@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/dist/orgs/orgs.service.js

@@ -10,7 +10,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { randomBytes, randomUUID } from "node:crypto";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
-import { cancelPendingRequests } from "../catalog/requests.service.js";
+import { OwnedItems } from "../catalog/owned-items.js";
+import { cancelPendingRequests } from "../catalog/request-rules.js";
+import { PluginScopeSync } from "../catalog/scope-sync.js";
 import { ApiError } from "../errors.js";
 import { EvalBudget } from "../evals/budget.js";
 import { ApiTokenService } from "../identity/api-tokens.js";
@@ -70,8 +72,8 @@ async function slugGuard(p) {
     }
 }
 /**
- * Organizations: create, read, update and soft delete. A soft delete emits `org.deleted` on
- * {@link KernelEvents} after the commit.
+ * Organizations: create, read, update and soft delete. A new org's plugin scope sync is enqueued
+ * after the commit; a soft delete emits `org.deleted` on {@link KernelEvents} after the commit.
  */
 let OrgsService = class OrgsService {
     db;
@@ -81,9 +83,15 @@ let OrgsService = class OrgsService {
     orgLock;
     events;
     evalBudget;
+    scopeSync;
+    ownedItems;
     constructor(db, txHost, settings, apiTokens, orgLock, events, 
     /** Cancels the deleted org's running eval runs (in the delete's transaction). */
-    evalBudget) {
+    evalBudget, 
+    /** A new org gets the plugins its scope offers it (the scope sync, after the commit). */
+    scopeSync, 
+    /** What the deleted org owns is transferred or removed in the delete's transaction (P3-20). */
+    ownedItems) {
         this.db = db;
         this.txHost = txHost;
         this.settings = settings;
@@ -91,6 +99,8 @@ let OrgsService = class OrgsService {
         this.orgLock = orgLock;
         this.events = events;
         this.evalBudget = evalBudget;
+        this.scopeSync = scopeSync;
+        this.ownedItems = ownedItems;
     }
     /**
      * Creates an org with the actor as owner, in the caller's transaction when there is one (the
@@ -104,8 +114,8 @@ let OrgsService = class OrgsService {
         // read in the context's transaction: a caller holding a connection asking the pool for a
         // second one could exhaust it under load
         const { orgCreation } = await this.settings.get();
-        if (orgCreation === "enterprise_admin" && !actor.isEnterpriseAdmin) {
-            throw new ApiError("org.creation_disabled", "Only enterprise admins can create organizations");
+        if (orgCreation === "super_admin" && !actor.isSuperAdmin) {
+            throw new ApiError("org.creation_disabled", "Only super admins can create organizations");
         }
         const name = checkName(input.name);
         const slug = input.slug ?? slugFromName(name);
@@ -127,6 +137,7 @@ let OrgsService = class OrgsService {
             target: row.id,
             detail: { slug, name },
         });
+        afterCommit(() => this.scopeSync.enqueueOrg(row.id));
         return toOrg(row);
     }
     /** 账号所属的（未软删除的）组织及其角色，按创建时间升序。 */
@@ -142,7 +153,7 @@ let OrgsService = class OrgsService {
             .execute();
         return rows.map((r) => ({ ...toOrg(r), role: r.role }));
     }
-    /** 全部（未软删除的）组织及成员数（企业管理员用）。 */
+    /** 全部（未软删除的）组织及成员数（超级管理员用）。 */
     async listAll() {
         const rows = await this.db
             .selectFrom("orgs")
@@ -167,7 +178,9 @@ let OrgsService = class OrgsService {
         return row && toOrg(row);
     }
     /** Renames / re-slugs (needs admin, decided live under the org lock). */
-    async update(orgId, patch, actor, actorTokenId) {
+    async update(orgId, patch, actor, actorTokenId, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail) {
         const values = {};
         if (patch.name !== undefined)
             values.name = checkName(patch.name);
@@ -175,9 +188,9 @@ let OrgsService = class OrgsService {
             checkSlug(patch.slug);
             values.slug = patch.slug;
         }
-        return slugGuard(this.updateIn(orgId, values, actor, actorTokenId));
+        return slugGuard(this.updateIn(orgId, values, actor, actorTokenId, auditDetail));
     }
-    async updateIn(orgId, values, actor, actorTokenId) {
+    async updateIn(orgId, values, actor, actorTokenId, auditDetail) {
         const { org: before } = await this.orgLock.lockAndAuthorize(orgId, actor.id, "org.update");
         if (Object.keys(values).length === 0) {
             const row = await this.db
@@ -199,15 +212,18 @@ let OrgsService = class OrgsService {
             orgId,
             action: "org.updated",
             target: orgId,
-            detail: { before, after: values },
+            detail: { before, after: values, ...auditDetail },
         });
         return toOrg(row);
     }
     /**
      * Soft delete (needs owner, decided live under the org lock): in the same transaction revokes
-     * the org's service tokens, cancels its running eval runs and pending catalog requests, and
-     * clears sessions' current org pointing at it; after the commit emits `org.deleted` (channel
-     * connections go with the org: the runtime's connection reads filter deleted orgs).
+     * the org's service tokens, cancels its running eval runs and pending catalog requests, clears
+     * sessions' current org pointing at it, and transfers or removes the plugins and promoted
+     * components it owns ({@link OwnedItems.onOrgDeleted}, P3-20: shared ones become the platform's,
+     * the others are removed, a removed plugin's extension taken out by its cleanup job after the
+     * commit); after the commit emits `org.deleted` (channel connections go with the org: the
+     * runtime's connection reads filter deleted orgs).
      */
     async softDelete(orgId, actor, actorTokenId) {
         await this.softDeleteIn(orgId, actor, actorTokenId);
@@ -219,10 +235,14 @@ let OrgsService = class OrgsService {
             .set({ deleted_at: sql `now()` })
             .where("id", "=", orgId)
             .execute();
+        // after the org is marked deleted, so it counts as no user of what it shared (P3-18)
+        await this.ownedItems.onOrgDeleted(orgId, actor.id, {
+            ...(actorTokenId !== undefined && { actorTokenId }),
+        });
         await this.apiTokens.revokeAllForOrg(orgId);
         // eval runs of a deleted org stop spending: cancelled explicitly (audited with the reason)
         await this.evalBudget.cancelRuns({ orgId }, { accountId: actor.id, ...(actorTokenId !== undefined && { tokenId: actorTokenId }) }, "org_deleted");
-        // pending catalog requests (including those passed to enterprise admins) are cancelled too
+        // pending catalog requests (including those passed to super admins) are cancelled too
         await cancelPendingRequests(this.db.db, { orgId }, actor.id, "org_deleted", actorTokenId !== undefined ? { actorTokenId } : {});
         await this.db
             .updateTable("sessions")
@@ -257,6 +277,8 @@ OrgsService = __decorate([
     __param(3, Inject(ApiTokenService)),
     __param(4, Inject(OrgLock)),
     __param(5, Inject(KernelEvents)),
-    __param(6, Inject(EvalBudget))
+    __param(6, Inject(EvalBudget)),
+    __param(7, Inject(PluginScopeSync)),
+    __param(8, Inject(OwnedItems))
 ], OrgsService);
 export { OrgsService };

package/dist/orgs/roles.d.ts

@@ -4,7 +4,7 @@ export type OrgRole = (typeof ORG_ROLES)[number];
 /** `role` 是否不低于 `min`。 */
 export declare function roleAtLeast(role: OrgRole, min: OrgRole): boolean;
 /** 组织级动作；路由用 `@OrgAction(action)` 声明所需动作。 */
-export type OrgAction = "org.read" | "org.update" | "org.delete" | "org.transfer" | "org.members.read" | "org.members.manage" | "org.invitations.manage" | "org.tokens.manage" | "org.extensions.manage" | "agents.create" | "agents.use" | "agents.manage" | "connectors.manage" | "connectors.use" | "approvals.decide" | "channels.manage" | "skills.read" | "skills.manage" | "ui.use" | "trajectories.read" | "evals.manage" | "org.models.manage" | "catalog.read" | "catalog.request" | "catalog.decide";
+export type OrgAction = "org.read" | "org.update" | "org.delete" | "org.transfer" | "org.members.read" | "org.members.manage" | "org.invitations.manage" | "org.tokens.manage" | "org.extensions.read" | "org.extensions.manage" | "agents.create" | "agents.use" | "agents.manage" | "connectors.manage" | "connectors.use" | "approvals.decide" | "channels.manage" | "skills.read" | "skills.manage" | "ui.use" | "trajectories.read" | "evals.manage" | "org.models.manage" | "catalog.read" | "catalog.request" | "catalog.decide" | "catalog.upload";
 /** 每个动作所需的最低角色。 */
 export declare const ACTION_MIN_ROLE: Record<OrgAction, OrgRole>;
 /** 只允许 user principal 执行的动作：服务令牌即使角色足够也拒绝（除 SERVICE_ALLOWED 外全部）。 */

package/dist/orgs/roles.js

@@ -12,6 +12,8 @@ export const ACTION_MIN_ROLE = {
     "org.members.manage": "admin",
     "org.invitations.manage": "admin",
     "org.tokens.manage": "admin",
+    // the 扩展 page for members: state only, no config / secrets / schema (the list projects by role)
+    "org.extensions.read": "member",
     "org.extensions.manage": "admin",
     "org.delete": "owner",
     "org.transfer": "owner",
@@ -38,11 +40,13 @@ export const ACTION_MIN_ROLE = {
     "evals.manage": "admin",
     // 本组织的模型用途映射（覆盖部署默认，如评委用途 eval）
     "org.models.manage": "admin",
-    // 企业目录（组织视角）：成员浏览（看不到 disabled）与申请；组织管理员决定成员申请（F-AF）。
+    // 平台目录（组织视角）：成员浏览（看不到 disabled）与申请；组织管理员决定成员申请（F-AF）。
     // 安装另按条目种类要求 skills.manage / connectors.manage / org.extensions.manage（服务里在组织行锁内复核）
     "catalog.read": "member",
     "catalog.request": "member",
     "catalog.decide": "admin",
+    // An org admin uploads a plugin package the org owns (spec §14.1 item 1, ruling P3-7)
+    "catalog.upload": "admin",
 };
 /** 服务令牌也可执行的动作：只读的 org.read、org.members.read，以及使用 agent 的 agents.use。 */
 const SERVICE_ALLOWED = new Set([

package/dist/orgs/settings.controller.d.ts

@@ -4,7 +4,7 @@ import { type OrgSandboxLimits, type OrgSettings, type OrgSettingsDeployment, ty
 /**
  * 组织设置（`/api/v1/orgs/:orgId/settings`）：成员可读，修改需 `org.update`（admin）。
  * 响应带 `deployment`（部署默认值，如沙箱出站），设置页据此展示「跟随部署」时的实际取值；
- * 以及只读的 `sandboxLimits`（组织实际生效的沙箱 cpu / 内存与来源，企业管理员在部署设置里覆盖，C19）。
+ * 以及只读的 `sandboxLimits`（组织实际生效的沙箱 cpu / 内存与来源，超级管理员在部署设置里覆盖，C19）。
  */
 type SettingsResponse = {
     settings: OrgSettings;

package/dist/orgs/settings.service.d.ts

@@ -8,12 +8,21 @@ import { OrgLock } from "./org-lock.js";
 /**
  * 组织设置（`capybara.orgs.settings` jsonb）。读取宽松：缺失或非法的字段按默认值，未知键保留不动
  * （更新时与存量合并），新版本加字段不需要迁移。
- * - `toolSearch`：工具超过阈值时是否改用目录 + `tool_search`（D11，默认 on）。
+ * - `toolSearch`：工具超过阈值时是否改用目录 + `ToolSearch`（D11，默认 on）。
  * - `locale`：组织默认语言（`zh` / `en`，默认 en），机器人在 IM 里说的固定话术按它选择。
  * - `sandboxToolPolicy`：沙箱工具的默认策略（M5 T8，默认 allow）。为 `ask` 时除只读的
- *   `sandbox_read` / `sandbox_glob` / `sandbox_grep` 外都需要审批（执行时实时读取）。
+ *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
+ * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
  *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ * - `platformTool`: the `Platform` builtin for the whole org (Platform tool spec §3): `on`,
+ *   `read-only` (writes listed as unavailable) or `off` (default `on`).
+ * - `timeZone`: the org's default time zone (IANA; absent = UTC) for senders without one of their
+ *   own (run context spec §3.3); an invalid stored value reads as absent.
+ * - `theme`: the org's default theme and whether members may pick their own (themes spec §7);
+ *   absent (or an invalid stored value) = follow the platform, personal picks allowed.
+ * - `uiArrangement`: per slot, the extension contributions the org hides and their order (UI slots
+ *   spec §5); a slot with no entry follows the platform's; an invalid stored value reads as absent.
  */
 /** 组织沙箱出站白名单的主机数上限。 */
 export declare const ORG_SANDBOX_ALLOW_HOSTS_MAX = 200;
@@ -29,6 +38,21 @@ export declare const SandboxEgressSettingSchema: z.ZodObject<{
     allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export type SandboxEgressSetting = z.infer<typeof SandboxEgressSettingSchema>;
+/**
+ * The org's theme setting (themes spec §7): `id` a theme on in the org (a `platform_themes` id),
+ * null = follow the platform's default; `personal: "locked"` hides the personal picker in the org
+ * and resolution ignores personal picks there.
+ */
+export declare const OrgThemeSettingSchema: z.ZodObject<{
+    id: z.ZodNullable<z.ZodString>;
+    personal: z.ZodEnum<{
+        allowed: "allowed";
+        locked: "locked";
+    }>;
+}, z.core.$strict>;
+export type OrgThemeSetting = z.infer<typeof OrgThemeSettingSchema>;
+/** The theme setting of an org that has none: follow the platform, personal picks allowed. */
+export declare const DEFAULT_ORG_THEME: OrgThemeSetting;
 export declare const OrgSettingsSchema: z.ZodObject<{
     toolSearch: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
         off: "off";
@@ -42,6 +66,11 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         allow: "allow";
         ask: "ask";
     }>>>;
+    platformTool: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
+        off: "off";
+        on: "on";
+        "read-only": "read-only";
+    }>>>;
     sandboxEgress: z.ZodCatch<z.ZodOptional<z.ZodObject<{
         mode: z.ZodEnum<{
             allowlist: "allowlist";
@@ -49,6 +78,16 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         }>;
         allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    wakeOnBackgroundTask: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+    timeZone: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    theme: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
+        personal: z.ZodEnum<{
+            allowed: "allowed";
+            locked: "locked";
+        }>;
+    }, z.core.$strict>>>;
+    uiArrangement: z.ZodCatch<z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown>>>>;
 }, z.core.$strip>;
 export type OrgSettings = z.infer<typeof OrgSettingsSchema>;
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
@@ -65,6 +104,12 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
         allow: "allow";
         ask: "ask";
     }>>;
+    platformTool: z.ZodOptional<z.ZodEnum<{
+        off: "off";
+        on: "on";
+        "read-only": "read-only";
+    }>>;
+    wakeOnBackgroundTask: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
     sandboxEgress: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         mode: z.ZodEnum<{
             allowlist: "allowlist";
@@ -72,6 +117,15 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
         }>;
         allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    timeZone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    theme: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
+        personal: z.ZodEnum<{
+            allowed: "allowed";
+            locked: "locked";
+        }>;
+    }, z.core.$strict>>>;
+    uiArrangement: z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown>>>;
 }, z.core.$strict>;
 export type OrgSettingsPatch = z.infer<typeof OrgSettingsPatchSchema>;
 /** 部署的沙箱出站（`sandbox.limits.egress` + `allowHosts`）。 */
@@ -81,15 +135,17 @@ export type DeploymentEgress = Pick<SandboxLimits, "egress" | "allowHosts">;
  * （省略时用部署的），但部署是 `none` 时仍为 `none`（组织永远不比部署放得更开，部署改成 none 后存量设置也随之收紧）。
  */
 export declare function effectiveSandboxEgress(deployment: DeploymentEgress, org: SandboxEgressSetting | undefined): DeploymentEgress;
+/** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
+export declare function effectiveWakeOnBackgroundTask(deployment: boolean, org: OrgSettings["wakeOnBackgroundTask"]): boolean;
 /**
- * 组织实际生效的沙箱限额（C19 / Ruling M16）：企业管理员的覆盖（部署设置 `sandboxLimitOverrides[orgId]`）
+ * 组织实际生效的沙箱限额（C19 / Ruling M16）：超级管理员的覆盖（部署设置 `sandboxLimitOverrides[orgId]`）
  * 给出的 cpu / memoryMb 替换部署默认，未给的项、disk 与出站沿用 `deployment`。只在创建沙箱时读取。
  */
 export declare function effectiveSandboxLimits(deployment: SandboxLimits, override: {
     cpu?: number | undefined;
     memoryMb?: number | undefined;
 } | undefined): SandboxLimits;
-/** 组织设置 GET 带回的只读沙箱限额：实际生效值与来源（有企业管理员的覆盖为 `override`）。 */
+/** 组织设置 GET 带回的只读沙箱限额：实际生效值与来源（有超级管理员的覆盖为 `override`）。 */
 export interface OrgSandboxLimits {
     cpu: number;
     memoryMb: number;
@@ -118,9 +174,13 @@ export declare class OrgSettingsService {
     config: Pick<KernelConfigService, "get">);
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
     deployment(): OrgSettingsDeployment;
-    /** 组织实际生效的沙箱 cpu / 内存（只读；由企业管理员在部署设置里覆盖）。 */
+    /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
     sandboxLimits(orgId: string): Promise<OrgSandboxLimits>;
     get(orgId: string): Promise<OrgSettings>;
-    update(orgId: string, patch: OrgSettingsPatch, actorAccountId: string, actorTokenId?: string): Promise<OrgSettings>;
+    /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
+    check(patch: OrgSettingsPatch): void;
+    update(orgId: string, patch: OrgSettingsPatch, actorAccountId: string, actorTokenId?: string, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>): Promise<OrgSettings>;
     private updateIn;
 }

package/dist/orgs/settings.service.js

@@ -17,16 +17,28 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { assertThemeOnIn } from "../themes/theme-state.js";
+import { IanaTimeZone } from "../time-zone.js";
+import { mergeArrangement, OrgUiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
 import { OrgLock } from "./org-lock.js";
 /**
  * 组织设置（`capybara.orgs.settings` jsonb）。读取宽松：缺失或非法的字段按默认值，未知键保留不动
  * （更新时与存量合并），新版本加字段不需要迁移。
- * - `toolSearch`：工具超过阈值时是否改用目录 + `tool_search`（D11，默认 on）。
+ * - `toolSearch`：工具超过阈值时是否改用目录 + `ToolSearch`（D11，默认 on）。
  * - `locale`：组织默认语言（`zh` / `en`，默认 en），机器人在 IM 里说的固定话术按它选择。
  * - `sandboxToolPolicy`：沙箱工具的默认策略（M5 T8，默认 allow）。为 `ask` 时除只读的
- *   `sandbox_read` / `sandbox_glob` / `sandbox_grep` 外都需要审批（执行时实时读取）。
+ *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
+ * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
  *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ * - `platformTool`: the `Platform` builtin for the whole org (Platform tool spec §3): `on`,
+ *   `read-only` (writes listed as unavailable) or `off` (default `on`).
+ * - `timeZone`: the org's default time zone (IANA; absent = UTC) for senders without one of their
+ *   own (run context spec §3.3); an invalid stored value reads as absent.
+ * - `theme`: the org's default theme and whether members may pick their own (themes spec §7);
+ *   absent (or an invalid stored value) = follow the platform, personal picks allowed.
+ * - `uiArrangement`: per slot, the extension contributions the org hides and their order (UI slots
+ *   spec §5); a slot with no entry follows the platform's; an invalid stored value reads as absent.
  */
 /** 组织沙箱出站白名单的主机数上限。 */
 export const ORG_SANDBOX_ALLOW_HOSTS_MAX = 200;
@@ -53,11 +65,33 @@ export const SandboxEgressSettingSchema = z
         .optional(),
 })
     .strict();
+/**
+ * The org's theme setting (themes spec §7): `id` a theme on in the org (a `platform_themes` id),
+ * null = follow the platform's default; `personal: "locked"` hides the personal picker in the org
+ * and resolution ignores personal picks there.
+ */
+export const OrgThemeSettingSchema = z
+    .object({
+    id: z.string().min(1).max(200).nullable(),
+    personal: z.enum(["allowed", "locked"]),
+})
+    .strict();
+/** The theme setting of an org that has none: follow the platform, personal picks allowed. */
+export const DEFAULT_ORG_THEME = { id: null, personal: "allowed" };
 export const OrgSettingsSchema = z.object({
     toolSearch: z.enum(["on", "off"]).default("on").catch("on"),
     locale: z.enum(["zh", "en"]).default("en").catch("en"),
     sandboxToolPolicy: z.enum(["allow", "ask"]).default("allow").catch("allow"),
+    platformTool: z.enum(["on", "read-only", "off"]).default("on").catch("on"),
     sandboxEgress: SandboxEgressSettingSchema.optional().catch({ mode: "none" }),
+    /** Overrides `runtime.wakeOnBackgroundTask`; absent follows the deployment. */
+    wakeOnBackgroundTask: z.boolean().optional().catch(undefined),
+    /** The org's default time zone (run context spec §3.3); absent = UTC. */
+    timeZone: IanaTimeZone.optional().catch(undefined),
+    /** The org's default theme and personal lock (themes spec §7); absent = {@link DEFAULT_ORG_THEME}. */
+    theme: OrgThemeSettingSchema.optional().catch(undefined),
+    /** Hidden and ordered extension contributions per slot; absent = follow the platform. */
+    uiArrangement: UiArrangementSchema.optional().catch(undefined),
 });
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
 export const OrgSettingsPatchSchema = z
@@ -65,8 +99,23 @@ export const OrgSettingsPatchSchema = z
     toolSearch: z.enum(["on", "off"]).optional(),
     locale: z.enum(["zh", "en"]).optional(),
     sandboxToolPolicy: z.enum(["allow", "ask"]).optional(),
+    platformTool: z.enum(["on", "read-only", "off"]).optional(),
+    /** null clears (follow the deployment again). */
+    wakeOnBackgroundTask: z.boolean().nullable().optional(),
     /** null 清除（恢复跟随部署默认）。 */
     sandboxEgress: SandboxEgressSettingSchema.nullable().optional(),
+    /** The org's default time zone (IANA); null clears it (UTC). */
+    timeZone: IanaTimeZone.nullable().optional(),
+    /**
+     * The org's default theme (`id`: a theme on in the org, else 400 `theme.not_available`; null
+     * follows the platform) and whether members may pick their own; null clears it.
+     */
+    theme: OrgThemeSettingSchema.nullable().optional(),
+    /**
+     * Per slot, the entry to hide / order contributions with (replaces that slot's stored entry);
+     * null removes a slot's entry (it follows the platform again). `platform.page` is refused.
+     */
+    uiArrangement: OrgUiArrangementPatchSchema.optional(),
 })
     .strict();
 /**
@@ -80,8 +129,12 @@ export function effectiveSandboxEgress(deployment, org) {
         return { egress: "none", allowHosts: [] };
     return { egress: "allowlist", allowHosts: [...(org.allowHosts ?? deployment.allowHosts)] };
 }
+/** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
+export function effectiveWakeOnBackgroundTask(deployment, org) {
+    return org ?? deployment;
+}
 /**
- * 组织实际生效的沙箱限额（C19 / Ruling M16）：企业管理员的覆盖（部署设置 `sandboxLimitOverrides[orgId]`）
+ * 组织实际生效的沙箱限额（C19 / Ruling M16）：超级管理员的覆盖（部署设置 `sandboxLimitOverrides[orgId]`）
  * 给出的 cpu / memoryMb 替换部署默认，未给的项、disk 与出站沿用 `deployment`。只在创建沙箱时读取。
  */
 export function effectiveSandboxLimits(deployment, override) {
@@ -130,7 +183,7 @@ let OrgSettingsService = class OrgSettingsService {
             sandboxEgress: { mode: lim.egress, allowHosts: [...lim.allowHosts] },
         };
     }
-    /** 组织实际生效的沙箱 cpu / 内存（只读；由企业管理员在部署设置里覆盖）。 */
+    /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
     async sandboxLimits(orgId) {
         const lim = this.config.get().sandbox.limits;
         const override = await readSandboxLimitOverride(this.db.db, orgId);
@@ -151,14 +204,20 @@ let OrgSettingsService = class OrgSettingsService {
             throw new ApiError("org.not_found", "Organization not found");
         return parseOrgSettings(row.settings);
     }
-    async update(orgId, patch, actorAccountId, actorTokenId) {
+    /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
+    check(patch) {
         if (patch.sandboxEgress?.mode === "allowlist" &&
             this.deployment().sandboxEgress.mode === "none") {
             throw new ApiError("org.sandbox_egress_not_allowed", "This deployment disables sandbox network access (sandbox.limits.egress is none); an organization can only set sandboxEgress to none");
         }
-        return this.updateIn(orgId, patch, actorAccountId, actorTokenId);
     }
-    async updateIn(orgId, patch, actorAccountId, actorTokenId) {
+    async update(orgId, patch, actorAccountId, actorTokenId, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail) {
+        this.check(patch);
+        return this.updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail);
+    }
+    async updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail) {
         await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "org.update");
         const row = await this.db
             .selectFrom("orgs")
@@ -169,15 +228,35 @@ let OrgSettingsService = class OrgSettingsService {
         const before = parseOrgSettings(stored);
         const changes = Object.fromEntries(Object.entries(patch)
             .filter(([, v]) => v !== undefined)
-            // null 清除 sandboxEgress：恢复跟随部署默认
+            // null clears sandboxEgress / wakeOnBackgroundTask: follow the deployment default again
             .map(([k, v]) => [k, v === null ? undefined : v]));
+        const arrangementPatch = patch.uiArrangement;
+        delete changes.uiArrangement;
         const after = { ...before, ...changes };
+        if (arrangementPatch !== undefined) {
+            after.uiArrangement = mergeArrangement(before.uiArrangement, arrangementPatch);
+            if (Object.keys(after.uiArrangement).length === 0)
+                delete after.uiArrangement;
+        }
         if (after.sandboxEgress === undefined)
             delete after.sandboxEgress;
+        if (after.wakeOnBackgroundTask === undefined)
+            delete after.wakeOnBackgroundTask;
+        if (after.timeZone === undefined)
+            delete after.timeZone;
+        if (after.theme === undefined)
+            delete after.theme;
+        if (after.uiArrangement === undefined)
+            delete after.uiArrangement;
         if (sameSettings(before, after))
             return before;
+        // Lock order: the org row (orgLock above), then the theme's catalog item and its row FOR
+        // SHARE (assertThemeOnIn), then the check, so no scope writer changes what it read first
+        if (patch.theme?.id != null && patch.theme.id !== before.theme?.id) {
+            await assertThemeOnIn(this.db.db, orgId, patch.theme.id);
+        }
         // 与存量合并：保留本版本不认识的键（清除的 sandboxEgress 不留在存量里）
-        const { sandboxEgress: _old, ...rest } = stored;
+        const { sandboxEgress: _old, wakeOnBackgroundTask: _oldWake, timeZone: _oldZone, theme: _oldTheme, uiArrangement: _oldArrangement, ...rest } = stored;
         await this.db
             .updateTable("orgs")
             .set({ settings: JSON.stringify({ ...rest, ...after }) })
@@ -189,7 +268,7 @@ let OrgSettingsService = class OrgSettingsService {
             orgId,
             action: "org.settings_updated",
             target: orgId,
-            detail: { before, after },
+            detail: { before, after, ...auditDetail },
         });
         return after;
     }

package/dist/overrides.d.ts

@@ -1,15 +1,20 @@
 import type { NestInterceptor } from "@nestjs/common";
 import { APP_INTERCEPTOR } from "@nestjs/core";
+import { ADMIN_USAGE_TIMINGS, type AdminUsageTimings } from "./admin/usage.service.js";
 import { CHANNEL_WEBHOOK_TIMINGS, type ChannelWebhookTimings } from "./channels/webhook.js";
 import type { EvalReplayHooks } from "./evals/run-replay.js";
 import { EVAL_REPLAY_HOOKS } from "./evals/worker.js";
 import { BOOTSTRAP_LOCK_TTL } from "./extensions/bootstrap.js";
 import { FILE_PREVIEW_TIMEOUT } from "./files/previewers.js";
+import { PRESENCE_INTERVAL_MS } from "./infra/presence/replica-presence.js";
 import { LIST_MODELS_TIMEOUT } from "./runtime/providers.js";
+import { RUN_CONTEXT_CLOCK } from "./runtime/run-context.service.js";
 import { AGENT_LOOP_FACTORY, type AgentLoopFactory } from "./runtime/run-steps.js";
 import { RUN_HOOKS, type RunHooks } from "./runtime/run-worker.js";
+import { SUBAGENT_MESSAGES_HOOKS, type SubagentMessagesHooks } from "./runtime/subagents/messages.js";
 import { USAGE_REPORT_RETRY, type UsageReportRetry } from "./runtime/usage-report.js";
 import { SANDBOX_LEASE_TIMINGS, type SandboxLeaseTimings } from "./sandbox/leases.js";
+import { SETUP_CHECK_TIMEOUT } from "./setup/setup-checks.service.js";
 import { TOOL_PIPELINE_HOOKS, type ToolPipelineHooks } from "./tools/pipeline.js";
 import { EMBED_TOKEN_CLOCK } from "./ui/embed-token.js";
 /**
@@ -20,9 +25,14 @@ import { EMBED_TOKEN_CLOCK } from "./ui/embed-token.js";
  * - `RUN_HOOKS`: the run worker's hooks;
  * - `EVAL_REPLAY_HOOKS`: the hooks of the eval full-run replay and the judge;
  * - `TOOL_PIPELINE_HOOKS`: the tool pipeline's hooks and policy decision;
+ * - `SUBAGENT_MESSAGES_HOOKS`: the sub-agent message tools' hooks (a send raced by a run's end);
  * - `BOOTSTRAP_LOCK_TTL`, `FILE_PREVIEW_TIMEOUT`, `LIST_MODELS_TIMEOUT`, `USAGE_REPORT_RETRY`,
- *   `SANDBOX_LEASE_TIMINGS`, `CHANNEL_WEBHOOK_TIMINGS`: shorter timings;
+ *   `SANDBOX_LEASE_TIMINGS`, `CHANNEL_WEBHOOK_TIMINGS`, `SETUP_CHECK_TIMEOUT`,
+ *   `PRESENCE_INTERVAL_MS`: shorter timings;
+ * - `ADMIN_USAGE_TIMINGS`: the usage aggregate's statement timeout and clock;
  * - `EMBED_TOKEN_CLOCK`: the clock embed tokens are issued and checked with;
+ * - `RUN_CONTEXT_CLOCK`: the clock run start reads the run context's date from, and the
+ *   `CurrentTime` builtin the time;
  * - `APP_INTERCEPTOR`: one more global interceptor (a probe of the matched routes).
  */
 interface KernelSeams {
@@ -30,13 +40,18 @@ interface KernelSeams {
     [RUN_HOOKS]: RunHooks;
     [EVAL_REPLAY_HOOKS]: EvalReplayHooks;
     [TOOL_PIPELINE_HOOKS]: ToolPipelineHooks;
+    [SUBAGENT_MESSAGES_HOOKS]: SubagentMessagesHooks;
     [BOOTSTRAP_LOCK_TTL]: number;
     [FILE_PREVIEW_TIMEOUT]: number;
     [LIST_MODELS_TIMEOUT]: number;
     [USAGE_REPORT_RETRY]: UsageReportRetry;
     [SANDBOX_LEASE_TIMINGS]: Partial<SandboxLeaseTimings>;
     [CHANNEL_WEBHOOK_TIMINGS]: Partial<ChannelWebhookTimings>;
+    [SETUP_CHECK_TIMEOUT]: number;
+    [PRESENCE_INTERVAL_MS]: number;
+    [ADMIN_USAGE_TIMINGS]: Partial<AdminUsageTimings>;
     [EMBED_TOKEN_CLOCK]: () => number;
+    [RUN_CONTEXT_CLOCK]: () => number;
     [APP_INTERCEPTOR]: NestInterceptor;
 }
 /**

package/dist/overrides.js

@@ -1,13 +1,18 @@
 import { APP_INTERCEPTOR } from "@nestjs/core";
+import { ADMIN_USAGE_TIMINGS } from "./admin/usage.service.js";
 import { CHANNEL_WEBHOOK_TIMINGS } from "./channels/webhook.js";
 import { EVAL_REPLAY_HOOKS } from "./evals/worker.js";
 import { BOOTSTRAP_LOCK_TTL } from "./extensions/bootstrap.js";
 import { FILE_PREVIEW_TIMEOUT } from "./files/previewers.js";
+import { PRESENCE_INTERVAL_MS } from "./infra/presence/replica-presence.js";
 import { LIST_MODELS_TIMEOUT } from "./runtime/providers.js";
+import { RUN_CONTEXT_CLOCK } from "./runtime/run-context.service.js";
 import { AGENT_LOOP_FACTORY } from "./runtime/run-steps.js";
 import { RUN_HOOKS } from "./runtime/run-worker.js";
+import { SUBAGENT_MESSAGES_HOOKS, } from "./runtime/subagents/messages.js";
 import { USAGE_REPORT_RETRY } from "./runtime/usage-report.js";
 import { SANDBOX_LEASE_TIMINGS } from "./sandbox/leases.js";
+import { SETUP_CHECK_TIMEOUT } from "./setup/setup-checks.service.js";
 import { TOOL_PIPELINE_HOOKS } from "./tools/pipeline.js";
 import { EMBED_TOKEN_CLOCK } from "./ui/embed-token.js";
 const SEAM_TOKENS = [
@@ -15,13 +20,18 @@ const SEAM_TOKENS = [
     RUN_HOOKS,
     EVAL_REPLAY_HOOKS,
     TOOL_PIPELINE_HOOKS,
+    SUBAGENT_MESSAGES_HOOKS,
     BOOTSTRAP_LOCK_TTL,
     FILE_PREVIEW_TIMEOUT,
     LIST_MODELS_TIMEOUT,
     USAGE_REPORT_RETRY,
     SANDBOX_LEASE_TIMINGS,
     CHANNEL_WEBHOOK_TIMINGS,
+    SETUP_CHECK_TIMEOUT,
+    PRESENCE_INTERVAL_MS,
+    ADMIN_USAGE_TIMINGS,
     EMBED_TOKEN_CLOCK,
+    RUN_CONTEXT_CLOCK,
     APP_INTERCEPTOR,
 ];
 const allSeamsListed = true;