@capybara-hq/kernel 0.1.0-rc.20 → 0.1.0-rc.22

package/dist/orgs/settings.service.js

@@ -7,8 +7,8 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { validateAllowHost } from "@capybara-hq/plugin-sdk";
-import { Inject, Injectable } from "@nestjs/common";
+import { SANDBOX_TIERS, tierAtMost, validateAllowHost, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Module, Optional } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
@@ -17,10 +17,12 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { effectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { assertThemeOnIn } from "../themes/theme-state.js";
 import { IanaTimeZone } from "../time-zone.js";
 import { mergeArrangement, OrgUiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
-import { OrgLock } from "./org-lock.js";
+import { OrgLock, OrgLockModule } from "./org-lock.js";
 /**
  * 组织设置（`capybara.orgs.settings` jsonb）。读取宽松：缺失或非法的字段按默认值，未知键保留不动
  * （更新时与存量合并），新版本加字段不需要迁移。
@@ -30,7 +32,10 @@ import { OrgLock } from "./org-lock.js";
  *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
  * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
- *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ *   See `baseSandboxEgress` (sandbox/tiers.ts). 存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ * - `sandboxTier`: the org's sandbox tier ceiling, default and unsandboxed switch (sandbox dev tiers
+ *   spec §4.1), each absent = follow the platform (`sandbox.tiers`); never above the platform. An
+ *   invalid stored value reads as `{ max: "strict" }` (narrower, never wider).
  * - `platformTool`: the `Platform` builtin for the whole org (Platform tool spec §3): `on`,
  *   `read-only` (writes listed as unavailable) or `off` (default `on`).
  * - `timeZone`: the org's default time zone (IANA; absent = UTC) for senders without one of their
@@ -65,6 +70,19 @@ export const SandboxEgressSettingSchema = z
         .optional(),
 })
     .strict();
+const TierSchema = z.enum(["strict", "dev", "open"]);
+/**
+ * The org's sandbox tier setting (sandbox dev tiers spec §4.1): `max` the highest tier its devices
+ * may reach, `default` the tier of a device that chose none, `allowUnsandboxed` false forbids
+ * unsandboxed local devices. Each absent = follow the platform's `sandbox.tiers`.
+ */
+export const SandboxTierSettingSchema = z
+    .object({
+    max: TierSchema.optional(),
+    default: TierSchema.optional(),
+    allowUnsandboxed: z.boolean().optional(),
+})
+    .strict();
 /**
  * The org's theme setting (themes spec §7): `id` a theme on in the org (a `platform_themes` id),
  * null = follow the platform's default; `personal: "locked"` hides the personal picker in the org
@@ -78,12 +96,56 @@ export const OrgThemeSettingSchema = z
     .strict();
 /** The theme setting of an org that has none: follow the platform, personal picks allowed. */
 export const DEFAULT_ORG_THEME = { id: null, personal: "allowed" };
+const posInt = (max, def) => z.number().int().min(1).max(max).default(def).catch(def);
+/** A stored `forbiddenTools` entry worth keeping: a tool key of the length the PATCH accepts. */
+const isForbiddenToolEntry = (v) => typeof v === "string" && v.length >= 1 && v.length <= 200;
+/**
+ * Org settings of scheduled tasks (spec §9); every field reads leniently (invalid = default,
+ * except `forbiddenTools`, which keeps its valid entries).
+ */
+export const ScheduledTasksSettingsSchema = z.object({
+    enabled: z.boolean().default(true).catch(true),
+    minIntervalMinutes: posInt(1_000_000, 60),
+    maxTasksPerMember: posInt(1_000_000, 20),
+    maxTasksPerOrg: posInt(1_000_000, 200),
+    maxRunsPerHour: posInt(1_000_000, 60),
+    defaultExpiryDays: z.number().int().min(1).max(36_500).nullable().default(null).catch(null),
+    catchUpWindowMinutes: posInt(1_000_000, 60),
+    unattendedAsk: z.enum(["fail", "wait"]).default("fail").catch("fail"),
+    pauseAfterFailures: posInt(1000, 5),
+    // fail-safe: an invalid entry is dropped, the valid ones stay forbidden (never reset to []);
+    // past the PATCH's 500 the list is truncated
+    forbiddenTools: z
+        .preprocess((v) => (Array.isArray(v) ? v.filter(isForbiddenToolEntry).slice(0, 500) : v), z.array(z.string()).max(500).default([]))
+        .catch([]),
+});
+/**
+ * The PATCH form: a partial merge into the group (fields left out keep their stored value; see
+ * `OrgSettingsService.update`). A field given replaces that field whole, `forbiddenTools` too.
+ */
+export const ScheduledTasksPatchSchema = z
+    .object({
+    enabled: z.boolean(),
+    minIntervalMinutes: z.number().int().min(1).max(1_000_000),
+    maxTasksPerMember: z.number().int().min(1).max(1_000_000),
+    maxTasksPerOrg: z.number().int().min(1).max(1_000_000),
+    maxRunsPerHour: z.number().int().min(1).max(1_000_000),
+    defaultExpiryDays: z.number().int().min(1).max(36_500).nullable(),
+    catchUpWindowMinutes: z.number().int().min(1).max(1_000_000),
+    unattendedAsk: z.enum(["fail", "wait"]),
+    pauseAfterFailures: z.number().int().min(1).max(1000),
+    forbiddenTools: z.array(z.string().min(1).max(200)).max(500),
+})
+    .partial()
+    .strict();
 export const OrgSettingsSchema = z.object({
     toolSearch: z.enum(["on", "off"]).default("on").catch("on"),
     locale: z.enum(["zh", "en"]).default("en").catch("en"),
     sandboxToolPolicy: z.enum(["allow", "ask"]).default("allow").catch("allow"),
     platformTool: z.enum(["on", "read-only", "off"]).default("on").catch("on"),
     sandboxEgress: SandboxEgressSettingSchema.optional().catch({ mode: "none" }),
+    /** The org's sandbox tiers (sandbox dev tiers spec §4.1); absent follows the platform. */
+    sandboxTier: SandboxTierSettingSchema.optional().catch({ max: "strict" }),
     /** Overrides `runtime.wakeOnBackgroundTask`; absent follows the deployment. */
     wakeOnBackgroundTask: z.boolean().optional().catch(undefined),
     /** The org's default time zone (run context spec §3.3); absent = UTC. */
@@ -92,6 +154,8 @@ export const OrgSettingsSchema = z.object({
     theme: OrgThemeSettingSchema.optional().catch(undefined),
     /** Hidden and ordered extension contributions per slot; absent = follow the platform. */
     uiArrangement: UiArrangementSchema.optional().catch(undefined),
+    /** Scheduled tasks (spec §9); the platform bounds clamp it, see `effectiveScheduleSettings`. */
+    scheduledTasks: ScheduledTasksSettingsSchema.prefault({}).catch(ScheduledTasksSettingsSchema.parse({})),
 });
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
 export const OrgSettingsPatchSchema = z
@@ -104,6 +168,11 @@ export const OrgSettingsPatchSchema = z
     wakeOnBackgroundTask: z.boolean().nullable().optional(),
     /** null 清除（恢复跟随部署默认）。 */
     sandboxEgress: SandboxEgressSettingSchema.nullable().optional(),
+    /**
+     * The org's sandbox tiers, replaced whole (fields left out follow the platform); never above
+     * the platform (`org.sandbox_tier_not_allowed`). null clears it.
+     */
+    sandboxTier: SandboxTierSettingSchema.nullable().optional(),
     /** The org's default time zone (IANA); null clears it (UTC). */
     timeZone: IanaTimeZone.nullable().optional(),
     /**
@@ -116,19 +185,10 @@ export const OrgSettingsPatchSchema = z
      * null removes a slot's entry (it follows the platform again). `platform.page` is refused.
      */
     uiArrangement: OrgUiArrangementPatchSchema.optional(),
+    /** Fields to change in the scheduled-tasks group; the rest keep their value. */
+    scheduledTasks: ScheduledTasksPatchSchema.optional(),
 })
     .strict();
-/**
- * 组织实际生效的沙箱出站：没有组织设置 → 部署默认；`none` → 只有回环；`allowlist` → 组织的白名单
- * （省略时用部署的），但部署是 `none` 时仍为 `none`（组织永远不比部署放得更开，部署改成 none 后存量设置也随之收紧）。
- */
-export function effectiveSandboxEgress(deployment, org) {
-    if (org === undefined)
-        return { egress: deployment.egress, allowHosts: [...deployment.allowHosts] };
-    if (org.mode === "none" || deployment.egress === "none")
-        return { egress: "none", allowHosts: [] };
-    return { egress: "allowlist", allowHosts: [...(org.allowHosts ?? deployment.allowHosts)] };
-}
 /** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
 export function effectiveWakeOnBackgroundTask(deployment, org) {
     return org ?? deployment;
@@ -162,25 +222,50 @@ export async function readOrgSettings(db, orgId) {
         .executeTakeFirst();
     return parseOrgSettings(row?.settings);
 }
+const sandboxTierNotAllowed = (message) => new ApiError("org.sandbox_tier_not_allowed", message);
+/** Whether a stored settings object holds a `sandboxTier` this version reads as `{ max: "strict" }`. */
+export function invalidStoredSandboxTier(raw) {
+    const v = asObject(raw).sandboxTier;
+    return v !== undefined && !SandboxTierSettingSchema.safeParse(v).success;
+}
+/** A setting's tier for intent comparison: absent (follow the platform) ranks above every tier. */
+const intentRank = (t) => t === undefined ? SANDBOX_TIERS.length : SANDBOX_TIERS.indexOf(t);
 /** 组织设置服务：读取与修改（修改需 `org.update`，锁内实时复核角色，写审计）。 */
 let OrgSettingsService = class OrgSettingsService {
     db;
     txHost;
     orgLock;
     config;
+    log;
     constructor(db, txHost, orgLock, 
     /** The deployment config (`sandboxEgress` may not exceed the deployment's). */
-    config) {
+    config, log) {
         this.db = db;
         this.txHost = txHost;
         this.orgLock = orgLock;
         this.config = config;
+        this.log = log;
+    }
+    /** Parses stored settings, warning when an invalid `sandboxTier` narrows to `{ max: "strict" }`. */
+    parseStored(orgId, raw) {
+        if (invalidStoredSandboxTier(raw)) {
+            this.log?.warn("org settings: stored sandboxTier is invalid; it reads as max strict", {
+                orgId,
+            });
+        }
+        return parseOrgSettings(raw);
     }
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
     deployment() {
-        const lim = this.config.get().sandbox.limits;
+        const { limits: lim, tiers } = this.config.get().sandbox;
         return {
             sandboxEgress: { mode: lim.egress, allowHosts: [...lim.allowHosts] },
+            sandboxTiers: {
+                max: tiers.max,
+                default: tiers.default,
+                allowUnsandboxed: tiers.allowUnsandboxed,
+                devHosts: [...lim.devHosts],
+            },
         };
     }
     /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
@@ -202,7 +287,7 @@ let OrgSettingsService = class OrgSettingsService {
             .executeTakeFirst();
         if (!row)
             throw new ApiError("org.not_found", "Organization not found");
-        return parseOrgSettings(row.settings);
+        return this.parseStored(orgId, row.settings);
     }
     /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
     check(patch) {
@@ -210,14 +295,83 @@ let OrgSettingsService = class OrgSettingsService {
             this.deployment().sandboxEgress.mode === "none") {
             throw new ApiError("org.sandbox_egress_not_allowed", "This deployment disables sandbox network access (sandbox.limits.egress is none); an organization can only set sandboxEgress to none");
         }
+        const t = patch.sandboxTier;
+        if (t != null) {
+            const platform = this.config.get().sandbox.tiers;
+            if (t.max !== undefined && !tierAtMost(t.max, platform.max)) {
+                throw sandboxTierNotAllowed(`The platform allows sandbox tiers up to ${platform.max}; sandboxTier.max cannot be ${t.max}`);
+            }
+            const max = t.max ?? platform.max;
+            if (t.default !== undefined && !tierAtMost(t.default, max)) {
+                throw sandboxTierNotAllowed(`sandboxTier.default (${t.default}) cannot be above the organization's highest tier (${max})`);
+            }
+            if (t.allowUnsandboxed === true && !platform.allowUnsandboxed) {
+                throw sandboxTierNotAllowed("The platform does not allow unsandboxed devices (sandbox.tiers.allowUnsandboxed is false); sandboxTier.allowUnsandboxed cannot be true");
+            }
+        }
     }
     async update(orgId, patch, actorAccountId, actorTokenId, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail) {
+    auditDetail, 
+    /**
+     * `onlyNarrows` (the Platform tool, API tokens): refuse a `sandboxTier` or `sandboxEgress`
+     * change that widens (see {@link assertOnlyNarrows}); only a person in a session widens.
+     */
+    opts) {
         this.check(patch);
-        return this.updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail);
+        return this.updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail, opts);
     }
-    async updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail) {
+    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
+    sandboxPolicy(settings, deviceTier) {
+        return effectiveSandboxPolicy(this.config.get().sandbox, settings, deviceTier);
+    }
+    /**
+     * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
+     * widens it, never the Platform tool or an API token):
+     * - `sandboxTier`: the effective ceiling, default or unsandboxed switch rises, or a stored cap
+     *   loosens (an absent `max` / `default` follows the platform, so it ranks above every tier and
+     *   clearing a cap that equals today's platform value is a widening; an explicit
+     *   `allowUnsandboxed: false` stays false). A cleared `default` under a new `max` no higher than
+     *   the old default is no loosening: the default never exceeds the ceiling. The value is
+     *   replaced whole, so the refusal names the fields the patch would clear;
+     * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
+     *   deployment's when the org gives none) not all in the current list.
+     */
+    assertOnlyNarrows(before, patch) {
+        if (patch.sandboxTier !== undefined) {
+            const next = patch.sandboxTier ?? undefined;
+            const prev = before.sandboxTier;
+            const b = this.sandboxPolicy(before, null);
+            const a = this.sandboxPolicy({ ...before, sandboxTier: next }, null);
+            // a cleared default follows the platform, capped by the ceiling: `max` bounds it then
+            const nextDefault = next?.default === undefined && next?.max !== undefined ? next.max : next?.default;
+            if (!tierAtMost(a.ceiling, b.ceiling) ||
+                !tierAtMost(a.defaultTier, b.defaultTier) ||
+                (a.allowUnsandboxed && !b.allowUnsandboxed) ||
+                intentRank(next?.max) > intentRank(prev?.max) ||
+                intentRank(nextDefault) > intentRank(prev?.default) ||
+                (prev?.allowUnsandboxed === false && next?.allowUnsandboxed !== false)) {
+                const cleared = ["max", "default", "allowUnsandboxed"].filter((f) => prev?.[f] !== undefined && next?.[f] === undefined);
+                throw sandboxTierNotAllowed("Raising the sandbox level needs a person in the organization settings." +
+                    (cleared.length === 0
+                        ? ""
+                        : ` sandboxTier is replaced whole: this change clears ${cleared.join(", ")}` +
+                            " (which would then follow the platform); give the values to keep again."));
+            }
+        }
+        if (patch.sandboxEgress !== undefined) {
+            const deploymentHosts = this.config.get().sandbox.limits.allowHosts;
+            const prev = before.sandboxEgress;
+            const next = patch.sandboxEgress ?? undefined;
+            const hostsOf = (e) => e?.allowHosts ?? deploymentHosts;
+            const widens = next?.mode !== "none" &&
+                (prev?.mode === "none" || !hostsOf(next).every((h) => hostsOf(prev).includes(h)));
+            if (widens) {
+                throw new ApiError("org.sandbox_egress_not_allowed", "Widening the sandbox network needs a person in the organization settings.");
+            }
+        }
+    }
+    async updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail, opts) {
         await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "org.update");
         const row = await this.db
             .selectFrom("orgs")
@@ -225,14 +379,26 @@ let OrgSettingsService = class OrgSettingsService {
             .where("id", "=", orgId)
             .executeTakeFirstOrThrow();
         const stored = asObject(row.settings);
-        const before = parseOrgSettings(stored);
+        const before = this.parseStored(orgId, stored);
+        // again under the org lock: a hot config reload may have lowered the platform since
+        this.check(patch);
+        // under the org lock, so the comparison is with the value the write replaces
+        if (opts?.onlyNarrows)
+            this.assertOnlyNarrows(before, patch);
         const changes = Object.fromEntries(Object.entries(patch)
             .filter(([, v]) => v !== undefined)
             // null clears sandboxEgress / wakeOnBackgroundTask: follow the deployment default again
             .map(([k, v]) => [k, v === null ? undefined : v]));
         const arrangementPatch = patch.uiArrangement;
         delete changes.uiArrangement;
+        delete changes.scheduledTasks;
         const after = { ...before, ...changes };
+        if (patch.scheduledTasks !== undefined) {
+            after.scheduledTasks = ScheduledTasksSettingsSchema.parse({
+                ...before.scheduledTasks,
+                ...Object.fromEntries(Object.entries(patch.scheduledTasks).filter(([, v]) => v !== undefined)),
+            });
+        }
         if (arrangementPatch !== undefined) {
             after.uiArrangement = mergeArrangement(before.uiArrangement, arrangementPatch);
             if (Object.keys(after.uiArrangement).length === 0)
@@ -240,6 +406,12 @@ let OrgSettingsService = class OrgSettingsService {
         }
         if (after.sandboxEgress === undefined)
             delete after.sandboxEgress;
+        // an empty sandboxTier is the same as none: follow the platform
+        if (after.sandboxTier !== undefined && Object.keys(after.sandboxTier).length === 0) {
+            delete after.sandboxTier;
+        }
+        if (after.sandboxTier === undefined)
+            delete after.sandboxTier;
         if (after.wakeOnBackgroundTask === undefined)
             delete after.wakeOnBackgroundTask;
         if (after.timeZone === undefined)
@@ -256,7 +428,7 @@ let OrgSettingsService = class OrgSettingsService {
             await assertThemeOnIn(this.db.db, orgId, patch.theme.id);
         }
         // 与存量合并：保留本版本不认识的键（清除的 sandboxEgress 不留在存量里）
-        const { sandboxEgress: _old, wakeOnBackgroundTask: _oldWake, timeZone: _oldZone, theme: _oldTheme, uiArrangement: _oldArrangement, ...rest } = stored;
+        const { sandboxEgress: _old, sandboxTier: _oldTier, wakeOnBackgroundTask: _oldWake, timeZone: _oldZone, theme: _oldTheme, uiArrangement: _oldArrangement, scheduledTasks: _oldScheduled, ...rest } = stored;
         await this.db
             .updateTable("orgs")
             .set({ settings: JSON.stringify({ ...rest, ...after }) })
@@ -281,6 +453,22 @@ OrgSettingsService = __decorate([
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(OrgLock)),
-    __param(3, Inject(KernelConfigService))
+    __param(3, Inject(KernelConfigService)),
+    __param(4, Optional()),
+    __param(4, Inject(KERNEL_LOGGER))
 ], OrgSettingsService);
 export { OrgSettingsService };
+/**
+ * The one {@link OrgSettingsService}: the orgs module re-exports it, and the catalog imports it
+ * directly (approving a network request writes `sandboxEgress`) without a cycle through OrgsModule.
+ */
+let OrgSettingsModule = class OrgSettingsModule {
+};
+OrgSettingsModule = __decorate([
+    Module({
+        imports: [OrgLockModule],
+        providers: [OrgSettingsService],
+        exports: [OrgSettingsService],
+    })
+], OrgSettingsModule);
+export { OrgSettingsModule };

package/dist/platform/exclusions.js

@@ -153,6 +153,11 @@ export const PLATFORM_EXCLUSIONS = [
         category: "secret",
         reason: "Body carries connector credentials and client secrets entered by a person",
     },
+    {
+        route: "POST /api/v1/orgs/:orgId/catalog-requests/network",
+        category: "human-only",
+        reason: "A member asks org admins to allow a domain from a blocked command's card; agents never file network requests",
+    },
     {
         route: "POST /api/v1/orgs/:orgId/catalog-requests/:id/decide",
         category: "human-only",
@@ -281,6 +286,11 @@ export const PLATFORM_EXCLUSIONS = [
         category: "human-only",
         reason: "Disconnects a person's own machine (revokes its credential); a trust decision taken on the device's page",
     },
+    {
+        route: "POST /api/v1/orgs/:orgId/devices/:id/policy",
+        category: "human-only",
+        reason: "A person changes their own machine's network policy; agents never widen a device's network",
+    },
     {
         route: "POST /api/v1/device/authorize",
         category: "transport",
@@ -560,7 +570,7 @@ export const PLATFORM_EXCLUSIONS = [
     {
         route: "POST /api/v1/orgs/:orgId/approvals/:id/decision",
         category: "human-only",
-        reason: "Decides a tool permission approval; only the person decides (spec §6.4); reading what waits is approvals.waiting / approvals.get",
+        reason: "Decides a tool permission approval or a network ask; only the person decides (spec §6.4); a person must decide network access on their own device; reading what waits is approvals.waiting / approvals.get",
     },
     {
         route: "GET /api/v1/orgs/:orgId/me/tool-grants",

package/dist/platform/operation.js

@@ -87,6 +87,10 @@ export const PLATFORM_DOMAINS = [
         id: "devices",
         description: "Your own cloud devices (the workspaces your conversations run in): list, read, create, rename, delete, wipe the files.",
     },
+    {
+        id: "schedules",
+        description: "Your scheduled tasks (an agent runs a prompt on a schedule, as you, unattended): list, read, create, edit, pause, resume, delete, run now or as a trial, run history, and the tools approved for a task.",
+    },
     {
         id: "setup",
         description: "Plugin setup guides: list the guides you may help with, read one as Markdown, the state of its checks for a channel connection or a connector, and running one check. Entering secrets, connecting an account and confirming the app was updated stay with the person on the web; read the docs topic `setup` first.",

package/dist/platform/ops/admin-items.ops.js

@@ -96,7 +96,7 @@ let AdminItemsOperations = class AdminItemsOperations {
             }),
             defineOperation({
                 id: "admin.agent-get",
-                description: "Read one agent of this org as the admin console shows it (super admin): its definition with the instructions in full, members, profile with quick action labels, versions count, the skills and connectors it uses by name. Never its conversations or credentials.",
+                description: "Read one agent of this org as the admin console shows it (super admin): its definition with the instructions in full, members, profile with quick action labels, versions count, the skills and connectors it has by name, and how many of the org's skills it turns off (skillsOff). Never its conversations or credentials.",
                 input: AgentIdInput,
                 example: { agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77" },
                 authz: { superAdmin: true },

package/dist/platform/ops/agent-skills.ops.js

@@ -38,7 +38,7 @@ const SHARE_FILES_SHOWN = 10;
 /** The model-facing result line of `agents.share-skill`. */
 function sharedText(o, name) {
     return o.kind === "shared"
-        ? `Shared skill "${name}" with the organization: it is now an org skill (the person maintains it) that any agent of the org can select; this agent keeps using it.`
+        ? `Shared skill "${name}" with the organization: it is now an org skill (the person maintains it) that every agent of the org has unless it turns it off; this agent keeps using it.`
         : `Asked the org admins to share skill "${name}" with the organization; it waits for their decision in the inbox. Until then it stays this agent's own skill.`;
 }
 /** The model-facing result line of `agents.register-skill`. */
@@ -367,7 +367,7 @@ let AgentSkillsOperations = class AgentSkillsOperations {
             }),
             defineOperation({
                 id: "agents.share-skill",
-                description: "Share one of an agent's own skills with the organization, so any agent of the org can select it; the agent keeps using it and the person becomes its maintainer (later versions they register on their agents are proposed to the org admins). An org admin shares at once; anyone else's ask waits for an org admin's decision in the inbox. Only the agent's owner can; takes the agent id from agents.list and the skill id from agents.skills.",
+                description: "Share one of an agent's own skills with the organization, so every agent of the org has it unless it turns it off; the agent keeps using it and the person becomes its maintainer (later versions they register on their agents are proposed to the org admins). An org admin shares at once; anyone else's ask waits for an org admin's decision in the inbox. Only the agent's owner can; takes the agent id from agents.list and the skill id from agents.skills.",
                 input: z.object({ agentId: AgentId, skillId: AgentSkillPathParams.shape.skillId }).strict(),
                 example: {
                     agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77",

package/dist/platform/ops/agent-templates.ops.js

@@ -50,7 +50,7 @@ let AgentTemplatesOperations = class AgentTemplatesOperations {
             }),
             defineOperation({
                 id: "agent-templates.get",
-                description: "Read one agent template with its definition (model tier, tools, skills, connectors it needs). Takes the template id from agent-templates.list.",
+                description: "Read one agent template with its definition (model tier, tools, the skills an agent made from it loads first, the skills it turns off (disallowedSkills), connectors it needs). Takes the template id from agent-templates.list.",
                 input: z.object({ templateId: AgentTemplateIdParams.shape.id }).strict(),
                 example: { templateId: "5d0c7a52-3a0e-4f0a-bd0a-0f8c3d2a9e10" },
                 authz: { orgAction: "agents.create" },
@@ -63,7 +63,7 @@ let AgentTemplatesOperations = class AgentTemplatesOperations {
             }),
             defineOperation({
                 id: "agent-templates.save",
-                description: "Save an agent of the org as an org agent template under a new name, so members can create their own copy from it. Credentials and per-person settings are not carried over; the result lists what was omitted.",
+                description: "Save an agent of the org as an org agent template under a new name, so members can create their own copy from it. The skills the agent turns off are saved as the template's disallowedSkills. Credentials and per-person settings are not carried over; the result lists what was omitted.",
                 input: SaveAsAgentIdParams.extend({
                     name: SaveAsTemplateBody.shape.name.min(1).max(80),
                     description: SaveAsTemplateBody.shape.description.max(1024),

package/dist/platform/ops/agents.ops.js

@@ -35,11 +35,6 @@ const Def = AgentCreateDefinition.shape;
 /** Every string the model sends is bounded (the route's tool refs and model strings are not). */
 const Short = z.string().min(1).max(200);
 const Model = Def.model.extend({ provider: Short, model: Short }).strict();
-const RouteSkills = Def.skills.unwrap();
-/** `writePolicy` stays the web's; `orgSkills` is required here (the route defaults it to []). */
-const Skills = RouteSkills.pick({ pinned: true })
-    .extend({ orgSkills: RouteSkills.shape.orgSkills.unwrap() })
-    .strict();
 /**
  * Whether `next` sets an `allow` that `current` does not have (decision 2026-11-09: `allow` on a
  * connector tool lets an agent call it without asking). Such a change is confirmed every time and
@@ -61,7 +56,8 @@ const Fields = {
      */
     disabledTools: Def.disabledTools.unwrap(),
     toolPolicies: z.record(Short, Def.toolPolicies.unwrap().valueType),
-    skills: Skills,
+    /** Skills turned off (skills default-on spec §4); `skills.writePolicy` stays the web's. */
+    disabledSkills: Def.disabledSkills.unwrap(),
     subagents: Def.subagents.unwrap(),
 };
 /**
@@ -189,7 +185,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.get",
-                description: "Read one agent you can see with its full definition (description, instructions, model, the tools it turns off (disabledTools: an agent has every tool the org offers except these), tool policies, skills and sub-agents) and its profile (avatar, description, quick actions). Takes the agent id from agents.list.",
+                description: "Read one agent you can see with its full definition (description, instructions, model, the tools it turns off (disabledTools: an agent has every tool the org offers except these), tool policies, the skills it turns off (disabledSkills: an agent has every skill on in the org except these), skills.writePolicy and sub-agents) and its profile (avatar, description, quick actions). Takes the agent id from agents.list.",
                 input: z.object({ agentId: AgentId }).strict(),
                 example: { agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77" },
                 authz: { orgAction: "agents.use" },
@@ -201,7 +197,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.create",
-                description: 'Create a new private agent owned by you, with a name, a model and optionally instructions, disabledTools, tool policies, skills and sub-agents. An agent has every tool the org offers (all built-in tools, the tools of the extensions on in the org and of the org\'s connectors) unless disabledTools turns it off: { kind: "builtin", name }, { kind: "plugin", plugin, tools: "all" | [names] } or { kind: "connector", connectorId, tools: "all" | [names] }. Agents created with the Platform tool are private; sharing an agent with the org or with members is done on the agents page of the web app.',
+                description: 'Create a new private agent owned by you, with a name, a model and optionally instructions, disabledTools, tool policies, disabledSkills and sub-agents. An agent has every tool the org offers (all built-in tools, the tools of the extensions on in the org and of the org\'s connectors) unless disabledTools turns it off: { kind: "builtin", name }, { kind: "plugin", plugin, tools: "all" | [names] } or { kind: "connector", connectorId, tools: "all" | [names] }. Likewise, an agent has every skill on in the org unless disabledSkills turns it off: { kind: "plugin", plugin, skills: "all" | [names] } for skills of a plugin (skills.list gives the plugin of each), or { kind: "skill", skillId } for a skill without a plugin; the skills of builtin plugins (builtin in skills.list) and the own skills of the agent cannot be turned off. Agents created with the Platform tool are private; sharing an agent with the org or with members is done on the agents page of the web app.',
                 input: z
                     .object({
                     definition: z
@@ -211,7 +207,7 @@ let AgentsOperations = class AgentsOperations {
                         model: Fields.model,
                         disabledTools: Fields.disabledTools.optional(),
                         toolPolicies: Fields.toolPolicies.optional(),
-                        skills: Fields.skills.optional(),
+                        disabledSkills: Fields.disabledSkills.optional(),
                         subagents: Fields.subagents.optional(),
                     })
                         .strict(),
@@ -248,7 +244,7 @@ let AgentsOperations = class AgentsOperations {
                         model: d.model,
                         ...(d.disabledTools !== undefined && { disabledTools: d.disabledTools }),
                         ...(d.toolPolicies !== undefined && { toolPolicies: d.toolPolicies }),
-                        ...(d.skills !== undefined && { skills: d.skills }),
+                        ...(d.disabledSkills !== undefined && { disabledSkills: d.disabledSkills }),
                         ...(d.subagents !== undefined && { subagents: d.subagents }),
                     });
                     return this.agents.create(ctx.orgId, ctx.actorAccountId, {
@@ -259,7 +255,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.update",
-                description: 'Change an agent you may edit: your own, private or shared, and as an org admin any agent of the org. Send the version you read from agents.get and only the fields to change; the others keep their value. The description (one short paragraph, "" removes it) is saved with the definition; the avatar and quick actions are changed with agents.update-profile. disabledTools replaces the whole list of turned-off tools (send [] to turn every tool on). A version that is no longer current is refused, so read the agent again first. The visibility cannot be changed here (that is done on the agents page of the web app). A change to your own private agent may be remembered by the person; a change to a shared agent, or one that sets a tool policy to allow, is confirmed every time.',
+                description: 'Change an agent you may edit: your own, private or shared, and as an org admin any agent of the org. Send the version you read from agents.get and only the fields to change; the others keep their value. The description (one short paragraph, "" removes it) is saved with the definition; the avatar and quick actions are changed with agents.update-profile. disabledTools replaces the whole list of turned-off tools (send [] to turn every tool on). disabledSkills replaces the whole list of turned-off skills (send [] to turn every skill on); an agent has every skill on in the org unless disabledSkills turns it off: { kind: "plugin", plugin, skills: "all" | [names] } for skills of a plugin (skills.list gives the plugin of each), or { kind: "skill", skillId } for a skill without a plugin; the skills of builtin plugins (builtin in skills.list) and the own skills of the agent cannot be turned off. A version that is no longer current is refused, so read the agent again first. The visibility cannot be changed here (that is done on the agents page of the web app). A change to your own private agent may be remembered by the person; a change to a shared agent, or one that sets a tool policy to allow, is confirmed every time.',
                 input: z
                     .object({
                     agentId: AgentId,
@@ -270,7 +266,7 @@ let AgentsOperations = class AgentsOperations {
                     model: Fields.model.optional(),
                     disabledTools: Fields.disabledTools.optional(),
                     toolPolicies: Fields.toolPolicies.optional(),
-                    skills: Fields.skills.optional(),
+                    disabledSkills: Fields.disabledSkills.optional(),
                     subagents: Fields.subagents.optional(),
                 })
                     .strict(),
@@ -292,7 +288,7 @@ let AgentsOperations = class AgentsOperations {
                     model: "definition.model",
                     disabledTools: "definition.disabledTools",
                     toolPolicies: "definition.toolPolicies",
-                    skills: "definition.skills",
+                    disabledSkills: "definition.disabledSkills",
                     subagents: "definition.subagents",
                 },
                 confirm: "personal",
@@ -332,7 +328,7 @@ let AgentsOperations = class AgentsOperations {
                         ...(patch.model !== undefined && { model: patch.model }),
                         ...(patch.disabledTools !== undefined && { disabledTools: patch.disabledTools }),
                         ...(patch.toolPolicies !== undefined && { toolPolicies: patch.toolPolicies }),
-                        ...(patch.skills !== undefined && { skills: patch.skills }),
+                        ...(patch.disabledSkills !== undefined && { disabledSkills: patch.disabledSkills }),
                         ...(patch.subagents !== undefined && { subagents: patch.subagents }),
                     };
                     return this.agents.update(ctx.orgId, agentId, ctx.actorAccountId, { definition, expectedVersion: version }, undefined, viaAgent("agents.update", ctx));
@@ -414,7 +410,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.preview-from-template",
-                description: "Preview creating an agent from an agent template: what carries over, what is pending (connectors the org has not set up) or unavailable, the model that would be used, and a previewHash. agents.create-from-template needs that hash.",
+                description: "Preview creating an agent from an agent template: what carries over, what is pending (connectors the org has not set up) or unavailable, the model that would be used, and a previewHash. Each skill the template names is carried when the org has it and unavailable otherwise; the new agent has every skill on in the org except those the template's disallowedSkills turns off. agents.create-from-template needs that hash.",
                 input: AgentFromTemplatePreviewBody,
                 example: { templateId: "5d0c7a52-3a0e-4f0a-bd0a-0f8c3d2a9e10" },
                 authz: { orgAction: "agents.create" },

package/dist/platform/ops/devices.ops.js

@@ -131,7 +131,7 @@ let DevicesOperations = class DevicesOperations {
             }),
             defineOperation({
                 id: "devices.get",
-                description: "Read one of your devices with its source (cloud or local), provider, state, instance, the machine of a local one and whether it is online, limits and creation time. Takes the id from devices.list.",
+                description: "Read one of your devices with its source (cloud or local), provider, state, instance, the machine of a local one and whether it is online, limits, sandbox level (the tier chosen and the one in effect, the highest allowed and why it is lower, whether it runs without a sandbox) and creation time. Takes the id from devices.list. Only the person changes a device's sandbox level, on the web.",
                 input: DeviceId,
                 example: { deviceId: "4e8a0c1d-6b2f-4a37-8d19-3c5e7f9a1b20" },
                 authz: { orgAction: "agents.use" },
@@ -276,6 +276,8 @@ let DevicesOperations = class DevicesOperations {
                 authz: { orgAction: "agents.use" },
                 mirrors: ["PATCH /api/v1/orgs/:orgId/devices/:id"],
                 renames: { deviceId: "id" },
+                // a person decides their device's sandbox level (sandbox dev tiers spec §7.2)
+                omits: ["tier"],
                 confirm: "personal",
                 errors: [
                     {

package/dist/platform/ops/inbox.ops.js

@@ -109,6 +109,25 @@ function orgRow(i) {
                 summary: `Your ${r.kind} request was ${r.status}${r.reason ? `: ${r.reason}` : ""}.`,
             };
         }
+        case "schedule_attention": {
+            const a = i.attention;
+            const summary = a.reason === "missing_grants"
+                ? `Scheduled task "${a.name}" ran without: ${a.missing.join(", ")}.${a.needsRole.length > 0 ? ` Needing a higher role than the owner has (cannot be pre-approved): ${a.needsRole.join(", ")}.` : ""}${a.needsAdmin.length > 0 ? ` Outside the organization's network allowlist (only an org admin can add them): ${a.needsAdmin.join(", ")}.` : ""}${a.deviceRefuses ? " The task's device does not accept network grants; its owner allows domains locally (capybara-device policy add allowedDomains <host>)." : ""}`
+                : a.reason === "failed"
+                    ? `Scheduled task "${a.name}"'s latest run failed${a.error ? `: ${a.error}` : ""}.`
+                    : `Scheduled task "${a.name}" is paused (${a.reason}${a.pausedBy ? ` by ${a.pausedBy.name || a.pausedBy.id}` : ""}).`;
+            return {
+                ...base,
+                name: a.name,
+                state: a.reason,
+                summary,
+                next: a.reason === "missing_grants"
+                    ? "Add the missing tools to the task's approved tools and connect the missing connectors on the web; tools that need a higher role cannot be pre-approved; network domains (network:<host>) are approved only by the person on the task page."
+                    : a.reason === "failed"
+                        ? "Check the run's error and the task's settings; the next good run clears this, and repeated failures pause the task."
+                        : "Resume the task once the cause is fixed.",
+            };
+        }
         default: {
             const n = i.notice;
             return {