@capybara-hq/kernel 0.1.0-rc.19 → 0.1.0-rc.20

package/dist/background/tasks.service.js

@@ -135,46 +135,91 @@ let BackgroundTasks = class BackgroundTasks {
     }
     /**
      * The end of the task's output, at most `tail` bytes. Read live when the task's device
-     * instance runs (never resuming a suspended one); a finished task whose sandbox does not run answers
-     * with the last lines its finished event kept. Anything else is
-     * `background_task.output_unavailable` (409).
+     * instance runs (never resuming a suspended one); a finished task that cannot be read live
+     * answers with the last lines its finished event kept and why (`unavailable`). Anything else is
+     * `background_task.output_unavailable` (409) with `details: [{ reason, environment }]`.
      */
     async output(orgId, conversationId, accountId, taskId, tail) {
         const task = await this.owned(orgId, conversationId, accountId, taskId);
-        if (task.sid !== null &&
-            task.sandboxCreatedAt !== null &&
-            task.deviceId !== null &&
-            (await this.sandbox.availableFor(task.deviceId)) &&
-            (await this.deviceUsable(orgId, task.conversationId))) {
-            const createdAt = task.sandboxCreatedAt;
-            // the person reading it acts in the task's conversation
-            const actor = { accountId, conversationId: task.conversationId };
-            try {
-                const r = await this.sandbox.ifRunning(task.deviceId, { createdAt }, async (p, h, signal) => {
-                    const res = await actingAs(p, actor).exec(h, {
-                        command: tailScript(task.id, tail),
-                        cwd: rootsOf(h).workspace,
-                        timeoutMs: OUTPUT_READ_TIMEOUT_MS,
-                        maxOutputBytes: 2 * OUTPUT_TAIL_MAX_BYTES + 4096,
-                        signal,
-                    });
-                    return res.exitCode === 0 ? parseTail(res.stdout, tail) : null;
-                }, AbortSignal.timeout(OUTPUT_READ_TIMEOUT_MS));
-                if (r.kind === "ran" && r.value !== null)
-                    return { ...r.value, source: "live" };
-            }
-            catch (e) {
-                if (!isSandboxGoneError(e))
-                    throw e;
-            }
-        }
+        const read = await this.readLive(orgId, accountId, task, tail);
+        if (read.kind === "ok")
+            return { ...read.value, source: "live" };
+        const unavailable = {
+            reason: read.reason,
+            environment: await this.environmentOf(task.deviceId),
+        };
         if (task.status !== "running") {
             const ev = await this.eventLog.findByIdem(task.conversationId, finishedEventKey(task.id));
             if (ev?.type === "background_task_finished") {
-                return { text: ev.payload.lastLines, truncated: true, source: "event" };
+                return { text: ev.payload.lastLines, truncated: true, source: "event", unavailable };
+            }
+        }
+        throw new ApiError("background_task.output_unavailable", `The task's output cannot be read now (${unavailable.reason})`, [unavailable]);
+    }
+    /** Whether the task ran on a local device (its machine) or in a cloud sandbox. */
+    async environmentOf(deviceId) {
+        if (deviceId === null)
+            return "cloud";
+        const row = await this.db.db
+            .selectFrom("devices")
+            .select("source")
+            .where("id", "=", deviceId)
+            .executeTakeFirst();
+        return row?.source === "local" ? "local" : "cloud";
+    }
+    /** Reads the output from the task's running instance, or says why it cannot. */
+    async readLive(orgId, accountId, task, tail) {
+        if (task.sid === null || task.sandboxCreatedAt === null || task.deviceId === null) {
+            // a reservation the launch has not finished, or a launch that failed
+            return {
+                kind: "unavailable",
+                reason: task.status === "running" ? "starting" : "not_started",
+            };
+        }
+        if (!(await this.sandbox.availableFor(task.deviceId))) {
+            return { kind: "unavailable", reason: "unavailable" };
+        }
+        if (!(await this.deviceUsable(orgId, task.conversationId))) {
+            return { kind: "unavailable", reason: "no_access" };
+        }
+        const createdAt = task.sandboxCreatedAt;
+        // the person reading it acts in the task's conversation
+        const actor = { accountId, conversationId: task.conversationId };
+        try {
+            const r = await this.sandbox.ifRunning(task.deviceId, { createdAt }, async (p, h, signal) => {
+                const res = await actingAs(p, actor).exec(h, {
+                    command: tailScript(task.id, tail),
+                    cwd: rootsOf(h).workspace,
+                    timeoutMs: OUTPUT_READ_TIMEOUT_MS,
+                    maxOutputBytes: 2 * OUTPUT_TAIL_MAX_BYTES + 4096,
+                    signal,
+                });
+                return res.exitCode === 0 ? parseTail(res.stdout, tail) : null;
+            }, AbortSignal.timeout(OUTPUT_READ_TIMEOUT_MS));
+            if (r.kind === "other_instance")
+                return { kind: "unavailable", reason: "rebuilt" };
+            if (r.kind === "not_running") {
+                // a suspended instance keeps its files; any other state means they went with it
+                return { kind: "unavailable", reason: r.status === "suspended" ? "suspended" : "rebuilt" };
+            }
+            if (r.value === null)
+                return { kind: "unavailable", reason: "read_failed" };
+            if (r.value === "missing")
+                return { kind: "unavailable", reason: "output_missing" };
+            return { kind: "ok", value: r.value };
+        }
+        catch (e) {
+            if (isSandboxGoneError(e))
+                return { kind: "unavailable", reason: "rebuilt" };
+            // a local device's machine: offline, or no longer the owner's (revoked, deleted)
+            if (e instanceof ApiError && e.code.startsWith("device.")) {
+                return {
+                    kind: "unavailable",
+                    reason: e.code === "device.offline" ? "device_offline" : "no_access",
+                };
             }
+            throw e;
         }
-        throw new ApiError("background_task.output_unavailable", "The task's output cannot be read now: its sandbox is not running");
     }
 };
 BackgroundTasks = __decorate([
@@ -188,18 +233,28 @@ BackgroundTasks = __decorate([
     __param(6, Inject(ConversationDevices))
 ], BackgroundTasks);
 export { BackgroundTasks };
-/** Prints `size <bytes>` and `out <base64 of the last `tail` bytes>`. Relative to the workspace root. */
-function tailScript(id, tail) {
+/**
+ * Prints `size <bytes>` and `out <base64 of the last `tail` bytes>`, or `missing` when the output
+ * file is not there. Relative to the workspace root; POSIX tools only (`wc -c`, `tail -c`,
+ * `base64`, `tr`), so it reads the same on Linux and macOS.
+ */
+export function tailScript(id, tail) {
     if (!TASK_ID_RE.test(id))
         throw new Error(`invalid background task id: ${id}`);
     const f = `${TASKS_DIR}/${id}.out`;
     return [
+        `if [ ! -f ${f} ]; then echo missing; exit 0; fi`,
         `s=$({ wc -c < ${f}; } 2>/dev/null | tr -d ' '); echo "size \${s:-0}"`,
         `printf 'out '; { tail -c ${Math.floor(tail)} ${f} 2>/dev/null | base64 | tr -d '\\n'; }; echo`,
     ].join("\n");
 }
-/** Decodes {@link tailScript}'s output; a cut that splits a UTF-8 character drops its tail bytes. */
-function parseTail(stdout, tail) {
+/**
+ * Decodes {@link tailScript}'s output (`missing`: no output file; null: unreadable); a cut that
+ * splits a UTF-8 character drops its tail bytes.
+ */
+export function parseTail(stdout, tail) {
+    if (/^missing$/m.test(stdout))
+        return "missing";
     const size = /^size ([0-9]+)$/m.exec(stdout);
     const out = /^out (\S*)$/m.exec(stdout);
     if (!size || !out)

package/dist/catalog/catalog.module.js

@@ -25,6 +25,10 @@ import { PlatformPluginUpdater } from "./plugin-upgrade.js";
 import { CatalogRequestsService } from "./requests.service.js";
 import { PLUGIN_SCOPE_QUEUE, PluginScopeSync } from "./scope-sync.js";
 export { CatalogImportModule };
+/** The plugin scope sync's queue registration (re-exported: the admin health reads its counts). */
+const PLUGIN_SCOPE_QUEUE_MODULE = QueueModule.registerQueue(PLUGIN_SCOPE_QUEUE);
+/** This module's maintenance queue registration (re-exported for the admin health). */
+const MAINTENANCE_QUEUE_MODULE = QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME);
 /**
  * The plugin catalog (spec §4, §10): {@link CatalogImportModule}, catalog requests, org installs
  * with their dependencies, the platform plugin update (`PlatformPluginUpdater`), the admin's scope
@@ -46,10 +50,10 @@ CatalogModule = __decorate([
             SkillsModule,
             ToolsModule,
             // the producer side of the plugin scope sync (`PluginScopeWorkersModule` consumes it)
-            QueueModule.registerQueue(PLUGIN_SCOPE_QUEUE),
+            PLUGIN_SCOPE_QUEUE_MODULE,
             // a removed org plugin's cleanup job (`OwnedItems`, `CatalogScopeService`; consumed by the
             // worker role's `MaintenanceProcessor`)
-            QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
+            MAINTENANCE_QUEUE_MODULE,
         ],
         providers: [
             CatalogRequestsService,
@@ -64,6 +68,8 @@ CatalogModule = __decorate([
             OwnedItems,
         ],
         exports: [
+            PLUGIN_SCOPE_QUEUE_MODULE,
+            MAINTENANCE_QUEUE_MODULE,
             CatalogImportModule,
             CatalogRequestsService,
             PluginInstaller,

package/dist/channels/channels.module.js

@@ -27,6 +27,8 @@ import { ChannelInbound } from "./inbound.js";
 import { CHANNEL_QUEUE_NAME, ChannelJobs } from "./jobs.js";
 import { ChannelOutbound, deliverBackoff } from "./outbound.js";
 import { AnonymousGuestLock, AnonymousGuests } from "./threads.js";
+/** The channel queue's registration (its producer here; the admin health reads its counts). */
+const CHANNEL_QUEUE_MODULE = QueueModule.registerQueue(CHANNEL_QUEUE_NAME);
 /**
  * Channels on every role: the org's channel connections, inbound (dedupe and enqueue; the inbound
  * jobs), the outbound delivery, the producer of the channel queue `cap-kernel-channels`, the
@@ -48,7 +50,7 @@ ChannelsModule = __decorate([
             ToolsModule,
             ConversationsModule,
             RuntimeModule,
-            QueueModule.registerQueue(CHANNEL_QUEUE_NAME),
+            CHANNEL_QUEUE_MODULE,
         ],
         providers: [
             ChannelJobs,
@@ -58,7 +60,14 @@ ChannelsModule = __decorate([
             ChannelInbound,
             ChannelOutbound,
         ],
-        exports: [ChannelJobs, ChannelConnections, AnonymousGuests, ChannelInbound, ChannelOutbound],
+        exports: [
+            ChannelJobs,
+            ChannelConnections,
+            AnonymousGuests,
+            ChannelInbound,
+            ChannelOutbound,
+            CHANNEL_QUEUE_MODULE,
+        ],
     })
 ], ChannelsModule);
 export { ChannelsModule };

package/dist/channels/supervisor.d.ts

@@ -127,6 +127,8 @@ export declare class ChannelSupervisor {
      * written yet on the first round).
      */
     private targets;
+    /** How many long connections this process holds now (replica presence reports it). */
+    heldCount(): number;
     private heldOf;
     /**
      * Gives back the most recently connected connection of `plugin`, leaving a handoff marker first;

package/dist/channels/supervisor.js

@@ -305,6 +305,10 @@ let ChannelSupervisor = class ChannelSupervisor {
         }
         return out;
     }
+    /** How many long connections this process holds now (replica presence reports it). */
+    heldCount() {
+        return this.held.size;
+    }
     heldOf(plugin) {
         let n = 0;
         for (const h of this.held.values())

package/dist/conversations/events.js

@@ -604,7 +604,7 @@ export const ConversationEventSchema = z.discriminatedUnion("type", [
         /**
          * Pinned skills (phase B, spec §9.1) in the agent's order: each a skill of `skills` (same
          * id, version and source) with its SKILL.md body as read at run start or written by
-         * SkillWrite. Absent means none (every snapshot before phase B).
+         * a skill registration. Absent means none (every snapshot before phase B).
          */
         pinned: z
             .array(z.object({

package/dist/conversations/titles.js

@@ -528,20 +528,16 @@ TitleQueue = __decorate([
     __param(3, Inject(KERNEL_LOGGER))
 ], TitleQueue);
 export { TitleQueue };
+/** The title queue's registration (re-exported: the admin health reads its counts). */
+const TITLE_QUEUE_MODULE = QueueModule.registerQueue(TITLE_QUEUE);
 /** Conversation titles: the queue and the job (consumed on the worker role). */
 let TitlesModule = class TitlesModule {
 };
 TitlesModule = __decorate([
     Module({
-        imports: [
-            EventLogModule,
-            ModelsModule,
-            ExtensionsModule,
-            UsageReportModule,
-            QueueModule.registerQueue(TITLE_QUEUE),
-        ],
+        imports: [EventLogModule, ModelsModule, ExtensionsModule, UsageReportModule, TITLE_QUEUE_MODULE],
         providers: [TitleGenerator, TitleQueue],
-        exports: [TitleQueue],
+        exports: [TitleQueue, TITLE_QUEUE_MODULE],
     })
 ], TitlesModule);
 export { TitlesModule };

package/dist/db/kernel-schema.d.ts

@@ -720,6 +720,10 @@ export interface SkillsTable {
     platform_skill_id: ColumnType<string | null, string | null | undefined, string | null>;
     /** 0081: a pin keeps the copy on its own stored version (ruling B2). */
     pinned_version: ColumnType<number | null, number | null | undefined, number | null>;
+    /** 0111: the agent a shared org skill came from (cleared when that agent is deleted). */
+    origin_agent_id: ColumnType<string | null, string | null | undefined, string | null>;
+    /** 0111: the account that maintains a shared org skill. */
+    maintainer_account_id: ColumnType<string | null, string | null | undefined, string | null>;
 }
 /** 0024_skills.sql：技能的版本。 */
 export interface SkillVersionsTable {
@@ -760,8 +764,11 @@ export interface SkillChangeRequestsTable {
     proposed_version: Json<ProposedSkillVersion>;
     object_prefix: string;
     requested_by_account: string;
-    requested_in_conversation: string;
+    /** 0112: null for a share request and for a version proposal registered on the web. */
+    requested_in_conversation: string | null;
     status: Generated<"pending" | "approved" | "rejected" | "cancelled">;
+    /** 0111: a share of an agent skill with the org, or a new version of a shared skill. */
+    kind: Dflt<"share" | "version">;
     decided_by: string | null;
     decided_at: TsNullable;
     created_at: Ts;

package/dist/devices/devices.module.js

@@ -8,6 +8,7 @@ import { Module } from "@nestjs/common";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { LocalDevicesModule } from "../local-devices/local-devices.module.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
+import { SandboxFileReader } from "../sandbox/sandbox-file-reader.js";
 import { DeviceAccess } from "./access.js";
 import { ConversationDevices } from "./conversation-devices.js";
 import { DevicesService } from "./devices.service.js";
@@ -24,8 +25,10 @@ DevicesModule = __decorate([
         // ExtensionsModule: the provider display names of demoted defaults; LocalDevicesModule: deleting
         // a local device revokes its machine
         imports: [SandboxModule, ExtensionsModule, LocalDevicesModule],
-        providers: [DeviceAccess, DevicesService, ConversationDevices],
-        exports: [DeviceAccess, DevicesService, ConversationDevices],
+        // SandboxFileReader lives here, not in SandboxModule: it needs ConversationDevices, and this
+        // module already imports SandboxModule (the other way would be a module cycle)
+        providers: [DeviceAccess, DevicesService, ConversationDevices, SandboxFileReader],
+        exports: [DeviceAccess, DevicesService, ConversationDevices, SandboxFileReader],
     })
 ], DevicesModule);
 export { DevicesModule };

package/dist/errors.d.ts

@@ -222,6 +222,8 @@ export declare const ERROR_CODES: {
     readonly "plugin.upgrade_failed": 502;
     readonly "setup.already_completed": 409;
     readonly "setup.token_invalid": 403;
+    /** The admin overview's seven-day usage aggregate ran past its statement timeout (spec §5.5). */
+    readonly "admin.usage_unavailable": 503;
     readonly "agent.not_found": 404;
     readonly "agent.version_conflict": 409;
     /** The profile was changed since the client read it (`expectedUpdatedAt` is stale). */
@@ -316,6 +318,14 @@ export declare const ERROR_CODES: {
     readonly "attachment.too_many_pending": 429;
     readonly "sandbox.unavailable": 503;
     readonly "sandbox.busy": 409;
+    /** A sandbox file path the kernel reads is not absolute or not under the sandbox roots. */
+    readonly "sandbox.file_invalid_path": 422;
+    /** No file at the sandbox path the kernel reads. */
+    readonly "sandbox.file_not_found": 422;
+    /** The sandbox path the kernel reads is a directory, not one file. */
+    readonly "sandbox.file_is_directory": 422;
+    /** The sandbox file the kernel reads is over the caller's size limit. */
+    readonly "sandbox.file_too_large": 422;
     /** The device is missing, deleted, or not the caller's (never 403, so ids cannot be probed). */
     readonly "device.not_found": 404;
     /** The cloud device's file system is gone at the provider; reset its files to start empty. */
@@ -355,15 +365,25 @@ export declare const ERROR_CODES: {
     readonly "skill.not_found": 404;
     /** Also a skill neither the model nor a person could use (phase D: both invocation flags off). */
     readonly "skill.invalid_package": 400;
+    /** An agent already has `AGENT_SKILLS_MAX` own skills. */
+    readonly "skill.agent_cap": 409;
+    /** Sharing this agent skill with the org is already waiting for an org admin. */
+    readonly "skill.share_pending": 409;
+    /** Another conversation's proposed version of this shared skill is waiting for an org admin. */
+    readonly "skill.proposal_pending_elsewhere": 409;
+    /** A sub-agent conversation tried to register a skill on its agent (only the root registers). */
+    readonly "skill.subagent_register": 403;
     /**
      * A person invoked a skill (`/name`, phase D) that is not one of the agent's effective skills
      * (`details: [{ reason: "not_found" }]`) or is hidden from the menu (`not_user_invocable`).
      */
     readonly "skill.not_invocable": 400;
-    /** Creating a skill from text (P3-24, F18): an org-level skill with this name already exists in the org. */
+    /**
+     * Uploading or sharing a skill: an org-level skill with this name already exists in the org
+     * (P3-24, F18).
+     */
     readonly "skill.name_exists": 409;
     readonly "skill_change.not_found": 404;
-    readonly "skill_change.not_owner": 403;
     readonly "skill_change.already_decided": 409;
     readonly "trajectory.not_found": 404;
     readonly "eval.run_not_finished": 409;

package/dist/errors.js

@@ -222,6 +222,8 @@ export const ERROR_CODES = {
     "plugin.upgrade_failed": 502,
     "setup.already_completed": 409,
     "setup.token_invalid": 403,
+    /** The admin overview's seven-day usage aggregate ran past its statement timeout (spec §5.5). */
+    "admin.usage_unavailable": 503,
     "agent.not_found": 404,
     "agent.version_conflict": 409,
     /** The profile was changed since the client read it (`expectedUpdatedAt` is stale). */
@@ -316,6 +318,14 @@ export const ERROR_CODES = {
     "attachment.too_many_pending": 429,
     "sandbox.unavailable": 503,
     "sandbox.busy": 409,
+    /** A sandbox file path the kernel reads is not absolute or not under the sandbox roots. */
+    "sandbox.file_invalid_path": 422,
+    /** No file at the sandbox path the kernel reads. */
+    "sandbox.file_not_found": 422,
+    /** The sandbox path the kernel reads is a directory, not one file. */
+    "sandbox.file_is_directory": 422,
+    /** The sandbox file the kernel reads is over the caller's size limit. */
+    "sandbox.file_too_large": 422,
     /** The device is missing, deleted, or not the caller's (never 403, so ids cannot be probed). */
     "device.not_found": 404,
     /** The cloud device's file system is gone at the provider; reset its files to start empty. */
@@ -355,15 +365,25 @@ export const ERROR_CODES = {
     "skill.not_found": 404,
     /** Also a skill neither the model nor a person could use (phase D: both invocation flags off). */
     "skill.invalid_package": 400,
+    /** An agent already has `AGENT_SKILLS_MAX` own skills. */
+    "skill.agent_cap": 409,
+    /** Sharing this agent skill with the org is already waiting for an org admin. */
+    "skill.share_pending": 409,
+    /** Another conversation's proposed version of this shared skill is waiting for an org admin. */
+    "skill.proposal_pending_elsewhere": 409,
+    /** A sub-agent conversation tried to register a skill on its agent (only the root registers). */
+    "skill.subagent_register": 403,
     /**
      * A person invoked a skill (`/name`, phase D) that is not one of the agent's effective skills
      * (`details: [{ reason: "not_found" }]`) or is hidden from the menu (`not_user_invocable`).
      */
     "skill.not_invocable": 400,
-    /** Creating a skill from text (P3-24, F18): an org-level skill with this name already exists in the org. */
+    /**
+     * Uploading or sharing a skill: an org-level skill with this name already exists in the org
+     * (P3-24, F18).
+     */
     "skill.name_exists": 409,
     "skill_change.not_found": 404,
-    "skill_change.not_owner": 403,
     "skill_change.already_decided": 409,
     "trajectory.not_found": 404,
     "eval.run_not_finished": 409,

package/dist/evals/evals.module.js

@@ -27,6 +27,8 @@ import { EvalRunsService } from "./runs.service.js";
 import { EvalSetsService } from "./sets.service.js";
 import { TrajectoryService } from "./trajectory.service.js";
 import { EVAL_MAX_STALLED_COUNT, EvalWorker } from "./worker.js";
+/** The eval queue's registration (re-exported: the admin health reads its counts). */
+const EVAL_QUEUE_MODULE = QueueModule.registerQueue(EVAL_QUEUE_NAME);
 /**
  * Evals: the trajectory viewer, eval sets and cases, eval runs (the producer of
  * `cap-kernel-evals`) and the run bookkeeping ({@link EvalBudgetModule}, re-exported).
@@ -42,10 +44,17 @@ EvalsModule = __decorate([
             OrgLockModule,
             ProvidersModule,
             EvalBudgetModule,
-            QueueModule.registerQueue(EVAL_QUEUE_NAME),
+            EVAL_QUEUE_MODULE,
         ],
         providers: [TrajectoryService, EvalSetsService, EvalRunsService, EvalJobs],
-        exports: [TrajectoryService, EvalSetsService, EvalRunsService, EvalJobs, EvalBudgetModule],
+        exports: [
+            TrajectoryService,
+            EvalSetsService,
+            EvalRunsService,
+            EvalJobs,
+            EvalBudgetModule,
+            EVAL_QUEUE_MODULE,
+        ],
     })
 ], EvalsModule);
 export { EvalsModule };

package/dist/extensions/permission-view.js

@@ -129,9 +129,9 @@ export function permissionGroups(set) {
     // older snapshots lack `ui`, `ui.components` and `client` (read as empty / false)
     const ui = p.ui ?? { views: [], embeds: [], components: [] };
     const components = ui.components ?? [];
-    const secretFields = [...set.config.deployment, ...set.config.org]
-        .filter((f) => f.secret)
-        .map((f) => f.path || "<root>");
+    // Level-prefixed like the config group: a field at both levels (an overridable secret such as
+    // `appSecret`) is two items, not one name listed twice.
+    const secretFields = ["deployment", "org"].flatMap((level) => set.config[level].filter((f) => f.secret).map((f) => `${level}:${f.path || "<root>"}`));
     const configFields = ["deployment", "org"].flatMap((level) => set.config[level].map((f) => `${level}:${f.path || "<root>"}`));
     const secretItems = [...(p.secrets ? ["secret store"] : []), ...secretFields];
     const groups = [

package/dist/http/api.module.js

@@ -8,7 +8,11 @@ import { Module } from "@nestjs/common";
 import { APP_GUARD } from "@nestjs/core";
 import { AdminController } from "../admin/admin.controller.js";
 import { AdminModule } from "../admin/admin.module.js";
+import { AdminAgentsController } from "../admin/admin-agents.controller.js";
+import { AdminConnectorsController } from "../admin/admin-connectors.controller.js";
+import { AdminAuditController } from "../admin/audit.controller.js";
 import { AdminExtensionsController } from "../admin/extensions.controller.js";
+import { AdminOverviewController } from "../admin/overview.controller.js";
 import { SetupController } from "../admin/setup.controller.js";
 import { AgentsController } from "../agents/agents.controller.js";
 import { AgentsModule } from "../agents/agents.module.js";
@@ -67,7 +71,8 @@ import { ConversationStreamController } from "../runtime/stream.controller.js";
 import { SetupModule } from "../setup/setup.module.js";
 import { SetupChecksController } from "../setup/setup-checks.controller.js";
 import { SetupGuidesController } from "../setup/setup-guides.controller.js";
-import { AgentSkillsController, InboxController, SkillChangesController, } from "../skills/changes.controller.js";
+import { AgentSkillsController } from "../skills/agent-skills.controller.js";
+import { InboxController, SkillChangesController } from "../skills/changes.controller.js";
 import { InvocableSkillsController } from "../skills/invocable.controller.js";
 import { SkillsController } from "../skills/skills.controller.js";
 import { SkillsModule } from "../skills/skills.module.js";
@@ -96,6 +101,10 @@ const CONTROLLERS = [
     InvitationsController,
     SetupController,
     AdminController,
+    AdminAgentsController,
+    AdminConnectorsController,
+    AdminAuditController,
+    AdminOverviewController,
     AdminExtensionsController,
     AdminCatalogController,
     AdminComponentsController,

package/dist/identity/settings.js

@@ -132,8 +132,9 @@ export const DEPLOYMENT_SETTINGS = z.object({
     /** 组织能否自建连接器（不经平台目录）。 */
     customConnectors: CustomPolicy.default("allow"),
     /**
-     * 组织能否自建技能（不经平台目录）：deny 时组织管理员不能上传技能包。agent 自写技能（`SkillWrite`，私有 agent 的
-     * agent 级技能与共享 agent 经负责人审批的变更）不受此开关约束——那是 agent 定义的一部分，由 R3 / R4 把关。
+     * Whether the org can create its own skills (not through the platform catalog): on deny org admins
+     * cannot upload skill packages. An agent registering its own skill (`agents.register-skill`) is not
+     * governed by it; only sharing a skill to the org is refused.
      */
     customSkills: CustomPolicy.default("allow"),
     /**

package/dist/identity/write-actor.d.ts

@@ -0,0 +1,11 @@
+import { type Principal } from "./principal.js";
+/**
+ * Who performs a write on the platform's behalf (a super admin acting on an org they need not be
+ * a member of): the account and, for a write made with a personal access token, the token id.
+ */
+export interface WriteActor {
+    accountId: string;
+    tokenId?: string;
+}
+/** The writer of a request: its user and, for a personal access token, the token id. */
+export declare function writeActorOf(principal: Principal): WriteActor;

package/dist/identity/write-actor.js

@@ -0,0 +1,7 @@
+import { patTokenId, requireUser } from "./principal.js";
+/** The writer of a request: its user and, for a personal access token, the token id. */
+export function writeActorOf(principal) {
+    const user = requireUser(principal);
+    const tokenId = patTokenId(user);
+    return { accountId: user.account.id, ...(tokenId !== undefined && { tokenId }) };
+}

package/dist/inbox/inbox.service.d.ts

@@ -38,7 +38,8 @@ export declare const INBOX_MAX_ITEMS = 100;
 /**
  * 收件箱里的一项（按 `type` 区分，形状稳定）：
  * - `tool_approval`：当前用户能处理的待处理工具调用审批（与 `GET /approvals?status=pending` 同一视图）；
- * - `skill_change`：当前用户作为 agent 负责人能决定的待处理技能变更（M5 T15，R4）；
+ * - `skill_change`: pending skill share requests and proposed versions of shared skills, when the
+ *   current user is an org admin (`skillChange.kind`; spec §5.4, §5.5);
  * - `catalog_request`: pending `enable` requests from members and pending `connector_setup`
  *   requests (`request.kind`; `request.agent` and `request.connectors` set, `item` null; ruling
  *   P4-T6-5), when the current user is an org admin (M6 T26, C22; plugin scope spec §5.1);

package/dist/inbox/platform-inbox.service.d.ts

@@ -91,6 +91,10 @@ export type PlatformInboxItem = {
     createdAt: string;
     notice: PlatformNoticeView;
 };
+/** Every {@link PlatformInboxItem} type, in the order the admin overview lists them. */
+export declare const PLATFORM_INBOX_TYPES: readonly ["catalog_request", "permission_confirmation", "org_upload_pending", "scope_sync_failed", "platform_migration", "ownership_transferred"];
+/** How many items of each type wait: every type, zeros included. */
+export type PlatformInboxCounts = Record<PlatformInboxItem["type"], number>;
 /** An open platform notice (`platform_notices`, kind `ownership_transferred`). */
 export interface PlatformNoticeView {
     id: string;
@@ -100,12 +104,14 @@ export interface PlatformNoticeView {
 }
 /**
  * `GET /admin/inbox`: newest first, at most {@link PLATFORM_INBOX_MAX_ITEMS}; `truncated`: more;
- * `total`: how many items wait in all (also `GET /admin/inbox/count`).
+ * `total`: how many items wait in all (also `GET /admin/inbox/count`); `byType`: `total` per
+ * type, counted over everything waiting (not the listed window).
  */
 export interface PlatformInboxView {
     items: PlatformInboxItem[];
     truncated: boolean;
     total: number;
+    byType: PlatformInboxCounts;
 }
 /**
  * The super admin's inbox (plugin scope spec §5.1 rule 5, §13.5): what waits on the platform,

package/dist/inbox/platform-inbox.service.js

@@ -24,6 +24,15 @@ export const SCOPE_SYNC_FAILURES_LIST_MAX = 200;
 export const MIGRATION_RUN_STUCK_MS = 60 * 60_000;
 /** Plugin install statuses of a plugin that is on in the org. */
 const LIVE_INSTALL = ["installing", "installed", "upgrading"];
+/** Every {@link PlatformInboxItem} type, in the order the admin overview lists them. */
+export const PLATFORM_INBOX_TYPES = [
+    "catalog_request",
+    "permission_confirmation",
+    "org_upload_pending",
+    "scope_sync_failed",
+    "platform_migration",
+    "ownership_transferred",
+];
 /**
  * The super admin's inbox (plugin scope spec §5.1 rule 5, §13.5): what waits on the platform,
  * gathered from the sources the admin pages read (the 待确认 tab's requests and permission
@@ -96,9 +105,18 @@ let PlatformInboxService = class PlatformInboxService {
                 : a.id > b.id
                     ? 1
                     : 0);
-        const total = requestCount + pending.length + failureCount + (run === null ? 0 : 1) + noticeCount;
+        const orgUploads = pending.filter((i) => i.owner.kind === "org").length;
+        const byType = {
+            catalog_request: requestCount,
+            permission_confirmation: pending.length - orgUploads,
+            org_upload_pending: orgUploads,
+            scope_sync_failed: failureCount,
+            platform_migration: run === null ? 0 : 1,
+            ownership_transferred: noticeCount,
+        };
+        const total = Object.values(byType).reduce((a, b) => a + b, 0);
         const items = all.slice(0, PLATFORM_INBOX_MAX_ITEMS);
-        return { items, truncated: total > items.length, total };
+        return { items, truncated: total > items.length, total, byType };
     }
     /**
      * How many items wait (the sidebar's count): the same sources, counted where they can be (the

package/dist/infra/presence/presence.module.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Global: {@link ReplicaPresence}, on every role (each process reports itself; `KernelLifecycle`
+ * starts and stops it), read by the admin health overview.
+ */
+export declare class PresenceModule {
+}