@capybara-hq/kernel 0.1.0-rc.22 → 0.1.0-rc.23

package/dist/orgs/settings.service.js

@@ -18,6 +18,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { readPlatformTiers } from "../sandbox/platform-tiers.js";
 import { effectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { assertThemeOnIn } from "../themes/theme-state.js";
 import { IanaTimeZone } from "../time-zone.js";
@@ -255,9 +256,14 @@ let OrgSettingsService = class OrgSettingsService {
         }
         return parseOrgSettings(raw);
     }
+    /** The platform's effective sandbox tiers (the startup config over the admin console's choice). */
+    platformTiers() {
+        return readPlatformTiers(this.db.db, this.config, this.log);
+    }
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
-    deployment() {
-        const { limits: lim, tiers } = this.config.get().sandbox;
+    async deployment() {
+        const lim = this.config.get().sandbox.limits;
+        const tiers = await this.platformTiers();
         return {
             sandboxEgress: { mode: lim.egress, allowHosts: [...lim.allowHosts] },
             sandboxTiers: {
@@ -290,14 +296,14 @@ let OrgSettingsService = class OrgSettingsService {
         return this.parseStored(orgId, row.settings);
     }
     /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
-    check(patch) {
+    async check(patch) {
         if (patch.sandboxEgress?.mode === "allowlist" &&
-            this.deployment().sandboxEgress.mode === "none") {
+            this.config.get().sandbox.limits.egress === "none") {
             throw new ApiError("org.sandbox_egress_not_allowed", "This deployment disables sandbox network access (sandbox.limits.egress is none); an organization can only set sandboxEgress to none");
         }
         const t = patch.sandboxTier;
         if (t != null) {
-            const platform = this.config.get().sandbox.tiers;
+            const platform = await this.platformTiers();
             if (t.max !== undefined && !tierAtMost(t.max, platform.max)) {
                 throw sandboxTierNotAllowed(`The platform allows sandbox tiers up to ${platform.max}; sandboxTier.max cannot be ${t.max}`);
             }
@@ -318,12 +324,19 @@ let OrgSettingsService = class OrgSettingsService {
      * change that widens (see {@link assertOnlyNarrows}); only a person in a session widens.
      */
     opts) {
-        this.check(patch);
+        await this.check(patch);
         return this.updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail, opts);
     }
-    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
-    sandboxPolicy(settings, deviceTier) {
-        return effectiveSandboxPolicy(this.config.get().sandbox, settings, deviceTier);
+    /**
+     * The effective sandbox policy for the org's settings and a device's own tier (null = none);
+     * `tiers`: the platform's tiers when the caller already read them.
+     */
+    async sandboxPolicy(settings, deviceTier, tiers) {
+        const deployment = {
+            limits: this.config.get().sandbox.limits,
+            tiers: tiers ?? (await this.platformTiers()),
+        };
+        return effectiveSandboxPolicy(deployment, settings, deviceTier);
     }
     /**
      * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
@@ -337,12 +350,13 @@ let OrgSettingsService = class OrgSettingsService {
      * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
      *   deployment's when the org gives none) not all in the current list.
      */
-    assertOnlyNarrows(before, patch) {
+    async assertOnlyNarrows(before, patch) {
         if (patch.sandboxTier !== undefined) {
             const next = patch.sandboxTier ?? undefined;
             const prev = before.sandboxTier;
-            const b = this.sandboxPolicy(before, null);
-            const a = this.sandboxPolicy({ ...before, sandboxTier: next }, null);
+            const tiers = await this.platformTiers();
+            const b = await this.sandboxPolicy(before, null, tiers);
+            const a = await this.sandboxPolicy({ ...before, sandboxTier: next }, null, tiers);
             // a cleared default follows the platform, capped by the ceiling: `max` bounds it then
             const nextDefault = next?.default === undefined && next?.max !== undefined ? next.max : next?.default;
             if (!tierAtMost(a.ceiling, b.ceiling) ||
@@ -381,10 +395,10 @@ let OrgSettingsService = class OrgSettingsService {
         const stored = asObject(row.settings);
         const before = this.parseStored(orgId, stored);
         // again under the org lock: a hot config reload may have lowered the platform since
-        this.check(patch);
+        await this.check(patch);
         // under the org lock, so the comparison is with the value the write replaces
         if (opts?.onlyNarrows)
-            this.assertOnlyNarrows(before, patch);
+            await this.assertOnlyNarrows(before, patch);
         const changes = Object.fromEntries(Object.entries(patch)
             .filter(([, v]) => v !== undefined)
             // null clears sandboxEgress / wakeOnBackgroundTask: follow the deployment default again

package/dist/platform/ops/admin.ops.js

@@ -43,6 +43,7 @@ const SettingsInput = DEPLOYMENT_SETTINGS_PATCH.pick({
     uiTheme: true,
     uiArrangement: true,
     clientExtensions: true,
+    sandboxTiers: true,
 }).strict();
 const ProviderId = ModelProviderParams.shape.provider.describe("The model provider (models.platform-list), e.g. the plugin name of its extension.");
 /** `provider/model` of a purpose target, or null. */
@@ -182,17 +183,17 @@ let AdminOperations = class AdminOperations {
             }),
             defineOperation({
                 id: "admin.settings",
-                description: "Read the deployment settings (super admin): who may create orgs (orgCreation), the price currency, whether orgs may create their own connectors and skills, whether org admins may browse the marketplaces, and the per-org limit overrides keyed by org id (orgs.get reads one org's).",
+                description: "Read the deployment settings (super admin): who may create orgs (orgCreation), the price currency, whether orgs may create their own connectors and skills, whether org admins may browse the marketplaces, the per-org limit overrides keyed by org id (orgs.get reads one org's), and the platform's sandbox levels in effect (sandboxTiers: max, default, allowUnsandboxed, with sources: env, file or nacos are set in the startup config and read-only, db chosen in the admin console, default).",
                 input: z.object({}).strict(),
                 example: {},
                 authz: { superAdmin: true },
                 mirrors: ["GET /api/v1/admin/settings"],
                 confirm: "read",
-                run: () => this.settings.get(),
+                run: () => this.settings.view(),
             }),
             defineOperation({
                 id: "admin.update-settings",
-                description: "Change deployment settings (super admin); give only the keys to change: orgCreation (anyone or super_admin), priceCurrency (ISO 4217 code), customConnectors / customSkills (allow or deny: whether orgs may create their own instead of installing from the catalog), orgMarketplaceBrowse (true or false), uiTheme ({ id }: the platform default theme, a platform theme whose scope is all, or null for the built-in theme; it is what every org falls back to and what the sign-in pages show), uiArrangement ({ <slot>: { hidden, order } } for a list slot, { <slot>: { use } } for a single slot: the platform default arrangement of UI slots, with contribution keys <extension>/<contribution>; hidden ones are not listed but still open by URL; use names the contribution that replaces the built-in, null for the built-in; null for a slot removes its entry), clientExtensions ({ enabled?, disabled? }: the kill switch of plugin client code; enabled false stops every plugin's interface code in every browser, disabled is the whole list of plugins whose interface code alone is stopped while their tools keep working; read the current list from admin.settings first). Per-org limits are orgs.set-limits.",
+                description: "Change deployment settings (super admin); give only the keys to change: orgCreation (anyone or super_admin), priceCurrency (ISO 4217 code), customConnectors / customSkills (allow or deny: whether orgs may create their own instead of installing from the catalog), orgMarketplaceBrowse (true or false), uiTheme ({ id }: the platform default theme, a platform theme whose scope is all, or null for the built-in theme; it is what every org falls back to and what the sign-in pages show), uiArrangement ({ <slot>: { hidden, order } } for a list slot, { <slot>: { use } } for a single slot: the platform default arrangement of UI slots, with contribution keys <extension>/<contribution>; hidden ones are not listed but still open by URL; use names the contribution that replaces the built-in, null for the built-in; null for a slot removes its entry), clientExtensions ({ enabled?, disabled? }: the kill switch of plugin client code; enabled false stops every plugin's interface code in every browser, disabled is the whole list of plugins whose interface code alone is stopped while their tools keep working; read the current list from admin.settings first), sandboxTiers ({ max?, default?, allowUnsandboxed? }: the platform's sandbox levels strict < dev < open; null clears a field back to its default; through this tool they may only be lowered, never raised, and fields set in the startup config are read-only). Per-org limits are orgs.set-limits.",
                 input: SettingsInput.refine((b) => Object.keys(b).length > 0, {
                     message: "at least one setting is required",
                 }),
@@ -207,6 +208,14 @@ let AdminOperations = class AdminOperations {
                         code: "validation_failed",
                         next: "Fix the values as the message says (admin.settings shows the current ones).",
                     },
+                    {
+                        code: "deployment.sandbox_tier_not_allowed",
+                        next: "Through this tool the platform's sandbox levels may only be lowered; to raise them, ask a super admin to change them in the admin console settings on the web.",
+                    },
+                    {
+                        code: "deployment.setting_readonly",
+                        next: "That sandbox level is set in the deployment's startup config (environment, file or Nacos; admin.settings shows the source); it can only be changed there, by the operator.",
+                    },
                     {
                         code: "theme.not_available",
                         next: "The platform default must be a platform theme whose scope is all, not disabled, and on in every organization. When the details list orgs, the theme is off in those organizations: tell the person their names, then choose another theme (plugins.components with kind theme lists them) or have it switched on in those organizations first; { id: null } sets the built-in theme.",
@@ -214,13 +223,27 @@ let AdminOperations = class AdminOperations {
                 ],
                 precheck: async (i) => {
                     const r = DeploymentSettingsBody.safeParse(i);
-                    return r.success
+                    if (!r.success) {
+                        return {
+                            ok: false,
+                            code: "validation_failed",
+                            message: r.error.issues[0]?.message ?? "",
+                        };
+                    }
+                    const tiers = i.sandboxTiers;
+                    return tiers === undefined
                         ? { ok: true }
-                        : { ok: false, code: "validation_failed", message: r.error.issues[0]?.message ?? "" };
+                        : precheckBy(() => this.settings.checkSandboxTiers(tiers, { onlyNarrows: true }));
                 },
                 summary: async (i) => {
-                    const { uiTheme, uiArrangement, clientExtensions, ...rest } = i;
+                    const { uiTheme, uiArrangement, clientExtensions, sandboxTiers, ...rest } = i;
                     const parts = Object.entries(rest).map(([k, v]) => `${k}=${String(v)}`);
+                    if (sandboxTiers !== undefined) {
+                        parts.push(`sandboxTiers=${Object.entries(sandboxTiers)
+                            .filter(([, v]) => v !== undefined)
+                            .map(([k, v]) => `${k}:${String(v)}`)
+                            .join(" ")}`);
+                    }
                     const zh = [...parts];
                     const en = [...parts];
                     if (uiTheme !== undefined) {
@@ -253,7 +276,9 @@ let AdminOperations = class AdminOperations {
                         en: `Change the deployment settings: ${en.join(", ")}`,
                     };
                 },
-                run: (input, ctx) => this.settings.update(input, ctx.actorAccountId, undefined, viaAgent("admin.update-settings", ctx)),
+                run: (input, ctx) => this.settings.update(input, ctx.actorAccountId, undefined, viaAgent("admin.update-settings", ctx), 
+                // a person raises the platform's sandbox levels, never an agent (dev tiers spec §2)
+                { onlyNarrows: true }),
             }),
             defineOperation({
                 id: "models.platform-list",

package/dist/platform/ops/org-settings.ops.js

@@ -47,7 +47,7 @@ let OrgSettingsOperations = class OrgSettingsOperations {
                 confirm: "read",
                 run: async (_input, ctx) => ({
                     settings: await this.settings.get(ctx.orgId),
-                    deployment: this.settings.deployment(),
+                    deployment: await this.settings.deployment(),
                     sandboxLimits: await this.settings.sandboxLimits(ctx.orgId),
                 }),
             }),
@@ -80,8 +80,8 @@ let OrgSettingsOperations = class OrgSettingsOperations {
                     },
                 ],
                 precheck: (i, ctx) => precheckBy(async () => {
-                    this.settings.check(i);
-                    this.settings.assertOnlyNarrows(await this.settings.get(ctx.orgId), i);
+                    await this.settings.check(i);
+                    await this.settings.assertOnlyNarrows(await this.settings.get(ctx.orgId), i);
                 }),
                 summary: async (i, ctx) => {
                     const { theme, ...rest } = i;

package/dist/platform/ops/orgs.ops.js

@@ -161,6 +161,7 @@ let OrgsOperations = class OrgsOperations {
                     "uiTheme",
                     "uiArrangement",
                     "clientExtensions",
+                    "sandboxTiers",
                 ],
                 extras: ["orgId", "runConcurrency", "sandbox", "subagents"],
                 confirm: "platform",

package/dist/platform/ops/platform.ops.js

@@ -148,7 +148,7 @@ let PlatformOperationsProvider = class PlatformOperationsProvider {
                     const sandbox = toolKeys.some((k) => SANDBOX_TOOL_NAMES.includes(k));
                     const org = await this.settings.get(ctx.orgId);
                     // a new device's level: the org's default tier and its network
-                    const policy = this.settings.sandboxPolicy(org, null);
+                    const policy = await this.settings.sandboxPolicy(org, null);
                     return {
                         id: agent.id,
                         name: d.name,

package/dist/sandbox/platform-tiers.d.ts

@@ -0,0 +1,86 @@
+import { type SandboxTier } from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
+import type { KernelConfig } from "../config/schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import type { KernelLogger } from "../log.js";
+/**
+ * The platform's sandbox tiers (sandbox dev tiers spec §4.1): `max`, `default` and
+ * `allowUnsandboxed`. Each field is read env > config file (or Nacos) > the super admin's choice in
+ * the admin console (deployment setting {@link PLATFORM_TIERS_SETTING}) > {@link PLATFORM_TIER_DEFAULTS}.
+ * A field set in the startup config is read-only in the admin console. Read live from PG at every
+ * use, so a change applies on every replica at once.
+ */
+/** The `deployment_settings` key of the super admin's choice. */
+export declare const PLATFORM_TIERS_SETTING = "sandboxTiers";
+/** The fields, in display order. */
+export declare const PLATFORM_TIER_FIELDS: readonly ["max", "default", "allowUnsandboxed"];
+export type PlatformTierField = (typeof PLATFORM_TIER_FIELDS)[number];
+/** The stored choice: each field absent follows the default. */
+export declare const PlatformTiersStoredSchema: z.ZodObject<{
+    max: z.ZodOptional<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>;
+    default: z.ZodOptional<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>;
+    allowUnsandboxed: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type PlatformTiersStored = z.infer<typeof PlatformTiersStoredSchema>;
+/**
+ * A change of the stored choice (`PUT /api/v1/admin/settings` `sandboxTiers`): each given field
+ * replaces the stored one, null clears it (back to the default); at least one field.
+ */
+export declare const PLATFORM_TIERS_PATCH: z.ZodObject<{
+    max: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>>;
+    default: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        dev: "dev";
+        open: "open";
+        strict: "strict";
+    }>>>;
+    allowUnsandboxed: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+}, z.core.$strict>;
+export type PlatformTiersPatch = z.infer<typeof PLATFORM_TIERS_PATCH>;
+/** The platform's effective tiers. */
+export interface PlatformTiers {
+    max: SandboxTier;
+    /** At most {@link max}. */
+    default: SandboxTier;
+    allowUnsandboxed: boolean;
+}
+/** What a field falls back to when neither the startup config nor the admin console sets it. */
+export declare const PLATFORM_TIER_DEFAULTS: Readonly<PlatformTiers>;
+/** Where a field's effective value comes from. */
+export type PlatformTierSource = "env" | "file" | "nacos" | "db" | "default";
+/** The admin console's view: the effective values and where each comes from. */
+export interface PlatformTiersView extends PlatformTiers {
+    sources: Record<PlatformTierField, PlatformTierSource>;
+}
+/** The startup config's `sandbox.tiers` (each field undefined when not set there). */
+export type ConfigTiers = KernelConfig["sandbox"]["tiers"];
+/**
+ * Parses the stored choice: missing -> `{}`; invalid -> `{ max: "strict" }`, narrower, never
+ * wider (the same rule an org's invalid `sandboxTier` follows), with a warning on `log`.
+ */
+export declare function parseStoredPlatformTiers(value: unknown, log?: Pick<KernelLogger, "warn">): PlatformTiersStored;
+/** The default the layers choose before it is cut to the max. */
+export declare const chosenPlatformDefault: (config: ConfigTiers, stored: PlatformTiersStored) => SandboxTier;
+/** The effective tiers of the startup config over the stored choice; the default is cut to the max. */
+export declare function resolvePlatformTiers(config: ConfigTiers, stored: PlatformTiersStored): PlatformTiers;
+/** Whether `next` reaches further than `prev` anywhere: a higher max or default, or unsandboxed allowed. */
+export declare function platformTiersWiden(prev: PlatformTiers, next: PlatformTiers): boolean;
+/** The stored choice with `patch` applied (null clears a field). */
+export declare function applyPlatformTiersPatch(stored: PlatformTiersStored, patch: PlatformTiersPatch): PlatformTiersStored;
+/** The stored choice, read live (in the caller's transaction when there is one). */
+export declare function readStoredPlatformTiers(db: KernelSchemaDb, log?: Pick<KernelLogger, "warn">): Promise<PlatformTiersStored>;
+/** The platform's effective tiers, read live: see {@link resolvePlatformTiers}. */
+export declare function readPlatformTiers(db: KernelSchemaDb, config: {
+    get(): Pick<KernelConfig, "sandbox">;
+}, log?: Pick<KernelLogger, "warn">): Promise<PlatformTiers>;

package/dist/sandbox/platform-tiers.js

@@ -0,0 +1,97 @@
+import { minTier, tierAtMost } from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
+/**
+ * The platform's sandbox tiers (sandbox dev tiers spec §4.1): `max`, `default` and
+ * `allowUnsandboxed`. Each field is read env > config file (or Nacos) > the super admin's choice in
+ * the admin console (deployment setting {@link PLATFORM_TIERS_SETTING}) > {@link PLATFORM_TIER_DEFAULTS}.
+ * A field set in the startup config is read-only in the admin console. Read live from PG at every
+ * use, so a change applies on every replica at once.
+ */
+/** The `deployment_settings` key of the super admin's choice. */
+export const PLATFORM_TIERS_SETTING = "sandboxTiers";
+/** The fields, in display order. */
+export const PLATFORM_TIER_FIELDS = ["max", "default", "allowUnsandboxed"];
+const Tier = z.enum(["strict", "dev", "open"]);
+/** The stored choice: each field absent follows the default. */
+export const PlatformTiersStoredSchema = z
+    .object({
+    max: Tier.optional(),
+    default: Tier.optional(),
+    allowUnsandboxed: z.boolean().optional(),
+})
+    .strict();
+/**
+ * A change of the stored choice (`PUT /api/v1/admin/settings` `sandboxTiers`): each given field
+ * replaces the stored one, null clears it (back to the default); at least one field.
+ */
+export const PLATFORM_TIERS_PATCH = z
+    .object({
+    max: Tier.nullable().optional(),
+    default: Tier.nullable().optional(),
+    allowUnsandboxed: z.boolean().nullable().optional(),
+})
+    .strict()
+    .refine((o) => Object.values(o).some((v) => v !== undefined), {
+    message: "give max, default, allowUnsandboxed or several",
+});
+/** What a field falls back to when neither the startup config nor the admin console sets it. */
+export const PLATFORM_TIER_DEFAULTS = Object.freeze({
+    max: "dev",
+    default: "dev",
+    allowUnsandboxed: true,
+});
+/**
+ * Parses the stored choice: missing -> `{}`; invalid -> `{ max: "strict" }`, narrower, never
+ * wider (the same rule an org's invalid `sandboxTier` follows), with a warning on `log`.
+ */
+export function parseStoredPlatformTiers(value, log) {
+    if (value === undefined)
+        return {};
+    const parsed = PlatformTiersStoredSchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    log?.warn("invalid deployment setting; it reads as max strict", { key: PLATFORM_TIERS_SETTING });
+    return { max: "strict" };
+}
+/** The default the layers choose before it is cut to the max. */
+export const chosenPlatformDefault = (config, stored) => config.default ?? stored.default ?? PLATFORM_TIER_DEFAULTS.default;
+/** The effective tiers of the startup config over the stored choice; the default is cut to the max. */
+export function resolvePlatformTiers(config, stored) {
+    const max = config.max ?? stored.max ?? PLATFORM_TIER_DEFAULTS.max;
+    return {
+        max,
+        default: minTier(chosenPlatformDefault(config, stored), max),
+        allowUnsandboxed: config.allowUnsandboxed ?? stored.allowUnsandboxed ?? PLATFORM_TIER_DEFAULTS.allowUnsandboxed,
+    };
+}
+/** Whether `next` reaches further than `prev` anywhere: a higher max or default, or unsandboxed allowed. */
+export function platformTiersWiden(prev, next) {
+    return (!tierAtMost(next.max, prev.max) ||
+        !tierAtMost(next.default, prev.default) ||
+        (next.allowUnsandboxed && !prev.allowUnsandboxed));
+}
+/** The stored choice with `patch` applied (null clears a field). */
+export function applyPlatformTiersPatch(stored, patch) {
+    const out = { ...stored };
+    for (const f of PLATFORM_TIER_FIELDS) {
+        const v = patch[f];
+        if (v === null)
+            delete out[f];
+        else if (v !== undefined)
+            out[f] = v;
+    }
+    return out;
+}
+/** The stored choice, read live (in the caller's transaction when there is one). */
+export async function readStoredPlatformTiers(db, log) {
+    const row = await db
+        .selectFrom("deployment_settings")
+        .select("value")
+        .where("key", "=", PLATFORM_TIERS_SETTING)
+        .executeTakeFirst();
+    return parseStoredPlatformTiers(row?.value, log);
+}
+/** The platform's effective tiers, read live: see {@link resolvePlatformTiers}. */
+export async function readPlatformTiers(db, config, log) {
+    return resolvePlatformTiers(config.get().sandbox.tiers, await readStoredPlatformTiers(db, log));
+}

package/dist/sandbox/sandbox.service.d.ts

@@ -465,7 +465,7 @@ export declare class SandboxService {
     /**
      * Under the exclusive lease, right after a resume or a (re)build: kills the sessions of the
      * background tasks marked lost while their process may live on (`kill_pending`), in one exec of
-     * `pkill -KILL -s <sid>`, then clears their flags. Tasks of another instance have no process
+     * `pkill -KILL -s <sid>` (`-g` on macOS), then clears their flags. Tasks of another instance have no process
      * here and are only cleared. A gone instance and an abort are thrown; another failure is warned
      * and leaves the flags of this instance's tasks for the next resume.
      */

package/dist/sandbox/sandbox.service.js

@@ -11,6 +11,7 @@ import { randomUUID } from "node:crypto";
 import { compareTiers, isFileSystemGoneError, isSandboxGoneError, rootsOf, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql, } from "kysely";
+import { SESSION_MODE_SCRIPT } from "../background/launch.js";
 import { BackgroundTaskStore } from "../background/store.js";
 import { DEFAULT_MAX_COMMAND_SECONDS, DEFAULT_MAX_RUN_SECONDS, } from "../config/schema.js";
 import { ApiError } from "../errors.js";
@@ -23,7 +24,7 @@ import { appendMissingGrant, TIER_OPEN_GRANT_KEY, UNATTENDED_OPEN_TIER_ERROR, un
 import { canonicalJson } from "../tools/canonical-json.js";
 import { SandboxLeases, SandboxLockLostError, sandboxBusy, } from "./leases.js";
 import { LOCAL_PROVIDER, providerForDevice, SandboxProviders, } from "./providers.js";
-import { appliedOf, effectiveSandboxPolicy, instanceLimitsJson, limitsForTier, readInstanceLimits, sameApplied, } from "./tiers.js";
+import { appliedOf, effectiveSandboxPolicy, instanceLimitsJson, limitsForTier, readDeploymentSandboxPolicy, readInstanceLimits, sameApplied, } from "./tiers.js";
 // Moved to leases.ts (phase C); re-exported for existing importers
 export { SANDBOX_LOCK_PREFIX, SANDBOX_LOCK_TTL_MS, SandboxLockLostError, sandboxBusy, } from "./leases.js";
 /** Margin (ms) of a holder record's TTL beyond the longest command: by then the in-sandbox limit has ended its commands. */
@@ -278,12 +279,12 @@ let SandboxService = class SandboxService {
      * default.
      */
     async devicePolicy(device) {
-        const cfg = this.config.get().sandbox;
-        const [settings, tier] = await Promise.all([
+        const [deployment, settings, tier] = await Promise.all([
+            readDeploymentSandboxPolicy(this.db.db, this.config),
             readOrgSettings(this.db.db, device.orgId),
             device.deviceId === undefined ? null : this.deviceTier(device.orgId, device.deviceId),
         ]);
-        return effectiveSandboxPolicy(cfg, settings, tier);
+        return effectiveSandboxPolicy(deployment, settings, tier);
     }
     /** The device's own tier (`devices.tier`); null when it follows the org or is not there. */
     async deviceTier(orgId, deviceId) {
@@ -701,6 +702,17 @@ let SandboxService = class SandboxService {
                         if (intent)
                             await this.clearIntent(env, token);
                         intent = false;
+                        // after a wait, the limits again under the lease: a tier narrowed just before the
+                        // holder we waited for let go is applied now (asShared checks `ready` with them)
+                        if (waited) {
+                            try {
+                                want = await wantNow();
+                            }
+                            catch (err) {
+                                await lease.release();
+                                throw err;
+                            }
+                        }
                         const e = await this.asShared(ctx, p, lease, ready, signal);
                         if (e)
                             return e;
@@ -1088,7 +1100,7 @@ let SandboxService = class SandboxService {
     /**
      * Under the exclusive lease, right after a resume or a (re)build: kills the sessions of the
      * background tasks marked lost while their process may live on (`kill_pending`), in one exec of
-     * `pkill -KILL -s <sid>`, then clears their flags. Tasks of another instance have no process
+     * `pkill -KILL -s <sid>` (`-g` on macOS), then clears their flags. Tasks of another instance have no process
      * here and are only cleared. A gone instance and an abort are thrown; another failure is warned
      * and leaves the flags of this instance's tasks for the next resume.
      */
@@ -1100,10 +1112,12 @@ let SandboxService = class SandboxService {
         let cleared = rows;
         if (mine.length > 0) {
             // pkill exits 1 when the session has no process left: only a higher status is a failure
-            const command = `rc=0; for sid in ${mine.map((r) => r.sid).join(" ")}; do pkill -KILL -s "$sid"; c=$?; [ "$c" -le 1 ] || rc=$c; done; exit $rc`;
+            const command = `${SESSION_MODE_SCRIPT}\nrc=0; for sid in ${mine.map((r) => r.sid).join(" ")}; do tk_kill KILL "$sid"; c=$?; [ "$c" -le 1 ] || rc=$c; done; exit $rc`;
             try {
                 const r = await p.impl.exec(handle, {
                     command,
+                    // tk_kill's control files are relative to the workspace root (macOS devices)
+                    cwd: rootsOf(handle).workspace,
                     timeoutMs: PENDING_KILL_TIMEOUT_MS,
                     maxOutputBytes: 4096,
                     signal,

package/dist/sandbox/tiers.d.ts

@@ -1,16 +1,28 @@
 import { type SandboxTier } from "@capybara-hq/plugin-sdk";
 import type { KernelConfig } from "../config/schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { OrgSettings } from "../orgs/settings.service.js";
+import { type PlatformTiers } from "./platform-tiers.js";
 /**
  * Sandbox tiers (sandbox dev tiers spec §4): who may reach which tier, and the network each tier
  * gets. One function, {@link effectiveSandboxPolicy}, combines the platform's ceiling and default
  * (`sandbox.tiers`), the org's (`sandboxTier`) and the device's own choice.
  */
-/** The deployment config the policy reads (`sandbox.limits` network fields and `sandbox.tiers`). */
+/**
+ * What the policy reads of the platform: the `sandbox.limits` network fields and the effective
+ * platform tiers (`readPlatformTiers`: the startup config over the admin console's choice).
+ */
 export interface DeploymentSandboxPolicy {
     limits: Pick<KernelConfig["sandbox"]["limits"], "egress" | "allowHosts" | "devHosts">;
-    tiers: KernelConfig["sandbox"]["tiers"];
+    tiers: PlatformTiers;
 }
+/**
+ * The platform side of the policy, read live: the `sandbox.limits` network fields of the config
+ * and the effective platform tiers (in the caller's transaction when there is one).
+ */
+export declare function readDeploymentSandboxPolicy(db: KernelSchemaDb, config: {
+    get(): Pick<KernelConfig, "sandbox">;
+}): Promise<DeploymentSandboxPolicy>;
 /** The org settings the policy reads. */
 export type OrgSandboxSettings = Pick<OrgSettings, "sandboxEgress" | "sandboxTier">;
 /**

package/dist/sandbox/tiers.js

@@ -1,4 +1,12 @@
 import { isSandboxTier, minTier, tierAtMost } from "@capybara-hq/plugin-sdk";
+import { readPlatformTiers } from "./platform-tiers.js";
+/**
+ * The platform side of the policy, read live: the `sandbox.limits` network fields of the config
+ * and the effective platform tiers (in the caller's transaction when there is one).
+ */
+export async function readDeploymentSandboxPolicy(db, config) {
+    return { limits: config.get().sandbox.limits, tiers: await readPlatformTiers(db, config) };
+}
 /** The org's base list `L`: see {@link BaseSandboxEgress}. */
 export function baseSandboxEgress(deployment, org) {
     if (deployment.egress === "none" || org?.mode === "none")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.22",
+  "version": "0.1.0-rc.23",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -65,7 +65,7 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.16"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.17"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",