@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/src/migrations/0081_platform_components.sql

@@ -0,0 +1,129 @@
+-- Platform components (phase 2, plan 2026-11-06-plugin-scope-phase-2.md rulings A2-C2, E2): skills,
+-- agent templates and connector templates owned by the deployment instead of an org, with their own
+-- scope (follow the plugin's, or their own), an org list (named) and per-org switches. Org copies
+-- link to them. Expand-only: nothing existing is changed except `agent_templates.plugin_name`
+-- losing NOT NULL (a template without a plugin is the bare `<name>`).
+
+CREATE TABLE IF NOT EXISTS platform_skills (
+  id text PRIMARY KEY,
+  catalog_item_id uuid REFERENCES catalog_items(id) ON DELETE SET NULL,
+  plugin_name text,
+  name text NOT NULL,
+  description text NOT NULL,
+  description_zh text,
+  current_version integer NOT NULL CHECK (current_version >= 1),
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_skills_live_name_uq
+  ON platform_skills ((coalesce(plugin_name, '')), name)
+  WHERE deleted_at IS NULL;
+
+CREATE TABLE IF NOT EXISTS platform_skill_versions (
+  skill_id text NOT NULL REFERENCES platform_skills(id) ON DELETE CASCADE,
+  version integer NOT NULL CHECK (version >= 1),
+  manifest jsonb NOT NULL,
+  object_prefix text NOT NULL,
+  catalog_version text,
+  source_format text NOT NULL DEFAULT 'capybara' CHECK (source_format IN ('capybara', 'claude-code')),
+  suggest_pinned boolean NOT NULL DEFAULT false,
+  updated_on_own boolean NOT NULL DEFAULT false,
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (skill_id, version)
+);
+
+CREATE TABLE IF NOT EXISTS platform_agent_templates (
+  id text PRIMARY KEY,
+  catalog_item_id uuid REFERENCES catalog_items(id) ON DELETE SET NULL,
+  plugin_name text,
+  name text NOT NULL,
+  description text,
+  description_zh text,
+  current_version integer NOT NULL CHECK (current_version >= 1),
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_agent_templates_live_name_uq
+  ON platform_agent_templates ((coalesce(plugin_name, '')), name)
+  WHERE deleted_at IS NULL;
+
+CREATE TABLE IF NOT EXISTS platform_agent_template_versions (
+  template_id text NOT NULL REFERENCES platform_agent_templates(id) ON DELETE CASCADE,
+  version integer NOT NULL CHECK (version >= 1),
+  definition jsonb NOT NULL,
+  object_prefix text,
+  catalog_version text,
+  source_format text NOT NULL DEFAULT 'capybara' CHECK (source_format IN ('capybara', 'claude-code')),
+  suggest_pinned boolean NOT NULL DEFAULT false,
+  updated_on_own boolean NOT NULL DEFAULT false,
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (template_id, version)
+);
+
+CREATE TABLE IF NOT EXISTS platform_connector_templates (
+  id text PRIMARY KEY,
+  catalog_item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  template_id text NOT NULL,
+  current_version text NOT NULL,
+  file jsonb NOT NULL,
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_connector_templates_live_uq
+  ON platform_connector_templates (catalog_item_id, template_id)
+  WHERE deleted_at IS NULL;
+
+-- Scope of an own-scope component: the orgs it is offered to (named) and each org's switch.
+CREATE TABLE IF NOT EXISTS component_scope_orgs (
+  kind text NOT NULL CHECK (kind IN ('skill', 'agent_template', 'connector_template')),
+  component_id text NOT NULL,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  PRIMARY KEY (kind, component_id, org_id)
+);
+CREATE TABLE IF NOT EXISTS component_org_switches (
+  kind text NOT NULL CHECK (kind IN ('skill', 'agent_template', 'connector_template')),
+  component_id text NOT NULL,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  enabled boolean NOT NULL,
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (kind, component_id, org_id)
+);
+
+-- Links from the org copies (ruling B2): a pin keeps the copy on its own stored version.
+ALTER TABLE skills ADD COLUMN IF NOT EXISTS platform_skill_id text
+  REFERENCES platform_skills(id) ON DELETE SET NULL;
+ALTER TABLE skills ADD COLUMN IF NOT EXISTS pinned_version integer;
+ALTER TABLE agent_templates ADD COLUMN IF NOT EXISTS platform_template_id text
+  REFERENCES platform_agent_templates(id) ON DELETE SET NULL;
+ALTER TABLE agent_templates ADD COLUMN IF NOT EXISTS pinned_version integer;
+ALTER TABLE connectors ADD COLUMN IF NOT EXISTS platform_template_id text
+  REFERENCES platform_connector_templates(id) ON DELETE SET NULL;
+
+-- A template without a plugin is the bare `<name>`; the live-name index must still hold for NULLs.
+ALTER TABLE agent_templates ALTER COLUMN plugin_name DROP NOT NULL;
+-- capybara:allow-destructive the index is recreated in the same transaction over coalesce(plugin_name, '') so NULL plugin names stay unique; no data change
+DROP INDEX IF EXISTS agent_templates_live_name_uq;
+CREATE UNIQUE INDEX IF NOT EXISTS agent_templates_live_name_uq
+  ON agent_templates (org_id, (coalesce(plugin_name, '')), name)
+  WHERE deleted_at IS NULL;

package/src/migrations/0082_platform_migration.sql

@@ -0,0 +1,33 @@
+-- Plugin scope phase 2, Task 5: the migration of org copies to platform components
+-- (`catalog/platform-migration.ts`, the worker job `platform-components-migrate`), and the org
+-- notices it writes for the org admins' inbox.
+
+-- The catalog version the item's platform components were last written from
+-- (`PlatformComponents.syncFromVersion`); null = never: the migration job writes them once. Removed
+-- components are not brought back, since an item with a version here is never synced by the job.
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS platform_synced_version text;
+
+-- One row per run of the job (at every worker start and once a day): when it ran and what it
+-- changed; rows older than 30 days are pruned, except the first finished run, whose start is the
+-- cutoff of the one-shot rename step (only org skills whose current version predates it).
+CREATE TABLE IF NOT EXISTS platform_migration_runs (
+  id uuid PRIMARY KEY,
+  started_at timestamptz NOT NULL DEFAULT now(),
+  finished_at timestamptz,
+  stats jsonb NOT NULL DEFAULT '{}'::jsonb
+);
+
+-- A notice for an org's admins (inbox item kind = `kind`), until one of them dismisses it.
+-- `skill_renamed`: detail `{ skillId, from, to, platformSkillId, plugin }`.
+CREATE TABLE IF NOT EXISTS org_notices (
+  id uuid PRIMARY KEY,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  kind text NOT NULL CHECK (kind IN ('skill_renamed')),
+  detail jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  dismissed_at timestamptz,
+  dismissed_by text REFERENCES accounts(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS org_notices_open_idx
+  ON org_notices (org_id, created_at DESC)
+  WHERE dismissed_at IS NULL;

package/src/migrations/0083_plugin_scope_sync_failures.sql

@@ -0,0 +1,15 @@
+-- Plugin scope phase 2, Task 11: the plugin scope sync's open failures, for the super admin's
+-- inbox (`catalog/scope-sync.ts` writes them, `inbox/platform-inbox.service.ts` reads them). One
+-- row per (item, org) whose last sync attempt failed; the next sync of that pair that does not
+-- fail deletes it. The audit event `plugin.scope_sync_failed` stays the history. `op`: `install`
+-- (turning it on), `uninstall` (turning it off), `dependencies` (installing the dependencies a
+-- platform update added to a live install).
+CREATE TABLE IF NOT EXISTS plugin_scope_sync_failures (
+  item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  op text NOT NULL CHECK (op IN ('install', 'uninstall', 'dependencies')),
+  code text NOT NULL,
+  message text NOT NULL,
+  failed_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (item_id, org_id)
+);

package/src/migrations/0084_org_owned_items.sql

@@ -0,0 +1,85 @@
+-- Org-owned items, sharing, pending uploads and notices (phase 3, plan
+-- 2026-11-06-plugin-scope-phase-3.md Task 1; rulings P3-3, P3-5, P3-6, P3-8, F27). Expand-only:
+-- every column is nullable or defaulted, and existing rows stay platform-owned (owner_org_id NULL)
+-- and not shareable. The only dropped objects are the old live-name indexes and the old notice
+-- kind check, replaced in the same file.
+
+-- Owners and pending uploads of catalog items. `owner_org_id` NULL = the platform; an org's
+-- upload that carries an extension waits for the super admin (`awaiting_confirmation`), with the
+-- uploaded version in `pending_*` until confirmed (P3-9 to P3-13).
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS awaiting_confirmation boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS pending_version text;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS pending_by text
+  REFERENCES accounts(id) ON DELETE SET NULL;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS pending_at timestamptz;
+CREATE INDEX IF NOT EXISTS catalog_items_owner_idx
+  ON catalog_items (owner_org_id)
+  WHERE owner_org_id IS NOT NULL AND deleted_at IS NULL;
+
+-- Whether a version may be used (ruling P3-52): `applied_at` is set when it was applied or
+-- confirmed (a platform import is applied as it is written: the default; an org's upload writes
+-- NULL until its owner applies it or the super admin confirms it), `rejected_at` when the super
+-- admin rejected it. Readers serving other orgs or the generic update use only applied, not
+-- rejected versions, whoever owns the item (a transfer keeps the version rows). Existing rows
+-- are platform imports: applied.
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS applied_at timestamptz DEFAULT now();
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS rejected_at timestamptz;
+
+-- Platform components: the owning org (NULL = platform), the org they were created in
+-- (`origin_org_id`, no FK, immutable; F27) and the share switch (P3-3, P3-5).
+ALTER TABLE platform_skills ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE platform_skills ADD COLUMN IF NOT EXISTS origin_org_id text;
+ALTER TABLE platform_skills ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE platform_agent_templates ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE platform_agent_templates ADD COLUMN IF NOT EXISTS origin_org_id text;
+ALTER TABLE platform_agent_templates ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE platform_connector_templates ADD COLUMN IF NOT EXISTS owner_org_id text
+  REFERENCES orgs(id) ON DELETE SET NULL;
+ALTER TABLE platform_connector_templates ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+
+-- Live names are unique per origin org (P3-5); the new indexes come first, then the old ones go
+-- (F27: new names, so a re-run is a true no-op).
+CREATE UNIQUE INDEX IF NOT EXISTS platform_skills_live_name_origin_uq
+  ON platform_skills ((coalesce(plugin_name, '')), name, (coalesce(origin_org_id, '')))
+  WHERE deleted_at IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS platform_agent_templates_live_name_origin_uq
+  ON platform_agent_templates ((coalesce(plugin_name, '')), name, (coalesce(origin_org_id, '')))
+  WHERE deleted_at IS NULL;
+-- capybara:allow-destructive replaced by platform_skills_live_name_origin_uq created above in this file; no data change
+DROP INDEX IF EXISTS platform_skills_live_name_uq;
+-- capybara:allow-destructive replaced by platform_agent_templates_live_name_origin_uq created above in this file; no data change
+DROP INDEX IF EXISTS platform_agent_templates_live_name_uq;
+
+-- Org copies: whether the owner shares the copy with other orgs (P3-3, P3-6).
+ALTER TABLE skills ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+ALTER TABLE agent_templates ADD COLUMN IF NOT EXISTS shareable boolean NOT NULL DEFAULT false;
+
+-- An org's upload waits in staging under its org (P3-8); deleting the org drops the staging.
+ALTER TABLE plugin_import_staging ADD COLUMN IF NOT EXISTS org_id text
+  REFERENCES orgs(id) ON DELETE CASCADE;
+
+-- New org notice kinds. 0082 declared the CHECK inline, so it is named org_notices_kind_check.
+-- capybara:allow-destructive the check is added back with the wider kind list in the next statement; existing rows (skill_renamed) satisfy it
+ALTER TABLE org_notices DROP CONSTRAINT IF EXISTS org_notices_kind_check;
+ALTER TABLE org_notices ADD CONSTRAINT org_notices_kind_check
+  CHECK (kind IN ('skill_renamed', 'item_shared', 'shared_item_updated',
+                  'upload_confirmed', 'upload_rejected'));
+
+-- A notice for the super admins (platform inbox), until one of them dismisses it.
+-- `ownership_transferred`: a deleted org's shared item now belongs to the platform.
+CREATE TABLE IF NOT EXISTS platform_notices (
+  id uuid PRIMARY KEY,
+  kind text NOT NULL CHECK (kind IN ('ownership_transferred')),
+  detail jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  dismissed_at timestamptz,
+  dismissed_by text REFERENCES accounts(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS platform_notices_open_idx
+  ON platform_notices (created_at DESC)
+  WHERE dismissed_at IS NULL;

package/src/migrations/0085_agent_templates_phase4.sql

@@ -0,0 +1,45 @@
+-- Agent templates, phase 4 (spec 2026-11-05-plugin-component-management-design.md §15.2: P4-7
+-- connector_setup requests, P4-8 provenance). Expand-only: every new column is nullable, existing
+-- rows keep their shape, and the only dropped objects are two checks replaced in this file.
+
+-- P4-8: where an agent came from. Display data only (no FK: the template may be deleted or
+-- renamed later), written when an agent is created from a template.
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS created_from_template_id text;
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS created_from_template_version int;
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS created_from_template_name text;
+
+-- P4-7: a `connector_setup` request asks an org admin to set up the connectors an agent made from a
+-- template needs (`pending_keys`: the template's connector keys still without an instance). It
+-- names its agent and no item or marketplace entry.
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS agent_id text
+  REFERENCES agents(id) ON DELETE CASCADE;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS pending_keys jsonb;
+
+-- capybara:allow-destructive the check is added back with `connector_setup` in the next statement; existing rows (access, import, enable) satisfy it
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_kind_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_kind_check
+  CHECK (kind IN ('access', 'import', 'enable', 'connector_setup'));
+
+-- item_id is already nullable (0077). The target check of 0077 required an item for every kind but
+-- `import`; a connector_setup row needs an agent instead.
+-- capybara:allow-destructive the check is added back with the connector_setup branch in the next statement; existing rows satisfy its first and third branches
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_target_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_target_check
+  CHECK (
+    kind = 'import' AND entry_name IS NOT NULL
+    OR kind = 'connector_setup' AND agent_id IS NOT NULL
+      AND item_id IS NULL AND entry_name IS NULL
+    OR kind NOT IN ('import', 'connector_setup') AND item_id IS NOT NULL
+  );
+
+-- `pending_keys` is a JSON array of keys when set.
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_pending_keys_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_pending_keys_check
+  CHECK (pending_keys IS NULL OR jsonb_typeof(pending_keys) = 'array');
+
+-- At most one pending setup request per agent (P4-7).
+CREATE UNIQUE INDEX IF NOT EXISTS catalog_requests_pending_setup_uq
+  ON catalog_requests (agent_id) WHERE kind = 'connector_setup' AND status = 'pending';
+
+CREATE INDEX IF NOT EXISTS catalog_requests_agent_idx
+  ON catalog_requests (agent_id) WHERE agent_id IS NOT NULL;

package/src/migrations/0086_org_layering.sql

@@ -0,0 +1,30 @@
+-- Platform / org layering (spec 2026-11-07-platform-org-layering-design.md). Expand-only: two new
+-- tables, nothing existing changes.
+
+-- 0086, spec §5.4 / §5.8: an org's copy of an extension's overridable deployment config fields. A
+-- row is a copy; no row means the org follows the platform ("no copy" and "a copy equal to the
+-- platform" stay distinct). `config` holds the copy's non-secret values; its secrets live in
+-- `secrets` under the org (namespace `kernel`, key `plugin-override:<plugin>:<path>`). Rows are kept
+-- when the extension is disabled or uninstalled, like `extension_org_configs`.
+CREATE TABLE IF NOT EXISTS extension_org_overrides (
+  plugin text NOT NULL,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (plugin, org_id)
+);
+
+-- 0086, spec §7: an org admin's switch of one tool of an extension that is on in the org. No row
+-- means the tool follows the extension (on).
+CREATE TABLE IF NOT EXISTS org_tool_switches (
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  plugin text NOT NULL,
+  tool text NOT NULL,
+  enabled boolean NOT NULL,
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (org_id, plugin, tool)
+);

package/src/migrations/0087_approval_summary.sql

@@ -0,0 +1,6 @@
+-- Platform tool (spec 2026-11-07-platform-tool-design.md §6.2, §6.3): an approval carries the
+-- kernel-rendered summary of the call ({zh, en}) and the scopes the person may choose. Expand-only:
+-- both columns are nullable; null keeps today's behavior (no summary; scopes derived from the row:
+-- "once" for a role escalation, else once / session / always).
+ALTER TABLE approvals ADD COLUMN IF NOT EXISTS summary jsonb;
+ALTER TABLE approvals ADD COLUMN IF NOT EXISTS scopes text[];

package/src/migrations/0088_environments.sql

@@ -0,0 +1,80 @@
+-- Environments phase 1 (spec 2026-11-07-environments-design §4.2, §10): a long-lived environment
+-- is one sandbox instance plus a file system kept until the environment is deleted. This replaces
+-- the per-conversation `sandboxes` table with `environment_instances`; the old table stays only
+-- for the cleanup job that destroys its remaining instances. The CHECK lists of owner_kind and
+-- source grow in phases 2 and 3 through new migrations.
+CREATE TABLE IF NOT EXISTS capybara.environments (
+  id text PRIMARY KEY,
+  org_id text NOT NULL REFERENCES capybara.orgs(id) ON DELETE CASCADE,
+  owner_kind text NOT NULL CHECK (owner_kind IN ('personal')),
+  owner_account_id text NOT NULL REFERENCES capybara.accounts(id),
+  name text,
+  is_default boolean NOT NULL DEFAULT false,
+  source text NOT NULL CHECK (source IN ('cloud')),
+  provider text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS environments_default_uq
+  ON capybara.environments (org_id, owner_account_id)
+  WHERE is_default AND deleted_at IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS environments_name_uq
+  ON capybara.environments (org_id, owner_account_id, lower(name))
+  WHERE name IS NOT NULL AND deleted_at IS NULL;
+
+-- Same columns and meaning as the old sandboxes table (0023), keyed by environment. fs_handle and
+-- fs_status describe the kept file system; status 'none' means no instance exists yet.
+CREATE TABLE IF NOT EXISTS capybara.environment_instances (
+  environment_id text PRIMARY KEY REFERENCES capybara.environments(id) ON DELETE CASCADE,
+  org_id text NOT NULL,
+  provider text,
+  fs_handle jsonb,
+  fs_status text NOT NULL DEFAULT 'none' CHECK (fs_status IN ('none', 'ready', 'lost')),
+  handle jsonb,
+  status text NOT NULL DEFAULT 'none'
+    CHECK (status IN ('none', 'creating', 'running', 'suspended', 'destroyed')),
+  last_used_at timestamptz NOT NULL DEFAULT now(),
+  running_since timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  suspended_at timestamptz,
+  destroyed_at timestamptz,
+  generation integer NOT NULL DEFAULT 0,
+  had_instance boolean NOT NULL DEFAULT false,
+  prev_provider text,
+  prev_handle jsonb,
+  sweep_failed_at timestamptz
+);
+CREATE INDEX IF NOT EXISTS environment_instances_running_idx
+  ON capybara.environment_instances (last_used_at)
+  WHERE status = 'running';
+CREATE INDEX IF NOT EXISTS environment_instances_live_idx
+  ON capybara.environment_instances (last_used_at)
+  WHERE status <> 'destroyed';
+CREATE INDEX IF NOT EXISTS environment_instances_org_idx
+  ON capybara.environment_instances (org_id);
+
+-- The environment a member's new conversations use when they pick none.
+CREATE TABLE IF NOT EXISTS capybara.environment_defaults (
+  org_id text NOT NULL,
+  account_id text NOT NULL,
+  environment_id text NOT NULL REFERENCES capybara.environments(id) ON DELETE CASCADE,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (org_id, account_id)
+);
+
+-- No cascade: a deleted environment is soft-deleted and the conversation keeps pointing at it.
+ALTER TABLE capybara.conversations
+  ADD COLUMN IF NOT EXISTS environment_id text REFERENCES capybara.environments(id);
+
+ALTER TABLE capybara.background_tasks ADD COLUMN IF NOT EXISTS environment_id text;
+CREATE INDEX IF NOT EXISTS background_tasks_environment_running_idx
+  ON capybara.background_tasks (environment_id) WHERE status = 'running';
+
+-- Tasks that ran in a per-conversation sandbox lose it with the move to environments (the
+-- instances are destroyed by the cleanup job).
+UPDATE capybara.background_tasks
+  SET status = 'lost',
+      lost_reason = COALESCE(lost_reason, 'sandbox_replaced_by_environment'),
+      finished_at = COALESCE(finished_at, now())
+  WHERE status = 'running';

package/src/migrations/0089_model_kinds_usage.sql

@@ -0,0 +1,38 @@
+-- Model platform providers (spec 2026-11-06-model-platform-providers-design.md). Expand-only: two
+-- new tables, nothing existing changes.
+
+-- 0089, spec §5.3: models disabled on two layers. `org_id` null is the platform's list (the super
+-- admin; such a model is invisible to every org), otherwise the org's own list (an org admin, among
+-- the models the platform left on). No row means the model is enabled; a model a provider lists
+-- later is enabled everywhere until someone disables it. Keyed on the model id, so a row applies to
+-- whichever list the org sees (the platform's config or the org's own copy); an id the list does
+-- not contain is kept harmlessly.
+CREATE TABLE IF NOT EXISTS model_disabled (
+  org_id text NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  model text NOT NULL,
+  disabled_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  disabled_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS model_disabled_scope_key
+  ON model_disabled ((coalesce(org_id, '')), provider, model);
+
+-- 0089, spec §5.4: model usage outside conversations (an extension's `ctx.models.embed` call). One
+-- row per call; `reported_at` is set once the `usage.report` job for the row (eventId = id) has
+-- nothing left to deliver (delivered, no subscriber, or a definite drop); `report_failed_at` once
+-- the job gave up after its last attempt. The sweeper re-enqueues recent rows where both are null.
+CREATE TABLE IF NOT EXISTS model_usage (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  extension text NOT NULL,
+  purpose text NOT NULL,
+  provider text NOT NULL,
+  model text NOT NULL,
+  input_tokens integer NOT NULL,
+  occurred_at timestamptz NOT NULL DEFAULT now(),
+  reported_at timestamptz NULL,
+  report_failed_at timestamptz NULL
+);
+CREATE INDEX IF NOT EXISTS model_usage_org_time ON model_usage (org_id, occurred_at DESC);
+CREATE INDEX IF NOT EXISTS model_usage_unreported ON model_usage (occurred_at)
+  WHERE reported_at IS NULL AND report_failed_at IS NULL;

package/src/migrations/0090_initial_passwords.sql

@@ -0,0 +1,27 @@
+-- Platform tool phase 2 (spec 2026-11-07-platform-tool-design.md §14.5 item 2): the super admin's
+-- agent creates an account with a kernel-generated one-time password. Expand-only.
+--
+-- must_change_password: the account must set its own password before anything else (the auth
+-- guard refuses every route but the password change, /me and logout until it does).
+ALTER TABLE capybara.accounts ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false;
+
+-- The generated password, sealed with the master keyring (AES-256-GCM, AAD = account id), waiting
+-- for the person who approved the creation to read it once on the web. Keyed by the account; the
+-- tool call it came from (conversation_id, run_id, call_id: a call id is unique only within its run)
+-- and its recipient decide who may read it. Read once (deleted as it is read), dropped when the
+-- account changes its password, and dropped after expires_at by the hourly cleanup job.
+CREATE TABLE IF NOT EXISTS capybara.account_initial_passwords (
+  account_id text PRIMARY KEY REFERENCES capybara.accounts(id) ON DELETE CASCADE,
+  recipient_account_id text NOT NULL REFERENCES capybara.accounts(id) ON DELETE CASCADE,
+  conversation_id text NOT NULL REFERENCES capybara.conversations(id) ON DELETE CASCADE,
+  run_id text NOT NULL,
+  call_id text NOT NULL,
+  master_key_id text NOT NULL,
+  ciphertext bytea NOT NULL,
+  expires_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS account_initial_passwords_call_idx
+  ON capybara.account_initial_passwords (conversation_id, run_id, call_id);
+CREATE INDEX IF NOT EXISTS account_initial_passwords_expires_idx
+  ON capybara.account_initial_passwords (expires_at);

package/src/migrations/0091_account_time_zone.sql

@@ -0,0 +1,4 @@
+-- Run context (spec 2026-11-08-run-context-design.md §3.4): a person's time zone setting (IANA
+-- name). Null, the default, follows the browser's time zone sent with each message; a set value
+-- overrides it. Expand-only.
+ALTER TABLE accounts ADD COLUMN IF NOT EXISTS time_zone text;

package/src/migrations/0092_tools_default_on.sql

@@ -0,0 +1,27 @@
+-- Tools are on by default (spec 2026-11-08-tools-default-on-design.md §3): an agent stores only
+-- what it turns off (`disabledTools`), not an enabled list (`tools`). Every stored agent version,
+-- older ones included (a rollback reads the same shape), becomes "nothing turned off". Idempotent:
+-- a definition without `tools` is left alone, one without `disabledTools` gets the empty list.
+UPDATE agent_versions
+SET definition = (definition - 'tools') || jsonb_build_object('disabledTools', '[]'::jsonb)
+WHERE definition ? 'tools' OR NOT definition ? 'disabledTools';
+
+-- Org-made agent templates (saved from an agent by an org admin: no plugin, no catalog item)
+-- lose their `tools` allowlist, so they turn nothing off either. Templates from plugin packages
+-- keep what the package wrote.
+UPDATE agent_template_versions AS v
+SET definition = v.definition - 'tools'
+FROM agent_templates AS t
+WHERE t.id = v.template_id
+  AND t.plugin_name IS NULL
+  AND t.catalog_item_id IS NULL
+  AND v.definition ? 'tools';
+
+UPDATE platform_agent_template_versions AS v
+SET definition = v.definition - 'tools'
+FROM platform_agent_templates AS t
+WHERE t.id = v.template_id
+  AND t.plugin_name IS NULL
+  AND t.catalog_item_id IS NULL
+  AND v.object_prefix IS NULL
+  AND v.definition ? 'tools';

package/src/migrations/0093_connected_environments.sql

@@ -0,0 +1,37 @@
+-- Environments phase 2 (spec 2026-11-07-environments-design §6, §13): a person's own machine,
+-- connected through the device program, becomes an environment with source 'device'. Expand-only:
+-- the source CHECK list grows and a new table holds the connected machine.
+
+-- 0088 left the CHECK unnamed, so Postgres named it environments_source_check; re-add it under
+-- the same name with the longer list.
+ALTER TABLE environments DROP CONSTRAINT IF EXISTS environments_source_check;
+ALTER TABLE environments
+  ADD CONSTRAINT environments_source_check CHECK (source IN ('cloud', 'device'));
+
+-- The machine connected to a device environment. credential_hash is a hash of the machine's
+-- long-lived credential (cap_dev_...), never the credential itself; revoking a machine sets
+-- revoked_at and keeps the row, so only one unrevoked machine exists per environment.
+-- program_version, mode, roots and session_isolation are what the program reported on its last
+-- connection; last_seen_at is the last time it connected or pinged.
+CREATE TABLE IF NOT EXISTS environment_machines (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  environment_id text NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+  account_id text NOT NULL,
+  credential_hash text NOT NULL UNIQUE,
+  name text NOT NULL,
+  os text NOT NULL,
+  arch text NOT NULL,
+  program_version text,
+  mode text CHECK (mode IN ('os', 'docker')),
+  roots jsonb,
+  session_isolation boolean NOT NULL DEFAULT false,
+  last_seen_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  revoked_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS environment_machines_active_uq
+  ON environment_machines (environment_id)
+  WHERE revoked_at IS NULL;
+-- The org cascade delete looks rows up by org (as environment_instances_org_idx in 0088).
+CREATE INDEX IF NOT EXISTS environment_machines_org_idx ON environment_machines (org_id);

package/src/migrations/0094_environment_paths_idx.sql

@@ -0,0 +1,7 @@
+-- Environments phase 2 (spec 2026-11-07-environments-design §13.1, ruling R22): every sandbox tool
+-- call reads the conversation's latest environment_paths event; a partial index answers it
+-- without scanning the conversation's events backwards. Not CONCURRENTLY, like the other index
+-- migrations (0025).
+CREATE INDEX IF NOT EXISTS conversation_events_environment_paths_idx
+  ON conversation_events (conversation_id, seq)
+  WHERE type = 'environment_paths';

package/src/migrations/0095_environment_files_resets.sql

@@ -0,0 +1,5 @@
+-- How many times an environment's files were reset. A provider may give the new file system the id
+-- of the destroyed one (sandbox-docker names its volumes after the environment), so the kernel
+-- counts resets itself: a conversation that last used the environment under another count is told
+-- its files were reset, not that the instance restarted on kept files.
+ALTER TABLE capybara.environment_instances ADD COLUMN IF NOT EXISTS fs_resets integer NOT NULL DEFAULT 0;

package/src/migrations/0096_environment_demoted_default.sql

@@ -0,0 +1,18 @@
+-- A default environment demoted by a sandbox provider switch (environments spec §4.2 item 13)
+-- records the provider it was demoted from; NULL for every other environment. The UI names such an
+-- environment after the default plus that provider's display name (「个人环境（Docker 沙箱）」), and
+-- when the deployment switches back to that provider the row is restored as the person's default.
+ALTER TABLE capybara.environments ADD COLUMN IF NOT EXISTS demoted_from_provider text;
+
+-- Backfill: until now a demoted default was renamed `Personal (<provider>)` (` 2`, ` 3`, … when
+-- taken). Those rows get the marker and lose the generated name. A person-made environment with
+-- such a name is caught too; that is accepted before 0.1.0 (AGENTS.md "Before 0.1.0": no real
+-- users yet). Idempotent: a backfilled row has a NULL name and no longer matches.
+UPDATE capybara.environments
+   SET demoted_from_provider = substring(name FROM '^Personal \(([^)]+)\)'),
+       name = NULL
+ WHERE owner_kind = 'personal'
+   AND NOT is_default
+   AND deleted_at IS NULL
+   AND demoted_from_provider IS NULL
+   AND name ~ '^Personal \([^)]+\)( [0-9]+)?$';

package/src/migrations/0097_extension_installs_enabled_at.sql

@@ -0,0 +1,16 @@
+-- When an install record's desired state last became `enabled` (NULL while disabled). A
+-- single-provider extension point (sandbox, object-store, secret-store, config-source) takes one
+-- enabled provider; enabling a second one is refused. A deployment that already has two enabled
+-- (enabled before that rule) loads the one enabled first on every replica and after every restart,
+-- never the first by name. `updated_at` cannot tell: an upgrade or a source change rewrites it.
+ALTER TABLE extension_installs ADD COLUMN IF NOT EXISTS enabled_at timestamptz;
+
+-- Backfill the enabled rows: the latest `extension.enabled` audit of the extension (every enable
+-- path writes one), else the install time. Idempotent: a filled row is skipped.
+UPDATE extension_installs i
+   SET enabled_at = COALESCE(
+         (SELECT max(a.at) FROM audit_events a
+           WHERE a.action = 'extension.enabled' AND a.target = i.name),
+         i.installed_at)
+ WHERE i.desired_state = 'enabled'
+   AND i.enabled_at IS NULL;