@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.4

package/dist/identity/me.controller.js

@@ -20,6 +20,7 @@ import { ApiTokenService, FutureIsoDate } from "./api-tokens.js";
 import { MAX_PASSWORD_LENGTH } from "./login.js";
 import { CurrentPrincipal, requireUser, SessionOnly } from "./principal.js";
 import { SessionService } from "./sessions.js";
+import { SettingsService } from "./settings.js";
 /** The credential throttlers of a password change (per account, per client IP). */
 const CHANGE_PASSWORD_THROTTLERS = ["change-password", "change-password-ip"];
 const ChangePasswordSchema = z.object({
@@ -45,13 +46,15 @@ let MeController = class MeController {
     tokens;
     throttler;
     log;
-    constructor(accounts, sessions, orgs, tokens, throttler, log) {
+    settings;
+    constructor(accounts, sessions, orgs, tokens, throttler, log, settings) {
         this.accounts = accounts;
         this.sessions = sessions;
         this.orgs = orgs;
         this.tokens = tokens;
         this.throttler = throttler;
         this.log = log;
+        this.settings = settings;
     }
     async me(principal) {
         const p = requireUser(principal);
@@ -62,7 +65,12 @@ let MeController = class MeController {
             name: o.name,
             role: o.role,
         }));
-        return { account: p.account, via: p.via, currentOrgId, memberships };
+        // a session's org the account has since left reads as none (removal clears it, but a session
+        // created at that moment may still name it)
+        const current = memberships.some((m) => m.orgId === currentOrgId) ? currentOrgId : null;
+        const { orgCreation } = await this.settings.get();
+        const canCreateOrg = orgCreation === "anyone" || p.account.isEnterpriseAdmin;
+        return { account: p.account, via: p.via, currentOrgId: current, memberships, canCreateOrg };
     }
     /** 切换当前组织（仅 Web 会话）；`null` 清空。非成员或已软删除的组织 → `org.not_found`。 */
     async setCurrentOrg(principal, body) {
@@ -160,6 +168,7 @@ MeController = __decorate([
     __param(2, Inject(OrgsService)),
     __param(3, Inject(ApiTokenService)),
     __param(4, Inject(CredentialThrottler)),
-    __param(5, Inject(KERNEL_LOGGER))
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(SettingsService))
 ], MeController);
 export { MeController };

package/dist/identity/sessions.d.ts

@@ -36,6 +36,18 @@ export declare class SessionService {
         userAgent?: string;
         ip?: string;
     }): Promise<IssuedSession>;
+    /**
+     * The org a new session starts in: the account's last chosen one while it is still a member of it
+     * (and the org is not deleted), else its only org when it has exactly one, else none (the web
+     * app then asks to choose or create one).
+     */
+    private startingOrg;
+    /**
+     * Read-only: of several refresh tokens (a cookie header carrying the legacy and the `Path=/`
+     * cookie), the first that is the current token of a live session, if any. Choosing before
+     * rotating keeps a stale token from tripping replay detection on a still valid session.
+     */
+    pickCurrentRefresh(candidates: readonly string[]): Promise<string | undefined>;
     refresh(refreshToken: string, meta: {
         userAgent?: string;
         ip?: string;

package/dist/identity/sessions.js

@@ -72,11 +72,49 @@ let SessionService = class SessionService {
             user_agent: meta.userAgent ?? null,
             ip: meta.ip ?? null,
             expires_at: sql `now() + make_interval(days => ${refreshTtlDays})`,
+            current_org_id: await this.startingOrg(accountId),
         })
             .returning(["expires_at"])
             .executeTakeFirstOrThrow();
         return this.issue(id, accountId, refreshToken, row.expires_at);
     }
+    /**
+     * The org a new session starts in: the account's last chosen one while it is still a member of it
+     * (and the org is not deleted), else its only org when it has exactly one, else none (the web
+     * app then asks to choose or create one).
+     */
+    async startingOrg(accountId) {
+        const orgs = await this.db
+            .selectFrom("memberships as m")
+            .innerJoin("orgs as o", "o.id", "m.org_id")
+            .innerJoin("accounts as a", "a.id", "m.account_id")
+            .select(["m.org_id as orgId", "a.last_org_id as lastOrgId"])
+            .where("m.account_id", "=", accountId)
+            .where("o.deleted_at", "is", null)
+            .execute();
+        const last = orgs.find((o) => o.orgId === o.lastOrgId);
+        if (last)
+            return last.orgId;
+        return orgs.length === 1 ? (orgs[0]?.orgId ?? null) : null;
+    }
+    /**
+     * Read-only: of several refresh tokens (a cookie header carrying the legacy and the `Path=/`
+     * cookie), the first that is the current token of a live session, if any. Choosing before
+     * rotating keeps a stale token from tripping replay detection on a still valid session.
+     */
+    async pickCurrentRefresh(candidates) {
+        if (candidates.length === 0)
+            return undefined;
+        const rows = await this.db
+            .selectFrom("sessions")
+            .select("refresh_hash")
+            .where("refresh_hash", "in", candidates.map((c) => sha256Hex(c)))
+            .where("revoked_at", "is", null)
+            .where("expires_at", ">", sql `now()`)
+            .execute();
+        const live = new Set(rows.map((r) => r.refresh_hash));
+        return candidates.find((c) => live.has(sha256Hex(c)));
+    }
     async refresh(refreshToken, meta) {
         const oldHash = sha256Hex(refreshToken);
         const next = newRefreshToken();
@@ -277,6 +315,13 @@ let SessionService = class SessionService {
                 .executeTakeFirst());
         if (!m)
             throw new ApiError("org.not_found", "Organization not found");
+        // remembered for the next sign-in; the account row before the session row, the order a
+        // password change takes (account, then its sessions)
+        await this.db
+            .updateTable("accounts")
+            .set({ last_org_id: orgId })
+            .where("id", "=", accountId)
+            .execute();
         const r = await this.db
             .updateTable("sessions")
             .set({ current_org_id: orgId })

package/dist/index.d.ts

@@ -31,7 +31,7 @@ export { type ApprovalDecision, ExtensionApprovals, type PendingExtension, type
 export { blobKey, ExtensionBlobIntegrityError, type ExtensionBlobSource, ExtensionBlobs, } from "./extensions/blobs.js";
 export { BOOTSTRAP_MANIFEST_FILE, type BootstrapEntryResult, BootstrapFailedError, type BootstrapFailure, type BootstrapResolveOptions, type BootstrapResult, BootstrapService, bootstrapManifestSha256, readBootstrapManifest, resolveBootstrapPackages, } from "./extensions/bootstrap.js";
 export { type ExtensionCli, openExtensionCli } from "./extensions/cli.js";
-export { DEPLOYMENT_SECRETS_ORG, type DeploymentConfigField, type DeploymentConfigView, ExtensionDeploymentConfigService, mergeDeploymentConfig, PLUGIN_DEPLOYMENT_CONFIG_TOPIC, readStoredDeploymentConfig, } from "./extensions/deployment-config.js";
+export { DEPLOYMENT_SECRETS_ORG, type DeploymentConfigField, type DeploymentConfigView, ExtensionDeploymentConfigService, mergeDeploymentConfig, PLUGIN_DEPLOYMENT_CONFIG_TOPIC, readStoredDeploymentConfig, type SecretEntry, } from "./extensions/deployment-config.js";
 export { assertSecretsReachable, ExtensionHost, type ExtensionLoadPlan, type InspectedExtension, type InstalledExtensionLoader, type InstallFailureReason, } from "./extensions/host.js";
 export { ExtensionUnloadedError, type InflightEntry, InflightTracker, PLUGIN_UNLOADED_TOOL_ERROR, type TrackOptions, trackCalls, } from "./extensions/inflight.js";
 export { type DesiredExtension, type ExtensionInstallRow, ExtensionInstalls, type IngestSource, type PackageReview, } from "./extensions/installs.js";

package/dist/infra/config/kernel-config.service.js

@@ -34,6 +34,12 @@ const HOT_APPLIERS = {
     "subagents.maxConcurrentPerRun": () => { },
     "subagents.maxDispatchesPerRun": () => { },
     "subagents.maxTokensPerRun": () => { },
+    // The web tools read these limits through the config service on every call.
+    "web.search.maxResults": () => { },
+    "web.fetch.maxPageChars": () => { },
+    "web.fetch.maxAnswerTokens": () => { },
+    "web.fetch.cacheSeconds": () => { },
+    "web.fetch.timeoutMs": () => { },
 };
 const HOT_PATHS = configFields(KernelConfigSchema)
     .filter((f) => f.meta?.hot)

package/dist/infra/database/database.module.js

@@ -66,6 +66,7 @@ let DatabaseModule = class DatabaseModule {
                     const { db } = config.get();
                     return createDb(db.url, db.poolMax, (err) => log.error("pg idle client error", { err }), {
                         connectTimeoutMs: db.connectTimeoutMs,
+                        idleTimeoutMs: db.idleTimeoutMs,
                         onClientError: (err) => log.warn("pg client error", { err }),
                     });
                 },

package/dist/infra/events/kernel-events.d.ts

@@ -78,6 +78,14 @@ export interface KernelEventMap {
     "run.orphaned": {
         runId: string;
     };
+    /**
+     * A background task of the conversation finished (after the commit of its
+     * `background_task_finished` event). `BackgroundWake` asks the run queue for a wake run; a lost
+     * event is re-derived by the next `ensureRun` (a message, the end of a run, a page opening).
+     */
+    "background_task.finished": {
+        conversationId: string;
+    };
 }
 type Handler<K extends keyof KernelEventMap> = (payload: KernelEventMap[K]) => Promise<void> | void;
 /** Typed in-process event emitter; handlers run in order, a failing one is logged and skipped. */

package/dist/infra/lifecycle/process-guards.js

@@ -39,6 +39,10 @@ export function createFatalRecorder(deps) {
     let recent = [];
     let open = false;
     return (kind, err) => {
+        // Exiting already: log nothing more. A failing log write (EPIPE on a dead stdout) raises the
+        // next event itself; logging it again would keep the process busy forever and starve the exit.
+        if (open)
+            return;
         try {
             const t = now();
             recent = recent.filter((x) => t - x < GUARD_CIRCUIT_WINDOW_MS);

package/dist/infra/logging/logging.module.d.ts

@@ -6,8 +6,10 @@ export interface LoggingModuleOptions {
     logger?: KernelLogger;
 }
 /**
- * Provides the process logger as `KERNEL_LOGGER`. The logger is created before the Nest context
- * (it must exist for startup errors), so it is passed in or derived from the startup config here.
+ * Provides the process logger as `KERNEL_ROOT_LOGGER` and, as `KERNEL_LOGGER`, one child per injecting
+ * class with `context` = the class name (the `[context=…]` of the pretty output; octok's
+ * per-class Nest logger context). The logger is created before the Nest context (it must exist for
+ * startup errors), so it is passed in or derived from the startup config here.
  */
 export declare class LoggingModule {
     static forRoot(config: KernelConfig, opts?: LoggingModuleOptions): DynamicModule;

package/dist/infra/logging/logging.module.js

@@ -5,12 +5,15 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var LoggingModule_1;
-import { Global, Module } from "@nestjs/common";
+import { Global, Module, Scope } from "@nestjs/common";
+import { INQUIRER } from "@nestjs/core";
 import { createConfiguredLogger } from "../../log-config.js";
-import { KERNEL_LOGGER } from "../tokens.js";
+import { KERNEL_LOGGER, KERNEL_ROOT_LOGGER } from "../tokens.js";
 /**
- * Provides the process logger as `KERNEL_LOGGER`. The logger is created before the Nest context
- * (it must exist for startup errors), so it is passed in or derived from the startup config here.
+ * Provides the process logger as `KERNEL_ROOT_LOGGER` and, as `KERNEL_LOGGER`, one child per injecting
+ * class with `context` = the class name (the `[context=…]` of the pretty output; octok's
+ * per-class Nest logger context). The logger is created before the Nest context (it must exist for
+ * startup errors), so it is passed in or derived from the startup config here.
  */
 let LoggingModule = LoggingModule_1 = class LoggingModule {
     static forRoot(config, opts = {}) {
@@ -21,8 +24,16 @@ let LoggingModule = LoggingModule_1 = class LoggingModule {
         return {
             module: LoggingModule_1,
             global: true,
-            providers: [{ provide: KERNEL_LOGGER, useValue: logger }],
-            exports: [KERNEL_LOGGER],
+            providers: [
+                { provide: KERNEL_ROOT_LOGGER, useValue: logger },
+                {
+                    provide: KERNEL_LOGGER,
+                    scope: Scope.TRANSIENT,
+                    inject: [KERNEL_ROOT_LOGGER, INQUIRER],
+                    useFactory: (root, inquirer) => contextLogger(root, inquirer),
+                },
+            ],
+            exports: [KERNEL_ROOT_LOGGER, KERNEL_LOGGER],
         };
     }
 };
@@ -32,3 +43,10 @@ LoggingModule = LoggingModule_1 = __decorate([
     // biome-ignore lint/complexity/noStaticOnlyClass: a Nest dynamic module
 ], LoggingModule);
 export { LoggingModule };
+/** The child of `root` for the class instance `inquirer`; `root` itself for a factory provider. */
+function contextLogger(root, inquirer) {
+    const name = inquirer?.constructor?.name;
+    return typeof name === "string" && name !== "" && name !== "Object"
+        ? root.child({ context: name })
+        : root;
+}

package/dist/infra/queue/redis-connection.d.ts

@@ -1,4 +1,10 @@
 import type { RedisOptions } from "bullmq";
+/**
+ * TCP keepalive of every long-lived kernel Redis connection: probes start after 10 s idle (the OS
+ * default is 2 hours), so a connection a dropped network left half-open is found and reconnected
+ * before a command waits on it, not at the next write (EPIPE).
+ */
+export declare const REDIS_KEEPALIVE_MS = 10000;
 /**
  * BullMQ connection options from the kernel's Redis URL, the same connection the hand-made
  * `new Redis(url, { maxRetriesPerRequest: null })` workers use: BullMQ requires

package/dist/infra/queue/redis-connection.js

@@ -1,3 +1,9 @@
+/**
+ * TCP keepalive of every long-lived kernel Redis connection: probes start after 10 s idle (the OS
+ * default is 2 hours), so a connection a dropped network left half-open is found and reconnected
+ * before a command waits on it, not at the next write (EPIPE).
+ */
+export const REDIS_KEEPALIVE_MS = 10_000;
 /**
  * BullMQ connection options from the kernel's Redis URL, the same connection the hand-made
  * `new Redis(url, { maxRetriesPerRequest: null })` workers use: BullMQ requires
@@ -14,5 +20,6 @@ export function bullConnectionOptions(url) {
         ...(db !== undefined && Number.isInteger(db) && { db }),
         ...(u.protocol === "rediss:" && { tls: {} }),
         maxRetriesPerRequest: null,
+        keepAlive: REDIS_KEEPALIVE_MS,
     };
 }

package/dist/infra/redis/redis.module.js

@@ -14,6 +14,7 @@ import { closeWithin } from "../close-within.js";
 import { KernelConfigService } from "../config/kernel-config.service.js";
 import { GracefulShutdownModule } from "../lifecycle/graceful-shutdown.module.js";
 import { GracefulShutdown } from "../lifecycle/graceful-shutdown.service.js";
+import { REDIS_KEEPALIVE_MS } from "../queue/redis-connection.js";
 import { KERNEL_BUS, KERNEL_LOGGER, REDIS, REDIS_SUBSCRIBER } from "../tokens.js";
 /**
  * Closes the bus subscriber, then the main connection, at the end of the shutdown
@@ -64,7 +65,10 @@ RedisModule = __decorate([
                 provide: REDIS,
                 inject: [KernelConfigService, KERNEL_LOGGER],
                 useFactory: (config, log) => {
-                    const redis = new Redis(config.get().redis.url, { lazyConnect: true });
+                    const redis = new Redis(config.get().redis.url, {
+                        lazyConnect: true,
+                        keepAlive: REDIS_KEEPALIVE_MS,
+                    });
                     redis.on("error", (err) => log.error("redis connection error", { err }));
                     return redis;
                 },
@@ -72,7 +76,7 @@ RedisModule = __decorate([
             {
                 provide: REDIS_SUBSCRIBER,
                 inject: [KernelConfigService, KERNEL_LOGGER],
-                useFactory: (config, log) => createBusSubscriber(() => new Redis(config.get().redis.url), log),
+                useFactory: (config, log) => createBusSubscriber(() => new Redis(config.get().redis.url, { keepAlive: REDIS_KEEPALIVE_MS }), log),
             },
             {
                 provide: KERNEL_BUS,

package/dist/infra/tokens.d.ts

@@ -1,6 +1,11 @@
 /** Injection tokens of the global infra modules. */
-/** The process logger (`KernelLogger`). */
+/**
+ * A class's logger (`KernelLogger`): the process logger with `context` set to the injecting class's
+ * name. Transient, so `app.get` cannot resolve it; use `KERNEL_ROOT_LOGGER` outside an injection.
+ */
 export declare const KERNEL_LOGGER: unique symbol;
+/** The process logger itself (`KernelLogger`), without a context. */
+export declare const KERNEL_ROOT_LOGGER: unique symbol;
 /** The startup input of `KernelConfigService`: `{ config, env }`. */
 export declare const KERNEL_CONFIG_INPUT: unique symbol;
 /** The Kysely pool, untyped (`Kysely<any>`); infra only, services inject `KernelDb`. */

package/dist/infra/tokens.js

@@ -1,6 +1,11 @@
 /** Injection tokens of the global infra modules. */
-/** The process logger (`KernelLogger`). */
+/**
+ * A class's logger (`KernelLogger`): the process logger with `context` set to the injecting class's
+ * name. Transient, so `app.get` cannot resolve it; use `KERNEL_ROOT_LOGGER` outside an injection.
+ */
 export const KERNEL_LOGGER = Symbol("KERNEL_LOGGER");
+/** The process logger itself (`KernelLogger`), without a context. */
+export const KERNEL_ROOT_LOGGER = Symbol("KERNEL_ROOT_LOGGER");
 /** The startup input of `KernelConfigService`: `{ config, env }`. */
 export const KERNEL_CONFIG_INPUT = Symbol("KERNEL_CONFIG_INPUT");
 /** The Kysely pool, untyped (`Kysely<any>`); infra only, services inject `KernelDb`. */

package/dist/log.d.ts

@@ -30,6 +30,11 @@ export interface KernelLogger extends Logger {
     redact(text: string): string;
     /** Waits until buffered records reached every output (Loki); never rejects. Call before exit. */
     flush(): Promise<void>;
+    /**
+     * A logger that adds `fields` to every record (e.g. `{ context: "RunWorker" }`); call fields cannot
+     * overwrite them. It shares everything else with this logger: level, secrets, outputs.
+     */
+    child(fields: Record<string, string>): KernelLogger;
 }
 /**
  * 用与 logger 相同的匹配器打码任意文本（工具结果等不经过日志的内容用）：展开规则同 `addOrgSecrets`
@@ -37,13 +42,15 @@ export interface KernelLogger extends Logger {
  * 不得小于匹配器的分桶前缀长度 4）。没有可用的值时原样返回。
  */
 export declare function createRedactor(values: readonly unknown[], minLength?: number): (s: string) => string;
-/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+/** Console format: `pretty` (pino-pretty), `json`, or `auto` (pretty on a TTY). */
 export declare const LOG_FORMATS: readonly ["auto", "pretty", "json"];
 /** Console format. */
 export type LogFormat = (typeof LOG_FORMATS)[number];
 /** A minimal writable the console output goes to (`process.stdout` by default). */
 export interface LogOutput {
     write(chunk: string): unknown;
+    /** A stream's `error` event (EPIPE when its reader is gone). */
+    on?(event: "error", listener: (err: unknown) => void): unknown;
 }
 /** Options of {@link createLogger}. */
 export interface LoggerOptions {
@@ -58,6 +65,11 @@ export interface LoggerOptions {
     out?: LogOutput;
     /** Whether the console is a terminal (picks `auto` and colors); default `process.stdout.isTTY`. */
     isTTY?: boolean;
+    /**
+     * Pretty output in colors; default: `FORCE_COLOR` (set and not `0`) turns them on, `NO_COLOR` off,
+     * else a TTY. `pnpm dev:kernel` forces them, since its output goes through `tee`.
+     */
+    colors?: boolean;
     /** Also push every record to Loki. */
     loki?: LokiOptions;
     /** Fields on every record (e.g. `role`); log calls cannot overwrite them. */

package/dist/log.js

@@ -105,15 +105,16 @@ function expandSecret(value) {
     }
     return out;
 }
-/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+/** Console format: `pretty` (pino-pretty), `json`, or `auto` (pretty on a TTY). */
 export const LOG_FORMATS = ["auto", "pretty", "json"];
-/** Fields shown in the pretty prefix instead of the trailing object, in this order. */
-const PREFIX_FIELDS = ["reqId", "traceId", "jobId", "runId", "plugin"];
-/** pino-pretty's message format: `[role] [reqId=…] [plugin=…] msg`, each part only when present. */
+/** Fields shown in the pretty prefix instead of the lines below, in this order. */
+const PREFIX_FIELDS = ["traceId", "reqId", "queue", "jobId", "runId", "context", "plugin"];
+/**
+ * pino-pretty's message format, the octok layout:
+ * `[pid=…] - [traceId=…] [reqId=…] [context=…] msg`, each bracket only when present.
+ */
 function prettyMessage(log, messageKey) {
-    const parts = [];
-    if (typeof log.role === "string")
-        parts.push(`[${log.role}]`);
+    const parts = [`[pid=${process.pid}] -`];
     for (const k of PREFIX_FIELDS) {
         const v = log[k];
         if (typeof v === "string" || typeof v === "number")
@@ -122,6 +123,24 @@ function prettyMessage(log, messageKey) {
     parts.push(String(log[messageKey] ?? ""));
     return parts.join(" ");
 }
+/** The HTTP access record (`http/app.ts`) as one sentence: method, path, status and duration. */
+function foldAccessLine(log) {
+    if (log.msg !== "request" || typeof log.method !== "string" || typeof log.url !== "string") {
+        return log;
+    }
+    const { method, url, status, ms, ...rest } = log;
+    return { ...rest, msg: `${method} ${url} ${status} ${ms}ms` };
+}
+function colorsOn(opts, isTTY) {
+    if (opts.colors !== undefined)
+        return opts.colors;
+    const force = process.env.FORCE_COLOR;
+    if (force !== undefined && force !== "0")
+        return true;
+    if (process.env.NO_COLOR)
+        return false;
+    return isTTY;
+}
 function consoleStream(opts) {
     if (opts.write) {
         const write = opts.write;
@@ -132,23 +151,50 @@ function consoleStream(opts) {
     if (!LOG_FORMATS.includes(format)) {
         throw new Error(`invalid log.format "${format}" (expected ${LOG_FORMATS.join(", ")})`);
     }
-    const out = opts.out ?? process.stdout;
+    const target = opts.out ?? process.stdout;
+    // A console whose reader is gone (the `tee` of `pnpm dev:kernel` stopped by Ctrl-C, a closed
+    // pipe) fails every write with EPIPE. Unhandled, each failure is an uncaught exception the
+    // process guard logs, which writes again: an endless chain that starves the event loop. So the
+    // first stream error ends console output for good (Loki, when configured, still gets records).
+    let broken = false;
+    target.on?.("error", () => {
+        broken = true;
+    });
+    const out = {
+        write: (s) => {
+            if (!broken)
+                target.write(s);
+        },
+    };
     const isTTY = opts.isTTY ?? process.stdout.isTTY === true;
     const pretty = format === "pretty" || (format === "auto" && isTTY);
     if (!pretty)
         return { write: (s) => out.write(s) };
-    // In process (no worker thread): pino-pretty formats each line synchronously.
+    const colors = colorsOn(opts, isTTY);
+    // In process (no worker thread): pino-pretty formats each record synchronously. The layout follows
+    // octok's buildPinoPrettyOptions: full local time, colored level, the bracket prefix, and
+    // the remaining fields as indented `key: value` lines below the message (errors with their stack).
     const format_ = prettyFactory({
-        colorize: isTTY,
-        colorizeObjects: isTTY,
-        singleLine: true,
-        // errors stay inside the one-line object instead of a multi-line stack block
-        errorLikeObjectKeys: [],
-        translateTime: "SYS:HH:MM:ss.l",
+        colorize: colors,
+        colorizeObjects: colors,
+        singleLine: false,
+        translateTime: "SYS:standard",
         ignore: ["pid", "hostname", "role", "spanId", ...PREFIX_FIELDS].join(","),
         messageFormat: (log, messageKey) => prettyMessage(log, messageKey),
     });
-    return { write: (s) => out.write(format_(s)) };
+    return {
+        write: (s) => {
+            let record;
+            try {
+                record = JSON.parse(s);
+            }
+            catch {
+                out.write(s);
+                return;
+            }
+            out.write(format_(foldAccessLine(record)));
+        },
+    };
 }
 /**
  * Creates the kernel logger on pino. Each record is `{ time, level, msg, ...base, ...fields }` with
@@ -254,7 +300,7 @@ export function createLogger(level = "info", opts = {}) {
         }
         sink[lvl](obj, redactMsg(msg));
     };
-    return {
+    const root = {
         debug: (msg, fields) => emit("debug", msg, fields),
         info: (msg, fields) => emit("info", msg, fields),
         warn: (msg, fields) => emit("warn", msg, fields),
@@ -299,5 +345,35 @@ export function createLogger(level = "info", opts = {}) {
                 }
             }
         },
+        // a method, so a wrapper of this logger (a test proxy) is the parent its children forward to
+        child(fields) {
+            return childLogger(this, fields);
+        },
+    };
+    return root;
+}
+/**
+ * A logger that adds `bound` to every record and forwards it to `parent`'s public methods (so a spy
+ * on the parent sees its children's records); call fields cannot overwrite the bound ones.
+ */
+function childLogger(parent, bound) {
+    const merged = (fields) => ({ ...fields, ...bound });
+    const child = {
+        debug: (msg, fields) => parent.debug(msg, merged(fields)),
+        info: (msg, fields) => parent.info(msg, merged(fields)),
+        warn: (msg, fields) => parent.warn(msg, merged(fields)),
+        error: (msg, fields) => parent.error(msg, merged(fields)),
+        get level() {
+            return parent.level;
+        },
+        setLevel: (level) => parent.setLevel(level),
+        addSecrets: (values) => parent.addSecrets(values),
+        addOrgSecrets: (values) => parent.addOrgSecrets(values),
+        redact: (text) => parent.redact(text),
+        flush: () => parent.flush(),
+        child(fields) {
+            return childLogger(this, fields);
+        },
     };
+    return child;
 }

package/dist/models/purposes.d.ts

@@ -35,6 +35,13 @@ export declare const KERNEL_PURPOSES: readonly [{
         readonly zh: "会话标题";
         readonly en: "Conversation titles";
     };
+}, {
+    readonly purpose: "web_fetch";
+    readonly kind: "chat";
+    readonly label: {
+        readonly zh: "网页提取";
+        readonly en: "Web page extraction";
+    };
 }, {
     readonly purpose: "subagent_fast";
     readonly kind: "chat";
@@ -140,6 +147,19 @@ export declare class ModelPurposesService {
     setOrg(orgId: string, purpose: string, target: PurposeTarget | null, actor: string, actorTokenId?: string): Promise<PurposeView>;
     /** 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。 */
     resolve(orgId: string, purpose: string): Promise<PurposeTarget>;
+    /** The target a {@link chat} call on `purpose` uses: the mapping, else `fallback` when unmapped. */
+    private chatTarget;
+    /**
+     * The limits of the model a {@link chat} call on `purpose` would use now (the same mapping and
+     * `fallback` rule): its context window and output cap, so a caller can size its request (e.g.
+     * the `WebFetch` page) before the call. Fails as `chat` does before sending.
+     */
+    chatLimits(orgId: string, purpose: string, opts?: {
+        fallback?: PurposeTarget;
+    }): Promise<{
+        contextWindow: number;
+        maxOutputTokens: number;
+    }>;
     /**
      * 按用途发一次对话请求：解析映射、按目标模型的声明宽松处理参数（补默认值，与运行时一致），用 `consumeModelStream`
      * 收完（只有流空闲看门狗）。输出上限取 `min(req.maxOutputTokens, 目标模型的 maxOutputTokens)`。
@@ -147,10 +167,13 @@ export declare class ModelPurposesService {
      * `opts.fallback`: the target used when the purpose is not mapped (`model.unconfigured`).
      * `opts.beforeSend`: called with the resolved target and the final request just before sending;
      * what it throws is thrown as is (a pre-send failure, e.g. a denied `model.request` hook).
+     * `opts.paramDefaults`: values for parameters the target does not set, kept only where the
+     * target model declares the key and the value fits it (e.g. `thinking: "off"` for a short call).
      */
     chat(orgId: string, purpose: string, req: Omit<ModelRequest, "model" | "params">, signal: AbortSignal, opts?: {
         fallback?: PurposeTarget;
         beforeSend?: (target: ModelRef, request: ModelRequest) => Promise<void>;
+        paramDefaults?: Record<string, ParamValue>;
     }): Promise<{
         content: ContentBlock[];
         stopReason: StopReason;