@capybara-hq/kernel 0.1.0-rc.21 → 0.1.0-rc.22

package/dist/tools/pipeline.js

@@ -22,6 +22,8 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { DevicePolicyService } from "../local-devices/device-policy.service.js";
+import { NetworkGrants } from "../local-devices/network-grants.js";
 import { UNKNOWN_RESULT_TEXT } from "../runtime/context/pairing.js";
 import { fireObserve, hookDeniedAudit, hookDeniedEvent, hookScope, } from "../runtime/hook-calls.js";
 import { subagentWaitingIdemKey } from "../runtime/loop.js";
@@ -30,8 +32,9 @@ import { rootSurfaceOf } from "../runtime/subagents/child.js";
 import { SubagentMessages } from "../runtime/subagents/messages.js";
 import { pairStoppedForks } from "../runtime/subagents/skill-fork.js";
 import { SubagentsService } from "../runtime/subagents/subagents.service.js";
+import { appendMissingGrant, connectionGrantKey, UNATTENDED_CONNECTION_ERROR, UNATTENDED_ELICITATION_NOTE, UNATTENDED_QUESTION_ERROR, unattendedFails, unattendedRunOf, } from "../schedules/unattended.js";
 import { skillLoadOfferedIn } from "../skills/catalog.js";
-import { ApprovalsService } from "./approvals.service.js";
+import { ApprovalsService, } from "./approvals.service.js";
 import { Breaker, breakerOpenMessage } from "./breaker.js";
 import { SEND_MESSAGE, SUBAGENT_HANDBACK, TOOL_SEARCH } from "./builtin-names.js";
 import { AGENT_TOOL, AgentToolInput } from "./builtins/agent.js";
@@ -43,6 +46,7 @@ import { CredentialMissing, Credentials } from "./credentials.js";
 import { ToolDrift } from "./drift.js";
 import { ElicitationSession } from "./elicitation.js";
 import { legacyHint, legacyToolInput, legacyToolKey } from "./legacy-keys.js";
+import { blockedEventHosts, clipKept, NETWORK_ASK_KEPT_MAX_BYTES, networkBlockedIdemKey, planNetworkAsk, settledNetworkNotes, withNetworkNotes, } from "./network-asks.js";
 import { OrgToolSwitches, toolTurnedOffReason } from "./org-tool-switches.js";
 import { renderResult, resolveOutputRefs, spillIfLarge, ToolOutputs } from "./outputs.js";
 import { createDecidePolicy } from "./policy.js";
@@ -182,6 +186,26 @@ function withNotes(result, notes) {
         content: [...content, ...notes.map((text) => ({ type: "text", text }))],
     };
 }
+/** A network ask's kept display fields, written with its result when the ask settles. */
+const keptExtras = (kept) => ({
+    ...(kept?.outputId !== undefined && { outputId: kept.outputId }),
+    ...(kept?.contentTypes !== undefined && { contentTypes: kept.contentTypes }),
+    ...(kept?.display !== undefined && { display: kept.display }),
+    ...(kept?.view !== undefined && { view: kept.view }),
+});
+/** A builtin result's kernel-internal network report (see `BuiltinResult.networkReport`). */
+function networkReportOf(result) {
+    const r = result?.networkReport;
+    if (r === undefined || typeof r.deviceId !== "string" || !Array.isArray(r.blocked)) {
+        return undefined;
+    }
+    const blocked = r.blocked.filter((b) => typeof b === "object" &&
+        b !== null &&
+        typeof b.host === "string" &&
+        typeof b.port === "number" &&
+        ["device", "org", "address", "unknown"].includes(b.layer));
+    return blocked.length === 0 ? undefined : { deviceId: r.deviceId, blocked };
+}
 /** 审批的等待时长（小时，四舍五入，至少 1）。 */
 const approvalHours = (a) => Math.max(1, Math.round((new Date(a.expiresAt).getTime() - new Date(a.createdAt).getTime()) / 3_600_000));
 const approvalWait = (a) => ({
@@ -212,7 +236,7 @@ let ToolPipeline = class ToolPipeline {
     /** The message tools between agents; absent (tests): their calls are refused. */
     messages, registry, credentials, breaker, outputs, approvals, questions, config, log, 
     /** Plugin hooks and inline ui contributions; absent (tests): no hooks, cards dropped. */
-    host, drift, effective, switches, txHost, hooks) {
+    host, drift, effective, switches, txHost, hooks, networkGrants, devicePolicy) {
         this.config = config;
         this.txHost = txHost;
         this.deps = {
@@ -244,6 +268,9 @@ let ToolPipeline = class ToolPipeline {
                 return subagents ? { dispatch: (a) => subagents.dispatch(a) } : undefined;
             },
             messages,
+            network: networkGrants && devicePolicy
+                ? { grants: networkGrants, devices: devicePolicy }
+                : undefined,
         };
         const decide = hooks?.decidePolicy;
         // the default policy reads live, on the context's handle
@@ -256,12 +283,21 @@ let ToolPipeline = class ToolPipeline {
      * 某个调用需要等人处理（审批 / 用户输入）→ 返回 `suspended`，之后的调用留到续跑时处理；
      * 续跑时重新进入本函数，按 PG 里的审批 / 输入请求结果继续。
      */
-    async runStep(ctx) {
+    async runStep(given) {
+        let ctx = given;
         const { eventLog } = this.deps;
         const msg = await eventLog.findByIdem(ctx.conversationId, assistantIdemKey(ctx.runId, ctx.step));
         if (msg?.type !== "assistant_message")
             return { kind: "done" };
         const calls = msg.payload.content.flatMap((b) => b.type === "tool_call" ? [{ id: b.id, name: b.name, input: b.input }] : []);
+        // scheduled tasks spec §7: read live for each step (a person's message absorbed since makes the
+        // rest of the run attended)
+        if (calls.length > 0 && ctx.unattended === undefined) {
+            ctx = {
+                ...ctx,
+                unattended: await unattendedRunOf(this.deps.db, this.config, ctx.orgId, ctx.runId),
+            };
+        }
         let resolved;
         const resolve = async () => {
             // 每步实时解析（连接器 / 插件状态可能在模型调用之后变化）
@@ -324,6 +360,22 @@ let ToolPipeline = class ToolPipeline {
         const attempt = rounds.length + 1;
         const started = await this.deps.eventLog.findByIdem(ctx.conversationId, idem.started(ctx.runId, call.id, attempt));
         if (started?.type === "tool_call_started") {
+            // a command that ran and was refused a network host waits for the device owner (network
+            // ask-to-allow spec §6.2, P-D2): pending → wait on; settled → its kept result and the
+            // outcome's note (the command is never run again; its tool.called was audited when it ran)
+            const ask = await this.deps.approvals.networkForCall(ctx.runId, call.id);
+            if (ask !== null) {
+                const notes = settledNetworkNotes(ask, approvalHours(ask));
+                if (notes === null)
+                    return approvalWait(ask);
+                const kept = ask.detail?.result;
+                await this.writeResult(ctx, call.id, call.name, {
+                    ...keptExtras(kept),
+                    content: withNetworkNotes(kept?.content ?? UNKNOWN_RESULT_TEXT, notes),
+                    isError: kept?.isError ?? true,
+                });
+                return undefined;
+            }
             // 确实开始执行过：照样审计 tool.called（耗时未知）；放行依据只认批准了所执行定义的审批记录
             const key = started.payload.toolKey;
             const approval = await this.deps.approvals.forCall(ctx.runId, call.id);
@@ -439,9 +491,16 @@ let ToolPipeline = class ToolPipeline {
                 ...(ctx.parent.otherAgent !== undefined && { parentAgentDiffers: ctx.parent.otherAgent }),
             }),
             callPolicy,
+            ...(ctx.unattended != null && { unattended: ctx.unattended }),
         });
         if (decision === "deny")
             return fail(deniedText(tool.key, callPolicy?.key), outKey);
+        if (typeof decision === "object" && "refused" in decision) {
+            if (decision.missingGrant !== undefined && ctx.unattended != null) {
+                await appendMissingGrant(this.deps.db, ctx.unattended.taskRunId, decision.missingGrant);
+            }
+            return fail(decision.refused, outKey);
+        }
         if (typeof decision === "object" && "unavailable" in decision) {
             return fail(unavailableText(tool.key, decision.unavailable), outKey);
         }
@@ -620,6 +679,16 @@ let ToolPipeline = class ToolPipeline {
         let outcome = await this.execute(tool, input, ctx, call.id, resume, resolved.tools);
         const durationMs = Date.now() - t0;
         await this.deps.hooks?.afterExecute?.(ctx.runId, call.id);
+        // scheduled tasks spec §7, `fail` mode: no one answers an input request or connects an app
+        if (unattendedFails(ctx.unattended) && ctx.unattended != null) {
+            if (outcome.kind === "input_required") {
+                outcome = { kind: "error", message: UNATTENDED_QUESTION_ERROR };
+            }
+            else if (outcome.kind === "connection_required") {
+                await appendMissingGrant(this.deps.db, ctx.unattended.taskRunId, connectionGrantKey(outcome.connectorSlug));
+                outcome = { kind: "error", message: UNATTENDED_CONNECTION_ERROR(outcome.connectorName) };
+            }
+        }
         if (outcome.kind === "input_required") {
             const asked = await this.askInput(ctx, call.id, tool.key, attempt, outcome);
             if (typeof asked !== "string")
@@ -673,8 +742,40 @@ let ToolPipeline = class ToolPipeline {
                 },
             ]
             : [];
+        const callAudit = {
+            durationMs,
+            connectorId: tool.source.kind === "connector" ? tool.source.connectorId : null,
+            authorization,
+        };
+        // a foreground command refused network hosts (network ask-to-allow spec §6.2): display-only
+        // `network_blocked` before the result, then an ask to the device owner (the run waits; the
+        // result is written when the ask settles) or notes after the output
+        const report = outcome.kind === "result" && tool.source.kind === "builtin"
+            ? networkReportOf(outcome.result)
+            : undefined;
+        let content = spilled.content;
+        if (report !== undefined) {
+            const handled = await this.networkBlocked(ctx, call.id, outKey, input, report, callAudit, {
+                text: rendered.text,
+                content: spilled.content,
+                isError: rendered.isError,
+                ...(spilled.outputId !== undefined && { outputId: spilled.outputId }),
+                ...(rendered.contentTypes.length > 0 && { contentTypes: rendered.contentTypes }),
+                ...(display !== undefined && { display }),
+                ...(view !== undefined && { view }),
+            });
+            if (handled.kind === "wait") {
+                if (hooks && hookBase) {
+                    fireObserve(hooks, "tool.postExecute", { ...hookBase, isError: rendered.isError, content: handled.content, durationMs }, ctx.signal, this.deps.log);
+                }
+                return handled.wait;
+            }
+            if (handled.event !== null)
+                pre.push(handled.event);
+            content = withNetworkNotes(content, handled.notes);
+        }
         await this.writeResult(ctx, call.id, outKey, {
-            content: spilled.content,
+            content,
             isError: rendered.isError,
             ...(spilled.outputId !== undefined && { outputId: spilled.outputId }),
             ...(rendered.contentTypes.length > 0 && { contentTypes: rendered.contentTypes }),
@@ -682,11 +783,7 @@ let ToolPipeline = class ToolPipeline {
             ...(display !== undefined && { display }),
             ...(view !== undefined && { view }),
             ...(card !== undefined && { card }),
-        }, pre, {
-            durationMs,
-            connectorId: tool.source.kind === "connector" ? tool.source.connectorId : null,
-            authorization,
-        });
+        }, pre, callAudit);
         // a sub-agent that needs a personal connection: mirrored in the root conversation of its tree
         // for display (sub-agents spec §9, agent map spec §7; not a wait, the child got the connect
         // text as its result)
@@ -697,10 +794,94 @@ let ToolPipeline = class ToolPipeline {
             }));
         }
         if (hooks && hookBase) {
-            fireObserve(hooks, "tool.postExecute", { ...hookBase, isError: rendered.isError, content: spilled.content, durationMs }, ctx.signal, this.deps.log);
+            fireObserve(hooks, "tool.postExecute", { ...hookBase, isError: rendered.isError, content, durationMs }, ctx.signal, this.deps.log);
         }
         return undefined;
     }
+    /**
+     * A foreground command's refused network hosts (network ask-to-allow spec §6.2, §6.8, §8.3):
+     * the `network_blocked` event, the missing grants of an unattended run, and either notes for the
+     * result written now, or (device-layer hosts worth asking) `network_blocked` and the call's
+     * `tool.called` audit written now, the result kept in a network ask to the device's owner and
+     * the run's wait. The kept result is the formatted one (≤ 16 KB: larger output is archived)
+     * followed by the notes written now; it is written with the decision's note when the ask
+     * settles (P-D2).
+     */
+    async networkBlocked(ctx, callId, toolKey, input, report, callAudit, result) {
+        const hosts = blockedEventHosts(report.blocked);
+        if (hosts.length === 0)
+            return { kind: "write", event: null, notes: [] };
+        const event = {
+            type: "network_blocked",
+            runId: ctx.runId,
+            idemKey: networkBlockedIdemKey(ctx.runId, callId),
+            payload: { step: ctx.step, callId, hosts },
+        };
+        const network = this.deps.network;
+        if (network === undefined)
+            return { kind: "write", event, notes: [] };
+        const device = await network.devices.summary(report.deviceId);
+        const run = hosts.some((h) => h.layer === "device")
+            ? await network.grants.runState(ctx.runId, report.deviceId)
+            : null;
+        const plan = planNetworkAsk(hosts, run, { device, unattended: ctx.unattended });
+        if (ctx.unattended != null) {
+            for (const key of plan.missingGrants) {
+                await appendMissingGrant(this.deps.db, ctx.unattended.taskRunId, key);
+            }
+        }
+        if (plan.ask.length === 0)
+            return { kind: "write", event, notes: plan.notes };
+        // the device's owner is the only person who may decide (spec §5.2)
+        const owner = await this.deps.db
+            .selectFrom("devices")
+            .select("owner_account_id")
+            .where("id", "=", report.deviceId)
+            .where("org_id", "=", ctx.orgId)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        if (owner === undefined)
+            return { kind: "write", event, notes: plan.notes };
+        let { content, outputId } = result;
+        if (Buffer.byteLength(content, "utf8") > NETWORK_ASK_KEPT_MAX_BYTES && outputId === undefined) {
+            // output under the spill threshold but over what an ask keeps: archive it after all
+            const spilled = await spillIfLarge(result.text, { spillChars: 0, previewChars: this.config.get().tools.outputPreviewChars }, (c) => this.deps.outputs.save({
+                orgId: ctx.orgId,
+                conversationId: ctx.conversationId,
+                callId,
+                content: c,
+            }));
+            content = spilled.content;
+            outputId = spilled.outputId;
+        }
+        const { text: _text, ...rest } = result;
+        const kept = {
+            ...rest,
+            content: withNetworkNotes(clipKept(content), plan.notes),
+            ...(outputId !== undefined && { outputId }),
+        };
+        // the command ran: network_blocked and its tool.called now, the result once the ask settles
+        const written = await this.writeResultIn(ctx, callId, toolKey, { isError: result.isError }, [event], callAudit, []);
+        await this.deps.eventLog.notify(ctx.conversationId, Math.max(...written.map((e) => e.seq)));
+        const given = (input ?? {});
+        const ask = await this.deps.approvals.requestNetwork({
+            orgId: ctx.orgId,
+            conversationId: ctx.conversationId,
+            runId: ctx.runId,
+            step: ctx.step,
+            callId,
+            requestedFor: owner.owner_account_id,
+            detail: {
+                deviceId: report.deviceId,
+                hosts: plan.ask,
+                command: typeof given.command === "string" ? clipText(given.command, 2000) : "",
+                description: typeof given.description === "string" ? given.description : null,
+                result: kept,
+            },
+            scopes: plan.scopes,
+        });
+        return { kind: "wait", wait: approvalWait(ask), content: kept.content };
+    }
     /** Appends a sub-agent's connect card to its root conversation ({@link rootSurfaceOf}). */
     async surfaceConnectInRoot(ctx, parent, callId, toolKey) {
         const target = await rootSurfaceOf(this.deps.db, ctx.conversationId, ctx.runId, parent);
@@ -886,7 +1067,7 @@ let ToolPipeline = class ToolPipeline {
         const connectorId = source.connectorId;
         const app = await db
             .selectFrom("connectors")
-            .select(["name", "connector", "endpoint", "auth", "status"])
+            .select(["name", "slug", "connector", "endpoint", "auth", "status"])
             .where("id", "=", connectorId)
             .where("org_id", "=", orgId)
             .where("deleted_at", "is", null)
@@ -922,10 +1103,13 @@ let ToolPipeline = class ToolPipeline {
         // 远端在调用途中向用户要输入（MCP elicitation，见 elicitation.ts）：需要问用户时中止本次调用、按 input_required
         // 处理；续跑时用 ctx.resume 的答案答复远端再次发起的同一请求。resources 工具不续跑，一律拒绝。
         const suspend = new AbortController();
+        // an unattended run in `fail` mode declines every elicitation: no one is there to answer
+        const unattended = unattendedFails(ctx.unattended);
         const elicit = new ElicitationSession({
             resume,
             onSuspend: () => suspend.abort(),
-            declineAll: source.resources === true,
+            declineAll: source.resources === true || unattended,
+            ...(unattended && { declineNote: UNATTENDED_ELICITATION_NOTE }),
         });
         // 远端可能把收到的凭据回显在结果 / 错误 / elicitation 表单里：写入事件之前按本次注入的值打码（见 redact.ts）
         const clean = (o) => {
@@ -961,6 +1145,7 @@ let ToolPipeline = class ToolPipeline {
                 kind: "connection_required",
                 connectorId,
                 connectorName: app.name,
+                connectorSlug: app.slug,
                 message: personalMissingText(app.name),
             }
             : { kind: "error", message: orgMissingText(app.name) };
@@ -1251,6 +1436,10 @@ ToolPipeline = __decorate([
     __param(15, Inject(OrgToolSwitches)),
     __param(16, Inject(TransactionHost)),
     __param(17, Optional()),
-    __param(17, Inject(TOOL_PIPELINE_HOOKS))
+    __param(17, Inject(TOOL_PIPELINE_HOOKS)),
+    __param(18, Optional()),
+    __param(18, Inject(NetworkGrants)),
+    __param(19, Optional()),
+    __param(19, Inject(DevicePolicyService))
 ], ToolPipeline);
 export { ToolPipeline };

package/dist/tools/policy.d.ts

@@ -1,6 +1,13 @@
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { DecidePolicy } from "./pipeline.js";
-import type { ResolvedTool, ToolPolicy } from "./registry.js";
+import type { ToolPolicy } from "./registry.js";
+export { R3_FIXED_ASK_TOOL_KEYS } from "./builtin-names.js";
+export { isFixedAsk } from "./fixed-ask.js";
+/**
+ * What allowed an ask without an approval: this conversation's grant, an "always" grant, or a
+ * scheduled task's grant (its unattended runs, scheduled tasks spec §7).
+ */
+export type GrantKind = "session" | "always" | "task";
 /** 取更严的策略（`allow < ask < deny`）。 */
 export declare function stricter(a: ToolPolicy, b: ToolPolicy | undefined): ToolPolicy;
 export interface PolicyInput {
@@ -10,19 +17,16 @@ export interface PolicyInput {
     agentOverride?: "ask" | "deny";
     /** `requiresUserInteraction`。 */
     fixedAsk: boolean;
-    /** 已记住且 specHash 与当前一致的授权。 */
-    grant: "session" | "always" | null;
+    /**
+     * 已记住且 specHash 与当前一致的授权; `task`: a scheduled task's grant in its unattended run.
+     */
+    grant: GrantKind | null;
 }
 /**
  * 策略判定（纯函数）：取组织默认、agent 收紧、固定询问三者中最严者；
  * 记住的授权只能把 `ask` 放行为 `allow`，不能越过 `deny`，对 `requiresUserInteraction` 的工具无效。
  */
 export declare function decide(input: PolicyInput): ToolPolicy;
-/**
- * Whether the tool is a fixed ask: its spec declares `requiresUserInteraction`, so its policy is
- * at least `ask` and remembered grants never let it through.
- */
-export declare function isFixedAsk(tool: ResolvedTool): boolean;
 /** Which level decided a connector tool's policy ({@link connectorPolicy}). */
 export type ConnectorPolicySource = "org" | "member" | "agent";
 /**
@@ -63,5 +67,14 @@ export declare function connectorPolicy(input: {
  *   （`approverRole` = 所需角色、`requestedFor` = null），此时记住的授权不放行。
  *
  * 结果为 `ask` 时返回审批请求，默认指向发起人本人；记住的授权把 `ask` 放行时返回 `{ grant }`（按 allow 执行）。
+ *
+ * An unattended run (`ctx.unattended`, not a trial run; scheduled tasks spec §7):
+ * - a tool in the org's `forbiddenTools` (by tool key or per-call key) is denied;
+ * - a Platform call that changes the agent's skills (`agents.register-skill`, ...) is an ask no
+ *   grant covers, even on a private agent where it would run without asking;
+ * - an ask is also allowed by a task grant of the current definition (`{ grant: "task" }`), never
+ *   for a fixed ask, a role escalation or a connector tool whose definition changed;
+ * - in `fail` mode an ask still left is refused (`{ refused, missingGrant }`, no approval), and
+ *   `AskUserQuestion` is refused; in `wait` mode both ask the creator as in an attended run.
  */
 export declare function createDecidePolicy(db: KernelSchemaDb): DecidePolicy;

package/dist/tools/policy.js

@@ -1,9 +1,15 @@
 import { sql } from "kysely";
 import { roleAtLeast } from "../orgs/roles.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
-import { SANDBOX_ASK_TOOL_NAMES } from "./builtin-names.js";
+import { grantRefusalOf } from "../schedules/grant-rules.js";
+import { findTaskGrant } from "../schedules/store.js";
+import { changesAgentSkills, UNATTENDED_ASK_ERROR, UNATTENDED_FIXED_ASK_ERROR, UNATTENDED_QUESTION_ERROR, unattendedRules, } from "../schedules/unattended.js";
+import { BUILTIN, SANDBOX_ASK_TOOL_NAMES } from "./builtin-names.js";
 import { personalAuth } from "./connector-account-policies.js";
+import { isFixedAsk } from "./fixed-ask.js";
 import { normalizeStoredDefinitionIn } from "./legacy-data.js";
+export { R3_FIXED_ASK_TOOL_KEYS } from "./builtin-names.js";
+export { isFixedAsk } from "./fixed-ask.js";
 const RANK = { allow: 0, ask: 1, deny: 2 };
 /** 取更严的策略（`allow < ask < deny`）。 */
 export function stricter(a, b) {
@@ -21,13 +27,6 @@ export function decide(input) {
         return "allow";
     return p;
 }
-/**
- * Whether the tool is a fixed ask: its spec declares `requiresUserInteraction`, so its policy is
- * at least `ask` and remembered grants never let it through.
- */
-export function isFixedAsk(tool) {
-    return tool.spec.annotations?.requiresUserInteraction === true;
-}
 const asSetting = (v) => v === "allow" || v === "ask" || v === "deny" ? v : undefined;
 /** The stricter of the settings that are set (none set: undefined). */
 function combine(...xs) {
@@ -92,6 +91,15 @@ export function connectorPolicy(input) {
  *   （`approverRole` = 所需角色、`requestedFor` = null），此时记住的授权不放行。
  *
  * 结果为 `ask` 时返回审批请求，默认指向发起人本人；记住的授权把 `ask` 放行时返回 `{ grant }`（按 allow 执行）。
+ *
+ * An unattended run (`ctx.unattended`, not a trial run; scheduled tasks spec §7):
+ * - a tool in the org's `forbiddenTools` (by tool key or per-call key) is denied;
+ * - a Platform call that changes the agent's skills (`agents.register-skill`, ...) is an ask no
+ *   grant covers, even on a private agent where it would run without asking;
+ * - an ask is also allowed by a task grant of the current definition (`{ grant: "task" }`), never
+ *   for a fixed ask, a role escalation or a connector tool whose definition changed;
+ * - in `fail` mode an ask still left is refused (`{ refused, missingGrant }`, no approval), and
+ *   `AskUserQuestion` is refused; in `wait` mode both ask the creator as in an attended run.
  */
 export function createDecidePolicy(db) {
     return async (tool, agentDef, ctx) => {
@@ -150,6 +158,18 @@ export function createDecidePolicy(db) {
                 memberSetting = mine?.policy;
             }
         }
+        // scheduled tasks spec §7: what an unattended run may not do at all
+        const unattended = unattendedRules(ctx.unattended) ? ctx.unattended : undefined;
+        if (unattended !== undefined) {
+            const forbidden = unattended.forbiddenTools;
+            if (forbidden.includes(tool.key) || forbidden.includes(policyKey))
+                return "deny";
+            if (unattended.unattendedAsk === "fail" &&
+                tool.source.kind === "builtin" &&
+                tool.key === BUILTIN.AskUserQuestion) {
+                return { refused: UNATTENDED_QUESTION_ERROR };
+            }
+        }
         // 沙箱工具的组织默认（M5 T8）：组织设置 sandboxToolPolicy 为 ask 时，有副作用的沙箱工具至少 ask
         // `orgAsk`: the org setting, not the tool's own default, is what makes it ask
         let orgAsk = false;
@@ -202,6 +222,8 @@ export function createDecidePolicy(db) {
             agentOverride = undefined;
         }
         let escalateTo = null;
+        /** The acting account's role, read only for a tool that declares `requiredRole`. */
+        let memberRole = null;
         if (tool.requiredRole !== undefined) {
             const m = await db
                 .selectFrom("memberships")
@@ -211,12 +233,20 @@ export function createDecidePolicy(db) {
                 .executeTakeFirst();
             if (!m)
                 return "deny";
+            memberRole = m.role;
             if (!roleAtLeast(m.role, tool.requiredRole))
                 escalateTo = tool.requiredRole;
         }
         // `remember: false` on a call that is not a plain allow (an org / platform operation, or a read
         // an agent tightened to ask): every call asks, grants never apply. A read (`allow`) never asks.
-        const fixedAsk = isFixedAsk(tool) ||
+        // an unattended run never changes the agent's skills on its own (spec §7): a Platform call
+        // that registers, deletes or shares one asks, outside every grant
+        const unattendedSkillChange = unattended !== undefined &&
+            tool.source.kind === "builtin" &&
+            tool.key === BUILTIN.Platform &&
+            changesAgentSkills(policyKey);
+        const fixedAsk = unattendedSkillChange ||
+            isFixedAsk(tool) ||
             (call !== null && !call.remember && (call.policy !== "allow" || agentOverride !== undefined));
         const input = {
             connectorDefault,
@@ -229,12 +259,36 @@ export function createDecidePolicy(db) {
             return "deny";
         if (pre === "ask" && !fixedAsk && escalateTo === null && hashCurrent) {
             input.grant = await findGrant(db, tool, policyKey, connectorId, ctx);
+            // an unattended run: the task's grants, like a tool_grants entry (spec §7)
+            if (input.grant === null &&
+                unattended !== undefined &&
+                (await findTaskGrant(db, unattended.taskId, policyKey, tool.specHash, connectorId))) {
+                input.grant = "task";
+            }
         }
         const result = decide(input);
         if (result === "allow" && escalateTo === null) {
             // 记住的授权把 ask 放行：返回授权种类（审计链记录凭什么放行）
             return pre === "ask" && input.grant !== null ? { grant: input.grant } : "allow";
         }
+        // an ask outside the grants in an unattended run, `fail` mode: no approval (spec §7)
+        if (unattended?.unattendedAsk === "fail") {
+            // recorded as a missing grant only when the creator could grant it to the task (the task
+            // grants' own rule) or could once promoted (`needs_role`, which the inbox says); a fixed
+            // ask, a per-call key (a skill change among them) or a forbidden tool never can: refused as a fixed ask,
+            // not recorded, so the inbox never offers a grant that cannot be added
+            const why = fixedAsk
+                ? { code: "fixed_ask" }
+                : grantRefusalOf(policyKey, tool, {
+                    // only `requiredRole` reads the role, and then it was read above
+                    role: memberRole ?? "guest",
+                    forbiddenTools: unattended.forbiddenTools,
+                });
+            if (why !== null && why.code !== "needs_role") {
+                return { refused: UNATTENDED_FIXED_ASK_ERROR(policyKey) };
+            }
+            return { refused: UNATTENDED_ASK_ERROR(policyKey), missingGrant: policyKey };
+        }
         const ask = {
             toolKey: policyKey,
             specHash: tool.specHash,

package/dist/tools/registry.d.ts

@@ -1,4 +1,4 @@
-import type { Connector, HookParentScope, InputRequired, ToolAnnotations, ToolCallContext, ToolResult, ToolSpec } from "@capybara-hq/plugin-sdk";
+import type { Connector, HookParentScope, InputRequired, NetworkBlockedHost, ToolAnnotations, ToolCallContext, ToolResult, ToolSpec } from "@capybara-hq/plugin-sdk";
 import { type AgentDefinition, type DisabledToolRef, type SubagentTools } from "../agents/definition.js";
 import type { ToolView } from "../conversations/events.js";
 import { EffectiveConfigs } from "../extensions/effective-config.js";
@@ -77,6 +77,15 @@ export type BuiltinResult = (ToolResult & {
      * checking it against `ToolViewSchema`). Builtins only: extension tools cannot set it.
      */
     view?: ToolView;
+    /**
+     * Kernel-internal (never written to the log or sent to the model): the network hosts a
+     * foreground command on a device was refused (`Bash`; network ask-to-allow spec §6.2). The
+     * pipeline turns it into `network_blocked`, an ask to the device owner or notes.
+     */
+    networkReport?: {
+        deviceId: string;
+        blocked: NetworkBlockedHost[];
+    };
 }) | InputRequired;
 /** 内置工具的处理函数（插件的 `ToolHandler` 可直接赋给它）。 */
 export type BuiltinHandler = (input: unknown, ctx: BuiltinCallContext) => Promise<BuiltinResult>;

package/dist/tools/tools.module.js

@@ -12,6 +12,7 @@ import { EventLogModule } from "../conversations/event-log.js";
 import { DevicesModule } from "../devices/devices.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { QueueModule } from "../infra/queue/queue.module.js";
+import { LocalDevicesModule } from "../local-devices/local-devices.module.js";
 import { ModelsModule } from "../models/models.module.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
 import { PlatformModule } from "../platform/platform.module.js";
@@ -20,12 +21,14 @@ import { StepLogModule } from "../runtime/step-log.js";
 import { SubagentsModule } from "../runtime/subagents/subagents.service.js";
 import { UsageReportModule } from "../runtime/usage-report.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
+import { ScheduledTaskStoreModule } from "../schedules/store.module.js";
 import { SkillsModule } from "../skills/skills.module.js";
 import { StorageModule } from "../storage/storage.module.js";
 import { AdminConnectors } from "./admin-connectors.js";
 import { ApprovalsService } from "./approvals.service.js";
 import { Breaker } from "./breaker.js";
 import { BuiltinTools } from "./builtins/builtin-tools.js";
+import { ScheduleToolsPort, ScheduleUpdates } from "./builtins/schedules.js";
 import { WebPages } from "./builtins/web/page-cache.js";
 import { ConnectorAccountPolicies } from "./connector-account-policies.js";
 import { ConnectorContent } from "./connector-content.js";
@@ -63,6 +66,8 @@ ToolsModule = __decorate([
             // the builtin sandbox and skill tools run in the conversation's device
             SandboxModule,
             DevicesModule,
+            // 「这台设备一直允许」 changes the device's local policy (network asks)
+            LocalDevicesModule,
             // `Bash` with run_in_background records its task; TaskOutput / TaskStop finish and stop it
             BackgroundModule,
             // the conversation page's tool metadata reads only what the viewer may see
@@ -74,11 +79,17 @@ ToolsModule = __decorate([
             // the `Platform` tool's operations, actor facts and agent docs (imports no domain module)
             PlatformModule,
             QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
+            // a trial run's approvals become its scheduled task's grants (scheduled tasks spec §7)
+            ScheduledTaskStoreModule,
         ],
         providers: [
             Credentials,
             ToolOutputs,
             BuiltinTools,
+            // `ScheduleUpdate`'s write in one transaction (scheduled tasks spec §11)
+            ScheduleUpdates,
+            // where `SchedulesModule` binds the task service for the schedule tools (no provider cycle)
+            ScheduleToolsPort,
             WebPages,
             ToolRegistry,
             ApprovalsService,
@@ -96,6 +107,7 @@ ToolsModule = __decorate([
             OrgToolSwitches,
         ],
         exports: [
+            ScheduleToolsPort,
             Credentials,
             ToolOutputs,
             BuiltinTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.21",
+  "version": "0.1.0-rc.22",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -65,7 +65,7 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.15"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.16"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",