@capybara-hq/kernel 0.1.0-rc.20 → 0.1.0-rc.21

package/bootstrap.json

@@ -3,7 +3,7 @@
   "schemaVersion": 1,
   "marketplace": {
     "url": "https://github.com/capybara-hq/plugins.git",
-    "commit": "14c73d5c51415223326d89414d62b7278ad60745"
+    "commit": "050de1403662d2ba04cb96839b742aaa0166c00e"
   },
   "plugins": [
     {
@@ -101,6 +101,15 @@
       "version": "0.1.0-rc.6",
       "integrity": "sha512-AOKLpoaBfOQUWnP9nszg9DQWR+6z5gl+ZHoTlHysA9LAeC2h/zipjGE9hY69HF9rueSHzM2kGESJLvXIuQODAA==",
       "required": false
+    },
+    {
+      "name": "skills-core",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-skills-core",
+      "version": "0.1.0-rc.0",
+      "integrity": "sha512-U3R+B3QcklCQyye22bQU1aJq05oLW4Fr3hfmLHuPFOq5jNt30mDc0zNPSDLr6MFDdUI/OJkkX7wvkyKa+zRPAQ==",
+      "required": false,
+      "builtin": true
     }
   ]
 }

package/dist/catalog/marketplaces.service.d.ts

@@ -188,7 +188,7 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.14";
+    readonly sdk: "0.1.0-rc.15";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;

package/dist/extensions/bootstrap.d.ts

@@ -1,6 +1,7 @@
-import { type BootstrapManifest, type Logger } from "@capybara-hq/plugin-sdk";
+import { type BootstrapEntry, type BootstrapManifest, type Logger } from "@capybara-hq/plugin-sdk";
 import { type PluginImport } from "../catalog/plugin-import.js";
 import type { KernelConfig } from "../config/schema.js";
+import { ApiError } from "../errors.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -35,9 +36,15 @@ import type { SingleProviderNote } from "./single-provider.js";
  *   until expiry) aborts the run at its next step. "Done" is a `bootstrap_runs` row for the
  *   manifest's sha256 (written with the audit `bootstrap.completed` only when every entry
  *   succeeded; otherwise the next start runs it again, which is idempotent).
+ * - Two passes per start: the first runs before the extensions load (no object store yet), the
+ *   second after them. A `builtin` entry (not required, but builtin in the catalog) is deferred by
+ *   the first pass (`deferBuiltin`: skipped, not a failure; the run is then not recorded and the
+ *   start runs the second pass), so it may ship skills and templates. A required entry is imported
+ *   by the first pass and must succeed; a builtin one that fails is logged like an optional one.
  * - Only entries new to the manifest are installed (Ruling 5): an optional entry that the last
  *   completed run already handled and that is not installed now (a super admin uninstalled
- *   it) stays uninstalled -> `kept`. A required entry is always installed.
+ *   it) stays uninstalled -> `kept`. A required or builtin entry is always installed (a
+ *   declarative one imported again when its catalog item is gone).
  * - Per entry, by the installed state of its extension:
  *   - not installed (and new, or required): imported into the catalog (source `bootstrap`, ref
  *     `bootstrap:<name>@<version>`, like a marketplace import), installed, approved (snapshot
@@ -65,7 +72,8 @@ import type { SingleProviderNote } from "./single-provider.js";
  * never needed again. A plugin's icons and setup guide files are kept in PG too (`catalog_files`),
  * so they never need it either; its skills, connector templates and agent templates do (an entry
  * shipping them fails while no object store runs; an optional one is retried after the extensions
- * loaded).
+ * loaded, and a plugin that must be builtin and ships them is a `builtin` entry, which only the
+ * pass after the extensions load imports).
  */
 /** The bootstrap manifest that ships with the kernel package. */
 export declare const BOOTSTRAP_MANIFEST_FILE: string;
@@ -93,15 +101,23 @@ export interface BootstrapFailure {
     code: string;
     message: string;
 }
-/** Some entries failed (the others were done); the run is not recorded as done. */
+/**
+ * Some entries failed or were deferred (the others were done); the run is not recorded as done.
+ */
 export declare class BootstrapFailedError extends Error {
     readonly failures: BootstrapFailure[];
     readonly results: BootstrapEntryResult[];
+    readonly deferred: string[];
+    readonly packages: ReadonlyMap<string, Uint8Array>;
     /**
      * @param results what the entries that did not fail did (pass them as `carry` to a later run in
      * the same start, so its record keeps `installed` instead of `kept`).
+     * @param deferred the builtin entries a first pass skipped (`deferBuiltin`): not failures, the
+     * later pass of the same start imports them.
+     * @param packages the packages this run obtained, by entry name (pass them as `packages` to the
+     * later pass of the same start, so nothing is downloaded twice).
      */
-    constructor(failures: BootstrapFailure[], results?: BootstrapEntryResult[]);
+    constructor(failures: BootstrapFailure[], results?: BootstrapEntryResult[], deferred?: string[], packages?: ReadonlyMap<string, Uint8Array>);
     /** A required entry failed: the kernel must not serve without it. */
     get requiredFailed(): boolean;
 }
@@ -121,13 +137,21 @@ export interface BootstrapResolveOptions {
     log?: Pick<Logger, "warn">;
     /** The npm download (default {@link fetchNpmPackage}; tests replace it). */
     fetch?: typeof fetchNpmPackage;
+    /**
+     * Entries whose package failing to be obtained is that entry's failure only: the error goes into
+     * `failed` (by entry name) and the other entries are still obtained. Every other entry's failure
+     * throws, so nothing is written.
+     */
+    soft?: (e: BootstrapEntry) => boolean;
+    failed?: Map<string, ApiError>;
 }
 /**
  * Obtains every entry's tgz, checked against its pinned sha512: from the offline directory when a
  * file there has that sha512, else (a `source: "npm"` entry) downloaded from the npm registry and
  * verified against the pin (the packument's `dist.integrity` is not consulted). Throws an
  * {@link ApiError} naming the plugin for the first entry it cannot obtain
- * (`bootstrap.missing_file`, `bootstrap.download_failed`, `bootstrap.integrity_mismatch`).
+ * (`bootstrap.missing_file`, `bootstrap.download_failed`, `bootstrap.integrity_mismatch`), except
+ * for the `soft` entries (recorded in `failed`, left out of the result).
  */
 export declare function resolveBootstrapPackages(manifest: BootstrapManifest, o: BootstrapResolveOptions): Promise<Map<string, Uint8Array>>;
 /** The lock around a whole run (`lock:bootstrap`). */
@@ -181,6 +205,17 @@ export declare class BootstrapService {
         dir?: string;
         signal?: AbortSignal;
         carry?: readonly BootstrapEntryResult[];
+        /**
+         * The first pass of a start (before the extensions load, so no object store): builtin entries
+         * are skipped, and the run throws {@link BootstrapFailedError} with them as `deferred` instead
+         * of being recorded as done.
+         */
+        deferBuiltin?: boolean;
+        /**
+         * Packages an earlier pass of the same start obtained ({@link BootstrapFailedError.packages});
+         * one whose sha512 still equals its entry's pin is used instead of obtaining it again.
+         */
+        packages?: ReadonlyMap<string, Uint8Array>;
         /** The plugin import a declarative entry (or an entry's catalog version) goes through. */
         imports: BootstrapImports;
     }): Promise<BootstrapResult>;
@@ -201,11 +236,15 @@ export declare class BootstrapService {
     /** The entry names the last completed run handled (undefined before any run completed). */
     private lastRunNames;
     private entry;
+    /** Whether a live (not deleted) platform catalog item has this name. */
+    private hasLiveItem;
     /**
-     * The catalog item of a bootstrap entry follows `required`: a required entry is builtin, offered
-     * to every org (scope `all`) and not disabled (migration 0075 could leave a required plugin
-     * disabled); an entry that stops being required is no longer builtin and keeps scope `all` (the
-     * admin may change it from then on).
+     * The catalog item of a bootstrap entry follows `required` / `builtin`: such an entry is builtin,
+     * offered to every org (scope `all`, which an org admin cannot switch off) and not disabled
+     * (migration 0075 could leave a required plugin disabled); an entry that stops being required or
+     * builtin is no longer builtin and keeps scope `all` (the admin may change it from then on).
+     * Only the platform item: an org-owned item of the same name (the entry then fails with
+     * `plugin.name_taken`) is never touched.
      */
     private markBuiltin;
     /** A declarative plugin: catalog only. Returns false when that version is already imported. */

package/dist/extensions/bootstrap.js

@@ -57,9 +57,15 @@ import { ExtensionRegistry } from "./registry.js";
  *   until expiry) aborts the run at its next step. "Done" is a `bootstrap_runs` row for the
  *   manifest's sha256 (written with the audit `bootstrap.completed` only when every entry
  *   succeeded; otherwise the next start runs it again, which is idempotent).
+ * - Two passes per start: the first runs before the extensions load (no object store yet), the
+ *   second after them. A `builtin` entry (not required, but builtin in the catalog) is deferred by
+ *   the first pass (`deferBuiltin`: skipped, not a failure; the run is then not recorded and the
+ *   start runs the second pass), so it may ship skills and templates. A required entry is imported
+ *   by the first pass and must succeed; a builtin one that fails is logged like an optional one.
  * - Only entries new to the manifest are installed (Ruling 5): an optional entry that the last
  *   completed run already handled and that is not installed now (a super admin uninstalled
- *   it) stays uninstalled -> `kept`. A required entry is always installed.
+ *   it) stays uninstalled -> `kept`. A required or builtin entry is always installed (a
+ *   declarative one imported again when its catalog item is gone).
  * - Per entry, by the installed state of its extension:
  *   - not installed (and new, or required): imported into the catalog (source `bootstrap`, ref
  *     `bootstrap:<name>@<version>`, like a marketplace import), installed, approved (snapshot
@@ -87,22 +93,35 @@ import { ExtensionRegistry } from "./registry.js";
  * never needed again. A plugin's icons and setup guide files are kept in PG too (`catalog_files`),
  * so they never need it either; its skills, connector templates and agent templates do (an entry
  * shipping them fails while no object store runs; an optional one is retried after the extensions
- * loaded).
+ * loaded, and a plugin that must be builtin and ships them is a `builtin` entry, which only the
+ * pass after the extensions load imports).
  */
 /** The bootstrap manifest that ships with the kernel package. */
 export const BOOTSTRAP_MANIFEST_FILE = fileURLToPath(new URL("../../bootstrap.json", import.meta.url));
-/** Some entries failed (the others were done); the run is not recorded as done. */
+/**
+ * Some entries failed or were deferred (the others were done); the run is not recorded as done.
+ */
 export class BootstrapFailedError extends Error {
     failures;
     results;
+    deferred;
+    packages;
     /**
      * @param results what the entries that did not fail did (pass them as `carry` to a later run in
      * the same start, so its record keeps `installed` instead of `kept`).
+     * @param deferred the builtin entries a first pass skipped (`deferBuiltin`): not failures, the
+     * later pass of the same start imports them.
+     * @param packages the packages this run obtained, by entry name (pass them as `packages` to the
+     * later pass of the same start, so nothing is downloaded twice).
      */
-    constructor(failures, results = []) {
-        super(`bootstrap failed for ${failures.map((f) => `${f.name}${f.required ? " (required)" : ""}: ${f.message}`).join("; ")}`);
+    constructor(failures, results = [], deferred = [], packages = new Map()) {
+        super(failures.length > 0
+            ? `bootstrap failed for ${failures.map((f) => `${f.name}${f.required ? " (required)" : ""}: ${f.message}`).join("; ")}`
+            : `bootstrap deferred the builtin plugins ${deferred.join(", ")} to the pass after the extensions load`);
         this.failures = failures;
         this.results = results;
+        this.deferred = deferred;
+        this.packages = packages;
         this.name = "BootstrapFailedError";
     }
     /** A required entry failed: the kernel must not serve without it. */
@@ -128,7 +147,8 @@ const integrityOf = (bytes) => `sha512-${createHash("sha512").update(bytes).dige
  * file there has that sha512, else (a `source: "npm"` entry) downloaded from the npm registry and
  * verified against the pin (the packument's `dist.integrity` is not consulted). Throws an
  * {@link ApiError} naming the plugin for the first entry it cannot obtain
- * (`bootstrap.missing_file`, `bootstrap.download_failed`, `bootstrap.integrity_mismatch`).
+ * (`bootstrap.missing_file`, `bootstrap.download_failed`, `bootstrap.integrity_mismatch`), except
+ * for the `soft` entries (recorded in `failed`, left out of the result).
  */
 export async function resolveBootstrapPackages(manifest, o) {
     const out = new Map();
@@ -141,11 +161,20 @@ export async function resolveBootstrapPackages(manifest, o) {
     const where = o.dir !== undefined ? o.dir : "the bootstrap directory (config bootstrap.dir)";
     for (const e of manifest.plugins) {
         signal.throwIfAborted();
-        const found = offline.get(e.integrity);
-        if (found !== undefined) {
-            out.set(e.name, found);
-            continue;
+        try {
+            out.set(e.name, await obtain(e));
         }
+        catch (err) {
+            if (signal.aborted || !(err instanceof ApiError) || o.soft?.(e) !== true)
+                throw err;
+            o.failed?.set(e.name, err);
+        }
+    }
+    return out;
+    async function obtain(e) {
+        const found = offline.get(e.integrity);
+        if (found !== undefined)
+            return found;
         if (e.source === "workspace") {
             throw new ApiError("bootstrap.missing_file", `Bootstrap plugin ${e.name} ${e.version}: no file in ${where} has its pinned sha512 (${e.integrity.slice(0, 19)}…), and a workspace entry cannot be downloaded; put its package tgz (pnpm pack-plugin ${e.path}) in that directory`);
         }
@@ -153,7 +182,7 @@ export async function resolveBootstrapPackages(manifest, o) {
         const offlineHint = `to install offline, put the package tgz (npm pack ${e.npm}@${e.version}, any file name) in ${where}`;
         try {
             const r = await fetchPackage({ registry: npmRegistry, ...(npmToken !== undefined && { token: npmToken }), maxBytes }, e.npm, e.version, signal, { expectedIntegrity: e.integrity });
-            out.set(e.name, r.bytes);
+            return r.bytes;
         }
         catch (err) {
             if (signal.aborted)
@@ -169,7 +198,6 @@ export async function resolveBootstrapPackages(manifest, o) {
             throw new ApiError("bootstrap.download_failed", `Bootstrap plugin ${e.name} ${e.version}: cannot download ${e.npm}@${e.version} from ${registry} (${reason}); ${offlineHint}, or set packages.npmRegistry to a reachable mirror`);
         }
     }
-    return out;
 }
 /** The registry's origin, for messages (never its credentials or path). */
 function registryOrigin(registry) {
@@ -298,20 +326,47 @@ let BootstrapService = class BootstrapService {
             const done = await recorded();
             if (done)
                 return done;
-            // Every package is obtained and checked before the first write
-            const files = await resolveBootstrapPackages(o.manifest, {
+            const deferBuiltin = o.deferBuiltin === true;
+            const isDeferred = (e) => deferBuiltin && e.builtin === true;
+            // Every package is obtained and checked before the first write (a deferred entry's by the
+            // later pass). The first pass refuses to write anything when one is missing or tampered;
+            // the later pass only fails that entry unless it is required.
+            const files = new Map();
+            const fetchFailed = new Map();
+            const toObtain = [];
+            for (const e of o.manifest.plugins) {
+                if (isDeferred(e))
+                    continue;
+                const kept = o.packages?.get(e.name);
+                if (kept !== undefined && integrityOf(kept) === e.integrity)
+                    files.set(e.name, kept);
+                else
+                    toObtain.push(e);
+            }
+            const obtained = await resolveBootstrapPackages({ ...o.manifest, plugins: toObtain }, {
                 ...(o.dir !== undefined && { dir: o.dir }),
                 config: this.config(),
                 signal,
                 log: this.log,
+                ...(!deferBuiltin && { soft: (e) => !e.required, failed: fetchFailed }),
             });
+            for (const [name, bytes] of obtained)
+                files.set(name, bytes);
             const handled = await this.lastRunNames();
             const results = [];
             const failures = [];
+            const deferred = [];
             for (const e of o.manifest.plugins) {
                 signal.throwIfAborted();
+                if (isDeferred(e)) {
+                    deferred.push(e.name);
+                    continue;
+                }
                 await this.warnIfHeld(e);
                 try {
+                    const fetchErr = fetchFailed.get(e.name);
+                    if (fetchErr !== undefined)
+                        throw fetchErr;
                     const r = await this.entry(e, files.get(e.name), handled, o.imports);
                     results.push(carried(r, o.carry));
                 }
@@ -320,6 +375,7 @@ let BootstrapService = class BootstrapService {
                         plugin: e.name,
                         version: e.version,
                         required: e.required,
+                        ...(e.builtin === true && { builtin: true }),
                         err,
                     });
                     failures.push({
@@ -331,8 +387,9 @@ let BootstrapService = class BootstrapService {
                 }
             }
             results.push(...(await this.clearRemoved(o.manifest)));
-            if (failures.length > 0)
-                throw new BootstrapFailedError(failures, results);
+            if (failures.length > 0 || deferred.length > 0) {
+                throw new BootstrapFailedError(failures, results, deferred, files);
+            }
             signal.throwIfAborted();
             await this.recordDone(manifestSha256, results);
             this.log.info("bootstrap completed", { manifestSha256, results });
@@ -421,12 +478,15 @@ let BootstrapService = class BootstrapService {
         const ref = `bootstrap:${e.name}@${e.version}`;
         // Not new to the manifest: an optional entry left out on purpose stays out (Ruling 5)
         const isNew = handled === undefined || !handled.has(e.name);
+        // Required and builtin entries are builtin in the catalog and put back when missing
+        const builtin = e.required || e.builtin === true;
         if (!pkg.manifest.extension) {
-            await this.markBuiltin(e.name, e.required);
-            if (!isNew)
+            await this.markBuiltin(e.name, builtin);
+            if (!isNew && !(builtin && !(await this.hasLiveItem(e.name)))) {
                 return { name: e.name, action: "kept", version: e.version };
+            }
             const imported = await this.importOnly(e, bytes, ref, imports);
-            await this.markBuiltin(e.name, e.required);
+            await this.markBuiltin(e.name, builtin);
             return { name: e.name, action: imported ? "imported" : "kept", version: e.version };
         }
         if (this.registry.declared().has(e.name)) {
@@ -438,7 +498,7 @@ let BootstrapService = class BootstrapService {
             .select(["version", "source", "required", "desired_state", "sha256"])
             .where("name", "=", e.name)
             .executeTakeFirst();
-        if (!row && !isNew && !e.required) {
+        if (!row && !isNew && !builtin) {
             this.log.info("bootstrap: an optional plugin that is not installed stays uninstalled", {
                 plugin: e.name,
             });
@@ -476,18 +536,31 @@ let BootstrapService = class BootstrapService {
         if (e.required && row?.desired_state === "disabled") {
             leftDisabled = await this.enableOrWarn(e);
         }
-        await this.markBuiltin(e.name, e.required);
+        await this.markBuiltin(e.name, builtin);
         return leftDisabled === undefined ? result : { ...result, leftDisabled };
     }
+    /** Whether a live (not deleted) platform catalog item has this name. */
+    async hasLiveItem(name) {
+        const row = await this.db
+            .selectFrom("catalog_items")
+            .select("id")
+            .where("name", "=", name)
+            .where("owner_org_id", "is", null)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        return row !== undefined;
+    }
     /**
-     * The catalog item of a bootstrap entry follows `required`: a required entry is builtin, offered
-     * to every org (scope `all`) and not disabled (migration 0075 could leave a required plugin
-     * disabled); an entry that stops being required is no longer builtin and keeps scope `all` (the
-     * admin may change it from then on).
+     * The catalog item of a bootstrap entry follows `required` / `builtin`: such an entry is builtin,
+     * offered to every org (scope `all`, which an org admin cannot switch off) and not disabled
+     * (migration 0075 could leave a required plugin disabled); an entry that stops being required or
+     * builtin is no longer builtin and keeps scope `all` (the admin may change it from then on).
+     * Only the platform item: an org-owned item of the same name (the entry then fails with
+     * `plugin.name_taken`) is never touched.
      */
-    async markBuiltin(name, required) {
+    async markBuiltin(name, builtin) {
         const touch = { updated_at: sql `now()` };
-        if (required) {
+        if (builtin) {
             await this.db
                 .updateTable("catalog_items")
                 .set({
@@ -498,6 +571,7 @@ let BootstrapService = class BootstrapService {
                 ...touch,
             })
                 .where("name", "=", name)
+                .where("owner_org_id", "is", null)
                 .where("deleted_at", "is", null)
                 .where((eb) => eb.or([eb("builtin", "=", false), eb("scope", "<>", "all"), eb("disabled", "=", true)]))
                 .execute();
@@ -507,6 +581,7 @@ let BootstrapService = class BootstrapService {
             .updateTable("catalog_items")
             .set({ builtin: false, ...touch })
             .where("name", "=", name)
+            .where("owner_org_id", "is", null)
             .where("deleted_at", "is", null)
             .where("builtin", "=", true)
             .execute();
@@ -582,6 +657,7 @@ let BootstrapService = class BootstrapService {
             .selectFrom("catalog_items")
             .select("id")
             .where("name", "=", e.name)
+            .where("owner_org_id", "is", null)
             .where("deleted_at", "is", null)
             .executeTakeFirst();
         const installed = await this.ops.install(e.name, review.sha256, null, undefined, item ? { catalogItemId: item.id } : {});
@@ -650,6 +726,7 @@ let BootstrapService = class BootstrapService {
             .updateTable("catalog_items")
             .set({ builtin: false, updated_at: sql `now()` })
             .where("builtin", "=", true)
+            .where("owner_org_id", "is", null)
             .where("deleted_at", "is", null);
         if (names.length > 0)
             items = items.where("name", "not in", names);

package/dist/lifecycle/kernel-lifecycle.d.ts

@@ -99,6 +99,8 @@ export declare class KernelLifecycle implements OnApplicationBootstrap, BeforeAp
     private unwatchConfig;
     /** What the first bootstrap pass did, carried into the second one. */
     private bootstrapCarry;
+    /** The packages the first bootstrap pass obtained, so the second downloads nothing again. */
+    private bootstrapPackages;
     constructor(accounts: AccountsService, configService: KernelConfigService, log: KernelLogger, options: KernelAppOptions, pool: Kysely<any>, redis: Redis, kdb: KernelDb, shutdown: GracefulShutdown, host: ExtensionHost, registry: ExtensionRegistry, installs: ExtensionInstalls, blobs: ExtensionBlobs, extensionLifecycle: ExtensionLifecycle, replicaStatus: ReplicaStatusStore, bootstrap: BootstrapService, marketplaces: MarketplacesService, pluginImport: PluginImport, bus: Pick<ExtensionContext["bus"], "publish" | "subscribe">, usageReport: UsageReporter, titles: TitleQueue, channelJobs: ChannelJobs, channelOutbound: ChannelOutbound, presence: ReplicaPresence, worker?: WorkerRole | undefined, gateway?: GatewayRole | undefined);
     /** The kernel HTTP application (set up by `buildKernelApp` before `init()`). */
     get http(): KernelHttpApp;
@@ -122,7 +124,9 @@ export declare class KernelLifecycle implements OnApplicationBootstrap, BeforeAp
      * kernel never serves without a required plugin. A failed optional entry is logged and returns
      * true: the start runs the step once more after the extensions loaded (a declarative entry's
      * catalog files need the object store, which on a fresh deployment is itself a bootstrap plugin),
-     * and the next start tries again while it stays incomplete.
+     * and the next start tries again while it stays incomplete. The first pass skips the `builtin`
+     * entries (they may ship skills and templates, which need the object store) and returns true for
+     * them too; the final pass imports them, and one that fails is logged like an optional entry.
      */
     private runBootstrap;
     /** 部署尚无活跃超级管理员时提示去初始化；查询失败只记日志，不影响启动。 */

package/dist/lifecycle/kernel-lifecycle.js

@@ -120,6 +120,8 @@ let KernelLifecycle = class KernelLifecycle {
     unwatchConfig;
     /** What the first bootstrap pass did, carried into the second one. */
     bootstrapCarry;
+    /** The packages the first bootstrap pass obtained, so the second downloads nothing again. */
+    bootstrapPackages;
     constructor(accounts, configService, log, options, 
     // biome-ignore lint/suspicious/noExplicitAny: the pool carries no schema types
     pool, redis, kdb, shutdown, host, registry, installs, blobs, extensionLifecycle, replicaStatus, bootstrap, marketplaces, pluginImport, bus, 
@@ -303,7 +305,9 @@ let KernelLifecycle = class KernelLifecycle {
      * kernel never serves without a required plugin. A failed optional entry is logged and returns
      * true: the start runs the step once more after the extensions loaded (a declarative entry's
      * catalog files need the object store, which on a fresh deployment is itself a bootstrap plugin),
-     * and the next start tries again while it stays incomplete.
+     * and the next start tries again while it stays incomplete. The first pass skips the `builtin`
+     * entries (they may ship skills and templates, which need the object store) and returns true for
+     * them too; the final pass imports them, and one that fails is logged like an optional entry.
      */
     async runBootstrap(dir, final = false) {
         const manifest = this.options.bootstrapManifest ?? (await readBootstrapManifest());
@@ -318,17 +322,25 @@ let KernelLifecycle = class KernelLifecycle {
                 ...(dir !== undefined && { dir }),
                 signal: this.shutdown.signal,
                 ...(this.bootstrapCarry !== undefined && { carry: this.bootstrapCarry }),
+                ...(this.bootstrapPackages !== undefined && { packages: this.bootstrapPackages }),
+                deferBuiltin: !final,
             });
             return false;
         }
         catch (e) {
             if (e instanceof BootstrapFailedError && !e.requiredFailed) {
                 this.bootstrapCarry = e.results;
-                if (final) {
-                    this.log.error("bootstrap: optional plugins could not be installed; retried on the next start", { failures: e.failures });
+                this.bootstrapPackages = e.packages;
+                if (e.failures.length === 0) {
+                    this.log.info("bootstrap: builtin plugins are installed once the extensions have loaded", {
+                        deferred: e.deferred,
+                    });
+                }
+                else if (final) {
+                    this.log.error("bootstrap: optional or builtin plugins could not be installed; retried on the next start", { failures: e.failures });
                 }
                 else {
-                    this.log.warn("bootstrap: optional plugins could not be installed yet; retried once the extensions have loaded", { failures: e.failures });
+                    this.log.warn("bootstrap: optional or builtin plugins could not be installed yet; retried once the extensions have loaded", { failures: e.failures });
                 }
                 return true;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.20",
+  "version": "0.1.0-rc.21",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -65,7 +65,7 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.14"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.15"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",