@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.25

package/dist/tools/tools.module.js

@@ -17,9 +17,9 @@ import { ModelsModule } from "../models/models.module.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
 import { PlatformModule } from "../platform/platform.module.js";
 import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
+import { RunJobsModule } from "../runtime/run-jobs.js";
 import { StepLogModule } from "../runtime/step-log.js";
 import { SubagentsModule } from "../runtime/subagents/subagents.service.js";
-import { UsageReportModule } from "../runtime/usage-report.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { ScheduledTaskStoreModule } from "../schedules/store.module.js";
 import { SkillsModule } from "../skills/skills.module.js";
@@ -72,10 +72,11 @@ ToolsModule = __decorate([
             BackgroundModule,
             // the conversation page's tool metadata reads only what the viewer may see
             ConversationAccessModule,
-            // the WebFetch extraction call: its purpose, usage report and step writes
+            // the WebFetch extraction call: its purpose and step writes (its usage report owed with them)
             ModelsModule,
-            UsageReportModule,
             StepLogModule,
+            // a decision resumes its waiting run in the decision's transaction (`RunResume`)
+            RunJobsModule,
             // the `Platform` tool's operations, actor facts and agent docs (imports no domain module)
             PlatformModule,
             QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.23",
+  "version": "0.1.0-rc.25",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -65,7 +65,7 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.17"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.19"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
@@ -74,7 +74,7 @@
     "@types/ws": "^8.18.2",
     "@types/yauzl": "3.4.0",
     "ws": "^8.22.0",
-    "@capybara-hq/testing": "0.1.0-rc.15"
+    "@capybara-hq/testing": "0.1.0-rc.17"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0118_device_policy_ops.sql

@@ -0,0 +1,6 @@
+-- The `policy` ops the platform sent to a machine whose answer may not be recorded yet (sandbox dev
+-- tiers spec §10.4): a summary the machine reports by itself (a `policy` frame, the next hello)
+-- that is such an op's change is not listed again as a change made on the machine. A JSON array of
+-- `{ id, add, remove, tier?, isolation?, until }`; an entry leaves when its answer is recorded or,
+-- unanswered, when `until` (epoch ms) has passed.
+ALTER TABLE device_machines ADD COLUMN IF NOT EXISTS pending_policy_ops jsonb NOT NULL DEFAULT '[]'::jsonb;

package/src/migrations/0119_outbox.sql

@@ -0,0 +1,22 @@
+-- Transactional outbox (transactional outbox spec §4): work that must follow a commit is written
+-- here in the same transaction as the state that owes it, and a relay delivers it to BullMQ. Rows are
+-- deleted on delivery; only dead rows (`dead_at` set) stay.
+
+CREATE TABLE IF NOT EXISTS outbox (
+  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  queue text NOT NULL,
+  job_name text NOT NULL,
+  job_id text NOT NULL,
+  data jsonb NOT NULL,
+  run_at timestamptz,
+  org_id text,                       -- for the overview and for org deletion; NULL for platform work
+  attempts integer NOT NULL DEFAULT 0,
+  next_attempt_at timestamptz NOT NULL DEFAULT now(),
+  last_error text,
+  dead_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+-- one pending row per job: a second add of the same job before delivery is a no-op; a dead row
+-- does not count, so it never blocks the same job owed again
+CREATE UNIQUE INDEX IF NOT EXISTS outbox_job_uniq ON outbox (queue, job_id) WHERE dead_at IS NULL;
+CREATE INDEX IF NOT EXISTS outbox_due ON outbox (next_attempt_at) WHERE dead_at IS NULL;

package/src/migrations/0120_drop_usage_report_sweep.sql

@@ -0,0 +1,7 @@
+-- 0120, transactional outbox spec §8.1 / §8.2: a `usage.report` delivery is owed in the outbox
+-- with the usage it reports, so the usage sweeper is gone, and with it its watermark table and the
+-- index it found unreported `model_usage` rows by. (`conversation_events_usage_idx` stays: the
+-- admin usage aggregate reads usage events by time.)
+-- capybara:allow-destructive the sweeper that read and wrote this single-row watermark is removed in this release (project not released, no compatibility layer)
+DROP TABLE IF EXISTS usage_report_sweep;
+DROP INDEX IF EXISTS model_usage_unreported;

package/src/migrations/0121_drop_platform_migration_runs.sql

@@ -0,0 +1,12 @@
+-- 0121, transactional outbox spec §8.2: the platform components migration job is gone (an import
+-- writes its platform components in its transaction), so nothing writes its runs table any more and
+-- the platform inbox no longer shows a run; the org notice kind `skill_renamed`, which only that job
+-- wrote, goes with it.
+-- capybara:allow-destructive the job that wrote this table is removed in this release and nothing reads it (project not released, no compatibility layer)
+DROP TABLE IF EXISTS platform_migration_runs;
+-- capybara:allow-destructive notices of a kind only the removed job wrote; the inbox no longer renders the kind (project not released)
+DELETE FROM org_notices WHERE kind = 'skill_renamed';
+-- capybara:allow-destructive the check is added back without `skill_renamed` in the next statement; no row has that kind any more
+ALTER TABLE org_notices DROP CONSTRAINT IF EXISTS org_notices_kind_check;
+ALTER TABLE org_notices ADD CONSTRAINT org_notices_kind_check
+  CHECK (kind IN ('item_shared', 'shared_item_updated', 'upload_confirmed', 'upload_rejected'));

package/src/migrations/0122_drop_scheduled_task_runs_rechecked_at.sql

@@ -0,0 +1,5 @@
+-- 0122, transactional outbox spec §8.1 / §8.2: the transaction that writes a pending task run owes
+-- its fire job in the outbox, so the scheduled task scan's repair is gone, and with it the column
+-- that rotated the repair's rechecks of started runs.
+-- capybara:allow-destructive the repair that read and wrote this column is removed in this release and nothing else reads it (project not released, no compatibility layer)
+ALTER TABLE scheduled_task_runs DROP COLUMN IF EXISTS rechecked_at;

package/src/migrations/0123_pgvector.sql

@@ -0,0 +1,27 @@
+-- pgvector, when the server offers it (memory plugin spec §6.4). Plugins store embeddings in a
+-- `vector` column when the type is visible from their search_path (`plugin_<name>, public`) and fall
+-- back to `real[]` otherwise, so pgvector is recommended, not required:
+-- - not offered by the server (no row in pg_available_extensions): nothing to do;
+-- - already installed, in whatever schema a DBA put it: left where it is;
+-- - refused (insufficient_privilege: the migrating role may not create it; feature_not_supported:
+--   a managed server lists it but its vendor allow-list refuses it, e.g. Azure Flexible Server):
+--   a notice naming the SQLSTATE, the migration succeeds. Any other error still fails it.
+-- `SCHEMA public` matters: the migrator's search_path is `capybara, public`, and a bare
+-- CREATE EXTENSION would put the type and `<=>` in `capybara`, invisible to plugin schemas.
+-- capybara:allow-destructive not destructive: a DO block is the only way to make CREATE EXTENSION conditional on availability and to turn a refused CREATE EXTENSION into a notice
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'vector') THEN
+    RAISE NOTICE 'pgvector is not available on this server; plugins fall back to real[] embeddings';
+    RETURN;
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
+    RETURN;
+  END IF;
+  BEGIN
+    EXECUTE 'CREATE EXTENSION IF NOT EXISTS vector SCHEMA public';
+  EXCEPTION WHEN insufficient_privilege OR feature_not_supported THEN
+    RAISE NOTICE 'pgvector not installed: CREATE EXTENSION was refused (SQLSTATE %: %); plugins fall back to real[] embeddings', SQLSTATE, SQLERRM;
+  END;
+END
+$$;

package/src/migrations/0124_conversation_source.sql

@@ -0,0 +1,36 @@
+-- Memory plugin spec §6.2: where a conversation comes from (web, channel_dm, channel_group,
+-- subagent), set once at creation and never changed; extension tools and context@1 providers are
+-- offered by it.
+-- The column is added with a constant default, so existing rows read 'web' without a rewrite.
+-- The backfill then sets the other sources, each UPDATE touching only rows still at 'web', so a
+-- re-run updates nothing; later UPDATEs skip rows an earlier one set:
+-- 1. kind 'subagent' -> subagent;
+-- 2. a channel thread row of any archive state (DM /new archives the row, the conversation stays
+--    a DM's): only 'dm:' keys -> channel_dm, any other key -> channel_group (a conversation with
+--    both is a group's: the safer of the two);
+-- 3. a scheduled group run whose thread is still to bind at its first post (no thread row yet):
+--    its delivery's target chat type.
+-- The rest stays web. The CHECK is added last (dropped first, so a re-run re-adds it).
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS source text NOT NULL DEFAULT 'web';
+
+UPDATE conversations SET source = 'subagent'
+WHERE kind = 'subagent' AND source = 'web';
+
+UPDATE conversations c
+SET source = CASE WHEN t.dm THEN 'channel_dm' ELSE 'channel_group' END
+FROM (
+  SELECT conversation_id, bool_and(thread_key LIKE 'dm:%') AS dm
+  FROM channel_threads
+  GROUP BY conversation_id
+) t
+WHERE t.conversation_id = c.id AND c.source = 'web';
+
+UPDATE conversations c
+SET source = CASE WHEN d.target->>'chatType' = 'dm' THEN 'channel_dm' ELSE 'channel_group' END
+FROM channel_deliveries d
+WHERE d.conversation_id = c.id AND d.target->>'chatType' IN ('dm', 'group') AND c.source = 'web';
+
+-- capybara:allow-destructive the CHECK is re-added unchanged right below (a re-run of this file)
+ALTER TABLE conversations DROP CONSTRAINT IF EXISTS conversations_source_check;
+ALTER TABLE conversations ADD CONSTRAINT conversations_source_check
+  CHECK (source IN ('web', 'channel_dm', 'channel_group', 'subagent'));

package/dist/catalog/platform-migration.d.ts

@@ -1,115 +0,0 @@
-import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { KernelDb } from "../infra/database/kernel-db.js";
-import { TransactionHost } from "../infra/database/transaction-host.js";
-import { LockService } from "../infra/lock/lock.service.js";
-import type { KernelLogger } from "../log.js";
-import { OrgLock } from "../orgs/org-lock.js";
-import { PlatformComponents } from "./platform-components.js";
-/** The job's name (`@LockedInterval`, run lock `cron:platform-components-migrate`). */
-export declare const PLATFORM_MIGRATION_JOB = "platform-components-migrate";
-/** The audit action and inbox notice of a renamed skill. */
-export declare const SKILL_RENAMED = "skill_renamed";
-/** What one run changed (also stored in `platform_migration_runs.stats`). */
-export interface PlatformMigrationStats {
-    /** Catalog items whose platform rows were written (`<name>@<version>`). */
-    itemsSynced: string[];
-    /** Catalog items whose sync failed (logged; tried again by the next run). */
-    itemsFailed: string[];
-    /** Org skill copies linked to their platform skill, and how many of them were pinned. */
-    skillsLinked: number;
-    skillsPinned: number;
-    /** Org skills renamed because a platform skill of the same name is on in their org. */
-    skillsRenamed: number;
-    /** Org template copies linked to their platform template, and how many of them were pinned. */
-    templatesLinked: number;
-    templatesPinned: number;
-    /** Connectors linked to the platform connector template they were made from. */
-    connectorsLinked: number;
-}
-/**
- * The name a renamed skill gets: `<name>-org`, then `-org-2`, `-org-3`, … (the base shortened
- * when the result would be longer than a skill name may be), the first one not in `taken`.
- */
-export declare function renamedSkillName(name: string, taken: ReadonlySet<string>): string;
-/**
- * The platform components migration (spec §6, §13.5), a worker job (`platform-components-migrate`,
- * `@LockedInterval` with `runOnStart`: once across replicas at every worker start, then daily).
- * Steps, each on the rows that still need it:
- * 1. every live catalog item never synced (`platform_synced_version` null) gets its platform rows
- *    (`syncFromVersion`, which records the version) at the highest
- *    version installed in an org (spec §6: "the plugin's version becomes the highest installed
- *    one"), else its latest version;
- * 2. an org skill copy with plugin provenance (on the skill and its current version) links to the
- *    platform skill of its plugin and name; it is pinned to its own current version when its files
- *    differ from the platform version's. A copy whose platform skill is not on in its org is left
- *    unlinked (it keeps serving what it served) until a later run finds it on: a linked copy,
- *    pinned or not, follows its platform skill's availability (ruling P2-18);
- * 3. one-shot (spec §5 rule 10, ruling P2-5: nothing is renamed outside the migration): only while
- *    no run has finished (the first run's own execution), an org skill of the org's own (no
- *    provenance) whose name a platform skill on in its org has stays the org's: it is renamed (`<name>-org`, `-org-2`, …), the org admins get an inbox notice
- *    (`skill_renamed`) and that platform skill is switched off in the org (a switch the org already
- *    has is kept). Agents select skills by id, so they keep it; the name changes in new runs. Once a
- *    run has finished, a clash is only logged as a warning and left alone (the org's skill wins);
- * 4. an org agent template links to the platform template of its plugin and name, pinned like
- *    skills (definitions compared as canonical JSON). Templates are never renamed: an org template
- *    always has its plugin's type, which is the platform template's;
- * 5. a connector made from a connector template (the install ledger's `template_id`) links to that
- *    platform connector template (ruling E2).
- * Plugin switches exist since phase 1 and new platform rows follow the plugin's scope, so nothing
- * else is written. Writes run per org under its row lock and re-check each row; nothing is deleted
- * or overwritten except the renamed skill's name. Each run is recorded in `platform_migration_runs`
- * (rows older than 30 days are pruned, except the first finished run: it marks the renames done).
- */
-export declare class PlatformMigration {
-    private readonly kdb;
-    private readonly orgLock;
-    private readonly platform;
-    readonly txHost: TransactionHost;
-    readonly config: KernelConfigService;
-    readonly lockService: LockService;
-    readonly log: KernelLogger;
-    constructor(kdb: KernelDb, orgLock: OrgLock, platform: PlatformComponents, txHost: TransactionHost, config: KernelConfigService, lockService: LockService, log: KernelLogger);
-    private get db();
-    /** The scheduled run (see the class). */
-    migrate(signal?: AbortSignal): Promise<void>;
-    /**
-     * One run of every step; returns what it changed. `signal` (the stop, or a lost run lock) is
-     * read between items and orgs: an aborted run stops there and its row is deleted (every step is
-     * idempotent, so the next run carries on; an unfinished run never counts as the first one).
-     */
-    runOnce(signal?: AbortSignal): Promise<PlatformMigrationStats>;
-    /** Deletes finished runs older than {@link RUNS_KEPT_MS}, never the first one (`first`). */
-    private pruneRuns;
-    /**
-     * Step 1: the live catalog items whose platform components were never written
-     * (`platform_synced_version` null; `syncFromVersion` sets it). An item whose components were
-     * removed since is not synced again.
-     */
-    private syncItems;
-    /** The highest version of the item installed in an org (and still stored), else `latest`. */
-    private platformVersion;
-    /** Step 2: org skill copies with plugin provenance, not linked yet. */
-    private linkSkills;
-    /** Links `links` of one org under its row lock (each only while it is still as read). */
-    private linkSkillsIn;
-    /**
-     * Step 3 (one-shot): org skills of the org's own whose name a platform skill on in their org has,
-     * renamed only in the first run (`rename`: no run has finished yet); later ones are only logged.
-     */
-    private renameClashes;
-    /**
-     * Renames the clashing skills of one org under its row lock (each only while it still has the
-     * name and no provenance), switches the clashing platform skills off in the org (unless the org
-     * has a switch for them already), and writes one inbox notice and one audit event per skill.
-     */
-    private renameIn;
-    /** Step 4: org agent templates not linked yet, by plugin and name. */
-    private linkTemplates;
-    /** Links `links` of one org under its row lock (each only while it is still as read). */
-    private linkTemplatesIn;
-    /**
-     * Step 5: connectors not linked yet whose install ledger row names the connector template they
-     * were made from; one statement (a connector only gains a link, nothing else changes).
-     */
-    private linkConnectors;
-}