@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.26

package/dist/tools/device-op-resolver.js

@@ -0,0 +1,121 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { DevicePolicyService, } from "../local-devices/device-policy.service.js";
+import { opVisibleIn, pendingPolicyOpsOf, } from "../local-devices/policy-summary.js";
+import { ApprovalsService } from "./approvals.service.js";
+/**
+ * The `device-op-resolve` job (transactional outbox spec §7): records what became of a device
+ * policy op whose outcome its caller did not record (a crash between the call and the resolve
+ * transaction, an answer that never came). Owed by the op's intent for when the op can no longer
+ * reach the machine, and by a hello that reported the op (`device-op-reported-<opId>`).
+ *
+ * An op without an entry any more is resolved already: a no-op. Otherwise the outcome is the one
+ * the hello reported, else the machine's answer to a read-only `policyStatus`: `applied` →
+ * recorded applied; `refused`, never received (`unknown` to the machine, or `absent` from its
+ * hello, once the op can no longer reach it) → failed; `started` (the machine stopped between
+ * its log and its answer), once the op can no longer reach it → applied when the policy it
+ * reports holds the change, else failed (`interrupted`); no answer (`offline`) → `unknown`, left
+ * for the machine's next hello. It never sends the change
+ * again (a widening after its ask closed is not allowed). An op that answers a network ask
+ * decides it when applied and the ask is still pending, else leaves it pending with the reason
+ * (`ApprovalsService.settleFromResolver`).
+ */
+let DeviceOpResolver = class DeviceOpResolver {
+    db;
+    txHost;
+    policies;
+    approvals;
+    constructor(db, txHost, policies, approvals) {
+        this.db = db;
+        this.txHost = txHost;
+        this.policies = policies;
+        this.approvals = approvals;
+    }
+    async resolve(data) {
+        const row = await this.db
+            .selectFrom("device_machines")
+            .select(["device_id", "pending_policy_ops"])
+            .where("id", "=", data.machineId)
+            .executeTakeFirst();
+        const op = pendingPolicyOpsOf(row?.pending_policy_ops).find((o) => o.id === data.opId);
+        if (row === undefined || op === undefined)
+            return;
+        const result = op.reported !== undefined
+            ? await this.reportedResult(row.device_id, op, op.reported.outcome)
+            : statusResult(op, await this.policies.outcomeOf(row.device_id, op.id));
+        await this.settle(data, op.source.approvalId, result);
+    }
+    /**
+     * The outcome a hello reported; a refusal's message (a hello carries none) is the machine's
+     * answer to `policyStatus` when it is connected.
+     */
+    async reportedResult(deviceId, op, outcome) {
+        if (outcome === "applied")
+            return { outcome: "applied" };
+        if (outcome === "absent")
+            return { outcome: "not_received" };
+        if (outcome === "interrupted")
+            return { outcome: "interrupted" };
+        const s = await this.policies.outcomeOf(deviceId, op.id);
+        const message = s.outcome === "refused" ? s.message : undefined;
+        return { outcome: "refused", message: (message ?? REFUSED_MESSAGE).slice(0, MAX_MESSAGE) };
+    }
+    /**
+     * The resolve transaction: the op's outcome, and the network ask it answers decided or given
+     * the reason in the same transaction (`ApprovalsService.settleFromResolver`).
+     */
+    async settle(data, approvalId, result) {
+        if (approvalId === null)
+            await this.policies.settleIn(data, result);
+        else
+            await this.approvals.settleFromResolver({ ...data, approvalId }, result);
+    }
+};
+__decorate([
+    Transactional()
+], DeviceOpResolver.prototype, "settle", null);
+DeviceOpResolver = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(DevicePolicyService)),
+    __param(3, Inject(ApprovalsService))
+], DeviceOpResolver);
+export { DeviceOpResolver };
+const REFUSED_MESSAGE = "The device's machine refused the policy change.";
+/** The longest refusal message kept from the machine (as its own op log keeps it). */
+const MAX_MESSAGE = 500;
+function statusResult(op, s) {
+    switch (s.outcome) {
+        case "applied":
+            return { outcome: "applied", ...(s.policy !== undefined && { policy: s.policy }) };
+        case "refused":
+            return { outcome: "refused", message: (s.message ?? REFUSED_MESSAGE).slice(0, MAX_MESSAGE) };
+        case "started":
+            // logged `started` only: once the op can no longer reach the machine, the policy it reports
+            // tells whether the change was written before it stopped
+            if (Date.now() < op.resolveAt || s.policy === undefined)
+                return { outcome: "unknown" };
+            return opVisibleIn(op, s.policy)
+                ? { outcome: "applied", policy: s.policy }
+                : { outcome: "interrupted" };
+        case "unknown":
+            // unknown to the machine: never received, once the op can no longer reach it (a job run
+            // early, on a clock running ahead, cannot tell yet)
+            return Date.now() >= op.resolveAt ? { outcome: "not_received" } : { outcome: "unknown" };
+        default:
+            // offline: its next hello tells
+            return { outcome: "unknown" };
+    }
+}

package/dist/tools/network-asks.d.ts

@@ -85,7 +85,7 @@ export declare function blockedEventHosts(blocked: readonly NetworkBlockedHost[]
  * the rest:
  * - `address` and `org` layers: a note each (in an unattended run an `org` host is a missing grant);
  *   `unknown`: nothing (the device's trailer explains);
- * - `device` layer on a program without `policyOp`: nothing (no ask, the trailer explains);
+ * - `device` layer on a program without `policyOpId`: nothing (no ask, the trailer explains);
  * - approved by the scheduled task the run serves (`run.taskGranted`) yet refused: a note that
  *   the device ignores the task's grants (never asked, never a missing grant);
  * - refused earlier in the run tree: the denied note; an unattended run in `fail` mode: its note

package/dist/tools/network-asks.js

@@ -90,7 +90,7 @@ export function blockedEventHosts(blocked) {
  * the rest:
  * - `address` and `org` layers: a note each (in an unattended run an `org` host is a missing grant);
  *   `unknown`: nothing (the device's trailer explains);
- * - `device` layer on a program without `policyOp`: nothing (no ask, the trailer explains);
+ * - `device` layer on a program without `policyOpId`: nothing (no ask, the trailer explains);
  * - approved by the scheduled task the run serves (`run.taskGranted`) yet refused: a note that
  *   the device ignores the task's grants (never asked, never a missing grant);
  * - refused earlier in the run tree: the denied note; an unattended run in `fail` mode: its note
@@ -107,9 +107,10 @@ export function planNetworkAsk(blocked, run, ctx) {
     const taskIgnored = [];
     const candidates = [];
     const missingGrants = [];
-    // a machine that reports blocked hosts and takes policy changes (Docker mode has no report)
+    // a machine that reports blocked hosts and takes policy changes under op ids (Docker mode has
+    // no report; a program without op ids cannot take 「一直允许」)
     const canAsk = ctx.device?.features.includes("networkReport") === true &&
-        ctx.device.features.includes("policyOp");
+        ctx.device.features.includes("policyOpId");
     // no run grant or policy change reaches a device whose owner turned remote grants off
     const remote = ctx.device?.policy?.remoteGrants !== "off";
     for (const b of hostsOf(blocked)) {

package/dist/tools/pipeline.d.ts

@@ -1,4 +1,4 @@
-import { type FormAnswer, type InputForm, type Logger } from "@capybara-hq/plugin-sdk";
+import { type ConversationSource, type FormAnswer, type InputForm, type Logger } from "@capybara-hq/plugin-sdk";
 import type { AgentDefinition } from "../agents/definition.js";
 import { EventLog } from "../conversations/event-log.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
@@ -222,8 +222,17 @@ export interface ToolStepContext {
     /** 运行所用的 agent 版本（审计链记录）。 */
     agentVersion: number;
     agent: AgentDefinition;
-    /** 对话发起人（取个人凭据、审计 actor）。 */
+    /** The run's trigger account (personal credentials, the audit actor). */
     accountId: string;
+    /**
+     * The conversation's source (memory plugin spec §6.2): extension tools limited by
+     * `spec.sources` are resolved with it, and plugin handlers receive it.
+     */
+    source: ConversationSource;
+    /** The conversation's owner (`conversations.account_id`), given to plugin handlers. */
+    ownerAccountId: string;
+    /** The trigger account's current org role, given to plugin handlers. */
+    role: OrgRole;
     /** run 的中止信号（用户中止 / 截止时间）。 */
     signal: AbortSignal;
     /** run 的截止时间（epoch 毫秒）；传给内置工具（沙箱命令据此收紧超时，Ruling M20）。 */

package/dist/tools/pipeline.js

@@ -314,6 +314,7 @@ let ToolPipeline = class ToolPipeline {
                     forkChild: ctx.parent?.forSkill === true,
                     sandboxConversationId: ctx.parent?.rootConversationId ?? ctx.conversationId,
                     replay: ctx.conversationKind === "eval",
+                    source: ctx.source,
                 });
             }
             return resolved;
@@ -1001,6 +1002,10 @@ let ToolPipeline = class ToolPipeline {
             conversationId: ctx.conversationId,
             callId,
             ...(resume !== undefined && { resume }),
+            // who and where (memory plugin spec §6.2): `accountId` stays the trigger account
+            source: ctx.source,
+            ownerAccountId: ctx.ownerAccountId,
+            role: ctx.role,
             ...(tool.source.kind === "builtin" && stepTools !== undefined && { tools: stepTools }),
             ...(tool.source.kind === "builtin" && { runId: ctx.runId }),
             ...(tool.source.kind === "builtin" &&

package/dist/tools/questions.service.d.ts

@@ -105,11 +105,22 @@ export declare class QuestionsService {
      */
     cancelPendingIn(runId: string): Promise<QuestionRecord[]>;
     /**
-     * 在调用方的事务内（`mandatory`）取消某组织里由 `accountId` 发起的运行上的全部 pending 输入请求（只有运行发起人能回答，
-     * 即「其作为处理人」的提问；成员离职时调用），走与 {@link cancelPendingIn} 相同的取消路径：置 cancelled、
-     * 写 `question_answered{cancelled}`。返回被取消的记录与各会话写到的最大 seq；调用方提交后发布事件。
+     * The conversations of `orgId` holding a pending question of a run `accountId` started (only the
+     * run's starter answers), read without locks: offboarding locks them, by tree root first
+     * (`lockConversationTrees`), before {@link cancelPendingFor}.
      */
-    cancelPendingFor(orgId: string, accountId: string): Promise<{
+    pendingConversationsFor(orgId: string, accountId: string): Promise<string[]>;
+    /**
+     * In the caller's transaction (`mandatory`; offboarding): cancels every pending question of a run
+     * `accountId` started in `orgId` within `conversationIds`, the conversations the caller already
+     * locked (by tree root first, `lockConversationTrees`; lock order D7: conversation, then question
+     * rows), along the same path as {@link cancelPendingIn}: `cancelled`,
+     * `question_answered{cancelled}`. A question asked meanwhile in another conversation waits for
+     * its run's stop (offboarding owes it), so no conversation is locked after a row. Returns the
+     * cancelled records and the highest seq written per conversation; the caller publishes after the
+     * commit.
+     */
+    cancelPendingFor(orgId: string, accountId: string, conversationIds: readonly string[]): Promise<{
         records: QuestionRecord[];
         seqs: Map<string, number>;
     }>;

package/dist/tools/questions.service.js

@@ -324,14 +324,12 @@ let QuestionsService = class QuestionsService {
         return out;
     }
     /**
-     * 在调用方的事务内（`mandatory`）取消某组织里由 `accountId` 发起的运行上的全部 pending 输入请求（只有运行发起人能回答，
-     * 即「其作为处理人」的提问；成员离职时调用），走与 {@link cancelPendingIn} 相同的取消路径：置 cancelled、
-     * 写 `question_answered{cancelled}`。返回被取消的记录与各会话写到的最大 seq；调用方提交后发布事件。
+     * The conversations of `orgId` holding a pending question of a run `accountId` started (only the
+     * run's starter answers), read without locks: offboarding locks them, by tree root first
+     * (`lockConversationTrees`), before {@link cancelPendingFor}.
      */
-    async cancelPendingFor(orgId, accountId) {
-        const t = this.db.db;
-        // the conversations first, in id order (lock order D7: conversation, then question rows)
-        const convs = await t
+    async pendingConversationsFor(orgId, accountId) {
+        const rows = await this.db
             .selectFrom("questions")
             .select("conversation_id")
             .distinct()
@@ -339,24 +337,28 @@ let QuestionsService = class QuestionsService {
             .where("status", "=", "pending")
             .where("run_id", "in", (eb) => eb.selectFrom("runs").select("id").where("trigger_account_id", "=", accountId))
             .execute();
-        if (convs.length > 0) {
-            await t
-                .selectFrom("conversations")
-                .select("id")
-                .where("id", "in", convs.map((c) => c.conversation_id))
-                .orderBy("id")
-                .forUpdate()
-                .execute();
-        }
-        // only the conversations locked above: a question asked meanwhile in another one waits for
-        // the run's stop (offboarding aborts it) or the sweep, so no conversation is locked after a row
+        return rows.map((r) => r.conversation_id);
+    }
+    /**
+     * In the caller's transaction (`mandatory`; offboarding): cancels every pending question of a run
+     * `accountId` started in `orgId` within `conversationIds`, the conversations the caller already
+     * locked (by tree root first, `lockConversationTrees`; lock order D7: conversation, then question
+     * rows), along the same path as {@link cancelPendingIn}: `cancelled`,
+     * `question_answered{cancelled}`. A question asked meanwhile in another conversation waits for
+     * its run's stop (offboarding owes it), so no conversation is locked after a row. Returns the
+     * cancelled records and the highest seq written per conversation; the caller publishes after the
+     * commit.
+     */
+    async cancelPendingFor(orgId, accountId, conversationIds) {
+        const t = this.db.db;
+        const convs = [...conversationIds];
         if (convs.length === 0)
             return { records: [], seqs: new Map() };
         const rows = await t
             .selectFrom("questions")
             .selectAll()
             .where("org_id", "=", orgId)
-            .where("conversation_id", "in", convs.map((c) => c.conversation_id))
+            .where("conversation_id", "in", convs)
             .where("status", "=", "pending")
             .where("run_id", "in", (eb) => eb.selectFrom("runs").select("id").where("trigger_account_id", "=", accountId))
             .orderBy("created_at")

package/dist/tools/registry.d.ts

@@ -1,4 +1,4 @@
-import type { Connector, HookParentScope, InputRequired, NetworkBlockedHost, ToolAnnotations, ToolCallContext, ToolResult, ToolSpec } from "@capybara-hq/plugin-sdk";
+import type { Connector, ConversationSource, HookParentScope, InputRequired, NetworkBlockedHost, ToolAnnotations, ToolCallContext, ToolResult, ToolSpec } from "@capybara-hq/plugin-sdk";
 import { type AgentDefinition, type DisabledToolRef, type SubagentTools } from "../agents/definition.js";
 import type { ToolView } from "../conversations/events.js";
 import { EffectiveConfigs } from "../extensions/effective-config.js";
@@ -213,6 +213,8 @@ export declare function withoutDisplayFields<T>(spec: T): T;
 export declare function specHash(spec: unknown): string;
 /** 由注解推导默认策略：只读 → allow；其余（破坏性 / 无注解）→ ask。 */
 export declare function policyFromAnnotations(a: ToolAnnotations | undefined): "allow" | "ask";
+/** Why an extension tool limited by `spec.sources` is not offered in a `source` conversation. */
+export declare const sourceHiddenReason: (source: ConversationSource) => string;
 /** `forAgent` 的结果。 */
 export interface AgentTools {
     tools: ResolvedTool[];
@@ -362,6 +364,11 @@ export declare class ToolRegistry {
         sandboxConversationId?: string;
         /** An eval replay's listing: its calls are never executed (the sandbox tools are listed). */
         replay?: boolean;
+        /**
+         * The conversation's source (memory plugin spec §6.2): an extension tool whose
+         * `spec.sources` leaves it out is hidden. Required, so nothing defaults to the widest.
+         */
+        source: ConversationSource;
     }): Promise<AgentTools>;
     /** 是否启用 `ToolSearch`（见 {@link forAgent}）；先比阈值，超过才读组织设置。 */
     private searchActive;

package/dist/tools/registry.js

@@ -59,6 +59,8 @@ export function specHash(spec) {
 export function policyFromAnnotations(a) {
     return a?.readOnlyHint === true ? "allow" : "ask";
 }
+/** Why an extension tool limited by `spec.sources` is not offered in a `source` conversation. */
+export const sourceHiddenReason = (source) => `Not available in ${source} conversations`;
 // `ToolSearch` is added by the registry by org setting and threshold, `Skill` when the log has a
 // skills catalog snapshot; neither comes from agent definitions (`./builtin-names.ts`).
 /** 工具定义（模型可见三项）的估算 token 数（与请求估算同一口径）。 */
@@ -348,6 +350,7 @@ let ToolRegistry = class ToolRegistry {
     }
     async resolve(orgId, def) {
         const disabled = def.disabledTools ?? [];
+        const { source } = def;
         const scope = {
             orgId,
             ...(def.sandboxConversationId !== undefined && {
@@ -435,6 +438,12 @@ let ToolRegistry = class ToolRegistry {
                     hidden.push({ ref: key, reason: toolTurnedOffReason(key) });
                     continue;
                 }
+                // offered only in some conversation sources; the source never changes, so this also
+                // refuses a resumed call (the pipeline resolves the step's tools with the same source)
+                if (t.spec.sources !== undefined && !t.spec.sources.includes(source)) {
+                    hidden.push({ ref: key, reason: sourceHiddenReason(source) });
+                    continue;
+                }
                 if (!(await configuredIn(t.plugin))) {
                     hidden.push({ ref: key, reason: `Plugin ${t.plugin} ${NEEDS_CONFIG_REASON}` });
                     continue;

package/dist/tools/tools.module.js

@@ -34,6 +34,7 @@ import { ConnectorAccountPolicies } from "./connector-account-policies.js";
 import { ConnectorContent } from "./connector-content.js";
 import { ConnectorsService } from "./connectors.service.js";
 import { Credentials } from "./credentials.js";
+import { DeviceOpResolver } from "./device-op-resolver.js";
 import { ToolDrift } from "./drift.js";
 import { ConversationToolInfo, OrgExtensionTools } from "./info.js";
 import { OAuthFlow } from "./oauth/flow.js";
@@ -106,6 +107,8 @@ ToolsModule = __decorate([
             ConversationToolInfo,
             OrgExtensionTools,
             OrgToolSwitches,
+            // the `device-op-resolve` job's body (it may decide the network ask the op answers)
+            DeviceOpResolver,
         ],
         exports: [
             ScheduleToolsPort,
@@ -126,6 +129,7 @@ ToolsModule = __decorate([
             ConversationToolInfo,
             OrgExtensionTools,
             OrgToolSwitches,
+            DeviceOpResolver,
         ],
     })
 ], ToolsModule);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.24",
+  "version": "0.1.0-rc.26",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -65,7 +65,7 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.18"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.20"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
@@ -74,7 +74,7 @@
     "@types/ws": "^8.18.2",
     "@types/yauzl": "3.4.0",
     "ws": "^8.22.0",
-    "@capybara-hq/testing": "0.1.0-rc.16"
+    "@capybara-hq/testing": "0.1.0-rc.17"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0121_drop_platform_migration_runs.sql

@@ -0,0 +1,12 @@
+-- 0121, transactional outbox spec §8.2: the platform components migration job is gone (an import
+-- writes its platform components in its transaction), so nothing writes its runs table any more and
+-- the platform inbox no longer shows a run; the org notice kind `skill_renamed`, which only that job
+-- wrote, goes with it.
+-- capybara:allow-destructive the job that wrote this table is removed in this release and nothing reads it (project not released, no compatibility layer)
+DROP TABLE IF EXISTS platform_migration_runs;
+-- capybara:allow-destructive notices of a kind only the removed job wrote; the inbox no longer renders the kind (project not released)
+DELETE FROM org_notices WHERE kind = 'skill_renamed';
+-- capybara:allow-destructive the check is added back without `skill_renamed` in the next statement; no row has that kind any more
+ALTER TABLE org_notices DROP CONSTRAINT IF EXISTS org_notices_kind_check;
+ALTER TABLE org_notices ADD CONSTRAINT org_notices_kind_check
+  CHECK (kind IN ('item_shared', 'shared_item_updated', 'upload_confirmed', 'upload_rejected'));

package/src/migrations/0122_drop_scheduled_task_runs_rechecked_at.sql

@@ -0,0 +1,5 @@
+-- 0122, transactional outbox spec §8.1 / §8.2: the transaction that writes a pending task run owes
+-- its fire job in the outbox, so the scheduled task scan's repair is gone, and with it the column
+-- that rotated the repair's rechecks of started runs.
+-- capybara:allow-destructive the repair that read and wrote this column is removed in this release and nothing else reads it (project not released, no compatibility layer)
+ALTER TABLE scheduled_task_runs DROP COLUMN IF EXISTS rechecked_at;

package/src/migrations/0123_pgvector.sql

@@ -0,0 +1,27 @@
+-- pgvector, when the server offers it (memory plugin spec §6.4). Plugins store embeddings in a
+-- `vector` column when the type is visible from their search_path (`plugin_<name>, public`) and fall
+-- back to `real[]` otherwise, so pgvector is recommended, not required:
+-- - not offered by the server (no row in pg_available_extensions): nothing to do;
+-- - already installed, in whatever schema a DBA put it: left where it is;
+-- - refused (insufficient_privilege: the migrating role may not create it; feature_not_supported:
+--   a managed server lists it but its vendor allow-list refuses it, e.g. Azure Flexible Server):
+--   a notice naming the SQLSTATE, the migration succeeds. Any other error still fails it.
+-- `SCHEMA public` matters: the migrator's search_path is `capybara, public`, and a bare
+-- CREATE EXTENSION would put the type and `<=>` in `capybara`, invisible to plugin schemas.
+-- capybara:allow-destructive not destructive: a DO block is the only way to make CREATE EXTENSION conditional on availability and to turn a refused CREATE EXTENSION into a notice
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'vector') THEN
+    RAISE NOTICE 'pgvector is not available on this server; plugins fall back to real[] embeddings';
+    RETURN;
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
+    RETURN;
+  END IF;
+  BEGIN
+    EXECUTE 'CREATE EXTENSION IF NOT EXISTS vector SCHEMA public';
+  EXCEPTION WHEN insufficient_privilege OR feature_not_supported THEN
+    RAISE NOTICE 'pgvector not installed: CREATE EXTENSION was refused (SQLSTATE %: %); plugins fall back to real[] embeddings', SQLSTATE, SQLERRM;
+  END;
+END
+$$;

package/src/migrations/0124_conversation_source.sql

@@ -0,0 +1,36 @@
+-- Memory plugin spec §6.2: where a conversation comes from (web, channel_dm, channel_group,
+-- subagent), set once at creation and never changed; extension tools and context@1 providers are
+-- offered by it.
+-- The column is added with a constant default, so existing rows read 'web' without a rewrite.
+-- The backfill then sets the other sources, each UPDATE touching only rows still at 'web', so a
+-- re-run updates nothing; later UPDATEs skip rows an earlier one set:
+-- 1. kind 'subagent' -> subagent;
+-- 2. a channel thread row of any archive state (DM /new archives the row, the conversation stays
+--    a DM's): only 'dm:' keys -> channel_dm, any other key -> channel_group (a conversation with
+--    both is a group's: the safer of the two);
+-- 3. a scheduled group run whose thread is still to bind at its first post (no thread row yet):
+--    its delivery's target chat type.
+-- The rest stays web. The CHECK is added last (dropped first, so a re-run re-adds it).
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS source text NOT NULL DEFAULT 'web';
+
+UPDATE conversations SET source = 'subagent'
+WHERE kind = 'subagent' AND source = 'web';
+
+UPDATE conversations c
+SET source = CASE WHEN t.dm THEN 'channel_dm' ELSE 'channel_group' END
+FROM (
+  SELECT conversation_id, bool_and(thread_key LIKE 'dm:%') AS dm
+  FROM channel_threads
+  GROUP BY conversation_id
+) t
+WHERE t.conversation_id = c.id AND c.source = 'web';
+
+UPDATE conversations c
+SET source = CASE WHEN d.target->>'chatType' = 'dm' THEN 'channel_dm' ELSE 'channel_group' END
+FROM channel_deliveries d
+WHERE d.conversation_id = c.id AND d.target->>'chatType' IN ('dm', 'group') AND c.source = 'web';
+
+-- capybara:allow-destructive the CHECK is re-added unchanged right below (a re-run of this file)
+ALTER TABLE conversations DROP CONSTRAINT IF EXISTS conversations_source_check;
+ALTER TABLE conversations ADD CONSTRAINT conversations_source_check
+  CHECK (source IN ('web', 'channel_dm', 'channel_group', 'subagent'));

package/src/migrations/0125_conversation_tree_stopped_at.sql

@@ -0,0 +1,5 @@
+-- Agent map spec §6 (changed in acceptance 2026-11-13): a person's stop of a root conversation
+-- stops its whole sub-agent tree and holds the tree's wakes. Set on the root by that stop, cleared
+-- when the root next starts a run; while set, no sub-agent delivery wakes the root and no
+-- sub-agent of its tree starts a run. Null on every existing row (no stop is held).
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS tree_stopped_at timestamptz;

package/dist/catalog/platform-migration.d.ts

@@ -1,115 +0,0 @@
-import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { KernelDb } from "../infra/database/kernel-db.js";
-import { TransactionHost } from "../infra/database/transaction-host.js";
-import { LockService } from "../infra/lock/lock.service.js";
-import type { KernelLogger } from "../log.js";
-import { OrgLock } from "../orgs/org-lock.js";
-import { PlatformComponents } from "./platform-components.js";
-/** The job's name (`@LockedInterval`, run lock `cron:platform-components-migrate`). */
-export declare const PLATFORM_MIGRATION_JOB = "platform-components-migrate";
-/** The audit action and inbox notice of a renamed skill. */
-export declare const SKILL_RENAMED = "skill_renamed";
-/** What one run changed (also stored in `platform_migration_runs.stats`). */
-export interface PlatformMigrationStats {
-    /** Catalog items whose platform rows were written (`<name>@<version>`). */
-    itemsSynced: string[];
-    /** Catalog items whose sync failed (logged; tried again by the next run). */
-    itemsFailed: string[];
-    /** Org skill copies linked to their platform skill, and how many of them were pinned. */
-    skillsLinked: number;
-    skillsPinned: number;
-    /** Org skills renamed because a platform skill of the same name is on in their org. */
-    skillsRenamed: number;
-    /** Org template copies linked to their platform template, and how many of them were pinned. */
-    templatesLinked: number;
-    templatesPinned: number;
-    /** Connectors linked to the platform connector template they were made from. */
-    connectorsLinked: number;
-}
-/**
- * The name a renamed skill gets: `<name>-org`, then `-org-2`, `-org-3`, … (the base shortened
- * when the result would be longer than a skill name may be), the first one not in `taken`.
- */
-export declare function renamedSkillName(name: string, taken: ReadonlySet<string>): string;
-/**
- * The platform components migration (spec §6, §13.5), a worker job (`platform-components-migrate`,
- * `@LockedInterval` with `runOnStart`: once across replicas at every worker start, then daily).
- * Steps, each on the rows that still need it:
- * 1. every live catalog item never synced (`platform_synced_version` null) gets its platform rows
- *    (`syncFromVersion`, which records the version) at the highest
- *    version installed in an org (spec §6: "the plugin's version becomes the highest installed
- *    one"), else its latest version;
- * 2. an org skill copy with plugin provenance (on the skill and its current version) links to the
- *    platform skill of its plugin and name; it is pinned to its own current version when its files
- *    differ from the platform version's. A copy whose platform skill is not on in its org is left
- *    unlinked (it keeps serving what it served) until a later run finds it on: a linked copy,
- *    pinned or not, follows its platform skill's availability (ruling P2-18);
- * 3. one-shot (spec §5 rule 10, ruling P2-5: nothing is renamed outside the migration): only while
- *    no run has finished (the first run's own execution), an org skill of the org's own (no
- *    provenance) whose name a platform skill on in its org has stays the org's: it is renamed (`<name>-org`, `-org-2`, …), the org admins get an inbox notice
- *    (`skill_renamed`) and that platform skill is switched off in the org (a switch the org already
- *    has is kept). Agents select skills by id, so they keep it; the name changes in new runs. Once a
- *    run has finished, a clash is only logged as a warning and left alone (the org's skill wins);
- * 4. an org agent template links to the platform template of its plugin and name, pinned like
- *    skills (definitions compared as canonical JSON). Templates are never renamed: an org template
- *    always has its plugin's type, which is the platform template's;
- * 5. a connector made from a connector template (the install ledger's `template_id`) links to that
- *    platform connector template (ruling E2).
- * Plugin switches exist since phase 1 and new platform rows follow the plugin's scope, so nothing
- * else is written. Writes run per org under its row lock and re-check each row; nothing is deleted
- * or overwritten except the renamed skill's name. Each run is recorded in `platform_migration_runs`
- * (rows older than 30 days are pruned, except the first finished run: it marks the renames done).
- */
-export declare class PlatformMigration {
-    private readonly kdb;
-    private readonly orgLock;
-    private readonly platform;
-    readonly txHost: TransactionHost;
-    readonly config: KernelConfigService;
-    readonly lockService: LockService;
-    readonly log: KernelLogger;
-    constructor(kdb: KernelDb, orgLock: OrgLock, platform: PlatformComponents, txHost: TransactionHost, config: KernelConfigService, lockService: LockService, log: KernelLogger);
-    private get db();
-    /** The scheduled run (see the class). */
-    migrate(signal?: AbortSignal): Promise<void>;
-    /**
-     * One run of every step; returns what it changed. `signal` (the stop, or a lost run lock) is
-     * read between items and orgs: an aborted run stops there and its row is deleted (every step is
-     * idempotent, so the next run carries on; an unfinished run never counts as the first one).
-     */
-    runOnce(signal?: AbortSignal): Promise<PlatformMigrationStats>;
-    /** Deletes finished runs older than {@link RUNS_KEPT_MS}, never the first one (`first`). */
-    private pruneRuns;
-    /**
-     * Step 1: the live catalog items whose platform components were never written
-     * (`platform_synced_version` null; `syncFromVersion` sets it). An item whose components were
-     * removed since is not synced again.
-     */
-    private syncItems;
-    /** The highest version of the item installed in an org (and still stored), else `latest`. */
-    private platformVersion;
-    /** Step 2: org skill copies with plugin provenance, not linked yet. */
-    private linkSkills;
-    /** Links `links` of one org under its row lock (each only while it is still as read). */
-    private linkSkillsIn;
-    /**
-     * Step 3 (one-shot): org skills of the org's own whose name a platform skill on in their org has,
-     * renamed only in the first run (`rename`: no run has finished yet); later ones are only logged.
-     */
-    private renameClashes;
-    /**
-     * Renames the clashing skills of one org under its row lock (each only while it still has the
-     * name and no provenance), switches the clashing platform skills off in the org (unless the org
-     * has a switch for them already), and writes one inbox notice and one audit event per skill.
-     */
-    private renameIn;
-    /** Step 4: org agent templates not linked yet, by plugin and name. */
-    private linkTemplates;
-    /** Links `links` of one org under its row lock (each only while it is still as read). */
-    private linkTemplatesIn;
-    /**
-     * Step 5: connectors not linked yet whose install ledger row names the connector template they
-     * were made from; one statement (a connector only gains a link, nothing else changes).
-     */
-    private linkConnectors;
-}