@capybara-hq/kernel 0.1.0-rc.22 → 0.1.0-rc.24

package/dist/local-devices/machines.js

@@ -20,7 +20,7 @@ import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
 import { LOCAL_PROVIDER } from "../sandbox/providers.js";
 import { deviceNotFound } from "../sandbox/sandbox.service.js";
 import { deviceRevokedTopic } from "./keys.js";
-import { deviceFeaturesOf, isolationOf, localPolicyOf } from "./policy-summary.js";
+import { deviceFeaturesOf, isolationOf, localPolicyDiff, localPolicyOf, opExplains, pendingPolicyOpsOf, } from "./policy-summary.js";
 import { LocalDeviceRelay } from "./relay.js";
 /** The machine credential's prefix (`cap_dev_` plus 32 random bytes, base64url). */
 export const MACHINE_CREDENTIAL_PREFIX = "cap_dev_";
@@ -162,7 +162,9 @@ let MachinesService = class MachinesService {
      * alone, read from `rawPolicy` (the frame's raw `policy`; {@link isolationOf}: anything but
      * `sandbox` is `none`), so it never hides that commands run without a sandbox. A reported
      * isolation that differs from the stored one (none stored counts as `sandbox`) is audited
-     * `device.isolation_reported` (sandbox dev tiers spec §10.4), once per change.
+     * `device.isolation_reported` (sandbox dev tiers spec §10.4), once per change; a change of what
+     * the owner sets, made on the machine while it was away, is audited `device.policy_changed`
+     * ({@link reportedPolicy}).
      */
     async recordHello(machineId, hello, rawPolicy = hello.policy) {
         const self = await this.db
@@ -177,6 +179,7 @@ let MachinesService = class MachinesService {
             "roots",
             "created_at",
             "local_policy",
+            "pending_policy_ops",
         ])
             .where("id", "=", machineId)
             .where("revoked_at", "is", null)
@@ -207,19 +210,7 @@ let MachinesService = class MachinesService {
                     .execute();
             }
         }
-        const summary = localPolicyOf(hello.policy);
-        const isolation = summary?.isolation ?? isolationOf(rawPolicy);
-        const policy = summary ?? (isolation === null ? null : { isolation });
-        const before = isolationOf(self.local_policy) ?? "sandbox";
-        if (isolation !== null && isolation !== before) {
-            await audit(this.db.db, {
-                actorAccountId: self.account_id,
-                orgId: self.org_id,
-                action: "device.isolation_reported",
-                target: self.device_id,
-                detail: { machineId, isolation, previous: before },
-            });
-        }
+        const policy = await this.reportedPolicy(machineId, self, hello.policy, rawPolicy);
         await this.db
             .updateTable("device_machines")
             .set({
@@ -237,6 +228,88 @@ let MachinesService = class MachinesService {
             .where("revoked_at", "is", null)
             .execute();
     }
+    /**
+     * Stores the local policy summary a connected program pushed after its hello (a `policy` frame:
+     * its policy file changed on the machine, its localhost proxy guard flipped, a new tier
+     * ceiling), read and audited as the hello's ({@link recordHello}): an unreadable summary keeps
+     * its isolation alone (`rawPolicy`); a change the owner made on the machine is audited
+     * `device.policy_changed` (`via: "device"`), else a changed isolation `device.isolation_reported`.
+     * The next sandbox call then records a new `device_paths` event when the facts the model is told
+     * changed. A revoked machine is left alone.
+     */
+    async recordPolicy(machineId, summary, rawPolicy = summary) {
+        const self = await this.db
+            .selectFrom("device_machines")
+            .select(["device_id", "org_id", "account_id", "local_policy", "pending_policy_ops"])
+            .where("id", "=", machineId)
+            .where("revoked_at", "is", null)
+            .forUpdate()
+            .executeTakeFirst();
+        if (self === undefined)
+            return;
+        const policy = await this.reportedPolicy(machineId, self, summary, rawPolicy);
+        await this.db
+            .updateTable("device_machines")
+            .set({ local_policy: jsonOrNull(policy), last_seen_at: sql `now()` })
+            .where("id", "=", machineId)
+            .where("revoked_at", "is", null)
+            .execute();
+    }
+    /**
+     * The summary to store for one a program reported (hello or `policy` frame): the parsed one,
+     * else its raw isolation alone, else null. When both the stored and the reported summary are
+     * readable and what the owner sets changed ({@link localPolicyDiff}) by no `policy` op the
+     * platform sent ({@link opExplains}: its answer may come after the machine's own report), the
+     * owner changed it on the machine (`capybara-device policy ...`): audited
+     * `device.policy_changed` with `via: "device"`, the isolation with it, so the device page lists
+     * it beside the platform's changes; one an op explains is not audited here (the op's answer
+     * is). Otherwise a reported isolation that differs from the stored one (none stored counts as
+     * `sandbox`) is audited `device.isolation_reported`. A summary reported again is no change. Runs in the caller's transaction, with the machine's row locked.
+     */
+    async reportedPolicy(machineId, self, reported, rawPolicy) {
+        const summary = localPolicyOf(reported);
+        const prev = localPolicyOf(self.local_policy);
+        const diff = summary !== null && prev !== null ? localPolicyDiff(prev, summary) : null;
+        if (diff !== null) {
+            const now = Date.now();
+            const byOp = pendingPolicyOpsOf(self.pending_policy_ops).some((op) => op.until > now && opExplains(op, diff));
+            // the platform's op: its answer lists it (the isolation with it)
+            if (byOp)
+                return summary;
+            await audit(this.db.db, {
+                actorAccountId: self.account_id,
+                orgId: self.org_id,
+                action: "device.policy_changed",
+                target: self.device_id,
+                detail: {
+                    add: diff.add,
+                    remove: diff.remove,
+                    ...(diff.tier !== undefined && { tier: diff.tier.to, tierFrom: diff.tier.from }),
+                    ...(diff.localhost !== undefined && { localhost: diff.localhost }),
+                    ...(diff.isolation !== undefined && { isolation: diff.isolation }),
+                    ...(diff.remoteGrants !== undefined && { remoteGrants: diff.remoteGrants }),
+                    by: self.account_id,
+                    via: "device",
+                    machineId,
+                    approvalId: null,
+                    confirmed: true,
+                },
+            });
+            return summary;
+        }
+        const isolation = summary?.isolation ?? isolationOf(rawPolicy);
+        const before = isolationOf(self.local_policy) ?? "sandbox";
+        if (isolation !== null && isolation !== before) {
+            await audit(this.db.db, {
+                actorAccountId: self.account_id,
+                orgId: self.org_id,
+                action: "device.isolation_reported",
+                target: self.device_id,
+                detail: { machineId, isolation, previous: before },
+            });
+        }
+        return summary ?? (isolation === null ? null : { isolation });
+    }
     /** Marks the machine seen (a ping); writes at most once every 60 seconds. */
     async touch(machineId) {
         await this.db
@@ -385,6 +458,9 @@ __decorate([
 __decorate([
     Transactional()
 ], MachinesService.prototype, "recordHello", null);
+__decorate([
+    Transactional()
+], MachinesService.prototype, "recordPolicy", null);
 __decorate([
     Transactional()
 ], MachinesService.prototype, "revoke", null);

package/dist/local-devices/policy-summary.d.ts

@@ -1,4 +1,4 @@
-import { type DeviceFeature, type DeviceLocalPolicySummary } from "@capybara-hq/plugin-sdk";
+import { type DeviceFeature, type DeviceLocalPolicySummary, type SandboxTier } from "@capybara-hq/plugin-sdk";
 /**
  * The known features in `v` (a hello's `features` or the stored column), in a fixed order and
  * deduped; anything else (unknown names, a non-array) is dropped.
@@ -18,3 +18,46 @@ export declare function localPolicyOf(v: unknown): DeviceLocalPolicySummary | nu
  * there is none.
  */
 export declare function isolationOf(v: unknown): "sandbox" | "none" | null;
+/**
+ * What changed between two local policy summaries, in the owner's terms (the device page's change
+ * list, sandbox dev tiers spec §10.4): hosts added to and removed from the allowlist, the chosen
+ * tier (`null`: follows the org's default), the localhost access, the isolation and whether the
+ * machine accepts the platform's changes. Facts the owner does not set (the effective tier, unix
+ * sockets) are left out. Each field is present only when it changed.
+ */
+export interface LocalPolicyDiff {
+    add: string[];
+    remove: string[];
+    tier?: {
+        from: SandboxTier | null;
+        to: SandboxTier | null;
+    };
+    localhost?: DeviceLocalPolicySummary["localhost"];
+    isolation?: DeviceLocalPolicySummary["isolation"];
+    remoteGrants?: DeviceLocalPolicySummary["remoteGrants"];
+}
+/** The {@link LocalPolicyDiff} from `prev` to `next`; null when nothing the owner sets changed. */
+export declare function localPolicyDiff(prev: DeviceLocalPolicySummary, next: DeviceLocalPolicySummary): LocalPolicyDiff | null;
+/**
+ * A `policy` op the platform sent to a machine whose answer may not be recorded yet (kept on the
+ * machine's row, `pending_policy_ops`): the change asked for, and until when (epoch ms) a summary
+ * the machine reports by itself may still be that op's.
+ */
+export interface PendingPolicyOp {
+    id: string;
+    add: string[];
+    remove: string[];
+    /** Present when the op set the tier (null: follow the org's default). */
+    tier?: SandboxTier | null;
+    isolation?: "sandbox";
+    until: number;
+}
+/** The pending ops stored on a machine row (malformed entries dropped). */
+export declare function pendingPolicyOpsOf(v: unknown): PendingPolicyOp[];
+/**
+ * Whether `diff` is what the platform's `op` did (its answer, or the machine's own report of it
+ * before the answer was recorded): hosts within the op's, the tier the op set, and only what a
+ * tier change moves with it (the isolation back to `sandbox`, the localhost access). The device
+ * page then lists the change once, as the platform's.
+ */
+export declare function opExplains(op: PendingPolicyOp, diff: LocalPolicyDiff): boolean;

package/dist/local-devices/policy-summary.js

@@ -61,3 +61,72 @@ export function isolationOf(v) {
     }
     return "none";
 }
+/** The {@link LocalPolicyDiff} from `prev` to `next`; null when nothing the owner sets changed. */
+export function localPolicyDiff(prev, next) {
+    const before = new Set(prev.allowedDomains);
+    const after = new Set(next.allowedDomains);
+    const d = {
+        add: [...after].filter((h) => !before.has(h)).sort(),
+        remove: [...before].filter((h) => !after.has(h)).sort(),
+    };
+    const fromTier = prev.tier ?? null;
+    const toTier = next.tier ?? null;
+    if (fromTier !== toTier)
+        d.tier = { from: fromTier, to: toTier };
+    if (prev.localhost !== next.localhost)
+        d.localhost = next.localhost;
+    if (prev.isolation !== next.isolation)
+        d.isolation = next.isolation;
+    if (prev.remoteGrants !== next.remoteGrants)
+        d.remoteGrants = next.remoteGrants;
+    const changed = d.add.length > 0 ||
+        d.remove.length > 0 ||
+        d.tier !== undefined ||
+        d.localhost !== undefined ||
+        d.isolation !== undefined ||
+        d.remoteGrants !== undefined;
+    return changed ? d : null;
+}
+/** The pending ops stored on a machine row (malformed entries dropped). */
+export function pendingPolicyOpsOf(v) {
+    if (!Array.isArray(v))
+        return [];
+    const hosts = (x) => Array.isArray(x) ? x.filter((h) => typeof h === "string") : [];
+    const out = [];
+    for (const e of v) {
+        if (typeof e !== "object" || e === null)
+            continue;
+        const o = e;
+        if (typeof o.id !== "string" || typeof o.until !== "number")
+            continue;
+        out.push({
+            id: o.id,
+            add: hosts(o.add),
+            remove: hosts(o.remove),
+            ...("tier" in o && { tier: isSandboxTier(o.tier) ? o.tier : null }),
+            ...(o.isolation === "sandbox" && { isolation: "sandbox" }),
+            until: o.until,
+        });
+    }
+    return out;
+}
+/**
+ * Whether `diff` is what the platform's `op` did (its answer, or the machine's own report of it
+ * before the answer was recorded): hosts within the op's, the tier the op set, and only what a
+ * tier change moves with it (the isolation back to `sandbox`, the localhost access). The device
+ * page then lists the change once, as the platform's.
+ */
+export function opExplains(op, diff) {
+    if (!diff.add.every((h) => op.add.includes(h)))
+        return false;
+    if (!diff.remove.every((h) => op.remove.includes(h)))
+        return false;
+    if (diff.tier !== undefined && (op.tier === undefined || diff.tier.to !== op.tier))
+        return false;
+    if (diff.isolation !== undefined && op.isolation === undefined && op.tier === undefined) {
+        return false;
+    }
+    if (diff.localhost !== undefined && op.tier === undefined)
+        return false;
+    return diff.remoteGrants === undefined;
+}

package/dist/models/embeddings.d.ts

@@ -2,9 +2,9 @@ import { type ExtensionEmbedRequest, type ExtensionEmbedResult, type ExtensionMo
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
-import { KernelEvents } from "../infra/events/kernel-events.js";
 import { type HookRunner } from "../runtime/hook-calls.js";
 import { ProviderRegistry } from "../runtime/providers.js";
+import { UsageReportJobs } from "../runtime/usage-report-jobs.js";
 import { ModelPurposesService } from "./purposes.js";
 /** An extension's `permissions.models` (what it declared, as approved in its manifest). */
 export type DeclaredModelPurposes = readonly NonNullable<ExtensionPermissions["models"]>[number][];
@@ -29,9 +29,9 @@ export declare const EMBED_MAX_INPUTS = 2048;
  *   limited by `models.embedTimeoutMs` (`ModelError("timeout")`), checks each result ({@link validateEmbedResult}: a
  *   wrong count, dimension or a non-finite number is a `ModelError` of kind `server`), and
  *   concatenates the vectors; no retries (an extension retries itself if it wants to);
- * - writes one `model_usage` row (the sum of the batches' input tokens) and announces it after the
- *   commit (`model_usage.recorded`: the usage reporter's `ModelUsageJobs` enqueues its
- *   `usage.report` delivery; the usage sweep catches up a lost one). A call that fails after the
+ * - writes one `model_usage` row (the sum of the batches' input tokens) and, in the same
+ *   transaction, owes its `usage.report` delivery while some plugin subscribes (`UsageReportJobs`,
+ *   transactional outbox spec §8.1). A call that fails after the
  *   provider answered some batches (an invalid result, a later batch failing) still records their
  *   input tokens before the error reaches the extension; one that fails before any answer records
  *   nothing.
@@ -42,14 +42,14 @@ export declare class ModelEmbeddings {
     readonly txHost: TransactionHost;
     private readonly purposes;
     private readonly providers;
-    /** `model_usage.recorded`: the usage reporter enqueues the row's delivery. */
-    private readonly events;
+    /** The row's `usage.report` delivery, owed with it. */
+    private readonly usage;
     private readonly log;
     /** `models.embedTimeoutMs` (hot). */
     private readonly config;
     constructor(kdb: KernelDb, txHost: TransactionHost, purposes: Pick<ModelPurposesService, "resolve">, providers: Pick<ProviderRegistry, "resolve">, 
-    /** `model_usage.recorded`: the usage reporter enqueues the row's delivery. */
-    events: Pick<KernelEvents, "emit">, log: Pick<Logger, "warn">, 
+    /** The row's `usage.report` delivery, owed with it. */
+    usage: Pick<UsageReportJobs, "oweModelUsage">, log: Pick<Logger, "warn">, 
     /** `models.embedTimeoutMs` (hot). */
     config: Pick<KernelConfigService, "get">);
     /** Refuses a purpose `plugin` did not declare with kind `embedding`, or an org it is off in. */
@@ -77,6 +77,6 @@ export declare class ModelEmbeddings {
         orgId: string;
         purpose: string;
     }): Promise<ExtensionModelTarget | null>;
-    /** One `model_usage` row; its `usage.report` delivery is enqueued after the commit. */
+    /** One `model_usage` row with its owed `usage.report` delivery. */
     private record;
 }

package/dist/models/embeddings.js

@@ -13,15 +13,14 @@ import { ApiError } from "../errors.js";
 import { isExtensionEnabled } from "../extensions/enabled.js";
 import { audit } from "../identity/audit.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
-import { KernelEvents } from "../infra/events/kernel-events.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { embeddingDeniedAudit } from "../runtime/hook-calls.js";
 import { modelDeniedText } from "../runtime/model-call.js";
 import { ProviderRegistry } from "../runtime/providers.js";
+import { UsageReportJobs } from "../runtime/usage-report-jobs.js";
 import { ModelPurposesService } from "./purposes.js";
 /** Most texts one `ctx.models.embed` call may carry (the kernel splits them by `maxBatch`). */
 export const EMBED_MAX_INPUTS = 2048;
@@ -44,9 +43,9 @@ export const EMBED_MAX_INPUTS = 2048;
  *   limited by `models.embedTimeoutMs` (`ModelError("timeout")`), checks each result ({@link validateEmbedResult}: a
  *   wrong count, dimension or a non-finite number is a `ModelError` of kind `server`), and
  *   concatenates the vectors; no retries (an extension retries itself if it wants to);
- * - writes one `model_usage` row (the sum of the batches' input tokens) and announces it after the
- *   commit (`model_usage.recorded`: the usage reporter's `ModelUsageJobs` enqueues its
- *   `usage.report` delivery; the usage sweep catches up a lost one). A call that fails after the
+ * - writes one `model_usage` row (the sum of the batches' input tokens) and, in the same
+ *   transaction, owes its `usage.report` delivery while some plugin subscribes (`UsageReportJobs`,
+ *   transactional outbox spec §8.1). A call that fails after the
  *   provider answered some batches (an invalid result, a later batch failing) still records their
  *   input tokens before the error reaches the extension; one that fails before any answer records
  *   nothing.
@@ -57,19 +56,19 @@ let ModelEmbeddings = class ModelEmbeddings {
     txHost;
     purposes;
     providers;
-    events;
+    usage;
     log;
     config;
     constructor(kdb, txHost, purposes, providers, 
-    /** `model_usage.recorded`: the usage reporter enqueues the row's delivery. */
-    events, log, 
+    /** The row's `usage.report` delivery, owed with it. */
+    usage, log, 
     /** `models.embedTimeoutMs` (hot). */
     config) {
         this.kdb = kdb;
         this.txHost = txHost;
         this.purposes = purposes;
         this.providers = providers;
-        this.events = events;
+        this.usage = usage;
         this.log = log;
         this.config = config;
     }
@@ -243,7 +242,7 @@ let ModelEmbeddings = class ModelEmbeddings {
             throw e;
         }
     }
-    /** One `model_usage` row; its `usage.report` delivery is enqueued after the commit. */
+    /** One `model_usage` row with its owed `usage.report` delivery. */
     async record(plugin, orgId, purpose, model, inputTokens) {
         const row = await this.kdb.db
             .insertInto("model_usage")
@@ -257,13 +256,7 @@ let ModelEmbeddings = class ModelEmbeddings {
         })
             .returning("id")
             .executeTakeFirstOrThrow();
-        // fire and forget: the extension's call never waits on the enqueue (PG, Redis); a lost one is
-        // caught up by the usage sweep
-        afterCommit(() => {
-            void this.events
-                .emit("model_usage.recorded", { id: row.id })
-                .catch((err) => this.log.warn("model usage event failed", { usageId: row.id, err }));
-        });
+        await this.usage.oweModelUsage(row.id, orgId);
     }
 };
 __decorate([
@@ -275,7 +268,7 @@ ModelEmbeddings = __decorate([
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(ModelPurposesService)),
     __param(3, Inject(ProviderRegistry)),
-    __param(4, Inject(KernelEvents)),
+    __param(4, Inject(UsageReportJobs)),
     __param(5, Inject(KERNEL_LOGGER)),
     __param(6, Inject(KernelConfigService))
 ], ModelEmbeddings);

package/dist/models/models.module.js

@@ -9,6 +9,7 @@ import { ExtensionRegistryModule } from "../extensions/registry.js";
 import { IdentityModule } from "../identity/identity.module.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
 import { ProvidersModule } from "../runtime/providers.js";
+import { UsageReportJobsModule } from "../runtime/usage-report-jobs.js";
 import { ModelEmbeddings } from "./embeddings.js";
 import { ModelEnablementModule } from "./enablement.js";
 import { PricesService } from "./prices.js";
@@ -28,6 +29,8 @@ ModelsModule = __decorate([
             OrgLockModule,
             ProvidersModule,
             ModelEnablementModule,
+            // an embed call's `usage.report` delivery, owed with its `model_usage` row (no queue)
+            UsageReportJobsModule,
         ],
         providers: [PricesService, ModelPurposesService, ModelEmbeddings],
         exports: [PricesService, ModelPurposesService, ModelEnablementModule, ModelEmbeddings],

package/dist/orgs/orgs.service.js

@@ -235,6 +235,13 @@ let OrgsService = class OrgsService {
             .set({ deleted_at: sql `now()` })
             .where("id", "=", orgId)
             .execute();
+        // the org's owed jobs go with it; dead letters stay for the overview, and the deletion's own
+        // cleanup work carries no org_id (transactional outbox spec §9)
+        await this.db
+            .deleteFrom("outbox")
+            .where("org_id", "=", orgId)
+            .where("dead_at", "is", null)
+            .execute();
         // after the org is marked deleted, so it counts as no user of what it shared (P3-18)
         await this.ownedItems.onOrgDeleted(orgId, actor.id, {
             ...(actorTokenId !== undefined && { actorTokenId }),

package/dist/orgs/settings.controller.js

@@ -23,7 +23,7 @@ let OrgSettingsController = class OrgSettingsController {
     async get(org) {
         return {
             settings: await this.settings.get(org.orgId),
-            deployment: this.settings.deployment(),
+            deployment: await this.settings.deployment(),
             sandboxLimits: await this.settings.sandboxLimits(org.orgId),
         };
     }
@@ -32,7 +32,7 @@ let OrgSettingsController = class OrgSettingsController {
         return {
             // an API token may narrow the sandbox, never widen it (sandbox dev tiers spec §2)
             settings: await this.settings.update(org.orgId, body, p.account.id, patTokenId(p), undefined, { onlyNarrows: patTokenId(p) !== undefined }),
-            deployment: this.settings.deployment(),
+            deployment: await this.settings.deployment(),
             sandboxLimits: await this.settings.sandboxLimits(org.orgId),
         };
     }

package/dist/orgs/settings.service.d.ts

@@ -5,6 +5,7 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { type PlatformTiers } from "../sandbox/platform-tiers.js";
 import { type EffectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { OrgLock } from "./org-lock.js";
 /**
@@ -296,13 +297,15 @@ export declare class OrgSettingsService {
     config: Pick<KernelConfigService, "get">, log?: KernelLogger | undefined);
     /** Parses stored settings, warning when an invalid `sandboxTier` narrows to `{ max: "strict" }`. */
     private parseStored;
+    /** The platform's effective sandbox tiers (the startup config over the admin console's choice). */
+    platformTiers(): Promise<PlatformTiers>;
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
-    deployment(): OrgSettingsDeployment;
+    deployment(): Promise<OrgSettingsDeployment>;
     /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
     sandboxLimits(orgId: string): Promise<OrgSandboxLimits>;
     get(orgId: string): Promise<OrgSettings>;
     /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
-    check(patch: OrgSettingsPatch): void;
+    check(patch: OrgSettingsPatch): Promise<void>;
     update(orgId: string, patch: OrgSettingsPatch, actorAccountId: string, actorTokenId?: string, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
     auditDetail?: Record<string, unknown>, 
@@ -313,8 +316,11 @@ export declare class OrgSettingsService {
     opts?: {
         onlyNarrows?: boolean;
     }): Promise<OrgSettings>;
-    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
-    sandboxPolicy(settings: OrgSettings, deviceTier: SandboxTier | null): EffectiveSandboxPolicy;
+    /**
+     * The effective sandbox policy for the org's settings and a device's own tier (null = none);
+     * `tiers`: the platform's tiers when the caller already read them.
+     */
+    sandboxPolicy(settings: OrgSettings, deviceTier: SandboxTier | null, tiers?: PlatformTiers): Promise<EffectiveSandboxPolicy>;
     /**
      * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
      * widens it, never the Platform tool or an API token):
@@ -327,7 +333,7 @@ export declare class OrgSettingsService {
      * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
      *   deployment's when the org gives none) not all in the current list.
      */
-    assertOnlyNarrows(before: OrgSettings, patch: OrgSettingsPatch): void;
+    assertOnlyNarrows(before: OrgSettings, patch: OrgSettingsPatch): Promise<void>;
     private updateIn;
 }
 /**

package/dist/orgs/settings.service.js

@@ -18,6 +18,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { readPlatformTiers } from "../sandbox/platform-tiers.js";
 import { effectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { assertThemeOnIn } from "../themes/theme-state.js";
 import { IanaTimeZone } from "../time-zone.js";
@@ -255,9 +256,14 @@ let OrgSettingsService = class OrgSettingsService {
         }
         return parseOrgSettings(raw);
     }
+    /** The platform's effective sandbox tiers (the startup config over the admin console's choice). */
+    platformTiers() {
+        return readPlatformTiers(this.db.db, this.config, this.log);
+    }
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
-    deployment() {
-        const { limits: lim, tiers } = this.config.get().sandbox;
+    async deployment() {
+        const lim = this.config.get().sandbox.limits;
+        const tiers = await this.platformTiers();
         return {
             sandboxEgress: { mode: lim.egress, allowHosts: [...lim.allowHosts] },
             sandboxTiers: {
@@ -290,14 +296,14 @@ let OrgSettingsService = class OrgSettingsService {
         return this.parseStored(orgId, row.settings);
     }
     /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
-    check(patch) {
+    async check(patch) {
         if (patch.sandboxEgress?.mode === "allowlist" &&
-            this.deployment().sandboxEgress.mode === "none") {
+            this.config.get().sandbox.limits.egress === "none") {
             throw new ApiError("org.sandbox_egress_not_allowed", "This deployment disables sandbox network access (sandbox.limits.egress is none); an organization can only set sandboxEgress to none");
         }
         const t = patch.sandboxTier;
         if (t != null) {
-            const platform = this.config.get().sandbox.tiers;
+            const platform = await this.platformTiers();
             if (t.max !== undefined && !tierAtMost(t.max, platform.max)) {
                 throw sandboxTierNotAllowed(`The platform allows sandbox tiers up to ${platform.max}; sandboxTier.max cannot be ${t.max}`);
             }
@@ -318,12 +324,19 @@ let OrgSettingsService = class OrgSettingsService {
      * change that widens (see {@link assertOnlyNarrows}); only a person in a session widens.
      */
     opts) {
-        this.check(patch);
+        await this.check(patch);
         return this.updateIn(orgId, patch, actorAccountId, actorTokenId, auditDetail, opts);
     }
-    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
-    sandboxPolicy(settings, deviceTier) {
-        return effectiveSandboxPolicy(this.config.get().sandbox, settings, deviceTier);
+    /**
+     * The effective sandbox policy for the org's settings and a device's own tier (null = none);
+     * `tiers`: the platform's tiers when the caller already read them.
+     */
+    async sandboxPolicy(settings, deviceTier, tiers) {
+        const deployment = {
+            limits: this.config.get().sandbox.limits,
+            tiers: tiers ?? (await this.platformTiers()),
+        };
+        return effectiveSandboxPolicy(deployment, settings, deviceTier);
     }
     /**
      * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
@@ -337,12 +350,13 @@ let OrgSettingsService = class OrgSettingsService {
      * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
      *   deployment's when the org gives none) not all in the current list.
      */
-    assertOnlyNarrows(before, patch) {
+    async assertOnlyNarrows(before, patch) {
         if (patch.sandboxTier !== undefined) {
             const next = patch.sandboxTier ?? undefined;
             const prev = before.sandboxTier;
-            const b = this.sandboxPolicy(before, null);
-            const a = this.sandboxPolicy({ ...before, sandboxTier: next }, null);
+            const tiers = await this.platformTiers();
+            const b = await this.sandboxPolicy(before, null, tiers);
+            const a = await this.sandboxPolicy({ ...before, sandboxTier: next }, null, tiers);
             // a cleared default follows the platform, capped by the ceiling: `max` bounds it then
             const nextDefault = next?.default === undefined && next?.max !== undefined ? next.max : next?.default;
             if (!tierAtMost(a.ceiling, b.ceiling) ||
@@ -381,10 +395,10 @@ let OrgSettingsService = class OrgSettingsService {
         const stored = asObject(row.settings);
         const before = this.parseStored(orgId, stored);
         // again under the org lock: a hot config reload may have lowered the platform since
-        this.check(patch);
+        await this.check(patch);
         // under the org lock, so the comparison is with the value the write replaces
         if (opts?.onlyNarrows)
-            this.assertOnlyNarrows(before, patch);
+            await this.assertOnlyNarrows(before, patch);
         const changes = Object.fromEntries(Object.entries(patch)
             .filter(([, v]) => v !== undefined)
             // null clears sandboxEgress / wakeOnBackgroundTask: follow the deployment default again