@capybara-hq/kernel 0.1.0-rc.19 → 0.1.0-rc.20

package/dist/skills/skills.service.js

@@ -16,19 +16,22 @@ import { PLATFORM_OWNER } from "../catalog/ownership.js";
 import { PlatformComponents } from "../catalog/platform-components.js";
 import { assertItemInstallable } from "../catalog/request-rules.js";
 import { AttachmentsService, SKILL_PACKAGE_CONTENT_TYPE, skillFilesPrefix, } from "../conversations/attachments.service.js";
+import { EventLog } from "../conversations/event-log.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
 import { assertCustomAllowed } from "../identity/settings.js";
 import { notifySharedUpdate } from "../inbox/org-notices.js";
+import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { OrgLock } from "../orgs/org-lock.js";
 import { textBytesTokens } from "../runtime/context/tokens.js";
 import { StorageService } from "../storage/storage.service.js";
-import { buildSkillWrite } from "../tools/builtins/skill-write.js";
 import { invocationOf, PINNED_SKILLS_LIMITS } from "./catalog.js";
-import { checkBuiltSkillFiles, readSkillPackage, skillManifest, } from "./package.js";
+import { cancelRequestIn, } from "./conversation-catalog.js";
+import { readSkillPackage, skillManifest, } from "./package.js";
 import { PLATFORM_SOURCE, platformSkillsOn, platformSource, skillFileStore, skillVersionsById, usableSkills, } from "./usable.js";
 /**
  * The skills named in `skillNames` an org would see twice if catalog item `itemId` brought its
@@ -126,19 +129,6 @@ const PUT_CONCURRENCY = 4;
 /** 详情里读取 SKILL.md 正文的上限。 */
 export const SKILL_BODY_MAX_BYTES = 1024 * 1024;
 const notFound = () => new ApiError("skill.not_found", "Skill not found");
-const nameExists = (name) => new ApiError("skill.name_exists", `A skill named "${name}" already exists in this organization. Choose another name.`);
-/** The checked files of a skill written as text (a built `SKILL.md`); `validation_failed` if not. */
-function textSkillFiles(input) {
-    const built = buildSkillWrite({
-        name: input.name,
-        description: input.description,
-        files: [{ path: SKILL_ENTRY_FILE, content: input.body }],
-    });
-    if ("errors" in built) {
-        throw new ApiError("validation_failed", `Invalid skill: ${built.errors[0] ?? "unknown problem"}`, built.errors.map((message) => ({ path: "body", message })));
-    }
-    return checkBuiltSkillFiles(built.files);
-}
 /**
  * 在调用方事务里核对 agent 定义引用的组织技能：每个 id 都必须是该组织未删除的 `scope=org` 技能
  * (or, phase 2, a platform skill on in the org: skills/usable.ts)，
@@ -348,16 +338,22 @@ let SkillsService = class SkillsService {
     txHost;
     orgLock;
     platform;
+    eventLog;
+    log;
     constructor(db, storage, attachments, txHost, orgLock, 
     /** The owner's new versions of a skill it promoted go to the platform row (ruling P3-4). */
-    platform) {
+    platform, eventLog, log) {
         this.db = db;
         this.storage = storage;
         this.attachments = attachments;
         this.txHost = txHost;
         this.orgLock = orgLock;
         this.platform = platform;
+        this.eventLog = eventLog;
+        this.log = log;
+        this.catalogDeps = { db, log, eventLog };
     }
+    catalogDeps;
     /**
      * Writes a package's files where its version will live: for a new version of a skill the org
      * promoted (ruling P3-3: a live org skill of the name linked without a pin to a platform skill
@@ -462,45 +458,6 @@ let SkillsService = class SkillsService {
             ...(owner !== undefined && { owner }),
         });
     }
-    /**
-     * The read-only checks of {@link createFromText}, for the `Platform` tool's precheck (before the
-     * card): custom skills allowed, a valid `SKILL.md`, and no live org skill of the name. Throws the
-     * same `ApiError` the create would; the create checks the name again under its lock.
-     */
-    async checkCreateFromText(orgId, input) {
-        await assertCustomAllowed(this.db.db, "customSkills");
-        const pkg = textSkillFiles(input);
-        const existing = await this.db
-            .selectFrom("skills")
-            .select("id")
-            .where("org_id", "=", orgId)
-            .where("scope", "=", "org")
-            .where("name", "=", pkg.name)
-            .where("deleted_at", "is", null)
-            .executeTakeFirst();
-        if (existing)
-            throw nameExists(pkg.name);
-    }
-    /**
-     * Creates an org skill from text (spec §14, P3-24): `SKILL.md` is built from the name,
-     * description and body ({@link buildSkillWrite}, the description a YAML string) and checked like
-     * an uploaded package. The same policy and name rules as an upload, except that a live org skill
-     * of that name is `skill.name_exists` (409) instead of a new version.
-     */
-    async createFromText(orgId, actorAccountId, input) {
-        this.storage.assertAvailable();
-        await assertCustomAllowed(this.db.db, "customSkills");
-        const pkg = textSkillFiles(input);
-        const prefix = skillFilesPrefix(randomUUID());
-        await this.putFiles(orgId, prefix, pkg.files);
-        return this.createVersionIn(orgId, actorAccountId, pkg, skillManifest(pkg), prefix, {
-            prefix,
-            failIfExists: true,
-            ...(input.actorTokenId !== undefined && { actorTokenId: input.actorTokenId }),
-            ...(input.auditDetail !== undefined && { auditDetail: input.auditDetail }),
-            ...(input.shareable !== undefined && { shareable: input.shareable }),
-        });
-    }
     /**
      * 用一组已校验的技能文件创建组织技能或给同名技能新增版本（上传与平台目录安装共用）：
      * 1. 把文件写到 `kernel/<orgId>/<prefix>`（缺省 `skills/<新 id>/`）；
@@ -514,6 +471,13 @@ let SkillsService = class SkillsService {
     actorAccountId, pkg, opts = {}) {
         this.storage.assertAvailable();
         const prefix = opts.prefix ?? skillFilesPrefix(randomUUID());
+        if (opts.stored !== undefined) {
+            const { stored, ...rest } = opts;
+            return this.createVersionIn(orgId, actorAccountId, pkg, skillManifest(pkg), prefix, {
+                ...rest,
+                ...(stored.owner !== undefined && { owner: stored.owner }),
+            });
+        }
         const owner = await this.putVersionFiles(orgId, pkg, prefix, opts.catalog !== undefined);
         try {
             return await this.createVersionIn(orgId, actorAccountId, pkg, skillManifest(pkg), prefix, {
@@ -528,6 +492,22 @@ let SkillsService = class SkillsService {
             throw e;
         }
     }
+    /**
+     * For a new version whose files are already in `kernel/<orgId>/` (a proposed version's draft):
+     * when the org skill of that name is one the org promoted, writes the files as the platform
+     * row's next version (never inside a transaction) and returns it for
+     * `createVersionFromFiles({ stored: { owner } })`; else nothing is written.
+     */
+    async prepareStoredVersion(orgId, pkg) {
+        const promoted = await promotedSkillNamed(this.db.db, orgId, pkg.name);
+        return promoted === undefined
+            ? undefined
+            : this.platform.prepareOwnerVersion(promoted, pkg.files);
+    }
+    /** Deletes a platform version {@link prepareStoredVersion} wrote that was not used. */
+    async discardStoredVersion(owner) {
+        await this.platform.discardPrefix(owner.prefix);
+    }
     /** Writes a skill package's files to `kernel/<orgId>/<prefix>` (a few at a time). */
     async putFiles(orgId, prefix, files) {
         const store = this.storage.kernel(orgId);
@@ -557,8 +537,6 @@ let SkillsService = class SkillsService {
             .where("deleted_at", "is", null)
             .forUpdate()
             .executeTakeFirst();
-        if (existing && opts.failIfExists)
-            throw nameExists(pkg.name);
         // The org's own skill it promoted (ruling P3-3): its new version goes to the platform row and
         // reaches every org using it (ruling P3-4); the files were written there before this
         // transaction, for the platform version current then
@@ -788,6 +766,38 @@ let SkillsService = class SkillsService {
         const platform = (await platformSummaryQuery(this.db.db).where("p.id", "in", platformIds).execute()).map((r) => ({ ...platformSummary(r), linkedIds: linked.get(r.id) ?? [] }));
         return [...own, ...platform].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : a.id < b.id ? -1 : 1);
     }
+    /**
+     * The agent's skills as the agent page lists them, by name: {@link listForAgent} (`shared:
+     * false`) plus `sharePending`, true while a share request of the skill waits for an org admin,
+     * and the org skills the agent shared (`origin_agent_id`; `scope: 'org'`, `shared: true`, same
+     * id as before sharing): the agent keeps them without selecting them.
+     */
+    async listOwnForAgent(orgId, agentId) {
+        const [skills, shared] = await Promise.all([
+            this.listForAgent(orgId, agentId),
+            summaryQuery(this.db.db)
+                .where("s.org_id", "=", orgId)
+                .where("s.scope", "=", "org")
+                .where("s.origin_agent_id", "=", agentId)
+                .where("s.deleted_at", "is", null)
+                .execute(),
+        ]);
+        const pending = skills.length === 0
+            ? []
+            : await this.db
+                .selectFrom("skill_change_requests")
+                .select("skill_id")
+                .where("org_id", "=", orgId)
+                .where("kind", "=", "share")
+                .where("status", "=", "pending")
+                .where("skill_id", "in", skills.map((s) => s.id))
+                .execute();
+        const ids = new Set(pending.map((r) => r.skill_id));
+        return [
+            ...skills.map((s) => ({ ...s, sharePending: ids.has(s.id), shared: false })),
+            ...shared.map((r) => ({ ...summary(r), sharePending: false, shared: true })),
+        ].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : a.id < b.id ? -1 : 1));
+    }
     /** 对该 agent 自动生效的技能（`scope=agent`、未删除），按名字排序。 */
     async listForAgent(orgId, agentId) {
         const rows = await summaryQuery(this.db.db)
@@ -924,7 +934,9 @@ let SkillsService = class SkillsService {
     /**
      * In the caller's transaction (`mandatory`: the caller holds the org row lock and checked
      * `skills.manage`), soft-deletes an org-scope skill of the org: what {@link softDelete} writes
-     * (audit `skill.deleted`); missing or deleted -> `skill.not_found`. The owner delete of a
+     * (audit `skill.deleted`); missing or deleted -> `skill.not_found`. Its pending version
+     * proposals are cancelled in the same transaction (trials reverted; drafts deleted and events
+     * published after the commit). The owner delete of a
      * promoted skill (`OwnedItems.deleteSkill`) calls it after its platform row was dealt with.
      */
     async deleteOrgSkillIn(orgId, skillId, actorAccountId, actorTokenId, auditDetail) {
@@ -939,6 +951,26 @@ let SkillsService = class SkillsService {
             .executeTakeFirst();
         if (!r)
             throw notFound();
+        // its pending version proposals go with it: cancelled, their trials reverted; after the
+        // commit the events are published and the drafts deleted (a share request has no draft)
+        const pending = await this.db
+            .selectFrom("skill_change_requests")
+            .selectAll()
+            .where("org_id", "=", orgId)
+            .where("skill_id", "=", skillId)
+            .where("kind", "=", "version")
+            .where("status", "=", "pending")
+            .orderBy("created_at")
+            .forUpdate()
+            .execute();
+        const cancelled = { prefixes: [], seqs: [] };
+        for (const p of pending) {
+            await cancelRequestIn(this.catalogDeps, p, cancelled, {
+                actorAccountId,
+                ...(actorTokenId !== undefined && { actorTokenId }),
+                reason: "skill_deleted",
+            });
+        }
         await audit(this.db.db, {
             actorAccountId,
             ...(actorTokenId !== undefined && { actorTokenId }),
@@ -947,6 +979,20 @@ let SkillsService = class SkillsService {
             target: skillId,
             detail: { name: r.name, ...auditDetail },
         });
+        if (pending.length > 0) {
+            afterCommit(async () => {
+                for (const [conv, seq] of cancelled.seqs)
+                    await this.eventLog.notify(conv, seq);
+                for (const prefix of cancelled.prefixes) {
+                    try {
+                        await this.storage.kernel(orgId).deletePrefix(prefix);
+                    }
+                    catch (err) {
+                        this.log.warn("skill draft cleanup failed", { orgId, prefix, err });
+                    }
+                }
+            });
+        }
     }
 };
 __decorate([
@@ -974,7 +1020,9 @@ SkillsService = __decorate([
     __param(2, Inject(AttachmentsService)),
     __param(3, Inject(TransactionHost)),
     __param(4, Inject(OrgLock)),
-    __param(5, Inject(PlatformComponents))
+    __param(5, Inject(PlatformComponents)),
+    __param(6, Inject(EventLog)),
+    __param(7, Inject(KERNEL_LOGGER))
 ], SkillsService);
 export { SkillsService };
 /**

package/dist/skills/usable.d.ts

@@ -59,9 +59,10 @@ export declare function pinnedSkillLinksServed(db: KernelSchemaDb, orgId: string
  */
 export declare function skillVersionsById(db: KernelSchemaDb, orgId: string, ids: readonly string[], log?: Pick<Logger, "warn">): Promise<Map<string, SkillVersionRow>>;
 /**
- * The skills an agent selects, sorted by id: its own skills (`scope = 'agent'`) and the ids of
- * `orgSkills` that resolve ({@link skillVersionsById}: org skills, linked copies, platform skills
- * on in the org). Not deduplicated by name.
+ * The skills an agent selects, sorted by id: its own skills (`scope = 'agent'`), the org skills
+ * it shared (`origin_agent_id`: the agent keeps a shared skill without a definition change) and
+ * the ids of `orgSkills` that resolve ({@link skillVersionsById}: org skills, linked copies,
+ * platform skills on in the org). Not deduplicated by name.
  */
 export declare function selectedSkills(db: KernelSchemaDb, a: {
     orgId: string;

package/dist/skills/usable.js

@@ -285,9 +285,10 @@ async function ownedPlatformIds(db, orgId, platformIds) {
     return new Set(rows.map((r) => r.id));
 }
 /**
- * The skills an agent selects, sorted by id: its own skills (`scope = 'agent'`) and the ids of
- * `orgSkills` that resolve ({@link skillVersionsById}: org skills, linked copies, platform skills
- * on in the org). Not deduplicated by name.
+ * The skills an agent selects, sorted by id: its own skills (`scope = 'agent'`), the org skills
+ * it shared (`origin_agent_id`: the agent keeps a shared skill without a definition change) and
+ * the ids of `orgSkills` that resolve ({@link skillVersionsById}: org skills, linked copies,
+ * platform skills on in the org). Not deduplicated by name.
  */
 export async function selectedSkills(db, a, log) {
     const agentOwn = await db
@@ -298,7 +299,15 @@ export async function selectedSkills(db, a, log) {
         .where("agent_id", "=", a.agentId)
         .where("deleted_at", "is", null)
         .execute();
-    const orgSkills = new Set(a.orgSkills);
+    const shared = await db
+        .selectFrom("skills")
+        .select("id")
+        .where("org_id", "=", a.orgId)
+        .where("scope", "=", "org")
+        .where("origin_agent_id", "=", a.agentId)
+        .where("deleted_at", "is", null)
+        .execute();
+    const orgSkills = new Set([...a.orgSkills, ...shared.map((r) => r.id)]);
     const byId = await skillVersionsById(db, a.orgId, [...agentOwn.map((r) => r.id), ...orgSkills], log);
     return [...byId.values()]
         .filter((r) => (r.scope === "agent" ? r.agentId === a.agentId : orgSkills.has(r.id)))

package/dist/tools/admin-connectors.d.ts

@@ -0,0 +1,69 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import type { ToolPolicy } from "./registry.js";
+/** One connector in the super admin's cross-org list (no endpoint, auth or credential). */
+export interface AdminConnectorRow {
+    id: string;
+    orgId: string;
+    orgName: string;
+    name: string;
+    slug: string;
+    /** The connector extension (e.g. `mcp`, `openapi`). */
+    connector: string;
+    status: "active" | "disabled";
+    platformTemplateId: string | null;
+    /** The platform connector template's name (its template id in the plugin), when it exists. */
+    templateName: string | null;
+    catalogItemId: string | null;
+    /** Counts every tool row of the connector, pending and missing ones included. */
+    toolCount: number;
+    toolsSyncedAt: Date | null;
+    createdBy: string;
+    createdByName: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * The super admin's read-only connector detail. Never a credential, token or secret value, and
+ * not whether any member has a credential: `auth` is the type and ownership only.
+ */
+export interface AdminConnectorDetail extends AdminConnectorRow {
+    /** Through {@link endpointView}: large text fields as their size and sha256 only. */
+    endpoint: unknown;
+    auth: {
+        type: string;
+        ownership: "org" | "personal" | null;
+    };
+    tools: {
+        name: string;
+        title: string | null;
+        status: "enabled" | "disabled" | "pending_review";
+        defaultPolicy: ToolPolicy;
+    }[];
+}
+export interface AdminConnectorQuery {
+    orgId?: string | undefined;
+    status?: "active" | "disabled" | undefined;
+    /** A case-insensitive substring of the connector name. */
+    q?: string | undefined;
+    /** The last id of the previous page. */
+    after?: string | undefined;
+    limit: number;
+}
+/**
+ * Cross-org reads of connectors for the super admin (spec
+ * 2026-11-10-admin-agents-connectors-design.md §3.4, §3.5). Only live connectors of live orgs;
+ * the caller checks the super admin.
+ */
+export declare class AdminConnectors {
+    private readonly kdb;
+    constructor(kdb: KernelDb);
+    private get db();
+    private base;
+    /** Live connectors of every live org by id, filtered; `next` is the last id when more follow. */
+    list(q: AdminConnectorQuery): Promise<{
+        connectors: AdminConnectorRow[];
+        next: string | null;
+    }>;
+    /** One live connector of a live org; else `connector.not_found`. */
+    get(connectorId: string): Promise<AdminConnectorDetail>;
+}

package/dist/tools/admin-connectors.js

@@ -0,0 +1,135 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { endpointView } from "./endpoint.js";
+const notFound = () => new ApiError("connector.not_found", "Connector not found");
+/**
+ * Cross-org reads of connectors for the super admin (spec
+ * 2026-11-10-admin-agents-connectors-design.md §3.4, §3.5). Only live connectors of live orgs;
+ * the caller checks the super admin.
+ */
+let AdminConnectors = class AdminConnectors {
+    kdb;
+    constructor(kdb) {
+        this.kdb = kdb;
+    }
+    get db() {
+        return this.kdb.db;
+    }
+    base() {
+        return this.db
+            .selectFrom("connectors as c")
+            .innerJoin("orgs as o", "o.id", "c.org_id")
+            .innerJoin("accounts as a", "a.id", "c.created_by")
+            .leftJoin("platform_connector_templates as pt", "pt.id", "c.platform_template_id")
+            .select([
+            "c.id",
+            "c.org_id",
+            "o.name as org_name",
+            "c.name",
+            "c.slug",
+            "c.connector",
+            "c.status",
+            "c.platform_template_id",
+            "pt.template_id as template_name",
+            "c.catalog_item_id",
+            "c.tools_synced_at",
+            "c.created_by",
+            "a.display_name as created_by_name",
+            "c.created_at",
+            "c.updated_at",
+            sql `(SELECT count(*)::int FROM capybara.connector_tools t
+          WHERE t.connector_id = c.id)`.as("tool_count"),
+        ])
+            .where("c.deleted_at", "is", null)
+            .where("o.deleted_at", "is", null);
+    }
+    /** Live connectors of every live org by id, filtered; `next` is the last id when more follow. */
+    async list(q) {
+        let query = this.base();
+        if (q.orgId !== undefined)
+            query = query.where("c.org_id", "=", q.orgId);
+        if (q.status !== undefined)
+            query = query.where("c.status", "=", q.status);
+        if (q.q !== undefined && q.q !== "") {
+            const like = `%${q.q.replace(/[\\%_]/g, (ch) => `\\${ch}`)}%`;
+            query = query.where(sql `c.name ILIKE ${like} ESCAPE '\\'`);
+        }
+        if (q.after !== undefined)
+            query = query.where("c.id", ">", q.after);
+        const rows = await query
+            .orderBy("c.id")
+            .limit(q.limit + 1)
+            .execute();
+        const page = rows.slice(0, q.limit).map(toRow);
+        return {
+            connectors: page,
+            next: rows.length > q.limit ? (page[page.length - 1]?.id ?? null) : null,
+        };
+    }
+    /** One live connector of a live org; else `connector.not_found`. */
+    async get(connectorId) {
+        const r = await this.base()
+            .select(["c.endpoint", "c.auth"])
+            .where("c.id", "=", connectorId)
+            .executeTakeFirst();
+        if (!r)
+            throw notFound();
+        const tools = await this.db
+            .selectFrom("connector_tools")
+            .select(["name", "spec", "status", "default_policy"])
+            .where("connector_id", "=", connectorId)
+            .orderBy("name")
+            .execute();
+        const auth = r.auth;
+        return {
+            ...toRow(r),
+            endpoint: endpointView(r.endpoint),
+            auth: { type: auth.type, ownership: auth.type === "none" ? null : auth.ownership },
+            tools: tools.map((t) => {
+                const title = t.spec.title;
+                return {
+                    name: t.name,
+                    title: typeof title === "string" ? title : null,
+                    status: t.status,
+                    defaultPolicy: t.default_policy,
+                };
+            }),
+        };
+    }
+};
+AdminConnectors = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb))
+], AdminConnectors);
+export { AdminConnectors };
+function toRow(r) {
+    return {
+        id: r.id,
+        orgId: r.org_id,
+        orgName: r.org_name,
+        name: r.name,
+        slug: r.slug,
+        connector: r.connector,
+        status: r.status,
+        platformTemplateId: r.platform_template_id ?? null,
+        templateName: r.template_name ?? null,
+        catalogItemId: r.catalog_item_id ?? null,
+        toolCount: r.tool_count,
+        toolsSyncedAt: r.tools_synced_at,
+        createdBy: r.created_by,
+        createdByName: r.created_by_name,
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+    };
+}

package/dist/tools/builtin-names.d.ts

@@ -15,7 +15,6 @@ export declare const BUILTIN: {
     readonly Grep: "Grep";
     readonly Deliver: "Deliver";
     readonly Skill: "Skill";
-    readonly SkillWrite: "SkillWrite";
     readonly AskUserQuestion: "AskUserQuestion";
     readonly ReadToolOutput: "ReadToolOutput";
     readonly ToolSearch: "ToolSearch";
@@ -58,6 +57,13 @@ export declare const SANDBOX_ASK_TOOL_NAMES: ReadonlySet<string>;
  * `CurrentTime` reads the clock (the run context carries only the date).
  */
 export declare const BUILTIN_TOOL_NAMES: readonly BuiltinName[];
+/**
+ * Is `key` a builtin-shaped key (a bare name, no `mcp__` / `plugin__` prefix) that names no
+ * builtin the kernel has now, e.g. the removed `SkillWrite`? Saving an agent or an org template
+ * drops such a `toolPolicies` key instead of refusing the save: a stored definition may still
+ * carry it, and the web sends the whole definition back.
+ */
+export declare function isRemovedBuiltinKey(key: string): boolean;
 /** The builtin that loads a skill (added by the registry when the log has a skills catalog). */
 export declare const SKILL_LOAD: "Skill";
 /** The builtin that searches the tool catalog (added by the registry by org setting and threshold). */
@@ -74,23 +80,12 @@ export declare const SUBAGENT_HANDBACK: "SubagentHandback";
  * `SubagentHandback` to a sub-agent. A definition's ref to either is ignored.
  */
 export declare const SUBAGENT_MESSAGE_TOOLS: ReadonlySet<string>;
-/**
- * Tool keys on the spec 3.6 R3 fixed list ("allowed is not confirmed"): their policy is at least
- * `ask` and remembered grants never let them through. `SkillWrite` changes shared skills.
- * Connector and extension tools express the same rule with `annotations.requiresUserInteraction`.
- */
-export declare const R3_FIXED_ASK_TOOL_KEYS: ReadonlySet<string>;
-/**
- * R3 keys that apply only to shared agents: a private agent's skills are not shared, so its
- * `SkillWrite` takes effect without asking (R4).
- */
-export declare const R3_SHARED_AGENT_ONLY_TOOL_KEYS: ReadonlySet<string>;
 /**
  * Tools a sub-agent never gets (sub-agents spec §5.3, §5.5): `AskUserQuestion` (the person does
- * not see the child), `Deliver` (delivering files is the parent's job) and `SkillWrite`. `Agent`
+ * not see the child) and `Deliver` (delivering files is the parent's job). `Agent`
  * is removed only from a child at `subagents.maxDepth` (agent map spec §4.1, `effectiveDefinition`).
  */
-export declare const CHILD_REMOVED_TOOLS: readonly ["AskUserQuestion", "Deliver", "SkillWrite"];
+export declare const CHILD_REMOVED_TOOLS: readonly ["AskUserQuestion", "Deliver"];
 /**
  * The builtins every agent has unless it turns them off (tools default-on spec §4), in this
  * order: {@link BUILTIN_TOOL_NAMES} without the ones the registry manages by rule (`ToolSearch`,

package/dist/tools/builtin-names.js

@@ -1,3 +1,4 @@
+import { parseToolKey } from "@capybara-hq/plugin-sdk";
 /**
  * The names (model-visible keys) of the kernel's builtin tools, following Claude Code (tool naming
  * spec §4.1). Plain constants: `BuiltinTools`, the tool factories, the registry, policy and the
@@ -14,7 +15,6 @@ export const BUILTIN = {
     Grep: "Grep",
     Deliver: "Deliver",
     Skill: "Skill",
-    SkillWrite: "SkillWrite",
     AskUserQuestion: "AskUserQuestion",
     ReadToolOutput: "ReadToolOutput",
     ToolSearch: "ToolSearch",
@@ -75,7 +75,6 @@ export const BUILTIN_TOOL_NAMES = [
     BUILTIN.ReadToolOutput,
     BUILTIN.ToolSearch,
     BUILTIN.Skill,
-    BUILTIN.SkillWrite,
     ...SANDBOX_TOOL_NAMES,
     BUILTIN.Agent,
     BUILTIN.SendMessage,
@@ -84,6 +83,16 @@ export const BUILTIN_TOOL_NAMES = [
     BUILTIN.Platform,
     BUILTIN.CurrentTime,
 ];
+const BUILTIN_NAME_SET = new Set(Object.values(BUILTIN));
+/**
+ * Is `key` a builtin-shaped key (a bare name, no `mcp__` / `plugin__` prefix) that names no
+ * builtin the kernel has now, e.g. the removed `SkillWrite`? Saving an agent or an org template
+ * drops such a `toolPolicies` key instead of refusing the save: a stored definition may still
+ * carry it, and the web sends the whole definition back.
+ */
+export function isRemovedBuiltinKey(key) {
+    return parseToolKey(key)?.kind === "builtin" && !BUILTIN_NAME_SET.has(key);
+}
 /** The builtin that loads a skill (added by the registry when the log has a skills catalog). */
 export const SKILL_LOAD = BUILTIN.Skill;
 /** The builtin that searches the tool catalog (added by the registry by org setting and threshold). */
@@ -103,29 +112,12 @@ export const SUBAGENT_MESSAGE_TOOLS = new Set([
     SEND_MESSAGE,
     SUBAGENT_HANDBACK,
 ]);
-/**
- * Tool keys on the spec 3.6 R3 fixed list ("allowed is not confirmed"): their policy is at least
- * `ask` and remembered grants never let them through. `SkillWrite` changes shared skills.
- * Connector and extension tools express the same rule with `annotations.requiresUserInteraction`.
- */
-export const R3_FIXED_ASK_TOOL_KEYS = new Set([BUILTIN.SkillWrite]);
-/**
- * R3 keys that apply only to shared agents: a private agent's skills are not shared, so its
- * `SkillWrite` takes effect without asking (R4).
- */
-export const R3_SHARED_AGENT_ONLY_TOOL_KEYS = new Set([
-    BUILTIN.SkillWrite,
-]);
 /**
  * Tools a sub-agent never gets (sub-agents spec §5.3, §5.5): `AskUserQuestion` (the person does
- * not see the child), `Deliver` (delivering files is the parent's job) and `SkillWrite`. `Agent`
+ * not see the child) and `Deliver` (delivering files is the parent's job). `Agent`
  * is removed only from a child at `subagents.maxDepth` (agent map spec §4.1, `effectiveDefinition`).
  */
-export const CHILD_REMOVED_TOOLS = [
-    BUILTIN.AskUserQuestion,
-    BUILTIN.Deliver,
-    BUILTIN.SkillWrite,
-];
+export const CHILD_REMOVED_TOOLS = [BUILTIN.AskUserQuestion, BUILTIN.Deliver];
 /**
  * The builtins every agent has unless it turns them off (tools default-on spec §4), in this
  * order: {@link BUILTIN_TOOL_NAMES} without the ones the registry manages by rule (`ToolSearch`,
@@ -150,7 +142,6 @@ export const BUILTIN_TOOL_KINDS = {
     [BUILTIN.TaskStop]: "command",
     [BUILTIN.ToolSearch]: "meta",
     [BUILTIN.Skill]: "meta",
-    [BUILTIN.SkillWrite]: "meta",
     [BUILTIN.ReadToolOutput]: "meta",
     [BUILTIN.AskUserQuestion]: "meta",
     [BUILTIN.SendMessage]: "meta",

package/dist/tools/builtins/builtin-tools.d.ts

@@ -16,7 +16,6 @@ import type { HookRunner } from "../../runtime/hook-calls.js";
 import { StepLog } from "../../runtime/step-log.js";
 import { UsageReporter } from "../../runtime/usage-report.js";
 import { SandboxService } from "../../sandbox/sandbox.service.js";
-import { SkillChangesService } from "../../skills/changes.service.js";
 import { StorageService } from "../../storage/storage.service.js";
 import { ToolOutputs } from "../outputs.js";
 import type { BuiltinTool } from "../registry.js";
@@ -25,11 +24,11 @@ import { WebPages } from "./web/index.js";
  * The kernel's builtin tools, built once from the injected services (their specs: names,
  * descriptions and schemas, are the factories' own and unchanged). `ToolSearch` and `Skill`
  * are added to a run by the registry (`forAgent`: organization setting and threshold, a skills
- * catalog snapshot), not by agent definitions; `SkillWrite` only when a definition names it.
+ * catalog snapshot), not by agent definitions.
  */
 export declare class BuiltinTools {
     private readonly tools;
-    constructor(db: KernelDb, config: KernelConfigService, outputs: ToolOutputs, storage: StorageService, skillChanges: SkillChangesService, attachments: AttachmentsService, eventLog: EventLog, sandbox: SandboxService, devices: ConversationDevices, points: ExtensionPointDefaults, webPages: WebPages, 
+    constructor(db: KernelDb, config: KernelConfigService, outputs: ToolOutputs, storage: StorageService, attachments: AttachmentsService, eventLog: EventLog, sandbox: SandboxService, devices: ConversationDevices, points: ExtensionPointDefaults, webPages: WebPages, 
     /** The WebFetch extraction call: the `web_fetch` purpose, its hooks, usage and denials. */
     purposes: ModelPurposesService, host: {
         readonly hooks?: HookRunner;