2): the skill package (zip) as the raw body
@@ -73,9 +86,14 @@ let AdminComponentsController = class AdminComponentsController {
         const actor = requireUser(principal);
         return this.components.uploadAgentTemplateVersion({ accountId: actor.account.id, ...actorOpts(actor) }, p.id, body.content);
     }
-    /** `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on). */
+    /**
+     * `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on),
+     * each with its display name and its plugin's icon (`icon`, the admin route; null without one).
+     */
     async list(q) {
-        return { components: await this.scope.list(q.kind) };
+        return {
+            components: await withIcons(this.icons, await this.scope.list(q.kind), { kind: "admin" }),
+        };
     }
     /**
      * A component's versions, newest first: `{ versions: [{ version, catalogVersion, updatedOnOwn,
@@ -178,7 +196,8 @@ AdminComponentsController = __decorate([
     Controller("api/v1/admin/components"),
     SuperAdmin(),
     __param(0, Inject(ComponentScopeService)),
-    __param(1, Inject(PlatformComponents))
+    __param(1, Inject(PlatformComponents)),
+    __param(2, Inject(PluginIcons))
 ], AdminComponentsController);
 export { AdminComponentsController };
 /**
@@ -189,21 +208,24 @@ export { AdminComponentsController };
  */
 let OrgComponentsController = class OrgComponentsController {
     scope;
-    constructor(scope) {
+    icons;
+    constructor(scope, icons) {
         this.scope = scope;
+        this.icons = icons;
     }
     /**
      * The platform components offered to the org (`?kind=`, `?itemId=`: only those; Task 10): each
      * with its state in the org (`on`, `locked` for `all`, the org's `switch`) and whether an org
-     * admin may switch it. Members read it (the workspace pages are read-only for them).
+     * admin may switch it. Members read it (the workspace pages are read-only for them). Each has
+     * its display name and `icon`, its plugin's icon on the org's catalog route (null without one,
+     * or when the org's catalog does not show the plugin to the reader: the share gate holds).
      */
     async list(org, q) {
-        return {
-            components: await this.scope.orgList(org.orgId, {
-                ...(q.kind !== undefined && { kind: q.kind }),
-                ...(q.itemId !== undefined && { itemId: q.itemId }),
-            }),
-        };
+        const rows = await this.scope.orgList(org.orgId, {
+            ...(q.kind !== undefined && { kind: q.kind }),
+            ...(q.itemId !== undefined && { itemId: q.itemId }),
+        });
+        return { components: await withIcons(this.icons, rows, orgIconScope(org)) };
     }
     async setSwitch(principal, org, p, body) {
         const actor = requireUser(principal);
@@ -229,6 +251,7 @@ __decorate([
 ], OrgComponentsController.prototype, "setSwitch", null);
 OrgComponentsController = __decorate([
     Controller("api/v1/orgs/:orgId/components"),
-    __param(0, Inject(ComponentScopeService))
+    __param(0, Inject(ComponentScopeService)),
+    __param(1, Inject(PluginIcons))
 ], OrgComponentsController);
 export { OrgComponentsController };

package/dist/catalog/component-scope.service.d.ts

@@ -68,7 +68,13 @@ export type ComponentTarget = {
 export interface ComponentView {
     kind: ComponentKind;
     id: string;
+    /** Skill or template name; a connector template's id (the file's base name). */
     name: string;
+    /** A connector template's localized display name (null: show `name`). */
+    displayName: {
+        zh: string;
+        en: string;
+    } | null;
     description: string | null;
     /** The plugin it came from (null: none). */
     plugin: string | null;
@@ -138,6 +144,11 @@ export interface OrgComponentView {
  * show with their switches. Never a component the org cannot see.
  */
 export interface OrgOfferedComponentView extends OrgComponentView {
+    /** A connector template's localized display name (null: show `name`). */
+    displayName: {
+        zh: string;
+        en: string;
+    } | null;
     description: string | null;
     itemId: string | null;
     version: string;

package/dist/catalog/component-scope.service.js

@@ -204,6 +204,7 @@ let ComponentScopeService = class ComponentScopeService {
                 kind,
                 id: c.id,
                 name: c.name,
+                displayName: c.displayName,
                 description: c.description,
                 plugin: c.plugin,
                 itemId: c.itemId,
@@ -258,6 +259,7 @@ let ComponentScopeService = class ComponentScopeService {
                     kind,
                     id: c.id,
                     name: c.name,
+                    displayName: c.displayName,
                     description: c.description,
                     plugin: c.plugin,
                     itemId: c.itemId,
@@ -360,6 +362,7 @@ let ComponentScopeService = class ComponentScopeService {
             kind,
             id: r.id,
             name: r.name,
+            displayName: null,
             description: r.description,
             plugin: r.plugin,
             itemId: r.catalog_item_id,
@@ -1084,6 +1087,7 @@ const virtualOf = (o) => ({
     plugin: o.plugin,
     version: String(o.version),
     description: null,
+    displayName: null,
     itemId: null,
     scopeMode: "own",
     scope: "named",

package/dist/catalog/component-state.d.ts

@@ -68,6 +68,14 @@ export interface ComponentRow extends ComponentScopeFacts {
     /** The current version (a connector template: the catalog version that last changed it). */
     version: string;
     description: string | null;
+    /**
+     * A connector template's localized display name (its file's `displayName`); null for skills and
+     * agent templates, whose name is what they are shown by.
+     */
+    displayName: {
+        zh: string;
+        en: string;
+    } | null;
     shownToOthers: boolean;
     /** The owning org (null: the platform; ruling P3-1). */
     ownerOrgId: string | null;

package/dist/catalog/component-state.js

@@ -63,6 +63,11 @@ export function componentOffered(c, p, listed) {
 export function componentLocked(_c, p) {
     return p?.builtin === true;
 }
+/** A `{ zh, en }` display name from stored JSON (a template file's), else null. */
+function localizedName(v) {
+    const n = v;
+    return typeof n?.zh === "string" && typeof n.en === "string" ? { zh: n.zh, en: n.en } : null;
+}
 /** The live platform components of `kind` (`ids` / `itemId`: only those). */
 export async function loadComponents(db, kind, filter = {}) {
     if (filter.ids !== undefined && filter.ids.length === 0)
@@ -105,17 +110,19 @@ export async function loadComponents(db, kind, filter = {}) {
             q = q.where("p.template_id", "=", filter.name);
         if (filter.forUpdate)
             q = q.forUpdate("p");
-        return (await q.orderBy("p.id").execute()).map((r) => ({
-            ...common(r),
-            ...(r.file?.defaultEnabled === false && {
-                defaultOff: true,
-            }),
-            name: r.template_id,
-            plugin: r.item_name,
-            version: r.current_version,
-            description: null,
-            originOrgId: null,
-        }));
+        return (await q.orderBy("p.id").execute()).map((r) => {
+            const file = r.file;
+            return {
+                ...common(r),
+                ...(file?.defaultEnabled === false && { defaultOff: true }),
+                name: r.template_id,
+                plugin: r.item_name,
+                version: r.current_version,
+                description: typeof file?.description === "string" ? file.description : null,
+                displayName: localizedName(file?.displayName),
+                originOrgId: null,
+            };
+        });
     }
     const table = kind === "skill"
         ? "platform_skills"
@@ -154,6 +161,7 @@ export async function loadComponents(db, kind, filter = {}) {
         plugin: r.plugin_name,
         version: String(r.current_version),
         description: r.description,
+        displayName: null,
         originOrgId: r.origin_org_id,
     }));
 }

package/dist/catalog/plugin-import.js

@@ -1714,7 +1714,10 @@ function actionOf(s, sha256, version) {
 export function pluginReviewHash(r, files) {
     const e = r.extension;
     const lic = r.licenseText;
-    const canonical = JSON.stringify([
+    // canonicalJson, not JSON.stringify: the review is stored as jsonb, which reorders object keys,
+    // so a template's auth / endpoint object would hash differently at confirm (plugin.review_stale
+    // on every import of a plugin whose connector template has a non-trivial auth block).
+    const canonical = canonicalJson([
         r.name,
         r.version,
         r.contentDigest,

package/dist/conversations/conversations.service.d.ts

@@ -1,5 +1,6 @@
 import { AgentLookup } from "../agents/agent-lookup.js";
 import type { ModelRef } from "../agents/definition.js";
+import type { AgentAvatar } from "../agents/profile.js";
 import { BackgroundTaskStopper } from "../background/stop.js";
 import type { TitleSource } from "../db/kernel-schema.js";
 import { ConversationEnvironments, type NewConversationEnvironment } from "../environments/conversation-environments.js";
@@ -53,9 +54,17 @@ export interface ConversationView {
 export declare function escapeLike(s: string): string;
 /** One agent's group in the sidebar list: the caller's newest conversations with that agent. */
 export interface ConversationGroup {
+    /**
+     * The agent's name and the avatar half of its profile, in the agents API's shape (the sidebar
+     * draws the group title from it without reading the agents list).
+     */
     agent: {
         id: string;
         name: string;
+        profile: {
+            avatar: AgentAvatar;
+            updatedAt: string;
+        };
     };
     /** max(updated_at) of the group's conversations. */
     latestAt: Date;

package/dist/conversations/conversations.service.js

@@ -482,7 +482,7 @@ let ConversationsService = class ConversationsService {
         LIMIT ${opts.limit + 1}
       )
       SELECT page.agent_id, page.latest_at, v.definition ->> 'name' AS agent_name,
-        cs.id, cs.org_id, cs.account_id, cs.title, cs.title_source, cs.selection, cs.last_seq,
+        a.profile_avatar, a.profile_updated_at, cs.id, cs.org_id, cs.account_id, cs.title, cs.title_source, cs.selection, cs.last_seq,
         cs.created_at, cs.updated_at, cs.parent_conversation_id, cs.subagent_type,
         cs.archived_at, cs.environment_id, cs.activity
       FROM page
@@ -506,7 +506,14 @@ let ConversationsService = class ConversationsService {
         for (const r of rows) {
             if (current?.agent.id !== r.agent_id) {
                 current = {
-                    agent: { id: r.agent_id, name: r.agent_name ?? "" },
+                    agent: {
+                        id: r.agent_id,
+                        name: r.agent_name ?? "",
+                        profile: {
+                            avatar: r.profile_avatar,
+                            updatedAt: r.profile_updated_at.toISOString(),
+                        },
+                    },
                     latestAt: r.latest_at,
                     conversations: [],
                     more: false,

package/dist/conversations/events.d.ts

@@ -809,6 +809,7 @@ export declare const ConversationEventSchema: z.ZodDiscriminatedUnion<[z.ZodObje
                 deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strict>>;
             toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+                allow: "allow";
                 ask: "ask";
                 deny: "deny";
             }>>>;

package/dist/db/kernel-schema.d.ts

@@ -420,6 +420,18 @@ export interface ConnectorsTable {
     /** 0081: the platform connector template this connector was made from (null = none). */
     platform_template_id: ColumnType<string | null, string | null | undefined, string | null>;
 }
+/**
+ * 0104: a member's own policy for one tool of a personal-credential connector, for calls made with
+ * their own connection (maintainer decision 2026-11-09).
+ */
+export interface ConnectorToolAccountPoliciesTable {
+    org_id: string;
+    connector_id: string;
+    account_id: string;
+    tool_name: string;
+    policy: "allow" | "ask" | "deny";
+    updated_at: Ts;
+}
 /** 0010_tools.sql（0033 由 `app_tools` 改名）：连接器暴露的工具。 */
 export interface ConnectorToolsTable {
     connector_id: string;
@@ -1142,6 +1154,7 @@ export interface KernelDatabase {
     lg_checkpoint_writes: LgCheckpointWritesTable;
     connectors: ConnectorsTable;
     connector_tools: ConnectorToolsTable;
+    connector_tool_account_policies: ConnectorToolAccountPoliciesTable;
     tool_grants: ToolGrantsTable;
     conversation_tool_grants: ConversationToolGrantsTable;
     approvals: ApprovalsTable;

package/dist/errors.d.ts

@@ -251,6 +251,8 @@ export declare const ERROR_CODES: {
     readonly "connector.tool_not_found": 404;
     readonly "connector.tool_not_pending": 409;
     readonly "connector.resources_disabled": 409;
+    /** Per-member tool policies on a connector with one org credential (decision 2026-11-09). */
+    readonly "connector.not_personal": 409;
     readonly "approval.not_found": 404;
     readonly "approval.already_decided": 409;
     readonly "approval.scope_not_allowed": 409;

package/dist/errors.js

@@ -251,6 +251,8 @@ export const ERROR_CODES = {
     "connector.tool_not_found": 404,
     "connector.tool_not_pending": 409,
     "connector.resources_disabled": 409,
+    /** Per-member tool policies on a connector with one org credential (decision 2026-11-09). */
+    "connector.not_personal": 409,
     "approval.not_found": 404,
     "approval.already_decided": 409,
     "approval.scope_not_allowed": 409,

package/dist/platform/exclusions.js

@@ -608,6 +608,16 @@ export const PLATFORM_EXCLUSIONS = [
         category: "secret",
         reason: "Writes the caller's connector credentials",
     },
+    {
+        route: "GET /api/v1/orgs/:orgId/connectors/:connectorId/tool-policies/me",
+        category: "internal",
+        reason: "Display list of the connector card's 权限 sheet; connectors.get gives an agent the tools and their org defaults",
+    },
+    {
+        route: "PUT /api/v1/orgs/:orgId/connectors/:connectorId/tool-policies/me",
+        category: "human-only",
+        reason: "A member's own tool policies decide what agents may call with their connection without asking; an agent must never loosen them for itself",
+    },
     {
         route: "DELETE /api/v1/orgs/:orgId/connectors/:connectorId/credentials/me",
         category: "secret",

package/dist/platform/ops/agents.ops.js

@@ -40,6 +40,15 @@ const RouteSkills = Def.skills.unwrap();
 const Skills = RouteSkills.pick({ pinned: true })
     .extend({ orgSkills: RouteSkills.shape.orgSkills.unwrap() })
     .strict();
+/**
+ * Whether `next` sets an `allow` that `current` does not have (decision 2026-11-09: `allow` on a
+ * connector tool lets an agent call it without asking). Such a change is confirmed every time and
+ * never remembered, so an agent can never loosen its own policies on a grant the person remembered
+ * for ordinary edits.
+ */
+function addsAllow(next, current) {
+    return Object.entries(next ?? {}).some(([k, v]) => v === "allow" && current?.[k] !== "allow");
+}
 /** The definition fields an agent can set through the tool; the rest keep the web's defaults. */
 const Fields = {
     name: Def.name,
@@ -156,8 +165,10 @@ let AgentsOperations = class AgentsOperations {
      * `agents.update`'s class (spec §13): `personal` (may be remembered) only on a private agent the
      * actor owns; any other agent the actor may edit is shared, so each change is confirmed.
      */
-    async updateClass(agentId, ctx) {
+    async updateClass(agentId, toolPolicies, ctx) {
         const a = await this.agents.get(ctx.orgId, agentId, ctx.actorAccountId);
+        if (addsAllow(toolPolicies, a.definition.toolPolicies))
+            return "org";
         return a.visibility === "private" && a.ownerAccountId === ctx.actorAccountId
             ? "personal"
             : "org";
@@ -221,6 +232,8 @@ let AgentsOperations = class AgentsOperations {
                 omits: ["memberIds", "profile"],
                 loosens: { visibility: "optional: the operation creates private agents only" },
                 confirm: "personal",
+                // an `allow` loosens: never on a remembered grant
+                confirmFor: async (i) => addsAllow(i.definition.toolPolicies, undefined) ? "org" : "personal",
                 summary: (i) => ({
                     zh: `新建私有智能体「${i.definition.name}」`,
                     en: `Create private agent "${i.definition.name}"`,
@@ -246,7 +259,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.update",
-                description: 'Change an agent you may edit: your own, private or shared, and as an org admin any agent of the org. Send the version you read from agents.get and only the fields to change; the others keep their value. The description (one short paragraph, "" removes it) is saved with the definition; the avatar and quick actions are changed with agents.update-profile. disabledTools replaces the whole list of turned-off tools (send [] to turn every tool on). A version that is no longer current is refused, so read the agent again first. The visibility cannot be changed here (that is done on the agents page of the web app). A change to your own private agent may be remembered by the person; a change to a shared agent is confirmed every time.',
+                description: 'Change an agent you may edit: your own, private or shared, and as an org admin any agent of the org. Send the version you read from agents.get and only the fields to change; the others keep their value. The description (one short paragraph, "" removes it) is saved with the definition; the avatar and quick actions are changed with agents.update-profile. disabledTools replaces the whole list of turned-off tools (send [] to turn every tool on). A version that is no longer current is refused, so read the agent again first. The visibility cannot be changed here (that is done on the agents page of the web app). A change to your own private agent may be remembered by the person; a change to a shared agent, or one that sets a tool policy to allow, is confirmed every time.',
                 input: z
                     .object({
                     agentId: AgentId,
@@ -289,7 +302,7 @@ let AgentsOperations = class AgentsOperations {
                         next: "The agent changed since you read it: read it again with agents.get, then send its current version.",
                     },
                 ],
-                confirmFor: (i, ctx) => this.updateClass(i.agentId, ctx),
+                confirmFor: (i, ctx) => this.updateClass(i.agentId, i.toolPolicies, ctx),
                 summary: async (i, ctx) => {
                     const a = await this.agents.get(ctx.orgId, i.agentId, ctx.actorAccountId);
                     const name = named(a.definition.name);
@@ -353,7 +366,7 @@ let AgentsOperations = class AgentsOperations {
                 // needs no declaration: an input that accepts less than the route passes the parity test.
                 omits: ["expectedUpdatedAt"],
                 confirm: "personal",
-                confirmFor: (i, ctx) => this.updateClass(i.agentId, ctx),
+                confirmFor: (i, ctx) => this.updateClass(i.agentId, undefined, ctx),
                 errors: [
                     {
                         code: "agent.not_found",
@@ -493,7 +506,7 @@ let AgentsOperations = class AgentsOperations {
                 confirm: "personal",
                 // destructive: asked every time and never remembered, a shared agent as an org write
                 rememberable: false,
-                confirmFor: (i, ctx) => this.updateClass(i.agentId, ctx),
+                confirmFor: (i, ctx) => this.updateClass(i.agentId, undefined, ctx),
                 errors: [
                     {
                         code: "agent.not_found",
@@ -578,7 +591,7 @@ let AgentsOperations = class AgentsOperations {
                 authz: { orgAction: "agents.create" },
                 mirrors: ["POST /api/v1/orgs/:orgId/agents/:agentId/pending-connectors/:key/bind"],
                 confirm: "personal",
-                confirmFor: (i, ctx) => this.updateClass(i.agentId, ctx),
+                confirmFor: (i, ctx) => this.updateClass(i.agentId, undefined, ctx),
                 errors: [
                     {
                         code: "agent.pending_connector_not_found",

package/dist/runtime/subagents/definition.d.ts

@@ -34,9 +34,10 @@ export interface EffectiveDefinitionDeps {
 type Policy = "ask" | "deny";
 /**
  * `base` with `over` applied on top, the stricter value winning per key (`deny` > `ask`). Values
- * other than `ask` / `deny` (stored template data is not re-validated) are skipped on both sides.
+ * other than `ask` / `deny` (stored template data is not re-validated; an agent's connector-tool
+ * `allow`, which the policy check reads from the agent's current version) are skipped on both sides.
  */
-export declare function stricterPolicies(base: Record<string, Policy>, over: Record<string, Policy>): Record<string, Policy>;
+export declare function stricterPolicies(base: Record<string, string>, over: Record<string, string>): Record<string, Policy>;
 /** An org agent's version and definition as checked by its gates. */
 export interface CheckedOrgAgent {
     version: number;

package/dist/runtime/subagents/definition.js

@@ -23,7 +23,8 @@ const RANK = { ask: 1, deny: 2 };
 const isPolicy = (p) => p === "ask" || p === "deny";
 /**
  * `base` with `over` applied on top, the stricter value winning per key (`deny` > `ask`). Values
- * other than `ask` / `deny` (stored template data is not re-validated) are skipped on both sides.
+ * other than `ask` / `deny` (stored template data is not re-validated; an agent's connector-tool
+ * `allow`, which the policy check reads from the agent's current version) are skipped on both sides.
  */
 export function stricterPolicies(base, over) {
     const out = {};