@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.4

package/dist/models/purposes.js

@@ -41,6 +41,11 @@ export const KERNEL_PURPOSES = [
     { purpose: "eval", kind: "chat", label: { zh: "评测评委", en: "Eval judge" } },
     /** Conversation titles (UI refresh B); unmapped → the conversation's current chat model. */
     { purpose: "title", kind: "chat", label: { zh: "会话标题", en: "Conversation titles" } },
+    /**
+     * The `WebFetch` extraction call (web tools spec §5); unmapped → the calling conversation's
+     * current chat model (a sub-agent's call: the sub-agent's).
+     */
+    { purpose: "web_fetch", kind: "chat", label: { zh: "网页提取", en: "Web page extraction" } },
     {
         purpose: "subagent_fast",
         kind: "chat",
@@ -254,6 +259,27 @@ let ModelPurposesService = class ModelPurposesService {
         }
         return view.effective;
     }
+    /** The target a {@link chat} call on `purpose` uses: the mapping, else `fallback` when unmapped. */
+    async chatTarget(orgId, purpose, fallback) {
+        try {
+            return await this.resolve(orgId, purpose);
+        }
+        catch (e) {
+            if (!(e instanceof ApiError && e.code === "model.unconfigured") || !fallback)
+                throw e;
+            return fallback;
+        }
+    }
+    /**
+     * The limits of the model a {@link chat} call on `purpose` would use now (the same mapping and
+     * `fallback` rule): its context window and output cap, so a caller can size its request (e.g.
+     * the `WebFetch` page) before the call. Fails as `chat` does before sending.
+     */
+    async chatLimits(orgId, purpose, opts = {}) {
+        const target = await this.chatTarget(orgId, purpose, opts.fallback);
+        const { info } = await this.providers.resolve(target.model);
+        return { contextWindow: info.contextWindow, maxOutputTokens: info.maxOutputTokens };
+    }
     /**
      * 按用途发一次对话请求：解析映射、按目标模型的声明宽松处理参数（补默认值，与运行时一致），用 `consumeModelStream`
      * 收完（只有流空闲看门狗）。输出上限取 `min(req.maxOutputTokens, 目标模型的 maxOutputTokens)`。
@@ -261,22 +287,17 @@ let ModelPurposesService = class ModelPurposesService {
      * `opts.fallback`: the target used when the purpose is not mapped (`model.unconfigured`).
      * `opts.beforeSend`: called with the resolved target and the final request just before sending;
      * what it throws is thrown as is (a pre-send failure, e.g. a denied `model.request` hook).
+     * `opts.paramDefaults`: values for parameters the target does not set, kept only where the
+     * target model declares the key and the value fits it (e.g. `thinking: "off"` for a short call).
      */
     async chat(orgId, purpose, req, signal, opts = {}) {
-        let target;
-        try {
-            target = await this.resolve(orgId, purpose);
-        }
-        catch (e) {
-            if (!(e instanceof ApiError && e.code === "model.unconfigured") || !opts.fallback)
-                throw e;
-            target = opts.fallback;
-        }
+        const target = await this.chatTarget(orgId, purpose, opts.fallback);
         const { provider, info } = await this.providers.resolve(target.model);
         const request = {
             ...req,
             model: info.id,
-            params: sanitizeParams(info.parameters, target.params).value,
+            // undeclared or unfitting defaults are dropped like any other parameter
+            params: sanitizeParams(info.parameters, { ...opts.paramDefaults, ...target.params }).value,
             // 输出上限不超过目标模型自己的上限（与运行时 assembleModelRequest 一致）
             maxOutputTokens: Math.min(req.maxOutputTokens, info.maxOutputTokens),
         };

package/dist/orgs/offboarding.d.ts

@@ -83,7 +83,9 @@ export declare class Offboarding {
      * In the caller's transaction (`mandatory`: the caller holds the org row lock, order org row →
      * membership, and did the "last owner" checks)：
      * 1. 删除成员关系（非成员 → `member.not_found`；删后组织没有 owner → `org.last_owner`），清空指向该组织的会话当前组织；
-     * 2. 吊销该账号**全部**会话与个人令牌（令牌与会话是账号级的，无法只吊销「该组织下」的，按保守处理）；
+     * 2. Removal and directory offboarding revoke **every** session and personal token of the
+     *    account (both are account-wide, so conservatively all); a person who leaves (`left`) keeps
+     *    them, and the session's current org is cleared (the membership check ends the access);
      * 3. 删除其在该组织所有连接器上的个人凭据；
      * 4. 取消其作为处理人的 pending 审批与提问（写 cancelled 事件），记下此人在该组织进行中的运行（提交后中止）；
      * 5. 其负责的该组织 agent 转给组织所有者（最早加入的 owner）并置 `needs_reassignment = true`；

package/dist/orgs/offboarding.js

@@ -83,7 +83,9 @@ let Offboarding = class Offboarding {
      * In the caller's transaction (`mandatory`: the caller holds the org row lock, order org row →
      * membership, and did the "last owner" checks)：
      * 1. 删除成员关系（非成员 → `member.not_found`；删后组织没有 owner → `org.last_owner`），清空指向该组织的会话当前组织；
-     * 2. 吊销该账号**全部**会话与个人令牌（令牌与会话是账号级的，无法只吊销「该组织下」的，按保守处理）；
+     * 2. Removal and directory offboarding revoke **every** session and personal token of the
+     *    account (both are account-wide, so conservatively all); a person who leaves (`left`) keeps
+     *    them, and the session's current org is cleared (the membership check ends the access);
      * 3. 删除其在该组织所有连接器上的个人凭据；
      * 4. 取消其作为处理人的 pending 审批与提问（写 cancelled 事件），记下此人在该组织进行中的运行（提交后中止）；
      * 5. 其负责的该组织 agent 转给组织所有者（最早加入的 owner）并置 `needs_reassignment = true`；
@@ -150,21 +152,29 @@ let Offboarding = class Offboarding {
             .where("account_id", "=", accountId)
             .where("current_org_id", "=", orgId)
             .execute();
-        const sessions = await this.db
-            .updateTable("sessions")
-            .set({ revoked_at: sql `now()` })
-            .where("account_id", "=", accountId)
-            .where("revoked_at", "is", null)
-            .returning("id")
-            .execute();
-        const tokens = await this.db
-            .updateTable("api_tokens")
-            .set({ revoked_at: sql `now()` })
-            .where("kind", "=", "personal")
-            .where("account_id", "=", accountId)
-            .where("revoked_at", "is", null)
-            .returning("id")
-            .execute();
+        // A person who leaves keeps their sign-in and personal tokens: the org guard reads the
+        // membership on every request, so access to this org ends with the row above, and their other
+        // orgs keep working. Removal and directory offboarding revoke both (account-wide, conservative).
+        const revoke = reason !== "left";
+        const sessions = revoke
+            ? await this.db
+                .updateTable("sessions")
+                .set({ revoked_at: sql `now()` })
+                .where("account_id", "=", accountId)
+                .where("revoked_at", "is", null)
+                .returning("id")
+                .execute()
+            : [];
+        const tokens = revoke
+            ? await this.db
+                .updateTable("api_tokens")
+                .set({ revoked_at: sql `now()` })
+                .where("kind", "=", "personal")
+                .where("account_id", "=", accountId)
+                .where("revoked_at", "is", null)
+                .returning("id")
+                .execute()
+            : [];
         // in this transaction (the approvals and questions services join it: `mandatory`)
         const credentials = await this.credentials.clearAccount(orgId, accountId);
         const approvals = await this.approvals.cancelPendingFor(orgId, accountId);

package/dist/orgs/settings.service.d.ts

@@ -12,6 +12,7 @@ import { OrgLock } from "./org-lock.js";
  * - `locale`：组织默认语言（`zh` / `en`，默认 en），机器人在 IM 里说的固定话术按它选择。
  * - `sandboxToolPolicy`：沙箱工具的默认策略（M5 T8，默认 allow）。为 `ask` 时除只读的
  *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
+ * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
  *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
  */
@@ -49,6 +50,7 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         }>;
         allowHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    wakeOnBackgroundTask: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strip>;
 export type OrgSettings = z.infer<typeof OrgSettingsSchema>;
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
@@ -65,6 +67,7 @@ export declare const OrgSettingsPatchSchema: z.ZodObject<{
         allow: "allow";
         ask: "ask";
     }>>;
+    wakeOnBackgroundTask: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
     sandboxEgress: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         mode: z.ZodEnum<{
             allowlist: "allowlist";
@@ -81,6 +84,8 @@ export type DeploymentEgress = Pick<SandboxLimits, "egress" | "allowHosts">;
  * （省略时用部署的），但部署是 `none` 时仍为 `none`（组织永远不比部署放得更开，部署改成 none 后存量设置也随之收紧）。
  */
 export declare function effectiveSandboxEgress(deployment: DeploymentEgress, org: SandboxEgressSetting | undefined): DeploymentEgress;
+/** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
+export declare function effectiveWakeOnBackgroundTask(deployment: boolean, org: OrgSettings["wakeOnBackgroundTask"]): boolean;
 /**
  * 组织实际生效的沙箱限额（C19 / Ruling M16）：企业管理员的覆盖（部署设置 `sandboxLimitOverrides[orgId]`）
  * 给出的 cpu / memoryMb 替换部署默认，未给的项、disk 与出站沿用 `deployment`。只在创建沙箱时读取。

package/dist/orgs/settings.service.js

@@ -25,6 +25,7 @@ import { OrgLock } from "./org-lock.js";
  * - `locale`：组织默认语言（`zh` / `en`，默认 en），机器人在 IM 里说的固定话术按它选择。
  * - `sandboxToolPolicy`：沙箱工具的默认策略（M5 T8，默认 allow）。为 `ask` 时除只读的
  *   `Read` / `Glob` / `Grep` 外都需要审批（执行时实时读取）。
+ * - `wakeOnBackgroundTask`：组织对 `runtime.wakeOnBackgroundTask` 的覆盖（缺省跟随部署），见 {@link effectiveWakeOnBackgroundTask}。
  * - `sandboxEgress`：组织的沙箱出站（Ruling M19 / D6），缺省跟随部署的 `sandbox.limits.egress` + `allowHosts`。
  *   见 {@link effectiveSandboxEgress}。存量值非法时按 `none` 读（宁可断网，不悄悄放宽到部署默认）。
  */
@@ -58,6 +59,8 @@ export const OrgSettingsSchema = z.object({
     locale: z.enum(["zh", "en"]).default("en").catch("en"),
     sandboxToolPolicy: z.enum(["allow", "ask"]).default("allow").catch("allow"),
     sandboxEgress: SandboxEgressSettingSchema.optional().catch({ mode: "none" }),
+    /** Overrides `runtime.wakeOnBackgroundTask`; absent follows the deployment. */
+    wakeOnBackgroundTask: z.boolean().optional().catch(undefined),
 });
 /** PATCH 体：只改给出的字段；未知字段 → 400。 */
 export const OrgSettingsPatchSchema = z
@@ -65,6 +68,8 @@ export const OrgSettingsPatchSchema = z
     toolSearch: z.enum(["on", "off"]).optional(),
     locale: z.enum(["zh", "en"]).optional(),
     sandboxToolPolicy: z.enum(["allow", "ask"]).optional(),
+    /** null clears (follow the deployment again). */
+    wakeOnBackgroundTask: z.boolean().nullable().optional(),
     /** null 清除（恢复跟随部署默认）。 */
     sandboxEgress: SandboxEgressSettingSchema.nullable().optional(),
 })
@@ -80,6 +85,10 @@ export function effectiveSandboxEgress(deployment, org) {
         return { egress: "none", allowHosts: [] };
     return { egress: "allowlist", allowHosts: [...(org.allowHosts ?? deployment.allowHosts)] };
 }
+/** Whether a finished background task wakes an idle conversation: the org's setting, else the deployment's. */
+export function effectiveWakeOnBackgroundTask(deployment, org) {
+    return org ?? deployment;
+}
 /**
  * 组织实际生效的沙箱限额（C19 / Ruling M16）：企业管理员的覆盖（部署设置 `sandboxLimitOverrides[orgId]`）
  * 给出的 cpu / memoryMb 替换部署默认，未给的项、disk 与出站沿用 `deployment`。只在创建沙箱时读取。
@@ -169,15 +178,17 @@ let OrgSettingsService = class OrgSettingsService {
         const before = parseOrgSettings(stored);
         const changes = Object.fromEntries(Object.entries(patch)
             .filter(([, v]) => v !== undefined)
-            // null 清除 sandboxEgress：恢复跟随部署默认
+            // null clears sandboxEgress / wakeOnBackgroundTask: follow the deployment default again
             .map(([k, v]) => [k, v === null ? undefined : v]));
         const after = { ...before, ...changes };
         if (after.sandboxEgress === undefined)
             delete after.sandboxEgress;
+        if (after.wakeOnBackgroundTask === undefined)
+            delete after.wakeOnBackgroundTask;
         if (sameSettings(before, after))
             return before;
         // 与存量合并：保留本版本不认识的键（清除的 sandboxEgress 不留在存量里）
-        const { sandboxEgress: _old, ...rest } = stored;
+        const { sandboxEgress: _old, wakeOnBackgroundTask: _oldWake, ...rest } = stored;
         await this.db
             .updateTable("orgs")
             .set({ settings: JSON.stringify({ ...rest, ...after }) })

package/dist/roles/worker.module.js

@@ -6,12 +6,15 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 var WorkerModule_1;
 import { Module } from "@nestjs/common";
+import { BackgroundModule } from "../background/background.module.js";
+import { BackgroundTaskPollJob } from "../background/poll.job.js";
 import { CatalogModule } from "../catalog/catalog.module.js";
 import { CatalogJobs } from "../catalog/jobs.js";
 import { ChannelsModule, ChannelWorkersModule } from "../channels/channels.module.js";
 import { GatewayCheckJob } from "../channels/supervisor.js";
 import { AttachmentsModule } from "../conversations/attachments.module.js";
 import { AttachmentCleanupJob } from "../conversations/attachments.service.js";
+import { EventLogModule } from "../conversations/event-log.js";
 import { TitlesModule } from "../conversations/titles.js";
 import { EvalWorkersModule } from "../evals/evals.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
@@ -59,6 +62,8 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 AttachmentsModule,
                 StorageModule,
                 SandboxModule,
+                BackgroundModule,
+                EventLogModule,
                 ToolsModule,
                 CatalogModule,
                 OrgsModule,
@@ -71,6 +76,7 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 AttachmentCleanupJob,
                 StoragePurgeJob,
                 SandboxSweepJobs,
+                BackgroundTaskPollJob,
                 ToolJobs,
                 CatalogJobs,
                 DirectoryScanJob,

package/dist/runtime/context/build.d.ts

@@ -1,6 +1,6 @@
 import { type ContentBlock, type ModelInfo, type ModelRequest, type ParamValue } from "@capybara-hq/plugin-sdk";
 import type { AgentDefinition } from "../../agents/definition.js";
-import type { ConversationEvent, EventPayload } from "../../conversations/events.js";
+import { type ConversationEvent, type EventPayload } from "../../conversations/events.js";
 import type { ResolvedTool } from "../../tools/registry.js";
 /**
  * 平台行为规范（模型可见，英文）。短而通用（spec 6 原则 5）；不放时间戳、会话 ID 等会变化的内容，
@@ -54,13 +54,14 @@ export interface BuildModelRequestInput {
     model: ModelInfo;
     step: number;
     /**
-     * loop 已吸收到的 user_message seq（R31）。提供时：
-     * - seq 大于它的 user_message 不进请求（运行中途到达、尚未被吸收的插话，由后续步骤吸收或触发下一轮）；
-     * - 每条 user_message 放在**吸收它的那次模型调用**的位置：日志里第一个 `request.absorbedUpToSeq`
+     * loop 已吸收到的位置（R31）：the largest seq of the absorbable events (`user_message` and
+     * `background_task_finished`, {@link isAbsorbable}) the loop took. 提供时：
+     * - seq 大于它的可吸收事件不进请求（运行中途到达、尚未被吸收的插话或后台任务结束，由后续步骤吸收或触发下一轮）；
+     * - 每个可吸收事件放在**吸收它的那次模型调用**的位置：日志里第一个 `request.absorbedUpToSeq`
      *   不小于它的 `model_call` 之前（没有该字段的旧 model_call 视为吸收了它之前的全部消息），
      *   本次请求吸收的放在末尾。于是模型看到的历史只追加（插话不会插到已发送的回复之前），
      *   且请求可由日志 + `model_call` 精确还原。
-     * 不提供时按 seq 原样回放全部 user_message。
+     * 不提供时按 seq 原样回放全部可吸收事件。
      */
     absorbedUpToSeq?: number;
     /**
@@ -231,10 +232,11 @@ export declare function summaryText(summary: string): string;
  * - messages：最近一条摘要（若有）作为首条 user 消息，其后按 seq 回放 `coversUpToSeq` 之后的
  *   `user_message` / `assistant_message`（content 原样，含 opaque；aborted 的也回放；媒体引用按
  *   {@link resolveMedia} 换成 base64 或文字占位）/ `reminder`
- *   （`role: "system"`，放在它所在的位置）；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
+ *   （`role: "system"`，放在它所在的位置）/ `background_task_finished`（`role: "system"`, the text of
+ *   {@link renderBackgroundFinished}, placed like a user_message）；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
  *   （同一步的多个结果合并，按该 assistant 消息里 tool_call 的顺序；找不到对应调用的结果不进请求）。
  *   其他事件不进请求。提供 `absorbedUpToSeq` 时，
- *   尚未被吸收的 user_message 不进请求，运行中途到达的插话放在吸收它的调用处（见 BuildModelRequestInput）。
+ *   尚未被吸收的可吸收事件不进请求，运行中途到达的放在吸收它的调用处（见 BuildModelRequestInput）。
  * 只追加：新事件只会在 messages 末尾追加；唯一的前缀变化来自新的压缩摘要。
  * `step` 与 `agentVersion` 不进请求内容（保证缓存前缀稳定），由调用方写入 `model_call` 事件。
  */

package/dist/runtime/context/build.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import { MEDIA_LIMITS, } from "@capybara-hq/plugin-sdk";
+import { renderBackgroundFinished } from "../../background/render.js";
+import { isAbsorbable, } from "../../conversations/events.js";
 import { catalogText, isAlwaysLoaded } from "../../tools/builtins/tool-search.js";
 import { LEGACY_CATALOG_HEADER, LEGACY_SKILL_TEXTS, usesLegacyToolNames } from "./legacy-text.js";
 import { invokedSkillNames, invokedSkillsText, SKILL_TEXTS, skillsCatalogEvents, snapshotChangeText, snapshotCurrentText, snapshotSystemText, systemSkillsCatalog, } from "./skills.js";
@@ -330,10 +332,11 @@ export function summaryText(summary) {
  * - messages：最近一条摘要（若有）作为首条 user 消息，其后按 seq 回放 `coversUpToSeq` 之后的
  *   `user_message` / `assistant_message`（content 原样，含 opaque；aborted 的也回放；媒体引用按
  *   {@link resolveMedia} 换成 base64 或文字占位）/ `reminder`
- *   （`role: "system"`，放在它所在的位置）；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
+ *   （`role: "system"`，放在它所在的位置）/ `background_task_finished`（`role: "system"`, the text of
+ *   {@link renderBackgroundFinished}, placed like a user_message）；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
  *   （同一步的多个结果合并，按该 assistant 消息里 tool_call 的顺序；找不到对应调用的结果不进请求）。
  *   其他事件不进请求。提供 `absorbedUpToSeq` 时，
- *   尚未被吸收的 user_message 不进请求，运行中途到达的插话放在吸收它的调用处（见 BuildModelRequestInput）。
+ *   尚未被吸收的可吸收事件不进请求，运行中途到达的放在吸收它的调用处（见 BuildModelRequestInput）。
  * 只追加：新事件只会在 messages 末尾追加；唯一的前缀变化来自新的压缩摘要。
  * `step` 与 `agentVersion` 不进请求内容（保证缓存前缀稳定），由调用方写入 `model_call` 事件。
  */
@@ -378,7 +381,7 @@ export function buildModelRequest(input) {
             lastCall = absorbedBy(e);
     }
     /**
-     * 第 i 个事件（user_message）的放置方式：
+     * 第 i 个事件（可吸收事件：user_message / background_task_finished）的放置方式：
      * - `inline`：在吸收它的调用（之后第一个 `absorbedBy ≥ seq` 的 model_call，或本次请求）之前，
      *   没有「由未吸收它的调用生成的回复」→ 按 seq 原位回放（常规情况，与不提供 absorbedUpToSeq 时一致）；
      * - `deferred`：它之后有非空 assistant_message 是由一次没有吸收它的 model_call 生成的（它在那一步
@@ -462,8 +465,12 @@ export function buildModelRequest(input) {
         const blocks = blocksOf(u.payload.content);
         return report === undefined ? blocks : [...blocks, { type: "text", text: report }];
     };
-    /** 被某次模型调用跳过（运行中途到达）、尚未被吸收的 user_message，按 seq 升序。 */
+    /** 被某次模型调用跳过（运行中途到达）、尚未被吸收的可吸收事件，按 seq 升序。 */
     let deferred = [];
+    /** An absorbable event as a request message: a user turn, or a finished task's system text. */
+    const absorbableMessage = (e) => e.type === "user_message"
+        ? { role: "user", content: userBlocks(e) }
+        : { role: "system", content: renderBackgroundFinished(e.payload) };
     /**
      * 把已被吸收（seq ≤ upTo）的延后消息按 seq 顺序放进 messages，插在末尾连续的 system 提醒之前
      * （若有）。这样某一步自己写在 model_call 之前的提醒（含收尾提醒）仍排在它所跟随的用户消息之后，
@@ -477,7 +484,7 @@ export function buildModelRequest(input) {
         let at = messages.length;
         while (at > 0 && messages[at - 1]?.role === "system")
             at--;
-        messages.splice(at, 0, ...ready.map((u) => ({ role: "user", content: userBlocks(u) })));
+        messages.splice(at, 0, ...ready.map(absorbableMessage));
     };
     /** (runId, callId) → 该调用的 tool_result 事件（同一调用只取第一个）。 */
     const results = new Map();
@@ -521,21 +528,22 @@ export function buildModelRequest(input) {
     for (const [i, e] of events.entries()) {
         if (e.seq <= after)
             continue;
+        if (isAbsorbable(e)) {
+            switch (absorbed === undefined ? "inline" : placement(i, e.seq)) {
+                case "inline":
+                    // seq 更小的延后事件被同一次或更早的调用吸收：先放它们，保持发送顺序。
+                    flush(e.seq - 1);
+                    messages.push(absorbableMessage(e));
+                    break;
+                case "deferred":
+                    deferred.push(e);
+                    break;
+                default:
+                    break;
+            }
+            continue;
+        }
         switch (e.type) {
-            case "user_message":
-                switch (absorbed === undefined ? "inline" : placement(i, e.seq)) {
-                    case "inline":
-                        // seq 更小的延后消息被同一次或更早的调用吸收：先放它们，保持用户消息的发送顺序。
-                        flush(e.seq - 1);
-                        messages.push({ role: "user", content: userBlocks(e) });
-                        break;
-                    case "deferred":
-                        deferred.push(e);
-                        break;
-                    default:
-                        break;
-                }
-                break;
             case "model_call":
                 emitRaced(e.payload.request.toSeq);
                 if (absorbed !== undefined)

package/dist/runtime/context/claude-tools.d.ts

@@ -7,6 +7,7 @@
  * tools" instead). Changing it only affects snapshots written afterwards: a conversation's next
  * run writes a new snapshot announcing the new map, and old snapshots keep their text (phase C
  * changed the Task / Agent line, sub-agents spec §16.5; the tool-naming change shortened it to the
- * Claude Code names, spec 2026-10-29 §6).
+ * Claude Code names, spec 2026-10-29 §6; background Bash made TaskOutput and TaskStop available,
+ * spec 2026-11-05 §4.4; WebFetch and WebSearch joined the same-name list with the web tools).
  */
 export declare const CLAUDE_CODE_TOOL_MAP: string;

package/dist/runtime/context/claude-tools.js

@@ -7,17 +7,18 @@
  * tools" instead). Changing it only affects snapshots written afterwards: a conversation's next
  * run writes a new snapshot announcing the new map, and old snapshots keep their text (phase C
  * changed the Task / Agent line, sub-agents spec §16.5; the tool-naming change shortened it to the
- * Claude Code names, spec 2026-10-29 §6).
+ * Claude Code names, spec 2026-10-29 §6; background Bash made TaskOutput and TaskStop available,
+ * spec 2026-11-05 §4.4; WebFetch and WebSearch joined the same-name list with the web tools).
  */
 export const CLAUDE_CODE_TOOL_MAP = [
     "Some skills in this conversation were written for Claude Code. Its tools Bash, Read, Write, Edit,",
-    "Glob, Grep, Skill, AskUserQuestion, ToolSearch and Agent have the same names here, when they are",
+    "Glob, Grep, Skill, AskUserQuestion, ToolSearch, Agent, WebFetch and WebSearch have the same names here, when they are",
     "in your tools. For the others:",
     "- MultiEdit -> several Edit calls",
     "- TodoWrite -> plugin__todo__write when it is in your tools; otherwise keep the task list in your replies",
     "- Task -> Agent; SendMessage to a sub-agent -> Agent with resume; model names haiku / sonnet / opus -> fast / standard / capable",
-    "- TaskOutput, TaskStop -> not available",
-    "- Any other tool a skill names (for example WebFetch, WebSearch, NotebookEdit, EnterWorktree) -> not available unless one of your tools does the same job",
+    "- TaskOutput -> TaskOutput, TaskStop -> TaskStop",
+    "- Any other tool a skill names (for example NotebookEdit, EnterWorktree) -> not available unless one of your tools does the same job",
     // biome-ignore lint/suspicious/noTemplateCurlyInString: the literal Claude Code variable the model reads
     "The sandbox tools exist only when this agent has a sandbox; without them a skill's scripts cannot run. A path such as ${CLAUDE_PLUGIN_ROOT}/skills/<name>/... means /skills/<name>/... after Skill has copied that skill into the sandbox.",
 ].join("\n");

package/dist/runtime/context/compaction.js

@@ -1,3 +1,4 @@
+import { renderBackgroundFinished } from "../../background/render.js";
 import { latestSummary } from "./build.js";
 /** 压缩请求的标记：放在 system 中，便于识别（model-fake 据此返回摘要）。 */
 export const COMPACTION_MARKER = "CAPYBARA_COMPACTION";
@@ -111,6 +112,9 @@ function transcriptLine(e) {
         }
         case "reminder":
             return `System reminder: ${e.payload.text}`;
+        // a finished background task is a system message of the request (build.ts)
+        case "background_task_finished":
+            return `System reminder: ${renderBackgroundFinished(e.payload)}`;
         // phase D: a forked skill's report is user content of the request (build.ts)
         case "skill_fork_result":
             return `User: ${e.payload.text}`;

package/dist/runtime/langgraph-loop.js

@@ -6,7 +6,8 @@ import { isForkInvocation } from "./subagents/skill-fork.js";
 /**
  * 图状态：只记录进度，消息每步从事件日志重建（runModelStep 自己读日志），checkpoint 很小。
  * - `step`：当前（最近一次进入的）步骤编号，prepare 节点 +1；
- * - `consumedUpToSeq`：已吸收的最大 user_message seq；
+ * - `consumedUpToSeq`：已吸收的最大可吸收事件 seq（user_message / background_task_finished; a
+ *   finish TaskOutput or TaskStop already reported is absorbed like any other, rendered short）；
  * - `lastStopReason`：最近一步模型调用的停止原因；
  * - `outcome`：图的结束方式（在决定结束的节点里写入，续跑已结束的图时直接读出，不依赖当前时间）。
  *
@@ -148,7 +149,7 @@ export class LangGraphLoop {
             let consumed = s.consumedUpToSeq;
             // the run's first prepare (also when it runs again after a suspend on its fork's sub-agent)
             const firstStep = s.step === 0;
-            const absorbed = await ctx.pendingUserMessages(consumed);
+            const absorbed = await ctx.pendingAbsorbable(consumed);
             for (const m of absorbed)
                 consumed = Math.max(consumed, m.seq);
             // phase D: a run's own fork invocation is absorbed at step 1 (the run boundary,

package/dist/runtime/loop.d.ts

@@ -1,6 +1,6 @@
 import type { AgentDefinition } from "../agents/definition.js";
 import type { KernelConfig } from "../config/schema.js";
-import type { ConversationEvent } from "../conversations/events.js";
+import type { AbsorbableEvent } from "../conversations/events.js";
 import type { StreamSink } from "./model-call.js";
 /** 一次运行交给 loop 的上下文（spec 4.4）。 */
 export interface LoopContext {
@@ -22,10 +22,11 @@ export interface LoopContext {
     shutdown: AbortSignal;
     sink: StreamSink;
     /**
-     * 下一个步骤间隙要吸收的插话：返回 seq > afterSeq 的 user_message（且只含本轮开始时尚未被消费的，
+     * 下一个步骤间隙要吸收的事件：返回 seq > afterSeq 的可吸收事件（`user_message` 与
+     * `background_task_finished`, `isAbsorbable`；且只含本轮开始时尚未被消费的，
      * 即 seq 也大于会话的 `consumed_seq`），按 seq 升序。loop 记录吸收到的最大 seq 作为 `consumedUpToSeq`。
      */
-    pendingUserMessages(afterSeq: number): Promise<ConversationEvent[]>;
+    pendingAbsorbable(afterSeq: number): Promise<AbsorbableEvent[]>;
     limits: {
         maxSteps: number;
         deadline: number;

package/dist/runtime/maintenance.d.ts

@@ -5,6 +5,7 @@ import type { KernelLogger } from "../log.js";
 import { DirectorySync } from "../orgs/directory-sync.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
 import { ToolDrift } from "../tools/drift.js";
+import { RunQueue } from "./run-queue.js";
 import { Waits } from "./waits.js";
 export { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
 /** The maintenance worker's concurrency (as the hand-made worker had). */
@@ -13,7 +14,7 @@ export declare const MAINTENANCE_CONCURRENCY = 5;
  * The one consumer of `cap-kernel-maintenance` (decision R11 of the Nest kernel spec): dispatches
  * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` →
  * {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
- * {@link DirectorySync}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * {@link DirectorySync}, `bg-wake` → {@link RunQueue.ensureRun}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
  * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
@@ -24,10 +25,11 @@ export declare class MaintenanceProcessor extends WorkerHost<Worker> {
     private readonly sandbox;
     private readonly drift;
     private readonly directory;
+    private readonly runs;
     private readonly scheduled;
     private readonly log;
     private readonly queue;
-    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyFor">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
+    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyFor">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, runs: Pick<RunQueue, "ensureRun">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
     /**
      * Removes the retired job schedulers (`RETIRED_SCHEDULER_IDS`, runtime/retired-schedulers.ts): every fixed-period
      * maintenance job is a `@LockedCron` / `@LockedInterval` now. Idempotent; called once when a

package/dist/runtime/maintenance.js

@@ -9,6 +9,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { getQueueToken, OnWorkerEvent, WorkerHost } from "@nestjs/bullmq";
 import { Inject, Injectable, Module } from "@nestjs/common";
+import { BG_WAKE_JOB } from "../background/wake-rules.js";
 import { configuredProcessor } from "../infra/queue/configured-processor.js";
 import { QueueModule } from "../infra/queue/queue.module.js";
 import { removeRetiredSchedulers } from "../infra/queue/retired-schedulers.js";
@@ -26,6 +27,7 @@ import { DRIFT_CONNECTOR_JOB } from "../tools/job-ids.js";
 import { ToolsModule } from "../tools/tools.module.js";
 import { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
 import { RETIRED_SCHEDULER_IDS } from "./retired-schedulers.js";
+import { RunQueue } from "./run-queue.js";
 import { RuntimeModule } from "./runtime.module.js";
 import { WAIT_TIMEOUT_JOB, Waits } from "./waits.js";
 export { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
@@ -35,7 +37,7 @@ export const MAINTENANCE_CONCURRENCY = 5;
  * The one consumer of `cap-kernel-maintenance` (decision R11 of the Nest kernel spec): dispatches
  * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` →
  * {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
- * {@link DirectorySync}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * {@link DirectorySync}, `bg-wake` → {@link RunQueue.ensureRun}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
  * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
@@ -46,15 +48,17 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
     sandbox;
     drift;
     directory;
+    runs;
     scheduled;
     log;
     queue;
-    constructor(waits, sandbox, drift, directory, scheduled, log, queue) {
+    constructor(waits, sandbox, drift, directory, runs, scheduled, log, queue) {
         super();
         this.waits = waits;
         this.sandbox = sandbox;
         this.drift = drift;
         this.directory = directory;
+        this.runs = runs;
         this.scheduled = scheduled;
         this.log = log;
         this.queue = queue;
@@ -90,6 +94,13 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
             case DIRECTORY_SYNC_JOB:
                 await this.directory.runSyncJob(job.data);
                 return;
+            // the end of a conversation's wake window (background Bash spec §3)
+            case BG_WAKE_JOB: {
+                // fired before the window ended (clock skew): it reschedules under its next retry id
+                const { conversationId, retry } = job.data;
+                await this.runs.ensureRun(conversationId, { wakeRetry: (retry ?? 0) + 1 });
+                return;
+            }
             default:
                 if (await this.scheduled.runNow(job.name))
                     return;
@@ -115,9 +126,10 @@ MaintenanceProcessor = __decorate([
     __param(1, Inject(SandboxService)),
     __param(2, Inject(ToolDrift)),
     __param(3, Inject(DirectorySync)),
-    __param(4, Inject(ScheduledRuns)),
-    __param(5, Inject(KERNEL_LOGGER)),
-    __param(6, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
+    __param(4, Inject(RunQueue)),
+    __param(5, Inject(ScheduledRuns)),
+    __param(6, Inject(KERNEL_LOGGER)),
+    __param(7, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
 ], MaintenanceProcessor);
 export { MaintenanceProcessor };
 /**

package/dist/runtime/model-call.d.ts

@@ -1,6 +1,7 @@
 import { type ContentBlock, type Logger, type ModelProvider, type ModelRequest, type ModelStreamEvent, type ModelUsage, type StopReason } from "@capybara-hq/plugin-sdk";
 import type { AgentDefinition } from "../agents/definition.js";
-import type { EventLog } from "../conversations/event-log.js";
+import type { AppendEvent, EventLog } from "../conversations/event-log.js";
+import { type ConversationEvent } from "../conversations/events.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import type { ToolRegistry, UnavailableTool } from "../tools/registry.js";
@@ -151,6 +152,21 @@ export declare function runModelStep(deps: ModelStepDeps, input: ModelStepInput)
  * 其余与 `runModelStep` 相同（幂等、降级、中止）。
  */
 export declare function runFinalWrapUp(deps: ModelStepDeps, input: ModelStepInput): Promise<ModelStepResult>;
+/**
+ * Appends a model call's events (its reply or compaction outcome with its `usage`; also the usage
+ * of a `WebFetch` extraction call, `tools/builtins/web/extract.ts`). For a
+ * sub-agent's run (`input.parentRunId`) in one transaction that also adds the tokens of the usage
+ * events it newly wrote to the parent run's `subagent_tokens_used` (sub-agents spec §8.3): a usage
+ * event already in the log (an idempotent hit after a crash) adds nothing, so each call counts
+ * exactly once.
+ */
+export declare function appendCounted(deps: {
+    eventLog: Pick<EventLog, "append" | "notify">;
+    stepLog: Pick<StepLog, "appendCounted">;
+}, input: {
+    conversationId: string;
+    parentRunId?: string | undefined;
+}, events: AppendEvent[]): Promise<ConversationEvent[]>;
 /** {@link assembleModelRequest} 的输入。 */
 export interface AssembleModelRequestInput extends Omit<BuildModelRequestInput, "tools"> {
     /** 本步解析出的工具；模型不支持工具（`capabilities.tools` 为 false）时不带。 */