@capybara-hq/kernel 0.1.0-rc.21 → 0.1.0-rc.23

package/dist/identity/settings.d.ts

@@ -1,8 +1,10 @@
 import { z } from "zod";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { type PlatformTiers, type PlatformTiersPatch, type PlatformTiersStored, type PlatformTiersView } from "../sandbox/platform-tiers.js";
 import { type UiArrangement } from "../ui/arrangement.js";
 import { SuperAdminLock } from "./super-admin.js";
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
@@ -105,6 +107,14 @@ export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DeploymentSettings = z.infer<typeof DEPLOYMENT_SETTINGS>;
+/**
+ * What `GET /api/v1/admin/settings` answers: the stored settings, and the platform's sandbox tiers
+ * as they are in effect with where each field comes from (`env` / `file` / `nacos`: the startup
+ * config, read-only here; `db`: chosen in the admin console; `default`).
+ */
+export type DeploymentSettingsView = DeploymentSettings & {
+    sandboxTiers: PlatformTiersView;
+};
 /**
  * 设置的修改（PUT /api/v1/admin/settings 的 body）：只改给出的键。
  * `runConcurrencyOverrides` 按组织合并：值为正整数 → 设置该组织的上限；值为 null → 删除该组织的覆盖
@@ -147,6 +157,19 @@ export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
         disabled: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    sandboxTiers: z.ZodOptional<z.ZodObject<{
+        max: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>>;
+        default: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>>;
+        allowUnsandboxed: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DeploymentSettingsPatch = z.infer<typeof DEPLOYMENT_SETTINGS_PATCH>;
 /**
@@ -198,7 +221,29 @@ export declare class SettingsService {
     readonly txHost: TransactionHost;
     private readonly adminLock;
     private readonly log;
-    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, log: Pick<KernelLogger, "warn">);
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    private readonly config;
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, log: Pick<KernelLogger, "warn">, 
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    config: Pick<KernelConfigService, "get" | "fieldSource">);
+    /** The settings with the platform's sandbox tiers in effect and their sources. */
+    view(): Promise<DeploymentSettingsView>;
+    private tiersView;
+    /**
+     * The refusals of a `sandboxTiers` change against the stored choice: a field set in the
+     * startup config (`deployment.setting_readonly`), a default above the max
+     * (`validation_failed`), and with `onlyNarrows` (an API token, the Platform tool) any widening:
+     * a higher max or default, unsandboxed allowed, in effect or in the stored choice (which
+     * applies once the startup config stops setting a field). Returns the next stored choice and
+     * the effective tiers before and after.
+     */
+    checkSandboxTiers(patch: PlatformTiersPatch, opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<{
+        next: PlatformTiersStored;
+        before: PlatformTiers;
+        after: PlatformTiers;
+    }>;
     /**
      * Reads every setting, in the context's transaction when there is one (a caller holding a
      * transaction connection does not take a second one from the pool). Each key is validated on
@@ -206,9 +251,14 @@ export declare class SettingsService {
      * valid keys apply; unknown keys (written by a newer version) are ignored.
      */
     get(): Promise<DeploymentSettings>;
-    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    /**
+     * Updates settings under the super admin lock, re-checking the actor (else `forbidden`).
+     * `onlyNarrows` (an API token, the Platform tool): `sandboxTiers` may only narrow.
+     */
     update(patch: DeploymentSettingsPatch, actorAccountId: string, actorTokenId?: string, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail?: Record<string, unknown>): Promise<DeploymentSettings>;
+    auditDetail?: Record<string, unknown>, opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<DeploymentSettingsView>;
     private write;
 }

package/dist/identity/settings.js

@@ -11,10 +11,12 @@ import { EXTENSION_NAME_RE } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { applyPlatformTiersPatch, chosenPlatformDefault, PLATFORM_TIER_FIELDS, PLATFORM_TIERS_PATCH, PLATFORM_TIERS_SETTING, platformTiersWiden, readStoredPlatformTiers, resolvePlatformTiers, } from "../sandbox/platform-tiers.js";
 import { assertPlatformDefaultEligible, lockThemeShared } from "../themes/theme-state.js";
 import { mergeArrangement, UiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
 import { audit } from "./audit.js";
@@ -153,6 +155,7 @@ export const DEPLOYMENT_SETTINGS = z.object({
     clientExtensions: ClientExtensionsSetting.default(clientExtensionsDefault),
 });
 const DEFAULTS = DEPLOYMENT_SETTINGS.parse({});
+const tierWidenRefused = () => new ApiError("deployment.sandbox_tier_not_allowed", "Raising the platform's sandbox level (sandboxTiers) needs a super admin in the admin console; an API token or the Platform tool may only lower it.");
 /**
  * 设置的修改（PUT /api/v1/admin/settings 的 body）：只改给出的键。
  * `runConcurrencyOverrides` 按组织合并：值为正整数 → 设置该组织的上限；值为 null → 删除该组织的覆盖
@@ -198,6 +201,14 @@ export const DEPLOYMENT_SETTINGS_PATCH = z
         message: "give enabled, disabled or both",
     })
         .optional(),
+    /**
+     * The platform's sandbox tiers (sandbox dev tiers spec §4.1): each given field replaces the
+     * stored one, null clears it (back to the default: max dev, default dev, unsandboxed allowed).
+     * A field set in the startup config is read-only (409 `deployment.setting_readonly`); the
+     * default may not be above the max; an API token or the Platform tool may only narrow (400
+     * `deployment.sandbox_tier_not_allowed`).
+     */
+    sandboxTiers: PLATFORM_TIERS_PATCH.optional(),
 })
     .strict();
 /**
@@ -350,11 +361,66 @@ let SettingsService = class SettingsService {
     txHost;
     adminLock;
     log;
-    constructor(db, txHost, adminLock, log) {
+    config;
+    constructor(db, txHost, adminLock, log, 
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    config) {
         this.db = db;
         this.txHost = txHost;
         this.adminLock = adminLock;
         this.log = log;
+        this.config = config;
+    }
+    /** The settings with the platform's sandbox tiers in effect and their sources. */
+    async view() {
+        const [settings, stored] = await Promise.all([
+            this.get(),
+            readStoredPlatformTiers(this.db.db, this.log),
+        ]);
+        return { ...settings, sandboxTiers: this.tiersView(stored) };
+    }
+    tiersView(stored) {
+        const config = this.config.get().sandbox.tiers;
+        const sources = Object.fromEntries(PLATFORM_TIER_FIELDS.map((f) => [
+            f,
+            this.config.fieldSource(`sandbox.tiers.${f}`) ??
+                (stored[f] !== undefined ? "db" : "default"),
+        ]));
+        return { ...resolvePlatformTiers(config, stored), sources };
+    }
+    /**
+     * The refusals of a `sandboxTiers` change against the stored choice: a field set in the
+     * startup config (`deployment.setting_readonly`), a default above the max
+     * (`validation_failed`), and with `onlyNarrows` (an API token, the Platform tool) any widening:
+     * a higher max or default, unsandboxed allowed, in effect or in the stored choice (which
+     * applies once the startup config stops setting a field). Returns the next stored choice and
+     * the effective tiers before and after.
+     */
+    async checkSandboxTiers(patch, opts = {}) {
+        const readonly = PLATFORM_TIER_FIELDS.filter((f) => patch[f] !== undefined && this.config.fieldSource(`sandbox.tiers.${f}`) !== undefined);
+        if (readonly.length > 0) {
+            throw new ApiError("deployment.setting_readonly", `These sandbox tier settings are set in the startup config (file, Nacos or environment) and are read-only here: ${readonly.map((f) => `sandbox.tiers.${f}`).join(", ")}`, readonly.map((f) => ({
+                path: `sandboxTiers.${f}`,
+                source: this.config.fieldSource(`sandbox.tiers.${f}`),
+            })));
+        }
+        const config = this.config.get().sandbox.tiers;
+        const stored = await readStoredPlatformTiers(this.db.db, this.log);
+        const next = applyPlatformTiersPatch(stored, patch);
+        const before = resolvePlatformTiers(config, stored);
+        const after = resolvePlatformTiers(config, next);
+        const chosen = chosenPlatformDefault(config, next);
+        if ((patch.max !== undefined || patch.default !== undefined) && chosen !== after.default) {
+            throw new ApiError("validation_failed", `The default sandbox tier (${chosen}) cannot be above the highest (${after.max}); lower sandboxTiers.default as well`, [{ path: "sandboxTiers.default", message: `must be at most ${after.max}` }]);
+        }
+        if (opts.onlyNarrows) {
+            const none = {};
+            if (platformTiersWiden(before, after) ||
+                platformTiersWiden(resolvePlatformTiers(none, stored), resolvePlatformTiers(none, next))) {
+                throw tierWidenRefused();
+            }
+        }
+        return { next, before, after };
     }
     /**
      * Reads every setting, in the context's transaction when there is one (a caller holding a
@@ -382,18 +448,21 @@ let SettingsService = class SettingsService {
         }
         return out;
     }
-    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    /**
+     * Updates settings under the super admin lock, re-checking the actor (else `forbidden`).
+     * `onlyNarrows` (an API token, the Platform tool): `sandboxTiers` may only narrow.
+     */
     async update(patch, actorAccountId, actorTokenId, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail) {
+    auditDetail, opts = {}) {
         const check = DEPLOYMENT_SETTINGS_PATCH.safeParse(patch);
         if (!check.success) {
             throw new ApiError("validation_failed", "Invalid deployment settings", check.error.issues.map((i) => ({ path: i.path.join("."), message: i.message })));
         }
-        await this.write(check.data, actorAccountId, actorTokenId, auditDetail);
-        return this.get();
+        await this.write(check.data, actorAccountId, actorTokenId, auditDetail, opts);
+        return this.view();
     }
-    async write(patch, actorAccountId, actorTokenId, auditDetail) {
+    async write(patch, actorAccountId, actorTokenId, auditDetail, opts) {
         await this.adminLock.lockAndAuthorize(actorAccountId);
         // The super admin lock serializes every settings write: the current overrides are read
         // and merged under it, so no concurrent change is lost
@@ -452,7 +521,16 @@ let SettingsService = class SettingsService {
                 next.subagentLimitOverrides = mergeByOrg(current.subagentLimitOverrides, subagentPatch);
             }
         }
-        for (const [key, value] of Object.entries(next)) {
+        // the platform's sandbox tiers: checked against the stored choice under the lock; lowering
+        // the max needs no org rewrite, the effective policy cuts every org's ceiling and default
+        let tiersChange;
+        const writes = Object.entries(next);
+        if (patch.sandboxTiers !== undefined) {
+            const r = await this.checkSandboxTiers(patch.sandboxTiers, opts);
+            tiersChange = { before: r.before, after: r.after };
+            writes.push([PLATFORM_TIERS_SETTING, r.next]);
+        }
+        for (const [key, value] of writes) {
             if (value === undefined)
                 continue;
             const json = JSON.stringify(value);
@@ -468,7 +546,11 @@ let SettingsService = class SettingsService {
             actorAccountId,
             ...(actorTokenId !== undefined && { actorTokenId }),
             action: "deployment.settings.updated",
-            detail: { ...patch, ...auditDetail },
+            detail: {
+                ...patch,
+                ...(tiersChange !== undefined && { sandboxTiersEffective: tiersChange }),
+                ...auditDetail,
+            },
         });
     }
 };
@@ -480,6 +562,7 @@ SettingsService = __decorate([
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(SuperAdminLock)),
-    __param(3, Inject(KERNEL_LOGGER))
+    __param(3, Inject(KERNEL_LOGGER)),
+    __param(4, Inject(KernelConfigService))
 ], SettingsService);
 export { SettingsService };

package/dist/inbox/inbox.module.js

@@ -6,6 +6,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 import { Module } from "@nestjs/common";
 import { CatalogModule } from "../catalog/catalog.module.js";
+import { SchedulesModule } from "../schedules/schedules.module.js";
 import { SkillsModule } from "../skills/skills.module.js";
 import { ToolsModule } from "../tools/tools.module.js";
 import { InboxService } from "./inbox.service.js";
@@ -18,7 +19,7 @@ let InboxModule = class InboxModule {
 };
 InboxModule = __decorate([
     Module({
-        imports: [ToolsModule, SkillsModule, CatalogModule],
+        imports: [ToolsModule, SkillsModule, CatalogModule, SchedulesModule],
         providers: [InboxService, PlatformInboxService],
         exports: [InboxService, PlatformInboxService],
     })

package/dist/inbox/inbox.service.d.ts

@@ -1,5 +1,6 @@
 import { CatalogRequestsService, type CatalogRequestView } from "../catalog/requests.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
+import { type ScheduleAttention, ScheduledTasksService } from "../schedules/scheduled-tasks.service.js";
 import { SkillChangesService, type SkillChangeView } from "../skills/changes.service.js";
 import { ApprovalsService, type ApprovalView } from "../tools/approvals.service.js";
 import type { OrgNoticeDetails } from "./org-notices.js";
@@ -40,11 +41,16 @@ export declare const INBOX_MAX_ITEMS = 100;
  * - `tool_approval`：当前用户能处理的待处理工具调用审批（与 `GET /approvals?status=pending` 同一视图）；
  * - `skill_change`: pending skill share requests and proposed versions of shared skills, when the
  *   current user is an org admin (`skillChange.kind`; spec §5.4, §5.5);
- * - `catalog_request`: pending `enable` requests from members and pending `connector_setup`
- *   requests (`request.kind`; `request.agent` and `request.connectors` set, `item` null; ruling
- *   P4-T6-5), when the current user is an org admin (M6 T26, C22; plugin scope spec §5.1);
+ * - `catalog_request`: pending `enable` and `network_allowlist` requests from members and pending
+ *   `connector_setup` requests (`request.kind`; for `connector_setup` `request.agent` and
+ *   `request.connectors` set, `item` null, ruling P4-T6-5; for `network_allowlist`
+ *   `request.network` set, network ask-to-allow spec §5.3), when the current user is an org admin
+ *   (M6 T26, C22; plugin scope spec §5.1);
  * - `catalog_request_decided`: the current user's own requests in this org that were approved or
  *   rejected (with the reason), until dismissed (`POST catalog-requests/:id/dismiss`);
+ * - `schedule_attention`: the current user's own scheduled task that needs them (spec §8): paused
+ *   for any reason but their own pause, its latest run failed, or its latest run was refused tools
+ *   or connections; derived live, gone once the task is resumed or runs clean;
  * - the org notices (`skill_renamed`, `item_shared`, `shared_item_updated`, `upload_confirmed`,
  *   `upload_rejected`; `type` = the notice's kind): for org admins, until one dismisses it
  *   (`POST inbox/notices/:id/dismiss`).
@@ -70,12 +76,20 @@ export type InboxItem = {
     /** When it was decided. */
     createdAt: string;
     request: CatalogRequestView;
+} | {
+    type: "schedule_attention";
+    /** `<taskId>:paused`, `<taskId>:failed` or `<taskId>:grants`. */
+    id: string;
+    createdAt: string;
+    attention: ScheduleAttentionView;
 } | {
     type: OrgNoticeView["kind"];
     id: string;
     createdAt: string;
     notice: OrgNoticeView;
 };
+/** A scheduled task that needs its creator ({@link ScheduleAttention}, dates as ISO strings). */
+export type ScheduleAttentionView = Omit<ScheduleAttention, "at">;
 /** `GET /inbox` 的结果：新的在前，最多 {@link INBOX_MAX_ITEMS} 项；`truncated` 为 true 表示还有更多。 */
 export interface InboxView {
     items: InboxItem[];
@@ -87,7 +101,8 @@ export declare class InboxService {
     private readonly skillChanges;
     private readonly kdb;
     private readonly catalogRequests;
-    constructor(approvals: Pick<ApprovalsService, "list">, skillChanges: Pick<SkillChangesService, "listPending">, kdb: KernelDb, catalogRequests: Pick<CatalogRequestsService, "listForOrgAdmin" | "listDecidedForRequester">);
+    private readonly schedules;
+    constructor(approvals: Pick<ApprovalsService, "list">, skillChanges: Pick<SkillChangesService, "listPending">, kdb: KernelDb, catalogRequests: Pick<CatalogRequestsService, "listForOrgAdmin" | "listDecidedForRequester">, schedules: Pick<ScheduledTasksService, "attentionFor">);
     list(orgId: string, accountId: string): Promise<InboxView>;
     /** The org's open notices when the account is an org admin (else none), newest first. */
     private notices;

package/dist/inbox/inbox.service.js

@@ -13,6 +13,7 @@ import { CATALOG_REQUESTS_LIST_MAX, CatalogRequestsService, } from "../catalog/r
 import { ApiError } from "../errors.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { roleAtLeast } from "../orgs/roles.js";
+import { ScheduledTasksService, } from "../schedules/scheduled-tasks.service.js";
 import { SKILL_CHANGES_LIST_MAX, SkillChangesService, } from "../skills/changes.service.js";
 import { APPROVALS_LIST_MAX, ApprovalsService, } from "../tools/approvals.service.js";
 /** The most open org notices one inbox read returns. */
@@ -25,19 +26,22 @@ let InboxService = class InboxService {
     skillChanges;
     kdb;
     catalogRequests;
-    constructor(approvals, skillChanges, kdb, catalogRequests) {
+    schedules;
+    constructor(approvals, skillChanges, kdb, catalogRequests, schedules) {
         this.approvals = approvals;
         this.skillChanges = skillChanges;
         this.kdb = kdb;
         this.catalogRequests = catalogRequests;
+        this.schedules = schedules;
     }
     async list(orgId, accountId) {
-        const [approvals, changes, requests, decided, notices] = await Promise.all([
+        const [approvals, changes, requests, decided, notices, attention] = await Promise.all([
             this.approvals.list(orgId, accountId, "pending"),
             this.skillChanges.listPending(orgId, accountId),
             this.catalogRequests.listForOrgAdmin(orgId, accountId),
             this.catalogRequests.listDecidedForRequester(orgId, accountId),
             this.notices(orgId, accountId),
+            this.schedules.attentionFor(orgId, accountId),
         ]);
         const all = [
             ...approvals.map((a) => ({
@@ -64,6 +68,12 @@ let InboxService = class InboxService {
                 createdAt: r.decidedAt ?? r.createdAt,
                 request: r,
             })),
+            ...attention.map(({ at, ...view }) => ({
+                type: "schedule_attention",
+                id: `${view.taskId}:${view.reason === "missing_grants" ? "grants" : view.reason === "failed" ? "failed" : "paused"}`,
+                createdAt: at.toISOString(),
+                attention: view,
+            })),
             ...notices.map((n) => ({ type: n.kind, id: n.id, createdAt: n.createdAt, notice: n })),
         ];
         // 新的在前；同一时刻按 id 定序（结果稳定）
@@ -142,7 +152,8 @@ InboxService = __decorate([
     __param(0, Inject(ApprovalsService)),
     __param(1, Inject(SkillChangesService)),
     __param(2, Inject(KernelDb)),
-    __param(3, Inject(CatalogRequestsService))
+    __param(3, Inject(CatalogRequestsService)),
+    __param(4, Inject(ScheduledTasksService))
 ], InboxService);
 export { InboxService };
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/infra/config/kernel-config.service.d.ts

@@ -15,6 +15,13 @@ export declare class KernelConfigService {
     private readonly listeners;
     constructor(input: KernelConfigInput, log: KernelLogger);
     get(): KernelConfig;
+    /**
+     * Where the current value of a field without a schema default comes from: `env` when an
+     * environment variable sets it, else the config source (`file` / `nacos`) when it is set at all;
+     * undefined when nothing sets it (a layer below the startup config decides, e.g. the deployment
+     * settings for `sandbox.tiers.*`). Such fields are read-only in the admin console.
+     */
+    fieldSource(path: string): "env" | "file" | "nacos" | undefined;
     /** Subscribes to applied changes (hot fields only); returns the unsubscribe function. */
     onChange(listener: ConfigChangeListener): () => void;
     /**

package/dist/infra/config/kernel-config.service.js

@@ -8,9 +8,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Inject, Injectable } from "@nestjs/common";
+import { envOverrides } from "../../config/env.js";
 import { changedPaths, configFields, getPath, secretValues, setPath } from "../../config/fields.js";
 import { resolveConfig } from "../../config/load.js";
 import { KernelConfigSchema } from "../../config/schema.js";
+import { configSourceKind } from "../../config/sources.js";
 import { KERNEL_CONFIG_INPUT, KERNEL_LOGGER } from "../tokens.js";
 /**
  * Appliers of the hot-reloadable fields: the key is a dotted path marked `hot` in the schema. A
@@ -33,6 +35,10 @@ const HOT_APPLIERS = {
     "models.embedTimeoutMs": () => { },
     // SandboxService reads the shared-lease cap at every acquisition.
     "sandbox.maxConcurrentCommands": () => { },
+    // Sandbox tiers are read at every device use, org settings read and Platform call.
+    "sandbox.tiers.max": () => { },
+    "sandbox.tiers.default": () => { },
+    "sandbox.tiers.allowUnsandboxed": () => { },
     // The devices service reads the personal limit at every create.
     "devices.maxPersonal": () => { },
     // The local device relay reads the reconnect grace at every disconnect and token response.
@@ -48,6 +54,13 @@ const HOT_APPLIERS = {
     "web.fetch.maxAnswerTokens": () => { },
     "web.fetch.cacheSeconds": () => { },
     "web.fetch.timeoutMs": () => { },
+    // Scheduled-task settings are clamped to these bounds on every read.
+    "schedules.minIntervalFloorMinutes": () => { },
+    "schedules.maxTasksPerMemberCap": () => { },
+    "schedules.maxTasksPerOrgCap": () => { },
+    "schedules.maxRunsPerHourCap": () => { },
+    // Run start reads the skills catalog budget when it records a snapshot.
+    "skills.catalogBudgetChars": () => { },
 };
 /**
  * Environment variables of renamed config keys, with their replacements: warned about once when
@@ -90,6 +103,24 @@ let KernelConfigService = class KernelConfigService {
     get() {
         return this.current;
     }
+    /**
+     * Where the current value of a field without a schema default comes from: `env` when an
+     * environment variable sets it, else the config source (`file` / `nacos`) when it is set at all;
+     * undefined when nothing sets it (a layer below the startup config decides, e.g. the deployment
+     * settings for `sandbox.tiers.*`). Such fields are read-only in the admin console.
+     */
+    fieldSource(path) {
+        if (getPath(this.current, path) === undefined)
+            return undefined;
+        let fromEnv = false;
+        try {
+            fromEnv = getPath(envOverrides(this.env), path) !== undefined;
+        }
+        catch {
+            // conflicting variables fail the start; a later change here only loses the label
+        }
+        return fromEnv ? "env" : configSourceKind(this.env);
+    }
     /** Subscribes to applied changes (hot fields only); returns the unsubscribe function. */
     onChange(listener) {
         this.listeners.add(listener);

package/dist/infra/events/kernel-events.d.ts

@@ -31,7 +31,8 @@ export interface KernelEventMap {
         orgId: string;
         conversationId: string;
         runId: string;
-        status: "approved" | "denied";
+        /** `skipped`: a network ask closed by the run's starter's message (network ask-to-allow §6.7). */
+        status: "approved" | "denied" | "skipped";
     };
     /**
      * A person answered a tool call's input request, or skipped it with a message (after the commit,

package/dist/local-devices/device-policy.service.d.ts

@@ -0,0 +1,65 @@
+import { type DeviceFeature, type DeviceLocalPolicySummary, type DevicePolicyArgs } from "@capybara-hq/plugin-sdk";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { MachinesService } from "./machines.js";
+import { LocalDeviceRelay } from "./relay.js";
+/** How long the machine may take to apply a policy change. */
+export declare const POLICY_DEADLINE_MS = 30000;
+/** What became of a policy change. */
+export type PolicyChangeOutcome = {
+    applied: true;
+    policy: DeviceLocalPolicySummary;
+} | {
+    applied: false;
+    reason: "offline" | "refused" | "unsupported";
+    message: string;
+};
+/**
+ * Changes a local device's policy on its machine (network ask-to-allow spec §5.2; sandbox dev
+ * tiers spec §7.3: its hosts, its `tier`, and `isolation` back to `sandbox`): the kernel→device
+ * `policy` op over the {@link LocalDeviceRelay}. The machine is the authority: it
+ * refuses widening unless its owner allows remote grants, validates every host and answers with
+ * the policy as written, which the kernel then keeps on the active machine's row (§5.4) and
+ * audits as `device.policy_changed`.
+ *
+ * The op is sent outside any transaction (a decision records its outcome afterwards, in its own
+ * transaction); only the summary write and the audit row are transactional. Callers decide who
+ * may change a device's policy (the device owner, in a signed-in session); this service checks
+ * only that the device is a live device of the org.
+ */
+export declare class DevicePolicyService {
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly relay;
+    private readonly machines;
+    private readonly log;
+    constructor(db: KernelDb, txHost: TransactionHost, relay: Pick<LocalDeviceRelay, "call" | "holderLive">, machines: Pick<MachinesService, "activeFor">, log: Pick<KernelLogger, "warn">);
+    /**
+     * Sends the `policy` op (no transaction may be open), stores the returned summary and audits
+     * `device.policy_changed`. Never throws for an offline machine, a refusal or a program without
+     * the `policyOp` feature (nothing is sent to it); a device that is not a live device of `orgId`
+     * is `device.not_found`.
+     */
+    apply(input: {
+        orgId: string;
+        deviceId: string;
+        change: Omit<DevicePolicyArgs, "source">;
+        source: DevicePolicyArgs["source"];
+        actorTokenId?: string;
+    }): Promise<PolicyChangeOutcome>;
+    /** The active machine's features and policy summary (null when no machine is connected). */
+    summary(deviceId: string): Promise<{
+        features: DeviceFeature[];
+        policy: DeviceLocalPolicySummary | null;
+    } | null>;
+    /**
+     * Keeps the policy the machine wrote on its row and audits the change (`confirmed`); with no
+     * policy (the answer never came) only audits the attempt, unconfirmed. The detail's `isolation`
+     * is the one asked for, or the one the machine now reports when it changed (a tier change turns
+     * the sandbox back on).
+     */
+    private record;
+    /** The outcome of a failed op: offline, or the machine's refusal; a deleted device is thrown. */
+    private notApplied;
+}