@capybara-hq/kernel 0.1.0-rc.26 → 0.1.0-rc.28

package/dist/tools/builtins/schedules.js

@@ -73,19 +73,52 @@ const RUN_AT_SCHEMA = {
 };
 const MODE_SCHEMA = {
     type: "string",
-    enum: ["new", "here"],
+    enum: ["new", "here", "chat"],
     description: '"new": every run starts a new conversation with this agent. "here": every run posts the ' +
         "prompt into this conversation (in an IM direct chat: the chat's current conversation), " +
-        'e.g. for "check this again at 3 pm".',
+        'e.g. for "check this again at 3 pm". "chat": every run posts into the IM chat named by ' +
+        "chat.",
+};
+const CHAT_SCHEMA = {
+    type: "object",
+    properties: {
+        connectionId: {
+            type: "string",
+            minLength: 1,
+            maxLength: 100,
+            description: "The id of the active channel connection that delivers to the chat.",
+        },
+        chatId: {
+            type: "string",
+            minLength: 1,
+            maxLength: 500,
+            description: "The chat's id within that connection, e.g. a DM's user id or a group's id.",
+        },
+        chatType: {
+            type: "string",
+            enum: ["dm", "group"],
+            description: 'The kind of chat: "dm" (the default) or "group". A group needs a channel with threads.',
+        },
+        agentId: {
+            type: "string",
+            minLength: 1,
+            maxLength: 100,
+            description: "The agent the chat belongs to; defaults to this run's agent. A chat target must use " +
+                "the connection's agent.",
+        },
+    },
+    required: ["connectionId", "chatId"],
+    additionalProperties: false,
 };
 const CREATE_SPEC = {
     name: BUILTIN.ScheduleCreate,
     description: "Create a scheduled task for the user: this agent runs the prompt on a schedule (cron) or " +
-        "once at a time (runAt), in the user's time zone, acting as the user. Use it when the user " +
-        'asks for something recurring or later ("every weekday at 9 send me a brief", "remind me at ' +
-        '3 pm"). Every call asks the user to approve the whole task first. Runs happen without the ' +
-        "user present: write the prompt so it stands on its own, and list in approvedTools the tools " +
-        "a run needs without asking. Do not use it for work to do now.",
+        "once at a time (runAt), in the user's time zone, acting as the user. Each run starts a new " +
+        "conversation, posts into this conversation, or posts into an IM chat the user names with " +
+        'chat. Use it when the user asks for something recurring or later ("every weekday at 9 ' +
+        'send me a brief", "remind me at 3 pm"). Every call asks the user to approve the whole task ' +
+        "first. Runs happen without the user present: write the prompt so it stands on its own, and " +
+        "list in approvedTools the tools a run needs without asking. Do not use it for work to do now.",
     keyArgs: ["name"],
     inputSchema: {
         type: "object",
@@ -105,6 +138,10 @@ const CREATE_SPEC = {
             cron: CRON_SCHEMA,
             runAt: RUN_AT_SCHEMA,
             mode: MODE_SCHEMA,
+            chat: {
+                ...CHAT_SCHEMA,
+                description: 'For mode "chat": the IM chat every run posts into.',
+            },
             approvedTools: TOOL_KEYS_SCHEMA,
         },
         required: ["name", "prompt", "mode"],
@@ -113,11 +150,10 @@ const CREATE_SPEC = {
 };
 const UPDATE_SPEC = {
     name: BUILTIN.ScheduleUpdate,
-    description: "Change one of the user's scheduled tasks: its name, prompt, schedule, where it runs or its " +
-        "approved tools. Pass the task id (from ScheduleList or ScheduleCreate) and only the fields " +
-        "to change; approvedTools replaces the whole list. Every call asks the user to approve the " +
-        "change first. To pause or stop a task, use ScheduleDelete or tell the user to pause it on " +
-        "the task page.",
+    description: "Change one of the user's scheduled tasks: its name, prompt, schedule, where it runs (a new " +
+        "conversation, this conversation or an IM chat, and the agent) or its approved tools. Pass " +
+        "the task id and only the fields to change; approvedTools replaces the whole list. Every " +
+        "call asks the user to approve the change first. It does not pause, resume or delete a task.",
     keyArgs: ["id"],
     inputSchema: {
         type: "object",
@@ -133,6 +169,10 @@ const UPDATE_SPEC = {
             cron: CRON_SCHEMA,
             runAt: RUN_AT_SCHEMA,
             mode: MODE_SCHEMA,
+            chat: {
+                ...CHAT_SCHEMA,
+                description: 'For mode "chat": the IM chat every run posts into; replaces the target.',
+            },
             approvedTools: {
                 ...TOOL_KEYS_SCHEMA,
                 description: `${TOOL_KEYS_SCHEMA.description} Replaces the task's whole list; pass [] to remove every approved tool, omit it to keep the list.`,
@@ -145,15 +185,21 @@ const UPDATE_SPEC = {
 const LIST_SPEC = {
     name: BUILTIN.ScheduleList,
     description: "List the user's scheduled tasks in this organization: id, name, schedule with its time " +
-        "zone, status, next run and where runs go. Use it to find a task's id before ScheduleUpdate " +
-        "or ScheduleDelete, or when the user asks what is scheduled. Read-only.",
+        "zone, status, next run and where runs go. Read-only.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+};
+const TARGETS_SPEC = {
+    name: BUILTIN.ScheduleTargets,
+    description: "List the IM chats scheduled task runs can be delivered to for the user in this " +
+        "organization: each chat's connection id, chat id, chat type and the connection's agent id, " +
+        "with a label naming the connection. Read-only.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
 };
 const DELETE_SPEC = {
     name: BUILTIN.ScheduleDelete,
     description: "Delete one of the user's scheduled tasks for good: it never runs again; past conversations " +
-        "stay. Use it when the user asks to stop or remove a task; find the id with ScheduleList. " +
-        "Only the user's own tasks can be deleted.",
+        "stay. Use it when the user asks to stop or remove a task. Only the user's own tasks can be " +
+        "deleted.",
     keyArgs: ["id"],
     inputSchema: {
         type: "object",
@@ -165,7 +211,15 @@ const DELETE_SPEC = {
     },
 };
 const ToolKeys = z.array(z.string().min(1).max(200)).max(TOOLS_MAX);
-const Mode = z.enum(["new", "here"]);
+const Mode = z.enum(["new", "here", "chat"]);
+const Chat = z
+    .object({
+    connectionId: z.string().min(1).max(100),
+    chatId: z.string().min(1).max(500),
+    chatType: z.enum(["dm", "group"]).optional(),
+    agentId: z.string().min(1).max(100).optional(),
+})
+    .strict();
 const CreateInput = z
     .object({
     name: z.string().min(1).max(NAME_MAX),
@@ -173,6 +227,7 @@ const CreateInput = z
     cron: z.string().min(1).max(100).optional(),
     runAt: z.string().min(1).max(40).optional(),
     mode: Mode,
+    chat: Chat.optional(),
     approvedTools: ToolKeys.optional(),
 })
     .strict();
@@ -184,19 +239,24 @@ const UpdateInput = z
     cron: z.string().min(1).max(100).optional(),
     runAt: z.string().min(1).max(40).optional(),
     mode: Mode.optional(),
+    chat: Chat.optional(),
     approvedTools: ToolKeys.optional(),
 })
     .strict();
 const IdInput = z.object({ id: z.string().min(1).max(100) }).strict();
 // ---- model-facing texts (English, actionable) ----
-const INVALID_CREATE_TEXT = "Invalid input; pass name, prompt, mode (new or here), exactly one of cron or runAt, and " +
-    "optionally approvedTools as an array of tool keys.";
+const INVALID_CREATE_TEXT = "Invalid input; pass name, prompt, mode (new, here or chat), exactly one of cron or runAt, " +
+    "chat with mode chat (connectionId, chatId, chatType, agentId), and optionally approvedTools " +
+    "as an array of tool keys.";
 const INVALID_UPDATE_TEXT = "Invalid input; pass the task id and the fields to change (name, prompt, cron or runAt, mode, " +
-    "approvedTools).";
+    "chat, approvedTools).";
 const INVALID_ID_TEXT = "Invalid input; pass the task id from ScheduleList.";
 const ONE_TRIGGER_TEXT = "Pass exactly one of cron (a repeating schedule) or runAt (a single run), not both and not neither.";
 const BOTH_TRIGGERS_TEXT = "Pass at most one of cron or runAt: cron makes the task repeat, runAt makes it run once.";
-const NOTHING_TO_UPDATE_TEXT = "Nothing to change; pass at least one of name, prompt, cron, runAt, mode or approvedTools with the id.";
+const NOTHING_TO_UPDATE_TEXT = "Nothing to change; pass at least one of name, prompt, cron, runAt, mode, chat or " +
+    "approvedTools with the id.";
+const CHAT_NEEDS_CHAT_TEXT = 'mode "chat" needs a chat; pass chat with connectionId and chatId (and optionally chatType and agentId).';
+const CHAT_ONLY_TEXT = 'chat applies only to mode "chat"; pass mode "chat" with it, or omit it.';
 export const SCHEDULES_UNAVAILABLE_TEXT = "Scheduled tasks are not available on this server; ask the user to manage the task on the scheduled tasks page instead.";
 export const SCHEDULES_OFF_TEXT = "Scheduled tasks are turned off in this organization; ask an org admin to turn them on.";
 /** The card recomputed at run time differs from the one the person approved. */
@@ -226,7 +286,7 @@ export function scheduleErrorText(e, ctx) {
         case "schedule.invalid_time_zone":
             return `${m}. Ask the user to set their time zone in their profile, then retry.`;
         case "schedule.target_invalid":
-            return `${m}. Use mode "new" to start a new conversation for every run instead.`;
+            return `${m}. Fix the target and retry, or use mode "new" to start a new conversation for every run instead.`;
         case "schedule.grant_not_allowed":
             return `${m}. Remove it from approvedTools and call again.`;
         case "forbidden":
@@ -287,7 +347,9 @@ function targetWords(t, currentConversationId) {
         return { zh: "每次运行新建对话", en: "a new conversation for every run" };
     if (t.mode === "chat") {
         const n = clip(t.connectionName, 60);
-        return { zh: `${n} 的私聊`, en: `the direct chat on ${n}` };
+        return t.chat.chatType === "group"
+            ? { zh: `${n} 的群聊`, en: `the group chat on ${n}` }
+            : { zh: `${n} 的私聊`, en: `the direct chat on ${n}` };
     }
     return t.conversationId === currentConversationId
         ? { zh: "当前对话", en: "this conversation" }
@@ -298,16 +360,25 @@ function toolsWords(keys) {
         ? { zh: "无", en: "none" }
         : { zh: keys.join("、"), en: keys.join(", ") };
 }
+/** The `chat` input with its default kind (`dm`). */
+const normalizedChat = (chat) => ({
+    connectionId: chat.connectionId,
+    chatId: chat.chatId,
+    chatType: chat.chatType ?? "dm",
+});
+/** A chat target with its connection's name for the words. */
+async function chatTargetOf(db, chat) {
+    const c = await db
+        .selectFrom("channel_connections")
+        .select("name")
+        .where("id", "=", chat.connectionId)
+        .executeTakeFirst();
+    return { mode: "chat", chat, connectionName: c?.name ?? chat.connectionId };
+}
 /** A stored task's target; a chat's connection name is read for the words. */
 async function storedTarget(db, task) {
-    if (task.mode === "chat" && task.chat !== null) {
-        const c = await db
-            .selectFrom("channel_connections")
-            .select("name")
-            .where("id", "=", task.chat.connectionId)
-            .executeTakeFirst();
-        return { mode: "chat", chat: task.chat, connectionName: c?.name ?? task.chat.connectionId };
-    }
+    if (task.mode === "chat" && task.chat !== null)
+        return chatTargetOf(db, task.chat);
     if (task.mode === "conversation" && task.conversationId !== null) {
         return { mode: "conversation", conversationId: task.conversationId };
     }
@@ -351,7 +422,8 @@ const sameTarget = (a, b) => a.mode === b.mode &&
         a.conversationId === b.conversationId) &&
     (a.mode !== "chat" ||
         (a.chat.connectionId === b.chat.connectionId &&
-            a.chat.chatId === b.chat.chatId));
+            a.chat.chatId === b.chat.chatId &&
+            a.chat.chatType === b.chat.chatType));
 const uniqueSorted = (keys) => [...new Set(keys)].sort();
 /** cron / runAt as the service's trigger; undefined when neither is given. */
 function triggerOf(i) {
@@ -361,6 +433,20 @@ function triggerOf(i) {
         return { kind: "once", at: i.runAt.trim() };
     return undefined;
 }
+/** `chat` against the mode on create, as a refusal; null when they agree. */
+function createChatError(i) {
+    if (i.mode !== "chat" && i.chat !== undefined)
+        return new ToolError(CHAT_ONLY_TEXT);
+    if (i.mode === "chat" && i.chat === undefined)
+        return new ToolError(CHAT_NEEDS_CHAT_TEXT);
+    return null;
+}
+/** `chat` against the mode on update; null when they agree (or chat is absent). */
+function updateChatError(i) {
+    if (i.chat === undefined)
+        return null;
+    return i.mode !== "chat" ? new ToolError(CHAT_ONLY_TEXT) : null;
+}
 const withZone = (t, timeZone) => t.kind === "cron"
     ? { kind: "cron", expr: t.expr, timeZone }
     : { kind: "once", at: t.at, timeZone };
@@ -429,7 +515,7 @@ ScheduleUpdates = __decorate([
     __param(2, Inject(ScheduledTaskStore))
 ], ScheduleUpdates);
 export { ScheduleUpdates };
-/** The four schedule builtins. */
+/** The five schedule builtins. */
 export function scheduleTools(deps) {
     /**
      * The service, or a refusal (the tools are hidden then too: {@link unavailable}). Defensive:
@@ -507,17 +593,28 @@ export function scheduleTools(deps) {
         const zone = await deps.timeZoneOf(ctx.orgId, ctx.conversationId);
         const target = input.mode === "here"
             ? await hereTarget(deps.db(), ctx.orgId, ctx.accountId, ctx.conversationId)
-            : { mode: "new" };
-        return { trigger, zone, target, tools: uniqueSorted(input.approvedTools ?? []) };
+            : input.mode === "chat"
+                ? await chatTargetOf(deps.db(), normalizedChat(input.chat))
+                : { mode: "new" };
+        return {
+            trigger,
+            zone,
+            target,
+            tools: uniqueSorted(input.approvedTools ?? []),
+            agentId: input.chat?.agentId ?? ctx.agentId,
+        };
     }
-    function createCard(input, p, conversationId) {
+    function createCard(input, p, conversationId, runAgentId) {
         const when = scheduleWords(withZone(p.trigger, p.zone));
         const where = targetWords(p.target, conversationId);
         const tools = toolsWords(p.tools);
         const name = clip(input.name, NAME_MAX);
+        const agent = p.agentId === runAgentId
+            ? { zh: "", en: "" }
+            : { zh: `；以智能体 ${p.agentId} 运行`, en: `; runs as agent ${p.agentId}` };
         return {
-            zh: `创建定时任务「${name}」：${when.zh}；运行位置：${where.zh}；预先批准的工具：${tools.zh}`,
-            en: `Create the scheduled task "${name}": ${when.en}; runs in ${where.en}; approved tools: ${tools.en}`,
+            zh: `创建定时任务「${name}」：${when.zh}；运行位置：${where.zh}${agent.zh}；预先批准的工具：${tools.zh}`,
+            en: `Create the scheduled task "${name}": ${when.en}; runs in ${where.en}${agent.en}; approved tools: ${tools.en}`,
         };
     }
     const create = {
@@ -532,24 +629,30 @@ export function scheduleTools(deps) {
             if ((parsed.data.cron === undefined) === (parsed.data.runAt === undefined)) {
                 return deny(key, ONE_TRIGGER_TEXT);
             }
+            const bad = createChatError(parsed.data);
+            if (bad !== null)
+                return deny(key, bad.message);
             const p = await createPlan(parsed.data, ctx);
-            return ask(key, createCard(parsed.data, p, ctx.conversationId));
+            return ask(key, createCard(parsed.data, p, ctx.conversationId, ctx.agentId));
         },
         async run(raw, ctx) {
             const parsed = CreateInput.safeParse(raw);
             if (!parsed.success)
                 throw new ToolError(INVALID_CREATE_TEXT);
             const input = parsed.data;
+            const bad = createChatError(input);
+            if (bad !== null)
+                throw bad;
             const svc = await service();
             const p = await createPlan(input, ctx);
             if (p.trigger === undefined || (input.cron !== undefined && input.runAt !== undefined)) {
                 throw new ToolError(ONE_TRIGGER_TEXT);
             }
             // the zone and target are recomputed now: they must be the ones the person approved
-            await sameAsApproved(ctx, BUILTIN.ScheduleCreate, createCard(input, p, ctx.conversationId));
+            await sameAsApproved(ctx, BUILTIN.ScheduleCreate, createCard(input, p, ctx.conversationId, ctx.agentId));
             const trigger = p.trigger;
             const task = await call(() => svc.create(ctx.orgId, ctx.accountId, {
-                agentId: ctx.agentId,
+                agentId: p.agentId,
                 name: input.name,
                 prompt: input.prompt,
                 trigger,
@@ -605,7 +708,9 @@ export function scheduleTools(deps) {
             const before = await storedTarget(db, task);
             const after = input.mode === "here"
                 ? await hereTarget(db, ctx.orgId, ctx.accountId, ctx.conversationId)
-                : { mode: "new" };
+                : input.mode === "chat"
+                    ? await chatTargetOf(db, normalizedChat(input.chat))
+                    : { mode: "new" };
             if (!sameTarget(before, after)) {
                 const b = targetWords(before, ctx.conversationId);
                 const a = targetWords(after, ctx.conversationId);
@@ -613,6 +718,10 @@ export function scheduleTools(deps) {
                 en.push(`runs in ${b.en} → ${a.en}`);
             }
         }
+        if (input.chat?.agentId !== undefined && input.chat.agentId !== task.agentId) {
+            zh.push(`智能体 ${clip(task.agentId, 80)} → ${clip(input.chat.agentId, 80)}`);
+            en.push(`agent ${clip(task.agentId, 80)} → ${clip(input.chat.agentId, 80)}`);
+        }
         if (input.approvedTools !== undefined) {
             const next = uniqueSorted(input.approvedTools);
             const added = next.filter((k) => !grants.includes(k));
@@ -649,6 +758,7 @@ export function scheduleTools(deps) {
         i.cron === undefined &&
         i.runAt === undefined &&
         i.mode === undefined &&
+        i.chat === undefined &&
         i.approvedTools === undefined;
     const update = {
         spec: UPDATE_SPEC,
@@ -663,6 +773,9 @@ export function scheduleTools(deps) {
             if (input.cron !== undefined && input.runAt !== undefined) {
                 return deny(key, BOTH_TRIGGERS_TEXT);
             }
+            const bad = updateChatError(input);
+            if (bad !== null)
+                return deny(key, bad.message);
             if (nothingToUpdate(input))
                 return deny(key, NOTHING_TO_UPDATE_TEXT);
             const task = await ownTask(ctx.orgId, ctx.accountId, input.id);
@@ -679,6 +792,9 @@ export function scheduleTools(deps) {
             if (input.cron !== undefined && input.runAt !== undefined) {
                 throw new ToolError(BOTH_TRIGGERS_TEXT);
             }
+            const bad = updateChatError(input);
+            if (bad !== null)
+                throw bad;
             if (nothingToUpdate(input))
                 throw new ToolError(NOTHING_TO_UPDATE_TEXT);
             const svc = await service();
@@ -697,11 +813,16 @@ export function scheduleTools(deps) {
             if (input.mode !== undefined) {
                 const target = input.mode === "here"
                     ? await hereTarget(deps.db(), ctx.orgId, ctx.accountId, ctx.conversationId)
-                    : { mode: "new" };
+                    : input.mode === "chat"
+                        ? await chatTargetOf(deps.db(), normalizedChat(input.chat))
+                        : { mode: "new" };
                 const f = targetFields(target);
                 patch.mode = f.mode;
                 patch.conversationId = f.conversationId ?? null;
                 patch.chat = f.chat ?? null;
+                // the chat's agent maps to the service's task agent (the HTTP shape stays flat)
+                if (input.chat?.agentId !== undefined)
+                    patch.agentId = input.chat.agentId;
             }
             const zone = task.trigger.timeZone;
             const updated = await call(() => deps.updates.apply(svc, ctx.orgId, ctx.accountId, task, patch, input.approvedTools), { id: input.id, zone });
@@ -761,6 +882,43 @@ export function scheduleTools(deps) {
             };
         },
     };
+    // ---- ScheduleTargets ----
+    /** A target's fields in the model-facing line (`ScheduleTargets`). */
+    const targetLine = (t) => `- ${clip(t.label, 120)}: connectionId=${t.connectionId}, chatId=${t.chatId}, ` +
+        `chatType=${t.chatType}, agentId=${t.agentId} (${clip(t.connectionName, 80)}, ${t.plugin})`;
+    const targets = {
+        spec: TARGETS_SPEC,
+        defaultPolicy: "allow",
+        unavailable,
+        async run(_raw, ctx) {
+            const svc = await service();
+            await liveRole(ctx);
+            const items = await call(() => svc.chatTargets(ctx.orgId, ctx.accountId), {});
+            if (items.length === 0) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "The user has no IM chats scheduled task runs can be delivered to in this " +
+                                "organization; a chat appears once the user has messaged the channel's bot or " +
+                                "talked in a group.",
+                        },
+                    ],
+                    display: display("没有可送达的聊天", "No delivery chats"),
+                };
+            }
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `The IM chats this user can deliver scheduled task runs to (${items.length}):\n` +
+                            items.map(targetLine).join("\n"),
+                    },
+                ],
+                display: display(`可送达的聊天（${items.length} 个）`, `Listed ${items.length} delivery chats`),
+            };
+        },
+    };
     // ---- ScheduleDelete ----
     const remove = {
         spec: DELETE_SPEC,
@@ -785,5 +943,5 @@ export function scheduleTools(deps) {
             };
         },
     };
-    return [create, update, list, remove];
+    return [create, update, list, targets, remove];
 }

package/dist/tools/connector-account-policies.d.ts

@@ -24,6 +24,14 @@ export interface MemberToolPolicyView {
 }
 /** Whether a connector's credential is per member: its calls are made with the member's connection. */
 export declare const personalAuth: (auth: unknown) => boolean;
+/**
+ * The tool name of a member's own policy for pushes to one repository on one host through the
+ * connector (sandbox git credentials spec §7: the virtual tool `git_push`,
+ * `git_push:<host>/<owner>/<repo>`, so an allow never covers another host). No
+ * `connector_tools` row backs it, so the 权限 sheet ({@link ConnectorAccountPolicies.read}) does
+ * not list it; 「一直允许」 on a git push ask writes it.
+ */
+export declare const gitPushPolicyName: (host: string, repo: string) => string;
 /**
  * A member's own tool policies for their own connection of a personal-credential connector
  * (maintainer decision 2026-11-09, the connector card's 权限). They apply to every agent the

package/dist/tools/connector-account-policies.js

@@ -22,6 +22,14 @@ export const personalAuth = (auth) => {
     const a = auth;
     return a !== null && a.type !== "none" && a.ownership === "personal";
 };
+/**
+ * The tool name of a member's own policy for pushes to one repository on one host through the
+ * connector (sandbox git credentials spec §7: the virtual tool `git_push`,
+ * `git_push:<host>/<owner>/<repo>`, so an allow never covers another host). No
+ * `connector_tools` row backs it, so the 权限 sheet ({@link ConnectorAccountPolicies.read}) does
+ * not list it; 「一直允许」 on a git push ask writes it.
+ */
+export const gitPushPolicyName = (host, repo) => `git_push:${host.toLowerCase()}/${repo}`;
 const notPersonal = () => new ApiError("connector.not_personal", "This connector uses one credential for the whole organization; only a connector each member connects to with their own credential has per-member tool policies");
 const notFound = () => new ApiError("connector.not_found", "Connector not found");
 /**

package/dist/tools/connectors.controller.d.ts

@@ -75,6 +75,7 @@ declare const CreateBody: z.ZodObject<{
         tokenTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>], "type">;
     credential: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    git: z.ZodOptional<z.ZodType<import("@capybara-hq/plugin-sdk").GitSource, unknown, z.core.$ZodTypeInternals<import("@capybara-hq/plugin-sdk").GitSource, unknown>>>;
 }, z.core.$strict>;
 /** 预览（Ruling A20）：与创建相同的连接器 / 端点 / 认证 / 凭据，认证可缺省（只读端点描述，不列工具）。 */
 declare const PreviewBody: z.ZodObject<{
@@ -170,6 +171,7 @@ declare const UpdateBody: z.ZodObject<{
         }>>;
     }, z.core.$strict>>>;
     allowUnannotated: z.ZodOptional<z.ZodBoolean>;
+    useForGit: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 /**
  * A connector as the org's pages show it: with its plugin's icon (`icon`, see `withIcons`), its

package/dist/tools/connectors.controller.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { ConnectorAuthSchema } from "@capybara-hq/plugin-sdk";
+import { ConnectorAuthSchema, GitSourceSchema } from "@capybara-hq/plugin-sdk";
 import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post, Put } from "@nestjs/common";
 import { z } from "zod";
 import { orgIconScope, PluginIcons } from "../extensions/plugin-icons.js";
@@ -47,6 +47,8 @@ const CreateBody = z
     endpoint: z.record(z.string(), z.unknown()),
     auth: ConnectorAuthSchema,
     credential: CredentialValue.optional(),
+    /** The git hosts the credential serves in sandboxes (sandbox git credentials spec §6.1). */
+    git: GitSourceSchema.optional(),
 })
     .strict();
 /** 预览（Ruling A20）：与创建相同的连接器 / 端点 / 认证 / 凭据，认证可缺省（只读端点描述，不列工具）。 */
@@ -76,6 +78,8 @@ const UpdateBody = z
         .refine((v) => Object.keys(v).length <= 1000, { message: "Too many tools" })
         .optional(),
     allowUnannotated: z.boolean().optional(),
+    /** Use an org-credential connector for git in sandboxes (spec 2026-11-12 §6.2). */
+    useForGit: z.boolean().optional(),
 })
     .strict();
 class ConnectorCreateBody extends createZodDto(CreateBody, "ConnectorCreateBody") {

package/dist/tools/connectors.service.d.ts

@@ -1,4 +1,4 @@
-import { type AuthHint, type ConnectorOperation, type ToolAnnotations } from "@capybara-hq/plugin-sdk";
+import { type AuthHint, type ConnectorOperation, type GitSource, type ToolAnnotations } from "@capybara-hq/plugin-sdk";
 import { type ConnectionGuideState, PluginGuides } from "../extensions/plugin-guides.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import type { WriteActor } from "../identity/write-actor.js";
@@ -71,6 +71,16 @@ export interface ConnectorSummary {
     platformTemplateId: string | null;
     /** The plugin (catalog item) its template came from (`connectors.catalog_item_id`), else null. */
     catalogItemId: string | null;
+    /**
+     * The git hosts its credential serves in sandboxes (`connectors.git_hosts`; sandbox git
+     * credentials spec §6.1), null when it declares none.
+     */
+    git: GitSource | null;
+    /**
+     * An org-ownership connector serves as a git source (`connectors.use_for_git`, set by an org
+     * admin); personal connectors with `git` always do and keep this false.
+     */
+    useForGit: boolean;
     createdBy: string;
     createdAt: Date;
     updatedAt: Date;
@@ -90,6 +100,11 @@ export interface CreateConnectorInput {
     endpoint: unknown;
     auth: ConnectorAuth;
     credential?: unknown;
+    /**
+     * The git hosts the connector's credential serves in sandboxes (a template's `git`, or the
+     * create body's; validated by the SDK's `GitSourceSchema`), stored in `connectors.git_hosts`.
+     */
+    git?: GitSource | undefined;
     /**
      * Install from a platform catalog connector template (T26, filled in by the catalog service,
      * not accepted over HTTP): the connector records its source item and version, the item policy is
@@ -139,6 +154,8 @@ export interface TemplateUpdateInput {
     auth: ConnectorAuth;
     /** The template version (itemId, version, templateId, defaultToolPolicies). */
     template: ConnectorTemplateRef;
+    /** The new template's git hosts (template-owned: replaces `git_hosts`; absent clears them). */
+    git?: GitSource | undefined;
     /**
      * The auth method or the credentials it needs changed: the connector's credentials (org and
      * personal, OAuth client and tokens) are cleared and `credential` (an org or the actor's static
@@ -194,6 +211,11 @@ export interface UpdateConnectorInput {
     }> | undefined;
     /** 把「没有 readOnlyHint / destructiveHint 注解」的工具默认策略批量改为 allow。 */
     allowUnannotated?: boolean | undefined;
+    /**
+     * Use this connector's credential for git in sandboxes (sandbox git credentials spec §6.2): only
+     * an org-ownership connector that declares git hosts; pushes are then the bot's.
+     */
+    useForGit?: boolean | undefined;
 }
 /** OAuth 安装准备的结果：要存的客户端，以及（客户端凭据流）安装时取到的组织 token。 */
 export interface OAuthSetup {
@@ -207,7 +229,10 @@ export interface OAuthSetup {
 export declare class ConnectorsService {
     private readonly kdb;
     private readonly registry;
-    /** Extension manifests (a slug may not take an extension's name). */
+    /**
+     * Extension manifests: a derived default slug avoids an extension's name (an explicit slug may
+     * take one; connector and extension tool keys live in separate namespaces).
+     */
     private readonly extensions;
     private readonly credentials;
     private readonly config;
@@ -218,7 +243,10 @@ export declare class ConnectorsService {
     /** Setup guides of connector templates (spec 2026-11-09-setup-guides-v2-design.md §11). */
     private readonly guides;
     constructor(kdb: KernelDb, registry: ToolRegistry, 
-    /** Extension manifests (a slug may not take an extension's name). */
+    /**
+     * Extension manifests: a derived default slug avoids an extension's name (an explicit slug may
+     * take one; connector and extension tool keys live in separate namespaces).
+     */
     extensions: Pick<ExtensionRegistry, "manifests">, credentials: Credentials, config: Pick<KernelConfigService, "get">, drift: ToolDrift, 
     /** The org row lock (orgs/org-lock.ts): joins the caller's transaction. */
     orgLock: Pick<OrgLock, "lock" | "lockAndAuthorize">, txHost: TransactionHost, 
@@ -344,6 +372,21 @@ export declare class ConnectorsService {
      * global id); else `connector.not_found`.
      */
     private liveOrgOf;
+    /**
+     * Disables a connector because its plugin was switched off in the org (spec §5 rule 8): its
+     * endpoint and credentials stay. Only a connector that was active is marked with the plugin
+     * (`connectors.disabled_by_plugin_id`), so switching the plugin back on re-enables exactly what
+     * this call disabled; one an org admin disabled by hand keeps no marker and stays disabled. The
+     * caller holds the org row lock and runs in its transaction.
+     */
+    disableWithPluginIn(orgId: string, connectorId: string, itemId: string): Promise<void>;
+    /**
+     * Re-enables a connector the given plugin's switch-off disabled
+     * ({@link disableWithPluginIn}) when the plugin is switched back on and its install takes the
+     * connector back through the reuse path. A connector an org admin disabled by hand (no marker)
+     * or one another state left disabled stays disabled. Returns whether it switched it on.
+     */
+    enableIfPluginDisabledIn(orgId: string, connectorId: string, itemId: string): Promise<boolean>;
     /**
      * Disables or enables a connector on the platform's behalf (a super admin who need not be a
      * member of the org; the caller checks the super admin): org row lock, the status update, audit