@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.24

package/dist/overrides.js

@@ -3,14 +3,18 @@ import { ADMIN_USAGE_TIMINGS } from "./admin/usage.service.js";
 import { CHANNEL_WEBHOOK_TIMINGS } from "./channels/webhook.js";
 import { EVAL_REPLAY_HOOKS } from "./evals/worker.js";
 import { BOOTSTRAP_LOCK_TTL } from "./extensions/bootstrap.js";
+import { USAGE_SUBSCRIBERS_CLOCK } from "./extensions/usage-subscribers.js";
 import { FILE_PREVIEW_TIMEOUT } from "./files/previewers.js";
+import { OUTBOX_DISPATCH_FAILS } from "./infra/outbox/outbox.dispatcher.js";
+import { OUTBOX_FAST_PATH_SETTLED } from "./infra/outbox/outbox.module.js";
+import { OUTBOX_STRICT_CONFLICTS } from "./infra/outbox/outbox.service.js";
 import { PRESENCE_INTERVAL_MS } from "./infra/presence/replica-presence.js";
 import { LIST_MODELS_TIMEOUT } from "./runtime/providers.js";
 import { RUN_CONTEXT_CLOCK } from "./runtime/run-context.service.js";
+import { ENSURE_RUN_FAILS } from "./runtime/run-queue.js";
 import { AGENT_LOOP_FACTORY } from "./runtime/run-steps.js";
 import { RUN_HOOKS } from "./runtime/run-worker.js";
 import { SUBAGENT_MESSAGES_HOOKS, } from "./runtime/subagents/messages.js";
-import { USAGE_REPORT_RETRY } from "./runtime/usage-report.js";
 import { SANDBOX_LEASE_TIMINGS } from "./sandbox/leases.js";
 import { SETUP_CHECK_TIMEOUT } from "./setup/setup-checks.service.js";
 import { TOOL_PIPELINE_HOOKS } from "./tools/pipeline.js";
@@ -24,7 +28,7 @@ const SEAM_TOKENS = [
     BOOTSTRAP_LOCK_TTL,
     FILE_PREVIEW_TIMEOUT,
     LIST_MODELS_TIMEOUT,
-    USAGE_REPORT_RETRY,
+    USAGE_SUBSCRIBERS_CLOCK,
     SANDBOX_LEASE_TIMINGS,
     CHANNEL_WEBHOOK_TIMINGS,
     SETUP_CHECK_TIMEOUT,
@@ -32,6 +36,10 @@ const SEAM_TOKENS = [
     ADMIN_USAGE_TIMINGS,
     EMBED_TOKEN_CLOCK,
     RUN_CONTEXT_CLOCK,
+    OUTBOX_STRICT_CONFLICTS,
+    OUTBOX_DISPATCH_FAILS,
+    OUTBOX_FAST_PATH_SETTLED,
+    ENSURE_RUN_FAILS,
     APP_INTERCEPTOR,
 ];
 const allSeamsListed = true;

package/dist/platform/exclusions.js

@@ -95,6 +95,11 @@ export const PLATFORM_EXCLUSIONS = [
         category: "human-only",
         reason: "Confirms an import review, an approval decision by the super admin",
     },
+    {
+        route: "POST /api/v1/admin/catalog/imports/:stagingId/update",
+        category: "human-only",
+        reason: "Confirms an import review together with the platform update it applies, an approval decision by the super admin",
+    },
     {
         route: "GET /api/v1/admin/catalog/items/:id/icon",
         category: "transport",

package/dist/platform/ops/admin.ops.js

@@ -78,6 +78,22 @@ function attentionRows(a) {
                     ? `Check the provider's deployment config and connection on its extension page (/admin/extensions/${p.plugin}); the models page (/admin/models) shows the list.`
                     : "The provider lists no chat model that is switched on: switch one on in the admin console (/admin/models) or check the provider's config.",
             })),
+            ...a.outbox.map((o) => ({
+                kind: "outbox",
+                id: o.kind,
+                name: "Background work that could not be queued",
+                state: "dead",
+                reason: `${o.count} dead outbox row(s), the oldest dead since ${o.oldestAt}`,
+                next: "List them with admin.outbox-list-dead, then retry each with admin.outbox-retry or drop it with admin.outbox-discard.",
+            })),
+            ...a.queue.map((q) => ({
+                kind: "queue",
+                id: q.kind,
+                name: "The queue lost background jobs",
+                state: "lost_jobs",
+                reason: `${q.count} queued run job(s) were missing from the queue, the last at ${q.lastAt}; they were queued again`,
+                next: "Redis lost data: check its persistence (AOF or snapshots) and whether it restarted or evicted keys. Nothing to do per run; the item clears a week after the last loss.",
+            })),
         ],
         more: a.more,
         unavailable: a.unavailable,
@@ -127,7 +143,7 @@ let AdminOperations = class AdminOperations {
         this.registry.register([
             defineOperation({
                 id: "admin.overview",
-                description: "The admin console's dashboard numbers (super admin): orgs, accounts and attentionTotal, everything waiting for a super admin (the platform inbox total plus the extensions, plugin updates and model providers admin.attention lists); partial is true when one of those lists could not be read right now (attentionTotal then leaves it out).",
+                description: "The admin console's dashboard numbers (super admin): orgs, accounts and attentionTotal, everything waiting for a super admin (the platform inbox total plus the extensions, plugin updates and model providers admin.attention lists, every dead outbox row and the lost-jobs item of the run queue); partial is true when one of those lists could not be read right now (attentionTotal then leaves it out).",
                 input: z.object({}).strict(),
                 example: {},
                 authz: { superAdmin: true },
@@ -137,7 +153,7 @@ let AdminOperations = class AdminOperations {
             }),
             defineOperation({
                 id: "admin.attention",
-                description: "What needs the super admin besides the platform inbox (super admin), one compact row each (kind, id, name, state, reason, next step): extensions (reason config, load_failed, approval, dependency, conflict, converging or legacy_format), platform plugins with a newer marketplace version (reason names both versions) and model providers (reason list_failed or no_chat_model). Each kind lists at most 20 rows; more counts the rest per kind. unavailable names a kind that could not be read right now (try again later). The platform inbox itself is inbox.platform-list.",
+                description: "What needs the super admin besides the platform inbox (super admin), one compact row each (kind, id, name, state, reason, next step): extensions (reason config, load_failed, approval, dependency, conflict, converging or legacy_format), platform plugins with a newer marketplace version (reason names both versions) model providers (reason list_failed or no_chat_model) background work the kernel could not queue (kind outbox: how many outbox rows are dead and since when) and run jobs the queue lost (kind queue: Redis lost data; the runs were queued again). Each kind lists at most 20 rows; more counts the rest per kind. unavailable names a kind that could not be read right now (try again later). The platform inbox itself is inbox.platform-list.",
                 input: z.object({}).strict(),
                 example: {},
                 authz: { superAdmin: true },

package/dist/platform/ops/catalog-admin.ops.d.ts

@@ -2,6 +2,7 @@ import { type OnModuleInit } from "@nestjs/common";
 import { type AppearanceResult, AppearanceService } from "../../catalog/appearance.service.js";
 import { CatalogService } from "../../catalog/catalog.service.js";
 import { CatalogScopeService } from "../../catalog/catalog-scope.service.js";
+import { PlatformImportUpdate } from "../../catalog/platform-import-update.js";
 import { PluginImport, type PluginReview } from "../../catalog/plugin-import.js";
 import { KernelDb } from "../../infra/database/kernel-db.js";
 import { ThemesService } from "../../themes/themes.service.js";
@@ -70,10 +71,11 @@ export declare class CatalogAdminOperations implements OnModuleInit {
     private readonly catalog;
     private readonly scope;
     private readonly pluginImport;
+    private readonly importUpdate;
     private readonly kdb;
     private readonly appearance;
     private readonly themes;
-    constructor(registry: PlatformOperations, catalog: CatalogService, scope: CatalogScopeService, pluginImport: PluginImport, kdb: KernelDb, appearance: AppearanceService, themes: ThemesService);
+    constructor(registry: PlatformOperations, catalog: CatalogService, scope: CatalogScopeService, pluginImport: PluginImport, importUpdate: PlatformImportUpdate, kdb: KernelDb, appearance: AppearanceService, themes: ThemesService);
     /** The precheck refusal of another org's private plugin (the phase-1 rule), else null. */
     private otherOrgs;
     /** Whether an org owns the item (its owner org manages it, not the super admin's agent). */

package/dist/platform/ops/catalog-admin.ops.js

@@ -14,6 +14,7 @@ import { CatalogDisabledBody, CatalogGitImportBody, CatalogIdPathParams, Catalog
 import { AppearanceService } from "../../catalog/appearance.service.js";
 import { CatalogService } from "../../catalog/catalog.service.js";
 import { CatalogScopeService } from "../../catalog/catalog-scope.service.js";
+import { PlatformImportUpdate } from "../../catalog/platform-import-update.js";
 import { PluginImport } from "../../catalog/plugin-import.js";
 import { ApiError } from "../../errors.js";
 import { KernelDb } from "../../infra/database/kernel-db.js";
@@ -125,14 +126,16 @@ let CatalogAdminOperations = class CatalogAdminOperations {
     catalog;
     scope;
     pluginImport;
+    importUpdate;
     kdb;
     appearance;
     themes;
-    constructor(registry, catalog, scope, pluginImport, kdb, appearance, themes) {
+    constructor(registry, catalog, scope, pluginImport, importUpdate, kdb, appearance, themes) {
         this.registry = registry;
         this.catalog = catalog;
         this.scope = scope;
         this.pluginImport = pluginImport;
+        this.importUpdate = importUpdate;
         this.kdb = kdb;
         this.appearance = appearance;
         this.themes = themes;
@@ -313,6 +316,30 @@ let CatalogAdminOperations = class CatalogAdminOperations {
                     };
                 },
             }),
+            defineOperation({
+                id: "plugins.import-update-preview",
+                description: "Preview what a staged new version of an installed platform plugin does as the platform update (super admin): every component's change, the extension step and the org connectors it touches. Nothing is imported or changed; the person confirms the review and the update together on the web (reviewUrl).",
+                input: z.object({ stagingId: StagingId }).strict(),
+                example: { stagingId: "3f1c2a9e-5b7d-4e21-9c0a-1d2e3f4a5b6c" },
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/catalog/imports/:stagingId/update-preview"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "plugin.staging_not_found",
+                        next: "The staged import expired (24 hours) or was confirmed already: prepare it again with plugins.import-npm or plugins.import-git.",
+                    },
+                    {
+                        code: "plugin.upgrade_target_invalid",
+                        next: "The plugin is not installed on the platform yet (reason not_installed: the review installs it), or the platform cannot move to this version (the details say why).",
+                    },
+                ],
+                run: async (input) => ({
+                    preview: await this.importUpdate.preview(input.stagingId),
+                    reviewUrl: reviewUrl(input.stagingId),
+                    next: CONFIRM_ON_WEB,
+                }),
+            }),
             defineOperation({
                 id: "plugins.scope-preview",
                 description: "Preview changing where a platform plugin is on (super admin): a scope (all: every org; optional: orgs switch it on; named: only the orgs listed, with orgs) or disabled: true (off everywhere). Returns the orgs that lose it (with the agents there), the components it takes back, name conflicts, and the scopeHash plugins.set-scope or plugins.set-disabled needs. Nothing is written; show the preview to the person first.",
@@ -675,8 +702,9 @@ CatalogAdminOperations = __decorate([
     __param(1, Inject(CatalogService)),
     __param(2, Inject(CatalogScopeService)),
     __param(3, Inject(PluginImport)),
-    __param(4, Inject(KernelDb)),
-    __param(5, Inject(AppearanceService)),
-    __param(6, Inject(ThemesService))
+    __param(4, Inject(PlatformImportUpdate)),
+    __param(5, Inject(KernelDb)),
+    __param(6, Inject(AppearanceService)),
+    __param(7, Inject(ThemesService))
 ], CatalogAdminOperations);
 export { CatalogAdminOperations };

package/dist/platform/ops/outbox.ops.d.ts

@@ -0,0 +1,21 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { OutboxDeadService } from "../../admin/outbox-dead.service.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { PlatformOperations } from "../registry.js";
+/**
+ * The super admin's dead outbox rows through the `Platform` tool (transactional outbox spec
+ * §3.4): the list, retry and discard of `/api/v1/admin/outbox/dead*`, run through the same
+ * service. Dead rows are the deployment's, not an org's: the operations act on all of them.
+ */
+export declare class OutboxOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly dead;
+    private readonly kdb;
+    constructor(registry: PlatformOperations, dead: OutboxDeadService, kdb: KernelDb);
+    /** The dead row's job (queue and name) for a card, or null when no dead row has the id. */
+    private jobOf;
+    private precheck;
+    /** "job-name on queue" for a card, or the bare id when the row is gone. */
+    private label;
+    onModuleInit(): void;
+}

package/dist/platform/ops/outbox.ops.js

@@ -0,0 +1,125 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { z } from "zod";
+import { OutboxDeadParams } from "../../admin/outbox-dead.schemas.js";
+import { OutboxDeadService } from "../../admin/outbox-dead.service.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { defineOperation } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { viaAgent } from "./errors.js";
+const DeadIdInput = OutboxDeadParams.strict();
+/**
+ * The super admin's dead outbox rows through the `Platform` tool (transactional outbox spec
+ * §3.4): the list, retry and discard of `/api/v1/admin/outbox/dead*`, run through the same
+ * service. Dead rows are the deployment's, not an org's: the operations act on all of them.
+ */
+let OutboxOperations = class OutboxOperations {
+    registry;
+    dead;
+    kdb;
+    constructor(registry, dead, kdb) {
+        this.registry = registry;
+        this.dead = dead;
+        this.kdb = kdb;
+    }
+    /** The dead row's job (queue and name) for a card, or null when no dead row has the id. */
+    async jobOf(id) {
+        const row = await this.kdb.db
+            .selectFrom("outbox")
+            .select(["queue", "job_name"])
+            .where("id", "=", id)
+            .where("dead_at", "is not", null)
+            .executeTakeFirst();
+        return row ?? null;
+    }
+    async precheck(id) {
+        return (await this.jobOf(id)) === null
+            ? { ok: false, code: "outbox.not_found", message: `No dead outbox row ${id}.` }
+            : { ok: true };
+    }
+    /** "job-name on queue" for a card, or the bare id when the row is gone. */
+    async label(id) {
+        const job = await this.jobOf(id);
+        return job === null ? `#${id}` : `${job.job_name} (${job.queue}, #${id})`;
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "admin.outbox-list-dead",
+                description: "List background work the kernel could not queue (super admin): outbox rows dead after their last delivery attempt, oldest first (at most 200), each with its id, queue, job name, job id, org (null for platform work), attempts, last error and when it died. Retry one with admin.outbox-retry or drop it with admin.outbox-discard.",
+                input: z.object({}).strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/outbox/dead"],
+                confirm: "read",
+                run: () => this.dead.list(),
+            }),
+            defineOperation({
+                id: "admin.outbox-retry",
+                description: "Queue a dead outbox row again (super admin): it gets fresh attempts and is delivered right away. When the same job is already owed by a pending row, the dead copy is discarded instead; outcome says which (retried or already_owed). A job whose subject is gone since is harmless: it finds nothing to do. The platform audit log records it.",
+                input: DeadIdInput,
+                example: { id: "42" },
+                authz: { superAdmin: true },
+                mirrors: ["POST /api/v1/admin/outbox/dead/:id/retry"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "outbox.not_found",
+                        next: "The row is no longer dead (retried, discarded or delivered): list the dead rows again with admin.outbox-list-dead.",
+                    },
+                ],
+                precheck: (i) => this.precheck(i.id),
+                summary: async (i) => {
+                    const job = await this.label(i.id);
+                    return {
+                        zh: `重新排入无法排入队列的后台任务 ${job}`,
+                        en: `Queue background work that could not be queued again: ${job}`,
+                    };
+                },
+                run: (input, ctx) => this.dead.retry(input.id, { accountId: ctx.actorAccountId }, viaAgent("admin.outbox-retry", ctx)),
+            }),
+            defineOperation({
+                id: "admin.outbox-discard",
+                description: "Discard a dead outbox row (super admin): its job is never run. Use it only when the work is no longer wanted; to run it, use admin.outbox-retry. The platform audit log records it.",
+                input: DeadIdInput,
+                example: { id: "42" },
+                authz: { superAdmin: true },
+                mirrors: ["DELETE /api/v1/admin/outbox/dead/:id"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "outbox.not_found",
+                        next: "The row is no longer dead (retried, discarded or delivered): list the dead rows again with admin.outbox-list-dead.",
+                    },
+                ],
+                precheck: (i) => this.precheck(i.id),
+                summary: async (i) => {
+                    const job = await this.label(i.id);
+                    return {
+                        zh: `丢弃无法排入队列的后台任务 ${job}，它不会再运行`,
+                        en: `Discard background work that could not be queued: ${job}; it will never run`,
+                    };
+                },
+                run: async (input, ctx) => {
+                    await this.dead.discard(input.id, { accountId: ctx.actorAccountId }, viaAgent("admin.outbox-discard", ctx));
+                    return { id: input.id, discarded: true };
+                },
+            }),
+        ]);
+    }
+};
+OutboxOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(OutboxDeadService)),
+    __param(2, Inject(KernelDb))
+], OutboxOperations);
+export { OutboxOperations };

package/dist/platform/ops/schedules.ops.js

@@ -10,7 +10,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ScheduledTasksService, } from "../../schedules/scheduled-tasks.service.js";
-import { createInputOf, grantsOf, ScheduleChatTargetsQuery, ScheduleCreateBody, ScheduleGrantableQuery, ScheduleGrantParams, ScheduleGrantsBody, ScheduleListQuery, ScheduleParams, ScheduleRunBody, ScheduleRunsQuery, ScheduleUpdateBody, updateInputOf, } from "../../schedules/schedules.schemas.js";
+import { calendarInputOf, createInputOf, grantsOf, ScheduleCalendarQuery, ScheduleChatTargetsQuery, ScheduleCreateBody, ScheduleGrantableQuery, ScheduleGrantParams, ScheduleGrantsBody, ScheduleListQuery, ScheduleParams, ScheduleRunBody, ScheduleRunsQuery, ScheduleUpdateBody, updateInputOf, } from "../../schedules/schedules.schemas.js";
 import { defineOperation } from "../operation.js";
 import { PlatformOperations } from "../registry.js";
 import { named, orElse } from "./summary.js";
@@ -98,6 +98,45 @@ let SchedulesOperations = class SchedulesOperations {
                     return { items: items.map(row) };
                 },
             }),
+            defineOperation({
+                id: "schedules.calendar",
+                description: "Your scheduled task runs and planned occurrences between two instants (at most 43 days): recorded runs with their status, planned runs computed from each active task's schedule up to 42 days ahead, and dense tasks summarized per day. Org admins see every task with all=true. from and to are ISO instants with an offset; timeZone (IANA) sets the local days used to summarize dense tasks; taskId lists one task's items, never summarized (then at most 2 days). truncated means a limit cut the range at horizon.",
+                input: ScheduleCalendarQuery,
+                example: {
+                    from: "2026-11-09T00:00:00+08:00",
+                    to: "2026-11-16T00:00:00+08:00",
+                    timeZone: "Asia/Shanghai",
+                },
+                authz: { orgAction: "org.read" },
+                mirrors: ["GET /api/v1/orgs/:orgId/schedules/calendar"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "validation_failed",
+                        next: "Narrow the range to 43 days or less (2 days with taskId), with from before to.",
+                    },
+                    {
+                        code: "forbidden",
+                        next: "Reading every task needs the org admin role: call without all, or ask an org admin.",
+                    },
+                    {
+                        code: "schedule.not_found",
+                        next: "Check taskId with schedules.list: members see only their own tasks; an org admin finds another member's task id with schedules.list all=true, then reads it here by taskId (all is not needed).",
+                    },
+                ],
+                run: async (input, ctx) => {
+                    const answer = await this.tasks.calendar(ctx.orgId, this.actor(ctx), calendarInputOf(input));
+                    return {
+                        ...answer,
+                        tasks: answer.tasks.map((t) => ({
+                            id: t.id,
+                            name: t.name,
+                            agentId: t.agentId,
+                            status: t.status,
+                        })),
+                    };
+                },
+            }),
             defineOperation({
                 id: "schedules.chat-targets",
                 description: "The IM chats you can point a chat-mode scheduled task at: your direct chats with each active channel connection's bot (one you have messaged before), and the groups you have talked in when the channel has threads. Each gives { connectionId, chatId, chatType } for schedules.create, and the connection's agentId, which the task must use.",

package/dist/platform/platform-ops.module.d.ts

@@ -21,6 +21,7 @@ import { ModelsOperations } from "./ops/models.ops.js";
 import { OrgPluginsOperations } from "./ops/org-plugins.ops.js";
 import { OrgSettingsOperations } from "./ops/org-settings.ops.js";
 import { OrgsOperations } from "./ops/orgs.ops.js";
+import { OutboxOperations } from "./ops/outbox.ops.js";
 import { PlatformOperationsProvider } from "./ops/platform.ops.js";
 import { PluginsOperations } from "./ops/plugins.ops.js";
 import { PreviewersOperations } from "./ops/previewers.ops.js";
@@ -34,7 +35,7 @@ import { UiOperations } from "./ops/ui.ops.js";
  * One provider per domain, each taking `PlatformOperations` as its first constructor argument:
  * the parity test in `tools/checks` builds the operations from it without a Nest app.
  */
-export declare const PLATFORM_OPERATION_PROVIDERS: readonly [typeof PlatformOperationsProvider, typeof SkillsOperations, typeof AgentsOperations, typeof AgentTemplatesOperations, typeof PluginsOperations, typeof MarketplacesOperations, typeof RequestsOperations, typeof ConnectorsOperations, typeof ExtensionsOperations, typeof ConversationsOperations, typeof ComponentsOperations, typeof AccountsOperations, typeof OrgsOperations, typeof AdminOperations, typeof CatalogAdminOperations, typeof OrgPluginsOperations, typeof ExtensionsAdminOperations, typeof ModelsOperations, typeof InboxOperations, typeof ApprovalsOperations, typeof ChannelsOperations, typeof OrgSettingsOperations, typeof EvalsOperations, typeof BackgroundOperations, typeof PreviewersOperations, typeof DevicesOperations, typeof AgentSkillsOperations, typeof ThemesOperations, typeof SetupOperations, typeof UiOperations, typeof AdminItemsOperations, typeof SchedulesOperations];
+export declare const PLATFORM_OPERATION_PROVIDERS: readonly [typeof PlatformOperationsProvider, typeof SkillsOperations, typeof AgentsOperations, typeof AgentTemplatesOperations, typeof PluginsOperations, typeof MarketplacesOperations, typeof RequestsOperations, typeof ConnectorsOperations, typeof ExtensionsOperations, typeof ConversationsOperations, typeof ComponentsOperations, typeof AccountsOperations, typeof OrgsOperations, typeof AdminOperations, typeof CatalogAdminOperations, typeof OrgPluginsOperations, typeof ExtensionsAdminOperations, typeof ModelsOperations, typeof InboxOperations, typeof ApprovalsOperations, typeof ChannelsOperations, typeof OrgSettingsOperations, typeof EvalsOperations, typeof BackgroundOperations, typeof PreviewersOperations, typeof DevicesOperations, typeof AgentSkillsOperations, typeof ThemesOperations, typeof SetupOperations, typeof UiOperations, typeof AdminItemsOperations, typeof SchedulesOperations, typeof OutboxOperations];
 /**
  * The `Platform` tool's operations (ruling P2): one provider per domain, each registering its
  * operations into `PlatformOperations` from `onModuleInit`. It imports the domain modules, which

package/dist/platform/platform-ops.module.js

@@ -49,6 +49,7 @@ import { ModelsOperations } from "./ops/models.ops.js";
 import { OrgPluginsOperations } from "./ops/org-plugins.ops.js";
 import { OrgSettingsOperations } from "./ops/org-settings.ops.js";
 import { OrgsOperations } from "./ops/orgs.ops.js";
+import { OutboxOperations } from "./ops/outbox.ops.js";
 import { PlatformOperationsProvider } from "./ops/platform.ops.js";
 import { PluginsOperations } from "./ops/plugins.ops.js";
 import { PreviewersOperations } from "./ops/previewers.ops.js";
@@ -107,6 +108,8 @@ export const PLATFORM_OPERATION_PROVIDERS = [
     AdminItemsOperations,
     // scheduled tasks (scheduled tasks spec §10)
     SchedulesOperations,
+    // dead outbox rows (transactional outbox spec §3.4)
+    OutboxOperations,
 ];
 /**
  * The `Platform` tool's operations (ruling P2): one provider per domain, each registering its

package/dist/platform/route-schemas.js

@@ -2,6 +2,7 @@ import { ADMIN_ROUTES } from "../admin/admin.schemas.js";
 import { ADMIN_ITEM_ROUTES } from "../admin/admin-items.schemas.js";
 import { AUDIT_ROUTES } from "../admin/audit.schemas.js";
 import { ADMIN_EXTENSION_ROUTES } from "../admin/extensions.schemas.js";
+import { OUTBOX_DEAD_ROUTES } from "../admin/outbox-dead.schemas.js";
 import { OVERVIEW_ROUTES } from "../admin/overview.schemas.js";
 import { AGENT_ROUTES } from "../agents/agents.schemas.js";
 import { AGENT_TEMPLATE_ROUTES } from "../agents/templates.schemas.js";
@@ -85,4 +86,6 @@ export const ROUTE_SCHEMAS = [
     // the admin overview and the platform-level audit log (admin overview spec §5.2)
     ...OVERVIEW_ROUTES,
     ...AUDIT_ROUTES,
+    // dead outbox rows (transactional outbox spec §3.4)
+    ...OUTBOX_DEAD_ROUTES,
 ];

package/dist/roles/worker.module.js

@@ -25,16 +25,18 @@ import { EvalWorkersModule } from "../evals/evals.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { PluginsReconcileJob } from "../extensions/lifecycle.js";
 import { InitialPasswordCleanupJob } from "../identity/initial-passwords.job.js";
+import { OutboxRelayModule } from "../infra/outbox/outbox-relay.module.js";
 import { KernelScheduleModule } from "../infra/schedule/schedule.module.js";
 import { DirectoryScanJob } from "../orgs/directory-sync.js";
 import { OffboardSweepJob } from "../orgs/offboarding.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
 import { OrgsModule } from "../orgs/orgs.module.js";
 import { MaintenanceModule } from "../runtime/maintenance.js";
+import { RunJobsModule } from "../runtime/run-jobs.js";
+import { RunOrphanCheck } from "../runtime/run-orphan-check.job.js";
 import { RuntimeWorkersModule } from "../runtime/run-processors.js";
 import { RuntimeModule } from "../runtime/runtime.module.js";
-import { UsageReportModule, UsageSweepJob } from "../runtime/usage-report.js";
-import { WaitSweepJob } from "../runtime/waits.js";
+import { UsageReportModule } from "../runtime/usage-report.js";
 import { SandboxSweepJobs } from "../sandbox/jobs.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { ScheduledTaskFireModule } from "../schedules/fire.js";
@@ -58,6 +60,8 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
             module: WorkerModule_1,
             imports: [
                 KernelScheduleModule,
+                // the outbox relay (`@LockedInterval`): delivers what the fast path did not
+                OutboxRelayModule,
                 ClientModule,
                 // the queue consumers (their worker options come from the startup config)
                 RuntimeWorkersModule.forRoot(config),
@@ -67,6 +71,7 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 PluginScopeWorkersModule,
                 // the domains the fixed-period jobs call
                 RuntimeModule,
+                RunJobsModule,
                 UsageReportModule,
                 TitlesModule,
                 AttachmentsModule,
@@ -84,8 +89,8 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 ScheduledTaskFireModule,
             ],
             providers: [
-                WaitSweepJob,
-                UsageSweepJob,
+                // the one repair of a run nobody runs (transactional outbox spec §8.3)
+                RunOrphanCheck,
                 AttachmentCleanupJob,
                 StoragePurgeJob,
                 SandboxSweepJobs,

package/dist/runtime/langgraph-loop.js

@@ -94,7 +94,8 @@ export class LangGraphLoop {
         const config = {
             configurable: { thread_id: ctx.runId },
             // 每步最多 3 个超步（prepare、model、tools），再加 wrapUp 与余量。
-            recursionLimit: ctx.limits.maxSteps * 3 + 10,
+            // no step limit: no recursion limit either (the loop ends when the model stops calling tools)
+            recursionLimit: ctx.limits.maxSteps === undefined ? Number.MAX_SAFE_INTEGER : ctx.limits.maxSteps * 3 + 10,
             durability: "sync",
         };
         const existing = await this.saver.getTuple({ configurable: { thread_id: ctx.runId } });
@@ -125,7 +126,12 @@ export class LangGraphLoop {
             : { kind: outcome, consumedUpToSeq: final.consumedUpToSeq };
     }
     build(ctx) {
-        const timedOut = () => Date.now() >= ctx.limits.deadline;
+        // an absent limit is no limit (`runtime.maxSteps` / `runtime.maxRunSeconds` 0)
+        const { maxSteps } = ctx.limits;
+        const timedOut = () => {
+            const deadline = ctx.limits.deadline;
+            return deadline !== undefined && Date.now() >= deadline;
+        };
         // 本次运行的附件字节缓存：各步共用，运行结束即丢弃（只是优化，见 MediaCache）
         const mediaCache = new MediaCache(this.stepDeps.config.get().attachments.requestMediaBytes);
         const input = (step, absorbedUpToSeq) => ({
@@ -138,7 +144,7 @@ export class LangGraphLoop {
             signal: ctx.signal,
             sink: ctx.sink,
             absorbedUpToSeq,
-            maxSteps: ctx.limits.maxSteps,
+            ...(maxSteps !== undefined && { maxSteps }),
             mediaCache,
             agentId: ctx.agentId,
             accountId: ctx.triggerAccountId,
@@ -216,7 +222,7 @@ export class LangGraphLoop {
                 agent: ctx.agent,
                 accountId: ctx.triggerAccountId,
                 signal: ctx.signal,
-                deadline: ctx.limits.deadline,
+                ...(ctx.limits.deadline !== undefined && { deadline: ctx.limits.deadline }),
                 ...(ctx.conversationKind !== undefined && { conversationKind: ctx.conversationKind }),
                 ...(ctx.parent !== undefined && { parent: ctx.parent }),
             });
@@ -256,7 +262,9 @@ export class LangGraphLoop {
             // (aborted / completed: a fork invocation's run ended in its first prepare, phase D)
             if (s.outcome !== null)
                 return END;
-            return s.budgetWrapUp === true || s.step > ctx.limits.maxSteps ? "wrapUp" : "model";
+            return s.budgetWrapUp === true || (maxSteps !== undefined && s.step > maxSteps)
+                ? "wrapUp"
+                : "model";
         }, ["model", "wrapUp", END])
             .addConditionalEdges("model", (s) => (s.budgetWrapUp === true ? "wrapUp" : s.outcome === null ? "tools" : END), ["tools", "wrapUp", END])
             .addEdge("tools", "prepare")

package/dist/runtime/limits.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Run limits where 0 means "no limit" (`runtime.maxSteps`, `runtime.maxRunSeconds`, a sub-agent's
+ * logged `maxSteps`): like Claude Code, a run without limits goes on until the model stops calling
+ * tools or someone stops it.
+ */
+/**
+ * The tightest of the given limits, ignoring absent and non-positive ones (0 = no limit);
+ * `undefined` when none of them limits anything.
+ */
+export declare function tightestLimit(...limits: (number | undefined)[]): number | undefined;
+/**
+ * The run's deadline (epoch ms) for `runtime.maxRunSeconds` counted from `startMs`; `undefined`
+ * when the run has no duration limit (0).
+ */
+export declare function runDeadline(startMs: number, maxRunSeconds: number): number | undefined;

package/dist/runtime/limits.js

@@ -0,0 +1,25 @@
+/**
+ * Run limits where 0 means "no limit" (`runtime.maxSteps`, `runtime.maxRunSeconds`, a sub-agent's
+ * logged `maxSteps`): like Claude Code, a run without limits goes on until the model stops calling
+ * tools or someone stops it.
+ */
+/**
+ * The tightest of the given limits, ignoring absent and non-positive ones (0 = no limit);
+ * `undefined` when none of them limits anything.
+ */
+export function tightestLimit(...limits) {
+    let out;
+    for (const l of limits) {
+        if (l === undefined || !(l > 0))
+            continue;
+        out = out === undefined ? l : Math.min(out, l);
+    }
+    return out;
+}
+/**
+ * The run's deadline (epoch ms) for `runtime.maxRunSeconds` counted from `startMs`; `undefined`
+ * when the run has no duration limit (0).
+ */
+export function runDeadline(startMs, maxRunSeconds) {
+    return maxRunSeconds > 0 ? startMs + maxRunSeconds * 1000 : undefined;
+}

package/dist/runtime/loop.d.ts

@@ -27,9 +27,13 @@ export interface LoopContext {
      * 即 seq 也大于会话的 `consumed_seq`），按 seq 升序。loop 记录吸收到的最大 seq 作为 `consumedUpToSeq`。
      */
     pendingAbsorbable(afterSeq: number): Promise<AbsorbableEvent[]>;
+    /**
+     * The run's limits; an absent one is no limit (`runtime.maxSteps` / `runtime.maxRunSeconds` 0):
+     * `maxSteps` model steps before the final wrap-up, `deadline` in epoch ms.
+     */
     limits: {
-        maxSteps: number;
-        deadline: number;
+        maxSteps?: number;
+        deadline?: number;
     };
     /**
      * Kind of the conversation: plugin hooks fire for `chat` and `subagent` (F10, P-18, sub-agents
@@ -124,6 +128,7 @@ export interface AgentLoop {
 /**
  * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
  * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
- * approval); the timeout is a safety net.
+ * approval); the timeout is a safety net. Without a run duration limit (`runtime.maxRunSeconds` 0)
+ * it is the approval timeout plus 10 minutes.
  */
 export declare function subagentsWait(runId: string, step: number, config: Pick<KernelConfig, "tools" | "runtime">, now?: number): WaitingFor;

package/dist/runtime/loop.js

@@ -8,7 +8,8 @@ export const subagentsWaitId = (runId, step) => `sa-${runId}-${step}`;
 /**
  * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
  * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
- * approval); the timeout is a safety net.
+ * approval); the timeout is a safety net. Without a run duration limit (`runtime.maxRunSeconds` 0)
+ * it is the approval timeout plus 10 minutes.
  */
 export function subagentsWait(runId, step, config, now = Date.now()) {
     const ms = config.tools.approvalTimeoutHours * 3_600_000 + config.runtime.maxRunSeconds * 1000 + 600_000;