@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.4

package/dist/runtime/run-queue.js

@@ -8,11 +8,14 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
+import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { visibleTo } from "../agents/agent-lookup.js";
+import { BG_WAKE_JOB, bgWakeJobId, wakeDecisionIn, } from "../background/wake-rules.js";
 import { EventLog } from "../conversations/event-log.js";
 import { dispatchQueuedIn, pauseQueueWith } from "../conversations/queue.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
@@ -21,6 +24,7 @@ import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { ToolPipeline } from "../tools/pipeline.js";
 import { KyselyCheckpointSaver } from "./checkpointer.js";
 import { ConversationLock } from "./conversation-lock.js";
+import { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
 import { notifyFinished, RunFinish } from "./run-finish.js";
 import { ACTIVE_RUN_STATUSES, RunJobs, runJobId, runQueueNameFor, } from "./run-jobs.js";
 export { ACTIVE_RUN_STATUSES, RUN_QUEUE_NAME, runJobId, runQueueNameFor, SUBAGENT_RUN_QUEUE_NAME, } from "./run-jobs.js";
@@ -29,6 +33,12 @@ export { ACTIVE_RUN_STATUSES, RUN_QUEUE_NAME, runJobId, runQueueNameFor, SUBAGEN
  * 只有进入 queued 超过这么久（`COALESCE(queued_at, created_at)`）仍没有任务的 queued 行才视为孤儿。
  */
 const ORPHAN_QUEUED_GRACE_SECONDS = 30;
+/**
+ * Margin added to the delayed wake job: its window is read on the database's clock, the delay runs
+ * on this process's and Redis's, so the job does not usually fire just before the window ends (one
+ * that does reschedules itself under its next retry id, `bgWakeJobId`).
+ */
+const WAKE_JOB_MARGIN_MS = 1000;
 /**
  * 运行队列（生产方）：`ensureRun` 在会话有未消费的用户消息、且没有进行中的运行时插入 `runs` 行并投递任务。
  * 「是否已有运行」以 PG 为准（会话行锁内检查 `runs` 中的 queued / running），并参考会话锁的持有者；
@@ -45,11 +55,15 @@ let RunQueue = class RunQueue {
     events;
     log;
     txHost;
+    config;
+    maintenance;
     constructor(kdb, eventLog, lock, jobs, finisher, 
     /** 运行以孤儿结束（标记失败 / 直接中止）后删除它的 checkpoint thread（thread_id = runId）。 */
     checkpoints, 
-    /** The run's open `agent` call results, in the orphan repair's transaction (sub-agents spec §12). */
-    pipeline, events, log, txHost) {
+    /** The run's open `Agent` call results, in the orphan repair's transaction (sub-agents spec §12). */
+    pipeline, events, log, txHost, config, 
+    /** The producer side of the delayed `bg-wake` job (`MaintenanceProcessor` consumes it). */
+    maintenance) {
         this.kdb = kdb;
         this.eventLog = eventLog;
         this.lock = lock;
@@ -60,12 +74,14 @@ let RunQueue = class RunQueue {
         this.events = events;
         this.log = log;
         this.txHost = txHost;
+        this.config = config;
+        this.maintenance = maintenance;
     }
     get db() {
         return this.kdb.db;
     }
     /**
-     * The `beforeTerminal` of an orphan repair: writes the run's open `agent` call results in the
+     * The `beforeTerminal` of an orphan repair: writes the run's open `Agent` call results in the
      * repair's transaction; `fire()` runs their observe hooks after the commit (review m1).
      */
     stopOpenCalls(runId) {
@@ -81,6 +97,11 @@ let RunQueue = class RunQueue {
      * 有未消费的用户消息（最新 user_message 的 seq > `consumed_seq`）、会话锁无人持有、
      * 且没有 queued / running / waiting 的运行时：插入 `runs`（queued）并投递任务，返回 runId；否则返回 null。
      *
+     * The boundary (`trigger_seq`) is that newest message; with none unconsumed, the queue's head
+     * once it is sent; with no head either, a wake-eligible finished background task (background
+     * Bash spec §3, {@link wakeDecisionIn}): the run is then attributed to the task's trigger
+     * account, and a finish inside the wake window schedules the delayed `bg-wake` job instead.
+     *
      * 孤儿清理（R29，按需进行，没有定时器）：已有的 queued / running 运行若 BullMQ 任务已不存在、
      * 会话锁也无人持有（queued 的还要超过宽限期），说明没有任何 worker 会再执行它——写
      * `run_failed { code: "run.orphaned" }` 把它标记为失败（consumed_seq 推进到它的触发消息），
@@ -89,7 +110,9 @@ let RunQueue = class RunQueue {
      *
      * agent 已软删除的会话不起新运行（孤儿清理照常进行）。
      */
-    async ensureRun(conversationId) {
+    async ensureRun(conversationId, 
+    /** From the `bg-wake` job: it fired `wakeRetry - 1` times before its window ended. */
+    opts = {}) {
         if ((await this.lock.holder(conversationId)) !== null)
             return null;
         const st = {
@@ -97,11 +120,17 @@ let RunQueue = class RunQueue {
             orphanRunId: null,
             dispatchedSeq: null,
             dispatchedSwitch: false,
+            dispatchedUnarchived: false,
             pausedNow: false,
             orphanStop: undefined,
+            wakeLater: null,
         };
         const created = await this.ensureRunIn(conversationId, st);
+        if (st.wakeLater !== null) {
+            await this.scheduleWake(conversationId, st.wakeLater, opts.wakeRetry ?? 0);
+        }
         const { orphanSeq, orphanRunId, dispatchedSeq, dispatchedSwitch, pausedNow, orphanStop } = st;
+        const { dispatchedUnarchived } = st;
         if (orphanSeq !== null) {
             await notifyFinished(this.eventLog, conversationId, orphanSeq, "failed");
             orphanStop?.fire();
@@ -114,6 +143,8 @@ let RunQueue = class RunQueue {
             await this.eventLog.publishChanged(conversationId, "queue");
             if (dispatchedSwitch)
                 await this.eventLog.publishChanged(conversationId, "selection");
+            if (dispatchedUnarchived)
+                await this.eventLog.publishChanged(conversationId, "archived");
         }
         if (orphanRunId !== null) {
             await this.dropCheckpoints(orphanRunId);
@@ -153,14 +184,25 @@ let RunQueue = class RunQueue {
         const t = this.db;
         const conv = await t
             .selectFrom("conversations")
-            .select(["consumed_seq", "agent_id", "kind", "queue_paused", "account_id"])
+            .select([
+            "consumed_seq",
+            "org_id",
+            "agent_id",
+            "kind",
+            "queue_paused",
+            "account_id",
+            "deleted_at",
+        ])
             .where("id", "=", conversationId)
             .forUpdate()
             .executeTakeFirst();
         // 评测回放的隐藏对话：运行由评测 worker 在里面直接驱动（工具只回放记录），绝不为它起真实运行
         if (conv?.kind !== "chat")
             return null;
-        let last = await t
+        // A deleted conversation starts no run, whatever is still unconsumed or queued
+        if (conv.deleted_at !== null)
+            return null;
+        const newest = await t
             .selectFrom("conversation_events")
             .select(["seq", "payload"])
             .where("conversation_id", "=", conversationId)
@@ -168,11 +210,25 @@ let RunQueue = class RunQueue {
             .orderBy("seq", "desc")
             .limit(1)
             .executeTakeFirst();
-        if (!last || Number(last.seq) <= Number(conv.consumed_seq)) {
+        /** The run's boundary: its `trigger_seq` and the account it runs as. */
+        let last = newest && {
+            seq: newest.seq,
+            accountId: newest.payload.authorAccountId,
+        };
+        const idleActive = !last || Number(last.seq) <= Number(conv.consumed_seq)
+            ? await this.activeRun(t, conversationId)
+            : undefined;
+        if (idleActive && Number(idleActive.trigger_seq) > Number(conv.consumed_seq)) {
+            // No unconsumed message, but a run whose boundary is not consumed yet (a wake run, whose
+            // boundary is a finished background task): it goes through the orphan check below with
+            // that boundary, as a message's run does
+            last = { seq: idleActive.trigger_seq, accountId: idleActive.trigger_account_id };
+        }
+        else if (!last || Number(last.seq) <= Number(conv.consumed_seq)) {
             // Nothing unconsumed: the queue's head goes out when the conversation is idle (no active
             // run, which includes runs waiting for approval or an answer) and the queue is not paused.
             // Interjections are always unconsumed messages, so the queue never jumps ahead of them.
-            if (conv.queue_paused || (await this.activeRun(t, conversationId)))
+            if (conv.queue_paused || idleActive)
                 return null;
             const owner = await t
                 .selectFrom("agents")
@@ -187,32 +243,46 @@ let RunQueue = class RunQueue {
                 .where("conversation_id", "=", conversationId)
                 .limit(1)
                 .executeTakeFirst();
-            if (!head)
-                return null;
-            // A queued message may wait for hours: it goes out only while its author can still use
-            // the conversation (active, a member, the agent visible to them; the isAccessible rule).
-            // Otherwise the queue pauses instead of posting as someone who lost access.
-            if (!(await authorCanSend(t, conversationId, conv.account_id))) {
-                await pauseQueueWith(t, conversationId, "author_cannot_send");
-                st.pausedNow = true;
-                this.log.warn("queued message not sent: its author can no longer use the conversation", {
-                    conversationId,
-                });
-                return null;
+            if (head) {
+                // A queued message may wait for hours: it goes out only while its author can still use
+                // the conversation (active, a member, the agent visible to them; the isAccessible rule).
+                // Otherwise the queue pauses instead of posting as someone who lost access.
+                if (!(await authorCanSend(t, conversationId, conv.account_id))) {
+                    await pauseQueueWith(t, conversationId, "author_cannot_send");
+                    st.pausedNow = true;
+                    this.log.warn("queued message not sent: its author can no longer use the conversation", {
+                        conversationId,
+                    });
+                    return null;
+                }
+                const sent = await dispatchQueuedIn(t, this.eventLog, conversationId);
+                if (!sent)
+                    return null;
+                if ("paused" in sent) {
+                    st.pausedNow = true;
+                    this.log.warn("queued skill invocation not sent: the skill can no longer be invoked", {
+                        conversationId,
+                    });
+                    return null;
+                }
+                st.dispatchedSeq = sent.event.seq;
+                st.dispatchedSwitch = sent.switched;
+                st.dispatchedUnarchived = sent.unarchived;
+                last = {
+                    seq: String(sent.event.seq),
+                    accountId: sent.event.payload.authorAccountId,
+                };
             }
-            const sent = await dispatchQueuedIn(t, this.eventLog, conversationId);
-            if (!sent)
-                return null;
-            if ("paused" in sent) {
-                st.pausedNow = true;
-                this.log.warn("queued skill invocation not sent: the skill can no longer be invoked", {
-                    conversationId,
-                });
-                return null;
+            else {
+                // Nothing queued either: a finished background task may wake the idle conversation
+                // (background Bash spec §3; a person's message or the queue always goes first)
+                const wake = await wakeDecisionIn(t, { id: conversationId, orgId: conv.org_id }, Number(conv.consumed_seq), this.config.get().runtime.wakeOnBackgroundTask, (accountId) => authorCanSend(t, conversationId, accountId));
+                if (wake?.kind === "later")
+                    st.wakeLater = wake;
+                if (wake?.kind !== "wake")
+                    return null;
+                last = { seq: String(wake.seq), accountId: wake.triggerAccountId };
             }
-            st.dispatchedSeq = sent.event.seq;
-            st.dispatchedSwitch = sent.switched;
-            last = { seq: String(sent.event.seq), payload: sent.event.payload };
         }
         const active = await this.activeRun(t, conversationId);
         if (active) {
@@ -254,7 +324,9 @@ let RunQueue = class RunQueue {
             .orderBy("seq")
             .limit(1)
             .executeTakeFirst();
-        const trigger = fork ?? last;
+        const trigger = fork
+            ? { seq: fork.seq, accountId: fork.payload.authorAccountId }
+            : last;
         // BullMQ 对重复的 jobId 静默忽略（add 返回的 Job 由调用方数据构造，看不出是否真的入队）：
         // 先显式查同一触发点的任务；仍存在（例如属于刚结束、尚未从队列移除的运行）就不插入 runs 行。
         const jobId = runJobId(conversationId, Number(trigger.seq));
@@ -283,12 +355,33 @@ let RunQueue = class RunQueue {
             conversation_id: conversationId,
             status: "queued",
             agent_version: agent.current_version,
-            trigger_account_id: trigger.payload.authorAccountId,
+            trigger_account_id: trigger.accountId,
             trigger_seq: Number(trigger.seq),
         })
             .execute();
         return { runId, jobId };
     }
+    /**
+     * Schedules the delayed `bg-wake` job at the end of the conversation's wake window (after the
+     * commit): one job per conversation and window end, so finishes inside one window share it. It
+     * calls {@link ensureRun}, which wakes the conversation if a finish is still unconsumed. A failed
+     * enqueue is logged: the next message, run end or page opening re-derives the wake.
+     */
+    async scheduleWake(conversationId, w, retry) {
+        const data = { conversationId, ...(retry > 0 && { retry }) };
+        try {
+            await this.maintenance.add(BG_WAKE_JOB, data, {
+                // a job that fired early reschedules under a new id (its own is still taken)
+                jobId: bgWakeJobId(conversationId, w.windowEnd, retry),
+                delay: w.delayMs + WAKE_JOB_MARGIN_MS,
+                removeOnComplete: true,
+                removeOnFail: true,
+            });
+        }
+        catch (err) {
+            this.log.error("cannot schedule the background task wake", { conversationId, err });
+        }
+    }
     /**
      * Enqueues a run job under the caller's job id (resumes, dispatches, repairs), with the same
      * options as {@link ensureRun} (see {@link RunJobs.enqueue}).
@@ -407,6 +500,7 @@ let RunQueue = class RunQueue {
             "id",
             "status",
             "trigger_seq",
+            "trigger_account_id",
             "job_id",
             sql `COALESCE(queued_at, created_at) < now() - make_interval(secs => ${ORPHAN_QUEUED_GRACE_SECONDS})`.as("past_grace"),
         ])
@@ -462,7 +556,9 @@ RunQueue = __decorate([
     __param(6, Inject(ToolPipeline)),
     __param(7, Inject(KernelEvents)),
     __param(8, Inject(KERNEL_LOGGER)),
-    __param(9, Inject(TransactionHost))
+    __param(9, Inject(TransactionHost)),
+    __param(10, Inject(KernelConfigService)),
+    __param(11, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
 ], RunQueue);
 export { RunQueue };
 /** The conversation's owner is active and can still see its agent (`isAccessible`'s rule). */

package/dist/runtime/run-worker.d.ts

@@ -63,7 +63,7 @@ export declare class RunWorker {
     /** Run start's skills catalog snapshot (reads the pinned skills' bodies, phase B). */
     private readonly skillsCatalog;
     /**
-     * In the terminal transaction of every run: writes its open `agent` call results
+     * In the terminal transaction of every run: writes its open `Agent` call results
      * (`stopOpenAgentCalls`; a no-op without dispatches); `fire` runs their observe hooks after the
      * commit (sub-agents spec §12, review m1: a failed or stalled parent too).
      */
@@ -94,7 +94,7 @@ export declare class RunWorker {
     /** Run start's skills catalog snapshot (reads the pinned skills' bodies, phase B). */
     skillsCatalog: Pick<SkillsCatalogService, "record">, 
     /**
-     * In the terminal transaction of every run: writes its open `agent` call results
+     * In the terminal transaction of every run: writes its open `Agent` call results
      * (`stopOpenAgentCalls`; a no-op without dispatches); `fire` runs their observe hooks after the
      * commit (sub-agents spec §12, review m1: a failed or stalled parent too).
      */

package/dist/runtime/run-worker.js

@@ -10,8 +10,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Inject, Injectable, Optional } from "@nestjs/common";
 import { DelayedError } from "bullmq";
 import { sql } from "kysely";
-import { normalizeStoredDefinition } from "../agents/definition.js";
 import { conversationTopic, EventLog, } from "../conversations/event-log.js";
+import { isAbsorbable, } from "../conversations/events.js";
 import { effectiveDefinition, NO_SELECTION, readSelection, sameModel, sameSelection, } from "../conversations/selection.js";
 import { TitleQueue } from "../conversations/titles.js";
 import { ApiError } from "../errors.js";
@@ -24,6 +24,7 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
 import { pinnedFailureText, SkillsCatalogService } from "../skills/catalog.js";
+import { normalizeStoredDefinitionIn } from "../tools/legacy-data.js";
 import { ToolPipeline } from "../tools/pipeline.js";
 import { RunAbort } from "./abort.js";
 import { KyselyCheckpointSaver } from "./checkpointer.js";
@@ -109,7 +110,7 @@ let RunWorker = class RunWorker {
     /** Run start's skills catalog snapshot (reads the pinned skills' bodies, phase B). */
     skillsCatalog, 
     /**
-     * In the terminal transaction of every run: writes its open `agent` call results
+     * In the terminal transaction of every run: writes its open `Agent` call results
      * (`stopOpenAgentCalls`; a no-op without dispatches); `fire` runs their observe hooks after the
      * commit (sub-agents spec §12, review m1: a failed or stalled parent too).
      */
@@ -525,7 +526,7 @@ let RunWorker = class RunWorker {
             // a follow-up runs with its task message's narrowing (final review I1): the frozen tools
             // and org skills the current version still allows, recorded at its dispatch
             const trigger = (await this.eventLog.readAfter(conversationId, Number(run.trigger_seq) - 1, 1))[0];
-            agent = childRunDefinition(normalizeStoredDefinition(started.payload.definition), trigger?.type === "user_message" && trigger.seq === Number(run.trigger_seq)
+            agent = childRunDefinition(await normalizeStoredDefinitionIn(this.db, conv.org_id, started.payload.definition), trigger?.type === "user_message" && trigger.seq === Number(run.trigger_seq)
                 ? trigger.payload.dispatch?.narrowed
                 : undefined);
             maxSteps = Math.min(started.payload.maxSteps, runtime.maxSteps);
@@ -552,7 +553,7 @@ let RunWorker = class RunWorker {
                 .where("agent_id", "=", conv.agent_id)
                 .where("version", "=", run.agent_version)
                 .executeTakeFirstOrThrow();
-            saved = normalizeStoredDefinition(version.definition);
+            saved = await normalizeStoredDefinitionIn(this.db, conv.org_id, version.definition);
             agent = saved;
         }
         let startedAt = run.started_at;
@@ -642,15 +643,16 @@ let RunWorker = class RunWorker {
                 .executeTakeFirstOrThrow();
             const startConsumed = Number(consumed_seq);
             let absorbed = startConsumed;
-            const pendingUserMessages = async (afterSeq) => {
+            const pendingAbsorbable = async (afterSeq) => {
                 // loop 声明已吸收到 afterSeq（续跑时来自 checkpoint，可能包含之前进程吸收的消息）。
                 absorbed = Math.max(absorbed, afterSeq);
                 const out = [];
                 let after = Math.max(afterSeq, startConsumed);
                 for (;;) {
                     const page = await this.eventLog.readAfter(conversationId, after, READ_PAGE);
+                    // messages and finished background tasks (spec 2026-11-05-background-bash-design §2.4)
                     for (const e of page)
-                        if (e.type === "user_message")
+                        if (isAbsorbable(e))
                             out.push(e);
                     const last = page.at(-1);
                     if (page.length < READ_PAGE || !last)
@@ -677,7 +679,7 @@ let RunWorker = class RunWorker {
                     signal: ac.signal,
                     shutdown: state.shutdown.signal,
                     sink: this.sinkFor(conversationId),
-                    pendingUserMessages,
+                    pendingAbsorbable,
                     limits: { maxSteps, deadline },
                     // a sub-agent's conversation fires hooks like a chat, with `parent` set (spec §11)
                     conversationKind: conv.kind === "eval" ? "eval" : conv.kind === "subagent" ? "subagent" : "chat",
@@ -814,6 +816,13 @@ let RunWorker = class RunWorker {
         const agent = saved !== undefined
             ? effectiveDefinition(saved, await readSelection(t, conversationId))
             : current;
+        // a wake run's boundary is a finished background task, not a message (background Bash §3)
+        const boundary = await t
+            .selectFrom("conversation_events")
+            .select("type")
+            .where("conversation_id", "=", conversationId)
+            .where("seq", "=", run.trigger_seq)
+            .executeTakeFirst();
         const [ev] = await this.eventLog.appendIn(conversationId, [
             {
                 type: "run_started",
@@ -823,6 +832,10 @@ let RunWorker = class RunWorker {
                     agentVersion: run.agent_version,
                     model: agent.model,
                     triggerAccountId: run.trigger_account_id,
+                    ...(boundary?.type === "background_task_finished" && {
+                        trigger: "background_task",
+                        triggerSeq: Number(run.trigger_seq),
+                    }),
                 },
             },
         ]);

package/dist/runtime/runtime.module.js

@@ -5,6 +5,8 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { Module } from "@nestjs/common";
+import { BackgroundModule } from "../background/background.module.js";
+import { BackgroundWake } from "../background/wake.js";
 import { ConversationAccessModule } from "../conversations/access.js";
 import { AttachmentsModule } from "../conversations/attachments.module.js";
 import { EventLogModule } from "../conversations/event-log.js";
@@ -28,7 +30,7 @@ import { RunJobsModule } from "./run-jobs.js";
 import { RunQueue } from "./run-queue.js";
 import { AgentLoops, RunSteps } from "./run-steps.js";
 import { RunWorker } from "./run-worker.js";
-import { StepLog } from "./step-log.js";
+import { StepLogModule } from "./step-log.js";
 import { ConversationStreams } from "./stream.js";
 import { SubagentsModule } from "./subagents/subagents.service.js";
 import { UsageReportModule } from "./usage-report.js";
@@ -58,6 +60,8 @@ RuntimeModule = __decorate([
             SubagentsModule,
             UsageReportModule,
             TitlesModule,
+            StepLogModule,
+            BackgroundModule,
             // the producer side of `wait-timeout` jobs (`MaintenanceProcessor` consumes them)
             QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
         ],
@@ -67,7 +71,6 @@ RuntimeModule = __decorate([
             RunAbort,
             KyselyCheckpointSaver,
             RunFinish,
-            StepLog,
             RunQueue,
             Waits,
             DecisionResumer,
@@ -75,6 +78,8 @@ RuntimeModule = __decorate([
             AgentLoops,
             RunSteps,
             RunWorker,
+            // a finished background task wakes an idle conversation (background Bash spec §3)
+            BackgroundWake,
             // one quota per key prefix (the org run quota, the org eval quota)
             {
                 provide: RUN_QUOTA,
@@ -93,7 +98,7 @@ RuntimeModule = __decorate([
             RunAbort,
             KyselyCheckpointSaver,
             RunFinish,
-            StepLog,
+            StepLogModule,
             RunQueue,
             Waits,
             RunControl,

package/dist/runtime/step-log.d.ts

@@ -38,3 +38,9 @@ export declare class StepLog {
         spec: ToolSpec;
     }[], events: AppendEvent[]): Promise<ConversationEvent[]>;
 }
+/**
+ * The step writes ({@link StepLog}): a module of its own, so the tools domain (the `WebFetch`
+ * extraction's usage and denials) uses them without importing the runtime.
+ */
+export declare class StepLogModule {
+}

package/dist/runtime/step-log.js

@@ -7,9 +7,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Inject, Injectable } from "@nestjs/common";
+import { Inject, Injectable, Module } from "@nestjs/common";
 import { sql } from "kysely";
-import { EventLog } from "../conversations/event-log.js";
+import { EventLog, EventLogModule } from "../conversations/event-log.js";
 import { usageTokens } from "../evals/budget.js";
 import { audit } from "../identity/audit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -92,3 +92,17 @@ StepLog = __decorate([
     __param(2, Inject(TransactionHost))
 ], StepLog);
 export { StepLog };
+/**
+ * The step writes ({@link StepLog}): a module of its own, so the tools domain (the `WebFetch`
+ * extraction's usage and denials) uses them without importing the runtime.
+ */
+let StepLogModule = class StepLogModule {
+};
+StepLogModule = __decorate([
+    Module({
+        imports: [EventLogModule],
+        providers: [StepLog],
+        exports: [StepLog],
+    })
+], StepLogModule);
+export { StepLogModule };

package/dist/runtime/subagents/definition.d.ts

@@ -6,11 +6,7 @@ import type { KernelConfigService } from "../../infra/config/kernel-config.servi
 import type { ModelPurposesService } from "../../models/purposes.js";
 import type { ProviderRegistry } from "../providers.js";
 import type { RosterEntry } from "./roster.js";
-/**
- * Tools a sub-agent never gets (spec §5.3, §5.5): `agent` (depth 1), `ask_user` (the person does not
- * see the child), `sandbox_deliver` (delivering files is the parent's job) and `skill_write`.
- */
-export declare const CHILD_REMOVED_TOOLS: readonly ["agent", "ask_user", "sandbox_deliver", "skill_write"];
+export { CHILD_REMOVED_TOOLS } from "../../tools/builtin-names.js";
 /**
  * The roster entry's template is gone (an inline template edited away, a plugin template
  * uninstalled) between resolving the roster and reading it. The dispatch refuses the call as an
@@ -100,4 +96,3 @@ export declare function intersectTools(frozen: readonly AgentToolRef[], current:
 export declare function narrowFollowUp(frozen: Pick<AgentDefinition, "tools" | "skills">, current: Pick<AgentDefinition, "tools" | "skills">): FollowUpNarrowing;
 /** The definition a child run uses: the frozen one with its trigger's follow-up narrowing. */
 export declare function childRunDefinition(frozen: AgentDefinition, narrowed: FollowUpNarrowing | undefined): AgentDefinition;
-export {};

package/dist/runtime/subagents/definition.js

@@ -1,13 +1,9 @@
-import { SKILL_ENTRY_FILE, sanitizeParams, } from "@capybara-hq/plugin-sdk";
+import { connectorToolKey, extensionToolKey, parseToolKey, SKILL_ENTRY_FILE, sanitizeParams, } from "@capybara-hq/plugin-sdk";
 import { loadTemplates } from "../../agents/templates.js";
 import { ApiError } from "../../errors.js";
 import { PINNED_SKILLS_LIMITS } from "../../skills/catalog.js";
-import { toolKey } from "../../tools/naming.js";
-/**
- * Tools a sub-agent never gets (spec §5.3, §5.5): `agent` (depth 1), `ask_user` (the person does not
- * see the child), `sandbox_deliver` (delivering files is the parent's job) and `skill_write`.
- */
-export const CHILD_REMOVED_TOOLS = ["agent", "ask_user", "sandbox_deliver", "skill_write"];
+import { CHILD_REMOVED_TOOLS } from "../../tools/builtin-names.js";
+export { CHILD_REMOVED_TOOLS } from "../../tools/builtin-names.js";
 /**
  * The roster entry's template is gone (an inline template edited away, a plugin template
  * uninstalled) between resolving the roster and reading it. The dispatch refuses the call as an
@@ -72,7 +68,7 @@ async function loadConnectors(db, orgId, refs) {
 /**
  * Narrows tool refs by resolved key (spec §5.3): keeps a key when `allow` (if given) lists it and
  * neither `deny` nor {@link CHILD_REMOVED_TOOLS} does. A connector ref with `tools: "all"` stays
- * live only when nothing can narrow it (no allowlist and no deny key under `<slug>__`), so a tool
+ * live only when nothing can narrow it (no allowlist and no deny key under `mcp__<slug>__`), so a tool
  * the connector gains later never slips past the template; otherwise it becomes the kept names, or
  * is dropped. A connector that no longer exists keeps its ref only without an allowlist.
  */
@@ -86,7 +82,7 @@ function narrowTools(refs, connectors, allow, deny) {
                 out.push(ref);
         }
         else if (ref.kind === "plugin") {
-            if (keep(toolKey(ref.plugin, ref.name)))
+            if (keep(extensionToolKey(ref.plugin, ref.name)))
                 out.push(ref);
         }
         else {
@@ -96,13 +92,16 @@ function narrowTools(refs, connectors, allow, deny) {
                     out.push(ref);
                 continue;
             }
-            const prefix = toolKey(c.slug, "");
-            if (ref.tools === "all" && allow === null && ![...deny].some((k) => k.startsWith(prefix))) {
+            const ownsKey = (k) => {
+                const parsed = parseToolKey(k);
+                return parsed?.kind === "connector" && parsed.slug === c.slug;
+            };
+            if (ref.tools === "all" && allow === null && ![...deny].some(ownsKey)) {
                 out.push(ref);
                 continue;
             }
             const names = ref.tools === "all" ? c.tools : ref.tools;
-            const kept = names.filter((name) => keep(toolKey(c.slug, name)));
+            const kept = names.filter((name) => keep(connectorToolKey(c.slug, name)));
             if (kept.length > 0)
                 out.push({ ...ref, tools: kept });
         }
@@ -229,7 +228,9 @@ function orgAgentDefinition(d, a) {
     }
     const agentId = a.entry.agentId ?? "";
     const own = a.orgAgent.definition;
-    const { subagents: _subagents, skills, ...rest } = own;
+    // prompt files are authoring data: the child's model sees only `instructions` (their join), and
+    // `subagent_started.definition` keeps its shape (spec 2026-11-04 §3.3)
+    const { subagents: _subagents, skills, instructionFiles: _files, ...rest } = own;
     const definition = {
         ...rest,
         // its own tools, not intersected with the parent's; only the child-removed ones go

package/dist/runtime/subagents/dispatch.d.ts

@@ -48,7 +48,7 @@ export type DispatchOutcome = {
 };
 /**
  * A dispatch for a person's fork invocation (phase D spec §6.2, `advanceSkillForks`), not for a
- * model's `agent` call: `general-purpose` is always available (the `agent` tool and
+ * model's `Agent` call: `general-purpose` is always available (the `Agent` tool and
  * `subagents.general` do not gate it), an unknown type falls back to it with a warning, and the
  * child records the invoked skill.
  */
@@ -83,7 +83,7 @@ export interface DispatchPlan {
     tierFallback: boolean;
 }
 /**
- * Dispatches the sub-agent of one `agent` call (spec §7.1), after the pipeline's validation,
+ * Dispatches the sub-agent of one `Agent` call (spec §7.1), after the pipeline's validation,
  * policy, approval and `tool.preExecute` stages. A new sub-agent: resolves its type and effective
  * definition, then in one transaction (holding the parent run's row lock, so the dispatches of one
  * run serialize) inserts the child conversation, appends `subagent_started` and the task message,

package/dist/runtime/subagents/dispatch.js

@@ -20,7 +20,7 @@ const GENERAL_ENTRY = {
 /** Idempotency key of the parent's `subagent_dispatched` event. */
 export const dispatchedIdemKey = (runId, callId) => `subagent_dispatched:${runId}:${callId}`;
 /**
- * Dispatches the sub-agent of one `agent` call (spec §7.1), after the pipeline's validation,
+ * Dispatches the sub-agent of one `Agent` call (spec §7.1), after the pipeline's validation,
  * policy, approval and `tool.preExecute` stages. A new sub-agent: resolves its type and effective
  * definition, then in one transaction (holding the parent run's row lock, so the dispatches of one
  * run serialize) inserts the child conversation, appends `subagent_started` and the task message,
@@ -274,7 +274,7 @@ async function orgAgentGates(db, a, agentId, agentType, resumed) {
 }
 const taskMessage = (ctx, callId, prompt, narrowed, 
 /**
- * A fork invocation's record: the child's log then holds the invocation, so its `skill_load`
+ * A fork invocation's record: the child's log then holds the invocation, so its `Skill`
  * is offered and resolves the invoked version (phase D).
  */
 skill) => ({