@capybara-hq/kernel 0.1.0-rc.19 → 0.1.0-rc.20

package/dist/tools/builtins/builtin-tools.js

@@ -28,7 +28,6 @@ import { conversationTimeZone, RUN_CONTEXT_CLOCK } from "../../runtime/run-conte
 import { StepLog } from "../../runtime/step-log.js";
 import { UsageReporter } from "../../runtime/usage-report.js";
 import { SandboxService } from "../../sandbox/sandbox.service.js";
-import { SkillChangesService } from "../../skills/changes.service.js";
 import { StorageService } from "../../storage/storage.service.js";
 import { ToolOutputs } from "../outputs.js";
 import { agentTool } from "./agent.js";
@@ -40,18 +39,17 @@ import { readToolOutputTool } from "./read-tool-output.js";
 import { sandboxTools } from "./sandbox/index.js";
 import { sendMessageTool } from "./send-message.js";
 import { skillLoadTool } from "./skill-load.js";
-import { skillWriteTool } from "./skill-write.js";
 import { toolSearchTool } from "./tool-search.js";
 import { extractAnswer, WebPages, webTools } from "./web/index.js";
 /**
  * The kernel's builtin tools, built once from the injected services (their specs: names,
  * descriptions and schemas, are the factories' own and unchanged). `ToolSearch` and `Skill`
  * are added to a run by the registry (`forAgent`: organization setting and threshold, a skills
- * catalog snapshot), not by agent definitions; `SkillWrite` only when a definition names it.
+ * catalog snapshot), not by agent definitions.
  */
 let BuiltinTools = class BuiltinTools {
     tools;
-    constructor(db, config, outputs, storage, skillChanges, attachments, eventLog, sandbox, devices, points, webPages, 
+    constructor(db, config, outputs, storage, attachments, eventLog, sandbox, devices, points, webPages, 
     /** The WebFetch extraction call: the `web_fetch` purpose, its hooks, usage and denials. */
     purposes, host, usageReport, stepLog, log, background, finisher, stopper, platformOps, platformActor, agentDocs, 
     /** The clock `CurrentTime` reads (the run context's clock seam; `Date.now` by default). */
@@ -91,8 +89,6 @@ let BuiltinTools = class BuiltinTools {
                     return db.db;
                 },
             }),
-            // 自写技能：agent 定义显式引用才可用
-            skillWriteTool({ changes: skillChanges }),
             // web search / fetch through the org's default provider (web tools spec §3); WebFetch answers
             // from the page with one call on the `web_fetch` purpose (§5), never returning the page
             ...webTools({
@@ -127,25 +123,24 @@ BuiltinTools = __decorate([
     __param(1, Inject(KernelConfigService)),
     __param(2, Inject(ToolOutputs)),
     __param(3, Inject(StorageService)),
-    __param(4, Inject(SkillChangesService)),
-    __param(5, Inject(AttachmentsService)),
-    __param(6, Inject(EventLog)),
-    __param(7, Inject(SandboxService)),
-    __param(8, Inject(ConversationDevices)),
-    __param(9, Inject(ExtensionPointDefaults)),
-    __param(10, Inject(WebPages)),
-    __param(11, Inject(ModelPurposesService)),
-    __param(12, Inject(ExtensionHost)),
-    __param(13, Inject(UsageReporter)),
-    __param(14, Inject(StepLog)),
-    __param(15, Inject(KERNEL_LOGGER)),
-    __param(16, Inject(BackgroundTaskStore)),
-    __param(17, Inject(BackgroundTaskFinisher)),
-    __param(18, Inject(BackgroundTaskStopper)),
-    __param(19, Inject(PlatformOperations)),
-    __param(20, Inject(PlatformActor)),
-    __param(21, Inject(AgentDocs)),
-    __param(22, Optional()),
-    __param(22, Inject(RUN_CONTEXT_CLOCK))
+    __param(4, Inject(AttachmentsService)),
+    __param(5, Inject(EventLog)),
+    __param(6, Inject(SandboxService)),
+    __param(7, Inject(ConversationDevices)),
+    __param(8, Inject(ExtensionPointDefaults)),
+    __param(9, Inject(WebPages)),
+    __param(10, Inject(ModelPurposesService)),
+    __param(11, Inject(ExtensionHost)),
+    __param(12, Inject(UsageReporter)),
+    __param(13, Inject(StepLog)),
+    __param(14, Inject(KERNEL_LOGGER)),
+    __param(15, Inject(BackgroundTaskStore)),
+    __param(16, Inject(BackgroundTaskFinisher)),
+    __param(17, Inject(BackgroundTaskStopper)),
+    __param(18, Inject(PlatformOperations)),
+    __param(19, Inject(PlatformActor)),
+    __param(20, Inject(AgentDocs)),
+    __param(21, Optional()),
+    __param(21, Inject(RUN_CONTEXT_CLOCK))
 ], BuiltinTools);
 export { BuiltinTools };

package/dist/tools/builtins/sandbox/bash.js

@@ -282,13 +282,13 @@ async function runInBackground(deps, ctx, input) {
             await announce();
             if (!isLarge || e instanceof ToolError)
                 throw e;
-            throw new ToolError(`The background task was not started: ${clip(why, 500).replace(/\.$/, "")}. Check the sandbox, or call Bash without run_in_background.${largeText()}`);
+            throw new ToolError(`The background task was not started: ${clip(why, 500).replace(/\.$/, "")}. Check the environment, or call Bash without run_in_background.${largeText()}`);
         }
     }
     if (launch.kind === "not_started") {
         await background.failLaunch(id, launch.why);
         await announce();
-        throw new ToolError(`The background task was not started: ${launch.why}. Check the sandbox, or call Bash without run_in_background.${largeText()}`);
+        throw new ToolError(`The background task was not started: ${launch.why}. Check the environment, or call Bash without run_in_background.${largeText()}`);
     }
     if (launch.kind === "stopped") {
         await announce();

package/dist/tools/builtins/skill-load.js

@@ -220,6 +220,7 @@ export async function findSkillVersion(db, ctx, entry) {
         .where("org_id", "=", ctx.orgId)
         .where("requested_in_conversation", "=", ctx.conversationId)
         .where("status", "=", "pending")
+        .where("kind", "=", "version")
         .where("object_prefix", "=", entry.source)
         .where(sql `proposed_version ->> 'skillId'`, "=", entry.id)
         .executeTakeFirst();

package/dist/tools/connectors.controller.d.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 import type { ConnectionGuideState } from "../extensions/plugin-guides.js";
 import { PluginIcons } from "../extensions/plugin-icons.js";
 import { type Principal } from "../identity/principal.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { type OrgContext } from "../orgs/org.guard.js";
 import { ConnectorAccountPolicies, type MemberToolPolicyView } from "./connector-account-policies.js";
 import { ConnectorGuideAckSchema, CredentialValue, MemberToolPoliciesBody } from "./connectors.schemas.js";
@@ -177,6 +178,8 @@ declare const UpdateBody: z.ZodObject<{
  */
 export type ConnectorPage<T extends ConnectorSummary = ConnectorDetail> = T & ConnectionGuideState & {
     icon: string | null;
+    /** The one-connector read of an `oauth_code` connector, for managers: its redirect URI. */
+    oauthCallbackUrl?: string | null;
 };
 /**
  * 连接器（`/api/v1/orgs/:orgId/connectors`）：读与个人凭据用 `connectors.use`（访客起），安装 / 修改 / 删除 / 刷新 /
@@ -186,7 +189,8 @@ export declare class ConnectorsController {
     private readonly connectors;
     private readonly icons;
     private readonly memberPolicies;
-    constructor(connectors: ConnectorsService, icons: PluginIcons, memberPolicies: ConnectorAccountPolicies);
+    private readonly config;
+    constructor(connectors: ConnectorsService, icons: PluginIcons, memberPolicies: ConnectorAccountPolicies, config: Pick<KernelConfigService, "get">);
     /**
      * Each connector with `icon`: the icon of the plugin its template came from, on the org's catalog
      * route (null for a custom connector, a plugin without an icon, or one the reader's catalog does

package/dist/tools/connectors.controller.js

@@ -12,6 +12,7 @@ import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post, Put } fr
 import { z } from "zod";
 import { orgIconScope, PluginIcons } from "../extensions/plugin-icons.js";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
@@ -20,6 +21,7 @@ import { ConnectorAccountPolicies, } from "./connector-account-policies.js";
 import { ConnectorGuideAckSchema, CredentialValue, MemberToolPoliciesBody, } from "./connectors.schemas.js";
 import { ConnectorsService, } from "./connectors.service.js";
 import { publicEndpoint } from "./endpoint.js";
+import { callbackUrl } from "./oauth/flow-paths.js";
 /**
  * 没有 `connectors.manage` 的读者只看到端点的公开部分（URL 不带 query、只有头名，见 endpoint.ts），
  * 也看不到工具的连接器数据（可能含服务器地址）。
@@ -98,10 +100,12 @@ let ConnectorsController = class ConnectorsController {
     connectors;
     icons;
     memberPolicies;
-    constructor(connectors, icons, memberPolicies) {
+    config;
+    constructor(connectors, icons, memberPolicies, config) {
         this.connectors = connectors;
         this.icons = icons;
         this.memberPolicies = memberPolicies;
+        this.config = config;
     }
     /**
      * Each connector with `icon`: the icon of the plugin its template came from, on the org's catalog
@@ -157,7 +161,16 @@ let ConnectorsController = class ConnectorsController {
     async get(principal, org, connectorId) {
         const p = requireUser(principal);
         const view = forViewer(org, await this.connectors.get(org.orgId, connectorId, p.account.id));
-        return { connector: await this.withGuide(org, view) };
+        const page = await this.withGuide(org, view);
+        // The redirect URI to register at the authorization server, for those who manage connectors
+        // (the credentials tab shows it next to the OAuth client); null without `http.publicUrl`.
+        if (page.auth.type !== "oauth_code" || !can(org.role, "connectors.manage")) {
+            return { connector: page };
+        }
+        const publicUrl = this.config.get().http.publicUrl;
+        return {
+            connector: { ...page, oauthCallbackUrl: publicUrl ? callbackUrl(publicUrl) : null },
+        };
     }
     async update(principal, org, connectorId, body) {
         const p = requireUser(principal);
@@ -343,6 +356,7 @@ ConnectorsController = __decorate([
     Controller("api/v1/orgs/:orgId/connectors"),
     __param(0, Inject(ConnectorsService)),
     __param(1, Inject(PluginIcons)),
-    __param(2, Inject(ConnectorAccountPolicies))
+    __param(2, Inject(ConnectorAccountPolicies)),
+    __param(3, Inject(KernelConfigService))
 ], ConnectorsController);
 export { ConnectorsController };

package/dist/tools/connectors.service.d.ts

@@ -1,6 +1,7 @@
 import { type AuthHint, type ConnectorOperation, type ToolAnnotations } from "@capybara-hq/plugin-sdk";
 import { type ConnectionGuideState, PluginGuides } from "../extensions/plugin-guides.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
+import type { WriteActor } from "../identity/write-actor.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -220,7 +221,7 @@ export declare class ConnectorsService {
     /** Extension manifests (a slug may not take an extension's name). */
     extensions: Pick<ExtensionRegistry, "manifests">, credentials: Credentials, config: Pick<KernelConfigService, "get">, drift: ToolDrift, 
     /** The org row lock (orgs/org-lock.ts): joins the caller's transaction. */
-    orgLock: Pick<OrgLock, "lockAndAuthorize">, txHost: TransactionHost, 
+    orgLock: Pick<OrgLock, "lock" | "lockAndAuthorize">, txHost: TransactionHost, 
     /** Setup guides of connector templates (spec 2026-11-09-setup-guides-v2-design.md §11). */
     guides: Pick<PluginGuides, "templateAck" | "connectorStates">);
     /** The kernel-schema handle of the current context (its transaction, else the pool). */
@@ -338,6 +339,24 @@ export declare class ConnectorsService {
     get(orgId: string, connectorId: string, viewerAccountId: string): Promise<ConnectorDetail>;
     /** 改名、启停连接器、工具启停与默认策略、批量把无注解工具改为 allow（`connectors.manage`）。 */
     update(orgId: string, connectorId: string, actorAccountId: string, patch: UpdateConnectorInput, actorTokenId?: string): Promise<ConnectorDetail>;
+    /**
+     * The org id of a live connector of a live org (the platform paths address a connector by its
+     * global id); else `connector.not_found`.
+     */
+    private liveOrgOf;
+    /**
+     * Disables or enables a connector on the platform's behalf (a super admin who need not be a
+     * member of the org; the caller checks the super admin): org row lock, the status update, audit
+     * `connector.updated` with `via: "platform"`. `auditDetail` (a Platform tool write's
+     * `viaAgent`) is merged into the detail; `via` stays `"platform"`.
+     */
+    setStatusAsPlatform(connectorId: string, status: "active" | "disabled", actor: WriteActor, auditDetail?: Record<string, unknown>): Promise<void>;
+    /**
+     * Deletes a connector on the platform's behalf (see {@link setStatusAsPlatform}): org row lock,
+     * then {@link removeIn} with `via: "platform"` in the audit detail (merged over `auditDetail`,
+     * a Platform tool write's `viaAgent`).
+     */
+    removeAsPlatform(connectorId: string, actor: WriteActor, auditDetail?: Record<string, unknown>): Promise<void>;
     /** 软删除，并删除该连接器的全部凭据（`connectors.manage`）。 */
     remove(orgId: string, connectorId: string, actorAccountId: string, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<void>;
     /**

package/dist/tools/connectors.service.js

@@ -1051,6 +1051,61 @@ let ConnectorsService = class ConnectorsService {
         });
         return this.detail(t, orgId, connectorId, actorAccountId);
     }
+    /**
+     * The org id of a live connector of a live org (the platform paths address a connector by its
+     * global id); else `connector.not_found`.
+     */
+    async liveOrgOf(connectorId) {
+        const r = await this.db
+            .selectFrom("connectors as c")
+            .innerJoin("orgs as o", "o.id", "c.org_id")
+            .select("c.org_id")
+            .where("c.id", "=", connectorId)
+            .where("c.deleted_at", "is", null)
+            .where("o.deleted_at", "is", null)
+            .executeTakeFirst();
+        if (!r)
+            throw notFound();
+        return r.org_id;
+    }
+    /**
+     * Disables or enables a connector on the platform's behalf (a super admin who need not be a
+     * member of the org; the caller checks the super admin): org row lock, the status update, audit
+     * `connector.updated` with `via: "platform"`. `auditDetail` (a Platform tool write's
+     * `viaAgent`) is merged into the detail; `via` stays `"platform"`.
+     */
+    async setStatusAsPlatform(connectorId, status, actor, auditDetail) {
+        const t = this.db;
+        const orgId = await this.liveOrgOf(connectorId);
+        await this.orgLock.lock(orgId);
+        const app = await this.row(t, orgId, connectorId, true);
+        await t
+            .updateTable("connectors")
+            .set({ status, updated_at: sql `now()` })
+            .where("id", "=", connectorId)
+            .execute();
+        await audit(t, {
+            actorAccountId: actor.accountId,
+            ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
+            orgId,
+            action: "connector.updated",
+            target: connectorId,
+            detail: { ...auditDetail, status: { from: app.status, to: status }, via: "platform" },
+        });
+    }
+    /**
+     * Deletes a connector on the platform's behalf (see {@link setStatusAsPlatform}): org row lock,
+     * then {@link removeIn} with `via: "platform"` in the audit detail (merged over `auditDetail`,
+     * a Platform tool write's `viaAgent`).
+     */
+    async removeAsPlatform(connectorId, actor, auditDetail) {
+        const orgId = await this.liveOrgOf(connectorId);
+        await this.orgLock.lock(orgId);
+        await this.removeIn(orgId, connectorId, actor.accountId, actor.tokenId, undefined, {
+            ...auditDetail,
+            via: "platform",
+        });
+    }
     /** 软删除，并删除该连接器的全部凭据（`connectors.manage`）。 */
     async remove(orgId, connectorId, actorAccountId, actorTokenId, auditDetail) {
         await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "connectors.manage");
@@ -1333,6 +1388,12 @@ __decorate([
 __decorate([
     Transactional()
 ], ConnectorsService.prototype, "update", null);
+__decorate([
+    Transactional()
+], ConnectorsService.prototype, "setStatusAsPlatform", null);
+__decorate([
+    Transactional()
+], ConnectorsService.prototype, "removeAsPlatform", null);
 __decorate([
     Transactional()
 ], ConnectorsService.prototype, "remove", null);

package/dist/tools/legacy-keys.js

@@ -20,7 +20,6 @@ export const LEGACY_BUILTINS = Object.freeze({
     sandbox_grep: { name: BUILTIN.Grep, params: { ignoreCase: "-i" } },
     sandbox_deliver: { name: BUILTIN.Deliver, params: { path: "file_path" } },
     skill_load: { name: BUILTIN.Skill, params: { name: "skill" } },
-    skill_write: { name: BUILTIN.SkillWrite, params: {} },
     ask_user: { name: BUILTIN.AskUserQuestion, params: {} },
     read_tool_output: { name: BUILTIN.ReadToolOutput, params: {} },
     tool_search: { name: BUILTIN.ToolSearch, params: { limit: "max_results" } },

package/dist/tools/org-tool-switches.d.ts

@@ -39,7 +39,7 @@ export declare class OrgToolSwitches {
     private readonly host;
     /** The org row lock: re-checks `org.extensions.manage` under the lock. */
     private readonly orgLock;
-    constructor(kdb: KernelDb, txHost: TransactionHost, host: Pick<ExtensionHost, "tools">, 
+    constructor(kdb: KernelDb, txHost: TransactionHost, host: Pick<ExtensionHost, "tools" | "current">, 
     /** The org row lock: re-checks `org.extensions.manage` under the lock. */
     orgLock: Pick<OrgLock, "lockAndAuthorize">);
     private get db();
@@ -47,7 +47,8 @@ export declare class OrgToolSwitches {
     private registered;
     /**
      * The tools of an extension the org sees: running here and visible under plugin scope, else 404
-     * `extension.not_found` (an invisible one is answered like an unknown one).
+     * `extension.not_found` (an invisible one is answered like an unknown one). An extension that
+     * runs but registers no tools (a channel, a model provider) answers an empty list, not 404.
      */
     private toolsFor;
     /** The stored switches of the org (all extensions, or one), `false` ones only matter. */

package/dist/tools/org-tool-switches.js

@@ -63,14 +63,14 @@ let OrgToolSwitches = class OrgToolSwitches {
     }
     /**
      * The tools of an extension the org sees: running here and visible under plugin scope, else 404
-     * `extension.not_found` (an invisible one is answered like an unknown one).
+     * `extension.not_found` (an invisible one is answered like an unknown one). An extension that
+     * runs but registers no tools (a channel, a model provider) answers an empty list, not 404.
      */
     async toolsFor(orgId, plugin) {
-        const tools = this.registered(plugin);
-        if (tools.length === 0 || !(await extensionVisibleTo(this.db, orgId, plugin))) {
+        if (!this.host.current(plugin) || !(await extensionVisibleTo(this.db, orgId, plugin))) {
             throw new ApiError("extension.not_found", `Extension ${plugin} is not installed`);
         }
-        return tools;
+        return this.registered(plugin);
     }
     /** The stored switches of the org (all extensions, or one), `false` ones only matter. */
     async offRows(orgId, plugin) {

package/dist/tools/policy.d.ts

@@ -1,7 +1,6 @@
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { DecidePolicy } from "./pipeline.js";
 import type { ResolvedTool, ToolPolicy } from "./registry.js";
-export { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS } from "./builtin-names.js";
 /** 取更严的策略（`allow < ask < deny`）。 */
 export declare function stricter(a: ToolPolicy, b: ToolPolicy | undefined): ToolPolicy;
 export interface PolicyInput {
@@ -9,22 +8,21 @@ export interface PolicyInput {
     connectorDefault: ToolPolicy;
     /** agent 负责人的收紧（`definition.toolPolicies[key]`）。 */
     agentOverride?: "ask" | "deny";
-    /** R3 清单或 `requiresUserInteraction`。 */
+    /** `requiresUserInteraction`。 */
     fixedAsk: boolean;
     /** 已记住且 specHash 与当前一致的授权。 */
     grant: "session" | "always" | null;
 }
 /**
- * 策略判定（纯函数）：取组织默认、agent 收紧、R3 固定询问三者中最严者；
- * 记住的授权只能把 `ask` 放行为 `allow`，不能越过 `deny`，对 R3 / `requiresUserInteraction` 的工具无效。
+ * 策略判定（纯函数）：取组织默认、agent 收紧、固定询问三者中最严者；
+ * 记住的授权只能把 `ask` 放行为 `allow`，不能越过 `deny`，对 `requiresUserInteraction` 的工具无效。
  */
 export declare function decide(input: PolicyInput): ToolPolicy;
 /**
- * 是否属于 R3 固定询问（清单或工具声明需要用户交互）。`visibility` 为 agent 当前的可见性：
- * {@link R3_SHARED_AGENT_ONLY_TOOL_KEYS} 里的内置工具在私有 agent 上不算固定询问，
- * 除非 agent 当前版本的 `skills.writePolicy` 为 `ask`（`skillWritePolicy`）；不知道可见性时按共享处理（更严）。
+ * Whether the tool is a fixed ask: its spec declares `requiresUserInteraction`, so its policy is
+ * at least `ask` and remembered grants never let it through.
  */
-export declare function isFixedAsk(tool: ResolvedTool, visibility?: "private" | "org" | "members" | undefined, skillWritePolicy?: "allow" | "ask" | undefined): boolean;
+export declare function isFixedAsk(tool: ResolvedTool): boolean;
 /** Which level decided a connector tool's policy ({@link connectorPolicy}). */
 export type ConnectorPolicySource = "org" | "member" | "agent";
 /**
@@ -37,7 +35,7 @@ export type ConnectorPolicySource = "org" | "member" | "agent";
  * 4. the member's own `allow` / `ask`;
  * 5. the org's default (`connector_tools.default_policy`, the annotation default unless an org
  *    admin changed it: `readOnlyHint: true` allows, anything else asks).
- * Fixed asks (R3, `requiresUserInteraction`), role escalation and grants apply after this.
+ * Fixed asks (`requiresUserInteraction`), role escalation and grants apply after this.
  */
 export declare function connectorPolicy(input: {
     orgDefault: ToolPolicy;

package/dist/tools/policy.js

@@ -1,18 +1,17 @@
 import { sql } from "kysely";
 import { roleAtLeast } from "../orgs/roles.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
-import { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS, SANDBOX_ASK_TOOL_NAMES, } from "./builtin-names.js";
+import { SANDBOX_ASK_TOOL_NAMES } from "./builtin-names.js";
 import { personalAuth } from "./connector-account-policies.js";
 import { normalizeStoredDefinitionIn } from "./legacy-data.js";
-export { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS } from "./builtin-names.js";
 const RANK = { allow: 0, ask: 1, deny: 2 };
 /** 取更严的策略（`allow < ask < deny`）。 */
 export function stricter(a, b) {
     return b !== undefined && RANK[b] > RANK[a] ? b : a;
 }
 /**
- * 策略判定（纯函数）：取组织默认、agent 收紧、R3 固定询问三者中最严者；
- * 记住的授权只能把 `ask` 放行为 `allow`，不能越过 `deny`，对 R3 / `requiresUserInteraction` 的工具无效。
+ * 策略判定（纯函数）：取组织默认、agent 收紧、固定询问三者中最严者；
+ * 记住的授权只能把 `ask` 放行为 `allow`，不能越过 `deny`，对 `requiresUserInteraction` 的工具无效。
  */
 export function decide(input) {
     let p = stricter(input.connectorDefault, input.agentOverride);
@@ -23,18 +22,11 @@ export function decide(input) {
     return p;
 }
 /**
- * 是否属于 R3 固定询问（清单或工具声明需要用户交互）。`visibility` 为 agent 当前的可见性：
- * {@link R3_SHARED_AGENT_ONLY_TOOL_KEYS} 里的内置工具在私有 agent 上不算固定询问，
- * 除非 agent 当前版本的 `skills.writePolicy` 为 `ask`（`skillWritePolicy`）；不知道可见性时按共享处理（更严）。
+ * Whether the tool is a fixed ask: its spec declares `requiresUserInteraction`, so its policy is
+ * at least `ask` and remembered grants never let it through.
  */
-export function isFixedAsk(tool, visibility, skillWritePolicy) {
-    if (tool.spec.annotations?.requiresUserInteraction === true)
-        return true;
-    if (!R3_FIXED_ASK_TOOL_KEYS.has(tool.key))
-        return false;
-    const builtinOnly = tool.source.kind === "builtin" && R3_SHARED_AGENT_ONLY_TOOL_KEYS.has(tool.key);
-    // 私有 agent：缺省 / allow 不问（R4），负责人设为 ask（D10）时与共享 agent 一样固定询问
-    return !(builtinOnly && visibility === "private" && skillWritePolicy !== "ask");
+export function isFixedAsk(tool) {
+    return tool.spec.annotations?.requiresUserInteraction === true;
 }
 const asSetting = (v) => v === "allow" || v === "ask" || v === "deny" ? v : undefined;
 /** The stricter of the settings that are set (none set: undefined). */
@@ -69,7 +61,7 @@ const tighteningOf = (s) => s === "ask" || s === "deny" ? s : undefined;
  * 4. the member's own `allow` / `ask`;
  * 5. the org's default (`connector_tools.default_policy`, the annotation default unless an org
  *    admin changed it: `readOnlyHint: true` allows, anything else asks).
- * Fixed asks (R3, `requiresUserInteraction`), role escalation and grants apply after this.
+ * Fixed asks (`requiresUserInteraction`), role escalation and grants apply after this.
  */
 export function connectorPolicy(input) {
     if (input.orgDefault === "deny")
@@ -174,7 +166,7 @@ export function createDecidePolicy(db) {
             .innerJoin("agent_versions", (j) => j
             .onRef("agent_versions.agent_id", "=", "agents.id")
             .onRef("agent_versions.version", "=", "agents.current_version"))
-            .select(["agent_versions.definition", "agents.visibility"])
+            .select(["agent_versions.definition"])
             .where("agents.id", "=", ctx.agentId)
             .executeTakeFirst();
         // stored raw: an rc version's keys read as current keys, so its deny keeps applying (§8.3)
@@ -222,12 +214,9 @@ export function createDecidePolicy(db) {
             if (!roleAtLeast(m.role, tool.requiredRole))
                 escalateTo = tool.requiredRole;
         }
-        // 可见性实时读（R5）：共享 agent 的 SkillWrite 固定 ask，私有 agent 不问（见 R3_SHARED_AGENT_ONLY_TOOL_KEYS）
-        // 当前版本的 skills.writePolicy 同样实时读（R5）：运行中改为 ask，下一次调用即生效；固定 ask 时授权不放行
-        const writePolicy = currentDef?.skills?.writePolicy;
         // `remember: false` on a call that is not a plain allow (an org / platform operation, or a read
         // an agent tightened to ask): every call asks, grants never apply. A read (`allow`) never asks.
-        const fixedAsk = isFixedAsk(tool, current?.visibility, writePolicy) ||
+        const fixedAsk = isFixedAsk(tool) ||
             (call !== null && !call.remember && (call.policy !== "allow" || agentOverride !== undefined));
         const input = {
             connectorDefault,
@@ -253,7 +242,7 @@ export function createDecidePolicy(db) {
             requestedFor: escalateTo === null ? ctx.accountId : null,
             approverRole: escalateTo,
             // the most specific rule that asked: role escalation, the agent's tightening, the connector,
-            // a fixed ask (R3, requiresUserInteraction), the org's sandboxToolPolicy, else the tool's own
+            // a fixed ask (requiresUserInteraction), the org's sandboxToolPolicy, else the tool's own
             // default
             policy: escalateTo !== null
                 ? "role"

package/dist/tools/tools.module.js

@@ -22,6 +22,7 @@ import { UsageReportModule } from "../runtime/usage-report.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { SkillsModule } from "../skills/skills.module.js";
 import { StorageModule } from "../storage/storage.module.js";
+import { AdminConnectors } from "./admin-connectors.js";
 import { ApprovalsService } from "./approvals.service.js";
 import { Breaker } from "./breaker.js";
 import { BuiltinTools } from "./builtins/builtin-tools.js";
@@ -87,6 +88,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            AdminConnectors,
             ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,
@@ -105,6 +107,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            AdminConnectors,
             ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.19",
+  "version": "0.1.0-rc.20",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {

package/src/migrations/0109_audit_platform_idx.sql

@@ -0,0 +1,5 @@
+-- Platform-level audit events (org_id null), newest first: the admin overview's recent platform
+-- operations and /admin/audit page by keyset on id (admin overview spec §4.4, §5.4). A plain
+-- CREATE INDEX: the migrator runs each file in a transaction.
+CREATE INDEX IF NOT EXISTS audit_events_platform_idx
+  ON audit_events (id DESC) WHERE org_id IS NULL;

package/src/migrations/0110_usage_time_idx.sql

@@ -0,0 +1,8 @@
+-- The admin overview's seven-day usage aggregate (admin overview spec §4.3, §5.4) reads runs and
+-- embedding usage of every org by time: runs by created_at (only (conversation_id, created_at)
+-- existed) and model_usage by occurred_at (only (org_id, occurred_at) and a partial index on the
+-- unreported rows existed). Chat usage events already have conversation_events_usage_idx (0040).
+-- A plain CREATE INDEX: the migrator runs each file in a transaction, so not CONCURRENTLY; it
+-- locks writes to the table while it builds (pre-0.1.0: no large deployments).
+CREATE INDEX IF NOT EXISTS runs_created_idx ON runs (created_at);
+CREATE INDEX IF NOT EXISTS model_usage_time_idx ON model_usage (occurred_at);

package/src/migrations/0111_agent_skill_sharing.sql

@@ -0,0 +1,22 @@
+-- Skill authoring via the Platform tool: an agent's owner shares an agent skill with the org. The
+-- shared skill is an org skill (scope 'org') that remembers the agent it came from
+-- (origin_agent_id, cleared when that agent is deleted; the skill stays) and the account that
+-- maintains it (maintainer_account_id).
+ALTER TABLE skills
+  ADD COLUMN IF NOT EXISTS origin_agent_id text REFERENCES agents(id) ON DELETE SET NULL;
+ALTER TABLE skills
+  ADD COLUMN IF NOT EXISTS maintainer_account_id text REFERENCES accounts(id);
+-- The skills an agent shared, for its skill list and for sharing again.
+CREATE INDEX IF NOT EXISTS skills_origin_agent_idx
+  ON skills (origin_agent_id)
+  WHERE origin_agent_id IS NOT NULL AND deleted_at IS NULL;
+
+-- A request is either a share of an agent skill with the org or a new version of a shared skill.
+ALTER TABLE skill_change_requests
+  ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'version'
+    CHECK (kind IN ('share', 'version'));
+
+-- The R4 owner-approved change flow ends. The draft objects of the cancelled rows are left to the
+-- org data cleanup.
+-- capybara:allow-destructive R4 owner-approved changes are removed; pending ones cannot be decided any more
+UPDATE skill_change_requests SET status = 'cancelled', decided_at = now() WHERE status = 'pending';

package/src/migrations/0112_skill_share_requests.sql

@@ -0,0 +1,4 @@
+-- A share request of an agent skill comes from the agent page or the Platform operation and has
+-- no trial, so it records no conversation; a version proposal registered on the web has none
+-- either. requested_in_conversation becomes optional.
+ALTER TABLE skill_change_requests ALTER COLUMN requested_in_conversation DROP NOT NULL;

package/dist/tools/builtins/skill-write.d.ts

@@ -1,59 +0,0 @@
-import type { SkillManifest } from "../../db/kernel-schema.js";
-import type { SkillChangesService } from "../../skills/changes.service.js";
-import type { BuiltinTool } from "../registry.js";
-/**
- * 内置工具 `SkillWrite`（M5 T15，R4）：agent 新建或更新它自己的技能（`scope = agent`）。
- * - 输入 `{ name, description, files: [{ path, content }] }`，只收文本文件，整个技能 ≤ {@link SKILL_WRITE_MAX_BYTES}；
- * - the kernel generates SKILL.md ({@link buildSkillWrite}): its frontmatter is `name` / `description`
- *   plus the invocation keys (`disable-model-invocation`, `context`, ... phase D) of the frontmatter
- *   of the `SKILL.md` entry in `files`, whose other keys are dropped; its body is that entry's body
- *   (empty without the entry);
- * - 每次调用写一个完整的新版本（上一版有、这次没给的文件不再属于新版本）；
- * - 私有 agent 直接生成新版本并立即生效；共享 agent 由触发对话的人先确认这次调用（R3 固定 ask，见 tools/policy.ts），
- *   再生成变更申请等负责人批准，期间只有本对话试用新版本（见 skills/changes.service.ts）；
- * - 成功后立即在日志追加技能目录快照（`skills_catalog`，Ruling M17），同一运行的下一步就能 `Skill`。
- */
-/** 一个技能（含合成的 SKILL.md）的总大小上限（UTF-8 字节）。 */
-export declare const SKILL_WRITE_MAX_BYTES: number;
-/** 一次最多的文件数（含 SKILL.md）。 */
-export declare const SKILL_WRITE_MAX_FILES = 200;
-/** `SkillWrite` 的输入（已按 inputSchema 校验）。 */
-export interface SkillWriteInput {
-    name: string;
-    description: string;
-    files: {
-        path: string;
-        content: string;
-    }[];
-}
-/** 一个待写入的文件。 */
-export interface BuiltSkillFile {
-    path: string;
-    data: Uint8Array;
-    size: number;
-    sha256: string;
-}
-/** {@link buildSkillWrite} 成功的结果。 */
-export interface BuiltSkill {
-    name: string;
-    description: string;
-    files: BuiltSkillFile[];
-    manifest: SkillManifest;
-}
-/**
- * 由工具输入合成技能文件（纯函数）：
- * - SKILL.md = `---\n<yaml name/description>---\n\n<正文>\n`，正文为 `files` 里 `SKILL.md` 的内容去掉 frontmatter、
- *   去掉首尾空行；合成结果再用 `parseSkillMd` 校验（名字规则、描述长度、不含 XML 标签）；
- * - 其余文件按 `validateSkillPackage` 校验路径（不能越出 `/skills/<name>/`、不能重复、大小写冲突等）；
- * - 只收文本：内容含 NUL 视为二进制，拒绝；全部文件（含 SKILL.md）的 UTF-8 字节数之和 ≤ {@link SKILL_WRITE_MAX_BYTES}。
- * 返回合成结果或全部问题（英文，直接给模型）。
- */
-export declare function buildSkillWrite(input: SkillWriteInput): BuiltSkill | {
-    errors: string[];
-};
-/** 依赖：技能变更服务。 */
-export interface SkillWriteDeps {
-    changes: Pick<SkillChangesService, "write">;
-}
-/** 内置工具 `SkillWrite`（见文件头）。 */
-export declare function skillWriteTool(deps: SkillWriteDeps): BuiltinTool;