@capybara-hq/kernel 0.1.0-rc.11 → 0.1.0-rc.13

package/dist/admin/admin.schemas.d.ts

@@ -53,6 +53,19 @@ export declare const DeploymentSettingsBody: z.ZodObject<{
     uiTheme: z.ZodOptional<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>>;
+    uiArrangement: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        "agent.detail.section": "agent.detail.section";
+        "conversation.panel": "conversation.panel";
+        "conversation.properties.section": "conversation.properties.section";
+        "conversation.tool-result.card": "conversation.tool-result.card";
+        "file.preview": "file.preview";
+        "org.page": "org.page";
+        "org.settings.section": "org.settings.section";
+        "platform.page": "platform.page";
+    }> & z.core.$partial, z.ZodNullable<z.ZodObject<{
+        hidden: z.ZodArray<z.ZodString>;
+        order: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>>;
 }, z.core.$strict>;
 export declare const PurposeParams: z.ZodObject<{
     purpose: z.ZodString;

package/dist/agents/agent-lookup.d.ts

@@ -49,6 +49,11 @@ export declare function visibleTo(viewerAccountId: string | null): (eb: Expressi
  * the live org). Deleted agents are never visible.
  */
 export declare function isAgentVisibleTo(db: KernelSchemaDb, agentId: string, accountId: string): Promise<boolean>;
+/**
+ * {@link isAgentVisibleTo} for an agent of `orgId` only: an agent the account can read in another
+ * org is not visible here (UI slots spec R6, the `agent.detail.section` scope rule).
+ */
+export declare function isAgentVisibleIn(db: KernelSchemaDb, orgId: string, agentId: string, accountId: string): Promise<boolean>;
 /**
  * Reads agents for a viewer (the visibility rule {@link visibleTo}): the part of `AgentsService`
  * the conversations, the skill invoker and the attachments read, with no dependency on the

package/dist/agents/agent-lookup.js

@@ -67,6 +67,21 @@ export async function isAgentVisibleTo(db, agentId, accountId) {
         .executeTakeFirst();
     return row !== undefined;
 }
+/**
+ * {@link isAgentVisibleTo} for an agent of `orgId` only: an agent the account can read in another
+ * org is not visible here (UI slots spec R6, the `agent.detail.section` scope rule).
+ */
+export async function isAgentVisibleIn(db, orgId, agentId, accountId) {
+    const row = await db
+        .selectFrom("agents")
+        .select("id")
+        .where("id", "=", agentId)
+        .where("org_id", "=", orgId)
+        .where("deleted_at", "is", null)
+        .where(visibleTo(accountId))
+        .executeTakeFirst();
+    return row !== undefined;
+}
 /**
  * Reads agents for a viewer (the visibility rule {@link visibleTo}): the part of `AgentsService`
  * the conversations, the skill invoker and the attachments read, with no dependency on the

package/dist/agents/agents.schemas.d.ts

@@ -33,6 +33,7 @@ export declare const AgentCreateDefinition: z.ZodObject<{
         tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
     }, z.core.$strict>], "kind">>>;
     toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        allow: "allow";
         ask: "ask";
         deny: "deny";
     }>>>;
@@ -116,6 +117,7 @@ export declare const AgentCreateBody: z.ZodObject<{
             tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
         }, z.core.$strict>], "kind">>>;
         toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+            allow: "allow";
             ask: "ask";
             deny: "deny";
         }>>>;
@@ -231,6 +233,7 @@ export declare const AgentUpdateBody: z.ZodObject<{
             tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
         }, z.core.$strict>], "kind">>>;
         toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+            allow: "allow";
             ask: "ask";
             deny: "deny";
         }>>>;

package/dist/agents/agents.service.js

@@ -8,6 +8,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
+import { parseToolKey } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
@@ -310,7 +311,16 @@ let AgentsService = class AgentsService {
                 message: "subagentTools is set only on a sub-agent's definition at dispatch",
             });
         }
-        for (const key of Object.keys(def.toolPolicies)) {
+        for (const [key, policy] of Object.entries(def.toolPolicies)) {
+            // `allow` counts only for a connector tool (decision 2026-11-09): elsewhere a policy only
+            // tightens, so an `allow` there is refused rather than kept as a no-op
+            if (policy === "allow" && parseToolKey(key)?.kind !== "connector") {
+                details.push({
+                    path: `toolPolicies.${key}`,
+                    message: `"allow" applies only to a connector's tools; "${key}" can only be tightened (ask or deny)`,
+                });
+                continue;
+            }
             if (!isToolPolicyKey(key, keys)) {
                 // an rc key (tool naming spec §8.3): saving writes current keys only, so name them
                 const renamed = legacyKeySaveText(key, keys);

package/dist/agents/definition.d.ts

@@ -196,6 +196,7 @@ export declare const AgentDefinitionSchema: z.ZodObject<{
         deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        allow: "allow";
         ask: "ask";
         deny: "deny";
     }>>>;

package/dist/agents/definition.js

@@ -207,10 +207,14 @@ export const AgentDefinitionSchema = z.object({
      */
     subagentTools: SubagentToolsSchema.optional(),
     /**
-     * Tightened policies by tool key (`ask` / `deny` only, never `allow`); keys are tools the agent
-     * could have (on or turned off). Older definitions without it read as empty.
+     * Policies by tool key; keys are tools the agent could have (on or turned off). `ask` / `deny`
+     * tighten any tool. `allow` is accepted only on a connector tool key and counts only for a
+     * personal-credential connector's tool (decision 2026-11-09): it overrides the org default and
+     * the member's own 询问, never the org's or the member's 禁止 (`tools/policy.ts`
+     * `connectorPolicy`); on any other tool it changes nothing. Older definitions without it read as
+     * empty.
      */
-    toolPolicies: z.record(z.string(), z.enum(["ask", "deny"])).default({}),
+    toolPolicies: z.record(z.string(), z.enum(["allow", "ask", "deny"])).default({}),
     /**
      * 技能（M5 T13）：`orgSkills` 是引用的组织技能 id（保存时校验属于本组织且未删除，不可重复）。
      * agent 自己的技能（`scope=agent`）自动对它生效，不进定义。可省略（较早保存的定义也没有），按空处理；

package/dist/agents/org-templates.js

@@ -200,6 +200,10 @@ extensionTools = []) {
     const toolPolicies = {};
     const connectorPolicies = new Map();
     for (const [k, v] of Object.entries(def.toolPolicies ?? {})) {
+        // a template only tightens: an agent's `allow` (a connector tool's, decision 2026-11-09)
+        // is not carried into it
+        if (v === "allow")
+            continue;
         const parsed = parseToolKey(k);
         if (parsed !== null && parsed.kind !== "connector" && TOOL_KEY_RE.test(k)) {
             toolPolicies[k] = v;

package/dist/agents/pending-connectors.service.js

@@ -134,7 +134,7 @@ let PendingConnectorsService = class PendingConnectorsService {
             }
             const k = connectorToolKey(c.slug, n);
             const prev = toolPolicies[k];
-            if (prev === undefined || RANK[p] > RANK[prev])
+            if (prev === undefined || prev === "allow" || RANK[p] > RANK[prev])
                 toolPolicies[k] = p;
         }
         // tools are on by default (tools default-on spec §3): binding an entry that names some tools

package/dist/background/background.module.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 import { Module } from "@nestjs/common";
 import { ConversationAccessModule } from "../conversations/access.js";
 import { EventLogModule } from "../conversations/event-log.js";
-import { EnvironmentsModule } from "../environments/environments.module.js";
+import { DevicesModule } from "../devices/devices.module.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { BackgroundTaskFinisher } from "./finish.js";
 import { BackgroundTaskStopper } from "./stop.js";
@@ -28,7 +28,7 @@ BackgroundModule = __decorate([
         imports: [
             BackgroundStoreModule,
             SandboxModule,
-            EnvironmentsModule,
+            DevicesModule,
             EventLogModule,
             ConversationAccessModule,
         ],

package/dist/background/launch-lock.d.ts

@@ -3,7 +3,7 @@ import { XactLock } from "../infra/database/xact-lock.js";
 /**
  * The launch lock of one root conversation (decision R9: one provider per transaction-scoped
  * lock): serializes background task reservations in its tree, so the count of running tasks
- * checked against `sandbox.background.maxTasks` (per root conversation, whatever environment it
+ * checked against `sandbox.background.maxTasks` (per root conversation, whatever device it
  * works in) and the insert of the new row are one step. Joins the
  * caller's transaction (`mandatory`), which holds it until it ends.
  */

package/dist/background/launch-lock.js

@@ -14,7 +14,7 @@ import { XactLock } from "../infra/database/xact-lock.js";
 /**
  * The launch lock of one root conversation (decision R9: one provider per transaction-scoped
  * lock): serializes background task reservations in its tree, so the count of running tasks
- * checked against `sandbox.background.maxTasks` (per root conversation, whatever environment it
+ * checked against `sandbox.background.maxTasks` (per root conversation, whatever device it
  * works in) and the insert of the new row are one step. Joins the
  * caller's transaction (`mandatory`), which holds it until it ends.
  */

package/dist/background/poll.job.d.ts

@@ -21,7 +21,7 @@ export declare const launchAbandonedAfterMs: (cfg: KernelConfig) => number;
 /**
  * The worker's background task jobs (spec 2026-11-05-background-bash-design §4.3), each once per
  * tick across replicas:
- * - `background-task-poll` (every `sandbox.background.pollSeconds`): for every environment
+ * - `background-task-poll` (every `sandbox.background.pollSeconds`): for every device
  *   instance with running tasks (of any conversation using it), one exec through
  *   `SandboxService.ifRunning` (which never creates or resumes an instance) reports each task's
  *   exit file and liveness; ended tasks finish through {@link BackgroundTaskFinisher}. Each poll
@@ -47,7 +47,7 @@ export declare class BackgroundTaskPollJob {
      * result: they never started), with a `changed: "background"` frame to their conversations.
      */
     pollOnce(signal?: AbortSignal): Promise<number>;
-    /** Polls the tasks of one environment instance; returns how many finished. */
+    /** Polls the tasks of one device instance; returns how many finished. */
     private pollSandbox;
     /** The poll exec of one instance: each task's report by id. */
     private pollExec;

package/dist/background/poll.job.js

@@ -44,7 +44,7 @@ const POLL_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
 /**
  * The worker's background task jobs (spec 2026-11-05-background-bash-design §4.3), each once per
  * tick across replicas:
- * - `background-task-poll` (every `sandbox.background.pollSeconds`): for every environment
+ * - `background-task-poll` (every `sandbox.background.pollSeconds`): for every device
  *   instance with running tasks (of any conversation using it), one exec through
  *   `SandboxService.ifRunning` (which never creates or resumes an instance) reports each task's
  *   exit file and liveness; ended tasks finish through {@link BackgroundTaskFinisher}. Each poll
@@ -93,8 +93,8 @@ let BackgroundTaskPollJob = class BackgroundTaskPollJob {
         for (const t of await this.store.runningStarted()) {
             if (t.sid === null || t.sandboxCreatedAt === null)
                 continue;
-            // one exec per instance: the tasks of every conversation sharing the environment
-            const key = `${t.environmentId} ${t.sandboxCreatedAt.getTime()}`;
+            // one exec per instance: the tasks of every conversation sharing the device
+            const key = `${t.deviceId} ${t.sandboxCreatedAt.getTime()}`;
             groups.set(key, [...(groups.get(key) ?? []), t]);
         }
         let finished = 0;
@@ -102,9 +102,9 @@ let BackgroundTaskPollJob = class BackgroundTaskPollJob {
             if (signal.aborted)
                 break;
             try {
-                // the environment's provider is not there (no cloud provider, `@device` not served):
+                // the device's provider is not there (no cloud provider, `@local` not served):
                 // its tasks stay as they are until it is
-                const env = tasks[0]?.environmentId ?? null;
+                const env = tasks[0]?.deviceId ?? null;
                 if (env === null ? !this.sandbox.cloudAvailable : !(await this.sandbox.availableFor(env))) {
                     continue;
                 }
@@ -114,7 +114,7 @@ let BackgroundTaskPollJob = class BackgroundTaskPollJob {
                 if (signal.aborted)
                     break;
                 this.log.warn("cannot poll background tasks; retrying next tick", {
-                    environmentId: tasks[0]?.environmentId,
+                    deviceId: tasks[0]?.deviceId,
                     err,
                 });
             }
@@ -123,13 +123,13 @@ let BackgroundTaskPollJob = class BackgroundTaskPollJob {
             this.log.info("background tasks finished", { count: finished });
         return finished;
     }
-    /** Polls the tasks of one environment instance; returns how many finished. */
+    /** Polls the tasks of one device instance; returns how many finished. */
     async pollSandbox(tasks, signal) {
         const [first] = tasks;
-        // a task from before environments has no instance any more
-        const r = first.environmentId === null
+        // a task from before devices has no instance any more
+        const r = first.deviceId === null
             ? { kind: "not_running", status: "gone" }
-            : await this.sandbox.ifRunning(first.environmentId, { createdAt: first.sandboxCreatedAt }, (p, h, sig) => this.pollExec(actingAs(p, taskActor(first)), h, tasks, sig), signal);
+            : await this.sandbox.ifRunning(first.deviceId, { createdAt: first.sandboxCreatedAt }, (p, h, sig) => this.pollExec(actingAs(p, taskActor(first)), h, tasks, sig), signal);
         const now = new Date();
         let n = 0;
         for (const t of tasks) {

package/dist/background/stop.d.ts

@@ -43,7 +43,7 @@ export declare class BackgroundTaskStopper {
     stop(task: BackgroundTaskRow, why: StopReason, signal?: AbortSignal): Promise<BackgroundTaskRow>;
     /**
      * SIGTERM, the grace period, SIGKILL until the session is empty, then the last lines: in the
-     * task's own instance only (`ifRunning`); a task from before environments has none.
+     * task's own instance only (`ifRunning`); a task from before devices has none.
      */
     private signalTask;
     /**

package/dist/background/stop.js

@@ -138,12 +138,12 @@ let BackgroundTaskStopper = class BackgroundTaskStopper {
     }
     /**
      * SIGTERM, the grace period, SIGKILL until the session is empty, then the last lines: in the
-     * task's own instance only (`ifRunning`); a task from before environments has none.
+     * task's own instance only (`ifRunning`); a task from before devices has none.
      */
     async signalTask(cur, sid, signal) {
-        if (cur.environmentId === null)
+        if (cur.deviceId === null)
             return { kind: "not_running", status: "gone" };
-        return this.sandbox.ifRunning(cur.environmentId, { createdAt: cur.sandboxCreatedAt }, async (tp, h, sig) => {
+        return this.sandbox.ifRunning(cur.deviceId, { createdAt: cur.sandboxCreatedAt }, async (tp, h, sig) => {
             const p = actingAs(tp, taskActor(cur));
             const term = await p.exec(h, {
                 command: termScript(cur.id, sid),

package/dist/background/store.d.ts

@@ -14,10 +14,10 @@ export interface BackgroundTaskRow {
      */
     sandboxConversationId: string;
     /**
-     * The environment the task runs in (the root conversation's when it was launched): its instance
-     * is where the task's processes are. Null only for tasks from before environments (all finished).
+     * The device the task runs in (the root conversation's when it was launched): its instance
+     * is where the task's processes are. Null only for tasks from before devices (all finished).
      */
-    environmentId: string | null;
+    deviceId: string | null;
     runId: string;
     callId: string;
     triggerAccountId: string;
@@ -157,10 +157,10 @@ export declare class BackgroundTaskStore {
     /** Moves the read offset forward only (a concurrent reader never moves it back). */
     advanceOffset(id: string, to: number): Promise<void>;
     /**
-     * Finished tasks of an environment whose process may still exist (any conversation's: they
+     * Finished tasks of a device whose process may still exist (any conversation's: they
      * share the instance).
      */
-    pendingKills(environmentId: string): Promise<BackgroundTaskRow[]>;
+    pendingKills(deviceId: string): Promise<BackgroundTaskRow[]>;
     clearKill(ids: string[]): Promise<void>;
     /** Deletes finished tasks that ended before `before`; a running one is never deleted. */
     pruneFinished(before: Date): Promise<number>;

package/dist/background/store.js

@@ -18,7 +18,7 @@ const toRow = (r) => ({
     orgId: r.org_id,
     conversationId: r.conversation_id,
     sandboxConversationId: r.sandbox_conversation_id,
-    environmentId: r.environment_id,
+    deviceId: r.device_id,
     runId: r.run_id,
     callId: r.call_id,
     triggerAccountId: r.trigger_account_id,
@@ -195,7 +195,7 @@ let BackgroundTaskStore = class BackgroundTaskStore {
             org_id: row.orgId,
             conversation_id: row.conversationId,
             sandbox_conversation_id: row.sandboxConversationId,
-            environment_id: row.environmentId,
+            device_id: row.deviceId,
             run_id: row.runId,
             call_id: row.callId,
             trigger_account_id: row.triggerAccountId,
@@ -314,14 +314,14 @@ let BackgroundTaskStore = class BackgroundTaskStore {
             .execute();
     }
     /**
-     * Finished tasks of an environment whose process may still exist (any conversation's: they
+     * Finished tasks of a device whose process may still exist (any conversation's: they
      * share the instance).
      */
-    async pendingKills(environmentId) {
+    async pendingKills(deviceId) {
         const rows = await this.db
             .selectFrom("background_tasks")
             .selectAll()
-            .where("environment_id", "=", environmentId)
+            .where("device_id", "=", deviceId)
             .where("kill_pending", "=", true)
             .orderBy("started_at", "asc")
             .execute();

package/dist/background/tasks.service.d.ts

@@ -1,6 +1,6 @@
 import { ConversationAccess } from "../conversations/access.js";
 import { EventLog } from "../conversations/event-log.js";
-import { ConversationEnvironments } from "../environments/conversation-environments.js";
+import { ConversationDevices } from "../devices/conversation-devices.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
 import { BackgroundTaskStopper } from "./stop.js";
@@ -45,8 +45,8 @@ export declare class BackgroundTasks {
     private readonly sandbox;
     private readonly eventLog;
     private readonly db;
-    private readonly environments;
-    constructor(access: Pick<ConversationAccess, "isAccessible">, store: Pick<BackgroundTaskStore, "listFor" | "get">, stopper: Pick<BackgroundTaskStopper, "stop">, sandbox: Pick<SandboxService, "availableFor" | "ifRunning">, eventLog: Pick<EventLog, "findByIdem">, db: KernelDb, environments: Pick<ConversationEnvironments, "forTool">);
+    private readonly devices;
+    constructor(access: Pick<ConversationAccess, "isAccessible">, store: Pick<BackgroundTaskStore, "listFor" | "get">, stopper: Pick<BackgroundTaskStopper, "stop">, sandbox: Pick<SandboxService, "availableFor" | "ifRunning">, eventLog: Pick<EventLog, "findByIdem">, db: KernelDb, devices: Pick<ConversationDevices, "forTool">);
     /**
      * The conversation and every sub-agent conversation below it (grandchildren too: their tasks run
      * in the root's sandbox, agent map spec §6); `conversation.not_found` when not visible.
@@ -63,12 +63,12 @@ export declare class BackgroundTasks {
      */
     stop(orgId: string, conversationId: string, accountId: string, taskId: string, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<BackgroundTaskView>;
     /**
-     * Whether the task's environment may still be used by its conversation's owner (the access
+     * Whether the task's device may still be used by its conversation's owner (the access
      * re-check every sandbox tool call makes); when it may not, the live read is skipped.
      */
-    private environmentUsable;
+    private deviceUsable;
     /**
-     * The end of the task's output, at most `tail` bytes. Read live when the task's environment
+     * The end of the task's output, at most `tail` bytes. Read live when the task's device
      * instance runs (never resuming a suspended one); a finished task whose sandbox does not run answers
      * with the last lines its finished event kept. Anything else is
      * `background_task.output_unavailable` (409).

package/dist/background/tasks.service.js

@@ -12,7 +12,7 @@ import { Inject, Injectable } from "@nestjs/common";
 import { ConversationAccess } from "../conversations/access.js";
 import { EventLog } from "../conversations/event-log.js";
 import { conversationTree } from "../conversations/tree.js";
-import { ConversationEnvironments } from "../environments/conversation-environments.js";
+import { ConversationDevices } from "../devices/conversation-devices.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -44,15 +44,15 @@ let BackgroundTasks = class BackgroundTasks {
     sandbox;
     eventLog;
     db;
-    environments;
-    constructor(access, store, stopper, sandbox, eventLog, db, environments) {
+    devices;
+    constructor(access, store, stopper, sandbox, eventLog, db, devices) {
         this.access = access;
         this.store = store;
         this.stopper = stopper;
         this.sandbox = sandbox;
         this.eventLog = eventLog;
         this.db = db;
-        this.environments = environments;
+        this.devices = devices;
     }
     /**
      * The conversation and every sub-agent conversation below it (grandchildren too: their tasks run
@@ -119,12 +119,12 @@ let BackgroundTasks = class BackgroundTasks {
         return this.view(after, conversationId);
     }
     /**
-     * Whether the task's environment may still be used by its conversation's owner (the access
+     * Whether the task's device may still be used by its conversation's owner (the access
      * re-check every sandbox tool call makes); when it may not, the live read is skipped.
      */
-    async environmentUsable(orgId, taskConversationId) {
+    async deviceUsable(orgId, taskConversationId) {
         try {
-            await this.environments.forTool(orgId, await rootConversationOf(this.db.db, taskConversationId));
+            await this.devices.forTool(orgId, await rootConversationOf(this.db.db, taskConversationId));
             return true;
         }
         catch (e) {
@@ -134,7 +134,7 @@ let BackgroundTasks = class BackgroundTasks {
         }
     }
     /**
-     * The end of the task's output, at most `tail` bytes. Read live when the task's environment
+     * The end of the task's output, at most `tail` bytes. Read live when the task's device
      * instance runs (never resuming a suspended one); a finished task whose sandbox does not run answers
      * with the last lines its finished event kept. Anything else is
      * `background_task.output_unavailable` (409).
@@ -143,14 +143,14 @@ let BackgroundTasks = class BackgroundTasks {
         const task = await this.owned(orgId, conversationId, accountId, taskId);
         if (task.sid !== null &&
             task.sandboxCreatedAt !== null &&
-            task.environmentId !== null &&
-            (await this.sandbox.availableFor(task.environmentId)) &&
-            (await this.environmentUsable(orgId, task.conversationId))) {
+            task.deviceId !== null &&
+            (await this.sandbox.availableFor(task.deviceId)) &&
+            (await this.deviceUsable(orgId, task.conversationId))) {
             const createdAt = task.sandboxCreatedAt;
             // the person reading it acts in the task's conversation
             const actor = { accountId, conversationId: task.conversationId };
             try {
-                const r = await this.sandbox.ifRunning(task.environmentId, { createdAt }, async (p, h, signal) => {
+                const r = await this.sandbox.ifRunning(task.deviceId, { createdAt }, async (p, h, signal) => {
                     const res = await actingAs(p, actor).exec(h, {
                         command: tailScript(task.id, tail),
                         cwd: rootsOf(h).workspace,
@@ -185,7 +185,7 @@ BackgroundTasks = __decorate([
     __param(3, Inject(SandboxService)),
     __param(4, Inject(EventLog)),
     __param(5, Inject(KernelDb)),
-    __param(6, Inject(ConversationEnvironments))
+    __param(6, Inject(ConversationDevices))
 ], BackgroundTasks);
 export { BackgroundTasks };
 /** Prints `size <bytes>` and `out <base64 of the last `tail` bytes>`. Relative to the workspace root. */

package/dist/catalog/component-scope.controller.d.ts

@@ -1,4 +1,5 @@
 import type { z } from "zod";
+import { PluginIcons } from "../extensions/plugin-icons.js";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
 import { ComponentParams, ComponentDisabledSchema as DisabledBody, ComponentIdSchema as IdParams, ComponentListQuery as ListQuery, OrgComponentListQuery, ComponentScopePreviewSchema as PreviewBody, ComponentScopeSchema as ScopeBody, ComponentShownSchema as ShownBody, ComponentSwitchBody as SwitchBody, ComponentTemplateVersionSchema as TemplateVersionBody } from "./component-scope.schemas.js";
@@ -13,7 +14,8 @@ import { PlatformComponents, type UploadedComponentVersion } from "./platform-co
 export declare class AdminComponentsController {
     private readonly scope;
     private readonly components;
-    constructor(scope: ComponentScopeService, components: PlatformComponents);
+    private readonly icons;
+    constructor(scope: ComponentScopeService, components: PlatformComponents, icons: PluginIcons);
     /**
      * Updates a platform skill on its own (spec §7.2): the skill package (zip) as the raw body
      * (`application/octet-stream`, at most `packages.maxBytes`). The package keeps the skill's name
@@ -26,9 +28,14 @@ export declare class AdminComponentsController {
     }): Promise<UploadedComponentVersion>;
     /** Updates a platform agent template on its own: `{ content }` is the template markdown file. */
     uploadAgentTemplateVersion(principal: Principal, p: z.infer<typeof IdParams>, body: z.infer<typeof TemplateVersionBody>): Promise<UploadedComponentVersion>;
-    /** `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on). */
+    /**
+     * `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on),
+     * each with its display name and its plugin's icon (`icon`, the admin route; null without one).
+     */
     list(q: z.infer<typeof ListQuery>): Promise<{
-        components: ComponentView[];
+        components: (ComponentView & {
+            icon: string | null;
+        })[];
     }>;
     /**
      * A component's versions, newest first: `{ versions: [{ version, catalogVersion, updatedOnOwn,
@@ -65,14 +72,19 @@ export declare class AdminComponentsController {
  */
 export declare class OrgComponentsController {
     private readonly scope;
-    constructor(scope: ComponentScopeService);
+    private readonly icons;
+    constructor(scope: ComponentScopeService, icons: PluginIcons);
     /**
      * The platform components offered to the org (`?kind=`, `?itemId=`: only those; Task 10): each
      * with its state in the org (`on`, `locked` for `all`, the org's `switch`) and whether an org
-     * admin may switch it. Members read it (the workspace pages are read-only for them).
+     * admin may switch it. Members read it (the workspace pages are read-only for them). Each has
+     * its display name and `icon`, its plugin's icon on the org's catalog route (null without one,
+     * or when the org's catalog does not show the plugin to the reader: the share gate holds).
      */
     list(org: OrgContext, q: z.infer<typeof OrgComponentListQuery>): Promise<{
-        components: OrgOfferedComponentView[];
+        components: (OrgOfferedComponentView & {
+            icon: string | null;
+        })[];
     }>;
     setSwitch(principal: Principal, org: OrgContext, p: z.infer<typeof ComponentParams>, body: z.infer<typeof SwitchBody>): Promise<{
         component: OrgComponentView;