@capybara-hq/kernel 0.1.0-rc.21 → 0.1.0-rc.23

package/dist/platform/ops/agents.ops.js

@@ -35,11 +35,6 @@ const Def = AgentCreateDefinition.shape;
 /** Every string the model sends is bounded (the route's tool refs and model strings are not). */
 const Short = z.string().min(1).max(200);
 const Model = Def.model.extend({ provider: Short, model: Short }).strict();
-const RouteSkills = Def.skills.unwrap();
-/** `writePolicy` stays the web's; `orgSkills` is required here (the route defaults it to []). */
-const Skills = RouteSkills.pick({ pinned: true })
-    .extend({ orgSkills: RouteSkills.shape.orgSkills.unwrap() })
-    .strict();
 /**
  * Whether `next` sets an `allow` that `current` does not have (decision 2026-11-09: `allow` on a
  * connector tool lets an agent call it without asking). Such a change is confirmed every time and
@@ -61,7 +56,8 @@ const Fields = {
      */
     disabledTools: Def.disabledTools.unwrap(),
     toolPolicies: z.record(Short, Def.toolPolicies.unwrap().valueType),
-    skills: Skills,
+    /** Skills turned off (skills default-on spec §4); `skills.writePolicy` stays the web's. */
+    disabledSkills: Def.disabledSkills.unwrap(),
     subagents: Def.subagents.unwrap(),
 };
 /**
@@ -189,7 +185,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.get",
-                description: "Read one agent you can see with its full definition (description, instructions, model, the tools it turns off (disabledTools: an agent has every tool the org offers except these), tool policies, skills and sub-agents) and its profile (avatar, description, quick actions). Takes the agent id from agents.list.",
+                description: "Read one agent you can see with its full definition (description, instructions, model, the tools it turns off (disabledTools: an agent has every tool the org offers except these), tool policies, the skills it turns off (disabledSkills: an agent has every skill on in the org except these), skills.writePolicy and sub-agents) and its profile (avatar, description, quick actions). Takes the agent id from agents.list.",
                 input: z.object({ agentId: AgentId }).strict(),
                 example: { agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77" },
                 authz: { orgAction: "agents.use" },
@@ -201,7 +197,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.create",
-                description: 'Create a new private agent owned by you, with a name, a model and optionally instructions, disabledTools, tool policies, skills and sub-agents. An agent has every tool the org offers (all built-in tools, the tools of the extensions on in the org and of the org\'s connectors) unless disabledTools turns it off: { kind: "builtin", name }, { kind: "plugin", plugin, tools: "all" | [names] } or { kind: "connector", connectorId, tools: "all" | [names] }. Agents created with the Platform tool are private; sharing an agent with the org or with members is done on the agents page of the web app.',
+                description: 'Create a new private agent owned by you, with a name, a model and optionally instructions, disabledTools, tool policies, disabledSkills and sub-agents. An agent has every tool the org offers (all built-in tools, the tools of the extensions on in the org and of the org\'s connectors) unless disabledTools turns it off: { kind: "builtin", name }, { kind: "plugin", plugin, tools: "all" | [names] } or { kind: "connector", connectorId, tools: "all" | [names] }. Likewise, an agent has every skill on in the org unless disabledSkills turns it off: { kind: "plugin", plugin, skills: "all" | [names] } for skills of a plugin (skills.list gives the plugin of each), or { kind: "skill", skillId } for a skill without a plugin; the skills of builtin plugins (builtin in skills.list) and the own skills of the agent cannot be turned off. Agents created with the Platform tool are private; sharing an agent with the org or with members is done on the agents page of the web app.',
                 input: z
                     .object({
                     definition: z
@@ -211,7 +207,7 @@ let AgentsOperations = class AgentsOperations {
                         model: Fields.model,
                         disabledTools: Fields.disabledTools.optional(),
                         toolPolicies: Fields.toolPolicies.optional(),
-                        skills: Fields.skills.optional(),
+                        disabledSkills: Fields.disabledSkills.optional(),
                         subagents: Fields.subagents.optional(),
                     })
                         .strict(),
@@ -248,7 +244,7 @@ let AgentsOperations = class AgentsOperations {
                         model: d.model,
                         ...(d.disabledTools !== undefined && { disabledTools: d.disabledTools }),
                         ...(d.toolPolicies !== undefined && { toolPolicies: d.toolPolicies }),
-                        ...(d.skills !== undefined && { skills: d.skills }),
+                        ...(d.disabledSkills !== undefined && { disabledSkills: d.disabledSkills }),
                         ...(d.subagents !== undefined && { subagents: d.subagents }),
                     });
                     return this.agents.create(ctx.orgId, ctx.actorAccountId, {
@@ -259,7 +255,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.update",
-                description: 'Change an agent you may edit: your own, private or shared, and as an org admin any agent of the org. Send the version you read from agents.get and only the fields to change; the others keep their value. The description (one short paragraph, "" removes it) is saved with the definition; the avatar and quick actions are changed with agents.update-profile. disabledTools replaces the whole list of turned-off tools (send [] to turn every tool on). A version that is no longer current is refused, so read the agent again first. The visibility cannot be changed here (that is done on the agents page of the web app). A change to your own private agent may be remembered by the person; a change to a shared agent, or one that sets a tool policy to allow, is confirmed every time.',
+                description: 'Change an agent you may edit: your own, private or shared, and as an org admin any agent of the org. Send the version you read from agents.get and only the fields to change; the others keep their value. The description (one short paragraph, "" removes it) is saved with the definition; the avatar and quick actions are changed with agents.update-profile. disabledTools replaces the whole list of turned-off tools (send [] to turn every tool on). disabledSkills replaces the whole list of turned-off skills (send [] to turn every skill on); an agent has every skill on in the org unless disabledSkills turns it off: { kind: "plugin", plugin, skills: "all" | [names] } for skills of a plugin (skills.list gives the plugin of each), or { kind: "skill", skillId } for a skill without a plugin; the skills of builtin plugins (builtin in skills.list) and the own skills of the agent cannot be turned off. A version that is no longer current is refused, so read the agent again first. The visibility cannot be changed here (that is done on the agents page of the web app). A change to your own private agent may be remembered by the person; a change to a shared agent, or one that sets a tool policy to allow, is confirmed every time.',
                 input: z
                     .object({
                     agentId: AgentId,
@@ -270,7 +266,7 @@ let AgentsOperations = class AgentsOperations {
                     model: Fields.model.optional(),
                     disabledTools: Fields.disabledTools.optional(),
                     toolPolicies: Fields.toolPolicies.optional(),
-                    skills: Fields.skills.optional(),
+                    disabledSkills: Fields.disabledSkills.optional(),
                     subagents: Fields.subagents.optional(),
                 })
                     .strict(),
@@ -292,7 +288,7 @@ let AgentsOperations = class AgentsOperations {
                     model: "definition.model",
                     disabledTools: "definition.disabledTools",
                     toolPolicies: "definition.toolPolicies",
-                    skills: "definition.skills",
+                    disabledSkills: "definition.disabledSkills",
                     subagents: "definition.subagents",
                 },
                 confirm: "personal",
@@ -332,7 +328,7 @@ let AgentsOperations = class AgentsOperations {
                         ...(patch.model !== undefined && { model: patch.model }),
                         ...(patch.disabledTools !== undefined && { disabledTools: patch.disabledTools }),
                         ...(patch.toolPolicies !== undefined && { toolPolicies: patch.toolPolicies }),
-                        ...(patch.skills !== undefined && { skills: patch.skills }),
+                        ...(patch.disabledSkills !== undefined && { disabledSkills: patch.disabledSkills }),
                         ...(patch.subagents !== undefined && { subagents: patch.subagents }),
                     };
                     return this.agents.update(ctx.orgId, agentId, ctx.actorAccountId, { definition, expectedVersion: version }, undefined, viaAgent("agents.update", ctx));
@@ -414,7 +410,7 @@ let AgentsOperations = class AgentsOperations {
             }),
             defineOperation({
                 id: "agents.preview-from-template",
-                description: "Preview creating an agent from an agent template: what carries over, what is pending (connectors the org has not set up) or unavailable, the model that would be used, and a previewHash. agents.create-from-template needs that hash.",
+                description: "Preview creating an agent from an agent template: what carries over, what is pending (connectors the org has not set up) or unavailable, the model that would be used, and a previewHash. Each skill the template names is carried when the org has it and unavailable otherwise; the new agent has every skill on in the org except those the template's disallowedSkills turns off. agents.create-from-template needs that hash.",
                 input: AgentFromTemplatePreviewBody,
                 example: { templateId: "5d0c7a52-3a0e-4f0a-bd0a-0f8c3d2a9e10" },
                 authz: { orgAction: "agents.create" },

package/dist/platform/ops/devices.ops.js

@@ -131,7 +131,7 @@ let DevicesOperations = class DevicesOperations {
             }),
             defineOperation({
                 id: "devices.get",
-                description: "Read one of your devices with its source (cloud or local), provider, state, instance, the machine of a local one and whether it is online, limits and creation time. Takes the id from devices.list.",
+                description: "Read one of your devices with its source (cloud or local), provider, state, instance, the machine of a local one and whether it is online, limits, sandbox level (the tier chosen and the one in effect, the highest allowed and why it is lower, whether it runs without a sandbox) and creation time. Takes the id from devices.list. Only the person changes a device's sandbox level, on the web.",
                 input: DeviceId,
                 example: { deviceId: "4e8a0c1d-6b2f-4a37-8d19-3c5e7f9a1b20" },
                 authz: { orgAction: "agents.use" },
@@ -276,6 +276,8 @@ let DevicesOperations = class DevicesOperations {
                 authz: { orgAction: "agents.use" },
                 mirrors: ["PATCH /api/v1/orgs/:orgId/devices/:id"],
                 renames: { deviceId: "id" },
+                // a person decides their device's sandbox level (sandbox dev tiers spec §7.2)
+                omits: ["tier"],
                 confirm: "personal",
                 errors: [
                     {

package/dist/platform/ops/inbox.ops.js

@@ -109,6 +109,25 @@ function orgRow(i) {
                 summary: `Your ${r.kind} request was ${r.status}${r.reason ? `: ${r.reason}` : ""}.`,
             };
         }
+        case "schedule_attention": {
+            const a = i.attention;
+            const summary = a.reason === "missing_grants"
+                ? `Scheduled task "${a.name}" ran without: ${a.missing.join(", ")}.${a.needsRole.length > 0 ? ` Needing a higher role than the owner has (cannot be pre-approved): ${a.needsRole.join(", ")}.` : ""}${a.needsAdmin.length > 0 ? ` Outside the organization's network allowlist (only an org admin can add them): ${a.needsAdmin.join(", ")}.` : ""}${a.deviceRefuses ? " The task's device does not accept network grants; its owner allows domains locally (capybara-device policy add allowedDomains <host>)." : ""}`
+                : a.reason === "failed"
+                    ? `Scheduled task "${a.name}"'s latest run failed${a.error ? `: ${a.error}` : ""}.`
+                    : `Scheduled task "${a.name}" is paused (${a.reason}${a.pausedBy ? ` by ${a.pausedBy.name || a.pausedBy.id}` : ""}).`;
+            return {
+                ...base,
+                name: a.name,
+                state: a.reason,
+                summary,
+                next: a.reason === "missing_grants"
+                    ? "Add the missing tools to the task's approved tools and connect the missing connectors on the web; tools that need a higher role cannot be pre-approved; network domains (network:<host>) are approved only by the person on the task page."
+                    : a.reason === "failed"
+                        ? "Check the run's error and the task's settings; the next good run clears this, and repeated failures pause the task."
+                        : "Resume the task once the cause is fixed.",
+            };
+        }
         default: {
             const n = i.notice;
             return {

package/dist/platform/ops/org-settings.ops.js

@@ -39,7 +39,7 @@ let OrgSettingsOperations = class OrgSettingsOperations {
         this.registry.register([
             defineOperation({
                 id: "org-settings.get",
-                description: "Read this org's settings: toolSearch, locale, sandboxToolPolicy, platformTool (on, read-only or off), sandboxEgress and wakeOnBackgroundTask (absent means it follows the deployment), theme (the org's default theme id, null or absent following the platform, and personal: allowed or locked), uiArrangement (per list slot, the extension contributions the org hides and their order; per single slot, the contribution that replaces the built-in as use, null for the built-in; a slot not listed follows the platform), the deployment's sandbox egress default and the sandbox cpu / memory limits in effect.",
+                description: "Read this org's settings: toolSearch, locale, sandboxToolPolicy, platformTool (on, read-only or off), sandboxEgress, sandboxTier ({ max, default, allowUnsandboxed }: the org's sandbox levels strict < dev < open) and wakeOnBackgroundTask (absent means it follows the deployment), theme (the org's default theme id, null or absent following the platform, and personal: allowed or locked), uiArrangement (per list slot, the extension contributions the org hides and their order; per single slot, the contribution that replaces the built-in as use, null for the built-in; a slot not listed follows the platform), the deployment's sandbox egress default and sandbox tiers, and the sandbox cpu / memory limits in effect.",
                 input: z.object({}).strict(),
                 example: {},
                 authz: { orgAction: "org.read" },
@@ -47,13 +47,13 @@ let OrgSettingsOperations = class OrgSettingsOperations {
                 confirm: "read",
                 run: async (_input, ctx) => ({
                     settings: await this.settings.get(ctx.orgId),
-                    deployment: this.settings.deployment(),
+                    deployment: await this.settings.deployment(),
                     sandboxLimits: await this.settings.sandboxLimits(ctx.orgId),
                 }),
             }),
             defineOperation({
                 id: "org-settings.update",
-                description: "Change this org's settings (org admins). Give only the settings to change; null clears sandboxEgress or wakeOnBackgroundTask so they follow the deployment again. theme: { id, personal } sets the org's default theme (a theme id from themes.list, or null to follow the platform) and whether members may pick their own (allowed) or not (locked); null clears it. uiArrangement: { <slot>: { hidden, order } } (a list slot) or { <slot>: { use } } (a single slot: shell.brand, conversation.empty, conversation.composer.frame) replaces that slot's entry, where hidden, order and use name contribution keys <extension>/<contribution> (hidden ones are not listed in the web UI but their pages still open by URL; use null is the built-in); null for a slot makes it follow the platform again; platform.page is refused. Setting platformTool to off or read-only takes effect from the next call and cuts this Platform tool off in the org, so say so before asking; an org admin switches it back on in the web settings.",
+                description: "Change this org's settings (org admins). Give only the settings to change; null clears sandboxEgress, sandboxTier or wakeOnBackgroundTask so they follow the deployment again. sandboxTier ({ max, default, allowUnsandboxed }, replaced whole) and sandboxEgress may only narrow the org's sandbox here: raising or clearing a tier cap, allowing unsandboxed devices, or adding network hosts is refused and needs a person in the organization settings on the web. theme: { id, personal } sets the org's default theme (a theme id from themes.list, or null to follow the platform) and whether members may pick their own (allowed) or not (locked); null clears it. uiArrangement: { <slot>: { hidden, order } } (a list slot) or { <slot>: { use } } (a single slot: shell.brand, conversation.empty, conversation.composer.frame) replaces that slot's entry, where hidden, order and use name contribution keys <extension>/<contribution> (hidden ones are not listed in the web UI but their pages still open by URL; use null is the built-in); null for a slot makes it follow the platform again; platform.page is refused. Setting platformTool to off or read-only takes effect from the next call and cuts this Platform tool off in the org, so say so before asking; an org admin switches it back on in the web settings.",
                 input: OrgSettingsPatchSchema.refine((i) => Object.values(i).some((v) => v !== undefined), {
                     message: "give at least one setting",
                 }),
@@ -64,7 +64,11 @@ let OrgSettingsOperations = class OrgSettingsOperations {
                 errors: [
                     {
                         code: "org.sandbox_egress_not_allowed",
-                        next: "This deployment disables sandbox network access, so the org can only set sandboxEgress to none; ask the super admin to change sandbox.limits.egress.",
+                        next: "Through this tool the org's sandbox network may only be narrowed (no new hosts, not back from none); if the deployment disables sandbox network access, sandboxEgress can only be none. To widen it, ask an org admin to change it in the organization settings on the web.",
+                    },
+                    {
+                        code: "org.sandbox_tier_not_allowed",
+                        next: "Through this tool the org's sandbox level may only be lowered, never above the platform's sandbox.tiers (org-settings.get shows both); to raise it, ask an org admin to change it in the organization settings on the web.",
                     },
                     {
                         code: "theme.not_available",
@@ -75,7 +79,10 @@ let OrgSettingsOperations = class OrgSettingsOperations {
                         next: "Fix the setting as the message says (org-settings.get shows the current values).",
                     },
                 ],
-                precheck: (i) => precheckBy(async () => this.settings.check(i)),
+                precheck: (i, ctx) => precheckBy(async () => {
+                    await this.settings.check(i);
+                    await this.settings.assertOnlyNarrows(await this.settings.get(ctx.orgId), i);
+                }),
                 summary: async (i, ctx) => {
                     const { theme, ...rest } = i;
                     const parts = Object.entries(rest)
@@ -108,7 +115,9 @@ let OrgSettingsOperations = class OrgSettingsOperations {
                     };
                 },
                 run: async (input, ctx) => {
-                    const settings = await this.settings.update(ctx.orgId, input, ctx.actorAccountId, undefined, viaAgent("org-settings.update", ctx));
+                    const settings = await this.settings.update(ctx.orgId, input, ctx.actorAccountId, undefined, viaAgent("org-settings.update", ctx), 
+                    // a person widens the sandbox, never an agent (sandbox dev tiers spec §7.2)
+                    { onlyNarrows: true });
                     const note = input.platformTool === undefined
                         ? undefined
                         : PLATFORM_TOOL_NOTE[settings.platformTool];

package/dist/platform/ops/orgs.ops.js

@@ -161,6 +161,7 @@ let OrgsOperations = class OrgsOperations {
                     "uiTheme",
                     "uiArrangement",
                     "clientExtensions",
+                    "sandboxTiers",
                 ],
                 extras: ["orgId", "runConcurrency", "sandbox", "subagents"],
                 confirm: "platform",

package/dist/platform/ops/platform.ops.d.ts

@@ -1,6 +1,7 @@
 import { type OnModuleInit } from "@nestjs/common";
 import { AgentsService } from "../../agents/agents.service.js";
 import { AccountsService } from "../../identity/accounts.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
 import { OrgSettingsService } from "../../orgs/settings.service.js";
 import { ThemesService } from "../../themes/themes.service.js";
 import { ToolRegistry } from "../../tools/registry.js";
@@ -18,7 +19,14 @@ export declare class PlatformOperationsProvider implements OnModuleInit {
     private readonly tools;
     private readonly accounts;
     private readonly themes;
-    constructor(registry: PlatformOperations, actor: PlatformActor, agents: AgentsService, settings: OrgSettingsService, tools: ToolRegistry, accounts: AccountsService, themes: ThemesService);
+    private readonly db;
+    constructor(registry: PlatformOperations, actor: PlatformActor, agents: AgentsService, settings: OrgSettingsService, tools: ToolRegistry, accounts: AccountsService, themes: ThemesService, db: KernelDb);
+    /**
+     * The skills in the agent's catalog now, by the names a run's catalog lists them, each with its
+     * plugin (skills default-on spec §11): the resolver's result for this conversation, as the next
+     * run start would snapshot it (manual-only skills are not in the catalog).
+     */
+    private skillNames;
     /**
      * The agent's tools by the keys the model sees, as the registry resolves them for a run (tools
      * default-on spec §8): every tool the org offers that the definition does not turn off, builtins

package/dist/platform/ops/platform.ops.js

@@ -12,8 +12,10 @@ import { z } from "zod";
 import { AgentsService } from "../../agents/agents.service.js";
 import { AccountsService } from "../../identity/accounts.js";
 import { PreferencesSchema } from "../../identity/me.schemas.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
 import { can } from "../../orgs/roles.js";
-import { effectiveSandboxEgress, OrgSettingsService } from "../../orgs/settings.service.js";
+import { OrgSettingsService } from "../../orgs/settings.service.js";
+import { resolveEffectiveSkills } from "../../skills/catalog.js";
 import { ThemesService } from "../../themes/themes.service.js";
 import { SANDBOX_TOOL_NAMES } from "../../tools/builtin-names.js";
 import { ToolRegistry } from "../../tools/registry.js";
@@ -49,7 +51,8 @@ let PlatformOperationsProvider = class PlatformOperationsProvider {
     tools;
     accounts;
     themes;
-    constructor(registry, actor, agents, settings, tools, accounts, themes) {
+    db;
+    constructor(registry, actor, agents, settings, tools, accounts, themes, db) {
         this.registry = registry;
         this.actor = actor;
         this.agents = agents;
@@ -57,6 +60,21 @@ let PlatformOperationsProvider = class PlatformOperationsProvider {
         this.tools = tools;
         this.accounts = accounts;
         this.themes = themes;
+        this.db = db;
+    }
+    /**
+     * The skills in the agent's catalog now, by the names a run's catalog lists them, each with its
+     * plugin (skills default-on spec §11): the resolver's result for this conversation, as the next
+     * run start would snapshot it (manual-only skills are not in the catalog).
+     */
+    async skillNames(ctx, d) {
+        const skills = await resolveEffectiveSkills(this.db.db, {
+            orgId: ctx.orgId,
+            agentId: ctx.agentId,
+            agent: { disabledSkills: d.disabledSkills ?? [] },
+            conversationId: ctx.conversationId,
+        });
+        return skills.map((s) => ({ name: s.name, plugin: s.plugin ?? null }));
     }
     /**
      * The agent's tools by the keys the model sees, as the registry resolves them for a run (tools
@@ -114,7 +132,7 @@ let PlatformOperationsProvider = class PlatformOperationsProvider {
             }),
             defineOperation({
                 id: "platform.me",
-                description: "Show this agent as configured: its model, the tools it has now by the keys you call them by (every tool the org offers unless the agent turns it off; connector tools as mcp__<connector>__<tool>, with those that cannot load now and why), the tools it turns off (disabledTools), skills (org and pinned), sub-agents, whether it runs in a sandbox, the sandbox network mode, and its profile (avatar, description, quick actions). Secrets are never shown.",
+                description: "Show this agent as configured: its model, the tools it has now by the keys you call them by (every tool the org offers unless the agent turns it off; connector tools as mcp__<connector>__<tool>, with those that cannot load now and why), the tools it turns off (disabledTools), the skills in its catalog now by name with their plugin (every skill on in the org unless the agent turns it off, its own and builtin plugins' skills always; manual-only skills are not in the catalog), the skills it turns off (disabledSkills), sub-agents, whether it runs in a sandbox, the sandbox level (tier) and network mode of a new device, and its profile (avatar, description, quick actions). Secrets are never shown.",
                 input: EMPTY,
                 example: {},
                 authz: { orgAction: "agents.use" },
@@ -123,11 +141,14 @@ let PlatformOperationsProvider = class PlatformOperationsProvider {
                 run: async (_input, ctx) => {
                     const agent = await this.agents.get(ctx.orgId, ctx.agentId, ctx.actorAccountId);
                     const d = agent.definition;
-                    const { keys: toolKeys, unavailable } = await this.toolKeys(ctx.orgId, d);
+                    const [{ keys: toolKeys, unavailable }, skills] = await Promise.all([
+                        this.toolKeys(ctx.orgId, d),
+                        this.skillNames(ctx, d),
+                    ]);
                     const sandbox = toolKeys.some((k) => SANDBOX_TOOL_NAMES.includes(k));
                     const org = await this.settings.get(ctx.orgId);
-                    const dep = this.settings.deployment().sandboxEgress;
-                    const egress = effectiveSandboxEgress({ egress: dep.mode, allowHosts: dep.allowHosts }, org.sandboxEgress);
+                    // a new device's level: the org's default tier and its network
+                    const policy = await this.settings.sandboxPolicy(org, null);
                     return {
                         id: agent.id,
                         name: d.name,
@@ -139,12 +160,12 @@ let PlatformOperationsProvider = class PlatformOperationsProvider {
                         ...(unavailable.length > 0 && { unavailableTools: unavailable }),
                         disabledTools: d.disabledTools ?? [],
                         toolPolicies: d.toolPolicies,
-                        skills: {
-                            orgSkills: d.skills?.orgSkills ?? [],
-                            pinned: d.skills?.pinned ?? [],
-                        },
+                        skills,
+                        disabledSkills: d.disabledSkills ?? [],
                         subagents: d.subagents ?? null,
-                        sandbox: sandbox ? { enabled: true, egress: egress.egress } : { enabled: false },
+                        sandbox: sandbox
+                            ? { enabled: true, tier: policy.tier, egress: policy.egress }
+                            : { enabled: false },
                         profile: {
                             avatar: agent.profile.avatar,
                             description: agent.profile.description,
@@ -226,6 +247,7 @@ PlatformOperationsProvider = __decorate([
     __param(3, Inject(OrgSettingsService)),
     __param(4, Inject(ToolRegistry)),
     __param(5, Inject(AccountsService)),
-    __param(6, Inject(ThemesService))
+    __param(6, Inject(ThemesService)),
+    __param(7, Inject(KernelDb))
 ], PlatformOperationsProvider);
 export { PlatformOperationsProvider };

package/dist/platform/ops/requests.ops.js

@@ -23,6 +23,7 @@ const view = (r) => ({
     item: r.item,
     entry: r.entry,
     agent: r.agent,
+    network: r.network,
     note: r.note,
     reason: r.reason,
     decidedAt: r.decidedAt,
@@ -40,7 +41,7 @@ const platformRow = (r) => ({
 /** A member's pending request as the org admins' list shows it: a compact row (the inbox's). */
 const pendingRow = (r) => ({
     id: r.id,
-    name: r.item?.name ?? r.entry?.name ?? r.agent?.name ?? r.kind,
+    name: r.item?.name ?? r.entry?.name ?? r.agent?.name ?? r.network?.hosts.join(", ") ?? r.kind,
     state: r.status,
     kind: r.kind,
     requestedBy: r.requestedByName,
@@ -153,7 +154,7 @@ let RequestsOperations = class RequestsOperations {
             }),
             defineOperation({
                 id: "requests.pending",
-                description: "List the requests members sent this org's admins that wait for a decision (org admins), as the inbox shows them, newest first: kind enable (switch a plugin on) or connector_setup (set up an agent's connectors), what it is about (the plugin or the agent), who asked and their note. Deciding them is done on the web. Pages by 50: pass the returned next as params.cursor.",
+                description: "List the requests members sent this org's admins that wait for a decision (org admins), as the inbox shows them, newest first: kind enable (switch a plugin on), connector_setup (set up an agent's connectors) or network_allowlist (allow hosts in the org's sandbox network), what it is about (the plugin, the agent or the hosts), who asked and their note. Deciding them is done on the web. Pages by 50: pass the returned next as params.cursor.",
                 input: z.object({ cursor: Cursor.optional() }).strict(),
                 example: {},
                 authz: { orgAction: "catalog.decide" },

package/dist/platform/ops/schedules.ops.d.ts

@@ -0,0 +1,21 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { ScheduledTasksService } from "../../schedules/scheduled-tasks.service.js";
+import { PlatformOperations } from "../registry.js";
+/**
+ * Scheduled-task operations of the `Platform` tool (scheduled tasks spec §10): the same service
+ * as the HTTP routes. Writes are `personal`. Creating or changing a task and its approved tools
+ * are never remembered (`rememberable: false`): an approval, remembered or granted to a task,
+ * must never let an unattended run create or widen a task. Delete, run and resume are never
+ * remembered either. List, pause and delete are `org.read` like their routes: a creator demoted
+ * to guest can still see and stop their own tasks (the service decides by ownership).
+ */
+export declare class SchedulesOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly tasks;
+    constructor(registry: PlatformOperations, tasks: ScheduledTasksService);
+    /** The caller as the service expects (it reads the live role itself). */
+    private actor;
+    /** The task's name for a card; its id when it cannot be read. */
+    private label;
+    onModuleInit(): void;
+}