@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.3

package/dist/agents/agent-lookup.js

@@ -11,7 +11,8 @@ import { Inject, Injectable, Module } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
-import { normalizeStoredDefinition } from "./definition.js";
+import { loadLegacyScope } from "../tools/legacy-data.js";
+import { needsLegacyScope, normalizeStoredDefinition } from "./definition.js";
 export const AGENT_VISIBILITIES = ["private", "org", "members"];
 const notFound = () => new ApiError("agent.not_found", "Agent not found");
 /**
@@ -142,6 +143,13 @@ let AgentLookup = class AgentLookup {
             .orderBy("account_id")
             .execute();
         const byId = new Map(rows.map((r) => [r.id, r]));
+        // rc `<x>__<tool>` keys read with their org's scope, loaded once per org that needs it
+        const scopes = new Map();
+        for (const r of rows) {
+            if (!scopes.has(r.org_id) && needsLegacyScope(r.definition)) {
+                scopes.set(r.org_id, await loadLegacyScope(this.db.db, r.org_id));
+            }
+        }
         return ids.flatMap((id) => {
             const r = byId.get(id);
             if (!r)
@@ -153,7 +161,7 @@ let AgentLookup = class AgentLookup {
                     ownerAccountId: r.owner_account_id,
                     visibility: r.visibility,
                     currentVersion: r.current_version,
-                    definition: normalizeStoredDefinition(r.definition),
+                    definition: normalizeStoredDefinition(r.definition, scopes.get(r.org_id)),
                     memberIds: r.visibility === "members"
                         ? memberRows.filter((m) => m.agent_id === id).map((m) => m.account_id)
                         : null,

package/dist/agents/agents.service.js

@@ -24,6 +24,7 @@ import { ProviderRegistry } from "../runtime/providers.js";
 import { SandboxJobs } from "../sandbox/jobs.js";
 import { SkillChangesService } from "../skills/changes.service.js";
 import { assertOrgSkills, assertPinnedSkills } from "../skills/skills.service.js";
+import { legacyKeySaveText } from "../tools/legacy-keys.js";
 import { ToolRegistry } from "../tools/registry.js";
 import { AgentLookup, isAgentVisibleTo, visibleTo, } from "./agent-lookup.js";
 import { normalizeStoredDefinition, paramIssues, SUBAGENT_NAME_RE, SUBAGENT_ROSTER_MAX, } from "./definition.js";
@@ -67,8 +68,13 @@ export async function assertSubagents(t, a) {
     if (sub === undefined)
         return;
     const details = [];
-    const add = (reason, path, value) => {
-        details.push({ reason, path, ...(value !== undefined && { value }) });
+    const add = (reason, path, value, message) => {
+        details.push({
+            reason,
+            path,
+            ...(value !== undefined && { value }),
+            ...(message !== undefined && { message }),
+        });
     };
     const types = new Set(sub.general === false ? [] : ["general-purpose"]);
     const claim = (type, path) => {
@@ -123,8 +129,11 @@ export async function assertSubagents(t, a) {
         const base = `subagents.inline.${i}`;
         name(x.name, `${base}.name`);
         const tool = (key, path) => {
-            if (!a.toolKeys.has(key))
-                add("tool_not_selected", path, key);
+            if (a.toolKeys.has(key))
+                return;
+            // an rc key names its current key(s) (tool naming spec §8.3)
+            const renamed = legacyKeySaveText(key, a.toolKeys);
+            add("tool_not_selected", path, key, renamed ?? undefined);
         };
         for (const [j, key] of (x.tools ?? []).entries())
             tool(key, `${base}.tools.${j}`);
@@ -167,7 +176,9 @@ export async function assertSubagents(t, a) {
     if (count > SUBAGENT_ROSTER_MAX)
         add("too_many", "subagents");
     if (details.length > 0) {
-        throw new ApiError("agent.subagents_invalid", `Invalid sub-agents: ${details.map((d) => `${d.path} (${d.reason})`).join(", ")}`, details);
+        throw new ApiError("agent.subagents_invalid", `Invalid sub-agents: ${details
+            .map((d) => `${d.path} (${d.reason}${d.message === undefined ? "" : `: ${d.message}`})`)
+            .join(", ")}`, details);
     }
 }
 /**
@@ -220,9 +231,11 @@ let AgentsService = class AgentsService {
         const details = [...issues];
         for (const key of Object.keys(def.toolPolicies)) {
             if (!keys.has(key)) {
+                // an rc key (tool naming spec §8.3): saving writes current keys only, so name them
+                const renamed = legacyKeySaveText(key, keys);
                 details.push({
                     path: `toolPolicies.${key}`,
-                    message: `"${key}" is not a tool of this agent`,
+                    message: renamed ?? `"${key}" is not a tool of this agent`,
                 });
             }
         }

package/dist/agents/definition.d.ts

@@ -1,5 +1,6 @@
 import { type ModelParameter } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
+import { type LegacyScope } from "../tools/legacy-keys.js";
 /** 模型引用：供应商插件名 + 模型 id。 */
 export declare const ModelRef: z.ZodObject<{
     provider: z.ZodString;
@@ -34,11 +35,7 @@ export declare const AgentToolRef: z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.Zo
     tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
 }, z.core.$strict>], "kind">, unknown>;
 export type AgentToolRef = z.output<typeof AgentToolRef>;
-/**
- * 新建 agent 未给 `tools` 时的默认工具（`tool_search` 由注册表按组织设置自动加入，不进定义）。
- * 只用于创建请求；修改与读出旧版本都不注入默认值。
- */
-export declare const DEFAULT_AGENT_TOOLS: AgentToolRef[];
+export { DEFAULT_AGENT_TOOLS } from "../tools/builtin-names.js";
 /** Roster names of inline templates and allowlisted org agents (the template name rule). */
 export declare const SUBAGENT_NAME_RE: RegExp;
 /**
@@ -75,7 +72,7 @@ export declare const InlineAgentTemplate: z.ZodObject<{
 }, z.core.$strict>;
 export type InlineAgentTemplate = z.infer<typeof InlineAgentTemplate>;
 /**
- * Sub-agents this agent may dispatch with the builtin `agent` tool (phase C, spec §5.2). No
+ * Sub-agents this agent may dispatch with the builtin `Agent` tool (phase C, spec §5.2). No
  * default: definitions without it are unchanged and gain no version.
  */
 export declare const SubagentsSchema: z.ZodObject<{
@@ -192,11 +189,37 @@ export declare const AgentDefinitionSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strip>;
 export type AgentDefinition = z.infer<typeof AgentDefinitionSchema>;
+/** The connectors and extensions a definition's own tool refs name (to read an ambiguous rc key). */
+interface OwnRefs {
+    connectors: ReadonlySet<string>;
+    extensions: ReadonlySet<string>;
+}
+/**
+ * Release-candidate tool keys in a stored definition, read as current keys (tool naming spec
+ * §8.3), the way {@link normalizeToolRef} reads the app -> connector rename: builtin refs in
+ * `tools`, the keys of `toolPolicies`, and the `tools` / `disallowedTools` / `toolPolicies` of a
+ * template, the agent's inline sub-agent templates included. Works on an agent definition and on
+ * an agent template alike. Old builtin names map without `scope`; an rc `<x>__<tool>` key maps
+ * only with one (the org's connector slugs and their ids, the deployment's extension names). When
+ * `x` is both a slug and an extension name, the definition's own tool refs decide; when they
+ * cannot, a policy or a deny list keeps the restriction on both candidate keys (a deny is never
+ * lost) and an allowlist keeps the old key (inert). An unknown key stays as it is. Keys in the
+ * current format are never touched. Returns the same object when nothing changes. Saving never
+ * goes through this: a new definition with an old key is refused (`AgentsService`).
+ */
+export declare function normalizeToolKeys(definition: unknown, scope?: LegacyScope, inherited?: OwnRefs): unknown;
+/**
+ * Does a stored definition or template hold an rc `<x>__<tool>` key, which only a
+ * {@link LegacyScope} can map? (Callers load the scope only then.)
+ */
+export declare function needsLegacyScope(definition: unknown): boolean;
 /**
  * 库里读出的定义（`agent_versions.definition`，不经 zod 解析）：把改名前的 `{ kind: "app" }` 工具引用规范化为
- * connector 形（C27）。其余字段原样保留；没有旧形引用时返回原对象。
+ * connector 形（C27），and rc tool keys to current keys ({@link normalizeToolKeys}: builtins
+ * always, `<x>__<tool>` keys with `scope`). Other fields are kept; without old forms the same
+ * object is returned.
  */
-export declare function normalizeStoredDefinition(def: unknown): AgentDefinition;
+export declare function normalizeStoredDefinition(def: unknown, scope?: LegacyScope): AgentDefinition;
 /** 按模型声明严格校验一组参数，返回 `{ path: "<field>.<key>", message }[]`（评测候选也用它）。 */
 export declare function paramIssues(field: string, decl: ModelParameter[], params: Record<string, unknown>): {
     path: string;

package/dist/agents/definition.js

@@ -1,5 +1,6 @@
 import { validateParams } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
+import { isLegacyBuiltinKey, isLegacyPrefixedKey, legacyToolKey, } from "../tools/legacy-keys.js";
 /** 模型引用：供应商插件名 + 模型 id。 */
 export const ModelRef = z.object({ provider: z.string(), model: z.string() });
 /**
@@ -37,14 +38,7 @@ export const AgentToolRef = z.preprocess(normalizeToolRef, z.discriminatedUnion(
     })
         .strict(),
 ]));
-/**
- * 新建 agent 未给 `tools` 时的默认工具（`tool_search` 由注册表按组织设置自动加入，不进定义）。
- * 只用于创建请求；修改与读出旧版本都不注入默认值。
- */
-export const DEFAULT_AGENT_TOOLS = [
-    { kind: "builtin", name: "ask_user" },
-    { kind: "builtin", name: "read_tool_output" },
-];
+export { DEFAULT_AGENT_TOOLS } from "../tools/builtin-names.js";
 /** Roster names of inline templates and allowlisted org agents (the template name rule). */
 export const SUBAGENT_NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 /**
@@ -68,7 +62,7 @@ export const InlineAgentTemplate = z
 })
     .strict();
 /**
- * Sub-agents this agent may dispatch with the builtin `agent` tool (phase C, spec §5.2). No
+ * Sub-agents this agent may dispatch with the builtin `Agent` tool (phase C, spec §5.2). No
  * default: definitions without it are unchanged and gain no version.
  */
 export const SubagentsSchema = z
@@ -118,7 +112,7 @@ export const AgentDefinitionSchema = z.object({
      * 技能（M5 T13）：`orgSkills` 是引用的组织技能 id（保存时校验属于本组织且未删除，不可重复）。
      * agent 自己的技能（`scope=agent`）自动对它生效，不进定义。可省略（较早保存的定义也没有），按空处理；
      * 不给默认值：没用技能的定义保存前后不变，不会因此多出一个版本。
-     * `writePolicy`（M6 T27，D10）：私有 agent 的 `skill_write` 是否固定确认，缺省按 `allow`（不写进定义）；
+     * `writePolicy`（M6 T27，D10）：私有 agent 的 `SkillWrite` 是否固定确认，缺省按 `allow`（不写进定义）；
      * 共享 agent 不论取值都走 R3 + R4。
      */
     skills: z
@@ -136,20 +130,202 @@ export const AgentDefinitionSchema = z.object({
     })
         .strict()
         .optional(),
-    /** Sub-agents (phase C); offered only when the builtin `agent` tool is in `tools`. */
+    /** Sub-agents (phase C); offered only when the builtin `Agent` tool is in `tools`. */
     subagents: SubagentsSchema.optional(),
 });
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/**
+ * The connector slugs and extension names `definition`'s `tools` name: connector refs (through
+ * `scope.connectorSlugById`), plugin refs, and current-format keys of a template's `tools`;
+ * `inherited` (the parent agent's, for an inline template) is added.
+ */
+function ownRefs(definition, scope, inherited) {
+    const connectors = new Set(inherited?.connectors);
+    const extensions = new Set(inherited?.extensions);
+    const tools = Array.isArray(definition.tools) ? definition.tools : [];
+    for (const r of tools) {
+        if (typeof r === "string") {
+            const m = /^(mcp|plugin)__([^_].*?)__./.exec(r);
+            if (m)
+                (m[1] === "mcp" ? connectors : extensions).add(m[2]);
+        }
+        else if (isRecord(r) && r.kind === "connector" && typeof r.connectorId === "string") {
+            const slug = scope.connectorSlugById?.get(r.connectorId);
+            if (slug !== undefined)
+                connectors.add(slug);
+        }
+        else if (isRecord(r) && r.kind === "plugin" && typeof r.plugin === "string") {
+            extensions.add(r.plugin);
+        }
+    }
+    return { connectors, extensions };
+}
+/**
+ * The current key(s) of a stored key. A builtin and an unambiguous `<x>__<tool>` map to one key
+ * ({@link legacyToolKey}). When `x` is both a connector slug and an extension name, the
+ * definition's own refs decide (only connector `x` -> `mcp__…`, only extension `x` ->
+ * `plugin__…`); when they name both or neither, both candidates are returned and the caller
+ * decides (a policy keeps a deny / ask on both: it must never be lost). Anything else: as is.
+ */
+function currentKeys(key, scope, own) {
+    const one = legacyToolKey(key, scope);
+    if (one !== null)
+        return [one];
+    if (scope === undefined || !isLegacyPrefixedKey(key))
+        return [key];
+    const head = key.slice(0, key.indexOf("__"));
+    if (!scope.connectorSlugs.has(head) || !scope.extensionNames.has(head))
+        return [key];
+    const c = own?.connectors.has(head) === true;
+    const e = own?.extensions.has(head) === true;
+    if (c && !e)
+        return [`mcp__${key}`];
+    if (e && !c)
+        return [`plugin__${key}`];
+    return [`mcp__${key}`, `plugin__${key}`];
+}
+/**
+ * A list of tool keys (a template's `tools` / `disallowedTools`) in current keys, deduplicated.
+ * A still-ambiguous key becomes both candidates in a deny list (`widen`), and stays as is (inert,
+ * so narrower) in an allowlist.
+ */
+function keyList(v, scope, own, widen) {
+    if (!Array.isArray(v))
+        return v;
+    let changed = false;
+    const out = [];
+    for (const x of v) {
+        let next = [x];
+        if (typeof x === "string") {
+            const keys = currentKeys(x, scope, own);
+            next = keys.length > 1 && !widen ? [x] : keys;
+        }
+        if (next.length !== 1 || next[0] !== x)
+            changed = true;
+        for (const n of next) {
+            if (typeof n === "string" && out.includes(n)) {
+                changed = true;
+                continue;
+            }
+            out.push(n);
+        }
+    }
+    return changed ? out : v;
+}
+/**
+ * `toolPolicies` in current keys; keys that become one keep the stricter policy, and a
+ * still-ambiguous key keeps its `ask` / `deny` on both candidates (anything else is dropped).
+ */
+function policyKeys(v, scope, own) {
+    if (!isRecord(v))
+        return v;
+    const mapped = Object.entries(v).map(([k, p]) => [k, p, currentKeys(k, scope, own)]);
+    if (mapped.every(([k, , keys]) => keys.length === 1 && keys[0] === k))
+        return v;
+    const rank = (p) => (p === "deny" ? 2 : p === "ask" ? 1 : 0);
+    const out = {};
+    for (const [, p, keys] of mapped) {
+        if (keys.length > 1 && rank(p) === 0)
+            continue;
+        for (const next of keys) {
+            if (!Object.hasOwn(out, next) || rank(p) > rank(out[next]))
+                out[next] = p;
+        }
+    }
+    return out;
+}
+/** An agent definition's `tools`: builtin refs by their current names (connector and plugin refs name tools, not keys). */
+function toolRefs(v, scope, own) {
+    if (!Array.isArray(v))
+        return v;
+    // template-shaped (`tools: string[]`): an allowlist
+    if (v.some((x) => typeof x === "string"))
+        return keyList(v, scope, own, false);
+    if (!v.some((r) => isRecord(r) &&
+        r.kind === "builtin" &&
+        typeof r.name === "string" &&
+        isLegacyBuiltinKey(r.name))) {
+        return v;
+    }
+    return v.map((r) => isRecord(r) && r.kind === "builtin" && typeof r.name === "string"
+        ? { ...r, name: legacyToolKey(r.name) ?? r.name }
+        : r);
+}
+/**
+ * Release-candidate tool keys in a stored definition, read as current keys (tool naming spec
+ * §8.3), the way {@link normalizeToolRef} reads the app -> connector rename: builtin refs in
+ * `tools`, the keys of `toolPolicies`, and the `tools` / `disallowedTools` / `toolPolicies` of a
+ * template, the agent's inline sub-agent templates included. Works on an agent definition and on
+ * an agent template alike. Old builtin names map without `scope`; an rc `<x>__<tool>` key maps
+ * only with one (the org's connector slugs and their ids, the deployment's extension names). When
+ * `x` is both a slug and an extension name, the definition's own tool refs decide; when they
+ * cannot, a policy or a deny list keeps the restriction on both candidate keys (a deny is never
+ * lost) and an allowlist keeps the old key (inert). An unknown key stays as it is. Keys in the
+ * current format are never touched. Returns the same object when nothing changes. Saving never
+ * goes through this: a new definition with an old key is refused (`AgentsService`).
+ */
+export function normalizeToolKeys(definition, scope, inherited) {
+    if (!isRecord(definition))
+        return definition;
+    const own = scope === undefined ? undefined : ownRefs(definition, scope, inherited);
+    const next = { ...definition };
+    let changed = false;
+    const put = (field, value) => {
+        if (value === definition[field])
+            return;
+        next[field] = value;
+        changed = true;
+    };
+    if ("tools" in definition)
+        put("tools", toolRefs(definition.tools, scope, own));
+    if ("disallowedTools" in definition) {
+        put("disallowedTools", keyList(definition.disallowedTools, scope, own, true));
+    }
+    if ("toolPolicies" in definition) {
+        put("toolPolicies", policyKeys(definition.toolPolicies, scope, own));
+    }
+    const sub = definition.subagents;
+    if (isRecord(sub) && Array.isArray(sub.inline)) {
+        const inline = sub.inline.map((t) => normalizeToolKeys(t, scope, own));
+        if (inline.some((t, i) => t !== sub.inline[i])) {
+            put("subagents", { ...sub, inline });
+        }
+    }
+    return changed ? next : definition;
+}
+/**
+ * Does a stored definition or template hold an rc `<x>__<tool>` key, which only a
+ * {@link LegacyScope} can map? (Callers load the scope only then.)
+ */
+export function needsLegacyScope(definition) {
+    if (!isRecord(definition))
+        return false;
+    const lists = [definition.tools, definition.disallowedTools];
+    for (const l of lists) {
+        if (Array.isArray(l) && l.some((x) => typeof x === "string" && isLegacyPrefixedKey(x))) {
+            return true;
+        }
+    }
+    if (isRecord(definition.toolPolicies)) {
+        if (Object.keys(definition.toolPolicies).some(isLegacyPrefixedKey))
+            return true;
+    }
+    const sub = definition.subagents;
+    return isRecord(sub) && Array.isArray(sub.inline) && sub.inline.some(needsLegacyScope);
+}
 /**
  * 库里读出的定义（`agent_versions.definition`，不经 zod 解析）：把改名前的 `{ kind: "app" }` 工具引用规范化为
- * connector 形（C27）。其余字段原样保留；没有旧形引用时返回原对象。
+ * connector 形（C27），and rc tool keys to current keys ({@link normalizeToolKeys}: builtins
+ * always, `<x>__<tool>` keys with `scope`). Other fields are kept; without old forms the same
+ * object is returned.
  */
-export function normalizeStoredDefinition(def) {
-    const d = def;
+export function normalizeStoredDefinition(def, scope) {
+    let d = def;
     const tools = d.tools;
-    if (!Array.isArray(tools) || !tools.some((t) => t?.kind === "app")) {
-        return d;
+    if (Array.isArray(tools) && tools.some((t) => t?.kind === "app")) {
+        d = { ...d, tools: tools.map(normalizeToolRef) };
     }
-    return { ...d, tools: tools.map(normalizeToolRef) };
+    return normalizeToolKeys(d, scope);
 }
 /** 按模型声明严格校验一组参数，返回 `{ path: "<field>.<key>", message }[]`（评测候选也用它）。 */
 export function paramIssues(field, decl, params) {

package/dist/agents/templates.js

@@ -10,7 +10,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { randomUUID } from "node:crypto";
 import { Inject, Injectable } from "@nestjs/common";
 import { KernelDb } from "../infra/database/kernel-db.js";
+import { loadLegacyScope } from "../tools/legacy-data.js";
 import { canonicalJson } from "../tools/registry.js";
+import { needsLegacyScope, normalizeToolKeys } from "./definition.js";
 const baseQuery = (db, orgId) => db
     .selectFrom("agent_templates as t")
     .innerJoin("agent_template_versions as v", (j) => j.onRef("v.template_id", "=", "t.id").onRef("v.version", "=", "t.current_version"))
@@ -26,16 +28,27 @@ const baseQuery = (db, orgId) => db
 ])
     .where("t.org_id", "=", orgId)
     .where("t.deleted_at", "is", null);
-const rowOf = (r) => ({
+/**
+ * A stored template row; its tool keys read as current keys (tool naming spec §8.3): old builtin
+ * names always, rc `<x>__<tool>` keys with `scope` (see {@link scopedRows}).
+ */
+const rowOf = (r, scope) => ({
     id: r.id,
     name: r.name,
     plugin: r.plugin_name,
     version: r.current_version,
-    template: r.definition,
+    template: normalizeToolKeys(r.definition, scope),
     sourceFormat: r.source_format,
     catalogItemId: r.catalog_item_id,
     catalogVersion: r.catalog_version,
 });
+/** The rows of one org as {@link TemplateRow}s, reading the org's legacy scope once when needed. */
+async function scopedRows(db, orgId, rows) {
+    const scope = rows.some((r) => needsLegacyScope(r.definition))
+        ? await loadLegacyScope(db, orgId)
+        : undefined;
+    return rows.map((r) => rowOf(r, scope));
+}
 /** The live templates of `ids` in the org (deleted and foreign ids are left out), by id. */
 export async function loadTemplates(db, orgId, ids) {
     if (ids.length === 0)
@@ -43,7 +56,7 @@ export async function loadTemplates(db, orgId, ids) {
     const rows = await baseQuery(db, orgId)
         .where("t.id", "in", [...ids])
         .execute();
-    return new Map(rows.map((r) => [r.id, rowOf(r)]));
+    return new Map((await scopedRows(db, orgId, rows)).map((t) => [t.id, t]));
 }
 /** Reads the org's agent templates (consumed by the roster, the agent page and Task 19's API). */
 let AgentTemplatesService = class AgentTemplatesService {
@@ -84,7 +97,9 @@ let AgentTemplatesService = class AgentTemplatesService {
         const r = await q.executeTakeFirst();
         if (!r)
             return null;
-        const t = rowOf(r);
+        const [t] = await scopedRows(this.db.db, orgId, [r]);
+        if (!t)
+            return null;
         return { id: t.id, version: t.version, plugin: t.plugin, template: t.template };
     }
 };

package/dist/catalog/catalog-content.js

@@ -4,6 +4,7 @@
 // module whose provider injects PluginInstaller (an ESM import cycle would run decorators early).
 import { createHash } from "node:crypto";
 import { parseAgentTemplate, parseConnectorTemplateFile, } from "@capybara-hq/plugin-sdk";
+import { normalizeToolKeys } from "../agents/definition.js";
 import { ApiError } from "../errors.js";
 import { can } from "../orgs/roles.js";
 import { packagePath } from "../packages/tgz.js";
@@ -318,6 +319,8 @@ export async function readCatalogAgentTemplates(storage, v) {
         if (!parsed || "errors" in parsed) {
             throw new ApiError("internal", `Stored agent template ${path} is missing or invalid`);
         }
-        return { path, template: parsed.template };
+        // an rc package's template may name old builtins: read as the current names (tool naming
+        // spec §8.3); rc `<x>__<tool>` keys are read with the org's scope by `loadTemplates`
+        return { path, template: normalizeToolKeys(parsed.template) };
     });
 }

package/dist/catalog/claude/agents.js

@@ -13,16 +13,19 @@ import { item } from "./report.js";
 export const GENERATED_AGENTS_DIR = ".capybara-generated/agents";
 /** Claude Code tool names -> Capybara tool keys (spec §16.4; anything else is dropped). */
 const TOOL_MAP = {
-    Bash: "sandbox_bash",
-    Read: "sandbox_read",
-    Write: "sandbox_write",
-    Edit: "sandbox_edit",
-    MultiEdit: "sandbox_edit",
-    Glob: "sandbox_glob",
-    Grep: "sandbox_grep",
-    Skill: "skill_load",
-    TodoWrite: "todo__write",
-    ToolSearch: "tool_search",
+    Bash: "Bash",
+    Read: "Read",
+    Write: "Write",
+    Edit: "Edit",
+    MultiEdit: "Edit",
+    Glob: "Glob",
+    Grep: "Grep",
+    Skill: "Skill",
+    AskUserQuestion: "AskUserQuestion",
+    ToolSearch: "ToolSearch",
+    Agent: "Agent",
+    Task: "Agent",
+    TodoWrite: "plugin__todo__write",
 };
 /** Claude ignores these for plugin agents: `not_applicable`. */
 const NOT_APPLICABLE = new Set(["permissionMode", "hooks", "mcpServers"]);

package/dist/catalog/marketplaces.service.d.ts

@@ -164,7 +164,7 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.0";
+    readonly sdk: "0.1.0-rc.1";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;

package/dist/channels/cards.d.ts

@@ -1,6 +1,6 @@
-import type { ChannelCard, FormAnswer, InputForm, OutboundMessage } from "@capybara-hq/plugin-sdk";
+import { type ChannelCard, type FormAnswer, type InputForm, type OutboundMessage } from "@capybara-hq/plugin-sdk";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
-import type { ApprovalsService } from "../tools/approvals.service.js";
+import type { ApprovalsService, ApprovalView } from "../tools/approvals.service.js";
 import { type ChannelLocale } from "./phrases.js";
 /** 审批卡片里工具参数预览的最大长度（字符）。 */
 export declare const INPUT_PREVIEW_MAX = 500;
@@ -23,6 +23,12 @@ export declare function webBase(publicUrl: string | undefined): string | undefin
 export declare const conversationUrl: (base: string, conversationId: string) => string;
 /** 个人连接页里某个连接器的位置（与网页 ConnectCard 的链接一致）。 */
 export declare const connectUrl: (base: string, connectorId: string) => string;
+/**
+ * The tool as the card names it (tool naming spec §7): a builtin by its name; a connector or
+ * extension tool as `<display name> [<tool>]` (the connector's name, the plugin's display name in
+ * the card's language), the way the web labels it.
+ */
+export declare function approvalToolName(v: Pick<ApprovalView, "toolKey" | "toolName" | "connector" | "extension">, locale: ChannelLocale): string;
 export interface CardDeps {
     db: KernelSchemaDb;
     approvals: Pick<ApprovalsService, "describe">;

package/dist/channels/cards.js

@@ -1,4 +1,4 @@
-import { KEY_SEPARATOR } from "../tools/naming.js";
+import { parseToolKey, } from "@capybara-hq/plugin-sdk";
 import { phrase } from "./phrases.js";
 /** 审批卡片里工具参数预览的最大长度（字符）。 */
 export const INPUT_PREVIEW_MAX = 500;
@@ -84,12 +84,20 @@ export function webBase(publicUrl) {
 export const conversationUrl = (base, conversationId) => `${base}/chat/${conversationId}`;
 /** 个人连接页里某个连接器的位置（与网页 ConnectCard 的链接一致）。 */
 export const connectUrl = (base, connectorId) => `${base}/settings/connections#connector-${encodeURIComponent(connectorId)}`;
-/** 来源内的工具名：连接器工具去掉 `<slug>__`（审批详情已处理），插件工具去掉 `<插件>__`。 */
-function shortToolName(v) {
+/**
+ * The tool as the card names it (tool naming spec §7): a builtin by its name; a connector or
+ * extension tool as `<display name> [<tool>]` (the connector's name, the plugin's display name in
+ * the card's language), the way the web labels it.
+ */
+export function approvalToolName(v, locale) {
+    // `toolName` is already the connector's own name for its tool
     if (v.connector)
-        return v.toolName;
-    const i = v.toolKey.indexOf(KEY_SEPARATOR);
-    return i > 0 ? v.toolKey.slice(i + KEY_SEPARATOR.length) : v.toolKey;
+        return `${v.connector.name} [${v.toolName}]`;
+    const parsed = parseToolKey(v.toolKey);
+    const tool = parsed && parsed.kind !== "builtin" ? parsed.tool : v.toolName;
+    if (v.extension)
+        return `${v.extension.displayName[locale]} [${tool}]`;
+    return v.toolKey;
 }
 /** 账号显示名；不存在返回 undefined。 */
 async function displayName(db, accountId) {
@@ -115,8 +123,8 @@ export async function approvalCard(d, approvalId, base, locale, redact) {
         kind: "approval",
         id: v.id,
         title: phrase("approvalTitle", locale),
-        toolName: shortToolName(v),
-        ...(v.connector && { appName: v.connector.name }),
+        // the label carries the source, so no separate appName (renderers would repeat it)
+        toolName: approvalToolName(v, locale),
         agentName: v.agent.name || "Agent",
         inputPreview: inputPreview(v.input, redact),
         scopes: v.requestedFor === null ? ["once"] : ["once", "session", "always"],

package/dist/config/schema.js

@@ -751,7 +751,7 @@ export const KernelConfigSchema = z.object({
             .int()
             .positive()
             .default(20000)
-            .meta(meta({ description: "Maximum characters returned by one read_tool_output call" })),
+            .meta(meta({ description: "Maximum characters returned by one ReadToolOutput call" })),
         oauthAllowInsecureLoopback: z
             .boolean()
             .default(false)
@@ -978,7 +978,7 @@ export const KernelConfigSchema = z.object({
             .positive()
             .default(104_857_600)
             .meta(meta({
-            description: "Largest file in bytes an agent may deliver from its sandbox to the user as an artifact (sandbox_deliver)",
+            description: "Largest file in bytes an agent may deliver from its sandbox to the user as an artifact (Deliver)",
         })),
         limits: z
             .object({

package/dist/conversations/artifacts.d.ts

@@ -20,7 +20,7 @@ export interface ArtifactPreview {
     truncated: boolean;
 }
 /**
- * 产物（M5 T8 / T11）：agent 经 `sandbox_deliver` 交付的文件。先按会话流的规则判定会话可见
+ * 产物（M5 T8 / T11）：agent 经 `Deliver` 交付的文件。先按会话流的规则判定会话可见
  * （不可见 → `conversation.not_found`），再只在这个会话的日志里找 `artifact_created`
  * （没有 → `conversation.artifact_not_found`）。
  *

package/dist/conversations/artifacts.js

@@ -62,7 +62,7 @@ async function readPrefix(body, max) {
     return out.subarray(0, n);
 }
 /**
- * 产物（M5 T8 / T11）：agent 经 `sandbox_deliver` 交付的文件。先按会话流的规则判定会话可见
+ * 产物（M5 T8 / T11）：agent 经 `Deliver` 交付的文件。先按会话流的规则判定会话可见
  * （不可见 → `conversation.not_found`），再只在这个会话的日志里找 `artifact_created`
  * （没有 → `conversation.artifact_not_found`）。
  *

package/dist/conversations/event-log.d.ts

@@ -123,6 +123,17 @@ export declare class EventLog {
     latestOfType<T extends ConversationEventType>(conversationId: string, type: T): Promise<Extract<ConversationEvent, {
         type: T;
     }> | undefined>;
+    /**
+     * The file state (`tool_result.view.file`) the latest `Read` / `Write` / `Edit` result of this
+     * conversation recorded for `path` (a normalized sandbox path); null when none did. One index
+     * probe per call: the partial index `conversation_events_file_state_idx` of migration 0063
+     * (conversation_id, view.file.path, seq DESC; tool_result rows only) answers it, also for a path
+     * never read (the query's predicate must keep matching that index's expression).
+     */
+    latestFileState(conversationId: string, path: string): Promise<{
+        size: number;
+        sha256: string;
+    } | null>;
     private validate;
     /** The append itself, in the context's transaction (both callers open or join one). */
     private write;