@capybara-hq/kernel 0.1.0-rc.26 → 0.1.0-rc.28

package/dist/schedules/scheduled-tasks.service.js

@@ -14,6 +14,7 @@ import { AgentLookup } from "../agents/agent-lookup.js";
 import { ConversationAccess } from "../conversations/access.js";
 import { readMessageContext } from "../conversations/message-context.js";
 import { ApiError } from "../errors.js";
+import { enabledExtensionsByOrg, isExtensionEnabled } from "../extensions/enabled.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { audit } from "../identity/audit.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
@@ -33,7 +34,7 @@ import { ToolRegistry } from "../tools/registry.js";
 import { assembleCalendar, CALENDAR_LIMITS, CALENDAR_RANGE_DAYS, CALENDAR_TASK_RANGE_DAYS, calendarRunReadLimit, } from "./calendar.js";
 import { readScheduleSettings } from "./effective-settings.js";
 import { grantNotAllowed, scheduleDisabled, scheduleForbidden, scheduleNotFound, targetInvalid, } from "./errors.js";
-import { grantRefusal, grantRefusalOf, isNetworkGrantKey, isPolicyGrantKey, isTierGrantKey, NETWORK_GRANT_PREFIX, NETWORK_GRANT_SPEC_HASH, networkGrantHost, networkGrantRefusal, TIER_GRANT_SPEC_HASH, tierGrantRefusal, } from "./grant-rules.js";
+import { GIT_GRANT_SPEC_HASH, GIT_PUSH_GRANT, gitGrantRefusal, grantRefusal, grantRefusalOf, isGitGrantKey, isNetworkGrantKey, isPolicyGrantKey, isTierGrantKey, NETWORK_GRANT_PREFIX, NETWORK_GRANT_SPEC_HASH, networkGrantHost, networkGrantRefusal, normalizeGitGrantKey, TIER_GRANT_SPEC_HASH, tierGrantRefusal, } from "./grant-rules.js";
 import { oweSchedFire, oweSchedSettleUnfired } from "./job-ids.js";
 import { pauseTaskIn } from "./pause.js";
 import { jitterForGap, minGapMinutes, nextTick, validateTrigger } from "./schedule-math.js";
@@ -41,8 +42,15 @@ import { ScheduledTaskStore } from "./store.js";
 export { grantRefusal, grantRefusalOf, networkGrantRefusal, };
 /** The refusal of a network grant written outside a person's web session. */
 const NETWORK_GRANT_NEEDS_PERSON = "Network domains are approved on the task page by a person.";
+/** Why a git push grant needs a person (sandbox git credentials spec §7). */
+const GIT_GRANT_NEEDS_PERSON = "Git pushes are approved on the task page by a person.";
 /** The refusal of a sandbox tier grant written outside a person's web session. */
 const TIER_GRANT_NEEDS_PERSON = "A sandbox level is approved on the task page by a person.";
+/**
+ * A grant that belongs to no tool: a network domain, a git push or a sandbox tier (never stale,
+ * never re-resolved).
+ */
+const isNonToolGrantKey = (key) => isPolicyGrantKey(key) || isGitGrantKey(key);
 const RUNS_DEFAULT = 50;
 const RUNS_MAX = 200;
 const DAY_MS = 86_400_000;
@@ -194,8 +202,8 @@ let ScheduledTasksService = class ScheduledTasksService {
             changes.agentId = agent.id;
             // the grants were approved for the old agent's tools: each must hold for the new agent
             // too (refused, so the creator sees which), and takes the new agent's definition; network
-            // and sandbox tier grants belong to no tool and stay as they are
-            const held = (await this.store.listGrants(t, task.id)).filter((g) => !isPolicyGrantKey(g.toolKey));
+            // and git and sandbox tier grants belong to no tool and stay as they are
+            const held = (await this.store.listGrants(t, task.id)).filter((g) => !isNonToolGrantKey(g.toolKey));
             const regranted = await this.resolveGrants(orgId, role, agent, settings, held.map((g) => ({
                 toolKey: g.toolKey,
                 ...(g.connectorId !== null && { connectorId: g.connectorId }),
@@ -465,15 +473,18 @@ let ScheduledTasksService = class ScheduledTasksService {
         });
     }
     /**
-     * The chats the caller can point a `chat` task at (spec §8): per active connection of the org,
-     * their DM threads (archived included) and, on a channel with threads, the groups they have a
-     * thread in. Members up (`schedules.use`, the route's).
+     * The chats the caller can point a `chat` task at (spec §8): per active connection of the org
+     * whose extension is enabled in it, their DM threads (archived included) and, on a channel with
+     * threads, the groups they have a thread in. Members up (`schedules.use`, the route's).
      */
     async chatTargets(orgId, accountId) {
         await this.liveRole(orgId, accountId);
         const rows = await this.db.db
             .selectFrom("channel_threads")
             .innerJoin("channel_connections", "channel_connections.id", "channel_threads.connection_id")
+            .innerJoin(enabledExtensionsByOrg(this.db.db).as("en"), (j) => j
+            .onRef("en.org_id", "=", "channel_connections.org_id")
+            .onRef("en.plugin", "=", "channel_connections.plugin"))
             .select([
             "channel_connections.id as connection_id",
             "channel_connections.name",
@@ -556,13 +567,13 @@ let ScheduledTasksService = class ScheduledTasksService {
             return [];
         // the creator's view of the agent's tools: a grant whose tool changed or left is stale;
         // unknown (null) when the tools cannot be read now, rather than failing the task page
-        const current = grants.every((g) => isPolicyGrantKey(g.toolKey))
+        const current = grants.every((g) => isNonToolGrantKey(g.toolKey))
             ? new Map()
             : await this.agentToolFacts(orgId, task.accountId, task.agentId);
         return grants.map((g) => ({
             ...g,
-            // a network or sandbox tier grant names no tool definition: never stale
-            stale: isPolicyGrantKey(g.toolKey)
+            // a network, git or sandbox tier grant names no tool definition: never stale
+            stale: isNonToolGrantKey(g.toolKey)
                 ? false
                 : current === null
                     ? null
@@ -716,8 +727,9 @@ let ScheduledTasksService = class ScheduledTasksService {
             // a refused tool granted since drops out, unless its grant no longer matches the tool's
             // definition (stale: it would be refused again); a refused domain granted since drops out
             // while the org's network allowlist admits it (network ask-to-allow spec §8.3)
+            // a refused git push drops out once the task holds a grant for it or for every repository;
             // a refused sandbox level granted since drops out while the org's ceiling is still open
-            const isTool = (k) => !k.startsWith("connection:") && !isPolicyGrantKey(k);
+            const isTool = (k) => !k.startsWith("connection:") && !isNonToolGrantKey(k);
             const facts = refused.some(isTool) ? await toolsOf(task.agentId) : null;
             const limits = refused.some(isNetworkGrantKey) ? await orgLimits() : null;
             const open = refused.some(isTierGrantKey) ? await openReachable() : false;
@@ -726,6 +738,8 @@ let ScheduledTasksService = class ScheduledTasksService {
                 const hash = have?.get(k);
                 if (isPolicyGrantKey(k))
                     return hash === undefined || !admits(k);
+                if (isGitGrantKey(k))
+                    return hash === undefined && have?.get(GIT_PUSH_GRANT) === undefined;
                 if (hash === undefined)
                     return true;
                 const current = facts?.get(k);
@@ -905,9 +919,9 @@ let ScheduledTasksService = class ScheduledTasksService {
      * - the mode and its fields agree (`conversation`: a conversation and no chat; `chat`: a chat
      *   and no conversation; `new`: neither);
      * - `conversation`: the creator's live chat conversation with this agent, still accessible;
-     * - `chat`: the connection is active and bound to this agent; a DM needs a thread row (archived
-     *   allowed) of the creator in that chat; a group needs the creator's thread row in the group
-     *   and a channel with threads.
+     * - `chat`: the connection is active, its channel extension is enabled in this org, and it is
+     *   bound to this agent; a DM needs a thread row (archived allowed) of the creator in that chat;
+     *   a group needs the creator's thread row in the group and a channel with threads.
      */
     async checkTarget(orgId, accountId, agentId, target) {
         const { mode, conversationId, chat } = target;
@@ -947,6 +961,9 @@ let ScheduledTasksService = class ScheduledTasksService {
             if (conn?.status !== "active") {
                 throw targetInvalid("The channel connection does not exist or is not active");
             }
+            if (!(await isExtensionEnabled(t, orgId, conn.plugin))) {
+                throw targetInvalid("The channel's extension is disabled in this organization, so its chats cannot receive a task's runs");
+            }
             if (conn.agent_id !== agentId) {
                 throw targetInvalid("The chat belongs to another agent: use the connection's agent");
             }
@@ -1029,7 +1046,9 @@ let ScheduledTasksService = class ScheduledTasksService {
      * `deviceId`, the task's device (null: none can be determined, the device rule is skipped),
      * stored with `spec_hash` `network` and no connector (plan P-D7), and only when
      * `source.fromSession` (a person on the task page; never a token, the Platform tool or the
-     * schedule tools). Duplicates keep the last.
+     * schedule tools). Each git push key (`git:push`, `git:push:<owner>/<repo>`, the repository
+     * lower-cased) is refused by {@link gitGrantRefusal} and stored with `spec_hash` `git` and no
+     * connector, also only when `source.fromSession`. Duplicates keep the last.
      */
     async resolveGrants(orgId, role, agent, settings, grants, deviceId, source = {}) {
         if (grants.length === 0)
@@ -1052,6 +1071,22 @@ let ScheduledTasksService = class ScheduledTasksService {
                 out.set(toolKey, { toolKey, specHash: NETWORK_GRANT_SPEC_HASH, connectorId: null });
             }
         }
+        const git = grants.filter((g) => isGitGrantKey(g.toolKey));
+        if (git.length > 0) {
+            // a push is the creator's decision, never an agent's or a token's (as network domains)
+            if (source.fromSession !== true)
+                throw grantNotAllowed(GIT_GRANT_NEEDS_PERSON);
+            for (const g of git) {
+                if (g.connectorId !== undefined) {
+                    throw grantNotAllowed(`${g.toolKey} is a git push and comes from no connector`);
+                }
+                const toolKey = normalizeGitGrantKey(g.toolKey);
+                const why = gitGrantRefusal(toolKey, { forbiddenTools: settings.forbiddenTools });
+                if (why !== null)
+                    throw grantNotAllowed(why.message);
+                out.set(toolKey, { toolKey, specHash: GIT_GRANT_SPEC_HASH, connectorId: null });
+            }
+        }
         const tiers = grants.filter((g) => isTierGrantKey(g.toolKey));
         if (tiers.length > 0) {
             if (source.fromSession !== true)
@@ -1076,7 +1111,7 @@ let ScheduledTasksService = class ScheduledTasksService {
                 });
             }
         }
-        const toolGrants = grants.filter((g) => !isPolicyGrantKey(g.toolKey));
+        const toolGrants = grants.filter((g) => !isNonToolGrantKey(g.toolKey));
         if (toolGrants.length === 0)
             return [...out.values()];
         const d = agent.definition;

package/dist/schedules/types.d.ts

@@ -28,6 +28,8 @@ export type SchedulePauseReason = "creator" | "admin" | "failures" | "creator_in
  | "invalid_schedule";
 export type TaskRunStatus = "pending" | "running" | "completed" | "failed" | "skipped";
 export type TaskRunSkipReason = "missed" | "overlap" | "rate_limited" | "queue_paused" | "removed" | "device_offline" | "creator_inactive" | "agent_gone" | "target_gone" | "conversation_gone" | "org_disabled"
+/** The channel's extension is disabled in the org: the task stays active. */
+ | "plugin_disabled"
 /** A group chat on a channel without threads (a group run needs its own thread). */
  | "unsupported_target"
 /** The task was deleted after the run was recorded. */

package/dist/tools/approvals.service.d.ts

@@ -18,8 +18,23 @@ export { APPROVAL_DENY_REASON_MAX_CHARS } from "../conversations/events.js";
 export declare const APPROVALS_LIST_MAX = 100;
 export type ApprovalStatus = "pending" | "approved" | "denied" | "expired" | "cancelled" | "skipped";
 export type ApprovalScope = "once" | "session" | "always";
-/** What an approval asks: a tool call, or the device owner about refused network hosts. */
-export type ApprovalKind = "tool" | "network";
+/**
+ * What an approval asks: a tool call, the device owner about refused network hosts, or the actor
+ * about a git push the gateway held.
+ */
+export type ApprovalKind = "tool" | "network" | "git";
+/**
+ * The formatted `tool_result` of a command an ask kept (≤ 16 KB; larger output already archived),
+ * and the display-only fields the pipeline writes with it when the ask settles.
+ */
+export interface KeptToolResult {
+    content: string;
+    isError: boolean;
+    outputId?: string;
+    contentTypes?: string[];
+    display?: ToolDisplay;
+    view?: ToolView;
+}
 /**
  * A network ask's `detail` (network ask-to-allow spec §6.1, P-D2): the device, the refused hosts,
  * the command and its kept `tool_result` (written with a note when the ask settles; the command is
@@ -33,18 +48,8 @@ export interface NetworkAskDetail {
     }[];
     command: string;
     description: string | null;
-    /**
-     * The formatted `tool_result` of the command (≤ 16 KB; larger output already archived), and the
-     * display-only fields the pipeline writes with it when the ask settles.
-     */
-    result: {
-        content: string;
-        isError: boolean;
-        outputId?: string;
-        contentTypes?: string[];
-        display?: ToolDisplay;
-        view?: ToolView;
-    };
+    /** The formatted `tool_result` of the command and its display-only fields. */
+    result: KeptToolResult;
     /** The hosts the decision allowed (every approved decision writes them; none: nothing). */
     grantedHosts?: string[];
     /**
@@ -74,11 +79,32 @@ export interface NetworkAskAttempt {
 }
 /** A network ask's detail as the API shows it: without the kept command result. */
 export type NetworkAskView = Omit<NetworkAskDetail, "result">;
+/**
+ * A git push ask's `detail` (sandbox git credentials spec §7): the host, the repository
+ * (`<owner>/<repo>`, normalized) and the refs of the push the gateway held, the command that ran
+ * it and its device, the kept `tool_result` (written with a note when the ask settles; the push is
+ * never run again by the kernel), and once approved what took effect. The connector whose
+ * credential the push used is the approval's `connectorId`.
+ */
+export interface GitAskDetail {
+    host: string;
+    repo: string;
+    refs: string[];
+    command?: string;
+    deviceId?: string;
+    result: KeptToolResult;
+    /** What took effect: a run grant (`once`) or the member's standing allow for the repo (`always`). */
+    outcome?: "once" | "always";
+}
+/** A git ask's detail as the API shows it: without the kept command result. */
+export type GitAskView = Omit<GitAskDetail, "result">;
 /**
  * The model-visible note written after a network ask's kept result when its run is stopped before
  * the device owner answered (spec §6.7).
  */
 export declare const NETWORK_ASK_CANCELLED_NOTE = "[network] The run was stopped before the user answered; access stays blocked.";
+/** The model-visible note after a git ask's kept result when its run is stopped before the answer. */
+export declare const GIT_ASK_CANCELLED_NOTE = "[git] The run was stopped before the user answered; the push was not made.";
 /** 一条审批记录。 */
 export interface ApprovalRecord {
     id: string;
@@ -90,8 +116,10 @@ export interface ApprovalRecord {
     attempt: number;
     /** `network`: a network ask (its tool key is `Bash`, its facts in {@link detail}). */
     kind: ApprovalKind;
-    /** A network ask's hosts, command, kept result and outcome; null for a tool approval. */
+    /** A network ask's hosts, command, kept result and outcome; null for any other kind. */
     detail: NetworkAskDetail | null;
+    /** A git ask's host, repository, refs, kept result and outcome; null for any other kind. */
+    git: GitAskDetail | null;
     toolKey: string;
     specHash: string;
     connectorId: string | null;
@@ -117,11 +145,12 @@ export interface ApprovalRecord {
     expiresAt: string;
     createdAt: string;
 }
-/** An approval as a route answers it: a network ask's detail without the kept command result. */
-export interface ApprovalPublicRecord extends Omit<ApprovalRecord, "detail"> {
+/** An approval as a route answers it: a network or git ask's detail without the kept command result. */
+export interface ApprovalPublicRecord extends Omit<ApprovalRecord, "detail" | "git"> {
     detail: NetworkAskView | null;
+    git: GitAskView | null;
 }
-/** The record without a network ask's kept command result (what routes and cards may show). */
+/** The record without an ask's kept command result (what routes and cards may show). */
 export declare function publicRecord(r: ApprovalRecord): ApprovalPublicRecord;
 /** 审批详情（列表与详情接口返回）。 */
 export interface ApprovalView extends ApprovalPublicRecord {
@@ -210,6 +239,22 @@ export interface NetworkAskInput {
 }
 /** The tool key a network ask is recorded under (the command ran in `Bash`). */
 export declare const NETWORK_ASK_TOOL_KEY = "Bash";
+/** The tool key a git ask is recorded under (the push ran in a `Bash` command). */
+export declare const GIT_ASK_TOOL_KEY = "Bash";
+/** A new git push ask (sandbox git credentials spec §7), made by the tool pipeline. */
+export interface GitAskInput {
+    orgId: string;
+    conversationId: string;
+    runId: string;
+    /** The call's step (written to `approval_requested`). */
+    step: number;
+    callId: string;
+    /** The actor whose credential the push used: the only person who may decide. */
+    requestedFor: string;
+    /** The connector whose credential the push used (its git source). */
+    connectorId: string;
+    detail: Omit<GitAskDetail, "outcome">;
+}
 /** 「以后都允许」授权（本人可撤销）。 */
 export interface ToolGrantView {
     agentId: string;
@@ -278,6 +323,17 @@ export declare class ApprovalsService {
      */
     requestNetwork(input: NetworkAskInput): Promise<ApprovalRecord>;
     private requestNetworkIn;
+    /**
+     * A git push ask (sandbox git credentials spec §7): a pending approval of kind `git` for the
+     * actor whose credential the push used, expiring like a tool approval, and its
+     * `approval_requested` (tool key `Bash`, the display-only `git` field), in one transaction. The
+     * scopes are `once` (a run grant) and, for a personal connector (the push used the actor's own
+     * connection), `always` (the actor's standing allow for the repository); an org connector's push
+     * acts as the org, so no member allow applies to it. Takes the attempt after the call's other
+     * approvals; one per call: a second request returns the first.
+     */
+    requestGit(input: GitAskInput): Promise<ApprovalRecord>;
+    private requestGitIn;
     /** 当前用户能处理的审批（新的在前，最多 {@link APPROVALS_LIST_MAX} 条）；`status` 缺省为全部。 */
     list(orgId: string, accountId: string, status?: ApprovalStatus): Promise<ApprovalView[]>;
     /** 详情；当前用户不能处理的一律 `approval.not_found`（不泄露存在）。 */
@@ -302,6 +358,15 @@ export declare class ApprovalsService {
      * (`late`) and answered with a 409 that says so.
      */
     private decideNetwork;
+    /**
+     * A git push ask's decision (sandbox git credentials spec §7): only the asked actor
+     * (`requested_for`) decides, in a signed-in session (a personal access token is refused, as for
+     * network asks); `once` is a run grant (the row itself), `always` also writes the actor's
+     * standing allow for the repository on that host (`connector_tool_account_policies`,
+     * `git_push:<host>/<owner>/<repo>`) in the decision's transaction. The run resumes after the
+     * commit.
+     */
+    private decideGit;
     /**
      * 「这台设备一直允许」 (transactional outbox spec §7): the intent of the device change (naming the
      * ask) is recorded, the `policy` op sent (no transaction open), then {@link settleNetworkOp}
@@ -390,6 +455,19 @@ export declare class ApprovalsService {
      * decided or one asked of someone else. In the decision's transaction.
      */
     private keepTrialNetworkGrant;
+    /**
+     * The actor's standing allow for pushes to `repo` through the connector (sandbox git
+     * credentials spec §7, 「一直允许」): a `connector_tool_account_policies` row named
+     * `git_push:<host>/<owner>/<repo>` with policy `allow`, in the decision's transaction.
+     */
+    private allowRepoIn;
+    /**
+     * A trial run of a scheduled task (sandbox git credentials spec §7): a push its creator allowed
+     * for this run (「这次允许」) becomes the task's `git:push:<owner>/<repo>` grant, when
+     * `gitGrantRefusal` allows it (the org does not forbid it). Never for an ask another account
+     * decided or one asked of someone else. In the decision's transaction.
+     */
+    private keepTrialGitGrant;
     /**
      * 详情，不做处理人校验（内核内部用：渠道出站投递组装 IM 审批卡片）；不存在返回 null。
      * 不得直接回给请求方——HTTP 接口用 {@link get}。
@@ -399,6 +477,8 @@ export declare class ApprovalsService {
     forCall(runId: string, callId: string): Promise<ApprovalRecord | null>;
     /** The network ask of a tool call (at most one per call); null when it has none. */
     networkForCall(runId: string, callId: string): Promise<ApprovalRecord | null>;
+    /** The git push ask of a tool call (at most one per call); null when it has none. */
+    gitForCall(runId: string, callId: string): Promise<ApprovalRecord | null>;
     /**
      * 超时（等待机制的超时任务调用）：仍 pending 且已到期 → 置 expired、写 `approval_decided{expired}`（处理人为 null）。
      * 与人工决定都锁同一行，恰好一个生效。返回 `expired`（本次生效）/ `not_due`（尚未到期）/
@@ -437,7 +517,8 @@ export declare class ApprovalsService {
     /**
      * In the caller's transaction (`mandatory`; it wrote `authorAccountId`'s message in
      * `conversationId` and holds that conversation's row lock): the message skips the pending
-     * network asks it closes (network ask-to-allow spec §6.7), as it skips questions: the asks of
+     * network and git asks it closes (network ask-to-allow spec §6.7; a git push ask follows the
+     * same flow, sandbox git credentials spec §7), as it skips questions: the asks of
      * active runs `authorAccountId` started, in the conversation and in its sub-agents'
      * conversations at any depth (their asks are shown in the root). Each becomes `skipped` with
      * `approval_decided{skipped}` by the author; access stays blocked. Returns the skipped records and