@capybara-hq/kernel 0.1.0-rc.11 → 0.1.0-rc.12

package/dist/tools/policy.js

@@ -2,6 +2,7 @@ import { sql } from "kysely";
 import { roleAtLeast } from "../orgs/roles.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
 import { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS, SANDBOX_ASK_TOOL_NAMES, } from "./builtin-names.js";
+import { personalAuth } from "./connector-account-policies.js";
 import { normalizeStoredDefinitionIn } from "./legacy-data.js";
 export { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS } from "./builtin-names.js";
 const RANK = { allow: 0, ask: 1, deny: 2 };
@@ -35,17 +36,51 @@ export function isFixedAsk(tool, visibility, skillWritePolicy) {
     // 私有 agent：缺省 / allow 不问（R4），负责人设为 ask（D10）时与共享 agent 一样固定询问
     return !(builtinOnly && visibility === "private" && skillWritePolicy !== "ask");
 }
-const asOverride = (v) => v === "ask" || v === "deny" ? v : undefined;
+const asSetting = (v) => v === "allow" || v === "ask" || v === "deny" ? v : undefined;
+/** The stricter of the settings that are set (none set: undefined). */
+function combine(...xs) {
+    let out;
+    for (const x of xs)
+        if (x !== undefined)
+            out = out === undefined ? x : stricter(out, x);
+    return out;
+}
 /**
- * An agent's tightening for a call: its policy on the tool key and, for a per-call key
- * (`Platform:<operation>`), on that key, the stricter of the two (a policy can only tighten).
+ * An agent's setting for a call: its policy on the tool key and, for a per-call key
+ * (`Platform:<operation>`), on that key, the stricter of the two; undefined when neither is set.
+ * `allow` counts only for a connector tool ({@link connectorPolicy}); elsewhere an agent's policy
+ * can only tighten ({@link tighteningOf}).
  */
-function overrideOf(policies, toolKey, policyKey) {
-    const own = asOverride(policies?.[toolKey]);
+function settingOf(policies, toolKey, policyKey) {
+    const own = asSetting(policies?.[toolKey]);
     if (policyKey === toolKey)
         return own;
-    const s = stricter(own ?? "allow", asOverride(policies?.[policyKey]));
-    return s === "allow" ? undefined : s;
+    return combine(own, asSetting(policies?.[policyKey]));
+}
+/** An agent setting as a tightening (`allow` tightens nothing). */
+const tighteningOf = (s) => s === "ask" || s === "deny" ? s : undefined;
+/**
+ * A personal-credential connector tool's policy for one call (maintainer decisions 2026-11-09;
+ * an org-credential connector's tool keeps the org default with the agent's tightening only),
+ * highest first:
+ * 1. the org's default `deny` (a tool the org switched off never gets here: it is unavailable);
+ * 2. the member's own `deny` for calls with their connection (`member`): a floor no agent lifts;
+ * 3. the agent's setting (`agent`, from its tools page): `allow` / `ask` / `deny`;
+ * 4. the member's own `allow` / `ask`;
+ * 5. the org's default (`connector_tools.default_policy`, the annotation default unless an org
+ *    admin changed it: `readOnlyHint: true` allows, anything else asks).
+ * Fixed asks (R3, `requiresUserInteraction`), role escalation and grants apply after this.
+ */
+export function connectorPolicy(input) {
+    if (input.orgDefault === "deny")
+        return { policy: "deny", source: "org" };
+    if (input.member === "deny")
+        return { policy: "deny", source: "member" };
+    if (input.agent !== undefined)
+        return { policy: input.agent, source: "agent" };
+    if (input.member !== undefined)
+        return { policy: input.member, source: "member" };
+    return { policy: input.orgDefault, source: "org" };
 }
 /**
  * 执行时的策略判定（spec 3.6 R5：在动作执行那一刻判定）。每次调用都实时读取：
@@ -58,7 +93,7 @@ function overrideOf(policies, toolKey, policyKey) {
  *   parent's current version still tightens it (sub-agents spec §5.3, §9); its "this conversation"
  *   grants are the root conversation's (agent map spec §7); an org agent sub-agent (§5.5): `ctx.agentId` is the
  *   dispatched agent (its current version, its "always" grants) and the parent agent's current
- *   policies apply on top ({@link parentAgentOverride});
+ *   policies apply on top ({@link parentAgentSetting});
  * - 授权表（`conversation_tool_grants` / `tool_grants`），`spec_hash` 与当前定义不一致视为无效（D8），
  *   `connector_id` 与工具的来源连接器不一致也无效（删除后用同一 slug 重新安装的连接器不继承旧授权）；
  * - 工具声明了 `requiredRole`（R1）时，发起人在组织中的当前角色：不是成员 → 拒绝；角色不足 → 按角色升级的审批
@@ -75,11 +110,15 @@ export function createDecidePolicy(db) {
         let connectorDefault = call?.policy ?? tool.defaultPolicy;
         let connectorId = null;
         let hashCurrent = true;
+        /** The member's own setting for a call with their connection (a personal-credential connector). */
+        let memberSetting;
+        /** A personal-credential connector: calls use the acting account's own connection. */
+        let personal = false;
         if (tool.source.kind === "connector") {
             connectorId = tool.source.connectorId;
             const app = await db
                 .selectFrom("connectors")
-                .select(["slug", "status", "deleted_at"])
+                .select(["slug", "status", "deleted_at", "auth"])
                 .where("id", "=", tool.source.connectorId)
                 .where("org_id", "=", ctx.orgId)
                 .executeTakeFirst();
@@ -105,6 +144,19 @@ export function createDecidePolicy(db) {
                 return { unavailable: "Tool is pending review" };
             connectorDefault = row.default_policy;
             hashCurrent = row.spec_hash === tool.specHash;
+            // The call is made with the acting account's own connection (the credential the pipeline
+            // injects for `ctx.accountId`): that account's settings apply, never another's
+            personal = personalAuth(app.auth);
+            if (personal) {
+                const mine = await db
+                    .selectFrom("connector_tool_account_policies")
+                    .select("policy")
+                    .where("connector_id", "=", tool.source.connectorId)
+                    .where("account_id", "=", ctx.accountId)
+                    .where("tool_name", "=", tool.source.name)
+                    .executeTakeFirst();
+                memberSetting = mine?.policy;
+            }
         }
         // 沙箱工具的组织默认（M5 T8）：组织设置 sandboxToolPolicy 为 ask 时，有副作用的沙箱工具至少 ask
         // `orgAsk`: the org setting, not the tool's own default, is what makes it ask
@@ -116,7 +168,7 @@ export function createDecidePolicy(db) {
             }
         }
         // 运行所用版本可能是加 toolPolicies 字段之前保存的：缺省为空
-        const runOverride = overrideOf(agentDef.toolPolicies, tool.key, policyKey);
+        const runSetting = settingOf(agentDef.toolPolicies, tool.key, policyKey);
         const current = await db
             .selectFrom("agents")
             .innerJoin("agent_versions", (j) => j
@@ -130,12 +182,33 @@ export function createDecidePolicy(db) {
             ? undefined
             : await normalizeStoredDefinitionIn(db, ctx.orgId, current.definition);
         const currentPolicies = currentDef?.toolPolicies;
-        const currentOverride = overrideOf(currentPolicies, tool.key, policyKey);
-        let strictest = stricter(runOverride ?? "allow", currentOverride);
+        const currentSetting = settingOf(currentPolicies, tool.key, policyKey);
+        // the run's version, the agent's current version and (a sub-agent) its parent agent's
+        // current version: the stricter of the ones that are set
+        // (an `allow` the owner removed since the run started no longer applies: removing it tightens)
+        const runKept = runSetting === "allow" && current !== undefined && currentSetting === undefined
+            ? undefined
+            : runSetting;
+        let agentSetting = combine(runKept, currentSetting);
         if (ctx.parentConversationId !== undefined && ctx.parentAgentDiffers !== false) {
-            strictest = stricter(strictest, await parentAgentOverride(db, tool.key, policyKey, ctx));
+            agentSetting = combine(agentSetting, await parentAgentSetting(db, tool.key, policyKey, ctx));
+        }
+        let agentOverride = tighteningOf(agentSetting);
+        // A personal-credential connector's tool: the levels of `connectorPolicy` decide its base
+        // policy (an agent's `allow` counts here, below the org's and the member's deny). A connector
+        // with one org credential has no member level and its calls act as the whole org: there the
+        // agent's setting only tightens the org default, as for every other tool (review 2026-11-09)
+        let decidedBy = null;
+        if (tool.source.kind === "connector" && personal) {
+            const r = connectorPolicy({
+                orgDefault: connectorDefault,
+                member: memberSetting,
+                agent: agentSetting,
+            });
+            connectorDefault = r.policy;
+            decidedBy = r.source;
+            agentOverride = undefined;
         }
-        const agentOverride = strictest === "allow" ? undefined : strictest;
         let escalateTo = null;
         if (tool.requiredRole !== undefined) {
             const m = await db
@@ -184,15 +257,17 @@ export function createDecidePolicy(db) {
             // default
             policy: escalateTo !== null
                 ? "role"
-                : agentOverride === "ask"
+                : agentOverride === "ask" || (decidedBy === "agent" && connectorDefault === "ask")
                     ? "agent"
-                    : tool.source.kind === "connector" && connectorDefault === "ask"
-                        ? "connector"
-                        : fixedAsk
-                            ? "fixed"
-                            : orgAsk
-                                ? "org"
-                                : "default",
+                    : decidedBy === "member" && connectorDefault === "ask"
+                        ? "member"
+                        : tool.source.kind === "connector" && connectorDefault === "ask"
+                            ? "connector"
+                            : fixedAsk
+                                ? "fixed"
+                                : orgAsk
+                                    ? "org"
+                                    : "default",
         };
         return { ask };
     };
@@ -203,7 +278,7 @@ export function createDecidePolicy(db) {
  * policy for the same key applies on top, so the parent's owner can tighten a running child too.
  * For a template or general-purpose child the parent conversation has the same agent, already read.
  */
-async function parentAgentOverride(db, toolKey, policyKey, ctx) {
+async function parentAgentSetting(db, toolKey, policyKey, ctx) {
     const row = await db
         .selectFrom("conversations as c")
         .innerJoin("agents as a", "a.id", "c.agent_id")
@@ -216,7 +291,7 @@ async function parentAgentOverride(db, toolKey, policyKey, ctx) {
     // stored raw: an rc version's keys read as current keys, so its deny keeps applying (§8.3)
     const policies = (await normalizeStoredDefinitionIn(db, ctx.orgId, row.definition))
         .toolPolicies;
-    return overrideOf(policies, toolKey, policyKey);
+    return settingOf(policies, toolKey, policyKey);
 }
 /**
  * A grant matching the current definition hash and source connector, keyed by the call's policy key

package/dist/tools/tools.module.js

@@ -26,6 +26,7 @@ import { ApprovalsService } from "./approvals.service.js";
 import { Breaker } from "./breaker.js";
 import { BuiltinTools } from "./builtins/builtin-tools.js";
 import { WebPages } from "./builtins/web/page-cache.js";
+import { ConnectorAccountPolicies } from "./connector-account-policies.js";
 import { ConnectorContent } from "./connector-content.js";
 import { ConnectorsService } from "./connectors.service.js";
 import { Credentials } from "./credentials.js";
@@ -86,6 +87,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,
             OrgExtensionTools,
@@ -103,6 +105,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,
             OrgExtensionTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.11",
+  "version": "0.1.0-rc.12",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {

package/src/migrations/0104_connector_tool_account_policies.sql

@@ -0,0 +1,16 @@
+-- A member's own tool policies for their own connection of a personal-credential connector
+-- (maintainer decision 2026-11-09, the connector card's 权限): one row per account, connector and
+-- tool name. They apply to every agent the account uses; an agent's tool policy overrides them, and
+-- a tool the org switched off (or set to deny) stays denied whatever they say.
+CREATE TABLE IF NOT EXISTS capybara.connector_tool_account_policies (
+  org_id text NOT NULL REFERENCES capybara.orgs(id) ON DELETE CASCADE,
+  connector_id text NOT NULL REFERENCES capybara.connectors(id) ON DELETE CASCADE,
+  account_id text NOT NULL REFERENCES capybara.accounts(id) ON DELETE CASCADE,
+  tool_name text NOT NULL,
+  policy text NOT NULL CHECK (policy IN ('allow', 'ask', 'deny')),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (connector_id, account_id, tool_name)
+);
+
+CREATE INDEX IF NOT EXISTS connector_tool_account_policies_account
+  ON capybara.connector_tool_account_policies (account_id);