@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.20

package/dist/admin/extensions.controller.d.ts

@@ -3,6 +3,7 @@ import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
 import { type DeploymentConfigView, ExtensionDeploymentConfigService } from "../extensions/deployment-config.js";
 import { ExtensionInstalls, type PackageReview } from "../extensions/installs.js";
+import { type OrgOverrideSummary, OrgOverrides } from "../extensions/org-overrides.js";
 import type { AdminExtensionView } from "../extensions/permission-view.js";
 import { type Principal } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
@@ -15,13 +16,23 @@ declare const InstallSchema: z.ZodObject<{
 }, z.core.$strip>;
 declare const ConfigSchema: z.ZodObject<{
     values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    secretEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        key: z.ZodString;
+        value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        renameFrom: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strip>;
 declare const NpmSchema: z.ZodObject<{
     package: z.ZodString;
     version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+declare const NameParams: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -33,7 +44,8 @@ export declare class AdminExtensionsController {
     private readonly ops;
     private readonly deploymentConfigs;
     private readonly kernelConfig;
-    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: KernelConfigService);
+    private readonly orgOverrides;
+    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: KernelConfigService, orgOverrides: OrgOverrides);
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
      * 在途工具调用最多等待的秒数（`extensionHost.drainSeconds`，界面提示用）。
@@ -50,6 +62,14 @@ export declare class AdminExtensionsController {
      * result. Unknown -> 404 `extension.not_found`.
      */
     config(name: string): Promise<DeploymentConfigView>;
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    orgCopies({ name }: z.infer<typeof NameParams>): Promise<{
+        overrides: OrgOverrideSummary[];
+    }>;
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid
@@ -57,9 +77,20 @@ export declare class AdminExtensionsController {
      * (a value from the startup config) does not block the PUT: it saves anyway, the extension stays
      * pending configuration and the startup config has to change. Every replica re-reads after saving:
      * hot fields are replaced in place, other fields reload the extension, and a pending extension
-     * loads (no restart).
+     * loads (no restart). `secretEntries` set, rename or remove single keys of a secret record a
+     * config UI hint draws per item (a path no hint names -> 400 `validation_failed`).
      */
     putConfig(principal: Principal, name: string, body: z.infer<typeof ConfigSchema>): Promise<DeploymentConfigView>;
+    /**
+     * Clears the deployment config saved here: the stored fields and every stored secret value of
+     * the extension; audits `extension.config_cleared`. Fields from the startup config (file / Nacos
+     * / env) cannot be removed here: they stay in effect and the returned view still shows them
+     * (`readonly`, with their `source`). Every replica re-reads, the same way as after a PUT: the
+     * extension loads from what remains, or becomes pending configuration when that is missing or
+     * invalid (no restart). Nothing stored -> no change (no audit). Unknown -> 404
+     * `extension.not_found`.
+     */
+    clearConfig(principal: Principal, name: string): Promise<DeploymentConfigView>;
     /**
      * Web approval: writes the snapshot (source web), audits `extension.permissions_approved` and
      * publishes `kernel.plugins.changed`. Package or

package/dist/admin/extensions.controller.js

@@ -14,10 +14,11 @@ import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
 import { ExtensionDeploymentConfigService, } from "../extensions/deployment-config.js";
 import { ExtensionInstalls } from "../extensions/installs.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { OrgOverrides } from "../extensions/org-overrides.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
-import { ZBody } from "../infra/validation/zod-params.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
 const ApproveSchema = z.object({
     /** 安装记录的包（审阅时的 sha256）；配置声明的插件为 null。 */
     sha256: z
@@ -30,9 +31,28 @@ const InstallSchema = z.object({
     /** 包存储里的包（上传 / npm 导入返回的 sha256）。 */
     sha256: z.string().regex(/^[0-9a-f]{64}$/),
 });
+const SecretEntrySchema = z
+    .object({
+    /** A secret record field some `x-ui.secrets[].path` names. */
+    path: z.string().min(1).max(256),
+    key: z.string().min(1).max(256),
+    /** A string sets the key, `null` removes it. */
+    value: z.string().max(65_536).nullable().optional(),
+    /** Moves the value at this key to `key` first. */
+    renameFrom: z.string().min(1).max(256).optional(),
+})
+    .strict()
+    .refine((e) => e.value !== undefined || e.renameFrom !== undefined, {
+    message: "an entry needs value or renameFrom",
+})
+    .refine((e) => e.key !== "__proto__" && e.renameFrom !== "__proto__", {
+    message: "__proto__ is not a valid key",
+});
 const ConfigSchema = z.object({
     /** 字段点路径 → 新值（`null` 清除）。 */
     values: z.record(z.string().min(1).max(256), z.unknown()),
+    /** Single keys of hinted secret records (extension config forms spec §4.3), applied in order. */
+    secretEntries: z.array(SecretEntrySchema).max(200).optional(),
 });
 const NpmSchema = z.object({
     package: z.string().min(1).max(214),
@@ -46,8 +66,12 @@ class ExtensionConfigBody extends createZodDto(ConfigSchema, "ExtensionConfigBod
 }
 class ExtensionNpmImportBody extends createZodDto(NpmSchema, "ExtensionNpmImportBody") {
 }
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+const NameParams = z.object({ name: z.string().min(1).max(64) });
+class AdminExtensionNameParamsDto extends createZodDto(NameParams, "AdminExtensionNameParams") {
+}
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -59,14 +83,16 @@ let AdminExtensionsController = class AdminExtensionsController {
     ops;
     deploymentConfigs;
     kernelConfig;
+    orgOverrides;
     constructor(installs, admin, ops, deploymentConfigs, 
     // 字段名不能与路由方法同名（如 `config`）：实例字段会遮住原型上的处理函数
-    kernelConfig) {
+    kernelConfig, orgOverrides) {
         this.installs = installs;
         this.admin = admin;
         this.ops = ops;
         this.deploymentConfigs = deploymentConfigs;
         this.kernelConfig = kernelConfig;
+        this.orgOverrides = orgOverrides;
     }
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
@@ -90,6 +116,14 @@ let AdminExtensionsController = class AdminExtensionsController {
     config(name) {
         return this.deploymentConfigs.view(name);
     }
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    async orgCopies({ name }) {
+        return { overrides: await this.orgOverrides.listForPlugin(name) };
+    }
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid
@@ -97,11 +131,25 @@ let AdminExtensionsController = class AdminExtensionsController {
      * (a value from the startup config) does not block the PUT: it saves anyway, the extension stays
      * pending configuration and the startup config has to change. Every replica re-reads after saving:
      * hot fields are replaced in place, other fields reload the extension, and a pending extension
-     * loads (no restart).
+     * loads (no restart). `secretEntries` set, rename or remove single keys of a secret record a
+     * config UI hint draws per item (a path no hint names -> 400 `validation_failed`).
      */
     putConfig(principal, name, body) {
         const actor = requireUser(principal);
-        return this.deploymentConfigs.put(name, body.values, actor.account.id, patTokenId(actor));
+        return this.deploymentConfigs.put(name, body.values, actor.account.id, patTokenId(actor), body.secretEntries);
+    }
+    /**
+     * Clears the deployment config saved here: the stored fields and every stored secret value of
+     * the extension; audits `extension.config_cleared`. Fields from the startup config (file / Nacos
+     * / env) cannot be removed here: they stay in effect and the returned view still shows them
+     * (`readonly`, with their `source`). Every replica re-reads, the same way as after a PUT: the
+     * extension loads from what remains, or becomes pending configuration when that is missing or
+     * invalid (no restart). Nothing stored -> no change (no audit). Unknown -> 404
+     * `extension.not_found`.
+     */
+    clearConfig(principal, name) {
+        const actor = requireUser(principal);
+        return this.deploymentConfigs.clear(name, actor.account.id, patTokenId(actor));
     }
     /**
      * Web approval: writes the snapshot (source web), audits `extension.permissions_approved` and
@@ -177,12 +225,21 @@ __decorate([
     Get(":name/config"),
     __param(0, Param("name"))
 ], AdminExtensionsController.prototype, "config", null);
+__decorate([
+    Get(":name/org-overrides"),
+    __param(0, ZParam(AdminExtensionNameParamsDto))
+], AdminExtensionsController.prototype, "orgCopies", null);
 __decorate([
     Put(":name/config"),
     __param(0, CurrentPrincipal()),
     __param(1, Param("name")),
     __param(2, ZBody(ExtensionConfigBody))
 ], AdminExtensionsController.prototype, "putConfig", null);
+__decorate([
+    Delete(":name/config"),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("name"))
+], AdminExtensionsController.prototype, "clearConfig", null);
 __decorate([
     Post(":name/approve"),
     HttpCode(200),
@@ -229,11 +286,12 @@ __decorate([
 ], AdminExtensionsController.prototype, "fromNpm", null);
 AdminExtensionsController = __decorate([
     Controller("api/v1/admin/extensions"),
-    EnterpriseAdmin(),
+    SuperAdmin(),
     __param(0, Inject(ExtensionInstalls)),
     __param(1, Inject(ExtensionAdmin)),
     __param(2, Inject(ExtensionAdminOps)),
     __param(3, Inject(ExtensionDeploymentConfigService)),
-    __param(4, Inject(KernelConfigService))
+    __param(4, Inject(KernelConfigService)),
+    __param(5, Inject(OrgOverrides))
 ], AdminExtensionsController);
 export { AdminExtensionsController };

package/dist/admin/extensions.schemas.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** `:name` as the lifecycle and detail routes take it (`@Param`). */
+export declare const AdminExtensionNamePathParams: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const ADMIN_EXTENSION_ROUTES: readonly RouteSchemas[];

package/dist/admin/extensions.schemas.js

@@ -0,0 +1,10 @@
+import { z } from "zod";
+/** `:name` as the lifecycle and detail routes take it (`@Param`). */
+export const AdminExtensionNamePathParams = z.object({ name: z.string().min(1) });
+export const ADMIN_EXTENSION_ROUTES = [
+    { route: "GET /api/v1/admin/extensions" },
+    { route: "GET /api/v1/admin/extensions/:name", params: AdminExtensionNamePathParams },
+    { route: "POST /api/v1/admin/extensions/:name/enable", params: AdminExtensionNamePathParams },
+    { route: "POST /api/v1/admin/extensions/:name/disable", params: AdminExtensionNamePathParams },
+    { route: "DELETE /api/v1/admin/extensions/:name", params: AdminExtensionNamePathParams },
+];

package/dist/admin/health.service.d.ts

@@ -0,0 +1,104 @@
+import type { Queue } from "bullmq";
+import type { Redis } from "ioredis";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { type LiveReplica, ReplicaPresence } from "../infra/presence/replica-presence.js";
+import type { KernelLogger } from "../log.js";
+/** The kernel's own queues, in the order the overview lists them (extension queues are not read). */
+export declare const KERNEL_QUEUE_NAMES: readonly ["cap-kernel-runs", "cap-kernel-subagent-runs", "cap-kernel-channels", "cap-kernel-maintenance", "cap-kernel-plugin-scope", "cap-kernel-titles", "cap-kernel-usage-report", "cap-kernel-evals"];
+/** How long each source's reads may take before the answer marks it unavailable. */
+export declare const HEALTH_READ_TIMEOUT_MS = 3000;
+/** A live replica as the overview shows it. */
+export interface AdminHealthReplica {
+    /** The process id (the one extension status rows and the gateway heartbeat use). */
+    id: string;
+    roles: LiveReplica["roles"];
+    version: string;
+    startedAt: string;
+    httpReplicaId: string | null;
+}
+/** One kernel queue: counts only, never job data or a failure text (spec §9). */
+export interface AdminHealthQueue {
+    name: (typeof KERNEL_QUEUE_NAMES)[number];
+    /** Waiting to be picked up (a paused queue keeps them here too), prioritized ones included. */
+    waiting: number;
+    active: number;
+    /** Delayed: scheduled for later, or waiting out a retry backoff. */
+    delayed: number;
+    /** Failed jobs still kept (each queue keeps the last 5000). */
+    failed: number;
+    /** Of those, the ones that failed in the last 24 hours (by `finishedOn`). */
+    failedLastDay: number;
+}
+/** A source the answer could not read right now (its numbers are null). */
+export type AdminHealthSource = "redis" | "database";
+/**
+ * The admin overview's 运行状况 (`GET /api/v1/admin/overview/health`, admin overview spec §5.2,
+ * §6.2). Each source degrades on its own: when Redis does not answer, `replicas`, `roles`,
+ * `queues`, `channels.online` / `.offline` and `devices.online` are null; when PostgreSQL does
+ * not, the channel, device and sandbox numbers read from it are null; `unavailable` names them.
+ */
+export interface AdminHealth {
+    kernel: {
+        version: string;
+    };
+    /** Live replicas (presence beat within its window), oldest start first. */
+    replicas: AdminHealthReplica[] | null;
+    /** Live replicas per role (a replica with several roles counts in each). */
+    roles: {
+        api: number;
+        worker: number;
+        gateway: number;
+    } | null;
+    queues: AdminHealthQueue[] | null;
+    /**
+     * Channel connections of orgs not deleted (deleted connections are not counted):
+     * - `online`: long connections held by a live gateway replica now (the replicas' own counts);
+     * - `offline`: active long-connection connections no replica holds (`max(0, active − online)`):
+     *   waiting for a gateway, backing off after a failure, or their plugin is off in the org;
+     * - `webhook`: active connections in webhook mode (callbacks, nothing to hold);
+     * - `disabled` / `error`: connections in that status, whatever their mode.
+     */
+    channels: {
+        online: number | null;
+        offline: number | null;
+        webhook: number | null;
+        disabled: number | null;
+        error: number | null;
+    };
+    /**
+     * `local`: local devices (not deleted, org not deleted); `online`: the devices whose connection a
+     * live replica holds (lease held), at most `local`.
+     */
+    devices: {
+        online: number | null;
+        local: number | null;
+    };
+    /** Sandbox instances by status, and running ones per provider (most first). */
+    sandboxes: {
+        running: number;
+        suspended: number;
+        byProvider: {
+            provider: string;
+            running: number;
+        }[];
+    } | null;
+    unavailable: AdminHealthSource[];
+}
+/**
+ * Reads the platform's health for the admin overview: the live replicas (replica presence), the
+ * kernel queues (BullMQ counts plus a ZCOUNT of each failed set over the last 24 hours, the set's
+ * score being `finishedOn`), and channel, device and sandbox counts (grouped PostgreSQL counts,
+ * plus the connections the live replicas report holding). Not cached: it is cheap, and stale health
+ * misleads. Reads the shared queue instances (no connection per request).
+ */
+export declare class AdminHealthService {
+    private readonly presence;
+    private readonly db;
+    private readonly redis;
+    private readonly log;
+    private readonly queues;
+    constructor(presence: Pick<ReplicaPresence, "live">, db: KernelDb, redis: Pick<Redis, "zcount" | "status">, log: Pick<KernelLogger, "warn">, runs: Queue, subagentRuns: Queue, channels: Queue, maintenance: Queue, pluginScope: Queue, titles: Queue, usageReport: Queue, evals: Queue);
+    read(): Promise<AdminHealth>;
+    private readRedis;
+    private readDb;
+}

package/dist/admin/health.service.js

@@ -0,0 +1,246 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { getQueueToken } from "@nestjs/bullmq";
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { PLUGIN_SCOPE_QUEUE } from "../catalog/scope-sync.js";
+import { CHANNEL_QUEUE_NAME } from "../channels/jobs.js";
+import { TITLE_QUEUE } from "../conversations/titles.js";
+import { EVAL_QUEUE_NAME } from "../evals/jobs.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { ReplicaPresence } from "../infra/presence/replica-presence.js";
+import { KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
+import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
+import { RUN_QUEUE_NAME, SUBAGENT_RUN_QUEUE_NAME } from "../runtime/run-jobs.js";
+import { USAGE_REPORT_QUEUE } from "../runtime/usage-report-jobs.js";
+import { KERNEL_VERSION } from "../version.js";
+/** The kernel's own queues, in the order the overview lists them (extension queues are not read). */
+export const KERNEL_QUEUE_NAMES = [
+    RUN_QUEUE_NAME,
+    SUBAGENT_RUN_QUEUE_NAME,
+    CHANNEL_QUEUE_NAME,
+    MAINTENANCE_QUEUE_NAME,
+    PLUGIN_SCOPE_QUEUE,
+    TITLE_QUEUE,
+    USAGE_REPORT_QUEUE,
+    EVAL_QUEUE_NAME,
+];
+/** How long each source's reads may take before the answer marks it unavailable. */
+export const HEALTH_READ_TIMEOUT_MS = 3_000;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** Rejects when `p` does not settle within `ms` (a down Redis makes commands wait, not fail). */
+function within(p, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`no answer within ${ms} ms`)), ms);
+        timer.unref?.();
+    });
+    p.catch(() => { }); // a late rejection after the timeout is not unhandled
+    return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
+}
+/**
+ * Reads the platform's health for the admin overview: the live replicas (replica presence), the
+ * kernel queues (BullMQ counts plus a ZCOUNT of each failed set over the last 24 hours, the set's
+ * score being `finishedOn`), and channel, device and sandbox counts (grouped PostgreSQL counts,
+ * plus the connections the live replicas report holding). Not cached: it is cheap, and stale health
+ * misleads. Reads the shared queue instances (no connection per request).
+ */
+let AdminHealthService = class AdminHealthService {
+    presence;
+    db;
+    redis;
+    log;
+    queues;
+    constructor(presence, db, redis, log, runs, subagentRuns, channels, maintenance, pluginScope, titles, usageReport, evals) {
+        this.presence = presence;
+        this.db = db;
+        this.redis = redis;
+        this.log = log;
+        // the order of KERNEL_QUEUE_NAMES
+        this.queues = [
+            runs,
+            subagentRuns,
+            channels,
+            maintenance,
+            pluginScope,
+            titles,
+            usageReport,
+            evals,
+        ];
+    }
+    async read() {
+        const [r, d] = await Promise.allSettled([
+            within(this.readRedis(), HEALTH_READ_TIMEOUT_MS),
+            // a query left running past the limit finishes on its pooled connection
+            within(this.readDb(), HEALTH_READ_TIMEOUT_MS),
+        ]);
+        const unavailable = [];
+        const redis = r.status === "fulfilled" ? r.value : null;
+        if (r.status === "rejected") {
+            unavailable.push("redis");
+            this.log.warn("admin health: cannot read Redis", { err: r.reason });
+        }
+        const db = d.status === "fulfilled" ? d.value : null;
+        if (d.status === "rejected") {
+            unavailable.push("database");
+            this.log.warn("admin health: cannot read the database", { err: d.reason });
+        }
+        const replicas = redis?.replicas ?? null;
+        const sum = (k) => replicas === null ? null : replicas.reduce((n, x) => n + x[k], 0);
+        const online = sum("channelsHeld");
+        const channelCount = (f) => db === null ? null : db.channels.filter(f).reduce((n, c) => n + c.n, 0);
+        const longActive = channelCount((c) => c.status === "active" && c.mode === "long_connection");
+        // Each replica counts only the devices whose lease it holds, so a device is online on at most
+        // one; the clamp covers a lease handover in flight and devices deleted while still connected
+        const connected = sum("devicesConnected");
+        const devicesOnline = connected === null || db === null ? connected : Math.min(connected, db.localDevices);
+        let sandboxes = null;
+        if (db !== null) {
+            const byProvider = new Map();
+            let running = 0;
+            let suspended = 0;
+            for (const i of db.instances) {
+                if (i.status === "suspended")
+                    suspended += i.n;
+                if (i.status !== "running")
+                    continue;
+                running += i.n;
+                if (i.provider !== null) {
+                    byProvider.set(i.provider, (byProvider.get(i.provider) ?? 0) + i.n);
+                }
+            }
+            sandboxes = {
+                running,
+                suspended,
+                byProvider: [...byProvider]
+                    .map(([provider, n]) => ({ provider, running: n }))
+                    .sort((a, b) => b.running - a.running || a.provider.localeCompare(b.provider)),
+            };
+        }
+        return {
+            kernel: { version: KERNEL_VERSION },
+            replicas: replicas?.map((x) => ({
+                id: x.id,
+                roles: x.roles,
+                version: x.version,
+                startedAt: x.startedAt,
+                httpReplicaId: x.httpReplicaId,
+            })) ?? null,
+            roles: replicas === null
+                ? null
+                : {
+                    api: replicas.filter((x) => x.roles.includes("api")).length,
+                    worker: replicas.filter((x) => x.roles.includes("worker")).length,
+                    gateway: replicas.filter((x) => x.roles.includes("gateway")).length,
+                },
+            queues: redis?.queues ?? null,
+            channels: {
+                online,
+                offline: online === null || longActive === null ? null : Math.max(0, longActive - online),
+                webhook: channelCount((c) => c.status === "active" && c.mode === "webhook"),
+                disabled: channelCount((c) => c.status === "disabled"),
+                error: channelCount((c) => c.status === "error"),
+            },
+            devices: { online: devicesOnline, local: db?.localDevices ?? null },
+            sandboxes,
+            unavailable,
+        };
+    }
+    async readRedis() {
+        // Fail fast while a connection is down: ioredis queues commands until it reconnects (the
+        // BullMQ connections retry forever, maxRetriesPerRequest null), so with the page polling every
+        // 30 s the reads would pile up in the offline queues instead of reporting Redis unavailable
+        if (this.redis.status !== "ready")
+            throw new Error(`redis is ${this.redis.status}`);
+        for (const q of this.queues) {
+            const status = (await q.getBackend().client).status;
+            if (status !== "ready")
+                throw new Error(`queue ${q.name} connection is ${status}`);
+        }
+        const since = Date.now() - DAY_MS;
+        const [replicas, queues] = await Promise.all([
+            this.presence.live(),
+            Promise.all(this.queues.map(async (q, i) => {
+                const [c, failedLastDay] = await Promise.all([
+                    q.getJobCounts("wait", "prioritized", "active", "delayed", "failed"),
+                    // the failed set is scored by finishedOn (pinned by the health test)
+                    this.redis.zcount(q.toKey("failed"), since, "+inf"),
+                ]);
+                return {
+                    name: KERNEL_QUEUE_NAMES[i],
+                    waiting: (c.wait ?? 0) + (c.prioritized ?? 0),
+                    active: c.active ?? 0,
+                    delayed: c.delayed ?? 0,
+                    failed: c.failed ?? 0,
+                    failedLastDay,
+                };
+            })),
+        ]);
+        return { replicas, queues };
+    }
+    async readDb() {
+        const db = this.db.db;
+        const [channels, devices, instances] = await Promise.all([
+            db
+                .selectFrom("channel_connections as c")
+                .innerJoin("orgs as o", "o.id", "c.org_id")
+                .select(["c.status as status", "c.inbound_mode as mode"])
+                .select(sql `count(*)`.as("n"))
+                .where("c.deleted_at", "is", null)
+                .where("o.deleted_at", "is", null)
+                .groupBy(["c.status", "c.inbound_mode"])
+                .execute(),
+            db
+                .selectFrom("devices as d")
+                .innerJoin("orgs as o", "o.id", "d.org_id")
+                .select(sql `count(*)`.as("n"))
+                .where("d.source", "=", "local")
+                .where("d.deleted_at", "is", null)
+                .where("o.deleted_at", "is", null)
+                .executeTakeFirst(),
+            // the partial indexes on device_instances (running / live) serve these statuses; an
+            // instance of a deleted org is left out like its channels and devices
+            db
+                .selectFrom("device_instances as i")
+                .innerJoin("orgs as o", "o.id", "i.org_id")
+                .select(["i.provider as provider", "i.status as status"])
+                .select(sql `count(*)`.as("n"))
+                .where("i.status", "in", ["running", "suspended"])
+                .where("o.deleted_at", "is", null)
+                .groupBy(["i.provider", "i.status"])
+                .execute(),
+        ]);
+        return {
+            channels: channels.map((c) => ({ status: c.status, mode: c.mode, n: Number(c.n) })),
+            localDevices: Number(devices?.n ?? 0),
+            instances: instances.map((i) => ({
+                provider: i.provider,
+                status: i.status,
+                n: Number(i.n),
+            })),
+        };
+    }
+};
+AdminHealthService = __decorate([
+    Injectable(),
+    __param(0, Inject(ReplicaPresence)),
+    __param(1, Inject(KernelDb)),
+    __param(2, Inject(REDIS)),
+    __param(3, Inject(KERNEL_LOGGER)),
+    __param(4, Inject(getQueueToken(RUN_QUEUE_NAME))),
+    __param(5, Inject(getQueueToken(SUBAGENT_RUN_QUEUE_NAME))),
+    __param(6, Inject(getQueueToken(CHANNEL_QUEUE_NAME))),
+    __param(7, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
+    __param(8, Inject(getQueueToken(PLUGIN_SCOPE_QUEUE))),
+    __param(9, Inject(getQueueToken(TITLE_QUEUE))),
+    __param(10, Inject(getQueueToken(USAGE_REPORT_QUEUE))),
+    __param(11, Inject(getQueueToken(EVAL_QUEUE_NAME)))
+], AdminHealthService);
+export { AdminHealthService };

package/dist/admin/limit-defaults.d.ts

@@ -0,0 +1,20 @@
+import type { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import type { SubagentLimits } from "../runtime/subagents/limits.js";
+/**
+ * The deployment's defaults of the per-org limits (with `GET /api/v1/admin/orgs`): what an
+ * organization without an override gets, from the live config. `subagents.maxDispatchesPerRun` and
+ * `maxTokensPerRun` of 0 mean no limit.
+ */
+export interface LimitDefaults {
+    /** `runtime.orgConcurrency`. */
+    runConcurrency: number;
+    /** `sandbox.limits.cpu` / `memoryMb`. */
+    sandbox: {
+        cpu: number;
+        memoryMb: number;
+    };
+    /** `subagents.*`. */
+    subagents: SubagentLimits;
+}
+/** {@link LimitDefaults} from the live config. */
+export declare function limitDefaults(config: KernelConfigService): LimitDefaults;

package/dist/admin/limit-defaults.js

@@ -0,0 +1,10 @@
+/** {@link LimitDefaults} from the live config. */
+export function limitDefaults(config) {
+    const cfg = config.get();
+    const { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun } = cfg.subagents;
+    return {
+        runConcurrency: cfg.runtime.orgConcurrency,
+        sandbox: { cpu: cfg.sandbox.limits.cpu, memoryMb: cfg.sandbox.limits.memoryMb },
+        subagents: { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun },
+    };
+}