@capybara-hq/kernel 0.1.0-rc.20 → 0.1.0-rc.22

package/dist/devices/public-suffix.js

@@ -0,0 +1,79 @@
+/**
+ * Public suffixes of more than one label that a device-page wildcard may not cover (a small
+ * built-in list, not the public suffix list; capybara-device keeps the same list in
+ * packages/device/src/public-suffix.ts). Includes the shared hosting suffixes where each
+ * subdomain belongs to someone else.
+ */
+const MULTI_LABEL_SUFFIXES = new Set([
+    "ac.uk",
+    "co.uk",
+    "gov.uk",
+    "ltd.uk",
+    "me.uk",
+    "net.uk",
+    "org.uk",
+    "plc.uk",
+    "com.cn",
+    "edu.cn",
+    "gov.cn",
+    "net.cn",
+    "org.cn",
+    "com.hk",
+    "org.hk",
+    "com.tw",
+    "org.tw",
+    "co.jp",
+    "ne.jp",
+    "or.jp",
+    "ac.jp",
+    "co.kr",
+    "or.kr",
+    "com.au",
+    "net.au",
+    "org.au",
+    "edu.au",
+    "co.nz",
+    "org.nz",
+    "com.br",
+    "com.mx",
+    "com.sg",
+    "com.my",
+    "co.in",
+    "co.za",
+    "com.tr",
+    "com.ar",
+    "github.io",
+    "gitlab.io",
+    "pages.dev",
+    "workers.dev",
+    "vercel.app",
+    "netlify.app",
+    "herokuapp.com",
+    "appspot.com",
+    "web.app",
+    "firebaseapp.com",
+    "azurewebsites.net",
+    "cloudfront.net",
+    "amazonaws.com",
+    "blogspot.com",
+    "ngrok.io",
+    "ngrok-free.app",
+    "trycloudflare.com",
+    "onrender.com",
+    "fly.dev",
+    "glitch.me",
+]);
+/**
+ * Why a `*.` wildcard is too broad to add from the device page: its remainder is a whole public
+ * suffix (one label such as `com`, or a known multi-label one such as `co.uk`, `github.io`);
+ * null for an exact host or a narrower wildcard.
+ */
+export function publicSuffixWildcard(pattern) {
+    if (!pattern.startsWith("*."))
+        return null;
+    const rest = pattern.slice(2).toLowerCase();
+    if (!rest.includes(".") || MULTI_LABEL_SUFFIXES.has(rest)) {
+        return `Use a narrower domain; ${pattern.toLowerCase()} covers a whole public suffix.`;
+    }
+    return null;
+}

package/dist/errors.d.ts

@@ -35,6 +35,7 @@ export declare const ERROR_CODES: {
     readonly "org.last_owner": 409;
     readonly "org.owner_required": 403;
     readonly "org.sandbox_egress_not_allowed": 400;
+    readonly "org.sandbox_tier_not_allowed": 400;
     readonly "member.not_found": 404;
     readonly "member.already_exists": 409;
     readonly "member.anonymous_guest": 409;
@@ -231,11 +232,6 @@ export declare const ERROR_CODES: {
     readonly "agent.model_unavailable": 400;
     /** A save gave `instructionFiles` and an `instructions` that is not their join. */
     readonly "agent.instructions_mismatch": 400;
-    /**
-     * `skills.pinned` of an agent definition is refused (details: `{ skill, reason, totalBytes? }`;
-     * reasons `not_selected`, `not_found`, `duplicate`, `too_many`, `too_large`, `manual_only`).
-     */
-    readonly "agent.pinned_invalid": 400;
     /** `subagents` of an agent definition is refused (details: `{ reason, path, value? }`). */
     readonly "agent.subagents_invalid": 400;
     /** Creating from a template with a visibility other than `private` without `agents.manage`. */
@@ -291,6 +287,7 @@ export declare const ERROR_CODES: {
     readonly "approval.not_found": 404;
     readonly "approval.already_decided": 409;
     readonly "approval.scope_not_allowed": 409;
+    readonly "approval.not_yours": 403;
     readonly "question.not_found": 404;
     readonly "question.already_answered": 409;
     readonly "tool_output.not_found": 404;
@@ -348,6 +345,28 @@ export declare const ERROR_CODES: {
     readonly "device.offline": 503;
     /** The local device's machine runs a `capybara-device` too old for this kernel; update it. */
     readonly "device.program_outdated": 426;
+    /**
+     * The device's machine refused a network policy change (its local `remoteGrants` is `off`, it
+     * runs in Docker mode, or a host is invalid); the message says how to allow it on the machine.
+     */
+    readonly "device.policy_refused": 409;
+    /** The device cannot change its network policy from the platform (cloud, or an older program). */
+    readonly "device.policy_unsupported": 409;
+    /**
+     * The device runs commands without a sandbox (its owner set it locally), which the org or the
+     * platform does not allow, or a scheduled run without the task's `tier:open` grant uses it
+     * (sandbox dev tiers spec §4.3, §11.4); checked at each command.
+     */
+    readonly "device.unsandboxed_not_allowed": 403;
+    /**
+     * A scheduled run uses a cloud device whose sandbox tier is open without the task's `tier:open`
+     * grant (sandbox dev tiers spec §11.4).
+     */
+    readonly "device.tier_not_granted": 403;
+    /** A device's sandbox tier above the org's or the platform's highest (sandbox dev tiers §4.1). */
+    readonly "device.tier_not_allowed": 400;
+    /** A local device's tier is kept on its machine (`policy` op or the local CLI), not the row. */
+    readonly "device.tier_on_device": 409;
     /** Device sign-in (RFC 8628 style): the person has not approved the code yet; keep polling. */
     readonly "device_sign_in.authorization_pending": 400;
     /** Device sign-in: the program polls faster than the interval; add 5 seconds and keep polling. */
@@ -362,6 +381,28 @@ export declare const ERROR_CODES: {
     readonly "device_sign_in.unavailable": 503;
     /** The machine credential is unknown or revoked. */
     readonly "device.credential_invalid": 401;
+    /** The scheduled task is missing, deleted, in another org or not the caller's to see. */
+    readonly "schedule.not_found": 404;
+    /** Not a 5-field cron expression (no seconds field). */
+    readonly "schedule.invalid_cron": 400;
+    /** Not an IANA time zone. */
+    readonly "schedule.invalid_time_zone": 400;
+    /** A `once` time that is not a local date-time `YYYY-MM-DDTHH:mm[:ss]`. */
+    readonly "schedule.invalid_once_time": 400;
+    /** A `once` time that is not in the future. */
+    readonly "schedule.once_in_past": 400;
+    /** Two fire times closer than the org's `minIntervalMinutes`. */
+    readonly "schedule.interval_too_short": 400;
+    /** The creator or the org has as many active and paused tasks as the org allows. */
+    readonly "schedule.limit_reached": 409;
+    /** The org turned scheduled tasks off. */
+    readonly "schedule.disabled": 409;
+    /** Where the task runs is inconsistent or not the creator's to use (conversation, chat, device). */
+    readonly "schedule.target_invalid": 400;
+    /** A tool the creator cannot pre-approve for the task (spec §7). */
+    readonly "schedule.grant_not_allowed": 400;
+    /** An org admin may pause, resume and delete another person's task, never edit it. */
+    readonly "schedule.forbidden": 403;
     readonly "skill.not_found": 404;
     /** Also a skill neither the model nor a person could use (phase D: both invocation flags off). */
     readonly "skill.invalid_package": 400;

package/dist/errors.js

@@ -35,6 +35,7 @@ export const ERROR_CODES = {
     "org.last_owner": 409,
     "org.owner_required": 403,
     "org.sandbox_egress_not_allowed": 400,
+    "org.sandbox_tier_not_allowed": 400,
     "member.not_found": 404,
     "member.already_exists": 409,
     "member.anonymous_guest": 409,
@@ -231,11 +232,6 @@ export const ERROR_CODES = {
     "agent.model_unavailable": 400,
     /** A save gave `instructionFiles` and an `instructions` that is not their join. */
     "agent.instructions_mismatch": 400,
-    /**
-     * `skills.pinned` of an agent definition is refused (details: `{ skill, reason, totalBytes? }`;
-     * reasons `not_selected`, `not_found`, `duplicate`, `too_many`, `too_large`, `manual_only`).
-     */
-    "agent.pinned_invalid": 400,
     /** `subagents` of an agent definition is refused (details: `{ reason, path, value? }`). */
     "agent.subagents_invalid": 400,
     /** Creating from a template with a visibility other than `private` without `agents.manage`. */
@@ -291,6 +287,7 @@ export const ERROR_CODES = {
     "approval.not_found": 404,
     "approval.already_decided": 409,
     "approval.scope_not_allowed": 409,
+    "approval.not_yours": 403,
     "question.not_found": 404,
     "question.already_answered": 409,
     "tool_output.not_found": 404,
@@ -348,6 +345,28 @@ export const ERROR_CODES = {
     "device.offline": 503,
     /** The local device's machine runs a `capybara-device` too old for this kernel; update it. */
     "device.program_outdated": 426,
+    /**
+     * The device's machine refused a network policy change (its local `remoteGrants` is `off`, it
+     * runs in Docker mode, or a host is invalid); the message says how to allow it on the machine.
+     */
+    "device.policy_refused": 409,
+    /** The device cannot change its network policy from the platform (cloud, or an older program). */
+    "device.policy_unsupported": 409,
+    /**
+     * The device runs commands without a sandbox (its owner set it locally), which the org or the
+     * platform does not allow, or a scheduled run without the task's `tier:open` grant uses it
+     * (sandbox dev tiers spec §4.3, §11.4); checked at each command.
+     */
+    "device.unsandboxed_not_allowed": 403,
+    /**
+     * A scheduled run uses a cloud device whose sandbox tier is open without the task's `tier:open`
+     * grant (sandbox dev tiers spec §11.4).
+     */
+    "device.tier_not_granted": 403,
+    /** A device's sandbox tier above the org's or the platform's highest (sandbox dev tiers §4.1). */
+    "device.tier_not_allowed": 400,
+    /** A local device's tier is kept on its machine (`policy` op or the local CLI), not the row. */
+    "device.tier_on_device": 409,
     /** Device sign-in (RFC 8628 style): the person has not approved the code yet; keep polling. */
     "device_sign_in.authorization_pending": 400,
     /** Device sign-in: the program polls faster than the interval; add 5 seconds and keep polling. */
@@ -362,6 +381,28 @@ export const ERROR_CODES = {
     "device_sign_in.unavailable": 503,
     /** The machine credential is unknown or revoked. */
     "device.credential_invalid": 401,
+    /** The scheduled task is missing, deleted, in another org or not the caller's to see. */
+    "schedule.not_found": 404,
+    /** Not a 5-field cron expression (no seconds field). */
+    "schedule.invalid_cron": 400,
+    /** Not an IANA time zone. */
+    "schedule.invalid_time_zone": 400,
+    /** A `once` time that is not a local date-time `YYYY-MM-DDTHH:mm[:ss]`. */
+    "schedule.invalid_once_time": 400,
+    /** A `once` time that is not in the future. */
+    "schedule.once_in_past": 400,
+    /** Two fire times closer than the org's `minIntervalMinutes`. */
+    "schedule.interval_too_short": 400,
+    /** The creator or the org has as many active and paused tasks as the org allows. */
+    "schedule.limit_reached": 409,
+    /** The org turned scheduled tasks off. */
+    "schedule.disabled": 409,
+    /** Where the task runs is inconsistent or not the creator's to use (conversation, chat, device). */
+    "schedule.target_invalid": 400,
+    /** A tool the creator cannot pre-approve for the task (spec §7). */
+    "schedule.grant_not_allowed": 400,
+    /** An org admin may pause, resume and delete another person's task, never edit it. */
+    "schedule.forbidden": 403,
     "skill.not_found": 404,
     /** Also a skill neither the model nor a person could use (phase D: both invocation flags off). */
     "skill.invalid_package": 400,

package/dist/evals/reconstruct.d.ts

@@ -13,15 +13,15 @@ import { type CaseSnapshot } from "./snapshot.js";
  * - `system_hash` / `tools_changed`（只在基线判定）：system 指纹、工具序列（tools 与 catalog）与记录不同；
  * - `tool_spec_missing`：快照里缺某个工具定义（从请求里去掉）；
  * - `definition_missing`：快照里缺该 agent 版本的定义（用空指令）；
- * - `pinned_changed` (phase B, never for a baseline): the candidate definition (or candidate agent
- *   version) pins other skills (`skills.pinned`, deduplicated and capped) than the original agent
- *   version's definition (the recorded snapshot's `pinned` ids when that definition is missing; not
- *   with `definition_missing`); the request still renders the recorded pinned bodies (Decision 1);
+ * - `pinned_changed` (phase B, never for a baseline, not with `definition_missing`): the
+ *   `skills_catalog` snapshot in effect at the call pinned skills (`pinned` non-empty). No candidate
+ *   can pin any more (skills default-on spec §9), so any candidate differs from such a call; the
+ *   request still renders the recorded pinned bodies (Decision 1);
  * - `subagent_changed` (phase C, never for a baseline): a sub-agent's (child) case with a candidate
  *   whose effective definition differs from the one frozen in its `subagent_started` (see
  *   {@link subagentChanged}); the request still renders the logged definition and preamble. A child
- *   case never consults `definitions` (no `definition_missing`) and has no `pinned_changed` (its
- *   pins are part of the effective definition);
+ *   case never consults `definitions` (no `definition_missing`) and has no `pinned_changed` (a
+ *   logged child definition that pinned counts as `subagent_changed`);
  * - `legacy_event`：记录缺 `tools` / `params` / `absorbedUpToSeq` / `maxOutputTokens`，或还原出媒体而记录里没有
  *   `media` / `mediaBudgetBytes`（较早的事件）；
  * - `params_changed`：没给候选参数时，记录的参数按所用模型的声明清洗后有键被丢弃或值变了（换了模型或模型声明变了）；
@@ -31,7 +31,10 @@ import { type CaseSnapshot } from "./snapshot.js";
  */
 /** 还原结果与原请求不一致的原因。 */
 export type DriftReason = "system_hash" | "tools_changed" | "tool_spec_missing" | "definition_missing"
-/** The candidate pins other skills than the recorded snapshot rendered (phase B). */
+/**
+ * The call rendered pinned skills (phase B), which no candidate has any more (skills default-on
+ * spec §9).
+ */
  | "pinned_changed"
 /** A child case's candidate has another effective definition than the logged one (phase C). */
  | "subagent_changed" | "legacy_event" | "params_changed"
@@ -97,17 +100,19 @@ export interface SubagentTemplateRef {
 /**
  * Does a candidate change what a sub-agent (child) case would run (`subagent_changed`, spec
  * §15.1)? Pure, from the snapshot alone, comparing the model-visible parts of the effective
- * definition (instructions, pinned skills, tools) with the logged one (`logged`, from its
- * `subagent_started`):
+ * definition (instructions, turned-off skills, tools) with the logged one (`logged`, from its
+ * `subagent_started`). A logged definition that pinned skills (`started.definition`, read raw)
+ * differs from every candidate: none pins any more (skills default-on spec §9).
  * - the same agent version (`sameVersion`): the candidate is the logged definition with
  *   overrides (instructions, model, params), compared field by field;
  * - another version of the case's agent: for an org agent child (`source: "agent"`) that agent's
  *   version, as dispatch would use it (its own tools minus the child-removed ones); otherwise the
- *   parent's version: `general` takes its instructions and tools and pins nothing, `inline` its
- *   template of the same name (gone = changed), and a `plugin` template does not depend on the
+ *   parent's version: `general` takes its instructions and tools (its skills follow the parent's,
+ *   `parentSide`), `inline` its template of the same name and the parent's turned-off tools and
+ *   skills (`parentSide`; the template gone = changed), and a `plugin` template does not depend on the
  *   parent version (its own version is {@link ReconstructOptions.subagentTemplate}). Template
- *   narrowing that needs the database (inline and plugin tool allowlists, skill names) is not
- *   recomputed: those compare instructions only.
+ *   narrowing that needs the database (inline and plugin tool allowlists, a plugin template's
+ *   `disallowedSkills` and skill names) is not recomputed: those compare instructions only.
  * Models and params are not part of it: they are candidate axes of their own. Neither is the
  * candidate's `subagents` block as the child's own roster (allowlist, templates, limits; only a
  * template child's entry in its parent's roster counts, `parentSide`) nor whether it offers `Agent`:

package/dist/evals/reconstruct.js

@@ -1,14 +1,24 @@
 import { sanitizeParams, } from "@capybara-hq/plugin-sdk";
-import { AgentDefinitionSchema, builtinDisabled, canonicalDisabledTools, normalizeStoredDefinition, } from "../agents/definition.js";
+import { AgentDefinitionSchema, builtinDisabled, canonicalDisabledSkills, canonicalDisabledTools, normalizeStoredDefinition, } from "../agents/definition.js";
 import { sameModel, selectionAt } from "../conversations/selection.js";
 import { ApiError } from "../errors.js";
 import { mediaRefs, planMedia, } from "../runtime/context/build.js";
 import { assembleModelRequest } from "../runtime/model-call.js";
 import { CHILD_REMOVED_TOOLS } from "../runtime/subagents/definition.js";
-import { PINNED_SKILLS_LIMITS } from "../skills/catalog.js";
 import { AGENT_TOOL } from "../tools/builtin-names.js";
 import { canonicalJson } from "./recorded-tools.js";
 import { toEvents } from "./snapshot.js";
+/**
+ * Does a definition from before skills were on by default pin skills? Read raw: the normalizer
+ * drops `skills.pinned` (skills default-on spec §4, §9).
+ */
+const pinsSkills = (d) => {
+    const skills = typeof d === "object" && d !== null ? d.skills : undefined;
+    const pinned = typeof skills === "object" && skills !== null
+        ? skills.pinned
+        : undefined;
+    return Array.isArray(pinned) && pinned.length > 0;
+};
 const DRIFT_ORDER = [
     "system_hash",
     "tools_changed",
@@ -103,27 +113,16 @@ export function reconstructRequest(s, modelCallSeq, opts) {
             model: { provider: call.payload.provider, model: call.payload.model },
         });
     }
-    // pinned_changed: the candidate pins other skills than the recorded agent version did. Compared
-    // with the original version's definition, not the effective snapshot (which omits stale or
-    // oversized pins), both deduplicated and capped like the run; the snapshot's ids only when that
-    // definition is missing. The stub of definition_missing has no pins, so it is skipped then.
+    // pinned_changed (skills default-on spec §9): the snapshot in effect at the call pinned skills,
+    // and no candidate pins any more (the migration rewrote the stored versions without pins). The
+    // stub of definition_missing is no candidate, so it is skipped then; a child reports a logged
+    // pin as subagent_changed instead.
     if (!baseline && started === undefined && !drift.has("definition_missing")) {
-        const norm = (ids) => [...new Set(ids ?? [])].slice(0, PINNED_SKILLS_LIMITS.count);
-        const origDef = s.definitions[String(origVersion)];
-        let recorded;
-        if (origDef) {
-            recorded = norm(normalizeStoredDefinition(origDef).skills?.pinned);
-        }
-        else {
-            const snap = inputEvents(all, call)
-                .filter((e) => e.type === "skills_catalog")
-                .at(-1);
-            recorded = (snap?.payload.pinned ?? []).map((p) => p.id);
-        }
-        const wanted = norm(agent.skills?.pinned);
-        if (recorded.length !== wanted.length || recorded.some((id, i) => wanted[i] !== id)) {
+        const snap = inputEvents(all, call)
+            .filter((e) => e.type === "skills_catalog")
+            .at(-1);
+        if ((snap?.payload.pinned ?? []).length > 0)
             drift.add("pinned_changed");
-        }
     }
     // 工具：按记录的顺序从快照取定义；取不到的从请求里去掉（基线与候选一样）
     const tools = [];
@@ -215,7 +214,8 @@ const sameTemplate = (logged, t) => logged.source !== "plugin" ||
     (logged.id === t.id &&
         logged.version === t.version &&
         (logged.platformTemplateId ?? null) === (t.platformTemplateId ?? null));
-const pinsOf = (d) => [...new Set(d.skills?.pinned ?? [])].slice(0, PINNED_SKILLS_LIMITS.count);
+/** A definition's turned-off skills, as compared (canonical form). */
+const skillsOf = (d) => canonicalJson(canonicalDisabledSkills(d.disabledSkills ?? []));
 /**
  * A sub-agent's tools without template narrowing (general and org agents), as compared: its
  * turned-off tools (tools default-on spec §4) and its key filter's allowlist and `deny` keys,
@@ -233,28 +233,35 @@ const childToolsOf = (d, keepAgent) => canonicalJson({
 const hasAgent = (d) => !builtinDisabled(d.disabledTools, AGENT_TOOL) &&
     !(d.subagentTools?.deny ?? []).includes(AGENT_TOOL) &&
     (d.subagentTools?.allow === undefined || d.subagentTools.allow.includes(AGENT_TOOL));
-/** The parent's selection a template child depends on: its tools, org skills and roster entry. */
+/**
+ * The parent's selection a template child depends on: its turned-off tools and skills (every
+ * `general`, `inline` and `plugin` child starts from them) and its roster entry.
+ */
 const parentSide = (d, started) => canonicalJson({
     disabledTools: canonicalDisabledTools(d.disabledTools ?? []),
-    orgSkills: d.skills?.orgSkills ?? [],
+    disabledSkills: canonicalDisabledSkills(d.disabledSkills ?? []),
     listed: started.template.source === "general"
         ? d.subagents?.general !== false
-        : (d.subagents?.templates ?? []).includes(started.template.id ?? ""),
+        : started.template.source === "inline"
+            ? (d.subagents?.inline ?? []).some((x) => x.name === started.agentType)
+            : (d.subagents?.templates ?? []).includes(started.template.id ?? ""),
 });
 /**
  * Does a candidate change what a sub-agent (child) case would run (`subagent_changed`, spec
  * §15.1)? Pure, from the snapshot alone, comparing the model-visible parts of the effective
- * definition (instructions, pinned skills, tools) with the logged one (`logged`, from its
- * `subagent_started`):
+ * definition (instructions, turned-off skills, tools) with the logged one (`logged`, from its
+ * `subagent_started`). A logged definition that pinned skills (`started.definition`, read raw)
+ * differs from every candidate: none pins any more (skills default-on spec §9).
  * - the same agent version (`sameVersion`): the candidate is the logged definition with
  *   overrides (instructions, model, params), compared field by field;
  * - another version of the case's agent: for an org agent child (`source: "agent"`) that agent's
  *   version, as dispatch would use it (its own tools minus the child-removed ones); otherwise the
- *   parent's version: `general` takes its instructions and tools and pins nothing, `inline` its
- *   template of the same name (gone = changed), and a `plugin` template does not depend on the
+ *   parent's version: `general` takes its instructions and tools (its skills follow the parent's,
+ *   `parentSide`), `inline` its template of the same name and the parent's turned-off tools and
+ *   skills (`parentSide`; the template gone = changed), and a `plugin` template does not depend on the
  *   parent version (its own version is {@link ReconstructOptions.subagentTemplate}). Template
- *   narrowing that needs the database (inline and plugin tool allowlists, skill names) is not
- *   recomputed: those compare instructions only.
+ *   narrowing that needs the database (inline and plugin tool allowlists, a plugin template's
+ *   `disallowedSkills` and skill names) is not recomputed: those compare instructions only.
  * Models and params are not part of it: they are candidate axes of their own. Neither is the
  * candidate's `subagents` block as the child's own roster (allowlist, templates, limits; only a
  * template child's entry in its parent's roster counts, `parentSide`) nor whether it offers `Agent`:
@@ -265,24 +272,31 @@ const parentSide = (d, started) => canonicalJson({
 export function subagentChanged(started, logged, candidate, sameVersion, 
 /** The parent's definition at the case's version (the snapshot's), for template children. */
 original) {
+    if (pinsSkills(started.definition))
+        return true;
     const keepAgent = hasAgent(logged);
     const childTools = (d) => childToolsOf(d, keepAgent);
-    const differs = (instructions, pinned, tools) => instructions !== logged.instructions ||
-        (pinned !== null && canonicalJson(pinned) !== canonicalJson(pinsOf(logged))) ||
+    const differs = (instructions, skills, tools) => instructions !== logged.instructions ||
+        (skills !== null && skills !== skillsOf(logged)) ||
         (tools !== null && tools !== childTools(logged));
     if (sameVersion) {
-        return differs(candidate.instructions, pinsOf(candidate), childTools(candidate));
+        return differs(candidate.instructions, skillsOf(candidate), childTools(candidate));
     }
     switch (started.template.source) {
         case "agent":
-            return differs(candidate.instructions, pinsOf(candidate), childTools(candidate));
+            return differs(candidate.instructions, skillsOf(candidate), childTools(candidate));
         case "general":
-            return (differs(candidate.instructions, [], childTools(candidate)) ||
+            return (differs(candidate.instructions, null, childTools(candidate)) ||
                 (original !== undefined && parentSide(original, started) !== parentSide(candidate, started)));
         case "inline": {
             const t = candidate.subagents?.inline?.find((x) => x.name === started.agentType);
             if (!t)
                 return true;
+            // the parent's turned-off tools and skills reach the child as they do a general one
+            if (original !== undefined &&
+                parentSide(original, started) !== parentSide(candidate, started)) {
+                return true;
+            }
             // conservative: any difference of the template between the two versions counts
             const o = original?.subagents?.inline?.find((x) => x.name === started.agentType);
             if (o !== undefined)

package/dist/evals/recorded-tools.d.ts

@@ -1,5 +1,5 @@
-import type { SandboxRoots } from "@capybara-hq/plugin-sdk";
 import type { EventLog } from "../conversations/event-log.js";
+import { type DevicePathsPayload } from "../runtime/context/device-paths.js";
 import { type LegacyScope } from "../tools/legacy-keys.js";
 import { type ToolPipeline, type ToolStepContext } from "../tools/pipeline.js";
 import type { CaseSnapshot } from "./snapshot.js";
@@ -25,13 +25,13 @@ export interface RecordedCall {
     /** The recorded call used release-candidate names; `toolKey` and `inputKey` are already the current ones. */
     legacy?: true;
     /**
-     * The roots of the latest `device_paths` event the original run had logged by this call's
-     * step (environments spec §13.1, ruling R22): set on every recorded call from the step where an
-     * event was logged onward. A replay that matches the call writes the event when the eval
-     * conversation's latest one differs, so a candidate whose first sandbox call lands in another
-     * step still gets the line, once.
+     * The payload (roots, and the sandbox level when recorded) of the latest `device_paths` event
+     * the original run had logged by this call's step (environments spec §13.1, ruling R22): set on
+     * every recorded call from the step where an event was logged onward. A replay that matches the
+     * call writes the event when the eval conversation's latest one differs, so a candidate whose
+     * first sandbox call lands in another step still gets the line, once.
      */
-    devicePaths?: SandboxRoots;
+    devicePaths?: DevicePathsPayload;
 }
 /**
  * The connectors and extensions an rc `<x>__<tool>` key can name, from positive evidence in the

package/dist/evals/recorded-tools.js

@@ -1,4 +1,4 @@
-import { devicePathsChange } from "../runtime/context/device-paths.js";
+import { devicePathsChange, devicePathsLevel, } from "../runtime/context/device-paths.js";
 import { assistantIdemKey } from "../runtime/model-call.js";
 import { MATCH_IGNORED_FIELDS } from "../tools/builtin-names.js";
 import { isLegacyPrefixedKey, legacyToolInput, legacyToolKey, } from "../tools/legacy-keys.js";
@@ -149,7 +149,8 @@ export function recordedCalls(s) {
         for (; next < own.length && own[next].seq < end; next++) {
             const e = own[next];
             if (e.type === "device_paths" && e.seq > a) {
-                current = e.payload.roots;
+                const p = e.payload;
+                current = { roots: p.roots, ...devicePathsLevel(p) };
             }
         }
         if (current !== undefined)
@@ -238,7 +239,7 @@ export class RecordedToolPipeline {
             const paths = rec?.devicePaths;
             const change = paths === undefined
                 ? null
-                : devicePathsChange(await eventLog.latestOfType(ctx.conversationId, "device_paths"), paths, ctx.runId);
+                : devicePathsChange(await eventLog.latestOfType(ctx.conversationId, "device_paths"), paths.roots, ctx.runId, devicePathsLevel(paths));
             await eventLog.append(ctx.conversationId, [
                 ...(change ? [change] : []),
                 {

package/dist/evals/trajectory.d.ts

@@ -49,7 +49,7 @@ export interface TrajectoryToolCall {
     approval: {
         approvalId: string;
         requestedAt: string;
-        decision: "approved" | "denied" | "expired" | "cancelled" | null;
+        decision: "approved" | "denied" | "expired" | "cancelled" | "skipped" | null;
         scope?: "once" | "session" | "always";
         byAccountId: string | null;
         decidedAt: string | null;
@@ -65,6 +65,11 @@ export interface TrajectoryToolCall {
     } | null;
     /** A `tool.preExecute` policy hook denied the call (it never started). */
     hookDenied?: TrajectoryHookDenial;
+    /**
+     * The network hosts the command was refused (`network_blocked`, display only; network
+     * ask-to-allow spec §6.5). A network ask about them is the call's `approval`.
+     */
+    networkBlocked?: EventPayload<"network_blocked">["hosts"];
     /**
      * An `Agent` call that dispatched (or resumed) a sub-agent (phase C, spec §15.4): the child
      * conversation (`subagentId`, whose trajectory the viewer links to), the run it started and that

package/dist/evals/trajectory.js

@@ -103,6 +103,7 @@ function buildRun({ started, events }, prices, forks) {
     const questions = new Map(); // callId → 最近一次
     const answers = new Map(); // questionId → 结果
     const toolDenials = new Map(); // callId → denial
+    const networkBlocks = new Map(); // callId → refused hosts
     const modelDenials = new Map(); // step → denial
     const dispatches = new Map(); // callId → dispatch
     const childEnds = new Map(); // childRunId → end
@@ -167,6 +168,10 @@ function buildRun({ started, events }, prices, forks) {
             case "subagent_finished":
                 childEnds.set(e.payload.childRunId, e);
                 break;
+            case "network_blocked":
+                noteCall(e.payload.step, e.payload.callId);
+                networkBlocks.set(e.payload.callId, e);
+                break;
             case "hook_denied":
                 if (e.payload.callId !== undefined) {
                     noteCall(e.payload.step, e.payload.callId);
@@ -234,8 +239,10 @@ function buildRun({ started, events }, prices, forks) {
             const ans = q === undefined ? undefined : answers.get(q.payload.questionId);
             const denied = toolDenials.get(callId);
             const dispatch = dispatches.get(callId)?.payload;
+            const blocked = networkBlocks.get(callId)?.payload.hosts;
             return {
                 ...(denied !== undefined && { hookDenied: denialOf(denied) }),
+                ...(blocked !== undefined && { networkBlocked: blocked }),
                 ...(dispatch !== undefined && {
                     subagent: {
                         subagentId: dispatch.subagentId,