@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.3

package/dist/tools/naming.js

@@ -1,14 +1,12 @@
 /**
  * 工具命名（Global Constraints）：模型可见的工具 key 必须匹配 `^[a-zA-Z0-9_-]{1,64}$`；
- * 插件工具为 `<plugin>__<tool>`，连接器工具为 `<connectorSlug>__<tool>`，内置工具就是其名字本身。
+ * 插件工具为 `plugin__<plugin>__<tool>`，连接器工具为 `mcp__<connectorSlug>__<tool>`（拼与拆见 SDK 的 tool-key.ts），内置工具就是其名字本身。
  * 超长或含非法字符的 key 一律报出来，不截断、不猜。
  */
 export const TOOL_KEY_RE = /^[a-zA-Z0-9_-]{1,64}$/;
 export const TOOL_KEY_MAX = 64;
 /** 连接器 slug：小写字母开头，小写字母 / 数字 / 下划线，最长 24。 */
 export const APP_SLUG_RE = /^[a-z][a-z0-9_]{0,23}$/;
-/** 前缀与工具名之间的分隔符。 */
-export const KEY_SEPARATOR = "__";
 /**
  * slug 是否合法：除正则外，不得含连续下划线、不得以下划线结尾——否则 `a__b` + `c` 与 `a` + `b__c`
  * 会拼出同一个 key。
@@ -31,10 +29,6 @@ export function deriveSlug(name) {
         .replace(/_+$/, "");
     return isValidSlug(s) ? s : null;
 }
-/** 拼 `<prefix>__<name>`。 */
-export function toolKey(prefix, name) {
-    return `${prefix}${KEY_SEPARATOR}${name}`;
-}
 /** key 不合法时返回英文原因，合法时返回 null。 */
 export function toolKeyIssue(key) {
     if (key.length > TOOL_KEY_MAX) {

package/dist/tools/outputs.js

@@ -194,7 +194,7 @@ export async function spillIfLarge(text, opts, save) {
     return {
         content: `${text.slice(0, opts.previewChars)}\n…\n` +
             `[Output truncated: ${saved.sizeChars} chars, ${saved.lineCount} lines. Full output id: ${id}. ` +
-            `Use read_tool_output to page through it, or pass {"$output":"${id}"} as a tool argument.]`,
+            `Use ReadToolOutput to page through it, or pass {"$output":"${id}"} as a tool argument.]`,
         outputId: id,
     };
 }

package/dist/tools/pipeline.d.ts

@@ -142,8 +142,8 @@ interface PipelineDeps {
      */
     onToolsChanged(orgId: string, connectorId: string): void;
     /**
-     * Dispatches the sub-agent of an `agent` call (sub-agents spec §7.1; `dispatchSubagent`). Without
-     * it, `agent` calls reach the builtin's guard, which refuses them.
+     * Dispatches the sub-agent of an `Agent` call (sub-agents spec §7.1; `dispatchSubagent`). Without
+     * it, `Agent` calls reach the builtin's guard, which refuses them.
      */
     readonly subagents: {
         dispatch(a: {
@@ -229,7 +229,7 @@ export declare class ToolPipeline {
     private readonly decide;
     private readonly deps;
     constructor(kdb: KernelDb, eventLog: EventLog, 
-    /** The `agent` tool's sub-agent dispatch; absent (tests): `agent` calls are refused. */
+    /** The `Agent` tool's sub-agent dispatch; absent (tests): `Agent` calls are refused. */
     subagents: Pick<SubagentsService, "dispatch"> | undefined, registry: Pick<ToolRegistry, "forAgent" | "findConnector" | "handler">, credentials: Pick<Credentials, "injection" | "onUnauthorized">, breaker: Pick<Breaker, "check" | "failure" | "success">, outputs: Pick<ToolOutputs, "save" | "load">, approvals: Pick<ApprovalsService, "request" | "forCall">, questions: Pick<QuestionsService, "ask" | "forCall">, config: Pick<KernelConfigService, "get">, log: Logger, 
     /** Plugin hooks and inline ui contributions; absent (tests): no hooks, cards dropped. */
     host: Pick<ExtensionHost, "hooks" | "current"> | undefined, drift: Pick<ToolDrift, "onToolsChanged"> | undefined, txHost: TransactionHost, hooks?: ToolPipelineHooks);
@@ -242,7 +242,7 @@ export declare class ToolPipeline {
      */
     runStep(ctx: ToolStepContext): Promise<ToolStepOutcome>;
     /**
-     * An `agent` call that was dispatched (spec §7.1 "already dispatched"): when its child run is
+     * An `Agent` call that was dispatched (spec §7.1 "already dispatched"): when its child run is
      * terminal, writes the parent's `subagent_finished` (if the child's finisher did not) and the
      * call's `tool_result` from the child's log, and returns true; else false (still open).
      *
@@ -255,14 +255,14 @@ export declare class ToolPipeline {
     /** {@link stopOpenAgentCalls} in a transaction of its own (a stop seen by the tools node). */
     private stopOpenAgentCallsNow;
     /**
-     * Writes, in the caller's transaction (`mandatory`), the `tool_result` of every open `agent` call
+     * Writes, in the caller's transaction (`mandatory`), the `tool_result` of every open `Agent` call
      * of a run that is being stopped
      * (sub-agents spec §12: a person stopped it while it waited on sub-agents, or its deadline or a
      * stop hit its tools node after a dispatch). A call whose child already ended gets the child's
      * result (and the missing `subagent_finished`); one whose child is still active gets
      * {@link AGENT_STOPPED_WITH_RUN_TEXT}. The caller stops those children after its commit.
      *
-     * Like every `agent` result (see {@link finishAgentCall}), each is audited `tool.called` in it
+     * Like every `Agent` result (see {@link finishAgentCall}), each is audited `tool.called` in it
      * (duration: the child's, or the time since the dispatch) and fires `tool.postExecute`, through
      * `fire()`, which the caller runs after its commit. Returns the steps and calls written (the
      * caller must not write a "not executed" result for them) and the highest seq written.
@@ -280,9 +280,15 @@ export declare class ToolPipeline {
      */
     private processCall;
     private runCall;
+    /**
+     * Every tool key the request that issued this step's calls offered (`request.tools` plus the
+     * `catalog` keys), in any mode; null when its model_call is not found. Used to tell a call to an
+     * old key that was offered (in flight across the rename) from one that never was.
+     */
+    private requestToolKeys;
     /**
      * 发出本步调用的请求里带了完整定义的工具 key：本步最后一次尝试的 `model_call.request.tools`
-     * （`assistant_message` 来自最后一次尝试）。该请求不在 tool_search 模式（没有 `catalog`，工具全部发送）
+     * （`assistant_message` 来自最后一次尝试）。该请求不在 ToolSearch 模式（没有 `catalog`，工具全部发送）
      * 或找不到 model_call 时返回 null（不做加载检查）。已加载集合由此从日志得出，不放进程内存。
      */
     private sentTools;

package/dist/tools/pipeline.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { ToolError, validateInputForm, validateToolDisplay, } from "@capybara-hq/plugin-sdk";
+import { parseToolKey, ToolError, validateInputForm, validateToolDisplay, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable, Optional } from "@nestjs/common";
 import { normalizeStoredDefinition } from "../agents/definition.js";
 import { EventLog } from "../conversations/event-log.js";
@@ -32,11 +32,13 @@ import { SubagentsService } from "../runtime/subagents/subagents.service.js";
 import { skillLoadOfferedIn } from "../skills/catalog.js";
 import { ApprovalsService } from "./approvals.service.js";
 import { Breaker, breakerOpenMessage } from "./breaker.js";
+import { TOOL_SEARCH } from "./builtin-names.js";
 import { AGENT_STOPPED_WITH_RUN_TEXT, AGENT_TOOL, AgentToolInput, } from "./builtins/agent.js";
 import { isAlwaysLoaded, notLoadedText } from "./builtins/tool-search.js";
 import { CredentialMissing, Credentials } from "./credentials.js";
 import { ToolDrift } from "./drift.js";
 import { ElicitationSession } from "./elicitation.js";
+import { legacyHint, legacyToolInput, legacyToolKey } from "./legacy-keys.js";
 import { renderResult, resolveOutputRefs, spillIfLarge, ToolOutputs } from "./outputs.js";
 import { createDecidePolicy } from "./policy.js";
 import { QuestionsService } from "./questions.service.js";
@@ -67,8 +69,27 @@ export const RUN_STOPPED_TEXT = "The run was stopped before this tool call was e
 export const RUN_STOPPED_DURING_TEXT = "The run was stopped while this tool call was running; its outcome is unknown. Verify before retrying.";
 const timeoutText = (key, ms) => `Tool ${key} timed out after ${ms / 1000}s. The operation may or may not have completed; verify before retrying.`;
 const failedText = (key, errName) => `Tool ${key} failed (${errName}). The operation may not have completed; check before retrying or try another approach.`;
-const unknownToolText = (name, keys, toolSearch) => `Unknown tool "${name}". Available tools: ${keys.length === 0 ? "(none)" : keys.join(", ")}.` +
-    (toolSearch ? " Use tool_search to load other tools." : "");
+/**
+ * Is a logged call key the `Agent` tool: the current key, or the rc `agent` of a call dispatched
+ * before the rename (spec §9; a builtin maps without a scope)?
+ */
+const isAgentCallKey = (key) => key === AGENT_TOOL || legacyToolKey(key) === AGENT_TOOL;
+/** The connector slugs and extension names among the run's tools (to read old `<x>__<tool>` keys). */
+const legacyScopeOf = (tools) => {
+    const connectorSlugs = new Set();
+    const extensionNames = new Set();
+    for (const t of tools) {
+        const p = parseToolKey(t.key);
+        if (p?.kind === "connector")
+            connectorSlugs.add(p.slug);
+        else if (p?.kind === "extension")
+            extensionNames.add(p.plugin);
+    }
+    return { connectorSlugs, extensionNames };
+};
+const unknownToolText = (name, keys, toolSearch, hint = null) => `Unknown tool "${name}". Available tools: ${keys.length === 0 ? "(none)" : keys.join(", ")}.` +
+    (toolSearch ? " Use ToolSearch to load other tools." : "") +
+    (hint === null ? "" : ` ${hint}`);
 const unavailableText = (name, reason) => `Tool "${name}" is unavailable: ${reason}.`;
 const deniedText = (key) => `Tool ${key} is denied by policy.`;
 /** Longest hook reason quoted in {@link hookDeniedText}. */
@@ -159,7 +180,7 @@ let ToolPipeline = class ToolPipeline {
     decide;
     deps;
     constructor(kdb, eventLog, 
-    /** The `agent` tool's sub-agent dispatch; absent (tests): `agent` calls are refused. */
+    /** The `Agent` tool's sub-agent dispatch; absent (tests): `Agent` calls are refused. */
     subagents, registry, credentials, breaker, outputs, approvals, questions, config, log, 
     /** Plugin hooks and inline ui contributions; absent (tests): no hooks, cards dropped. */
     host, drift, txHost, hooks) {
@@ -213,7 +234,7 @@ let ToolPipeline = class ToolPipeline {
             // 每步实时解析（连接器 / 插件状态可能在模型调用之后变化）
             if (!resolved) {
                 // the request builder's rule: a skills catalog snapshot (even an empty one) or a person's
-                // skill invocation in the log → skill_load is offered (see skillLoadOffered)
+                // skill invocation in the log → Skill is offered (see skillLoadOffered)
                 const skillLoad = await skillLoadOfferedIn(this.deps.db, this.deps.eventLog, ctx.conversationId);
                 resolved = await this.deps.registry.forAgent(ctx.orgId, {
                     tools: ctx.agent.tools ?? [],
@@ -223,13 +244,13 @@ let ToolPipeline = class ToolPipeline {
             }
             return resolved;
         };
-        // `agent` calls whose sub-agent still runs (spec §7.1): a dispatch never blocks later calls;
+        // `Agent` calls whose sub-agent still runs (spec §7.1): a dispatch never blocks later calls;
         // once every call was handled, the step waits for them
         let open = 0;
         for (const call of calls) {
             if (await eventLog.findByIdem(ctx.conversationId, idem.result(ctx.runId, call.id)))
                 continue;
-            if (call.name === AGENT_TOOL) {
+            if (isAgentCallKey(call.name)) {
                 const row = await dispatchOfCall(this.deps.db, ctx.runId, call.id);
                 if (row) {
                     if (!(await this.finishAgentCall(ctx, row, call, resolve)))
@@ -263,7 +284,7 @@ let ToolPipeline = class ToolPipeline {
         return { kind: "done" };
     }
     /**
-     * An `agent` call that was dispatched (spec §7.1 "already dispatched"): when its child run is
+     * An `Agent` call that was dispatched (spec §7.1 "already dispatched"): when its child run is
      * terminal, writes the parent's `subagent_finished` (if the child's finisher did not) and the
      * call's `tool_result` from the child's log, and returns true; else false (still open).
      *
@@ -279,12 +300,13 @@ let ToolPipeline = class ToolPipeline {
         const r = await childResult(this.deps.eventLog, row, { modelGiven });
         if (!r)
             return false;
-        // No spec-hash check as in processCall: an `agent` call writes no tool_call_started holding
+        // No spec-hash check as in processCall: an `Agent` call writes no tool_call_started holding
         // the executed definition's hash, and its description changes with the roster and limits
         // while the child runs. The call's approval (forCall: its latest) is by construction the one
         // that let this dispatch start, since a dispatch happens only after an approved decision.
         const approval = await this.deps.approvals.forCall(ctx.runId, call.id);
-        await this.writeResult(ctx, row.parentCallId, AGENT_TOOL, { content: r.content, isError: r.isError }, [finishedEvent(row, r.finished)], {
+        // the result keeps the logged key (`agent` for a call dispatched before the rename, spec §9)
+        await this.writeResult(ctx, row.parentCallId, call.name, { content: r.content, isError: r.isError }, [finishedEvent(row, r.finished)], {
             durationMs: r.finished.durationMs,
             connectorId: null,
             ...(approval?.status === "approved" && {
@@ -316,14 +338,14 @@ let ToolPipeline = class ToolPipeline {
         return this.stopOpenAgentCalls(runId, agent);
     }
     /**
-     * Writes, in the caller's transaction (`mandatory`), the `tool_result` of every open `agent` call
+     * Writes, in the caller's transaction (`mandatory`), the `tool_result` of every open `Agent` call
      * of a run that is being stopped
      * (sub-agents spec §12: a person stopped it while it waited on sub-agents, or its deadline or a
      * stop hit its tools node after a dispatch). A call whose child already ended gets the child's
      * result (and the missing `subagent_finished`); one whose child is still active gets
      * {@link AGENT_STOPPED_WITH_RUN_TEXT}. The caller stops those children after its commit.
      *
-     * Like every `agent` result (see {@link finishAgentCall}), each is audited `tool.called` in it
+     * Like every `Agent` result (see {@link finishAgentCall}), each is audited `tool.called` in it
      * (duration: the child's, or the time since the dispatch) and fires `tool.postExecute`, through
      * `fire()`, which the caller runs after its commit. Returns the steps and calls written (the
      * caller must not write a "not executed" result for them) and the highest seq written.
@@ -373,6 +395,8 @@ let ToolPipeline = class ToolPipeline {
             return none;
         const conversationId = run.conversation_id;
         const inputs = new Map();
+        // the logged key of each call (`agent` for a call dispatched before the rename, spec §9)
+        const names = new Map();
         const events = [];
         const calls = [];
         for (const d of dispatches) {
@@ -394,8 +418,11 @@ let ToolPipeline = class ToolPipeline {
                     .executeTakeFirst();
                 const content = msg?.payload?.content ?? [];
                 for (const b of content) {
-                    if (b.type === "tool_call" && b.id !== undefined)
+                    if (b.type === "tool_call" && b.id !== undefined) {
                         inputs.set(b.id, b.input);
+                        if (b.name !== undefined)
+                            names.set(b.id, b.name);
+                    }
                 }
             }
             const input = inputs.get(d.parent_call_id);
@@ -435,7 +462,7 @@ let ToolPipeline = class ToolPipeline {
                 payload: {
                     step: d.step,
                     callId: d.parent_call_id,
-                    toolKey: AGENT_TOOL,
+                    toolKey: names.get(d.parent_call_id) ?? AGENT_TOOL,
                     content: r.content,
                     isError: r.isError,
                 },
@@ -578,36 +605,48 @@ let ToolPipeline = class ToolPipeline {
             await this.writeResult(ctx, call.id, key, { content, isError: true });
             return undefined;
         };
-        const tool = resolved.tools.find((t) => t.key === call.name);
+        let tool = resolved.tools.find((t) => t.key === call.name);
+        // A call logged before the tool keys were renamed (spec 8.1): the request that issued it offered
+        // the old key. It runs as the current tool with translated input; the result keeps the logged key.
+        let legacy = false;
+        if (!tool) {
+            const next = legacyToolKey(call.name, legacyScopeOf(resolved.tools));
+            const current = next === null ? undefined : resolved.tools.find((t) => t.key === next);
+            if (current && (await this.requestToolKeys(ctx))?.has(call.name) === true) {
+                tool = current;
+                legacy = true;
+            }
+        }
         if (!tool) {
             const why = resolved.unavailable.find((u) => u.ref === call.name) ??
                 resolved.hidden?.find((u) => u.ref === call.name);
             if (why)
                 return fail(unavailableText(call.name, why.reason));
             let keys = resolved.tools.map((t) => t.key);
-            // tool_search 模式：目录可能很大，只列内置工具与发出本次调用的请求里带了定义的工具
+            // ToolSearch 模式：目录可能很大，只列内置工具与发出本次调用的请求里带了定义的工具
             if (resolved.toolSearch === true) {
                 const sent = await this.sentTools(ctx);
                 if (sent !== null)
                     keys = keys.filter((k) => isAlwaysLoaded(k) || sent.has(k));
             }
             keys.sort();
-            return fail(unknownToolText(call.name, keys, keys.includes("tool_search")));
+            return fail(unknownToolText(call.name, keys, keys.includes(TOOL_SEARCH), legacyHint(call.name)));
         }
-        // tool_search 模式下，模型只能调用请求里带了完整定义的工具：目录里有、但发出本次调用的请求没加载 →
-        // 明确错误，不自动加载（spec 5.5 / 6.3）。同一步里先 tool_search 再调用刚加载的工具同样报错。
-        if (resolved.toolSearch === true && !isAlwaysLoaded(tool.key)) {
+        const outKey = legacy ? call.name : tool.key;
+        // ToolSearch 模式下，模型只能调用请求里带了完整定义的工具：目录里有、但发出本次调用的请求没加载 →
+        // 明确错误，不自动加载（spec 5.5 / 6.3）。同一步里先 ToolSearch 再调用刚加载的工具同样报错。
+        if (!legacy && resolved.toolSearch === true && !isAlwaysLoaded(tool.key)) {
             const sent = await this.sentTools(ctx);
             if (sent !== null && !sent.has(tool.key))
-                return fail(notLoadedText(tool.key), tool.key);
+                return fail(notLoadedText(tool.key), outKey);
         }
         let input;
         try {
-            input = await resolveOutputRefs(call.input, (id) => this.deps.outputs.load({ orgId: ctx.orgId, conversationId: ctx.conversationId }, id));
+            input = await resolveOutputRefs(legacy ? legacyToolInput(call.name, call.input) : call.input, (id) => this.deps.outputs.load({ orgId: ctx.orgId, conversationId: ctx.conversationId }, id));
         }
         catch (e) {
             if (e instanceof ToolError)
-                return fail(e.message, tool.key);
+                return fail(e.message, outKey);
             throw e;
         }
         // 连接器工具的 schema 来自连接器（不受信任）：去掉有风险的关键字并限制大小 / 层数
@@ -616,7 +655,7 @@ let ToolPipeline = class ToolPipeline {
             log: this.deps.log,
         });
         if (invalid !== null)
-            return fail(invalid, tool.key);
+            return fail(invalid, outKey);
         const decision = await this.decide(tool, ctx.agent, {
             orgId: ctx.orgId,
             accountId: ctx.accountId,
@@ -629,15 +668,19 @@ let ToolPipeline = class ToolPipeline {
             }),
         });
         if (decision === "deny")
-            return fail(deniedText(tool.key), tool.key);
+            return fail(deniedText(tool.key), outKey);
         if (typeof decision === "object" && "unavailable" in decision) {
-            return fail(unavailableText(tool.key, decision.unavailable), tool.key);
+            return fail(unavailableText(tool.key, decision.unavailable), outKey);
         }
         // 该调用已有审批（续跑）→ 按审批结果；没有且策略为 ask → 建审批并等待
         // （不写 tool_call_started：此时尚未开始执行）。
         let approval = await this.deps.approvals.forCall(ctx.runId, call.id);
         // 批准的是旧定义（等待期间工具定义变了）：原批准不适用于当前定义，策略仍需审批时按新定义重新审批。
-        const stale = approval?.status === "approved" && approval.specHash !== tool.specHash;
+        // An in-flight rc call (spec §9) is the exception: its approval was asked under the rc definition
+        // of the same call, and the rename changed every builtin's definition; the person approved this
+        // very call, so the approval stands.
+        const approvedHere = approval?.status === "approved" && (legacy || approval.specHash === tool.specHash);
+        const stale = approval?.status === "approved" && !approvedHere;
         if ((!approval || stale) && typeof decision === "object" && "ask" in decision) {
             approval = await this.deps.approvals.request({
                 attempt: (approval?.attempt ?? 0) + 1,
@@ -657,10 +700,10 @@ let ToolPipeline = class ToolPipeline {
         }
         if (approval && approval.status !== "approved") {
             const refused = this.refusalText(approval);
-            return refused === null ? approvalWait(approval) : fail(refused, tool.key);
+            return refused === null ? approvalWait(approval) : fail(refused, outKey);
         }
         // 走到这里即放行：在（与当前定义一致的）审批下执行，否则是授权或策略放行
-        const authorization = approval?.status === "approved" && approval.specHash === tool.specHash
+        const authorization = approval?.status === "approved" && approvedHere
             ? approvalAuthorization(approval)
             : typeof decision === "object" && "grant" in decision
                 ? { grant: decision.grant }
@@ -675,7 +718,7 @@ let ToolPipeline = class ToolPipeline {
             // written with the call's tool_result, so a call with a logged denial never runs again anyway.
             const prior = await this.deps.eventLog.findByIdem(ctx.conversationId, idem.hookDenied(ctx.runId, call.id));
             if (prior?.type === "hook_denied") {
-                return fail(hookDeniedText(prior.payload.plugin, prior.payload.reason), tool.key);
+                return fail(hookDeniedText(prior.payload.plugin, prior.payload.reason), outKey);
             }
         }
         // payload only built when a tool hook is registered (zero overhead otherwise)
@@ -697,7 +740,7 @@ let ToolPipeline = class ToolPipeline {
             catch (e) {
                 // run() rejects only when the run's signal aborted: an abort, never a deny
                 if (ctx.signal.aborted)
-                    return fail(RUN_STOPPED_TEXT, tool.key);
+                    return fail(RUN_STOPPED_TEXT, outKey);
                 throw e;
             }
             if (!verdict.allowed) {
@@ -715,20 +758,20 @@ let ToolPipeline = class ToolPipeline {
                     step: ctx.step,
                     callId: call.id,
                 });
-                await this.writeResult(ctx, call.id, tool.key, { content: hookDeniedText(verdict.plugin, verdict.reason), isError: true }, [event], undefined, [hookDeniedAudit(site, event.payload, verdict)]);
+                await this.writeResult(ctx, call.id, outKey, { content: hookDeniedText(verdict.plugin, verdict.reason), isError: true }, [event], undefined, [hookDeniedAudit(site, event.payload, verdict)]);
                 return undefined;
             }
         }
-        // `agent` (sub-agents spec §7.1): no tool_call_started; the dispatch is made durable in one
+        // `Agent` (sub-agents spec §7.1): no tool_call_started; the dispatch is made durable in one
         // transaction (its marker is the subagent_dispatches row) and the call stays open
         const dispatcher = this.deps.subagents;
         if (tool.source.kind === "builtin" && tool.key === AGENT_TOOL && dispatcher) {
             const parsed = AgentToolInput.safeParse(input);
             if (!parsed.success) {
-                return fail("Invalid agent call: pass description and prompt, and optionally subagent_type, model or resume.", tool.key);
+                return fail("Invalid agent call: pass description and prompt, and optionally subagent_type, model or resume.", outKey);
             }
             const r = await dispatcher.dispatch({ ctx, callId: call.id, input: parsed.data });
-            return r.kind === "refused" ? fail(r.content, tool.key) : OPEN;
+            return r.kind === "refused" ? fail(r.content, outKey) : OPEN;
         }
         await this.deps.eventLog.append(ctx.conversationId, [
             {
@@ -751,7 +794,7 @@ let ToolPipeline = class ToolPipeline {
         const rendered = outcome.kind === "result"
             ? renderResult(outcome.result)
             : { text: outcome.message, contentTypes: [], isError: true };
-        // 内置工具（tool_search）报告的已加载工具：只认本步可用、非内置的 key，写进 tool_result（日志即事实源）
+        // 内置工具（ToolSearch）报告的已加载工具：只认本步可用、非内置的 key，写进 tool_result（日志即事实源）
         const loadedTools = outcome.kind === "result" && tool.source.kind === "builtin"
             ? loadedFrom(outcome.result, resolved.tools)
             : [];
@@ -795,7 +838,7 @@ let ToolPipeline = class ToolPipeline {
                 },
             ]
             : [];
-        await this.writeResult(ctx, call.id, tool.key, {
+        await this.writeResult(ctx, call.id, outKey, {
             content: spilled.content,
             isError: rendered.isError,
             ...(spilled.outputId !== undefined && { outputId: spilled.outputId }),
@@ -836,9 +879,24 @@ let ToolPipeline = class ToolPipeline {
         }
         return undefined;
     }
+    /**
+     * Every tool key the request that issued this step's calls offered (`request.tools` plus the
+     * `catalog` keys), in any mode; null when its model_call is not found. Used to tell a call to an
+     * old key that was offered (in flight across the rename) from one that never was.
+     */
+    async requestToolKeys(ctx) {
+        for (let attempt = MAX_MODEL_ATTEMPTS; attempt >= 1; attempt--) {
+            const e = await this.deps.eventLog.findByIdem(ctx.conversationId, modelCallIdemKey(ctx.runId, ctx.step, attempt));
+            if (e?.type !== "model_call")
+                continue;
+            const { tools, catalog } = e.payload.request;
+            return new Set([...(tools ?? []), ...(catalog ?? [])].map((t) => t.key));
+        }
+        return null;
+    }
     /**
      * 发出本步调用的请求里带了完整定义的工具 key：本步最后一次尝试的 `model_call.request.tools`
-     * （`assistant_message` 来自最后一次尝试）。该请求不在 tool_search 模式（没有 `catalog`，工具全部发送）
+     * （`assistant_message` 来自最后一次尝试）。该请求不在 ToolSearch 模式（没有 `catalog`，工具全部发送）
      * 或找不到 model_call 时返回 null（不做加载检查）。已加载集合由此从日志得出，不放进程内存。
      */
     async sentTools(ctx) {
@@ -912,7 +970,7 @@ let ToolPipeline = class ToolPipeline {
         const handler = this.deps.registry.handler(tool.source);
         if (!handler)
             return { kind: "error", message: `Tool ${tool.key} is no longer available.` };
-        // 插件处理函数只拿到 SDK 的 ToolCallContext；内置工具另外拿到本步解析出的工具（tool_search 用）
+        // 插件处理函数只拿到 SDK 的 ToolCallContext；内置工具另外拿到本步解析出的工具（ToolSearch 用）
         const base = {
             orgId: ctx.orgId,
             accountId: ctx.accountId,

package/dist/tools/policy.d.ts

@@ -1,20 +1,7 @@
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { DecidePolicy } from "./pipeline.js";
 import type { ResolvedTool, ToolPolicy } from "./registry.js";
-/**
- * spec 3.6 R3「有权 ≠ 已确认」固定清单上的工具 key：策略至少为 `ask`，记住的授权也不放行。
- *
- * R3 清单：发布到公共市场、安装连接器、提插件申请、改角色与成员、删除、改共享技能、改自己的指令。
- * M3 的内置工具（`ask_user`、`read_tool_output`、`tool_search`）与连接器工具都不在清单上；M5 T15 加入
- * `skill_write`（改共享技能）。后续实现上述动作的内置工具时把 key 登记在这里。连接器 / 插件工具由
- * `annotations.requiresUserInteraction` 表达同一约束。
- */
-export declare const R3_FIXED_ASK_TOOL_KEYS: ReadonlySet<string>;
-/**
- * R3 清单里只对共享 agent 生效的 key（窄口子）：R3 的条目是「改共享技能」，私有 agent（`visibility = private`，
- * 只有负责人本人能用）的技能不是共享的，`skill_write` 直接生效、不询问（R4）。其余 R3 条目不论可见性一律固定 ask。
- */
-export declare const R3_SHARED_AGENT_ONLY_TOOL_KEYS: ReadonlySet<string>;
+export { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS } from "./builtin-names.js";
 /** 取更严的策略（`allow < ask < deny`）。 */
 export declare function stricter(a: ToolPolicy, b: ToolPolicy | undefined): ToolPolicy;
 export interface PolicyInput {

package/dist/tools/policy.js

@@ -1,21 +1,9 @@
 import { sql } from "kysely";
 import { roleAtLeast } from "../orgs/roles.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
-import { SANDBOX_ASK_TOOL_NAMES } from "./builtins/sandbox/names.js";
-/**
- * spec 3.6 R3「有权 ≠ 已确认」固定清单上的工具 key：策略至少为 `ask`，记住的授权也不放行。
- *
- * R3 清单：发布到公共市场、安装连接器、提插件申请、改角色与成员、删除、改共享技能、改自己的指令。
- * M3 的内置工具（`ask_user`、`read_tool_output`、`tool_search`）与连接器工具都不在清单上；M5 T15 加入
- * `skill_write`（改共享技能）。后续实现上述动作的内置工具时把 key 登记在这里。连接器 / 插件工具由
- * `annotations.requiresUserInteraction` 表达同一约束。
- */
-export const R3_FIXED_ASK_TOOL_KEYS = new Set(["skill_write"]);
-/**
- * R3 清单里只对共享 agent 生效的 key（窄口子）：R3 的条目是「改共享技能」，私有 agent（`visibility = private`，
- * 只有负责人本人能用）的技能不是共享的，`skill_write` 直接生效、不询问（R4）。其余 R3 条目不论可见性一律固定 ask。
- */
-export const R3_SHARED_AGENT_ONLY_TOOL_KEYS = new Set(["skill_write"]);
+import { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS, SANDBOX_ASK_TOOL_NAMES, } from "./builtin-names.js";
+import { normalizeStoredDefinitionIn } from "./legacy-data.js";
+export { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS } from "./builtin-names.js";
 const RANK = { allow: 0, ask: 1, deny: 2 };
 /** 取更严的策略（`allow < ask < deny`）。 */
 export function stricter(a, b) {
@@ -122,7 +110,11 @@ export function createDecidePolicy(db) {
             .select(["agent_versions.definition", "agents.visibility"])
             .where("agents.id", "=", ctx.agentId)
             .executeTakeFirst();
-        const currentPolicies = current?.definition?.toolPolicies;
+        // stored raw: an rc version's keys read as current keys, so its deny keeps applying (§8.3)
+        const currentDef = current === undefined
+            ? undefined
+            : await normalizeStoredDefinitionIn(db, ctx.orgId, current.definition);
+        const currentPolicies = currentDef?.toolPolicies;
         const currentOverride = asOverride(currentPolicies?.[tool.key]);
         let strictest = stricter(runOverride ?? "allow", currentOverride);
         if (ctx.parentConversationId !== undefined && ctx.parentAgentDiffers !== false) {
@@ -142,9 +134,9 @@ export function createDecidePolicy(db) {
             if (!roleAtLeast(m.role, tool.requiredRole))
                 escalateTo = tool.requiredRole;
         }
-        // 可见性实时读（R5）：共享 agent 的 skill_write 固定 ask，私有 agent 不问（见 R3_SHARED_AGENT_ONLY_TOOL_KEYS）
+        // 可见性实时读（R5）：共享 agent 的 SkillWrite 固定 ask，私有 agent 不问（见 R3_SHARED_AGENT_ONLY_TOOL_KEYS）
         // 当前版本的 skills.writePolicy 同样实时读（R5）：运行中改为 ask，下一次调用即生效；固定 ask 时授权不放行
-        const writePolicy = current?.definition?.skills?.writePolicy;
+        const writePolicy = currentDef?.skills?.writePolicy;
         const fixedAsk = isFixedAsk(tool, current?.visibility, writePolicy);
         const input = {
             connectorDefault,
@@ -203,7 +195,9 @@ async function parentAgentOverride(db, toolKey, ctx) {
         .executeTakeFirst();
     if (!row || row.id === ctx.agentId)
         return undefined;
-    const policies = row.definition.toolPolicies;
+    // stored raw: an rc version's keys read as current keys, so its deny keeps applying (§8.3)
+    const policies = (await normalizeStoredDefinitionIn(db, ctx.orgId, row.definition))
+        .toolPolicies;
     return asOverride(policies?.[toolKey]);
 }
 /**

package/dist/tools/questions.controller.d.ts

@@ -7,7 +7,7 @@ declare const AnswerBody: z.ZodObject<{
     answer: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 }, z.core.$strict>;
 /**
- * 输入请求（`ask_user`、插件工具的 `input_required`）：`/api/v1/orgs/:orgId/questions`。
+ * 输入请求（`AskUserQuestion`、插件工具的 `input_required`）：`/api/v1/orgs/:orgId/questions`。
  * 动作用 `approvals.decide`（访客起、仅限用户主体）：回答必须由人做出，agent / 服务令牌不能代答；
  * 具体是否允许由服务判定——只有该运行的发起人能读取与回答，其他成员 403。
  */

package/dist/tools/questions.controller.js

@@ -19,7 +19,7 @@ const AnswerBody = z.object({ answer: z.record(z.string().max(200), z.unknown())
 class QuestionAnswerBody extends createZodDto(AnswerBody, "QuestionAnswerBody") {
 }
 /**
- * 输入请求（`ask_user`、插件工具的 `input_required`）：`/api/v1/orgs/:orgId/questions`。
+ * 输入请求（`AskUserQuestion`、插件工具的 `input_required`）：`/api/v1/orgs/:orgId/questions`。
  * 动作用 `approvals.decide`（访客起、仅限用户主体）：回答必须由人做出，agent / 服务令牌不能代答；
  * 具体是否允许由服务判定——只有该运行的发起人能读取与回答，其他成员 403。
  */

package/dist/tools/questions.service.d.ts

@@ -5,7 +5,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
 export type QuestionStatus = "pending" | "answered" | "expired" | "cancelled";
-/** 一条输入请求（`ask_user`、插件工具的 `input_required`、MCP elicitation 共用）。 */
+/** 一条输入请求（`AskUserQuestion`、插件工具的 `input_required`、MCP elicitation 共用）。 */
 export interface QuestionRecord {
     id: string;
     orgId: string;