@capybara-hq/kernel 0.1.0-rc.21 → 0.1.0-rc.22

package/dist/orgs/settings.service.d.ts

@@ -1,9 +1,11 @@
-import { type SandboxLimits } from "@capybara-hq/plugin-sdk";
+import { type SandboxLimits, type SandboxTier } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { type EffectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { OrgLock } from "./org-lock.js";
 /**
  * 组织设置（`capybara.orgs.settings` jsonb）。读取宽松：缺失或非法的字段按默认值，未知键保留不动
@@ -14,7 +16,10 @@ import { OrgLock } from "./org-lock.js";
  *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
  * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
- *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ *   See `baseSandboxEgress` (sandbox/tiers.ts). 存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ * - `sandboxTier`: the org's sandbox tier ceiling, default and unsandboxed switch (sandbox dev tiers
+ *   spec §4.1), each absent = follow the platform (`sandbox.tiers`); never above the platform. An
+ *   invalid stored value reads as `{ max: "strict" }` (narrower, never wider).
  * - `platformTool`: the `Platform` builtin for the whole org (Platform tool spec §3): `on`,
  *   `read-only` (writes listed as unavailable) or `off` (default `on`).
  * - `timeZone`: the org's default time zone (IANA; absent = UTC) for senders without one of their
@@ -38,6 +43,25 @@ export declare const SandboxEgressSettingSchema: z.ZodObject<{
     allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export type SandboxEgressSetting = z.infer<typeof SandboxEgressSettingSchema>;
+/**
+ * The org's sandbox tier setting (sandbox dev tiers spec §4.1): `max` the highest tier its devices
+ * may reach, `default` the tier of a device that chose none, `allowUnsandboxed` false forbids
+ * unsandboxed local devices. Each absent = follow the platform's `sandbox.tiers`.
+ */
+export declare const SandboxTierSettingSchema: z.ZodObject<{
+    max: z.ZodOptional<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>;
+    default: z.ZodOptional<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>;
+    allowUnsandboxed: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type SandboxTierSetting = z.infer<typeof SandboxTierSettingSchema>;
 /**
  * The org's theme setting (themes spec §7): `id` a theme on in the org (a `platform_themes` id),
  * null = follow the platform's default; `personal: "locked"` hides the personal picker in the org
@@ -53,6 +77,45 @@ export declare const OrgThemeSettingSchema: z.ZodObject<{
 export type OrgThemeSetting = z.infer<typeof OrgThemeSettingSchema>;
 /** The theme setting of an org that has none: follow the platform, personal picks allowed. */
 export declare const DEFAULT_ORG_THEME: OrgThemeSetting;
+/**
+ * Org settings of scheduled tasks (spec §9); every field reads leniently (invalid = default,
+ * except `forbiddenTools`, which keeps its valid entries).
+ */
+export declare const ScheduledTasksSettingsSchema: z.ZodObject<{
+    enabled: z.ZodCatch<z.ZodDefault<z.ZodBoolean>>;
+    minIntervalMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    maxTasksPerMember: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    maxTasksPerOrg: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    maxRunsPerHour: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    defaultExpiryDays: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
+    catchUpWindowMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    unattendedAsk: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
+        fail: "fail";
+        wait: "wait";
+    }>>>;
+    pauseAfterFailures: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    forbiddenTools: z.ZodCatch<z.ZodPreprocess<z.ZodDefault<z.ZodArray<z.ZodString>>, unknown>>;
+}, z.core.$strip>;
+export type ScheduledTasksSettings = z.infer<typeof ScheduledTasksSettingsSchema>;
+/**
+ * The PATCH form: a partial merge into the group (fields left out keep their stored value; see
+ * `OrgSettingsService.update`). A field given replaces that field whole, `forbiddenTools` too.
+ */
+export declare const ScheduledTasksPatchSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    minIntervalMinutes: z.ZodOptional<z.ZodNumber>;
+    maxTasksPerMember: z.ZodOptional<z.ZodNumber>;
+    maxTasksPerOrg: z.ZodOptional<z.ZodNumber>;
+    maxRunsPerHour: z.ZodOptional<z.ZodNumber>;
+    defaultExpiryDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    catchUpWindowMinutes: z.ZodOptional<z.ZodNumber>;
+    unattendedAsk: z.ZodOptional<z.ZodEnum<{
+        fail: "fail";
+        wait: "wait";
+    }>>;
+    pauseAfterFailures: z.ZodOptional<z.ZodNumber>;
+    forbiddenTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
 export declare const OrgSettingsSchema: z.ZodObject<{
     toolSearch: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
         off: "off";
@@ -78,6 +141,19 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         }>;
         allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    sandboxTier: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        max: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        default: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        allowUnsandboxed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>;
     wakeOnBackgroundTask: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
     timeZone: z.ZodCatch<z.ZodOptional<z.ZodString>>;
     theme: z.ZodCatch<z.ZodOptional<z.ZodObject<{
@@ -88,6 +164,21 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         }>;
     }, z.core.$strict>>>;
     uiArrangement: z.ZodCatch<z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown>>>>;
+    scheduledTasks: z.ZodCatch<z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodCatch<z.ZodDefault<z.ZodBoolean>>;
+        minIntervalMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        maxTasksPerMember: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        maxTasksPerOrg: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        maxRunsPerHour: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        defaultExpiryDays: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
+        catchUpWindowMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        unattendedAsk: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
+            fail: "fail";
+            wait: "wait";
+        }>>>;
+        pauseAfterFailures: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        forbiddenTools: z.ZodCatch<z.ZodPreprocess<z.ZodDefault<z.ZodArray<z.ZodString>>, unknown>>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type OrgSettings = z.infer<typeof OrgSettingsSchema>;
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
@@ -117,6 +208,19 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
         }>;
         allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    sandboxTier: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        max: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        default: z.ZodOptional<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>;
+        allowUnsandboxed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>;
     timeZone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     theme: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
@@ -126,15 +230,23 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
         }>;
     }, z.core.$strict>>>;
     uiArrangement: z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown>>>;
+    scheduledTasks: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        minIntervalMinutes: z.ZodOptional<z.ZodNumber>;
+        maxTasksPerMember: z.ZodOptional<z.ZodNumber>;
+        maxTasksPerOrg: z.ZodOptional<z.ZodNumber>;
+        maxRunsPerHour: z.ZodOptional<z.ZodNumber>;
+        defaultExpiryDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        catchUpWindowMinutes: z.ZodOptional<z.ZodNumber>;
+        unattendedAsk: z.ZodOptional<z.ZodEnum<{
+            fail: "fail";
+            wait: "wait";
+        }>>;
+        pauseAfterFailures: z.ZodOptional<z.ZodNumber>;
+        forbiddenTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type OrgSettingsPatch = z.infer<typeof OrgSettingsPatchSchema>;
-/** 部署的沙箱出站（`sandbox.limits.egress` + `allowHosts`）。 */
-export type DeploymentEgress = Pick<SandboxLimits, "egress" | "allowHosts">;
-/**
- * 组织实际生效的沙箱出站：没有组织设置 → 部署默认；`none` → 只有回环；`allowlist` → 组织的白名单
- * （省略时用部署的），但部署是 `none` 时仍为 `none`（组织永远不比部署放得更开，部署改成 none 后存量设置也随之收紧）。
- */
-export declare function effectiveSandboxEgress(deployment: DeploymentEgress, org: SandboxEgressSetting | undefined): DeploymentEgress;
 /** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
 export declare function effectiveWakeOnBackgroundTask(deployment: boolean, org: OrgSettings["wakeOnBackgroundTask"]): boolean;
 /**
@@ -154,14 +266,23 @@ export interface OrgSandboxLimits {
 /** 设置页展示用的部署默认值（`GET` 一并返回）。 */
 export interface OrgSettingsDeployment {
     sandboxEgress: {
-        mode: SandboxLimits["egress"];
+        mode: "none" | "allowlist";
         allowHosts: string[];
     };
+    /** The platform's tiers (`sandbox.tiers`) and the dev hosts the dev tier adds. */
+    sandboxTiers: {
+        max: SandboxTier;
+        default: SandboxTier;
+        allowUnsandboxed: boolean;
+        devHosts: string[];
+    };
 }
 /** 把存储的 jsonb 解析为设置（宽松，见 {@link OrgSettingsSchema}）。 */
 export declare function parseOrgSettings(raw: unknown): OrgSettings;
 /** 读组织设置（每次实时读 PG，多副本下改动立即生效）；组织不存在或已删除按默认值。 */
 export declare function readOrgSettings(db: KernelSchemaDb, orgId: string): Promise<OrgSettings>;
+/** Whether a stored settings object holds a `sandboxTier` this version reads as `{ max: "strict" }`. */
+export declare function invalidStoredSandboxTier(raw: unknown): boolean;
 /** 组织设置服务：读取与修改（修改需 `org.update`，锁内实时复核角色，写审计）。 */
 export declare class OrgSettingsService {
     private readonly db;
@@ -169,9 +290,12 @@ export declare class OrgSettingsService {
     private readonly orgLock;
     /** The deployment config (`sandboxEgress` may not exceed the deployment's). */
     private readonly config;
+    private readonly log?;
     constructor(db: KernelDb, txHost: TransactionHost, orgLock: OrgLock, 
     /** The deployment config (`sandboxEgress` may not exceed the deployment's). */
-    config: Pick<KernelConfigService, "get">);
+    config: Pick<KernelConfigService, "get">, log?: KernelLogger | undefined);
+    /** Parses stored settings, warning when an invalid `sandboxTier` narrows to `{ max: "strict" }`. */
+    private parseStored;
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
     deployment(): OrgSettingsDeployment;
     /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
@@ -181,6 +305,34 @@ export declare class OrgSettingsService {
     check(patch: OrgSettingsPatch): void;
     update(orgId: string, patch: OrgSettingsPatch, actorAccountId: string, actorTokenId?: string, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail?: Record<string, unknown>): Promise<OrgSettings>;
+    auditDetail?: Record<string, unknown>, 
+    /**
+     * `onlyNarrows` (the Platform tool, API tokens): refuse a `sandboxTier` or `sandboxEgress`
+     * change that widens (see {@link assertOnlyNarrows}); only a person in a session widens.
+     */
+    opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<OrgSettings>;
+    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
+    sandboxPolicy(settings: OrgSettings, deviceTier: SandboxTier | null): EffectiveSandboxPolicy;
+    /**
+     * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
+     * widens it, never the Platform tool or an API token):
+     * - `sandboxTier`: the effective ceiling, default or unsandboxed switch rises, or a stored cap
+     *   loosens (an absent `max` / `default` follows the platform, so it ranks above every tier and
+     *   clearing a cap that equals today's platform value is a widening; an explicit
+     *   `allowUnsandboxed: false` stays false). A cleared `default` under a new `max` no higher than
+     *   the old default is no loosening: the default never exceeds the ceiling. The value is
+     *   replaced whole, so the refusal names the fields the patch would clear;
+     * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
+     *   deployment's when the org gives none) not all in the current list.
+     */
+    assertOnlyNarrows(before: OrgSettings, patch: OrgSettingsPatch): void;
     private updateIn;
 }
+/**
+ * The one {@link OrgSettingsService}: the orgs module re-exports it, and the catalog imports it
+ * directly (approving a network request writes `sandboxEgress`) without a cycle through OrgsModule.
+ */
+export declare class OrgSettingsModule {
+}

package/dist/orgs/settings.service.js

@@ -7,8 +7,8 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { validateAllowHost } from "@capybara-hq/plugin-sdk";
-import { Inject, Injectable } from "@nestjs/common";
+import { SANDBOX_TIERS, tierAtMost, validateAllowHost, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Module, Optional } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
@@ -17,10 +17,12 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { effectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { assertThemeOnIn } from "../themes/theme-state.js";
 import { IanaTimeZone } from "../time-zone.js";
 import { mergeArrangement, OrgUiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
-import { OrgLock } from "./org-lock.js";
+import { OrgLock, OrgLockModule } from "./org-lock.js";
 /**
  * 组织设置（`capybara.orgs.settings` jsonb）。读取宽松：缺失或非法的字段按默认值，未知键保留不动
  * （更新时与存量合并），新版本加字段不需要迁移。
@@ -30,7 +32,10 @@ import { OrgLock } from "./org-lock.js";
  *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
  * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
- *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ *   See `baseSandboxEgress` (sandbox/tiers.ts). 存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
+ * - `sandboxTier`: the org's sandbox tier ceiling, default and unsandboxed switch (sandbox dev tiers
+ *   spec §4.1), each absent = follow the platform (`sandbox.tiers`); never above the platform. An
+ *   invalid stored value reads as `{ max: "strict" }` (narrower, never wider).
  * - `platformTool`: the `Platform` builtin for the whole org (Platform tool spec §3): `on`,
  *   `read-only` (writes listed as unavailable) or `off` (default `on`).
  * - `timeZone`: the org's default time zone (IANA; absent = UTC) for senders without one of their
@@ -65,6 +70,19 @@ export const SandboxEgressSettingSchema = z
         .optional(),
 })
     .strict();
+const TierSchema = z.enum(["strict", "dev", "open"]);
+/**
+ * The org's sandbox tier setting (sandbox dev tiers spec §4.1): `max` the highest tier its devices
+ * may reach, `default` the tier of a device that chose none, `allowUnsandboxed` false forbids
+ * unsandboxed local devices. Each absent = follow the platform's `sandbox.tiers`.
+ */
+export const SandboxTierSettingSchema = z
+    .object({
+    max: TierSchema.optional(),
+    default: TierSchema.optional(),
+    allowUnsandboxed: z.boolean().optional(),
+})
+    .strict();
 /**
  * The org's theme setting (themes spec §7): `id` a theme on in the org (a `platform_themes` id),
  * null = follow the platform's default; `personal: "locked"` hides the personal picker in the org
@@ -78,12 +96,56 @@ export const OrgThemeSettingSchema = z
     .strict();
 /** The theme setting of an org that has none: follow the platform, personal picks allowed. */
 export const DEFAULT_ORG_THEME = { id: null, personal: "allowed" };
+const posInt = (max, def) => z.number().int().min(1).max(max).default(def).catch(def);
+/** A stored `forbiddenTools` entry worth keeping: a tool key of the length the PATCH accepts. */
+const isForbiddenToolEntry = (v) => typeof v === "string" && v.length >= 1 && v.length <= 200;
+/**
+ * Org settings of scheduled tasks (spec §9); every field reads leniently (invalid = default,
+ * except `forbiddenTools`, which keeps its valid entries).
+ */
+export const ScheduledTasksSettingsSchema = z.object({
+    enabled: z.boolean().default(true).catch(true),
+    minIntervalMinutes: posInt(1_000_000, 60),
+    maxTasksPerMember: posInt(1_000_000, 20),
+    maxTasksPerOrg: posInt(1_000_000, 200),
+    maxRunsPerHour: posInt(1_000_000, 60),
+    defaultExpiryDays: z.number().int().min(1).max(36_500).nullable().default(null).catch(null),
+    catchUpWindowMinutes: posInt(1_000_000, 60),
+    unattendedAsk: z.enum(["fail", "wait"]).default("fail").catch("fail"),
+    pauseAfterFailures: posInt(1000, 5),
+    // fail-safe: an invalid entry is dropped, the valid ones stay forbidden (never reset to []);
+    // past the PATCH's 500 the list is truncated
+    forbiddenTools: z
+        .preprocess((v) => (Array.isArray(v) ? v.filter(isForbiddenToolEntry).slice(0, 500) : v), z.array(z.string()).max(500).default([]))
+        .catch([]),
+});
+/**
+ * The PATCH form: a partial merge into the group (fields left out keep their stored value; see
+ * `OrgSettingsService.update`). A field given replaces that field whole, `forbiddenTools` too.
+ */
+export const ScheduledTasksPatchSchema = z
+    .object({
+    enabled: z.boolean(),
+    minIntervalMinutes: z.number().int().min(1).max(1_000_000),
+    maxTasksPerMember: z.number().int().min(1).max(1_000_000),
+    maxTasksPerOrg: z.number().int().min(1).max(1_000_000),
+    maxRunsPerHour: z.number().int().min(1).max(1_000_000),
+    defaultExpiryDays: z.number().int().min(1).max(36_500).nullable(),
+    catchUpWindowMinutes: z.number().int().min(1).max(1_000_000),
+    unattendedAsk: z.enum(["fail", "wait"]),
+    pauseAfterFailures: z.number().int().min(1).max(1000),
+    forbiddenTools: z.array(z.string().min(1).max(200)).max(500),
+})
+    .partial()
+    .strict();
 export const OrgSettingsSchema = z.object({
     toolSearch: z.enum(["on", "off"]).default("on").catch("on"),
     locale: z.enum(["zh", "en"]).default("en").catch("en"),
     sandboxToolPolicy: z.enum(["allow", "ask"]).default("allow").catch("allow"),
     platformTool: z.enum(["on", "read-only", "off"]).default("on").catch("on"),
     sandboxEgress: SandboxEgressSettingSchema.optional().catch({ mode: "none" }),
+    /** The org's sandbox tiers (sandbox dev tiers spec §4.1); absent follows the platform. */
+    sandboxTier: SandboxTierSettingSchema.optional().catch({ max: "strict" }),
     /** Overrides `runtime.wakeOnBackgroundTask`; absent follows the deployment. */
     wakeOnBackgroundTask: z.boolean().optional().catch(undefined),
     /** The org's default time zone (run context spec §3.3); absent = UTC. */
@@ -92,6 +154,8 @@ export const OrgSettingsSchema = z.object({
     theme: OrgThemeSettingSchema.optional().catch(undefined),
     /** Hidden and ordered extension contributions per slot; absent = follow the platform. */
     uiArrangement: UiArrangementSchema.optional().catch(undefined),
+    /** Scheduled tasks (spec §9); the platform bounds clamp it, see `effectiveScheduleSettings`. */
+    scheduledTasks: ScheduledTasksSettingsSchema.prefault({}).catch(ScheduledTasksSettingsSchema.parse({})),
 });
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
 export const OrgSettingsPatchSchema = z
@@ -104,6 +168,11 @@ export const OrgSettingsPatchSchema = z
     wakeOnBackgroundTask: z.boolean().nullable().optional(),
     /** null 清除（恢复跟随部署默认）。 */
     sandboxEgress: SandboxEgressSettingSchema.nullable().optional(),
+    /**
+     * The org's sandbox tiers, replaced whole (fields left out follow the platform); never above
+     * the platform (`org.sandbox_tier_not_allowed`). null clears it.
+     */
+    sandboxTier: SandboxTierSettingSchema.nullable().optional(),
     /** The org's default time zone (IANA); null clears it (UTC). */
     timeZone: IanaTimeZone.nullable().optional(),
     /**
@@ -116,19 +185,10 @@ export const OrgSettingsPatchSchema = z
      * null removes a slot's entry (it follows the platform again). `platform.page` is refused.
      */
     uiArrangement: OrgUiArrangementPatchSchema.optional(),
+    /** Fields to change in the scheduled-tasks group; the rest keep their value. */
+    scheduledTasks: ScheduledTasksPatchSchema.optional(),
 })
     .strict();
-/**
- * 组织实际生效的沙箱出站：没有组织设置 → 部署默认；`none` → 只有回环；`allowlist` → 组织的白名单
- * （省略时用部署的），但部署是 `none` 时仍为 `none`（组织永远不比部署放得更开，部署改成 none 后存量设置也随之收紧）。
- */
-export function effectiveSandboxEgress(deployment, org) {
-    if (org === undefined)
-        return { egress: deployment.egress, allowHosts: [...deployment.allowHosts] };
-    if (org.mode === "none" || deployment.egress === "none")
-        return { egress: "none", allowHosts: [] };
-    return { egress: "allowlist", allowHosts: [...(org.allowHosts ?? deployment.allowHosts)] };
-}
 /** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
 export function effectiveWakeOnBackgroundTask(deployment, org) {
     return org ?? deployment;
@@ -162,25 +222,50 @@ export async function readOrgSettings(db, orgId) {
         .executeTakeFirst();
     return parseOrgSettings(row?.settings);
 }
+const sandboxTierNotAllowed = (message) => new ApiError("org.sandbox_tier_not_allowed", message);
+/** Whether a stored settings object holds a `sandboxTier` this version reads as `{ max: "strict" }`. */
+export function invalidStoredSandboxTier(raw) {
+    const v = asObject(raw).sandboxTier;
+    return v !== undefined && !SandboxTierSettingSchema.safeParse(v).success;
+}
+/** A setting's tier for intent comparison: absent (follow the platform) ranks above every tier. */
+const intentRank = (t) => t === undefined ? SANDBOX_TIERS.length : SANDBOX_TIERS.indexOf(t);
 /** 组织设置服务：读取与修改（修改需 `org.update`，锁内实时复核角色，写审计）。 */
 let OrgSettingsService = class OrgSettingsService {
     db;
     txHost;
     orgLock;
     config;
+    log;
     constructor(db, txHost, orgLock, 
     /** The deployment config (`sandboxEgress` may not exceed the deployment's). */
-    config) {
+    config, log) {
         this.db = db;
         this.txHost = txHost;
         this.orgLock = orgLock;
         this.config = config;
+        this.log = log;
+    }
+    /** Parses stored settings, warning when an invalid `sandboxTier` narrows to `{ max: "strict" }`. */
+    parseStored(orgId, raw) {
+        if (invalidStoredSandboxTier(raw)) {
+            this.log?.warn("org settings: stored sandboxTier is invalid; it reads as max strict", {
+                orgId,
+            });
+        }
+        return parseOrgSettings(raw);
     }
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
     deployment() {
-        const lim = this.config.get().sandbox.limits;
+        const { limits: lim, tiers } = this.config.get().sandbox;
         return {
             sandboxEgress: { mode: lim.egress, allowHosts: [...lim.allowHosts] },
+            sandboxTiers: {
+                max: tiers.max,
+                default: tiers.default,
+                allowUnsandboxed: tiers.allowUnsandboxed,
+                devHosts: [...lim.devHosts],
+            },
         };
     }
     /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
@@ -202,7 +287,7 @@ let OrgSettingsService = class OrgSettingsService {
             .executeTakeFirst();
         if (!row)
             throw new ApiError("org.not_found", "Organization not found");
-        return parseOrgSettings(row.settings);
+        return this.parseStored(orgId, row.settings);
     }
     /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
     check(patch) {
@@ -210,14 +295,83 @@ let OrgSettingsService = class OrgSettingsService {
             this.deployment().sandboxEgress.mode === "none") {
             throw new ApiError("org.sandbox_egress_not_allowed", "This deployment disables sandbox network access (sandbox.limits.egress is none); an organization can only set sandboxEgress to none");
         }
+        const t = patch.sandboxTier;
+        if (t != null) {
+            const platform = this.config.get().sandbox.tiers;
+            if (t.max !== undefined && !tierAtMost(t.max, platform.max)) {
+                throw sandboxTierNotAllowed(`The platform allows sandbox tiers up to ${platform.max}; sandboxTier.max cannot be ${t.max}`);
+            }
+            const max = t.max ?? platform.max;
+            if (t.default !== undefined && !tierAtMost(t.default, max)) {
+                throw sandboxTierNotAllowed(`sandboxTier.default (${t.default}) cannot be above the organization's highest tier (${max})`);
+            }
+            if (t.allowUnsandboxed === true && !platform.allowUnsandboxed) {
+                throw sandboxTierNotAllowed("The platform does not allow unsandboxed devices (sandbox.tiers.allowUnsandboxed is false); sandboxTier.allowUnsandboxed cannot be true");
+            }
+        }
     }
     async update(orgId, patch, actorAccountId, actorTokenId, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail) {
+    auditDetail, 
+    /**
+     * `onlyNarrows` (the Platform tool, API tokens): refuse a `sandboxTier` or `sandboxEgress`
+     * change that widens (see {@link assertOnlyNarrows}); only a person in a session widens.
+     */
+    opts) {
         this.check(patch);
-        return this.updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail);
+        return this.updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail, opts);
     }
-    async updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail) {
+    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
+    sandboxPolicy(settings, deviceTier) {
+        return effectiveSandboxPolicy(this.config.get().sandbox, settings, deviceTier);
+    }
+    /**
+     * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
+     * widens it, never the Platform tool or an API token):
+     * - `sandboxTier`: the effective ceiling, default or unsandboxed switch rises, or a stored cap
+     *   loosens (an absent `max` / `default` follows the platform, so it ranks above every tier and
+     *   clearing a cap that equals today's platform value is a widening; an explicit
+     *   `allowUnsandboxed: false` stays false). A cleared `default` under a new `max` no higher than
+     *   the old default is no loosening: the default never exceeds the ceiling. The value is
+     *   replaced whole, so the refusal names the fields the patch would clear;
+     * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
+     *   deployment's when the org gives none) not all in the current list.
+     */
+    assertOnlyNarrows(before, patch) {
+        if (patch.sandboxTier !== undefined) {
+            const next = patch.sandboxTier ?? undefined;
+            const prev = before.sandboxTier;
+            const b = this.sandboxPolicy(before, null);
+            const a = this.sandboxPolicy({ ...before, sandboxTier: next }, null);
+            // a cleared default follows the platform, capped by the ceiling: `max` bounds it then
+            const nextDefault = next?.default === undefined && next?.max !== undefined ? next.max : next?.default;
+            if (!tierAtMost(a.ceiling, b.ceiling) ||
+                !tierAtMost(a.defaultTier, b.defaultTier) ||
+                (a.allowUnsandboxed && !b.allowUnsandboxed) ||
+                intentRank(next?.max) > intentRank(prev?.max) ||
+                intentRank(nextDefault) > intentRank(prev?.default) ||
+                (prev?.allowUnsandboxed === false && next?.allowUnsandboxed !== false)) {
+                const cleared = ["max", "default", "allowUnsandboxed"].filter((f) => prev?.[f] !== undefined && next?.[f] === undefined);
+                throw sandboxTierNotAllowed("Raising the sandbox level needs a person in the organization settings." +
+                    (cleared.length === 0
+                        ? ""
+                        : ` sandboxTier is replaced whole: this change clears ${cleared.join(", ")}` +
+                            " (which would then follow the platform); give the values to keep again."));
+            }
+        }
+        if (patch.sandboxEgress !== undefined) {
+            const deploymentHosts = this.config.get().sandbox.limits.allowHosts;
+            const prev = before.sandboxEgress;
+            const next = patch.sandboxEgress ?? undefined;
+            const hostsOf = (e) => e?.allowHosts ?? deploymentHosts;
+            const widens = next?.mode !== "none" &&
+                (prev?.mode === "none" || !hostsOf(next).every((h) => hostsOf(prev).includes(h)));
+            if (widens) {
+                throw new ApiError("org.sandbox_egress_not_allowed", "Widening the sandbox network needs a person in the organization settings.");
+            }
+        }
+    }
+    async updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail, opts) {
         await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "org.update");
         const row = await this.db
             .selectFrom("orgs")
@@ -225,14 +379,26 @@ let OrgSettingsService = class OrgSettingsService {
             .where("id", "=", orgId)
             .executeTakeFirstOrThrow();
         const stored = asObject(row.settings);
-        const before = parseOrgSettings(stored);
+        const before = this.parseStored(orgId, stored);
+        // again under the org lock: a hot config reload may have lowered the platform since
+        this.check(patch);
+        // under the org lock, so the comparison is with the value the write replaces
+        if (opts?.onlyNarrows)
+            this.assertOnlyNarrows(before, patch);
         const changes = Object.fromEntries(Object.entries(patch)
             .filter(([, v]) => v !== undefined)
             // null clears sandboxEgress / wakeOnBackgroundTask: follow the deployment default again
             .map(([k, v]) => [k, v === null ? undefined : v]));
         const arrangementPatch = patch.uiArrangement;
         delete changes.uiArrangement;
+        delete changes.scheduledTasks;
         const after = { ...before, ...changes };
+        if (patch.scheduledTasks !== undefined) {
+            after.scheduledTasks = ScheduledTasksSettingsSchema.parse({
+                ...before.scheduledTasks,
+                ...Object.fromEntries(Object.entries(patch.scheduledTasks).filter(([, v]) => v !== undefined)),
+            });
+        }
         if (arrangementPatch !== undefined) {
             after.uiArrangement = mergeArrangement(before.uiArrangement, arrangementPatch);
             if (Object.keys(after.uiArrangement).length === 0)
@@ -240,6 +406,12 @@ let OrgSettingsService = class OrgSettingsService {
         }
         if (after.sandboxEgress === undefined)
             delete after.sandboxEgress;
+        // an empty sandboxTier is the same as none: follow the platform
+        if (after.sandboxTier !== undefined && Object.keys(after.sandboxTier).length === 0) {
+            delete after.sandboxTier;
+        }
+        if (after.sandboxTier === undefined)
+            delete after.sandboxTier;
         if (after.wakeOnBackgroundTask === undefined)
             delete after.wakeOnBackgroundTask;
         if (after.timeZone === undefined)
@@ -256,7 +428,7 @@ let OrgSettingsService = class OrgSettingsService {
             await assertThemeOnIn(this.db.db, orgId, patch.theme.id);
         }
         // 与存量合并：保留本版本不认识的键（清除的 sandboxEgress 不留在存量里）
-        const { sandboxEgress: _old, wakeOnBackgroundTask: _oldWake, timeZone: _oldZone, theme: _oldTheme, uiArrangement: _oldArrangement, ...rest } = stored;
+        const { sandboxEgress: _old, sandboxTier: _oldTier, wakeOnBackgroundTask: _oldWake, timeZone: _oldZone, theme: _oldTheme, uiArrangement: _oldArrangement, scheduledTasks: _oldScheduled, ...rest } = stored;
         await this.db
             .updateTable("orgs")
             .set({ settings: JSON.stringify({ ...rest, ...after }) })
@@ -281,6 +453,22 @@ OrgSettingsService = __decorate([
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(OrgLock)),
-    __param(3, Inject(KernelConfigService))
+    __param(3, Inject(KernelConfigService)),
+    __param(4, Optional()),
+    __param(4, Inject(KERNEL_LOGGER))
 ], OrgSettingsService);
 export { OrgSettingsService };
+/**
+ * The one {@link OrgSettingsService}: the orgs module re-exports it, and the catalog imports it
+ * directly (approving a network request writes `sandboxEgress`) without a cycle through OrgsModule.
+ */
+let OrgSettingsModule = class OrgSettingsModule {
+};
+OrgSettingsModule = __decorate([
+    Module({
+        imports: [OrgLockModule],
+        providers: [OrgSettingsService],
+        exports: [OrgSettingsService],
+    })
+], OrgSettingsModule);
+export { OrgSettingsModule };