@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.3

package/dist/runtime/subagents/definition.js

@@ -1,13 +1,9 @@
-import { SKILL_ENTRY_FILE, sanitizeParams, } from "@capybara-hq/plugin-sdk";
+import { connectorToolKey, extensionToolKey, parseToolKey, SKILL_ENTRY_FILE, sanitizeParams, } from "@capybara-hq/plugin-sdk";
 import { loadTemplates } from "../../agents/templates.js";
 import { ApiError } from "../../errors.js";
 import { PINNED_SKILLS_LIMITS } from "../../skills/catalog.js";
-import { toolKey } from "../../tools/naming.js";
-/**
- * Tools a sub-agent never gets (spec §5.3, §5.5): `agent` (depth 1), `ask_user` (the person does not
- * see the child), `sandbox_deliver` (delivering files is the parent's job) and `skill_write`.
- */
-export const CHILD_REMOVED_TOOLS = ["agent", "ask_user", "sandbox_deliver", "skill_write"];
+import { CHILD_REMOVED_TOOLS } from "../../tools/builtin-names.js";
+export { CHILD_REMOVED_TOOLS } from "../../tools/builtin-names.js";
 /**
  * The roster entry's template is gone (an inline template edited away, a plugin template
  * uninstalled) between resolving the roster and reading it. The dispatch refuses the call as an
@@ -72,7 +68,7 @@ async function loadConnectors(db, orgId, refs) {
 /**
  * Narrows tool refs by resolved key (spec §5.3): keeps a key when `allow` (if given) lists it and
  * neither `deny` nor {@link CHILD_REMOVED_TOOLS} does. A connector ref with `tools: "all"` stays
- * live only when nothing can narrow it (no allowlist and no deny key under `<slug>__`), so a tool
+ * live only when nothing can narrow it (no allowlist and no deny key under `mcp__<slug>__`), so a tool
  * the connector gains later never slips past the template; otherwise it becomes the kept names, or
  * is dropped. A connector that no longer exists keeps its ref only without an allowlist.
  */
@@ -86,7 +82,7 @@ function narrowTools(refs, connectors, allow, deny) {
                 out.push(ref);
         }
         else if (ref.kind === "plugin") {
-            if (keep(toolKey(ref.plugin, ref.name)))
+            if (keep(extensionToolKey(ref.plugin, ref.name)))
                 out.push(ref);
         }
         else {
@@ -96,13 +92,16 @@ function narrowTools(refs, connectors, allow, deny) {
                     out.push(ref);
                 continue;
             }
-            const prefix = toolKey(c.slug, "");
-            if (ref.tools === "all" && allow === null && ![...deny].some((k) => k.startsWith(prefix))) {
+            const ownsKey = (k) => {
+                const parsed = parseToolKey(k);
+                return parsed?.kind === "connector" && parsed.slug === c.slug;
+            };
+            if (ref.tools === "all" && allow === null && ![...deny].some(ownsKey)) {
                 out.push(ref);
                 continue;
             }
             const names = ref.tools === "all" ? c.tools : ref.tools;
-            const kept = names.filter((name) => keep(toolKey(c.slug, name)));
+            const kept = names.filter((name) => keep(connectorToolKey(c.slug, name)));
             if (kept.length > 0)
                 out.push({ ...ref, tools: kept });
         }

package/dist/runtime/subagents/dispatch.d.ts

@@ -48,7 +48,7 @@ export type DispatchOutcome = {
 };
 /**
  * A dispatch for a person's fork invocation (phase D spec §6.2, `advanceSkillForks`), not for a
- * model's `agent` call: `general-purpose` is always available (the `agent` tool and
+ * model's `Agent` call: `general-purpose` is always available (the `Agent` tool and
  * `subagents.general` do not gate it), an unknown type falls back to it with a warning, and the
  * child records the invoked skill.
  */
@@ -83,7 +83,7 @@ export interface DispatchPlan {
     tierFallback: boolean;
 }
 /**
- * Dispatches the sub-agent of one `agent` call (spec §7.1), after the pipeline's validation,
+ * Dispatches the sub-agent of one `Agent` call (spec §7.1), after the pipeline's validation,
  * policy, approval and `tool.preExecute` stages. A new sub-agent: resolves its type and effective
  * definition, then in one transaction (holding the parent run's row lock, so the dispatches of one
  * run serialize) inserts the child conversation, appends `subagent_started` and the task message,

package/dist/runtime/subagents/dispatch.js

@@ -20,7 +20,7 @@ const GENERAL_ENTRY = {
 /** Idempotency key of the parent's `subagent_dispatched` event. */
 export const dispatchedIdemKey = (runId, callId) => `subagent_dispatched:${runId}:${callId}`;
 /**
- * Dispatches the sub-agent of one `agent` call (spec §7.1), after the pipeline's validation,
+ * Dispatches the sub-agent of one `Agent` call (spec §7.1), after the pipeline's validation,
  * policy, approval and `tool.preExecute` stages. A new sub-agent: resolves its type and effective
  * definition, then in one transaction (holding the parent run's row lock, so the dispatches of one
  * run serialize) inserts the child conversation, appends `subagent_started` and the task message,
@@ -274,7 +274,7 @@ async function orgAgentGates(db, a, agentId, agentType, resumed) {
 }
 const taskMessage = (ctx, callId, prompt, narrowed, 
 /**
- * A fork invocation's record: the child's log then holds the invocation, so its `skill_load`
+ * A fork invocation's record: the child's log then holds the invocation, so its `Skill`
  * is offered and resolves the invoked version (phase D).
  */
 skill) => ({

package/dist/runtime/subagents/org-agents.js

@@ -1,6 +1,7 @@
 import { isAgentVisibleTo } from "../../agents/agent-lookup.js";
 import { normalizeStoredDefinition } from "../../agents/definition.js";
 import { audit } from "../../identity/audit.js";
+import { normalizeStoredDefinitionIn } from "../../tools/legacy-data.js";
 /**
  * Checks the gates for dispatching `agentId` from a parent whose current definition is
  * `parentDefinition` (read live by the caller: R5, removing an allowlist entry stops new
@@ -23,7 +24,7 @@ export async function checkOrgAgent(db, a) {
     if (!(a.parentDefinition.subagents?.agents ?? []).some((x) => x.agentId === a.agentId)) {
         return { ok: false, gate: "allowlist" };
     }
-    const definition = normalizeStoredDefinition(row.definition);
+    const definition = await normalizeStoredDefinitionIn(db, a.orgId, row.definition);
     if (definition.subagents?.dispatchable !== true)
         return { ok: false, gate: "dispatchable" };
     if (!(await isAgentVisibleTo(db, a.agentId, a.triggerAccountId))) {

package/dist/runtime/subagents/roster.d.ts

@@ -45,7 +45,7 @@ export declare const isGeneralAlias: (agent: string) => boolean;
  * `general-purpose` for no `agent` and Claude's built-in types; else a roster type (a bare name
  * prefers the skill's own plugin's template `<plugin>:<name>`, then {@link findType}). An `agent`
  * that does not resolve falls back to `general-purpose` and is returned as `unknown`. `inRoster`:
- * the type is one the parent's `agent` tool offers (`general-purpose` is not when
+ * the type is one the parent's `Agent` tool offers (`general-purpose` is not when
  * `subagents.general === false`, which does not block a person's fork invocation).
  */
 export declare function resolveSkillForkType(db: KernelSchemaDb, orgId: string, parent: Pick<AgentDefinition, "subagents">, agent: string | undefined, plugin: string | undefined): Promise<{

package/dist/runtime/subagents/roster.js

@@ -90,7 +90,7 @@ export const isGeneralAlias = (agent) => GENERAL_ALIASES.has(agent);
  * `general-purpose` for no `agent` and Claude's built-in types; else a roster type (a bare name
  * prefers the skill's own plugin's template `<plugin>:<name>`, then {@link findType}). An `agent`
  * that does not resolve falls back to `general-purpose` and is returned as `unknown`. `inRoster`:
- * the type is one the parent's `agent` tool offers (`general-purpose` is not when
+ * the type is one the parent's `Agent` tool offers (`general-purpose` is not when
  * `subagents.general === false`, which does not block a person's fork invocation).
  */
 export async function resolveSkillForkType(db, orgId, parent, agent, plugin) {

package/dist/runtime/subagents/skill-fork.d.ts

@@ -8,7 +8,7 @@ import { type DispatchDeps } from "./dispatch.js";
 /**
  * Forked skills (phase D spec §6): a person's invocation of a `context: fork` skill starts its own
  * run (the run boundary, {@link forkBoundary}), whose `prepare` node dispatches the sub-agent
- * through phase C's `dispatchSubagent` before any model call and waits on it like an `agent` call
+ * through phase C's `dispatchSubagent` before any model call and waits on it like an `Agent` call
  * (`subagents` wait `sa-<runId>-0`). When the child has ended, `prepare` appends the model-visible
  * `skill_fork_result` and the parent's model answers. Every terminal path of the run (and the wait
  * sweep) pairs a fork invocation without a report ({@link pairStoppedForks}), so the log never holds
@@ -110,7 +110,7 @@ export declare const recordedSkillForks: (eventLog: Pick<EventLog, "append" | "f
  * In the transaction of a run's terminal path (or the wait sweep): the run's fork invocation
  * (its trigger message, by the run boundary) without a report gets one now: the ended child's
  * result (and the parent's missing `subagent_finished`), {@link AGENT_STOPPED_WITH_RUN_TEXT} for a
- * child still active (the caller stops it after its commit, as for `agent` calls), or
+ * child still active (the caller stops it after its commit, as for `Agent` calls), or
  * {@link FORK_NOT_STARTED_TEXT} when nothing was dispatched. Returns the call ids written
  * (`skill-<seq>`) and the highest seq; the caller notifies after its commit.
  */

package/dist/runtime/subagents/skill-fork.js

@@ -7,7 +7,7 @@ import { dispatchSubagent } from "./dispatch.js";
 /**
  * Forked skills (phase D spec §6): a person's invocation of a `context: fork` skill starts its own
  * run (the run boundary, {@link forkBoundary}), whose `prepare` node dispatches the sub-agent
- * through phase C's `dispatchSubagent` before any model call and waits on it like an `agent` call
+ * through phase C's `dispatchSubagent` before any model call and waits on it like an `Agent` call
  * (`subagents` wait `sa-<runId>-0`). When the child has ended, `prepare` appends the model-visible
  * `skill_fork_result` and the parent's model answers. Every terminal path of the run (and the wait
  * sweep) pairs a fork invocation without a report ({@link pairStoppedForks}), so the log never holds
@@ -190,7 +190,7 @@ export const recordedSkillForks = (eventLog, recorded) => ({
  * In the transaction of a run's terminal path (or the wait sweep): the run's fork invocation
  * (its trigger message, by the run boundary) without a report gets one now: the ended child's
  * result (and the parent's missing `subagent_finished`), {@link AGENT_STOPPED_WITH_RUN_TEXT} for a
- * child still active (the caller stops it after its commit, as for `agent` calls), or
+ * child still active (the caller stops it after its commit, as for `Agent` calls), or
  * {@link FORK_NOT_STARTED_TEXT} when nothing was dispatched. Returns the call ids written
  * (`skill-<seq>`) and the highest seq; the caller notifies after its commit.
  */

package/dist/runtime/subagents/subagents.service.d.ts

@@ -12,7 +12,7 @@ import { type ChildWriter, type DispatchArgs, type DispatchCommit, type Dispatch
 import { type SubagentStep } from "./progress.js";
 import { type SkillForkDeps, type SkillForks } from "./skill-fork.js";
 /**
- * Sub-agents (phase C, spec §7) and forked skills (phase D): the `agent` tool's dispatch (the
+ * Sub-agents (phase C, spec §7) and forked skills (phase D): the `Agent` tool's dispatch (the
  * tool pipeline calls {@link dispatch}), a run's fork invocation ({@link skillForks}, the loop's
  * `prepare`) and a child step's progress on the parent's stream ({@link progress}). Child runs go
  * to the sub-agent run queue through {@link RunJobs}. The child lifecycle after dispatch (a
@@ -28,13 +28,13 @@ export declare class SubagentsService {
     /** The live fork handler of the loop (`LoopDeps.skillForks`). */
     readonly skillForks: SkillForks;
     constructor(kdb: KernelDb, eventLog: EventLog, purposes: ModelPurposesService, registry: ProviderRegistry, config: KernelConfigService, jobs: RunJobs, invoker: SkillInvoker, bus: ExtensionContext["bus"], log: KernelLogger, txHost: TransactionHost);
-    /** Dispatches the sub-agent of one `agent` call (`dispatchSubagent`). */
+    /** Dispatches the sub-agent of one `Agent` call (`dispatchSubagent`). */
     dispatch(a: DispatchArgs): Promise<DispatchOutcome>;
     /** The dispatch's writes in a transaction of their own (see `commitDispatchIn`). */
     commitDispatch(a: DispatchArgs, plan: DispatchPlan, child: ChildWriter): Promise<DispatchCommit | null>;
     /** A sub-agent's finished step on its parent's stream (sub-agents spec §14.2). Never throws. */
     progress(s: SubagentStep): Promise<void>;
 }
-/** Sub-agent dispatch (the tools domain's `agent` tool and the run loop use it). */
+/** Sub-agent dispatch (the tools domain's `Agent` tool and the run loop use it). */
 export declare class SubagentsModule {
 }

package/dist/runtime/subagents/subagents.service.js

@@ -24,7 +24,7 @@ import { commitDispatchIn, dispatchSubagent, } from "./dispatch.js";
 import { publishSubagentProgress } from "./progress.js";
 import { liveSkillForks } from "./skill-fork.js";
 /**
- * Sub-agents (phase C, spec §7) and forked skills (phase D): the `agent` tool's dispatch (the
+ * Sub-agents (phase C, spec §7) and forked skills (phase D): the `Agent` tool's dispatch (the
  * tool pipeline calls {@link dispatch}), a run's fork invocation ({@link skillForks}, the loop's
  * `prepare`) and a child step's progress on the parent's stream ({@link progress}). Child runs go
  * to the sub-agent run queue through {@link RunJobs}. The child lifecycle after dispatch (a
@@ -58,7 +58,7 @@ let SubagentsService = class SubagentsService {
         };
         this.skillForks = liveSkillForks(this.deps);
     }
-    /** Dispatches the sub-agent of one `agent` call (`dispatchSubagent`). */
+    /** Dispatches the sub-agent of one `Agent` call (`dispatchSubagent`). */
     dispatch(a) {
         return dispatchSubagent(this.deps, a);
     }
@@ -88,7 +88,7 @@ SubagentsService = __decorate([
     __param(9, Inject(TransactionHost))
 ], SubagentsService);
 export { SubagentsService };
-/** Sub-agent dispatch (the tools domain's `agent` tool and the run loop use it). */
+/** Sub-agent dispatch (the tools domain's `Agent` tool and the run loop use it). */
 let SubagentsModule = class SubagentsModule {
 };
 SubagentsModule = __decorate([

package/dist/runtime/waits.d.ts

@@ -42,7 +42,7 @@ export interface WaitSweepResult {
     /** 运行已终态、被本次扫描取消的审批 / 输入请求。 */
     cancelled: number;
     /**
-     * Finished parent runs whose open `agent` calls had no `tool_result`, repaired (final review
+     * Finished parent runs whose open `Agent` calls had no `tool_result`, repaired (final review
      * I3: the next run would send an unpaired tool call, which providers refuse).
      */
     repaired: number;
@@ -75,7 +75,7 @@ export declare class Waits implements OnApplicationShutdown {
     private readonly questions;
     private readonly runQueue;
     /**
-     * Writes, in the caller's transaction, the results of a stopped run's open `agent` calls;
+     * Writes, in the caller's transaction, the results of a stopped run's open `Agent` calls;
      * `fire` runs their observe hooks after the commit.
      */
     private readonly pipeline;
@@ -96,7 +96,7 @@ export declare class Waits implements OnApplicationShutdown {
     private readonly unsubscribe;
     constructor(kdb: KernelDb, eventLog: EventLog, approvals: Pick<ApprovalsService, "expire" | "cancelPendingIn">, questions: Pick<QuestionsService, "expire" | "cancelPendingIn">, runQueue: Pick<RunQueue, "enqueue" | "repairOrphan" | "abortIfOrphaned">, 
     /**
-     * Writes, in the caller's transaction, the results of a stopped run's open `agent` calls;
+     * Writes, in the caller's transaction, the results of a stopped run's open `Agent` calls;
      * `fire` runs their observe hooks after the commit.
      */
     pipeline: Pick<ToolPipeline, "stopOpenAgentCalls">, finisher: Pick<RunFinish, "finishIn">, 
@@ -163,7 +163,7 @@ export declare class Waits implements OnApplicationShutdown {
      * 运行已不是 waiting（例如刚被续跑）→ 返回 false，由调用方走常规中止。
      */
     abortWaiting(conversationId: string, runId: string, byAccountId: string | null, detail?: RunAbortDetail): Promise<boolean>;
-    /** {@link abortWaiting}'s transaction; the open `agent` calls it wrote go back through `st`. */
+    /** {@link abortWaiting}'s transaction; the open `Agent` calls it wrote go back through `st`. */
     private abortWaitingIn;
     /** 扫描 3：运行已终态（如暂停途中失败）仍 pending 的审批 / 输入请求 → 取消（写决定 / 回答事件）。 */
     private sweepFinishedRuns;
@@ -193,7 +193,7 @@ export declare class Waits implements OnApplicationShutdown {
      */
     private sweepSubagentOrphans;
     /**
-     * Finished parent runs (past the grace period, within the last day) with an `agent` call that has
+     * Finished parent runs (past the grace period, within the last day) with an `Agent` call that has
      * no `tool_result` (final review I3): a terminal path that skipped `stopOpenAgentCalls`, such as
      * an old replica's abort, would otherwise leave an unpaired tool call that every later request of
      * the conversation sends and providers refuse. Each is repaired under the conversation row lock

package/dist/runtime/waits.js

@@ -75,7 +75,7 @@ let Waits = class Waits {
     unsubscribe;
     constructor(kdb, eventLog, approvals, questions, runQueue, 
     /**
-     * Writes, in the caller's transaction, the results of a stopped run's open `agent` calls;
+     * Writes, in the caller's transaction, the results of a stopped run's open `Agent` calls;
      * `fire` runs their observe hooks after the commit.
      */
     pipeline, finisher, 
@@ -337,7 +337,7 @@ let Waits = class Waits {
         await this.stopChildren(runId, null).catch((err) => this.log.error("cannot stop the sub-agents of a run", { runId, err }));
         return true;
     }
-    /** {@link abortWaiting}'s transaction; the open `agent` calls it wrote go back through `st`. */
+    /** {@link abortWaiting}'s transaction; the open `Agent` calls it wrote go back through `st`. */
     async abortWaitingIn(conversationId, runId, byAccountId, detail, st) {
         const t = this.db;
         await t
@@ -385,7 +385,7 @@ let Waits = class Waits {
             if (typeof spec.step === "number")
                 steps.add(spec.step);
         }
-        // a parent waiting on sub-agents (spec §12): its open `agent` calls get their results
+        // a parent waiting on sub-agents (spec §12): its open `Agent` calls get their results
         const agents = await this.pipeline.stopOpenAgentCalls(runId);
         for (const step of agents.steps)
             steps.add(step);
@@ -626,7 +626,7 @@ let Waits = class Waits {
         return out;
     }
     /**
-     * Finished parent runs (past the grace period, within the last day) with an `agent` call that has
+     * Finished parent runs (past the grace period, within the last day) with an `Agent` call that has
      * no `tool_result` (final review I3): a terminal path that skipped `stopOpenAgentCalls`, such as
      * an old replica's abort, would otherwise leave an unpaired tool call that every later request of
      * the conversation sends and providers refuse. Each is repaired under the conversation row lock
@@ -887,7 +887,7 @@ let Waits = class Waits {
      * 等待中的调用给取消说明，其余（排在等待调用之后、尚未执行的）给「未执行」说明。
      */
     async stoppedResults(t, conversationId, runId, steps, cancelled, 
-    /** Calls whose result the caller writes itself (open `agent` calls). */
+    /** Calls whose result the caller writes itself (open `Agent` calls). */
     skip = new Set()) {
         const out = [];
         for (const step of steps.sort((a, b) => a - b)) {

package/dist/skills/catalog.d.ts

@@ -11,7 +11,7 @@ import { type CatalogSkill, type PinnedSkill, type SkillsSnapshot } from "../run
 import { type PrefixedStorage, StorageService } from "../storage/storage.service.js";
 /**
  * 技能目录快照（M5 T14，Ruling M17）：运行开始时解析「此刻对这个对话生效的技能」，与日志里最新一份快照不同才写
- * `skills_catalog`。模型看到的目录与 `skill_load` 的名字解析只来自日志，不读实时的库。
+ * `skills_catalog`。模型看到的目录与 `Skill` 的名字解析只来自日志，不读实时的库。
  */
 /**
  * Pinned skill limits (spec §9.1): at most `count` pinned skills per agent, whose current SKILL.md
@@ -103,9 +103,9 @@ export declare function loadPinnedBodies(storage: PrefixedStorage, orgId: string
 export declare function fitPinned(pinned: readonly PinnedSkill[], log: Pick<Logger, "warn"> | undefined, input: Partial<Pick<EffectiveSkillsInput, "orgId" | "agentId" | "conversationId">>): PinnedSkill[];
 /** `skills_catalog` 的幂等键：每次运行最多写一份。 */
 /**
- * 是否给模型 `skill_load`：日志里有过技能目录快照（Ruling M17），**即使最新一份是空的**。构建请求与执行工具调用
+ * 是否给模型 `Skill`：日志里有过技能目录快照（Ruling M17），**即使最新一份是空的**。构建请求与执行工具调用
  * 用同一判定。不因空快照收回这个工具：工具集合一变缓存前缀就失效；而且 agent 没有别的工具时会发出「没有工具
- * 但历史里有 tool_use」的请求，Anthropic 会拒绝。空目录下调用 skill_load 由 `NO_SKILLS_TEXT` 给出可执行的说明。
+ * 但历史里有 tool_use」的请求，Anthropic 会拒绝。空目录下调用 Skill 由 `NO_SKILLS_TEXT` 给出可执行的说明。
  */
 export declare function skillLoadOffered(latest: Extract<ConversationEvent, {
     type: "skills_catalog";
@@ -124,7 +124,7 @@ export declare const skillsCatalogIdemKey: (runId: string) => string;
 /**
  * 在调用方事务里锁会话行（与 `EventLog.append` 同一把锁）并读最新一份技能目录快照（没有为 undefined）。
  * `db` is the caller's transaction handle (`KernelDb.db` inside `@Transactional`).
- * 「读最新 → 推出下一份 → 追加」都在这把锁内，别的写快照的事务（运行开始、skill_write、拒绝时的回退）插不进来。
+ * 「读最新 → 推出下一份 → 追加」都在这把锁内，别的写快照的事务（运行开始、SkillWrite、拒绝时的回退）插不进来。
  */
 export declare function lockLatestCatalog(db: KernelSchemaDb, conversationId: string): Promise<SkillsSnapshot | undefined>;
 /**

package/dist/skills/catalog.js

@@ -23,7 +23,7 @@ import { sameSnapshot, } from "../runtime/context/skills.js";
 import { StorageService } from "../storage/storage.service.js";
 /**
  * 技能目录快照（M5 T14，Ruling M17）：运行开始时解析「此刻对这个对话生效的技能」，与日志里最新一份快照不同才写
- * `skills_catalog`。模型看到的目录与 `skill_load` 的名字解析只来自日志，不读实时的库。
+ * `skills_catalog`。模型看到的目录与 `Skill` 的名字解析只来自日志，不读实时的库。
  */
 /**
  * Pinned skill limits (spec §9.1): at most `count` pinned skills per agent, whose current SKILL.md
@@ -303,9 +303,9 @@ export function fitPinned(pinned, log, input) {
 }
 /** `skills_catalog` 的幂等键：每次运行最多写一份。 */
 /**
- * 是否给模型 `skill_load`：日志里有过技能目录快照（Ruling M17），**即使最新一份是空的**。构建请求与执行工具调用
+ * 是否给模型 `Skill`：日志里有过技能目录快照（Ruling M17），**即使最新一份是空的**。构建请求与执行工具调用
  * 用同一判定。不因空快照收回这个工具：工具集合一变缓存前缀就失效；而且 agent 没有别的工具时会发出「没有工具
- * 但历史里有 tool_use」的请求，Anthropic 会拒绝。空目录下调用 skill_load 由 `NO_SKILLS_TEXT` 给出可执行的说明。
+ * 但历史里有 tool_use」的请求，Anthropic 会拒绝。空目录下调用 Skill 由 `NO_SKILLS_TEXT` 给出可执行的说明。
  */
 export function skillLoadOffered(latest, 
 /**
@@ -336,7 +336,7 @@ export const skillsCatalogIdemKey = (runId) => `skills_catalog:${runId}`;
 /**
  * 在调用方事务里锁会话行（与 `EventLog.append` 同一把锁）并读最新一份技能目录快照（没有为 undefined）。
  * `db` is the caller's transaction handle (`KernelDb.db` inside `@Transactional`).
- * 「读最新 → 推出下一份 → 追加」都在这把锁内，别的写快照的事务（运行开始、skill_write、拒绝时的回退）插不进来。
+ * 「读最新 → 推出下一份 → 追加」都在这把锁内，别的写快照的事务（运行开始、SkillWrite、拒绝时的回退）插不进来。
  */
 export async function lockLatestCatalog(db, conversationId) {
     await db

package/dist/skills/changes.service.d.ts

@@ -97,9 +97,9 @@ export interface CancelledDrafts {
 }
 /**
  * agent 自写技能与共享 agent 的技能变更审批（M5 T15，R4）：
- * - `write`（工具 `skill_write` 调用）：私有 agent 直接生成新版本；共享 agent 生成一条待负责人批准的申请，
+ * - `write`（工具 `SkillWrite` 调用）：私有 agent 直接生成新版本；共享 agent 生成一条待负责人批准的申请，
  *   期间只有发起对话试用（`resolveEffectiveSkills` 按对话合并）；两种情况都在同一事务里往发起对话追加一份
- *   技能目录快照（Ruling M17：日志是唯一事实源），同一运行的下一步即可 `skill_load`；
+ *   技能目录快照（Ruling M17：日志是唯一事实源），同一运行的下一步即可 `Skill`；
  * - `decide`（HTTP，只有该 agent 当前的负责人）：批准 → 版本对所有对话生效（各对话下一次运行开始时写新快照）；
  *   拒绝 → 删除草稿对象，发起对话下一次运行开始时目录回到当前版本；
  * - 同一 agent 的同名技能最多一条待处理申请：同一对话再写取代旧的（旧的 cancelled、草稿删除、技能 id 不变），

package/dist/skills/changes.service.js

@@ -22,6 +22,7 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { sameSnapshot, } from "../runtime/context/skills.js";
 import { StorageService } from "../storage/storage.service.js";
+import { BUILTIN } from "../tools/builtin-names.js";
 import { fitPinned, invocationOf, lockLatestCatalog } from "./catalog.js";
 /**
  * 每个 agent 自己的技能（`scope = agent`）上限，含待批准的新技能。远低于目录快照的上限（`SKILLS_CATALOG_MAX`），
@@ -42,7 +43,7 @@ const AGENT_GONE_TEXT = "This agent no longer exists, so the skill cannot be sav
 const iso = (v) => new Date(v).toISOString();
 const byName = (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
 const notFound = () => new ApiError("skill_change.not_found", "Skill change not found");
-/** The body of the SKILL.md a skill_write just stored (as run start would read it); null if unparsable. */
+/** The body of the SKILL.md a SkillWrite just stored (as run start would read it); null if unparsable. */
 function writtenBody(pkg) {
     const md = pkg.files.find((f) => f.path === SKILL_ENTRY_FILE);
     if (!md)
@@ -57,9 +58,9 @@ function writtenBody(pkg) {
 }
 /**
  * agent 自写技能与共享 agent 的技能变更审批（M5 T15，R4）：
- * - `write`（工具 `skill_write` 调用）：私有 agent 直接生成新版本；共享 agent 生成一条待负责人批准的申请，
+ * - `write`（工具 `SkillWrite` 调用）：私有 agent 直接生成新版本；共享 agent 生成一条待负责人批准的申请，
  *   期间只有发起对话试用（`resolveEffectiveSkills` 按对话合并）；两种情况都在同一事务里往发起对话追加一份
- *   技能目录快照（Ruling M17：日志是唯一事实源），同一运行的下一步即可 `skill_load`；
+ *   技能目录快照（Ruling M17：日志是唯一事实源），同一运行的下一步即可 `Skill`；
  * - `decide`（HTTP，只有该 agent 当前的负责人）：批准 → 版本对所有对话生效（各对话下一次运行开始时写新快照）；
  *   拒绝 → 删除草稿对象，发起对话下一次运行开始时目录回到当前版本；
  * - 同一 agent 的同名技能最多一条待处理申请：同一对话再写取代旧的（旧的 cancelled、草稿删除、技能 id 不变），
@@ -245,7 +246,7 @@ let SkillChangesService = class SkillChangesService {
                     files: pkg.manifest.files.length,
                     agentId: ctx.agentId,
                     conversationId: ctx.conversationId,
-                    via: "skill_write",
+                    via: BUILTIN.SkillWrite,
                 },
             });
             outcome = { kind: "version", skillId, version, created: !existing };

package/dist/skills/invocation-keys.d.ts

@@ -2,7 +2,7 @@
  * The SKILL.md invocation keys (package ecosystem phase D) and their lenient reading: readers of
  * stored files (catalog install and upgrade) and the Claude Code translation drop a key the strict
  * `parseSkillMd` checks would refuse, with the reason, instead of refusing the skill or storing an
- * invocation nobody can use. Uploads, native imports and `skill_write` stay strict.
+ * invocation nobody can use. Uploads, native imports and `SkillWrite` stay strict.
  */
 /** The frontmatter keys that make up a skill's invocation metadata. */
 export declare const INVOCATION_KEYS: readonly ["disable-model-invocation", "user-invocable", "context", "agent", "argument-hint", "arguments"];

package/dist/skills/invocation-keys.js

@@ -3,7 +3,7 @@ import { parseSkillMd } from "@capybara-hq/plugin-sdk";
  * The SKILL.md invocation keys (package ecosystem phase D) and their lenient reading: readers of
  * stored files (catalog install and upgrade) and the Claude Code translation drop a key the strict
  * `parseSkillMd` checks would refuse, with the reason, instead of refusing the skill or storing an
- * invocation nobody can use. Uploads, native imports and `skill_write` stay strict.
+ * invocation nobody can use. Uploads, native imports and `SkillWrite` stay strict.
  */
 /** The frontmatter keys that make up a skill's invocation metadata. */
 export const INVOCATION_KEYS = [

package/dist/skills/invoke.d.ts

@@ -121,7 +121,7 @@ export declare class SkillInvoker {
      * `storage.unavailable` (`skill_unreadable`) when the version is gone or its SKILL.md cannot be
      * read, plain `storage.unavailable` when storage is down. `task` renders the text for the
      * sub-agent's effective definition: the shell-injection line only when the sub-agent has
-     * `sandbox_bash` (batch 3 review m1).
+     * `Bash` (batch 3 review m1).
      */
     renderTask(a: {
         orgId: string;

package/dist/skills/invoke.js

@@ -15,6 +15,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { isGeneralAlias, resolveSkillForkType } from "../runtime/subagents/roster.js";
 import { StorageService } from "../storage/storage.service.js";
+import { BUILTIN } from "../tools/builtin-names.js";
 import { findSkillVersion, readSkillFile, SkillIntegrityError, } from "../tools/builtins/skill-load.js";
 import { invocationOf, resolveSkills } from "./catalog.js";
 /** A leading `/<name>` or `/<plugin>:<name>`, then whitespace or the end (spec §3.2). */
@@ -142,10 +143,10 @@ let SkillInvoker = class SkillInvoker {
         const body = await this.readBody(a.orgId, found);
         const others = found.manifest.files.some((f) => f.path !== SKILL_ENTRY_FILE);
         const lines = {
-            // the invocation itself makes the conversation's next run offer skill_load (skillLoadOffered)
+            // the invocation itself makes the conversation's next run offer Skill (skillLoadOffered)
             ...(others && { files: "load" }),
             ...(hasShellInjection(body) &&
-                hasBuiltin(a.agent, "sandbox_bash") && { shellHint: true }),
+                hasBuiltin(a.agent, BUILTIN.Bash) && { shellHint: true }),
         };
         const input = {
             name: a.name,
@@ -192,7 +193,7 @@ let SkillInvoker = class SkillInvoker {
      * `storage.unavailable` (`skill_unreadable`) when the version is gone or its SKILL.md cannot be
      * read, plain `storage.unavailable` when storage is down. `task` renders the text for the
      * sub-agent's effective definition: the shell-injection line only when the sub-agent has
-     * `sandbox_bash` (batch 3 review m1).
+     * `Bash` (batch 3 review m1).
      */
     async renderTask(a) {
         const { skill } = a;
@@ -225,7 +226,7 @@ let SkillInvoker = class SkillInvoker {
             lines: {
                 ...(others && { files: "load" }),
                 ...(hasShellInjection(body) &&
-                    hasBuiltin(child, "sandbox_bash") && { shellHint: true }),
+                    hasBuiltin(child, BUILTIN.Bash) && { shellHint: true }),
             },
             lead: false,
         });

package/dist/tools/approvals.service.d.ts

@@ -1,3 +1,4 @@
+import { type LocalizedName } from "@capybara-hq/plugin-sdk";
 import { EventLog } from "../conversations/event-log.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -43,6 +44,11 @@ export interface ApprovalView extends ApprovalRecord {
         name: string;
         slug: string;
     } | null;
+    /** An extension tool's plugin (`plugin__<plugin>__<tool>`) and its display name (display only). */
+    extension: {
+        name: string;
+        displayName: LocalizedName;
+    } | null;
     agent: {
         id: string;
         name: string;

package/dist/tools/approvals.service.js

@@ -8,6 +8,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
+import { connectorToolKey, parseToolKey } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { EventLog } from "../conversations/event-log.js";
@@ -19,6 +20,7 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
 import { ORG_ROLES, roleAtLeast } from "../orgs/roles.js";
+import { pluginDisplayNames } from "./display-names.js";
 export { APPROVAL_DENY_REASON_MAX_CHARS } from "../conversations/events.js";
 /** `list` 一次最多返回的审批数（收件箱据此判断这个来源是否取满）。 */
 export const APPROVALS_LIST_MAX = 100;
@@ -579,12 +581,22 @@ let ApprovalsService = class ApprovalsService {
                 .where("id", "in", connectorIds)
                 .execute();
         const connectorById = new Map(apps.map((a) => [a.id, a]));
+        const pluginOf = (r) => {
+            if (r.connectorId !== null)
+                return null;
+            const p = parseToolKey(r.toolKey);
+            return p?.kind === "extension" ? p.plugin : null;
+        };
+        const displayNames = await pluginDisplayNames(db.db, recs.flatMap((r) => {
+            const p = pluginOf(r);
+            return p === null ? [] : [p];
+        }));
         return recs.flatMap((r) => {
             const c = ctx.get(r.runId);
             if (!c)
                 return [];
             const app = r.connectorId === null ? undefined : connectorById.get(r.connectorId);
-            const prefix = app ? `${app.slug}__` : undefined;
+            const prefix = app ? connectorToolKey(app.slug, "") : undefined;
             return [
                 {
                     ...r,
@@ -592,6 +604,12 @@ let ApprovalsService = class ApprovalsService {
                         ? r.toolKey.slice(prefix.length)
                         : r.toolKey,
                     connector: app ? { id: app.id, name: app.name, slug: app.slug } : null,
+                    extension: (() => {
+                        const p = pluginOf(r);
+                        return p === null
+                            ? null
+                            : { name: p, displayName: displayNames.get(p) ?? { zh: p, en: p } };
+                    })(),
                     agent: { id: c.agent_id, name: names.get(c.agent_id) ?? "" },
                     ...(c.parent_conversation_id !== null
                         ? {