@capybara-hq/kernel 0.1.0-rc.20 → 0.1.0-rc.22

package/dist/orgs/roles.js

@@ -47,6 +47,10 @@ export const ACTION_MIN_ROLE = {
     "catalog.decide": "admin",
     // An org admin uploads a plugin package the org owns (spec §14.1 item 1, ruling P3-7)
     "catalog.upload": "admin",
+    // Scheduled tasks (spec 2026-11-11 §10): create, edit, pause, resume, run and delete one's own
+    "schedules.use": "member",
+    // list every task of the org, pause, resume and delete any (never edit another person's)
+    "schedules.manage": "admin",
 };
 /** 服务令牌也可执行的动作：只读的 org.read、org.members.read，以及使用 agent 的 agents.use。 */
 const SERVICE_ALLOWED = new Set([

package/dist/orgs/settings.controller.js

@@ -30,7 +30,8 @@ let OrgSettingsController = class OrgSettingsController {
     async update(principal, org, body) {
         const p = requireUser(principal);
         return {
-            settings: await this.settings.update(org.orgId, body, p.account.id, patTokenId(p)),
+            // an API token may narrow the sandbox, never widen it (sandbox dev tiers spec §2)
+            settings: await this.settings.update(org.orgId, body, p.account.id, patTokenId(p), undefined, { onlyNarrows: patTokenId(p) !== undefined }),
             deployment: this.settings.deployment(),
             sandboxLimits: await this.settings.sandboxLimits(org.orgId),
         };

package/dist/orgs/settings.service.d.ts

@@ -1,9 +1,11 @@
-import { type SandboxLimits } from "@capybara-hq/plugin-sdk";
+import { type SandboxLimits, type SandboxTier } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { type EffectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { OrgLock } from "./org-lock.js";
 /**
  * 组织设置（`capybara.orgs.settings` jsonb）。读取宽松：缺失或非法的字段按默认值，未知键保留不动
@@ -14,7 +16,10 @@ import { OrgLock } from "./org-lock.js";
  *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
  * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
- *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ *   See `baseSandboxEgress` (sandbox/tiers.ts). 存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ * - `sandboxTier`: the org's sandbox tier ceiling, default and unsandboxed switch (sandbox dev tiers
+ *   spec §4.1), each absent = follow the platform (`sandbox.tiers`); never above the platform. An
+ *   invalid stored value reads as `{ max: "strict" }` (narrower, never wider).
  * - `platformTool`: the `Platform` builtin for the whole org (Platform tool spec §3): `on`,
  *   `read-only` (writes listed as unavailable) or `off` (default `on`).
  * - `timeZone`: the org's default time zone (IANA; absent = UTC) for senders without one of their
@@ -38,6 +43,25 @@ export declare const SandboxEgressSettingSchema: z.ZodObject<{
     allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export type SandboxEgressSetting = z.infer<typeof SandboxEgressSettingSchema>;
+/**
+ * The org's sandbox tier setting (sandbox dev tiers spec §4.1): `max` the highest tier its devices
+ * may reach, `default` the tier of a device that chose none, `allowUnsandboxed` false forbids
+ * unsandboxed local devices. Each absent = follow the platform's `sandbox.tiers`.
+ */
+export declare const SandboxTierSettingSchema: z.ZodObject<{
+    max: z.ZodOptional<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>;
+    default: z.ZodOptional<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>;
+    allowUnsandboxed: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type SandboxTierSetting = z.infer<typeof SandboxTierSettingSchema>;
 /**
  * The org's theme setting (themes spec §7): `id` a theme on in the org (a `platform_themes` id),
  * null = follow the platform's default; `personal: "locked"` hides the personal picker in the org
@@ -53,6 +77,45 @@ export declare const OrgThemeSettingSchema: z.ZodObject<{
 export type OrgThemeSetting = z.infer<typeof OrgThemeSettingSchema>;
 /** The theme setting of an org that has none: follow the platform, personal picks allowed. */
 export declare const DEFAULT_ORG_THEME: OrgThemeSetting;
+/**
+ * Org settings of scheduled tasks (spec §9); every field reads leniently (invalid = default,
+ * except `forbiddenTools`, which keeps its valid entries).
+ */
+export declare const ScheduledTasksSettingsSchema: z.ZodObject<{
+    enabled: z.ZodCatch<z.ZodDefault<z.ZodBoolean>>;
+    minIntervalMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    maxTasksPerMember: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    maxTasksPerOrg: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    maxRunsPerHour: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    defaultExpiryDays: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
+    catchUpWindowMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    unattendedAsk: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
+        fail: "fail";
+        wait: "wait";
+    }>>>;
+    pauseAfterFailures: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    forbiddenTools: z.ZodCatch<z.ZodPreprocess<z.ZodDefault<z.ZodArray<z.ZodString>>, unknown>>;
+}, z.core.$strip>;
+export type ScheduledTasksSettings = z.infer<typeof ScheduledTasksSettingsSchema>;
+/**
+ * The PATCH form: a partial merge into the group (fields left out keep their stored value; see
+ * `OrgSettingsService.update`). A field given replaces that field whole, `forbiddenTools` too.
+ */
+export declare const ScheduledTasksPatchSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    minIntervalMinutes: z.ZodOptional<z.ZodNumber>;
+    maxTasksPerMember: z.ZodOptional<z.ZodNumber>;
+    maxTasksPerOrg: z.ZodOptional<z.ZodNumber>;
+    maxRunsPerHour: z.ZodOptional<z.ZodNumber>;
+    defaultExpiryDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    catchUpWindowMinutes: z.ZodOptional<z.ZodNumber>;
+    unattendedAsk: z.ZodOptional<z.ZodEnum<{
+        fail: "fail";
+        wait: "wait";
+    }>>;
+    pauseAfterFailures: z.ZodOptional<z.ZodNumber>;
+    forbiddenTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
 export declare const OrgSettingsSchema: z.ZodObject<{
     toolSearch: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
         off: "off";
@@ -78,6 +141,19 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         }>;
         allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    sandboxTier: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        max: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        default: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        allowUnsandboxed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>;
     wakeOnBackgroundTask: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
     timeZone: z.ZodCatch<z.ZodOptional<z.ZodString>>;
     theme: z.ZodCatch<z.ZodOptional<z.ZodObject<{
@@ -88,6 +164,21 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         }>;
     }, z.core.$strict>>>;
     uiArrangement: z.ZodCatch<z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown>>>>;
+    scheduledTasks: z.ZodCatch<z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodCatch<z.ZodDefault<z.ZodBoolean>>;
+        minIntervalMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        maxTasksPerMember: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        maxTasksPerOrg: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        maxRunsPerHour: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        defaultExpiryDays: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
+        catchUpWindowMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        unattendedAsk: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
+            fail: "fail";
+            wait: "wait";
+        }>>>;
+        pauseAfterFailures: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        forbiddenTools: z.ZodCatch<z.ZodPreprocess<z.ZodDefault<z.ZodArray<z.ZodString>>, unknown>>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type OrgSettings = z.infer<typeof OrgSettingsSchema>;
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
@@ -117,6 +208,19 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
         }>;
         allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    sandboxTier: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        max: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        default: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        allowUnsandboxed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>;
     timeZone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     theme: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
@@ -126,15 +230,23 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
         }>;
     }, z.core.$strict>>>;
     uiArrangement: z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown>>>;
+    scheduledTasks: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        minIntervalMinutes: z.ZodOptional<z.ZodNumber>;
+        maxTasksPerMember: z.ZodOptional<z.ZodNumber>;
+        maxTasksPerOrg: z.ZodOptional<z.ZodNumber>;
+        maxRunsPerHour: z.ZodOptional<z.ZodNumber>;
+        defaultExpiryDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        catchUpWindowMinutes: z.ZodOptional<z.ZodNumber>;
+        unattendedAsk: z.ZodOptional<z.ZodEnum<{
+            fail: "fail";
+            wait: "wait";
+        }>>;
+        pauseAfterFailures: z.ZodOptional<z.ZodNumber>;
+        forbiddenTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type OrgSettingsPatch = z.infer<typeof OrgSettingsPatchSchema>;
-/** 部署的沙箱出站（`sandbox.limits.egress` + `allowHosts`）。 */
-export type DeploymentEgress = Pick<SandboxLimits, "egress" | "allowHosts">;
-/**
- * 组织实际生效的沙箱出站：没有组织设置 → 部署默认；`none` → 只有回环；`allowlist` → 组织的白名单
- * （省略时用部署的），但部署是 `none` 时仍为 `none`（组织永远不比部署放得更开，部署改成 none 后存量设置也随之收紧）。
- */
-export declare function effectiveSandboxEgress(deployment: DeploymentEgress, org: SandboxEgressSetting | undefined): DeploymentEgress;
 /** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
 export declare function effectiveWakeOnBackgroundTask(deployment: boolean, org: OrgSettings["wakeOnBackgroundTask"]): boolean;
 /**
@@ -154,14 +266,23 @@ export interface OrgSandboxLimits {
 /** 设置页展示用的部署默认值（`GET` 一并返回）。 */
 export interface OrgSettingsDeployment {
     sandboxEgress: {
-        mode: SandboxLimits["egress"];
+        mode: "none" | "allowlist";
         allowHosts: string[];
     };
+    /** The platform's tiers (`sandbox.tiers`) and the dev hosts the dev tier adds. */
+    sandboxTiers: {
+        max: SandboxTier;
+        default: SandboxTier;
+        allowUnsandboxed: boolean;
+        devHosts: string[];
+    };
 }
 /** 把存储的 jsonb 解析为设置（宽松，见 {@link OrgSettingsSchema}）。 */
 export declare function parseOrgSettings(raw: unknown): OrgSettings;
 /** 读组织设置（每次实时读 PG，多副本下改动立即生效）；组织不存在或已删除按默认值。 */
 export declare function readOrgSettings(db: KernelSchemaDb, orgId: string): Promise<OrgSettings>;
+/** Whether a stored settings object holds a `sandboxTier` this version reads as `{ max: "strict" }`. */
+export declare function invalidStoredSandboxTier(raw: unknown): boolean;
 /** 组织设置服务：读取与修改（修改需 `org.update`，锁内实时复核角色，写审计）。 */
 export declare class OrgSettingsService {
     private readonly db;
@@ -169,9 +290,12 @@ export declare class OrgSettingsService {
     private readonly orgLock;
     /** The deployment config (`sandboxEgress` may not exceed the deployment's). */
     private readonly config;
+    private readonly log?;
     constructor(db: KernelDb, txHost: TransactionHost, orgLock: OrgLock, 
     /** The deployment config (`sandboxEgress` may not exceed the deployment's). */
-    config: Pick<KernelConfigService, "get">);
+    config: Pick<KernelConfigService, "get">, log?: KernelLogger | undefined);
+    /** Parses stored settings, warning when an invalid `sandboxTier` narrows to `{ max: "strict" }`. */
+    private parseStored;
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
     deployment(): OrgSettingsDeployment;
     /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
@@ -181,6 +305,34 @@ export declare class OrgSettingsService {
     check(patch: OrgSettingsPatch): void;
     update(orgId: string, patch: OrgSettingsPatch, actorAccountId: string, actorTokenId?: string, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail?: Record<string, unknown>): Promise<OrgSettings>;
+    auditDetail?: Record<string, unknown>, 
+    /**
+     * `onlyNarrows` (the Platform tool, API tokens): refuse a `sandboxTier` or `sandboxEgress`
+     * change that widens (see {@link assertOnlyNarrows}); only a person in a session widens.
+     */
+    opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<OrgSettings>;
+    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
+    sandboxPolicy(settings: OrgSettings, deviceTier: SandboxTier | null): EffectiveSandboxPolicy;
+    /**
+     * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
+     * widens it, never the Platform tool or an API token):
+     * - `sandboxTier`: the effective ceiling, default or unsandboxed switch rises, or a stored cap
+     *   loosens (an absent `max` / `default` follows the platform, so it ranks above every tier and
+     *   clearing a cap that equals today's platform value is a widening; an explicit
+     *   `allowUnsandboxed: false` stays false). A cleared `default` under a new `max` no higher than
+     *   the old default is no loosening: the default never exceeds the ceiling. The value is
+     *   replaced whole, so the refusal names the fields the patch would clear;
+     * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
+     *   deployment's when the org gives none) not all in the current list.
+     */
+    assertOnlyNarrows(before: OrgSettings, patch: OrgSettingsPatch): void;
     private updateIn;
 }
+/**
+ * The one {@link OrgSettingsService}: the orgs module re-exports it, and the catalog imports it
+ * directly (approving a network request writes `sandboxEgress`) without a cycle through OrgsModule.
+ */
+export declare class OrgSettingsModule {
+}