@capybara-hq/kernel 0.1.0-rc.22 → 0.1.0-rc.24

package/dist/devices/devices.service.js

@@ -29,7 +29,7 @@ import { readOrgSettings } from "../orgs/settings.service.js";
 import { SandboxJobs } from "../sandbox/jobs.js";
 import { isInternalProvider, LOCAL_PROVIDER, SandboxProviders } from "../sandbox/providers.js";
 import { deviceNotFound, SandboxService } from "../sandbox/sandbox.service.js";
-import { effectiveSandboxPolicy } from "../sandbox/tiers.js";
+import { effectiveSandboxPolicy, readDeploymentSandboxPolicy, } from "../sandbox/tiers.js";
 import { unattendedTierOf } from "../schedules/unattended.js";
 import { DeviceAccess, demotedProvider, deviceProvider, deviceUnavailable, inUseForDefault, } from "./access.js";
 /** How many recent sandbox changes a device view lists. */
@@ -293,7 +293,11 @@ let DevicesService = class DevicesService {
     }
     /** The org's sandbox policy for a device choosing `tier` (null: the org's default). */
     async policyFor(orgId, tier) {
-        return effectiveSandboxPolicy(this.config.get().sandbox, await readOrgSettings(this.db.db, orgId), tier);
+        const [deployment, settings] = await Promise.all([
+            readDeploymentSandboxPolicy(this.db.db, this.config),
+            readOrgSettings(this.db.db, orgId),
+        ]);
+        return effectiveSandboxPolicy(deployment, settings, tier);
     }
     /**
      * The sandbox level a sandbox call in the device runs at now, for the model (`device_paths`,
@@ -318,11 +322,12 @@ let DevicesService = class DevicesService {
             .executeTakeFirst();
         if (row === undefined)
             return null;
-        const [settings, unattended] = await Promise.all([
+        const [deployment, settings, unattended] = await Promise.all([
+            readDeploymentSandboxPolicy(this.db.db, this.config),
             readOrgSettings(this.db.db, orgId),
             runId === undefined ? null : unattendedTierOf(this.db.db, runId, deviceId),
         ]);
-        const policyOf = (tier) => effectiveSandboxPolicy(this.config.get().sandbox, settings, tier);
+        const policyOf = (tier) => effectiveSandboxPolicy(deployment, settings, tier);
         const summary = localPolicyOf(row.local_policy);
         const s = sandboxStateOf(policyOf, {
             source: row.source,
@@ -807,12 +812,13 @@ let DevicesService = class DevicesService {
         const demotedProviders = [
             ...new Set(rows.flatMap((r) => (demoted.get(r.id) ? [demoted.get(r.id)] : []))),
         ];
-        const [names, recent, settings] = await Promise.all([
+        const [names, recent, settings, deployment] = await Promise.all([
             this.displayNames.many(demotedProviders),
             this.recentSandboxChanges(orgId, rows.map((r) => r.id)),
             readOrgSettings(this.db.db, orgId),
+            readDeploymentSandboxPolicy(this.db.db, this.config),
         ]);
-        const policyOf = (tier) => effectiveSandboxPolicy(this.config.get().sandbox, settings, tier);
+        const policyOf = (tier) => effectiveSandboxPolicy(deployment, settings, tier);
         // each device's limits (a cloud device's own tier) and its instance's pending change
         const perDevice = new Map(await Promise.all(rows.map(async (r) => {
             const policy = policyOf(r.source === "cloud" ? r.tier : null);
@@ -1049,7 +1055,16 @@ const tierOrNull = (v) => v === "strict" || v === "dev" || v === "open" ? v : nu
 function sandboxChangeOf(action, at, d, by) {
     const hosts = (v) => Array.isArray(v) ? v.filter((h) => typeof h === "string") : [];
     const isolation = d.isolation === "sandbox" || d.isolation === "none" ? d.isolation : null;
-    const base = { at: at.toISOString(), add: [], remove: [], tier: null, isolation: null, by };
+    const base = {
+        at: at.toISOString(),
+        add: [],
+        remove: [],
+        tier: null,
+        isolation: null,
+        localhost: null,
+        remoteGrants: null,
+        by,
+    };
     if (action === "device.tier_changed") {
         return { ...base, kind: "tier", tier: { to: tierOrNull(d.to) }, via: "web", confirmed: true };
     }
@@ -1062,9 +1077,15 @@ function sandboxChangeOf(action, at, d, by) {
         add: hosts(d.add),
         remove: hosts(d.remove),
         // the key is there only when the change set the tier (null: follow the org's default)
-        tier: "tier" in d ? { to: tierOrNull(d.tier) } : null,
+        tier: "tier" in d
+            ? { ...("tierFrom" in d && { from: tierOrNull(d.tierFrom) }), to: tierOrNull(d.tier) }
+            : null,
         isolation,
-        via: d.via === "im" ? "im" : "web",
+        localhost: d.localhost === "on" || d.localhost === "off-proxy-detected" || d.localhost === "off"
+            ? d.localhost
+            : null,
+        remoteGrants: d.remoteGrants === "owner" || d.remoteGrants === "off" ? d.remoteGrants : null,
+        via: d.via === "im" ? "im" : d.via === "device" ? "device" : "web",
         confirmed: d.confirmed === true,
     };
 }

package/dist/errors.d.ts

@@ -36,6 +36,10 @@ export declare const ERROR_CODES: {
     readonly "org.owner_required": 403;
     readonly "org.sandbox_egress_not_allowed": 400;
     readonly "org.sandbox_tier_not_allowed": 400;
+    /** A deployment setting set in the startup config (file, Nacos or env): read-only in the admin console. */
+    readonly "deployment.setting_readonly": 409;
+    /** Raising the platform's sandbox tiers through an API token or the Platform tool (only narrowing). */
+    readonly "deployment.sandbox_tier_not_allowed": 400;
     readonly "member.not_found": 404;
     readonly "member.already_exists": 409;
     readonly "member.anonymous_guest": 409;
@@ -221,10 +225,17 @@ export declare const ERROR_CODES: {
     readonly "plugin.upgrade_stale": 409;
     readonly "plugin.upgrade_target_invalid": 409;
     readonly "plugin.upgrade_failed": 502;
+    /**
+     * The platform's import and update imported the version but the update failed: the platform
+     * stays on its version, the imported version is in the catalog (retry with the plain update).
+     */
+    readonly "plugin.imported_not_updated": 409;
     readonly "setup.already_completed": 409;
     readonly "setup.token_invalid": 403;
     /** The admin overview's seven-day usage aggregate ran past its statement timeout (spec §5.5). */
     readonly "admin.usage_unavailable": 503;
+    /** No dead outbox row has this id (delivered, discarded, retried, or never dead). */
+    readonly "outbox.not_found": 404;
     readonly "agent.not_found": 404;
     readonly "agent.version_conflict": 409;
     /** The profile was changed since the client read it (`expectedUpdatedAt` is stale). */
@@ -315,6 +326,10 @@ export declare const ERROR_CODES: {
     readonly "attachment.too_many_pending": 429;
     readonly "sandbox.unavailable": 503;
     readonly "sandbox.busy": 409;
+    /** A cloud sandbox provider refused the device's tier (its config refuses open egress). */
+    readonly "sandbox.tier_refused": 409;
+    /** A cloud sandbox provider failed to create a device's sandbox for another reason. */
+    readonly "sandbox.create_failed": 502;
     /** A sandbox file path the kernel reads is not absolute or not under the sandbox roots. */
     readonly "sandbox.file_invalid_path": 422;
     /** No file at the sandbox path the kernel reads. */

package/dist/errors.js

@@ -36,6 +36,10 @@ export const ERROR_CODES = {
     "org.owner_required": 403,
     "org.sandbox_egress_not_allowed": 400,
     "org.sandbox_tier_not_allowed": 400,
+    /** A deployment setting set in the startup config (file, Nacos or env): read-only in the admin console. */
+    "deployment.setting_readonly": 409,
+    /** Raising the platform's sandbox tiers through an API token or the Platform tool (only narrowing). */
+    "deployment.sandbox_tier_not_allowed": 400,
     "member.not_found": 404,
     "member.already_exists": 409,
     "member.anonymous_guest": 409,
@@ -221,10 +225,17 @@ export const ERROR_CODES = {
     "plugin.upgrade_stale": 409,
     "plugin.upgrade_target_invalid": 409,
     "plugin.upgrade_failed": 502,
+    /**
+     * The platform's import and update imported the version but the update failed: the platform
+     * stays on its version, the imported version is in the catalog (retry with the plain update).
+     */
+    "plugin.imported_not_updated": 409,
     "setup.already_completed": 409,
     "setup.token_invalid": 403,
     /** The admin overview's seven-day usage aggregate ran past its statement timeout (spec §5.5). */
     "admin.usage_unavailable": 503,
+    /** No dead outbox row has this id (delivered, discarded, retried, or never dead). */
+    "outbox.not_found": 404,
     "agent.not_found": 404,
     "agent.version_conflict": 409,
     /** The profile was changed since the client read it (`expectedUpdatedAt` is stale). */
@@ -315,6 +326,10 @@ export const ERROR_CODES = {
     "attachment.too_many_pending": 429,
     "sandbox.unavailable": 503,
     "sandbox.busy": 409,
+    /** A cloud sandbox provider refused the device's tier (its config refuses open egress). */
+    "sandbox.tier_refused": 409,
+    /** A cloud sandbox provider failed to create a device's sandbox for another reason. */
+    "sandbox.create_failed": 502,
     /** A sandbox file path the kernel reads is not absolute or not under the sandbox roots. */
     "sandbox.file_invalid_path": 422,
     /** No file at the sandbox path the kernel reads. */

package/dist/evals/run-replay.js

@@ -19,6 +19,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { estimateTokens } from "../runtime/context/tokens.js";
+import { runDeadline, tightestLimit } from "../runtime/limits.js";
 import { RunError } from "../runtime/model-call.js";
 import { runContextIdemKey } from "../runtime/run-context.service.js";
 import { recordedSkillForks } from "../runtime/subagents/skill-fork.js";
@@ -526,13 +527,18 @@ export async function replayRun(d, s, candidate, evalRunId, signal) {
         return out;
     };
     const runtime = d.config.get().runtime;
-    const deadline = Date.now() + runtime.maxRunSeconds * 1000;
+    // 0 in the config or the logged child limit = no limit there
+    const maxSteps = tightestLimit(subagent?.maxSteps, runtime.maxSteps);
+    // `runtime.maxRunSeconds` 0: no deadline and no timer
+    const deadline = runDeadline(Date.now(), runtime.maxRunSeconds);
     let deadlineHit = false;
-    const timer = setTimeout(() => {
-        deadlineHit = true;
-        stopper.abort();
-    }, Math.max(0, deadline - Date.now()));
-    timer.unref();
+    const timer = deadline === undefined
+        ? undefined
+        : setTimeout(() => {
+            deadlineHit = true;
+            stopper.abort();
+        }, Math.max(0, deadline - Date.now()));
+    timer?.unref();
     // a fork invocation's report is the recorded one: a replay never dispatches a sub-agent (A5)
     const skillForks = recordedSkillForks(eventLog, s.events.filter((e) => e.runId === s.runId));
     const loop = d.loop({ toolPipeline: pipeline, registry, skillForks, ...(media && { media }) });
@@ -551,8 +557,8 @@ export async function replayRun(d, s, candidate, evalRunId, signal) {
             sink: () => { },
             pendingAbsorbable,
             limits: {
-                maxSteps: subagent === undefined ? runtime.maxSteps : Math.min(subagent.maxSteps, runtime.maxSteps),
-                deadline,
+                ...(maxSteps !== undefined && { maxSteps }),
+                ...(deadline !== undefined && { deadline }),
             },
             // replays never fire plugin hooks (the loop deps omit them too, P-18)
             conversationKind: "eval",

package/dist/extensions/extensions.module.js

@@ -28,6 +28,7 @@ import { SingleProviderGuard } from "./single-provider.js";
 import { ReplicaStatusStore } from "./sources.js";
 import { ExtensionStateModule } from "./state.module.js";
 import { ExtensionAvailability } from "./unavailable.js";
+import { UsageSubscribersModule } from "./usage-subscribers.js";
 /**
  * The extensions domain: the extension host (it builds each `ctx` from the injected kernel
  * services), the package store and install records (the desired state the host converges to, one
@@ -48,6 +49,8 @@ ExtensionsModule = __decorate([
             ExtensionStateModule,
             // ctx.models: the embeddings broker (models domain, below the host through ExtensionStateModule)
             ModelsModule,
+            // the lifecycle clears the `usage.report` subscriber cache on PLUGINS_CHANGED
+            UsageSubscribersModule,
         ],
         providers: [
             PluginInstallLock,

package/dist/extensions/lifecycle.d.ts

@@ -7,6 +7,7 @@ import { ExtensionInstalls } from "./installs.js";
 import { PLUGINS_CHANGED_TOPIC, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, STALE_RECONCILE_PERIODS } from "./lifecycle-topics.js";
 import { PLUGINS_MIGRATED_TOPIC } from "./migrate-lock.js";
 import { ReplicaStatusStore } from "./sources.js";
+import { UsageSubscribers } from "./usage-subscribers.js";
 export { PLUGINS_CHANGED_TOPIC, PLUGINS_MIGRATED_TOPIC, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, STALE_RECONCILE_PERIODS, };
 /**
  * 每副本一个：把本副本的插件加载状态收敛到 PG 期望状态（C16）。
@@ -24,6 +25,8 @@ export declare class ExtensionLifecycle {
     private readonly installs;
     private readonly config;
     private readonly log;
+    /** "Does any plugin subscribe to usage.report": its cached answer is cleared on PLUGINS_CHANGED. */
+    private readonly usageSubscribers;
     private running;
     private queued;
     private unsubs;
@@ -32,7 +35,9 @@ export declare class ExtensionLifecycle {
     private stopped;
     constructor(host: ExtensionHost, bus: Pick<ExtensionContext["bus"], "publish" | "subscribe">, status: ReplicaStatusStore, 
     /** Every install record's name (any desired state): prunes status rows this replica no longer knows. */
-    installs: ExtensionInstalls, config: KernelConfigService, log: KernelLogger);
+    installs: ExtensionInstalls, config: KernelConfigService, log: KernelLogger, 
+    /** "Does any plugin subscribe to usage.report": its cached answer is cleared on PLUGINS_CHANGED. */
+    usageSubscribers: Pick<UsageSubscribers, "invalidate">);
     /** 订阅三个主题（订阅失败只记 error：周期任务的消息同样收不到时，下次启动再来）。 */
     start(): Promise<void>;
     /**

package/dist/extensions/lifecycle.js

@@ -17,6 +17,7 @@ import { ExtensionInstalls } from "./installs.js";
 import { PLUGIN_DEPLOYMENT_CONFIG_TOPIC, PLUGINS_CHANGED_TOPIC, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, STALE_RECONCILE_PERIODS, } from "./lifecycle-topics.js";
 import { PLUGINS_MIGRATED_TOPIC } from "./migrate-lock.js";
 import { ReplicaStatusStore } from "./sources.js";
+import { UsageSubscribers } from "./usage-subscribers.js";
 export { PLUGINS_CHANGED_TOPIC, PLUGINS_MIGRATED_TOPIC, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, STALE_RECONCILE_PERIODS, };
 /** 心跳超过这么多个周期的行直接删除（副本早已退出；读的一方本来就不计入）。 */
 const PRUNE_RECONCILE_PERIODS = 10;
@@ -35,6 +36,7 @@ let ExtensionLifecycle = class ExtensionLifecycle {
     installs;
     config;
     log;
+    usageSubscribers;
     running;
     queued;
     unsubs = [];
@@ -43,13 +45,16 @@ let ExtensionLifecycle = class ExtensionLifecycle {
     stopped = false;
     constructor(host, bus, status, 
     /** Every install record's name (any desired state): prunes status rows this replica no longer knows. */
-    installs, config, log) {
+    installs, config, log, 
+    /** "Does any plugin subscribe to usage.report": its cached answer is cleared on PLUGINS_CHANGED. */
+    usageSubscribers) {
         this.host = host;
         this.bus = bus;
         this.status = status;
         this.installs = installs;
         this.config = config;
         this.log = log;
+        this.usageSubscribers = usageSubscribers;
     }
     /** 订阅三个主题（订阅失败只记 error：周期任务的消息同样收不到时，下次启动再来）。 */
     async start() {
@@ -65,6 +70,7 @@ let ExtensionLifecycle = class ExtensionLifecycle {
         await on(PLUGINS_CHANGED_TOPIC, (p) => {
             // 安装 / 卸载改变了「部署已知」的插件名：路由闸门不等 TTL
             this.host.invalidateKnownNames();
+            this.usageSubscribers.invalidate();
             this.trigger(`changed:${pluginOf(p)}`);
         });
         await on(PLUGINS_RECONCILE_TOPIC, () => this.trigger("periodic"));
@@ -176,7 +182,8 @@ ExtensionLifecycle = __decorate([
     __param(2, Inject(ReplicaStatusStore)),
     __param(3, Inject(ExtensionInstalls)),
     __param(4, Inject(KernelConfigService)),
-    __param(5, Inject(KERNEL_LOGGER))
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(UsageSubscribers))
 ], ExtensionLifecycle);
 export { ExtensionLifecycle };
 const pluginOf = (p) => typeof p === "object" && p !== null && typeof p.plugin === "string"

package/dist/extensions/usage-subscribers.d.ts

@@ -0,0 +1,43 @@
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+/**
+ * Plugins that subscribe to `usage.report` according to deployment state: an approved permission
+ * snapshot that declares the `usage.report` hook, for a plugin the deployment still knows: an enabled
+ * install, or a config-declared plugin with a replica status row that is not `unloaded`. With `orgId`, only plugins
+ * the organization enabled (org config rows and required bootstrap plugins).
+ */
+export declare function queryUsageSubscribers(db: KernelSchemaDb, orgId?: string): Promise<Set<string>>;
+/** How long one replica trusts its answer to "does any plugin subscribe" (spec §8.1). */
+export declare const USAGE_SUBSCRIBERS_TTL_MS = 30000;
+/**
+ * Test seam (`KernelOverride`): the clock {@link UsageSubscribers} ages its cached answer with
+ * (default `Date.now`); the kernel never provides it.
+ */
+export declare const USAGE_SUBSCRIBERS_CLOCK: unique symbol;
+/**
+ * Whether the deployment has at least one `usage.report` subscriber ({@link queryUsageSubscribers}
+ * without an org), which decides whether a usage write owes a delivery (transactional outbox spec
+ * §8.1): a usage event written while no plugin subscribes is never reported, later subscribers
+ * included. The answer comes from PG, not from this replica's loaded handlers, so a replica that
+ * has no handler still owes the delivery another replica makes.
+ *
+ * Per-process memoisation of that PG read: kept {@link USAGE_SUBSCRIBERS_TTL_MS} and cleared on
+ * `PLUGINS_CHANGED` (`ExtensionLifecycle` calls {@link invalidate}), so an enabled subscriber is
+ * seen at once, or within 30 s when the bus message is lost. It holds no state another request or
+ * replica relies on.
+ */
+export declare class UsageSubscribers {
+    private readonly kdb;
+    private readonly now;
+    private cached;
+    /** Bumped by {@link invalidate}: a read that started before it does not refill the cache. */
+    private generation;
+    constructor(kdb: KernelDb, now?: () => number);
+    /** Whether any plugin subscribes (cached; the read joins the caller's transaction, if any). */
+    any(): Promise<boolean>;
+    /** Forgets the cached answer (a plugin was installed, enabled, upgraded or removed). */
+    invalidate(): void;
+}
+/** {@link UsageSubscribers}: below the extension host, so the model broker and the runtime use it. */
+export declare class UsageSubscribersModule {
+}

package/dist/extensions/usage-subscribers.js

@@ -0,0 +1,108 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Module, Optional } from "@nestjs/common";
+import { sql } from "kysely";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { enabledExtensionsQuery } from "./enabled.js";
+/**
+ * Plugins that subscribe to `usage.report` according to deployment state: an approved permission
+ * snapshot that declares the `usage.report` hook, for a plugin the deployment still knows: an enabled
+ * install, or a config-declared plugin with a replica status row that is not `unloaded`. With `orgId`, only plugins
+ * the organization enabled (org config rows and required bootstrap plugins).
+ */
+export async function queryUsageSubscribers(db, orgId) {
+    let q = db
+        .selectFrom("extension_permission_snapshots as s")
+        .select("s.plugin")
+        .where(sql `s.permissions -> 'permissions' -> 'hooks' ? 'usage.report'`)
+        .where((eb) => eb.or([
+        eb.exists(eb
+            .selectFrom("extension_installs as i")
+            .select(sql `1`.as("one"))
+            .whereRef("i.name", "=", "s.plugin")
+            .where("i.desired_state", "=", "enabled")),
+        // config-declared plugins still declared (and not unloaded) on some replica; installs are
+        // covered by desired_state above (their replica rows linger as `unloaded` when disabled)
+        eb.exists(eb
+            .selectFrom("extension_replica_status as r")
+            .select(sql `1`.as("one"))
+            .whereRef("r.plugin", "=", "s.plugin")
+            .where("r.source", "=", "config")
+            .where("r.state", "<>", "unloaded")),
+    ]));
+    if (orgId !== undefined) {
+        q = q.where("s.plugin", "in", enabledExtensionsQuery(db, orgId));
+    }
+    return new Set((await q.execute()).map((r) => r.plugin));
+}
+/** How long one replica trusts its answer to "does any plugin subscribe" (spec §8.1). */
+export const USAGE_SUBSCRIBERS_TTL_MS = 30_000;
+/**
+ * Test seam (`KernelOverride`): the clock {@link UsageSubscribers} ages its cached answer with
+ * (default `Date.now`); the kernel never provides it.
+ */
+export const USAGE_SUBSCRIBERS_CLOCK = Symbol("USAGE_SUBSCRIBERS_CLOCK");
+/**
+ * Whether the deployment has at least one `usage.report` subscriber ({@link queryUsageSubscribers}
+ * without an org), which decides whether a usage write owes a delivery (transactional outbox spec
+ * §8.1): a usage event written while no plugin subscribes is never reported, later subscribers
+ * included. The answer comes from PG, not from this replica's loaded handlers, so a replica that
+ * has no handler still owes the delivery another replica makes.
+ *
+ * Per-process memoisation of that PG read: kept {@link USAGE_SUBSCRIBERS_TTL_MS} and cleared on
+ * `PLUGINS_CHANGED` (`ExtensionLifecycle` calls {@link invalidate}), so an enabled subscriber is
+ * seen at once, or within 30 s when the bus message is lost. It holds no state another request or
+ * replica relies on.
+ */
+let UsageSubscribers = class UsageSubscribers {
+    kdb;
+    now;
+    cached;
+    /** Bumped by {@link invalidate}: a read that started before it does not refill the cache. */
+    generation = 0;
+    constructor(kdb, now = Date.now) {
+        this.kdb = kdb;
+        this.now = now;
+    }
+    /** Whether any plugin subscribes (cached; the read joins the caller's transaction, if any). */
+    async any() {
+        const at = this.now();
+        const c = this.cached;
+        if (c !== undefined && at - c.at < USAGE_SUBSCRIBERS_TTL_MS)
+            return c.any;
+        const generation = this.generation;
+        const any = (await queryUsageSubscribers(this.kdb.db)).size > 0;
+        if (generation === this.generation)
+            this.cached = { any, at };
+        return any;
+    }
+    /** Forgets the cached answer (a plugin was installed, enabled, upgraded or removed). */
+    invalidate() {
+        this.generation++;
+        this.cached = undefined;
+    }
+};
+UsageSubscribers = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Optional()),
+    __param(1, Inject(USAGE_SUBSCRIBERS_CLOCK))
+], UsageSubscribers);
+export { UsageSubscribers };
+/** {@link UsageSubscribers}: below the extension host, so the model broker and the runtime use it. */
+let UsageSubscribersModule = class UsageSubscribersModule {
+};
+UsageSubscribersModule = __decorate([
+    Module({
+        providers: [UsageSubscribers],
+        exports: [UsageSubscribers],
+    })
+], UsageSubscribersModule);
+export { UsageSubscribersModule };

package/dist/http/api.module.js

@@ -12,6 +12,7 @@ import { AdminAgentsController } from "../admin/admin-agents.controller.js";
 import { AdminConnectorsController } from "../admin/admin-connectors.controller.js";
 import { AdminAuditController } from "../admin/audit.controller.js";
 import { AdminExtensionsController } from "../admin/extensions.controller.js";
+import { OutboxDeadController } from "../admin/outbox-dead.controller.js";
 import { AdminOverviewController } from "../admin/overview.controller.js";
 import { SetupController } from "../admin/setup.controller.js";
 import { AgentsController } from "../agents/agents.controller.js";
@@ -107,6 +108,7 @@ const CONTROLLERS = [
     AdminConnectorsController,
     AdminAuditController,
     AdminOverviewController,
+    OutboxDeadController,
     AdminExtensionsController,
     AdminCatalogController,
     AdminComponentsController,

package/dist/identity/settings.d.ts

@@ -1,8 +1,10 @@
 import { z } from "zod";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { type PlatformTiers, type PlatformTiersPatch, type PlatformTiersStored, type PlatformTiersView } from "../sandbox/platform-tiers.js";
 import { type UiArrangement } from "../ui/arrangement.js";
 import { SuperAdminLock } from "./super-admin.js";
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
@@ -105,6 +107,14 @@ export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DeploymentSettings = z.infer<typeof DEPLOYMENT_SETTINGS>;
+/**
+ * What `GET /api/v1/admin/settings` answers: the stored settings, and the platform's sandbox tiers
+ * as they are in effect with where each field comes from (`env` / `file` / `nacos`: the startup
+ * config, read-only here; `db`: chosen in the admin console; `default`).
+ */
+export type DeploymentSettingsView = DeploymentSettings & {
+    sandboxTiers: PlatformTiersView;
+};
 /**
  * 设置的修改（PUT /api/v1/admin/settings 的 body）：只改给出的键。
  * `runConcurrencyOverrides` 按组织合并：值为正整数 → 设置该组织的上限；值为 null → 删除该组织的覆盖
@@ -147,6 +157,19 @@ export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
         disabled: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    sandboxTiers: z.ZodOptional<z.ZodObject<{
+        max: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>>;
+        default: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>>;
+        allowUnsandboxed: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DeploymentSettingsPatch = z.infer<typeof DEPLOYMENT_SETTINGS_PATCH>;
 /**
@@ -198,7 +221,29 @@ export declare class SettingsService {
     readonly txHost: TransactionHost;
     private readonly adminLock;
     private readonly log;
-    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, log: Pick<KernelLogger, "warn">);
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    private readonly config;
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, log: Pick<KernelLogger, "warn">, 
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    config: Pick<KernelConfigService, "get" | "fieldSource">);
+    /** The settings with the platform's sandbox tiers in effect and their sources. */
+    view(): Promise<DeploymentSettingsView>;
+    private tiersView;
+    /**
+     * The refusals of a `sandboxTiers` change against the stored choice: a field set in the
+     * startup config (`deployment.setting_readonly`), a default above the max
+     * (`validation_failed`), and with `onlyNarrows` (an API token, the Platform tool) any widening:
+     * a higher max or default, unsandboxed allowed, in effect or in the stored choice (which
+     * applies once the startup config stops setting a field). Returns the next stored choice and
+     * the effective tiers before and after.
+     */
+    checkSandboxTiers(patch: PlatformTiersPatch, opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<{
+        next: PlatformTiersStored;
+        before: PlatformTiers;
+        after: PlatformTiers;
+    }>;
     /**
      * Reads every setting, in the context's transaction when there is one (a caller holding a
      * transaction connection does not take a second one from the pool). Each key is validated on
@@ -206,9 +251,14 @@ export declare class SettingsService {
      * valid keys apply; unknown keys (written by a newer version) are ignored.
      */
     get(): Promise<DeploymentSettings>;
-    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    /**
+     * Updates settings under the super admin lock, re-checking the actor (else `forbidden`).
+     * `onlyNarrows` (an API token, the Platform tool): `sandboxTiers` may only narrow.
+     */
     update(patch: DeploymentSettingsPatch, actorAccountId: string, actorTokenId?: string, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail?: Record<string, unknown>): Promise<DeploymentSettings>;
+    auditDetail?: Record<string, unknown>, opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<DeploymentSettingsView>;
     private write;
 }