@capybara-hq/kernel 0.1.0-rc.19 → 0.1.0-rc.20

package/dist/platform/ops/agent-skills.ops.js

@@ -11,8 +11,13 @@ import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { AgentsService } from "../../agents/agents.service.js";
 import { ApiError } from "../../errors.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { rootConversationOf } from "../../runtime/subagents/child.js";
+import { SandboxFileReader } from "../../sandbox/sandbox-file-reader.js";
+import { AgentSkillsService, isOrgAdmin, } from "../../skills/agent-skills.service.js";
 import { SkillChangesService } from "../../skills/changes.service.js";
 import { SkillInvoker } from "../../skills/invoke.js";
+import { SKILL_PACKAGE_MAX_BYTES } from "../../skills/package.js";
 import { AgentSkillPathParams, AgentSkillsListParams, InvocableSkillsQuerySchema, SkillChangePathParams, } from "../../skills/skills.schemas.js";
 import { SkillsService } from "../../skills/skills.service.js";
 import { defineOperation, } from "../operation.js";
@@ -22,6 +27,31 @@ import { named, orElse } from "./summary.js";
 const AgentId = AgentSkillsListParams.shape.agentId;
 const DESCRIPTION_MAX = 200;
 const clip = (s) => s.length > DESCRIPTION_MAX ? `${s.slice(0, DESCRIPTION_MAX)}…` : s;
+/** A sandbox path (the sandbox tools' bound). */
+const FILE_PATH_MAX = 4096;
+const PATH_SHOWN_MAX = 200;
+const shownPath = (p) => p.length > PATH_SHOWN_MAX ? `${p.slice(0, PATH_SHOWN_MAX)}…` : p;
+const subagentRefusal = () => new ApiError("skill.subagent_register", "A sub-agent cannot register skills on its agent; only the agent the person talks with can.");
+const subagentShareRefusal = () => new ApiError("skill.subagent_register", "A sub-agent cannot share skills; only the agent the person talks with can.");
+/** File paths shown on a share card (the rest are counted). */
+const SHARE_FILES_SHOWN = 10;
+/** The model-facing result line of `agents.share-skill`. */
+function sharedText(o, name) {
+    return o.kind === "shared"
+        ? `Shared skill "${name}" with the organization: it is now an org skill (the person maintains it) that any agent of the org can select; this agent keeps using it.`
+        : `Asked the org admins to share skill "${name}" with the organization; it waits for their decision in the inbox. Until then it stays this agent's own skill.`;
+}
+/** The model-facing result line of `agents.register-skill`. */
+function registeredText(o, files) {
+    const counted = files === null ? "" : ` (${files} file${files === 1 ? "" : "s"})`;
+    if (o.kind === "proposed") {
+        return `Proposed version ${o.version} of the org skill "${o.name}"${counted}; it waits for an org admin to approve it in the inbox. Until then only this conversation sees the new version.`;
+    }
+    const head = `${o.created ? "Created" : "Updated"} skill "${o.name}", version ${o.version}${counted}.`;
+    return o.manualOnly
+        ? `${head} It is manual-only: it is not in your skill catalog; a person invokes it with /${o.name} in any conversation with this agent.`
+        : `${head} It applies to every conversation with this agent from now on; in this run, load it with the Skill tool (skill "${o.name}").`;
+}
 const skillRow = (s) => ({
     id: s.id,
     name: s.name,
@@ -32,21 +62,81 @@ const skillRow = (s) => ({
 });
 /**
  * The skills of one agent and the skill change inbox detail (`Platform` tool, spec §14): reads of
- * the agent's own skills and of the invocable ones, detaching a skill, and the detail of a pending
- * skill change as the inbox shows it. Deciding a change stays `human-only`.
+ * the agent's own skills and of the invocable ones, registering, deleting and sharing a skill,
+ * and the detail of a skill change request as the inbox shows it. Deciding a request stays
+ * `human-only` (org admins on the web).
  */
 let AgentSkillsOperations = class AgentSkillsOperations {
     registry;
     agents;
     skills;
     changes;
+    agentSkills;
     invoker;
-    constructor(registry, agents, skills, changes, invoker) {
+    files;
+    db;
+    constructor(registry, agents, skills, changes, agentSkills, invoker, files, db) {
         this.registry = registry;
         this.agents = agents;
         this.skills = skills;
         this.changes = changes;
+        this.agentSkills = agentSkills;
         this.invoker = invoker;
+        this.files = files;
+        this.db = db;
+    }
+    /**
+     * Class of registering a skill on the run's agent: `personal` on a private agent the actor owns
+     * whose `skills.writePolicy` is not `ask`; otherwise `org` (asked every time, never remembered).
+     * Also `org` when the registration may apply a version to a shared org skill at once (the actor
+     * is an org admin maintaining one; the package name is not known before the card).
+     */
+    async registerClass(ctx) {
+        const a = await this.agents.get(ctx.orgId, ctx.agentId, ctx.actorAccountId);
+        const personal = a.visibility === "private" &&
+            a.ownerAccountId === ctx.actorAccountId &&
+            a.definition.skills?.writePolicy !== "ask";
+        if (!personal)
+            return "org";
+        return (await this.agentSkills.mayApplyOrgVersions(ctx.orgId, ctx.actorAccountId))
+            ? "org"
+            : "personal";
+    }
+    /**
+     * The refusals read before anything touches the sandbox (the reader checks only the device):
+     * a sub-agent conversation, then an actor who is not the agent's current owner.
+     */
+    async registerCheck(ctx) {
+        if ((await rootConversationOf(this.db.db, ctx.conversationId)) !== ctx.conversationId) {
+            throw subagentRefusal();
+        }
+        await this.agentSkills.assertOwner(ctx.orgId, ctx.agentId, ctx.actorAccountId);
+    }
+    /**
+     * The refusals of sharing read before the card: a sub-agent conversation, an actor who is not
+     * the agent's current owner, a skill that is not one of the agent's own.
+     */
+    async shareCheck(agentId, skillId, ctx) {
+        if ((await rootConversationOf(this.db.db, ctx.conversationId)) !== ctx.conversationId) {
+            throw subagentShareRefusal();
+        }
+        await this.agentSkills.assertOwner(ctx.orgId, agentId, ctx.actorAccountId);
+        const skill = (await this.skills.listForAgent(ctx.orgId, agentId)).find((s) => s.id === skillId);
+        if (!skill)
+            throw new ApiError("skill.not_found", "Skill not found");
+        return skill;
+    }
+    /** The file count of a registered version (null for a proposal or when the row is gone). */
+    async filesOf(o) {
+        if (o.kind !== "version")
+            return null;
+        const v = await this.db.db
+            .selectFrom("skill_versions")
+            .select("manifest")
+            .where("skill_id", "=", o.skillId)
+            .where("version", "=", o.version)
+            .executeTakeFirst();
+        return v?.manifest.files.length ?? null;
     }
     /** Class of deleting a skill: your own private agent is personal; a shared agent is the org's. */
     async deleteClass(agentId, ctx) {
@@ -168,13 +258,202 @@ let AgentSkillsOperations = class AgentSkillsOperations {
                     };
                 },
                 run: async (input, ctx) => {
-                    await this.changes.deleteAgentSkill(ctx.orgId, input.agentId, input.skillId, ctx.actorAccountId, undefined, viaAgent("agents.delete-skill", ctx));
+                    await this.agentSkills.deleteAgentSkill(ctx.orgId, input.agentId, input.skillId, ctx.actorAccountId, undefined, viaAgent("agents.delete-skill", ctx));
                     return { id: input.skillId, deleted: true };
                 },
             }),
+            defineOperation({
+                id: "agents.register-skill",
+                description: "Register a zip package from your sandbox as one of this agent's own skills: a new skill, or the next version of this agent's skill with the same name. Build the package in the sandbox first: a zip with SKILL.md at its root (frontmatter name and description, then the instructions) plus any scripts or references, then pass its absolute path. Only the agent's owner can, and only from the conversation the person talks in (not a sub-agent). The new version applies to every conversation with this agent; in this run, load it with Skill. When the person maintains a shared org skill of the same name (and this agent has no own skill of it), the package is that skill's next version: an org admin applies it at once, anyone else's is proposed to the org admins and only this conversation uses it until approved.",
+                input: z.object({ filePath: z.string().min(1).max(FILE_PATH_MAX) }).strict(),
+                example: { filePath: "/workspace/out/weekly-report.zip" },
+                authz: { orgAction: "agents.create" },
+                mirrors: ["POST /api/v1/orgs/:orgId/agents/:agentId/skills"],
+                // the agent is always the run's own (ctx.agentId); the zip comes from the sandbox
+                omits: ["agentId", "uploadId"],
+                extras: ["filePath"],
+                confirm: "personal",
+                confirmFor: (_i, ctx) => this.registerClass(ctx),
+                errors: [
+                    {
+                        code: "skill.subagent_register",
+                        next: "Hand the skill files back to your parent agent; only the agent the person talks with registers skills.",
+                    },
+                    {
+                        code: "forbidden",
+                        next: "Only the agent's owner can add or update its skills; tell the person, and the owner can register the package (or upload it on the agent's page).",
+                    },
+                    {
+                        code: "agent.not_found",
+                        next: "This agent is deleted or no longer visible to the person; tell them.",
+                    },
+                    {
+                        code: "sandbox.file_invalid_path",
+                        next: "Pass the absolute path of the zip inside the sandbox (e.g. under the workspace); check it with Glob.",
+                    },
+                    {
+                        code: "sandbox.file_not_found",
+                        next: "Check the path with Glob, or build the zip first with Bash (cd into the skill directory, then zip -r ../<name>.zip .).",
+                    },
+                    {
+                        code: "sandbox.file_is_directory",
+                        next: "Archive the directory into one zip with Bash (zip -r) and pass the zip's path.",
+                    },
+                    {
+                        code: "sandbox.file_too_large",
+                        next: "The package is over 50 MB; leave out large or generated files, rebuild the zip and retry.",
+                    },
+                    {
+                        code: "skill.invalid_package",
+                        next: "Fix the package as the message says (SKILL.md at the zip's root with name and description frontmatter, allowed paths and sizes), rebuild the zip and retry.",
+                    },
+                    {
+                        code: "skill.agent_cap",
+                        next: "Register a new version of an existing skill (same name) instead, or ask the agent's owner to delete one of its skills (agents.skills lists them).",
+                    },
+                    {
+                        code: "skill.name_exists",
+                        next: "This agent uses an org skill with this name that only its maintainer can update; change the name in SKILL.md, rebuild the zip and register again, or ask the skill's maintainer.",
+                    },
+                    {
+                        code: "catalog.custom_disabled",
+                        next: "This deployment does not allow custom org skills, so this version of a shared skill cannot be registered; tell the person.",
+                    },
+                    {
+                        code: "skill.proposal_pending_elsewhere",
+                        next: "Another conversation has a proposed version of this skill waiting for an org admin; wait for that decision, or continue in that conversation.",
+                    },
+                    {
+                        code: "storage.unavailable",
+                        next: "File storage is unavailable; try again later, or tell the person to contact the super admin.",
+                    },
+                ],
+                precheck: (_i, ctx) => precheckBy(() => this.registerCheck(ctx)),
+                summary: (i) => ({
+                    zh: `从 ${shownPath(i.filePath)} 为智能体登记技能`,
+                    en: `Register a skill on this agent from ${shownPath(i.filePath)}`,
+                }),
+                run: async (input, ctx) => {
+                    await this.registerCheck(ctx);
+                    const zip = await this.files.read({
+                        orgId: ctx.orgId,
+                        conversationId: ctx.conversationId,
+                        actorAccountId: ctx.actorAccountId,
+                        path: input.filePath,
+                        maxBytes: SKILL_PACKAGE_MAX_BYTES,
+                        signal: ctx.signal,
+                    });
+                    const o = await this.agentSkills.register({
+                        orgId: ctx.orgId,
+                        agentId: ctx.agentId,
+                        accountId: ctx.actorAccountId,
+                        conversationId: ctx.conversationId,
+                        runId: ctx.runId,
+                        auditDetail: viaAgent("agents.register-skill", ctx),
+                    }, zip);
+                    const files = await this.filesOf(o);
+                    return {
+                        skill: {
+                            id: o.skillId,
+                            name: o.name,
+                            state: o.kind === "proposed" ? "pending" : o.manualOnly ? "manual" : "active",
+                            version: o.version,
+                            ...(files !== null && { files }),
+                            ...(o.kind === "proposed" && { requestId: o.requestId }),
+                        },
+                        message: registeredText(o, files),
+                    };
+                },
+            }),
+            defineOperation({
+                id: "agents.share-skill",
+                description: "Share one of an agent's own skills with the organization, so any agent of the org can select it; the agent keeps using it and the person becomes its maintainer (later versions they register on their agents are proposed to the org admins). An org admin shares at once; anyone else's ask waits for an org admin's decision in the inbox. Only the agent's owner can; takes the agent id from agents.list and the skill id from agents.skills.",
+                input: z.object({ agentId: AgentId, skillId: AgentSkillPathParams.shape.skillId }).strict(),
+                example: {
+                    agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77",
+                    skillId: "0b9f2c4e-1d3a-4c55-9e0a-7a2f6d1c8b11",
+                },
+                authz: { orgAction: "agents.create" },
+                mirrors: ["POST /api/v1/orgs/:orgId/agents/:agentId/skills/:skillId/share"],
+                confirm: "personal",
+                // an org admin's share changes the org's skill library at once: an org write, every time
+                confirmFor: async (_i, ctx) => (await isOrgAdmin(this.db.db, ctx.orgId, ctx.actorAccountId)) ? "org" : "personal",
+                errors: [
+                    {
+                        code: "skill.subagent_register",
+                        next: "Tell your parent agent which skill to share; only the agent the person talks with shares skills.",
+                    },
+                    {
+                        code: "agent.not_found",
+                        next: "Check the agent id with agents.list: only agents you can see are readable.",
+                    },
+                    {
+                        code: "forbidden",
+                        next: "Only the agent's owner can share its skills; tell the person, and the owner can share it on the agent's page.",
+                    },
+                    {
+                        code: "skill.not_found",
+                        next: "Check the skill id with agents.skills: only the agent's own skills can be shared, and a shared one is no longer listed there.",
+                    },
+                    {
+                        code: "skill.name_exists",
+                        next: "The organization already has a skill with this name; register the package again under another name, then share that skill.",
+                    },
+                    {
+                        code: "catalog.custom_disabled",
+                        next: "This deployment does not allow custom org skills; the skill stays the agent's own. Tell the person.",
+                    },
+                    {
+                        code: "skill.share_pending",
+                        next: "Sharing this skill already waits for an org admin; nothing more to do until they decide.",
+                    },
+                ],
+                precheck: (i, ctx) => precheckBy(async () => {
+                    await this.shareCheck(i.agentId, i.skillId, ctx);
+                }),
+                summary: async (i, ctx) => {
+                    const skill = await orElse(async () => named((await this.shareCheck(i.agentId, i.skillId, ctx)).name), i.skillId);
+                    // the card shows the files, so someone has seen what enters the org's skill library
+                    const files = await orElse(async () => {
+                        const s = (await this.skills.listForAgent(ctx.orgId, i.agentId)).find((x) => x.id === i.skillId);
+                        if (!s)
+                            return "";
+                        const v = await this.db.db
+                            .selectFrom("skill_versions")
+                            .select("manifest")
+                            .where("skill_id", "=", s.id)
+                            .where("version", "=", s.currentVersion)
+                            .executeTakeFirst();
+                        const paths = v?.manifest.files.map((f) => f.path) ?? [];
+                        const shown = paths.slice(0, SHARE_FILES_SHOWN).join(", ");
+                        const more = paths.length - SHARE_FILES_SHOWN;
+                        return more > 0 ? `${shown} (+${more})` : shown;
+                    }, "");
+                    const tail = files === "" ? "" : `: ${files}`;
+                    return {
+                        zh: `将技能「${skill}」共享到组织${tail}`,
+                        en: `Share skill "${skill}" with the organization${tail}`,
+                    };
+                },
+                run: async (input, ctx) => {
+                    const skill = await this.shareCheck(input.agentId, input.skillId, ctx);
+                    const o = await this.agentSkills.share({
+                        orgId: ctx.orgId,
+                        agentId: input.agentId,
+                        accountId: ctx.actorAccountId,
+                        auditDetail: viaAgent("agents.share-skill", ctx),
+                    }, input.skillId);
+                    return {
+                        share: o,
+                        name: skill.name,
+                        state: o.kind === "shared" ? "shared" : "pending",
+                        message: sharedText(o, skill.name),
+                    };
+                },
+            }),
             defineOperation({
                 id: "skills.get-change",
-                description: "Read one skill change a shared agent proposed, as the inbox shows it: the agent, the skill name and description, the version it would become, its file paths and sizes, who asked, its state and who decided. Never file contents: review those on the web, where you also decide it (agents never decide skill changes). Only the agent's owner and the person who asked can read it.",
+                description: "Read one skill change request as the inbox shows it: a share of an agent's skill with the org or a proposed version of a shared skill (kind), the agent, the skill name and description, the version, its file paths and sizes, who asked, its state and who decided. Never file contents: review those on the web, where org admins decide it (agents never decide skill changes). Only org admins and the person who asked can read it.",
                 input: z.object({ changeId: SkillChangePathParams.shape.id }).strict(),
                 example: { changeId: "6a1d3e5f-2b4c-4d70-8e91-0f2a4c6e8b13" },
                 // approvals.decide is stricter than the service (a plain-member requester is refused by
@@ -186,7 +465,7 @@ let AgentSkillsOperations = class AgentSkillsOperations {
                 errors: [
                     {
                         code: "skill_change.not_found",
-                        next: "No change with this id is yours to read; the inbox lists those waiting for you (inbox.list).",
+                        next: "No change with this id is yours to read; org admins see the pending ones in the inbox (inbox.list).",
                     },
                 ],
                 run: async (input, ctx) => {
@@ -194,6 +473,7 @@ let AgentSkillsOperations = class AgentSkillsOperations {
                     return {
                         skillChange: {
                             id: d.id,
+                            kind: d.kind,
                             name: d.name,
                             state: d.status,
                             description: d.description,
@@ -221,6 +501,9 @@ AgentSkillsOperations = __decorate([
     __param(1, Inject(AgentsService)),
     __param(2, Inject(SkillsService)),
     __param(3, Inject(SkillChangesService)),
-    __param(4, Inject(SkillInvoker))
+    __param(4, Inject(AgentSkillsService)),
+    __param(5, Inject(SkillInvoker)),
+    __param(6, Inject(SandboxFileReader)),
+    __param(7, Inject(KernelDb))
 ], AgentSkillsOperations);
 export { AgentSkillsOperations };

package/dist/platform/ops/inbox.ops.js

@@ -79,12 +79,14 @@ function orgRow(i) {
         }
         case "skill_change": {
             const c = i.skillChange;
-            const what = c.skillId === null ? "a new skill" : `version ${c.version}`;
+            const by = c.requestedByName || "a deleted account";
             return {
                 ...base,
                 name: c.name,
                 state: c.status,
-                summary: `Skill change for agent ${c.agent.name} by ${c.requestedByName || "a deleted account"}: ${what}, ${c.files.length} file(s).`,
+                summary: c.kind === "share"
+                    ? `Request by ${by} to share skill ${c.name} of agent ${c.agent.name} with the organization, ${c.files.length} file(s).`
+                    : `Proposed version ${c.version} of the shared skill ${c.name} by ${by} (agent ${c.agent.name}), ${c.files.length} file(s).`,
                 next: "Review and decide it on the web, in the inbox; agents never decide skill changes.",
             };
         }
@@ -254,7 +256,7 @@ let InboxOperations = class InboxOperations {
         this.registry.register([
             defineOperation({
                 id: "inbox.list",
-                description: "List your inbox in this org, newest first, one compact row each (type, what it is about, state, the summary the inbox shows, your next step): tool call approvals waiting for you, skill changes you can decide, and for org admins the members' pending requests and the org's notices; your own decided requests too. Never a call's input. Deciding is done by you on the web; notices can be dismissed with inbox.dismiss-notice. Pages by 50: pass the returned next as params.cursor.",
+                description: "List your inbox in this org, newest first, one compact row each (type, what it is about, state, the summary the inbox shows, your next step): tool call approvals waiting for you, and for org admins the skill share requests and proposed skill versions, the members' pending requests and the org's notices; your own decided requests too. Never a call's input. Deciding is done by you on the web; notices can be dismissed with inbox.dismiss-notice. Pages by 50: pass the returned next as params.cursor.",
                 input: z.object({ cursor: Cursor.optional() }).strict(),
                 example: {},
                 authz: { orgAction: "approvals.decide" },
@@ -302,7 +304,7 @@ let InboxOperations = class InboxOperations {
             }),
             defineOperation({
                 id: "inbox.platform-list",
-                description: "List the platform inbox (super admin), newest first, one compact row each (type, what, state, summary, next step): orgs' requests to the platform, plugins waiting for a permission confirmation, this org's uploads waiting for you, failed scope syncs, a failed or stuck components migration and ownership notices. Only the newest 100 items are read (truncated: more wait); listed is how many of them are shown, otherOrgItems how many are items of plugins other orgs own (only counted). total counts everything waiting on the platform, other orgs' items included, as the admin console does. Nothing is decided here: requests and confirmations are done in the admin console. Pages by 50: pass the returned next as params.cursor.",
+                description: "List the platform inbox (super admin), newest first, one compact row each (type, what, state, summary, next step): orgs' requests to the platform, plugins waiting for a permission confirmation, this org's uploads waiting for you, failed scope syncs, a failed or stuck components migration and ownership notices. Only the newest 100 items are read (truncated: more wait); listed is how many of them are shown, otherOrgItems how many are items of plugins other orgs own (only counted). total counts everything waiting on the platform, other orgs' items included, as the admin console does; byType splits total by type (everything waiting, not the listed page). Nothing is decided here: requests and confirmations are done in the admin console. Pages by 50: pass the returned next as params.cursor.",
                 input: z.object({ cursor: Cursor.optional() }).strict(),
                 example: {},
                 authz: { superAdmin: true },
@@ -331,6 +333,7 @@ let InboxOperations = class InboxOperations {
                     return {
                         ...page,
                         total: view.total,
+                        byType: view.byType,
                         listed: shown.length,
                         truncated: view.truncated,
                         otherOrgItems: view.items.length - shown.length,

package/dist/platform/ops/platform.ops.js

@@ -30,7 +30,7 @@ const BUILDS = [
 ];
 const FAMILIES = [
     "Platform: this tool, for the org's skills, agents, agent templates, plugins, connectors and requests.",
-    "Skill and SkillWrite: use and write the skills of this agent.",
+    "Skill: use the skills of this agent.",
     "Agent, SendMessage, SubagentHandback: dispatch and talk to sub-agents.",
     "Bash, Read, Write, Edit, Glob, Grep, Deliver: work in the conversation's sandbox.",
     "WebSearch, WebFetch: reach the web through the org's providers.",

package/dist/platform/ops/skills.ops.js

@@ -10,7 +10,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { OwnedItems } from "../../catalog/owned-items.js";
-import { SkillCreateFields, SkillIdParams, SkillPathParams, SkillShareableSchema, } from "../../skills/skills.schemas.js";
+import { SkillIdParams, SkillPathParams, SkillShareableSchema, } from "../../skills/skills.schemas.js";
 import { SkillsService } from "../../skills/skills.service.js";
 import { defineOperation } from "../operation.js";
 import { PlatformOperations } from "../registry.js";
@@ -18,7 +18,6 @@ import { precheckBy, viaAgent } from "./errors.js";
 import { named, orElse } from "./summary.js";
 const NoInput = z.object({}).strict();
 const SkillId = z.object({ skillId: SkillPathParams.shape.id.max(100) }).strict();
-const Create = SkillCreateFields.shape;
 const OwnedSkillId = z.object({ skillId: SkillIdParams.shape.id }).strict();
 /**
  * Skill library operations of the `Platform` tool (spec §7). The skill body can be long; `get`
@@ -60,61 +59,6 @@ let SkillsOperations = class SkillsOperations {
                 confirm: "read",
                 run: async (input, ctx) => this.skills.get(ctx.orgId, input.skillId),
             }),
-            defineOperation({
-                id: "skills.create",
-                description: "Create an org skill from text: a name, a one-line description of when to use it, and the SKILL.md body. A skill of that name must not exist yet. Uploads of packages are done on the web.",
-                // the route's text form, its bounds tightened for the model (a SKILL.md up to 100k chars)
-                input: z
-                    .object({
-                    name: Create.name.unwrap().max(64),
-                    description: Create.description.unwrap(),
-                    body: Create.body.unwrap().min(1).max(100_000),
-                    shareable: Create.shareable,
-                })
-                    .strict(),
-                example: {
-                    name: "weekly-report",
-                    description: "Use when asked to write the weekly status report.",
-                    body: "# Steps\n\n1. Collect this week's updates.\n2. Write the report.",
-                },
-                authz: { orgAction: "skills.manage" },
-                mirrors: ["POST /api/v1/orgs/:orgId/skills"],
-                // packages are uploaded on the web
-                omits: ["uploadId"],
-                confirm: "org",
-                errors: [
-                    {
-                        code: "skill.name_exists",
-                        next: "A skill of that name exists: pick another name, or read the existing one with skills.get.",
-                    },
-                    {
-                        code: "validation_failed",
-                        next: "Fix the SKILL.md as the message says (name, description, body), then call again.",
-                    },
-                    {
-                        code: "catalog.custom_disabled",
-                        next: {
-                            superAdmin: "The platform does not allow custom skills: allow them in the admin console under Settings, then call again.",
-                            orgAdmin: "The platform does not allow custom skills; ask the super admin, or use a platform skill from skills.list.",
-                            member: "The platform does not allow custom skills; use a platform skill from skills.list, or ask an org admin.",
-                        },
-                    },
-                ],
-                precheck: (i, ctx) => precheckBy(() => this.skills.checkCreateFromText(ctx.orgId, i)),
-                summary: (i) => i.shareable === true
-                    ? {
-                        zh: `新建组织技能「${i.name}」（可共享给其他组织）`,
-                        en: `Create org skill "${i.name}" (shared with other orgs)`,
-                    }
-                    : { zh: `新建组织技能「${i.name}」`, en: `Create org skill "${i.name}"` },
-                run: async (input, ctx) => this.skills.createFromText(ctx.orgId, ctx.actorAccountId, {
-                    name: input.name,
-                    description: input.description,
-                    body: input.body,
-                    ...(input.shareable !== undefined && { shareable: input.shareable }),
-                    auditDetail: viaAgent("skills.create", ctx),
-                }),
-            }),
             defineOperation({
                 id: "skills.set-shareable",
                 description: "Set whether an org skill may be shared with other orgs. Only the org's own skills can be changed; a skill that came from a platform plugin cannot.",

package/dist/platform/platform-ops.module.d.ts

@@ -1,5 +1,6 @@
 import { AccountsOperations } from "./ops/accounts.ops.js";
 import { AdminOperations } from "./ops/admin.ops.js";
+import { AdminItemsOperations } from "./ops/admin-items.ops.js";
 import { AgentSkillsOperations } from "./ops/agent-skills.ops.js";
 import { AgentTemplatesOperations } from "./ops/agent-templates.ops.js";
 import { AgentsOperations } from "./ops/agents.ops.js";
@@ -32,7 +33,7 @@ import { UiOperations } from "./ops/ui.ops.js";
  * One provider per domain, each taking `PlatformOperations` as its first constructor argument:
  * the parity test in `tools/checks` builds the operations from it without a Nest app.
  */
-export declare const PLATFORM_OPERATION_PROVIDERS: readonly [typeof PlatformOperationsProvider, typeof SkillsOperations, typeof AgentsOperations, typeof AgentTemplatesOperations, typeof PluginsOperations, typeof MarketplacesOperations, typeof RequestsOperations, typeof ConnectorsOperations, typeof ExtensionsOperations, typeof ConversationsOperations, typeof ComponentsOperations, typeof AccountsOperations, typeof OrgsOperations, typeof AdminOperations, typeof CatalogAdminOperations, typeof OrgPluginsOperations, typeof ExtensionsAdminOperations, typeof ModelsOperations, typeof InboxOperations, typeof ApprovalsOperations, typeof ChannelsOperations, typeof OrgSettingsOperations, typeof EvalsOperations, typeof BackgroundOperations, typeof PreviewersOperations, typeof DevicesOperations, typeof AgentSkillsOperations, typeof ThemesOperations, typeof SetupOperations, typeof UiOperations];
+export declare const PLATFORM_OPERATION_PROVIDERS: readonly [typeof PlatformOperationsProvider, typeof SkillsOperations, typeof AgentsOperations, typeof AgentTemplatesOperations, typeof PluginsOperations, typeof MarketplacesOperations, typeof RequestsOperations, typeof ConnectorsOperations, typeof ExtensionsOperations, typeof ConversationsOperations, typeof ComponentsOperations, typeof AccountsOperations, typeof OrgsOperations, typeof AdminOperations, typeof CatalogAdminOperations, typeof OrgPluginsOperations, typeof ExtensionsAdminOperations, typeof ModelsOperations, typeof InboxOperations, typeof ApprovalsOperations, typeof ChannelsOperations, typeof OrgSettingsOperations, typeof EvalsOperations, typeof BackgroundOperations, typeof PreviewersOperations, typeof DevicesOperations, typeof AgentSkillsOperations, typeof ThemesOperations, typeof SetupOperations, typeof UiOperations, typeof AdminItemsOperations];
 /**
  * The `Platform` tool's operations (ruling P2): one provider per domain, each registering its
  * operations into `PlatformOperations` from `onModuleInit`. It imports the domain modules, which

package/dist/platform/platform-ops.module.js

@@ -5,6 +5,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { Module } from "@nestjs/common";
+import { AdminModule } from "../admin/admin.module.js";
 import { AgentsModule } from "../agents/agents.module.js";
 import { BackgroundModule } from "../background/background.module.js";
 import { AppearanceModule } from "../catalog/appearance.service.js";
@@ -26,6 +27,7 @@ import { ThemesModule } from "../themes/themes.module.js";
 import { ToolsModule } from "../tools/tools.module.js";
 import { AccountsOperations } from "./ops/accounts.ops.js";
 import { AdminOperations } from "./ops/admin.ops.js";
+import { AdminItemsOperations } from "./ops/admin-items.ops.js";
 import { AgentSkillsOperations } from "./ops/agent-skills.ops.js";
 import { AgentTemplatesOperations } from "./ops/agent-templates.ops.js";
 import { AgentsOperations } from "./ops/agents.ops.js";
@@ -99,6 +101,8 @@ export const PLATFORM_OPERATION_PROVIDERS = [
     SetupOperations,
     // UI slot catalog (UI slots spec §3)
     UiOperations,
+    // every org's agents and connectors, the conversation org's through the tool (spec §4.5)
+    AdminItemsOperations,
 ];
 /**
  * The `Platform` tool's operations (ruling P2): one provider per domain, each registering its
@@ -111,6 +115,7 @@ PlatformOpsModule = __decorate([
     Module({
         imports: [
             PlatformModule,
+            AdminModule,
             SkillsModule,
             AgentsModule,
             OrgsModule,

package/dist/platform/route-schemas.js

@@ -1,5 +1,8 @@
 import { ADMIN_ROUTES } from "../admin/admin.schemas.js";
+import { ADMIN_ITEM_ROUTES } from "../admin/admin-items.schemas.js";
+import { AUDIT_ROUTES } from "../admin/audit.schemas.js";
 import { ADMIN_EXTENSION_ROUTES } from "../admin/extensions.schemas.js";
+import { OVERVIEW_ROUTES } from "../admin/overview.schemas.js";
 import { AGENT_ROUTES } from "../agents/agents.schemas.js";
 import { AGENT_TEMPLATE_ROUTES } from "../agents/templates.schemas.js";
 import { BACKGROUND_ROUTES } from "../background/background.schemas.js";
@@ -74,4 +77,9 @@ export const ROUTE_SCHEMAS = [
     ...SETUP_GUIDE_ROUTES,
     // UI slots (UI slots spec §3)
     ...UI_ROUTES,
+    // every org's agents and connectors (admin agents and connectors spec §4)
+    ...ADMIN_ITEM_ROUTES,
+    // the admin overview and the platform-level audit log (admin overview spec §5.2)
+    ...OVERVIEW_ROUTES,
+    ...AUDIT_ROUTES,
 ];

package/dist/roles/gateway-role.d.ts

@@ -37,6 +37,10 @@ export declare class GatewayRole {
      * `checkpoint` throws when a stop began meanwhile.
      */
     start(checkpoint: () => void): Promise<void>;
+    /** The channel long connections this process holds (replica presence). */
+    channelsHeld(): number;
+    /** The device sockets open on this process (replica presence). */
+    devicesConnected(): number;
     /** Stops watching extension instance changes (the stop's first step). */
     unwatch(): void;
     /** Ends the webhook cache's `channel.changed` subscription. */

package/dist/roles/gateway-role.js

@@ -82,6 +82,14 @@ let GatewayRole = class GatewayRole {
         this.unwatchWebhooks = this.host.onChange(() => webhooks.invalidateAll());
         checkpoint();
     }
+    /** The channel long connections this process holds (replica presence). */
+    channelsHeld() {
+        return this.supervisor.heldCount();
+    }
+    /** The device sockets open on this process (replica presence). */
+    devicesConnected() {
+        return this.devices.connectionCount();
+    }
     /** Stops watching extension instance changes (the stop's first step). */
     unwatch() {
         this.unwatchPlugins?.();

package/dist/runtime/run-jobs.js

@@ -78,14 +78,16 @@ RunJobs = __decorate([
     __param(3, Inject(KERNEL_LOGGER))
 ], RunJobs);
 export { RunJobs };
+/** The run queues' registration (re-exported: the admin health reads their counts). */
+const RUN_QUEUES_MODULE = QueueModule.registerQueue(RUN_QUEUE_NAME, SUBAGENT_RUN_QUEUE_NAME);
 /** The run queues' producer (the sub-agent dispatch, the run queue and the waits use it). */
 let RunJobsModule = class RunJobsModule {
 };
 RunJobsModule = __decorate([
     Module({
-        imports: [QueueModule.registerQueue(RUN_QUEUE_NAME, SUBAGENT_RUN_QUEUE_NAME)],
+        imports: [RUN_QUEUES_MODULE],
         providers: [RunJobs],
-        exports: [RunJobs],
+        exports: [RunJobs, RUN_QUEUES_MODULE],
     })
 ], RunJobsModule);
 export { RunJobsModule };