@capybara-hq/kernel 0.1.0-rc.21 → 0.1.0-rc.23

package/dist/skills/usable.js

@@ -1,4 +1,5 @@
-import { componentOn } from "../catalog/component-state.js";
+import { skillDisabled } from "../agents/definition.js";
+import { componentOn, platformBuiltin } from "../catalog/component-state.js";
 /** The `source` prefix of a platform skill version in a snapshot or an invocation record. */
 export const PLATFORM_SOURCE = "platform:";
 /** The snapshot `source` of a platform skill version stored at `prefix` (in `deployment/`). */
@@ -38,6 +39,9 @@ async function platformRowsOn(db, orgId, ids) {
         "c.id as item_id",
         "c.disabled as item_disabled",
         "c.builtin as item_builtin",
+        "c.owner_org_id as item_owner",
+        "p.owner_org_id",
+        "p.shareable",
         eb
             .exists(eb
             .selectFrom("plugin_installs as a")
@@ -66,18 +70,28 @@ async function platformRowsOn(db, orgId, ids) {
         .where("p.disabled", "=", false);
     if (ids !== undefined)
         q = q.where("p.id", "in", [...ids]);
+    // the share gate (ruling P3-1, as `usableBy` in catalog/ownership.ts): another org's skill
+    // while its owner shares it, or while this org is associated with it (listed, its plugin
+    // installed here, or switched on here: an org keeps what it has when sharing stops, P3-16)
+    const gate = (r) => r.owner_org_id === null ||
+        r.owner_org_id === orgId ||
+        r.shareable ||
+        Boolean(r.listed) ||
+        Boolean(r.installed) ||
+        r.switch === true;
     // the predicate of component scope (catalog/component-state.ts); `disabled` is filtered above
-    return (await q.execute()).filter((r) => componentOn({ scopeMode: r.scope_mode, scope: r.scope, disabled: false, itemId: r.catalog_item_id }, r.catalog_item_id === null
-        ? null
-        : {
-            live: r.item_id !== null,
-            disabled: r.item_disabled === true,
-            builtin: r.item_builtin === true,
-            // the plugin's own scope and list do not decide whether a component is on
-            scope: "optional",
-            listed: false,
-            installed: Boolean(r.installed),
-        }, Boolean(r.listed), r.switch ?? null));
+    return (await q.execute()).filter((r) => gate(r) &&
+        componentOn({ scopeMode: r.scope_mode, scope: r.scope, disabled: false, itemId: r.catalog_item_id }, r.catalog_item_id === null
+            ? null
+            : {
+                live: r.item_id !== null,
+                disabled: r.item_disabled === true,
+                builtin: platformBuiltin({ builtin: r.item_builtin, owner_org_id: r.item_owner }),
+                // the plugin's own scope and list do not decide whether a component is on
+                scope: "optional",
+                listed: false,
+                installed: Boolean(r.installed),
+            }, Boolean(r.listed), r.switch ?? null));
 }
 /**
  * The ids among `ids` of the platform skills on in the org (see {@link platformOn}), whatever the
@@ -114,7 +128,9 @@ export async function pinnedSkillLinksServed(db, orgId, ids) {
  * - `own`: `wantedOn` over the skill's own scope, the org's list membership and its switch.
  * One query for the skills with their plugin and org state, one for the org's names.
  */
-async function platformOn(db, orgId, ids, log) {
+async function platformOn(db, orgId, ids, log, 
+/** Ids nobody selected (builtin skills): their shadowing is logged at `debug`. */
+quiet = new Set()) {
     const rows = await platformRowsOn(db, orgId, ids);
     if (rows.length === 0)
         return [];
@@ -143,12 +159,12 @@ async function platformOn(db, orgId, ids, log) {
             const sameComponent = o.platform_skill_id === r.id ||
                 (o.catalog_item_id !== null && o.catalog_item_id === r.catalog_item_id);
             if (!sameComponent) {
-                log?.warn("platform skill shadowed by an org skill of the same name", {
-                    orgId,
-                    name: r.name,
-                    platformSkillId: r.id,
-                    skillId: o.id,
-                });
+                const fields = { orgId, name: r.name, platformSkillId: r.id, skillId: o.id };
+                const msg = "platform skill shadowed by an org skill of the same name";
+                if (quiet.has(r.id))
+                    log?.debug?.(msg, fields);
+                else
+                    log?.warn(msg, fields);
             }
             continue;
         }
@@ -187,7 +203,9 @@ async function platformOn(db, orgId, ids, log) {
  * while the platform skill is on in the org; a pinned copy as its own version, while its platform
  * skill is on in the org (ruling P2-18); a platform skill id while it is on in the org.
  */
-export async function skillVersionsById(db, orgId, ids, log) {
+export async function skillVersionsById(db, orgId, ids, log, 
+/** Ids nobody selected (builtin skills): a name clash of theirs is logged at `debug`. */
+quiet = new Set()) {
     const unique = [...new Set(ids)];
     const out = new Map();
     if (unique.length === 0)
@@ -222,7 +240,7 @@ export async function skillVersionsById(db, orgId, ids, log) {
             ...linked.map((r) => r.platform_skill_id),
         ]),
     ];
-    const platform = new Map((await platformOn(db, orgId, platformIds, log)).map((p) => [p.id, p]));
+    const platform = new Map((await platformOn(db, orgId, platformIds, log, quiet)).map((p) => [p.id, p]));
     const owned = await ownedPlatformIds(db, orgId, linked.map((r) => r.platform_skill_id));
     // ruling P2-18: a pinned copy serves its own version while its platform skill is on in the org
     const pinnedOn = await pinnedSkillLinksServed(db, orgId, pinned.map((r) => r.platform_skill_id));
@@ -285,33 +303,149 @@ async function ownedPlatformIds(db, orgId, platformIds) {
     return new Set(rows.map((r) => r.id));
 }
 /**
- * The skills an agent selects, sorted by id: its own skills (`scope = 'agent'`), the org skills
- * it shared (`origin_agent_id`: the agent keeps a shared skill without a definition change) and
- * the ids of `orgSkills` that resolve ({@link skillVersionsById}: org skills, linked copies,
- * platform skills on in the org). Not deduplicated by name.
+ * The skill ids no agent can turn off (skill authoring spec §5.7, skills default-on spec §3): the
+ * live platform skills of the platform's builtin plugins (`catalog_items.builtin`, platform-owned),
+ * plus the org's pinned copies of them (a pinned copy shadows its platform skill by name, ruling
+ * P2-18). Whether each is on in the org (a component switch, the deployment's disable) is left to
+ * the resolvers.
  */
-export async function selectedSkills(db, a, log) {
-    const agentOwn = await db
+export async function builtinSkillIds(db, orgId) {
+    const platform = await db
+        .selectFrom("platform_skills as p")
+        .innerJoin("catalog_items as c", "c.id", "p.catalog_item_id")
+        .select("p.id")
+        .where("c.builtin", "=", true)
+        .where("c.owner_org_id", "is", null)
+        .where("c.deleted_at", "is", null)
+        .where("p.owner_org_id", "is", null)
+        .where("p.deleted_at", "is", null)
+        .where("p.disabled", "=", false)
+        .execute();
+    if (platform.length === 0)
+        return [];
+    const ids = platform.map((r) => r.id);
+    const pinnedCopies = await db
         .selectFrom("skills")
         .select("id")
-        .where("org_id", "=", a.orgId)
-        .where("scope", "=", "agent")
-        .where("agent_id", "=", a.agentId)
+        .where("org_id", "=", orgId)
+        .where("scope", "=", "org")
+        .where("deleted_at", "is", null)
+        .where("pinned_version", "is not", null)
+        .where("platform_skill_id", "in", ids)
+        .execute();
+    return [...ids, ...pinnedCopies.map((r) => r.id)];
+}
+/**
+ * The names of the platform's builtin plugins (`catalog_items.builtin`, platform-owned, live): their
+ * skills are always on, and an agent cannot turn them off (skills default-on spec §3).
+ */
+export async function builtinSkillPlugins(db) {
+    const rows = await db
+        .selectFrom("catalog_items")
+        .select("name")
+        .where("builtin", "=", true)
+        .where("owner_org_id", "is", null)
         .where("deleted_at", "is", null)
         .execute();
-    const shared = await db
+    return new Set(rows.map((r) => r.name));
+}
+/**
+ * The ids of the skills an agent always has, whatever its `disabledSkills` say: its own skills
+ * (`scope = 'agent'`) and the org skills it shared (`origin_agent_id`: the agent keeps a shared
+ * skill without a definition entry).
+ */
+export async function agentOwnSkillIds(db, a) {
+    const rows = await db
         .selectFrom("skills")
-        .select("id")
+        .select(["id", "scope"])
         .where("org_id", "=", a.orgId)
+        .where("deleted_at", "is", null)
+        .where((eb) => eb.or([
+        eb.and([eb("scope", "=", "agent"), eb("agent_id", "=", a.agentId)]),
+        eb.and([eb("scope", "=", "org"), eb("origin_agent_id", "=", a.agentId)]),
+    ]))
+        .execute();
+    return {
+        own: rows.filter((r) => r.scope === "agent").map((r) => r.id),
+        shared: rows.filter((r) => r.scope === "org").map((r) => r.id),
+    };
+}
+/**
+ * The org's copies linked to the platform skills `platformIds` without a pin (ruling B2), by
+ * platform skill id (the first by id when there are several): such a copy keeps its own id in an
+ * agent's catalog, as when it was selected, so the snapshot does not change when a copy gets
+ * linked.
+ */
+export async function linkedCopyIds(db, orgId, platformIds) {
+    const linked = new Map();
+    if (platformIds.length === 0)
+        return linked;
+    const copies = await db
+        .selectFrom("skills")
+        .select(["id", "platform_skill_id"])
+        .where("org_id", "=", orgId)
         .where("scope", "=", "org")
-        .where("origin_agent_id", "=", a.agentId)
         .where("deleted_at", "is", null)
+        .where("pinned_version", "is", null)
+        .where("platform_skill_id", "in", [...platformIds])
+        .orderBy("id")
         .execute();
-    const orgSkills = new Set([...a.orgSkills, ...shared.map((r) => r.id)]);
-    const byId = await skillVersionsById(db, a.orgId, [...agentOwn.map((r) => r.id), ...orgSkills], log);
-    return [...byId.values()]
-        .filter((r) => (r.scope === "agent" ? r.agentId === a.agentId : orgSkills.has(r.id)))
-        .sort((x, y) => (x.id < y.id ? -1 : x.id > y.id ? 1 : 0));
+    for (const c of copies) {
+        const pid = c.platform_skill_id;
+        if (!linked.has(pid))
+            linked.set(pid, c.id);
+    }
+    return linked;
+}
+/**
+ * The ids a disabled skill entry may name for `r`: its own, the platform skill it serves and the
+ * org's linked copy listed under it (`linked`, from {@link linkedCopyIds}).
+ */
+export function skillIdsOf(r, linked) {
+    const ids = new Set([r.id]);
+    if (r.platformSkillId !== undefined)
+        ids.add(r.platformSkillId);
+    const copy = linked.get(r.id);
+    if (copy !== undefined)
+        ids.add(copy);
+    return [...ids];
+}
+/**
+ * The skills an agent has (skills default-on spec §3), sorted by id: its own skills, the org
+ * skills it shared, and every skill on in the org ({@link usableSkillVersions}) minus what
+ * `disabledSkills` turns off. A plugin entry matches a skill's `plugin` and name, a skill entry its
+ * id (or the platform skill a copy serves). The skills of builtin plugins, the agent's own and its
+ * shared ones are never turned off. Not deduplicated by name (`resolveSkills` ranks).
+ */
+export async function agentSkills(db, a, log) {
+    const { own, shared } = await agentOwnSkillIds(db, a);
+    const always = await skillVersionsById(db, a.orgId, [...own, ...shared], log);
+    const out = new Map();
+    for (const r of always.values()) {
+        if (r.scope === "agent" ? r.agentId === a.agentId : true)
+            out.set(r.id, r);
+    }
+    const usable = await usableSkillVersions(db, a.orgId, log);
+    // a linked copy keeps its own id in the catalog (see linkedCopyIds)
+    const linked = await linkedCopyIds(db, a.orgId, usable.flatMap((r) => (r.origin === "platform" ? [r.id] : [])));
+    const builtin = a.disabledSkills.length === 0 ? new Set() : await builtinSkillPlugins(db);
+    const builtinIds = a.disabledSkills.length === 0 ? new Set() : new Set(await builtinSkillIds(db, a.orgId));
+    for (const r of usable) {
+        if (out.has(r.id))
+            continue;
+        const ids = skillIdsOf(r, linked);
+        const fixed = (r.plugin !== null && builtin.has(r.plugin) && r.origin === "platform") ||
+            ids.some((id) => builtinIds.has(id));
+        if (!fixed && skillDisabled(a.disabledSkills, { plugin: r.plugin, name: r.name, ids })) {
+            continue;
+        }
+        const copy = linked.get(r.id);
+        if (copy === undefined)
+            out.set(r.id, r);
+        else if (!out.has(copy))
+            out.set(copy, { ...r, id: copy });
+    }
+    return [...out.values()].sort((x, y) => (x.id < y.id ? -1 : x.id > y.id ? 1 : 0));
 }
 /**
  * The org's usable skills, sorted by name: its own live org skills (`scope = 'org'`, unlinked, or

package/dist/tools/approvals.controller.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import { type ApprovalRecord, ApprovalsService, type ApprovalView, type ToolGrantView } from "./approvals.service.js";
+import { type ApprovalPublicRecord, ApprovalsService, type ApprovalView, type ToolGrantView } from "./approvals.service.js";
 declare const ListQuery: z.ZodObject<{
     status: z.ZodOptional<z.ZodEnum<{
         approved: "approved";
@@ -9,6 +9,7 @@ declare const ListQuery: z.ZodObject<{
         denied: "denied";
         expired: "expired";
         pending: "pending";
+        skipped: "skipped";
     }>>;
 }, z.core.$strict>;
 declare const DecisionBody: z.ZodObject<{
@@ -23,6 +24,7 @@ declare const DecisionBody: z.ZodObject<{
     }>>;
     note: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
+    hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 /**
  * 工具调用审批（`/api/v1/orgs/:orgId/approvals`，`approvals.decide`：访客起、仅限用户主体——agent 不能审批，R2）。
@@ -38,7 +40,7 @@ export declare class ApprovalsController {
         approval: ApprovalView;
     }>;
     decide(principal: Principal, org: OrgContext, id: string, body: z.infer<typeof DecisionBody>): Promise<{
-        approval: ApprovalRecord;
+        approval: ApprovalPublicRecord;
     }>;
 }
 /** 本人的「以后都允许」授权（`/api/v1/orgs/:orgId/me/tool-grants`）：查看与撤销，只动自己的。 */

package/dist/tools/approvals.controller.js

@@ -9,13 +9,14 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Controller, Delete, Get, HttpCode, Inject, Param, Post } from "@nestjs/common";
 import { z } from "zod";
+import { NETWORK_ASK_MAX_HOSTS, NETWORK_HOST_MAX_CHARS } from "../conversations/events.js";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
 import { CONTROL_OR_HIDDEN_RE } from "../text.js";
 import { ApprovalsListQuerySchema } from "./approvals.schemas.js";
-import { APPROVAL_DENY_REASON_MAX_CHARS, ApprovalsService, } from "./approvals.service.js";
+import { APPROVAL_DENY_REASON_MAX_CHARS, ApprovalsService, publicRecord, } from "./approvals.service.js";
 const ListQuery = ApprovalsListQuerySchema;
 const DecisionBody = z
     .object({
@@ -32,11 +33,24 @@ const DecisionBody = z
         .max(APPROVAL_DENY_REASON_MAX_CHARS)
         .refine((r) => !CONTROL_OR_HIDDEN_RE.test(r.replace(/[\n\t]/g, " ")), "reason must not contain control or format characters")
         .optional(),
+    /**
+     * A network ask only: the hosts allowed, a subset of those asked (absent: all of them); the
+     * others count as denied.
+     */
+    hosts: z
+        .array(z.string().min(1).max(NETWORK_HOST_MAX_CHARS))
+        .min(1)
+        .max(NETWORK_ASK_MAX_HOSTS)
+        .optional(),
 })
     .strict()
     .refine((b) => b.reason === undefined || b.decision === "deny", {
     path: ["reason"],
     message: "A reason can only be given with deny",
+})
+    .refine((b) => b.hosts === undefined || b.decision === "approve", {
+    path: ["hosts"],
+    message: "Hosts can only be given with approve",
 });
 class ApprovalsListQuery extends createZodDto(ListQuery, "ApprovalsListQuery") {
 }
@@ -61,8 +75,9 @@ let ApprovalsController = class ApprovalsController {
     }
     async decide(principal, org, id, body) {
         const p = requireUser(principal);
+        // a network ask's kept command result stays in the kernel
         return {
-            approval: await this.approvals.decide(org.orgId, id, p.account.id, body, patTokenId(p)),
+            approval: publicRecord(await this.approvals.decide(org.orgId, id, p.account.id, body, patTokenId(p), "web")),
         };
     }
 };

package/dist/tools/approvals.schemas.d.ts

@@ -8,6 +8,7 @@ export declare const ApprovalsListQuerySchema: z.ZodObject<{
         denied: "denied";
         expired: "expired";
         pending: "pending";
+        skipped: "skipped";
     }>>;
 }, z.core.$strict>;
 /** `:id` of `GET /approvals/:id`, as the route takes it (`@Param`). */

package/dist/tools/approvals.schemas.js

@@ -1,7 +1,9 @@
 import { z } from "zod";
 /** `GET /approvals?status=`: absent lists every status. */
 export const ApprovalsListQuerySchema = z
-    .object({ status: z.enum(["pending", "approved", "denied", "expired", "cancelled"]).optional() })
+    .object({
+    status: z.enum(["pending", "approved", "denied", "expired", "cancelled", "skipped"]).optional(),
+})
     .strict();
 /** `:id` of `GET /approvals/:id`, as the route takes it (`@Param`). */
 export const ApprovalPathParams = z.object({ id: z.string() });

package/dist/tools/approvals.service.d.ts

@@ -1,16 +1,68 @@
-import { type LocalizedName } from "@capybara-hq/plugin-sdk";
+import { type LocalizedName, type ToolDisplay } from "@capybara-hq/plugin-sdk";
 import { EventLog } from "../conversations/event-log.js";
+import { type ToolView } from "../conversations/events.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import { DevicePolicyService } from "../local-devices/device-policy.service.js";
 import { type OrgRole } from "../orgs/roles.js";
+import { SandboxService } from "../sandbox/sandbox.service.js";
+import { ScheduledTaskStore } from "../schedules/store.js";
 import type { ApprovalPolicySource } from "./pipeline.js";
+import { ToolRegistry } from "./registry.js";
 export { APPROVAL_DENY_REASON_MAX_CHARS } from "../conversations/events.js";
 /** `list` 一次最多返回的审批数（收件箱据此判断这个来源是否取满）。 */
 export declare const APPROVALS_LIST_MAX = 100;
-export type ApprovalStatus = "pending" | "approved" | "denied" | "expired" | "cancelled";
+export type ApprovalStatus = "pending" | "approved" | "denied" | "expired" | "cancelled" | "skipped";
 export type ApprovalScope = "once" | "session" | "always";
+/** What an approval asks: a tool call, or the device owner about refused network hosts. */
+export type ApprovalKind = "tool" | "network";
+/**
+ * A network ask's `detail` (network ask-to-allow spec §6.1, P-D2): the device, the refused hosts,
+ * the command and its kept `tool_result` (written with a note when the ask settles; the command is
+ * never run again), and once approved what took effect.
+ */
+export interface NetworkAskDetail {
+    deviceId: string;
+    hosts: {
+        host: string;
+        port: number;
+    }[];
+    command: string;
+    description: string | null;
+    /**
+     * The formatted `tool_result` of the command (≤ 16 KB; larger output already archived), and the
+     * display-only fields the pipeline writes with it when the ask settles.
+     */
+    result: {
+        content: string;
+        isError: boolean;
+        outputId?: string;
+        contentTypes?: string[];
+        display?: ToolDisplay;
+        view?: ToolView;
+    };
+    /** The hosts the decision allowed (every approved decision writes them; none: nothing). */
+    grantedHosts?: string[];
+    /** What took effect: a run grant, the device's policy, or a run grant because the device did not apply it. */
+    /**
+     * What took effect: a run grant (`once`), the device's policy (`always`), a run grant because
+     * the device could not be reached or lacks the feature (`once_fallback`), or nothing because the
+     * device refused the change (`refused`: its owner takes no remote grants; no run grant either).
+     */
+    outcome?: "once" | "always" | "once_fallback" | "refused";
+    /** Why 「一直允许」 did not reach the device's policy. */
+    fallback?: "offline" | "refused" | "unsupported";
+}
+/** A network ask's detail as the API shows it: without the kept command result. */
+export type NetworkAskView = Omit<NetworkAskDetail, "result">;
+/**
+ * The model-visible note written after a network ask's kept result when its run is stopped before
+ * the device owner answered (spec §6.7).
+ */
+export declare const NETWORK_ASK_CANCELLED_NOTE = "[network] The run was stopped before the user answered; access stays blocked.";
 /** 一条审批记录。 */
 export interface ApprovalRecord {
     id: string;
@@ -20,6 +72,10 @@ export interface ApprovalRecord {
     callId: string;
     /** 同一调用的第几次审批（从 1 起；工具定义变化后重新审批时递增）。 */
     attempt: number;
+    /** `network`: a network ask (its tool key is `Bash`, its facts in {@link detail}). */
+    kind: ApprovalKind;
+    /** A network ask's hosts, command, kept result and outcome; null for a tool approval. */
+    detail: NetworkAskDetail | null;
     toolKey: string;
     specHash: string;
     connectorId: string | null;
@@ -45,8 +101,14 @@ export interface ApprovalRecord {
     expiresAt: string;
     createdAt: string;
 }
+/** An approval as a route answers it: a network ask's detail without the kept command result. */
+export interface ApprovalPublicRecord extends Omit<ApprovalRecord, "detail"> {
+    detail: NetworkAskView | null;
+}
+/** The record without a network ask's kept command result (what routes and cards may show). */
+export declare function publicRecord(r: ApprovalRecord): ApprovalPublicRecord;
 /** 审批详情（列表与详情接口返回）。 */
-export interface ApprovalView extends ApprovalRecord {
+export interface ApprovalView extends ApprovalPublicRecord {
     /** 来源内的工具原名（连接器工具为连接器里的名字；否则同 `toolKey`）。 */
     toolName: string;
     connector: {
@@ -108,7 +170,30 @@ export interface DecisionInput {
     note?: string | undefined;
     /** Only with `deny` (trimmed, 1–500 characters; checked by the route). */
     reason?: string | undefined;
+    /**
+     * A network ask's approval only: the hosts allowed, a subset of those asked (absent: all); the
+     * unchecked ones count as denied (P-D5).
+     */
+    hosts?: string[] | undefined;
+}
+/** Where a decision was made (the device's local audit line and `device.network_*`). */
+export type DecisionVia = "web" | "im";
+/** A new network ask (network ask-to-allow spec §6.2), made by the tool pipeline. */
+export interface NetworkAskInput {
+    orgId: string;
+    conversationId: string;
+    runId: string;
+    /** The call's step (written to `approval_requested`). */
+    step: number;
+    callId: string;
+    /** The device owner: the only person who may decide. */
+    requestedFor: string;
+    detail: Omit<NetworkAskDetail, "grantedHosts" | "outcome" | "fallback">;
+    /** `["once", "always"]`, or `["once"]` when the device takes no remote grants. */
+    scopes: ("once" | "always")[];
 }
+/** The tool key a network ask is recorded under (the command ran in `Bash`). */
+export declare const NETWORK_ASK_TOOL_KEY = "Bash";
 /** 「以后都允许」授权（本人可撤销）。 */
 export interface ToolGrantView {
     agentId: string;
@@ -132,13 +217,39 @@ export declare class ApprovalsService {
     private readonly eventLog;
     private readonly events;
     readonly txHost: TransactionHost;
-    constructor(db: KernelDb, config: Pick<KernelConfigService, "get">, eventLog: Pick<EventLog, "appendIn" | "notify">, events: Pick<KernelEvents, "emit">, txHost: TransactionHost);
+    private readonly schedules;
+    /** A trial approval is kept only for a tool the task may hold as a grant (its agent's tools). */
+    private readonly registry;
+    /** 「这台设备一直允许」 sends the `policy` op to the device before the decision is recorded. */
+    private readonly policies;
+    /** One decision of a network ask at a time, across replicas (the op is sent before the transaction). */
+    readonly lockService: LockService;
+    /** A trial run's 「这次允许」 becomes a task grant only within the org's egress. */
+    private readonly sandbox;
+    constructor(db: KernelDb, config: Pick<KernelConfigService, "get">, eventLog: Pick<EventLog, "appendIn" | "notify">, events: Pick<KernelEvents, "emit">, txHost: TransactionHost, schedules: Pick<ScheduledTaskStore, "addGrant">, 
+    /** A trial approval is kept only for a tool the task may hold as a grant (its agent's tools). */
+    registry: Pick<ToolRegistry, "forAgent">, 
+    /** 「这台设备一直允许」 sends the `policy` op to the device before the decision is recorded. */
+    policies: Pick<DevicePolicyService, "apply" | "summary">, 
+    /** One decision of a network ask at a time, across replicas (the op is sent before the transaction). */
+    lockService: LockService, 
+    /** A trial run's 「这次允许」 becomes a task grant only within the org's egress. */
+    sandbox: Pick<SandboxService, "ceilingLimits">);
     /**
      * 新建 pending 审批（`expires_at` = 现在 + `tools.approvalTimeoutHours`）并写 `approval_requested`，同一事务。
      * 按 (run_id, call_id, attempt) 幂等：已存在则返回已有记录（不覆盖），事件按 `approval_requested:<approvalId>` 幂等。
      */
     request(input: ApprovalRequestInput): Promise<ApprovalRecord>;
     private requestIn;
+    /**
+     * A network ask (network ask-to-allow spec §6.2): a pending approval of kind `network` for the
+     * device owner, expiring like a tool approval (`tools.approvalTimeoutHours`), and its
+     * `approval_requested` (tool key `Bash`, the display-only `network.hosts`), in one transaction.
+     * It takes the attempt after the call's other approvals (P-D4: the command ran, so no tool
+     * approval of the call follows it). One per call: a second request returns the first.
+     */
+    requestNetwork(input: NetworkAskInput): Promise<ApprovalRecord>;
+    private requestNetworkIn;
     /** 当前用户能处理的审批（新的在前，最多 {@link APPROVALS_LIST_MAX} 条）；`status` 缺省为全部。 */
     list(orgId: string, accountId: string, status?: ApprovalStatus): Promise<ApprovalView[]>;
     /** 详情；当前用户不能处理的一律 `approval.not_found`（不泄露存在）。 */
@@ -149,15 +260,61 @@ export declare class ApprovalsService {
      * `always` → 发起人 × agent × 工具）、`approval_decided` 事件（幂等键 `approval_decided:<id>`）与审计；
      * 提交后发布事件并调用 `onDecided`。
      */
-    decide(orgId: string, id: string, accountId: string, body: DecisionInput, actorTokenId?: string): Promise<ApprovalRecord>;
+    decide(orgId: string, id: string, accountId: string, body: DecisionInput, actorTokenId?: string, via?: DecisionVia): Promise<ApprovalRecord>;
+    /**
+     * A network ask's decision (network ask-to-allow spec §5.2), one at a time per ask across
+     * replicas: only the device owner (`requested_for`) decides, in a signed-in session (a personal
+     * access token is refused; the route already refuses service and embed tokens); the allowed
+     * hosts are a subset of those asked. 「这台设备一直允许」 sends the `policy` op first, outside any
+     * transaction; when the device cannot be reached or lacks the feature the decision is recorded
+     * as a run grant with the reason, and when the device refuses (its owner takes no remote grants)
+     * as `always` with outcome `refused` and nothing granted. Then {@link decideIn} records what took
+     * effect and the run resumes after the commit; a change the device applied after the ask closed
+     * is audited (`late`) and answered with a 409 that says so.
+     */
+    private decideNetwork;
+    /** `device.network_allowed` of a policy change that reached the device after the ask closed. */
+    private auditLateAllow;
+    /** The owner of a live device of the org (null: none, deleted, or of another org). */
+    private deviceOwnerOf;
+    /**
+     * Adds the hosts to the device's local policy (the `policy` op; never inside a transaction).
+     * Null when it was applied, else why not: the decision falls back to a run grant.
+     */
+    private applyAlways;
+    /** After the commit: the decision's events reach the page, the run's waits and IM delivery. */
+    private announceDecided;
+    /** An account's display name (null when unknown). */
+    private displayNameOf;
     private decideIn;
+    /**
+     * A trial run of a scheduled task (scheduled tasks spec §7): an approval its creator granted, in
+     * any scope, is also added to the task's grants with the approved definition's hash, so its
+     * unattended runs do not ask again. Kept only by the rule `addGrants` applies
+     * (`grantRefusalOf`, against the task agent's tools now): never a role-escalated approval
+     * (`requestedFor` null, it stays `once`), one another account decided, one whose scopes never
+     * allowed remembering (an org / platform operation: "once" only), a per-call key
+     * (`Platform:<operation>`, a skill change among them), a fixed ask, a tool the org forbids (its key or the
+     * call's), or a tool the task's agent does not have. In the decision's transaction.
+     */
+    private keepTrialGrant;
+    /**
+     * A trial run of a scheduled task (network ask-to-allow spec §8.1): the hosts its creator allowed
+     * for this run (「这次允许」) on a network ask about one of their devices become the task's
+     * `network:<host>` grants, each only when `networkGrantRefusal` allows it (exact host, within the
+     * org's effective egress, the device takes remote grants). Never for an ask another account
+     * decided or one asked of someone else. In the decision's transaction.
+     */
+    private keepTrialNetworkGrant;
     /**
      * 详情，不做处理人校验（内核内部用：渠道出站投递组装 IM 审批卡片）；不存在返回 null。
      * 不得直接回给请求方——HTTP 接口用 {@link get}。
      */
     describe(id: string): Promise<ApprovalView | null>;
-    /** 某个工具调用最近一次的审批（attempt 最大者）；没有则返回 null。 */
+    /** 某个工具调用最近一次的工具审批（attempt 最大者，网络询问除外）；没有则返回 null。 */
     forCall(runId: string, callId: string): Promise<ApprovalRecord | null>;
+    /** The network ask of a tool call (at most one per call); null when it has none. */
+    networkForCall(runId: string, callId: string): Promise<ApprovalRecord | null>;
     /**
      * 超时（等待机制的超时任务调用）：仍 pending 且已到期 → 置 expired、写 `approval_decided{expired}`（处理人为 null）。
      * 与人工决定都锁同一行，恰好一个生效。返回 `expired`（本次生效）/ `not_due`（尚未到期）/
@@ -182,7 +339,25 @@ export declare class ApprovalsService {
         records: ApprovalRecord[];
         seqs: Map<string, number>;
     }>;
-    /** 系统写的 `approval_decided`（超时 / 取消，处理人为 null），在当前事务内；返回事件 seq。 */
+    /**
+     * In the caller's transaction (`mandatory`; it wrote `authorAccountId`'s message in
+     * `conversationId` and holds that conversation's row lock): the message skips the pending
+     * network asks it closes (network ask-to-allow spec §6.7), as it skips questions: the asks of
+     * active runs `authorAccountId` started, in the conversation and in its sub-agents'
+     * conversations at any depth (their asks are shown in the root). Each becomes `skipped` with
+     * `approval_decided{skipped}` by the author; access stays blocked. Returns the skipped records and
+     * the highest seq written per conversation; the caller notifies and emits
+     * `approval.decided{skipped}` after the commit, so the runs resume.
+     */
+    skipNetworkIn(conversationId: string, authorAccountId: string): Promise<{
+        records: ApprovalRecord[];
+        seqs: Map<string, number>;
+    }>;
+    /** `conversationId` and its sub-agents' conversations at any depth (at most 16 levels). */
+    private subtreeOf;
+    /**
+     * 系统写的 `approval_decided`（超时 / 取消，处理人为 null；跳过，处理人为消息作者），在当前事务内；返回事件 seq。
+     */
     private decidedEvent;
     /** 本人在该组织的「以后都允许」授权。 */
     listGrants(orgId: string, accountId: string): Promise<ToolGrantView[]>;