@capybara-hq/kernel 0.1.0-rc.11 → 0.1.0-rc.13

package/dist/{devices → local-devices}/relay.js

@@ -14,16 +14,16 @@ import { ApiError } from "../errors.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import { KERNEL_BUS, KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
-import { environmentNotFound } from "../sandbox/sandbox.service.js";
+import { deviceNotFound } from "../sandbox/sandbox.service.js";
 import { deviceLeaseKey, deviceReqKey, deviceReqTopic, deviceResKey, deviceResTopic, } from "./keys.js";
 import { DeviceTargets } from "./targets.js";
-/** The environment's connected machine is not connected (no replica holds its lease). */
-export const environmentOffline = () => new ApiError("environment.offline", "The connected machine of this environment is offline. Start capybara-device on that machine, or pick another environment.");
+/** The device's connected machine is not connected (no replica holds its lease). */
+export const deviceOffline = () => new ApiError("device.offline", "The machine of this local device is offline. Start capybara-device on that machine, or pick another device.");
 /**
- * The environment's machine was disconnected (revoked, signed out): 403 `environment.forbidden`
+ * The device's machine was disconnected (revoked, signed out): 403 `device.forbidden`
  * with `details: [{ reason: "machine_revoked" }]`, so the tools tell the model what to ask for.
  */
-export const machineRevoked = () => new ApiError("environment.forbidden", "The connected machine of this environment was disconnected. Run capybara-device logout, then capybara-device login on it, or pick another environment.", [{ reason: "machine_revoked" }]);
+export const machineRevoked = () => new ApiError("device.forbidden", "The machine of this local device was disconnected. Run capybara-device logout, then capybara-device login on it, or pick another device.", [{ reason: "machine_revoked" }]);
 /** The text a machine's `error` result reaches the model with (ruling R28). */
 export const ON_MACHINE_PREFIX = "On the connected machine: ";
 /** The longest one lease check of a waiting caller may take before it counts as "unknown". */
@@ -68,8 +68,8 @@ const GRACE_EXPIRED = Symbol("grace expired");
 const errMsg = (e) => (e instanceof Error ? e.message : String(e));
 /**
  * The caller side of the device relay (environments spec §13.4). A request goes onto the
- * environment's Redis list (`capk:device-req:<environmentId>`) and is announced on
- * `device.req.<environmentId>`; whichever gateway replica holds the machine's lease drains the
+ * device's Redis list (`capk:device-req:<deviceId>`) and is announced on
+ * `device.req.<deviceId>`; whichever gateway replica holds the machine's lease drains the
  * list and forwards the frames to the machine.
  *
  * **The holder's half of the wire** (Task 6 follows it): items on the list are `KernelReq` or
@@ -82,13 +82,13 @@ const errMsg = (e) => (e instanceof Error ? e.message : String(e));
  * The caller subscribes to its result topic before pushing and reads the result key once after,
  * and once more before giving up (the run-abort pattern; a publish lost while the subscriber
  * reconnects is still found). It waits within its own call for at most `deadlineMs` plus
- * `environments.device.reconnectGraceSeconds`; when the lease disappears meanwhile (checked every
+ * `devices.local.reconnectGraceSeconds`; when the lease disappears meanwhile (checked every
  * {@link HOLDER_POLL_MS}) the wait ends at most one grace later. A result produced while the
  * machine was disconnected arrives after it reconnects. Giving up (grace, abort, a bad result)
  * removes the request from the list, or queues a `cancel` when the machine already took it
  * (ruling R15). Nothing is kept in process memory beyond the call.
  */
-let DeviceRelay = class DeviceRelay {
+let LocalDeviceRelay = class LocalDeviceRelay {
     redis;
     bus;
     locks;
@@ -104,35 +104,35 @@ let DeviceRelay = class DeviceRelay {
         this.targets = targets;
     }
     /** Whether a gateway replica holds the machine's connection now. */
-    async holderLive(environmentId) {
-        return (await this.locks.holderOf(deviceLeaseKey(environmentId))) !== null;
+    async holderLive(deviceId) {
+        return (await this.locks.holderOf(deviceLeaseKey(deviceId))) !== null;
     }
     /**
      * Queues `op` for the machine without waiting for an answer (ruling R14: `stop`). The caller
      * checks {@link holderLive} first; the frame waits on the list for the grace like any request.
      */
-    async send(environmentId, op, args, deadlineMs) {
+    async send(deviceId, op, args, deadlineMs) {
         const id = randomUUID();
         const d = Math.max(1, Math.ceil(deadlineMs));
         const req = { type: "req", id, op, args, deadlineMs: d };
-        await this.push(environmentId, JSON.stringify(req), this.graceMs() + d + LIST_TTL_MARGIN_MS);
-        await this.bus.publish(deviceReqTopic(environmentId), { id });
+        await this.push(deviceId, JSON.stringify(req), this.graceMs() + d + LIST_TTL_MARGIN_MS);
+        await this.bus.publish(deviceReqTopic(deviceId), { id });
     }
     /**
-     * Runs `op` on the environment's machine and returns its validated result. Throws
-     * `environment.offline` when no replica holds the machine at send time or when the wait ran
-     * out, but `environment.forbidden` ({@link machineRevoked}) when the machine was revoked and
-     * `environment.not_found` when the environment was deleted (checked whenever the connection is
+     * Runs `op` on the device's machine and returns its validated result. Throws
+     * `device.offline` when no replica holds the machine at send time or when the wait ran
+     * out, but `device.forbidden` ({@link machineRevoked}) when the machine was revoked and
+     * `device.not_found` when the device was deleted (checked whenever the connection is
      * missing, ruling R27); the machine's failures map to `SandboxGoneError` (`gone`),
      * `FileSystemGoneError` (`fs_gone`) or a `ToolError` (`policy`, and `error` prefixed
      * {@link ON_MACHINE_PREFIX}); an invalid answer throws a `DeviceProtocolError`. On abort the
      * abort reason is thrown.
      */
-    async call(environmentId, op, args, opts) {
+    async call(deviceId, op, args, opts) {
         const { signal } = opts;
         signal.throwIfAborted();
-        if (!(await this.holderLive(environmentId))) {
-            throw this.goneError(await this.targetState(environmentId)) ?? environmentOffline();
+        if (!(await this.holderLive(deviceId))) {
+            throw this.goneError(await this.targetState(deviceId)) ?? deviceOffline();
         }
         signal.throwIfAborted();
         const id = randomUUID();
@@ -164,8 +164,8 @@ let DeviceRelay = class DeviceRelay {
             signal.addEventListener("abort", onAbort, { once: true });
             // aborted while subscribing: nothing was sent yet
             signal.throwIfAborted();
-            await this.push(environmentId, reqJson, listTtlMs);
-            this.nudge(environmentId, id);
+            await this.push(deviceId, reqJson, listTtlMs);
+            this.nudge(deviceId, id);
             onStored(await this.redis.get(deviceResKey(id)));
             // wait until the result, the abort, or `giveUpAt`. The lease is checked every poll: its loss
             // caps `giveUpAt` at one grace from then (never extending it); a reconnect within that grace
@@ -178,7 +178,7 @@ let DeviceRelay = class DeviceRelay {
                     return;
                 try {
                     // a stalled Redis must not hold the give-up back: no answer in time means "unknown"
-                    const live = await this.leaseCheck(environmentId);
+                    const live = await this.leaseCheck(deviceId);
                     if (live === true && capped) {
                         capped = false;
                         giveUpAt = fullGiveUpAt;
@@ -188,8 +188,8 @@ let DeviceRelay = class DeviceRelay {
                         giveUpAt = Math.min(giveUpAt, Date.now() + graceMs);
                     }
                     if (live === false) {
-                        // a revoked machine or a deleted environment never comes back: fail at once
-                        const gone = this.goneError(await this.targetState(environmentId));
+                        // a revoked machine or a deleted device never comes back: fail at once
+                        const gone = this.goneError(await this.targetState(deviceId));
                         if (gone) {
                             settle({ error: gone });
                             return;
@@ -197,7 +197,7 @@ let DeviceRelay = class DeviceRelay {
                     }
                 }
                 catch (e) {
-                    this.log.warn("device relay lease check failed", { environmentId, error: errMsg(e) });
+                    this.log.warn("device relay lease check failed", { deviceId, error: errMsg(e) });
                 }
                 if (stopped)
                     return;
@@ -219,31 +219,31 @@ let DeviceRelay = class DeviceRelay {
             stopped = true;
             clearTimeout(timer);
             if ("res" in r) {
-                await this.quietly("delete the result", environmentId, () => this.redis.del(deviceResKey(id)));
+                await this.quietly("delete the result", deviceId, () => this.redis.del(deviceResKey(id)));
                 return this.resultOf(op, r.res);
             }
             if (r.error instanceof Error) {
                 // a bad answer: drop it, give the request up, report the protocol error
-                await this.quietly("delete the result", environmentId, () => this.redis.del(deviceResKey(id)));
+                await this.quietly("delete the result", deviceId, () => this.redis.del(deviceResKey(id)));
             }
-            await this.giveUp(environmentId, id, reqJson, listTtlMs);
+            await this.giveUp(deviceId, id, reqJson, listTtlMs);
             if (r.error === ABORTED)
                 throw signal.reason;
             if (r.error === GRACE_EXPIRED)
-                throw environmentOffline();
+                throw deviceOffline();
             throw r.error;
         }
         finally {
             stopped = true;
             clearTimeout(timer);
             signal.removeEventListener("abort", onAbort);
-            await this.quietly("unsubscribe", environmentId, unsubscribe);
+            await this.quietly("unsubscribe", deviceId, unsubscribe);
         }
     }
     /** {@link holderLive}, or undefined when it takes longer than {@link LEASE_CHECK_TIMEOUT_MS}. */
-    async leaseCheck(environmentId) {
+    async leaseCheck(deviceId) {
         let timer;
-        const check = this.holderLive(environmentId);
+        const check = this.holderLive(deviceId);
         check.catch(() => { }); // a late failure after the timeout is not unhandled
         try {
             return await Promise.race([
@@ -258,12 +258,12 @@ let DeviceRelay = class DeviceRelay {
         }
     }
     /**
-     * The environment's state ({@link DeviceTargets}), or undefined when it cannot be read within
+     * The device's state ({@link DeviceTargets}), or undefined when it cannot be read within
      * {@link LEASE_CHECK_TIMEOUT_MS} (a failure only logs: the caller keeps its other rules).
      */
-    async targetState(environmentId) {
+    async targetState(deviceId) {
         let timer;
-        const read = this.targets.state(environmentId);
+        const read = this.targets.state(deviceId);
         read.catch(() => { });
         try {
             return await Promise.race([
@@ -274,8 +274,8 @@ let DeviceRelay = class DeviceRelay {
             ]);
         }
         catch (e) {
-            this.log.warn("device relay could not read the environment state", {
-                environmentId,
+            this.log.warn("device relay could not read the device state", {
+                deviceId,
                 error: errMsg(e),
             });
             return undefined;
@@ -287,39 +287,39 @@ let DeviceRelay = class DeviceRelay {
     /** The error of a state that never comes back; undefined for `active` or unknown. */
     goneError(state) {
         if (state === "deleted")
-            return environmentNotFound();
+            return deviceNotFound();
         if (state === "revoked")
             return machineRevoked();
         return undefined;
     }
     graceMs() {
-        return this.config.get().environments.device.reconnectGraceSeconds * 1000;
+        return this.config.get().devices.local.reconnectGraceSeconds * 1000;
     }
-    async push(environmentId, frame, ttlMs) {
-        await this.redis.eval(PUSH_WITH_TTL, 1, deviceReqKey(environmentId), frame, String(ttlMs));
+    async push(deviceId, frame, ttlMs) {
+        await this.redis.eval(PUSH_WITH_TTL, 1, deviceReqKey(deviceId), frame, String(ttlMs));
     }
     /** Announces new frames to the holder; a lost nudge is picked up on the holder's next drain. */
-    nudge(environmentId, id) {
-        this.bus.publish(deviceReqTopic(environmentId), { id }).catch((e) => {
-            this.log.warn("device relay nudge failed", { environmentId, error: errMsg(e) });
+    nudge(deviceId, id) {
+        this.bus.publish(deviceReqTopic(deviceId), { id }).catch((e) => {
+            this.log.warn("device relay nudge failed", { deviceId, error: errMsg(e) });
         });
     }
     /** Removes the request from the list, or queues a cancel when the machine took it (R15). */
-    async giveUp(environmentId, id, reqJson, ttlMs) {
+    async giveUp(deviceId, id, reqJson, ttlMs) {
         const cancel = JSON.stringify({ type: "cancel", id });
-        await this.quietly("give the request up", environmentId, async () => {
-            const queued = await this.redis.eval(GIVE_UP, 1, deviceReqKey(environmentId), reqJson, cancel, String(ttlMs));
+        await this.quietly("give the request up", deviceId, async () => {
+            const queued = await this.redis.eval(GIVE_UP, 1, deviceReqKey(deviceId), reqJson, cancel, String(ttlMs));
             if (queued === 1)
-                this.nudge(environmentId, id);
+                this.nudge(deviceId, id);
         });
     }
     /** Runs a side step whose failure must not replace the call's outcome: logged, swallowed. */
-    async quietly(what, environmentId, fn) {
+    async quietly(what, deviceId, fn) {
         try {
             await fn();
         }
         catch (e) {
-            this.log.warn(`device relay could not ${what}`, { environmentId, error: errMsg(e) });
+            this.log.warn(`device relay could not ${what}`, { deviceId, error: errMsg(e) });
         }
     }
     /** A stored / published `res` frame for request `id`, or the protocol error it carries. */
@@ -361,7 +361,7 @@ let DeviceRelay = class DeviceRelay {
         }
     }
 };
-DeviceRelay = __decorate([
+LocalDeviceRelay = __decorate([
     Injectable(),
     __param(0, Inject(REDIS)),
     __param(1, Inject(KERNEL_BUS)),
@@ -369,5 +369,5 @@ DeviceRelay = __decorate([
     __param(3, Inject(KernelConfigService)),
     __param(4, Inject(KERNEL_LOGGER)),
     __param(5, Inject(DeviceTargets))
-], DeviceRelay);
-export { DeviceRelay };
+], LocalDeviceRelay);
+export { LocalDeviceRelay };

package/dist/{devices → local-devices}/targets.d.ts

@@ -1,7 +1,7 @@
 import type { SandboxRoots } from "@capybara-hq/plugin-sdk";
 import { KernelDb } from "../infra/database/kernel-db.js";
 /**
- * Whether a device environment can still be served: `active` (live and an unrevoked machine),
+ * Whether a local device can still be served: `active` (live and an unrevoked machine),
  * `revoked` (live, no active machine: disconnected or signed out) or `deleted` (missing or
  * deleted, or its org deleted).
  */
@@ -9,20 +9,20 @@ export type DeviceTargetState = "active" | "revoked" | "deleted";
 /** Whether two sets of roots name the same three directories. */
 export declare const sameRoots: (a: SandboxRoots, b: SandboxRoots) => boolean;
 /**
- * Reads a device environment and its machine from PG for the relay and the `@device` provider.
+ * Reads a local device and its machine from PG for the relay and the `@local` provider.
  * The relay asks {@link state} when a machine has no connection, so a revoked machine or a deleted
- * environment fails a waiting call at once instead of after the reconnect grace (ruling R27).
+ * device fails a waiting call at once instead of after the reconnect grace (ruling R27).
  * Kept apart from `MachinesService` (which depends on the relay) so there is no dependency cycle.
  */
 export declare class DeviceTargets {
     private readonly db;
     constructor(db: KernelDb);
-    state(environmentId: string): Promise<DeviceTargetState>;
-    /** The org of a live environment, or null (missing or deleted). */
-    orgOf(environmentId: string): Promise<string | null>;
+    state(deviceId: string): Promise<DeviceTargetState>;
+    /** The org of a live device, or null (missing or deleted). */
+    orgOf(deviceId: string): Promise<string | null>;
     /**
-     * The roots the environment's active machine last reported in its hello frame, or null (no
+     * The roots the device's active machine last reported in its hello frame, or null (no
      * active machine, or none reported yet).
      */
-    machineRoots(environmentId: string): Promise<SandboxRoots | null>;
+    machineRoots(deviceId: string): Promise<SandboxRoots | null>;
 }

package/dist/{devices → local-devices}/targets.js

@@ -13,9 +13,9 @@ const ROOT_KEYS = ["workspace", "skills", "tmp"];
 /** Whether two sets of roots name the same three directories. */
 export const sameRoots = (a, b) => ROOT_KEYS.every((k) => a[k] === b[k]);
 /**
- * Reads a device environment and its machine from PG for the relay and the `@device` provider.
+ * Reads a local device and its machine from PG for the relay and the `@local` provider.
  * The relay asks {@link state} when a machine has no connection, so a revoked machine or a deleted
- * environment fails a waiting call at once instead of after the reconnect grace (ruling R27).
+ * device fails a waiting call at once instead of after the reconnect grace (ruling R27).
  * Kept apart from `MachinesService` (which depends on the relay) so there is no dependency cycle.
  */
 let DeviceTargets = class DeviceTargets {
@@ -23,13 +23,13 @@ let DeviceTargets = class DeviceTargets {
     constructor(db) {
         this.db = db;
     }
-    async state(environmentId) {
+    async state(deviceId) {
         const row = await this.db
-            .selectFrom("environments as e")
+            .selectFrom("devices as e")
             .innerJoin("orgs as o", "o.id", "e.org_id")
-            .leftJoin("environment_machines as m", (j) => j.onRef("m.environment_id", "=", "e.id").on("m.revoked_at", "is", null))
+            .leftJoin("device_machines as m", (j) => j.onRef("m.device_id", "=", "e.id").on("m.revoked_at", "is", null))
             .select(["e.id", "m.id as machine_id"])
-            .where("e.id", "=", environmentId)
+            .where("e.id", "=", deviceId)
             .where("e.deleted_at", "is", null)
             .where("o.deleted_at", "is", null)
             .executeTakeFirst();
@@ -37,25 +37,25 @@ let DeviceTargets = class DeviceTargets {
             return "deleted";
         return row.machine_id === null ? "revoked" : "active";
     }
-    /** The org of a live environment, or null (missing or deleted). */
-    async orgOf(environmentId) {
+    /** The org of a live device, or null (missing or deleted). */
+    async orgOf(deviceId) {
         const row = await this.db
-            .selectFrom("environments")
+            .selectFrom("devices")
             .select("org_id")
-            .where("id", "=", environmentId)
+            .where("id", "=", deviceId)
             .where("deleted_at", "is", null)
             .executeTakeFirst();
         return row?.org_id ?? null;
     }
     /**
-     * The roots the environment's active machine last reported in its hello frame, or null (no
+     * The roots the device's active machine last reported in its hello frame, or null (no
      * active machine, or none reported yet).
      */
-    async machineRoots(environmentId) {
+    async machineRoots(deviceId) {
         const row = await this.db
-            .selectFrom("environment_machines")
+            .selectFrom("device_machines")
             .select("roots")
-            .where("environment_id", "=", environmentId)
+            .where("device_id", "=", deviceId)
             .where("revoked_at", "is", null)
             .executeTakeFirst();
         const r = row?.roots;

package/dist/orgs/offboarding.d.ts

@@ -30,8 +30,8 @@ export interface OffboardResult {
     runs: InFlightRun[];
     /** 负责的 agent 转交给的所有者；没有转交时为 null。 */
     newOwnerId: string | null;
-    /** The person's environments in the org, soft-deleted here; destroyed by a job after commit. */
-    environments: string[];
+    /** The person's devices in the org, soft-deleted here; destroyed by a job after commit. */
+    devices: string[];
     /** Conversations whose queued messages were deleted (`changed: queue` after commit). */
     queueConversations: string[];
 }
@@ -66,7 +66,7 @@ export declare class Offboarding {
     private readonly redis;
     private readonly registry;
     private readonly eventLog;
-    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
+    /** The departed member's devices: one-off maintenance jobs, destroyed by a worker. */
     private readonly sandboxJobs;
     /** Stops the departed member's runs (`by: null`, a system action). */
     private readonly runs;
@@ -75,7 +75,7 @@ export declare class Offboarding {
     private readonly questions;
     readonly log: KernelLogger;
     constructor(db: KernelDb, txHost: TransactionHost, sessions: Pick<SessionService, "markRevoked">, redis: Pick<Redis, "set" | "exists">, registry: Pick<ExtensionRegistry, "list">, eventLog: Pick<EventLog, "notify" | "publishChanged">, 
-    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
+    /** The departed member's devices: one-off maintenance jobs, destroyed by a worker. */
     sandboxJobs: Pick<SandboxJobs, "destroy">, 
     /** Stops the departed member's runs (`by: null`, a system action). */
     runs: OffboardingRunControl, credentials: Pick<Credentials, "clearAccount">, approvals: Pick<ApprovalsService, "cancelPendingFor">, questions: Pick<QuestionsService, "cancelPendingFor">, log: KernelLogger);
@@ -95,7 +95,7 @@ export declare class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. Soft-deletes the person's environments in the org and clears their default row (the
+     * 9. Soft-deletes the person's devices in the org and clears their default row (the
      *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
      *    any left).
      */
@@ -108,7 +108,7 @@ export declare class Offboarding {
     /**
      * After the commit (callers register it with the infra `afterCommit` inside their transaction):
      * writes the session revocation markers, publishes the cancelled events, stops the person's
-     * runs in the org and schedules destroying their environments. A failing step only logs a
+     * runs in the org and schedules destroying their devices. A failing step only logs a
      * warning.
      */
     afterOffboard(r: OffboardResult): Promise<void>;

package/dist/orgs/offboarding.js

@@ -63,7 +63,7 @@ let Offboarding = class Offboarding {
     questions;
     log;
     constructor(db, txHost, sessions, redis, registry, eventLog, 
-    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
+    /** The departed member's devices: one-off maintenance jobs, destroyed by a worker. */
     sandboxJobs, 
     /** Stops the departed member's runs (`by: null`, a system action). */
     runs, credentials, approvals, questions, log) {
@@ -96,7 +96,7 @@ let Offboarding = class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. Soft-deletes the person's environments in the org and clears their default row (the
+     * 9. Soft-deletes the person's devices in the org and clears their default row (the
      *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
      *    any left).
      */
@@ -259,8 +259,8 @@ let Offboarding = class Offboarding {
                 .where("id", "in", queueConversations)
                 .execute();
         }
-        const environments = await this.db
-            .updateTable("environments")
+        const devices = await this.db
+            .updateTable("devices")
             .set({ deleted_at: sql `now()`, updated_at: sql `now()` })
             .where("org_id", "=", orgId)
             .where("owner_kind", "=", "personal")
@@ -269,7 +269,7 @@ let Offboarding = class Offboarding {
             .returning("id")
             .execute();
         await this.db
-            .deleteFrom("environment_defaults")
+            .deleteFrom("device_defaults")
             .where("org_id", "=", orgId)
             .where("account_id", "=", accountId)
             .execute();
@@ -293,7 +293,7 @@ let Offboarding = class Offboarding {
                 channelThreadsArchived: Number(threads.numUpdatedRows),
                 toolGrantsDeleted: Number(grants.numDeletedRows),
                 ...(excluded.length > 0 && { directoryExcluded: excluded }),
-                ...(environments.length > 0 && { environmentsDeleted: environments.length }),
+                ...(devices.length > 0 && { devicesDeleted: devices.length }),
                 ...(queued.length > 0 && { queuedMessagesDeleted: queued.length }),
             },
         });
@@ -307,7 +307,7 @@ let Offboarding = class Offboarding {
                 status: r.status,
             })),
             newOwnerId: agents.length > 0 ? owner.account_id : null,
-            environments: environments.map((r) => r.id),
+            devices: devices.map((r) => r.id),
             queueConversations,
         };
     }
@@ -336,7 +336,7 @@ let Offboarding = class Offboarding {
     /**
      * After the commit (callers register it with the infra `afterCommit` inside their transaction):
      * writes the session revocation markers, publishes the cancelled events, stops the person's
-     * runs in the org and schedules destroying their environments. A failing step only logs a
+     * runs in the org and schedules destroying their devices. A failing step only logs a
      * warning.
      */
     async afterOffboard(r) {
@@ -365,13 +365,13 @@ let Offboarding = class Offboarding {
         }
         for (const run of r.runs)
             await this.stopRun(run);
-        if (r.environments.length > 0) {
+        if (r.devices.length > 0) {
             try {
-                await this.sandboxJobs.destroy(r.environments);
+                await this.sandboxJobs.destroy(r.devices);
             }
             catch (err) {
-                log.warn("offboarding: cannot schedule environment destruction", {
-                    count: r.environments.length,
+                log.warn("offboarding: cannot schedule device destruction", {
+                    count: r.devices.length,
                     err,
                 });
             }

package/dist/orgs/settings.service.d.ts

@@ -21,6 +21,8 @@ import { OrgLock } from "./org-lock.js";
  *   own (run context spec §3.3); an invalid stored value reads as absent.
  * - `theme`: the org's default theme and whether members may pick their own (themes spec §7);
  *   absent (or an invalid stored value) = follow the platform, personal picks allowed.
+ * - `uiArrangement`: per slot, the extension contributions the org hides and their order (UI slots
+ *   spec §5); a slot with no entry follows the platform's; an invalid stored value reads as absent.
  */
 /** 组织沙箱出站白名单的主机数上限。 */
 export declare const ORG_SANDBOX_ALLOW_HOSTS_MAX = 200;
@@ -85,6 +87,19 @@ export declare const OrgSettingsSchema: z.ZodObject<{
             locked: "locked";
         }>;
     }, z.core.$strict>>>;
+    uiArrangement: z.ZodCatch<z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        "agent.detail.section": "agent.detail.section";
+        "conversation.panel": "conversation.panel";
+        "conversation.properties.section": "conversation.properties.section";
+        "conversation.tool-result.card": "conversation.tool-result.card";
+        "file.preview": "file.preview";
+        "org.page": "org.page";
+        "org.settings.section": "org.settings.section";
+        "platform.page": "platform.page";
+    }> & z.core.$partial, z.ZodObject<{
+        hidden: z.ZodArray<z.ZodString>;
+        order: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>>;
 }, z.core.$strip>;
 export type OrgSettings = z.infer<typeof OrgSettingsSchema>;
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
@@ -122,6 +137,19 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
             locked: "locked";
         }>;
     }, z.core.$strict>>>;
+    uiArrangement: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        "agent.detail.section": "agent.detail.section";
+        "conversation.panel": "conversation.panel";
+        "conversation.properties.section": "conversation.properties.section";
+        "conversation.tool-result.card": "conversation.tool-result.card";
+        "file.preview": "file.preview";
+        "org.page": "org.page";
+        "org.settings.section": "org.settings.section";
+        "platform.page": "platform.page";
+    }> & z.core.$partial, z.ZodNullable<z.ZodObject<{
+        hidden: z.ZodArray<z.ZodString>;
+        order: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>>;
 }, z.core.$strict>;
 export type OrgSettingsPatch = z.infer<typeof OrgSettingsPatchSchema>;
 /** 部署的沙箱出站（`sandbox.limits.egress` + `allowHosts`）。 */

package/dist/orgs/settings.service.js

@@ -19,6 +19,7 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { assertThemeOnIn } from "../themes/theme-state.js";
 import { IanaTimeZone } from "../time-zone.js";
+import { mergeArrangement, OrgUiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
 import { OrgLock } from "./org-lock.js";
 /**
  * 组织设置（`capybara.orgs.settings` jsonb）。读取宽松：缺失或非法的字段按默认值，未知键保留不动
@@ -36,6 +37,8 @@ import { OrgLock } from "./org-lock.js";
  *   own (run context spec §3.3); an invalid stored value reads as absent.
  * - `theme`: the org's default theme and whether members may pick their own (themes spec §7);
  *   absent (or an invalid stored value) = follow the platform, personal picks allowed.
+ * - `uiArrangement`: per slot, the extension contributions the org hides and their order (UI slots
+ *   spec §5); a slot with no entry follows the platform's; an invalid stored value reads as absent.
  */
 /** 组织沙箱出站白名单的主机数上限。 */
 export const ORG_SANDBOX_ALLOW_HOSTS_MAX = 200;
@@ -87,6 +90,8 @@ export const OrgSettingsSchema = z.object({
     timeZone: IanaTimeZone.optional().catch(undefined),
     /** The org's default theme and personal lock (themes spec §7); absent = {@link DEFAULT_ORG_THEME}. */
     theme: OrgThemeSettingSchema.optional().catch(undefined),
+    /** Hidden and ordered extension contributions per slot; absent = follow the platform. */
+    uiArrangement: UiArrangementSchema.optional().catch(undefined),
 });
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
 export const OrgSettingsPatchSchema = z
@@ -106,6 +111,11 @@ export const OrgSettingsPatchSchema = z
      * follows the platform) and whether members may pick their own; null clears it.
      */
     theme: OrgThemeSettingSchema.nullable().optional(),
+    /**
+     * Per slot, the entry to hide / order contributions with (replaces that slot's stored entry);
+     * null removes a slot's entry (it follows the platform again). `platform.page` is refused.
+     */
+    uiArrangement: OrgUiArrangementPatchSchema.optional(),
 })
     .strict();
 /**
@@ -220,7 +230,14 @@ let OrgSettingsService = class OrgSettingsService {
             .filter(([, v]) => v !== undefined)
             // null clears sandboxEgress / wakeOnBackgroundTask: follow the deployment default again
             .map(([k, v]) => [k, v === null ? undefined : v]));
+        const arrangementPatch = patch.uiArrangement;
+        delete changes.uiArrangement;
         const after = { ...before, ...changes };
+        if (arrangementPatch !== undefined) {
+            after.uiArrangement = mergeArrangement(before.uiArrangement, arrangementPatch);
+            if (Object.keys(after.uiArrangement).length === 0)
+                delete after.uiArrangement;
+        }
         if (after.sandboxEgress === undefined)
             delete after.sandboxEgress;
         if (after.wakeOnBackgroundTask === undefined)
@@ -229,6 +246,8 @@ let OrgSettingsService = class OrgSettingsService {
             delete after.timeZone;
         if (after.theme === undefined)
             delete after.theme;
+        if (after.uiArrangement === undefined)
+            delete after.uiArrangement;
         if (sameSettings(before, after))
             return before;
         // Lock order: the org row (orgLock above), then the theme's catalog item and its row FOR
@@ -237,7 +256,7 @@ let OrgSettingsService = class OrgSettingsService {
             await assertThemeOnIn(this.db.db, orgId, patch.theme.id);
         }
         // 与存量合并：保留本版本不认识的键（清除的 sandboxEgress 不留在存量里）
-        const { sandboxEgress: _old, wakeOnBackgroundTask: _oldWake, timeZone: _oldZone, theme: _oldTheme, ...rest } = stored;
+        const { sandboxEgress: _old, wakeOnBackgroundTask: _oldWake, timeZone: _oldZone, theme: _oldTheme, uiArrangement: _oldArrangement, ...rest } = stored;
         await this.db
             .updateTable("orgs")
             .set({ settings: JSON.stringify({ ...rest, ...after }) })