@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/tools/tools.module.js

@@ -5,26 +5,34 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { Module } from "@nestjs/common";
+import { BackgroundModule } from "../background/background.module.js";
 import { ConversationAccessModule } from "../conversations/access.js";
 import { AttachmentsModule } from "../conversations/attachments.module.js";
 import { EventLogModule } from "../conversations/event-log.js";
+import { EnvironmentsModule } from "../environments/environments.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { QueueModule } from "../infra/queue/queue.module.js";
+import { ModelsModule } from "../models/models.module.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
+import { PlatformModule } from "../platform/platform.module.js";
 import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
+import { StepLogModule } from "../runtime/step-log.js";
 import { SubagentsModule } from "../runtime/subagents/subagents.service.js";
+import { UsageReportModule } from "../runtime/usage-report.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { SkillsModule } from "../skills/skills.module.js";
 import { StorageModule } from "../storage/storage.module.js";
 import { ApprovalsService } from "./approvals.service.js";
 import { Breaker } from "./breaker.js";
 import { BuiltinTools } from "./builtins/builtin-tools.js";
+import { WebPages } from "./builtins/web/page-cache.js";
 import { ConnectorContent } from "./connector-content.js";
 import { ConnectorsService } from "./connectors.service.js";
 import { Credentials } from "./credentials.js";
 import { ToolDrift } from "./drift.js";
-import { ConversationToolInfo } from "./info.js";
+import { ConversationToolInfo, OrgExtensionTools } from "./info.js";
 import { OAuthFlow } from "./oauth/flow.js";
+import { OrgToolSwitches } from "./org-tool-switches.js";
 import { ToolOutputs } from "./outputs.js";
 import { ToolPipeline } from "./pipeline.js";
 import { QuestionsService } from "./questions.service.js";
@@ -50,16 +58,26 @@ ToolsModule = __decorate([
             OrgLockModule,
             // the `Agent` tool's dispatch
             SubagentsModule,
-            // the builtin sandbox and skill tools run in the conversation's sandbox
+            // the builtin sandbox and skill tools run in the conversation's environment
             SandboxModule,
+            EnvironmentsModule,
+            // `Bash` with run_in_background records its task; TaskOutput / TaskStop finish and stop it
+            BackgroundModule,
             // the conversation page's tool metadata reads only what the viewer may see
             ConversationAccessModule,
+            // the WebFetch extraction call: its purpose, usage report and step writes
+            ModelsModule,
+            UsageReportModule,
+            StepLogModule,
+            // the `Platform` tool's operations, actor facts and agent docs (imports no domain module)
+            PlatformModule,
             QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
         ],
         providers: [
             Credentials,
             ToolOutputs,
             BuiltinTools,
+            WebPages,
             ToolRegistry,
             ApprovalsService,
             QuestionsService,
@@ -70,6 +88,8 @@ ToolsModule = __decorate([
             ConnectorsService,
             OAuthFlow,
             ConversationToolInfo,
+            OrgExtensionTools,
+            OrgToolSwitches,
         ],
         exports: [
             Credentials,
@@ -85,6 +105,8 @@ ToolsModule = __decorate([
             ConnectorsService,
             OAuthFlow,
             ConversationToolInfo,
+            OrgExtensionTools,
+            OrgToolSwitches,
         ],
     })
 ], ToolsModule);

package/dist/tools/validate.js

@@ -1,5 +1,5 @@
 import { Ajv2020 } from "ajv/dist/2020.js";
-import { canonicalJson } from "./registry.js";
+import { canonicalJson } from "./canonical-json.js";
 /**
  * 编译结果缓存的上限：超过后整体丢弃（工具定义每步从库里重新读出，缓存不能无限增长）。
  * 缓存的是由定义推导出的只读数据，不是跨进程状态。

package/dist/ui/views.d.ts

@@ -1,6 +1,7 @@
 import { type FormAnswer, type Logger, type UiActionResult, type UiContribution, type UiIcon, type UiView } from "@capybara-hq/plugin-sdk";
 import { ConversationsService } from "../conversations/conversations.service.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { PreviewerRegistry } from "../files/previewers.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -78,7 +79,7 @@ export declare function dropForeignOpens(view: UiView, panels: ReadonlySet<strin
  */
 export declare class UiViews {
     private readonly d;
-    constructor(host: ExtensionHost, conversations: ConversationsService, previewers: PreviewerRegistry, db: KernelDb, log: Pick<Logger, "warn">);
+    constructor(host: ExtensionHost, conversations: ConversationsService, previewers: PreviewerRegistry, db: KernelDb, log: Pick<Logger, "warn">, effective: Pick<EffectiveConfigs, "get">);
     /** 该组织、该角色可见的界面贡献：插件已启用且已加载；kind view 的要求插件注册了 render；组织页面要 member 以上。 */
     contributions(orgId: string, role: OrgRole): Promise<UiContributionItem[]>;
     /**

package/dist/ui/views.js

@@ -12,6 +12,7 @@ import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ConversationsService } from "../conversations/conversations.service.js";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs, NEEDS_CONFIG_REASON } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { PreviewerRegistry } from "../files/previewers.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -100,9 +101,10 @@ function actionResultProblems(r) {
  */
 let UiViews = class UiViews {
     d;
-    constructor(host, conversations, previewers, db, log) {
+    constructor(host, conversations, previewers, db, log, effective) {
         this.d = {
             host,
+            effective,
             // org config rows plus the required bootstrap plugins
             enabledPlugins: (orgId) => host.enabledPlugins(orgId),
             canAccessConversation: (orgId, id, accountId) => conversations.isAccessible(orgId, id, accountId),
@@ -223,7 +225,18 @@ let UiViews = class UiViews {
             throw notFound();
         if (!(await this.d.enabledPlugins(t.orgId)).has(t.plugin))
             throw notFound();
-        const base = { orgId: t.orgId, accountId: t.accountId, role: t.role, locale: t.locale };
+        // spec A §6: the extension is not called for an org whose effective config is not valid
+        const effective = await this.d.effective.get(t.orgId, t.plugin);
+        if (!effective.ok) {
+            throw new ApiError("extension.needs_config", `Extension ${t.plugin} ${NEEDS_CONFIG_REASON}`);
+        }
+        const base = {
+            orgId: t.orgId,
+            accountId: t.accountId,
+            role: t.role,
+            locale: t.locale,
+            config: effective.config,
+        };
         if (!isConversationPlace(entry.contribution.place)) {
             if (t.item !== undefined || t.card !== undefined) {
                 throw new ApiError("validation_failed", "item and callId are for conversation views");
@@ -299,6 +312,7 @@ UiViews = __decorate([
     __param(1, Inject(ConversationsService)),
     __param(2, Inject(PreviewerRegistry)),
     __param(3, Inject(KernelDb)),
-    __param(4, Inject(KERNEL_LOGGER))
+    __param(4, Inject(KERNEL_LOGGER)),
+    __param(5, Inject(EffectiveConfigs))
 ], UiViews);
 export { UiViews };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.3",
+  "version": "0.1.0-rc.5",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -64,14 +64,14 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.1"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.3"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
     "@types/pg": "^8.23.1",
     "@types/semver": "^7.8.0",
     "@types/yauzl": "3.4.0",
-    "@capybara-hq/testing": "0.1.0-rc.3"
+    "@capybara-hq/testing": "0.1.0-rc.6"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0064_account_last_org.sql

@@ -0,0 +1,7 @@
+-- The organization an account last chose as its current one: a new web session (login, SSO, setup,
+-- an accepted invitation) starts in it while the account is still a member and the org is not
+-- deleted, so people don't pick their org again at every sign-in. Written with the session's
+-- current org by `PUT /me/current-org`; NULL = never chosen (a new session then starts in the only
+-- org when there is exactly one). Additive: older replicas never read or write it.
+ALTER TABLE capybara.accounts
+  ADD COLUMN IF NOT EXISTS last_org_id text REFERENCES capybara.orgs(id) ON DELETE SET NULL;

package/src/migrations/0065_conversation_archive.sql

@@ -0,0 +1,8 @@
+-- A person archives a conversation (hidden from the default lists, still readable and unarchived
+-- by a new message) or deletes it (soft: hidden everywhere for the owner; the event log, runs and
+-- trajectories stay for enterprise admins).
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS archived_at timestamptz;
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS deleted_at timestamptz;
+CREATE INDEX IF NOT EXISTS conversations_live_idx
+  ON capybara.conversations (org_id, account_id, updated_at DESC)
+  WHERE deleted_at IS NULL AND archived_at IS NULL;

package/src/migrations/0066_extension_display_name.sql

@@ -0,0 +1,4 @@
+-- The plugin.json `displayName` ({ zh, en }) of an extension package, written when the package is
+-- stored; NULL when the plugin has none and for packages stored before this migration (no
+-- backfill: a name arrives with the next version). Additive: older replicas never read it.
+ALTER TABLE capybara.extension_packages ADD COLUMN IF NOT EXISTS display_name jsonb;

package/src/migrations/0067_agent_profiles.sql

@@ -0,0 +1,20 @@
+-- The agent profile (avatar, description, quick actions): display data stored beside the agent,
+-- outside agent_versions, so changing it creates no version. Expand-only.
+-- profile_updated_at is kept at millisecond precision so a client can send it back as expectedUpdatedAt.
+ALTER TABLE capybara.agents ADD COLUMN IF NOT EXISTS profile_avatar jsonb;
+ALTER TABLE capybara.agents ADD COLUMN IF NOT EXISTS profile_description text NOT NULL DEFAULT '';
+ALTER TABLE capybara.agents
+  ADD COLUMN IF NOT EXISTS profile_quick_actions jsonb NOT NULL DEFAULT '[]';
+ALTER TABLE capybara.agents
+  ADD COLUMN IF NOT EXISTS profile_updated_at timestamptz NOT NULL
+  DEFAULT date_trunc('milliseconds', now());
+
+-- A definition's avatarUrl becomes an external avatar (once: only where none is set yet).
+UPDATE capybara.agents a
+SET profile_avatar = jsonb_build_object('kind', 'external', 'url', v.definition->>'avatarUrl')
+FROM capybara.agent_versions v
+WHERE v.agent_id = a.id
+  AND v.version = a.current_version
+  AND a.profile_avatar IS NULL
+  AND jsonb_typeof(v.definition->'avatarUrl') = 'string'
+  AND v.definition->>'avatarUrl' <> '';

package/src/migrations/0068_agent_avatar_uploads.sql

@@ -0,0 +1,7 @@
+-- Agent avatar uploads reuse the presigned attachment flow: a new purpose 'agent-avatar' and the
+-- agent whose profile uses the upload (set once on save; a used upload has no expiry).
+ALTER TABLE capybara.attachments DROP CONSTRAINT IF EXISTS attachments_purpose_check;
+ALTER TABLE capybara.attachments
+  ADD CONSTRAINT attachments_purpose_check
+  CHECK (purpose IN ('chat', 'skill-package', 'agent-avatar'));
+ALTER TABLE capybara.attachments ADD COLUMN IF NOT EXISTS agent_id text;

package/src/migrations/0069_attachments_agent_idx.sql

@@ -0,0 +1,3 @@
+-- The agent avatar lookup and the cleanup of an agent's uploads filter attachments by agent_id;
+-- a partial index keeps it small, since most attachments belong to no agent.
+CREATE INDEX IF NOT EXISTS attachments_agent_idx ON capybara.attachments (agent_id) WHERE agent_id IS NOT NULL;

package/src/migrations/0070_background_tasks.sql

@@ -0,0 +1,37 @@
+-- Background Bash (spec 2026-11-05-background-bash-design §4.1): a command started with
+-- run_in_background keeps running in the conversation's sandbox after its tool call returns. One
+-- row per task; the owner is `conversation_id` (the child conversation for a sub-agent) and
+-- `sandbox_conversation_id` is the root conversation that owns the sandbox. Rows go with their
+-- conversations; finished rows are pruned after tools.outputRetentionDays.
+CREATE TABLE IF NOT EXISTS capybara.background_tasks (
+  id text PRIMARY KEY,
+  org_id text NOT NULL,
+  conversation_id text NOT NULL REFERENCES capybara.conversations(id) ON DELETE CASCADE,
+  sandbox_conversation_id text NOT NULL REFERENCES capybara.conversations(id) ON DELETE CASCADE,
+  run_id text NOT NULL,
+  call_id text NOT NULL,
+  trigger_account_id text NOT NULL,
+  description text NOT NULL,
+  command text NOT NULL,
+  -- the session id: the pid `setsid` started; stopping and liveness go by the session
+  sid text NOT NULL,
+  -- relative to /workspace
+  output_path text NOT NULL,
+  status text NOT NULL DEFAULT 'running'
+    CHECK (status IN ('running', 'completed', 'failed', 'stopped', 'timed_out', 'lost')),
+  lost_reason text,
+  exit_code integer,
+  started_at timestamptz NOT NULL DEFAULT now(),
+  finished_at timestamptz,
+  deadline_at timestamptz NOT NULL,
+  -- the sandbox instance the task runs in (the handle plus created_at identify an instance)
+  sandbox_created_at timestamptz NOT NULL,
+  -- a task marked lost while its process may still exist
+  kill_pending boolean NOT NULL DEFAULT false,
+  -- the bytes TaskOutput has already returned
+  read_offset bigint NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS background_tasks_running_idx
+  ON capybara.background_tasks (sandbox_conversation_id) WHERE status = 'running';
+CREATE INDEX IF NOT EXISTS background_tasks_conversation_idx
+  ON capybara.background_tasks (conversation_id, started_at DESC);

package/src/migrations/0071_background_tasks_reserve.sql

@@ -0,0 +1,6 @@
+-- Background Bash: a launch reserves its row (status running, counted against
+-- sandbox.background.maxTasks under a transaction-scoped lock) before the launch exec, and sets
+-- sid and sandbox_created_at once the command started. A row without a sid is a reservation: the
+-- poller skips it, and a failed launch finishes it as failed.
+ALTER TABLE IF EXISTS capybara.background_tasks ALTER COLUMN sid DROP NOT NULL;
+ALTER TABLE IF EXISTS capybara.background_tasks ALTER COLUMN sandbox_created_at DROP NOT NULL;

package/src/migrations/0072_background_tasks_stopping.sql

@@ -0,0 +1,5 @@
+-- Background Bash: a stop claims its task before it signals the session (stopping_at), so the
+-- poller, which skips a claimed task, cannot finish it meanwhile from what the signals leave
+-- behind (no process, or the wrapper's exit status); the stop's own finish is then the only one.
+-- A launch that finds its reservation claimed kills the command it started at once.
+ALTER TABLE IF EXISTS capybara.background_tasks ADD COLUMN IF NOT EXISTS stopping_at timestamptz;

package/src/migrations/0073_org_extension_point_defaults.sql

@@ -0,0 +1,11 @@
+-- Web tools (spec §6): an org's default provider of an extension point with `selection:
+-- "org-default"` (`point` is the name without the major, e.g. `web-search`). A row naming an
+-- extension that is disabled or uninstalled stays and is ignored until it is a candidate again.
+CREATE TABLE IF NOT EXISTS capybara.org_extension_point_defaults (
+  org_id text NOT NULL REFERENCES capybara.orgs(id) ON DELETE CASCADE,
+  point text NOT NULL,
+  extension text NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by text REFERENCES capybara.accounts(id) ON DELETE SET NULL,
+  PRIMARY KEY (org_id, point)
+);

package/src/migrations/0074_subagent_tree.sql

@@ -0,0 +1,50 @@
+-- Agent map (spec docs/superpowers/specs/2026-11-06-agent-map-design.md §6): nested sub-agents
+-- and a budget per tree.
+-- - conversations.subagent_depth: levels below the root conversation (0 = a root, 1 = its child).
+-- - runs.budget_run_id: the person-triggered root run whose window this run's dispatches and its
+--   descendants' tokens count against; null = the run is its own budget run.
+-- - subagent_dispatches.budget_run_id: the budget run the dispatch counted against (existing rows:
+--   the dispatching run, which was its own budget run before nesting).
+-- - subagent_dispatches.for_skill: the dispatch of a `context: fork` skill invocation (existing
+--   fork dispatches are backfilled).
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS subagent_depth smallint NOT NULL DEFAULT 0;
+
+ALTER TABLE runs ADD COLUMN IF NOT EXISTS budget_run_id text;
+CREATE INDEX IF NOT EXISTS runs_budget_run_idx ON runs (budget_run_id)
+  WHERE budget_run_id IS NOT NULL;
+
+ALTER TABLE subagent_dispatches ADD COLUMN IF NOT EXISTS budget_run_id text;
+UPDATE subagent_dispatches SET budget_run_id = parent_run_id WHERE budget_run_id IS NULL;
+ALTER TABLE subagent_dispatches ALTER COLUMN budget_run_id SET NOT NULL;
+ALTER TABLE subagent_dispatches ADD COLUMN IF NOT EXISTS for_skill boolean NOT NULL DEFAULT false;
+-- Existing fork dispatches (phase D: call id `skill-<seq>` at step 0, `skillCallId` / `FORK_STEP`
+-- in runtime/subagents/skill-fork.ts) are marked, so a fork in flight across the upgrade keeps its
+-- wait and its finish is never delivered as a background child's. A second run changes nothing.
+UPDATE subagent_dispatches SET for_skill = true
+WHERE for_skill = false AND step = 0 AND parent_call_id ~ '^skill-[0-9]+$';
+CREATE INDEX IF NOT EXISTS subagent_dispatches_budget_run_idx
+  ON subagent_dispatches (budget_run_id);
+
+-- Org overrides stored in deployment_settings.subagentLimitOverrides ({orgId: {...}}): the limit
+-- maxConcurrentPerRun is now maxConcurrentPerConversation (per conversation, §6). Each org entry
+-- holding the old key gets the new key with its value instead; an entry that already has the new
+-- key keeps it. Rows without the old key are left as they are, so a second run changes nothing.
+UPDATE deployment_settings AS ds
+SET value = (
+  SELECT jsonb_object_agg(
+    e.org,
+    CASE
+      WHEN jsonb_typeof(e.entry) = 'object' AND e.entry ? 'maxConcurrentPerRun'
+        THEN jsonb_build_object('maxConcurrentPerConversation', e.entry -> 'maxConcurrentPerRun')
+          || (e.entry - 'maxConcurrentPerRun')
+      ELSE e.entry
+    END
+  )
+  FROM jsonb_each(ds.value) AS e(org, entry)
+)
+WHERE ds.key = 'subagentLimitOverrides'
+  AND jsonb_typeof(ds.value) = 'object'
+  AND EXISTS (
+    SELECT 1 FROM jsonb_each(ds.value) AS e(org, entry)
+    WHERE jsonb_typeof(e.entry) = 'object' AND e.entry ? 'maxConcurrentPerRun'
+  );

package/src/migrations/0075_plugin_scope.sql

@@ -0,0 +1,61 @@
+-- Plugin scope (phase 1, spec 2026-11-05-plugin-component-management-design.md §5): every catalog item
+-- gets a scope (all / optional / named), a builtin flag, a disabled flag, an org list (named) and
+-- per-org switches. Replaces the catalog policy, grants and requests. Expand-only: `policy`,
+-- `catalog_org_grants` and `catalog_requests` stay (nothing reads them after this release).
+-- The backfill runs once per database (the migrator records the file); the UPDATEs below only read
+-- the old columns, and the inserts are ON CONFLICT DO NOTHING.
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS scope text NOT NULL DEFAULT 'optional';
+ALTER TABLE catalog_items DROP CONSTRAINT IF EXISTS catalog_items_scope_check;
+ALTER TABLE catalog_items ADD CONSTRAINT catalog_items_scope_check
+  CHECK (scope IN ('all', 'optional', 'named'));
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS builtin boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS disabled boolean NOT NULL DEFAULT false;
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS scope_version integer NOT NULL DEFAULT 0;
+
+-- named scope: the orgs the item is offered to.
+CREATE TABLE IF NOT EXISTS catalog_item_scope_orgs (
+  item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  PRIMARY KEY (item_id, org_id)
+);
+
+-- Per-org on / off switch of an item's components.
+CREATE TABLE IF NOT EXISTS catalog_item_org_switches (
+  item_id uuid NOT NULL REFERENCES catalog_items(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  enabled boolean NOT NULL,
+  updated_by text REFERENCES accounts(id) ON DELETE SET NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (item_id, org_id)
+);
+
+-- Backfill from policy / grants / installs.
+UPDATE catalog_items SET disabled = true WHERE policy = 'disabled';
+UPDATE catalog_items SET scope = 'named' WHERE policy = 'needs_approval';
+
+-- Required bootstrap plugins are builtin and offered to every org.
+UPDATE catalog_items SET scope = 'all', builtin = true
+  WHERE id IN (SELECT catalog_item_id FROM extension_installs
+               WHERE required AND catalog_item_id IS NOT NULL);
+
+-- named: granted orgs and orgs that already installed it.
+INSERT INTO catalog_item_scope_orgs (item_id, org_id)
+  SELECT g.item_id, g.org_id FROM catalog_org_grants g
+  JOIN catalog_items i ON i.id = g.item_id AND i.scope = 'named'
+  ON CONFLICT DO NOTHING;
+INSERT INTO catalog_item_scope_orgs (item_id, org_id)
+  SELECT DISTINCT p.item_id, p.org_id FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope = 'named'
+  WHERE p.status = 'installed'
+  ON CONFLICT DO NOTHING;
+
+-- An org that installed the item keeps it on (builtin / all items need no switch).
+INSERT INTO catalog_item_org_switches (item_id, org_id, enabled)
+  SELECT DISTINCT p.item_id, p.org_id, true FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope <> 'all'
+  WHERE p.status = 'installed'
+  ON CONFLICT DO NOTHING;
+
+-- Requests are gone: pending ones are withdrawn ('cancelled', the status the old withdraw used).
+UPDATE catalog_requests SET status = 'cancelled', note = 'superseded by scope', decided_at = now()
+  WHERE status = 'pending';

package/src/migrations/0076_skills_created_by_nullable.sql

@@ -0,0 +1,6 @@
+-- Plugin scope sync (spec 2026-11-05-plugin-component-management-design.md §5): the kernel installs
+-- plugins in an org as no person (the worker job that converges orgs to a plugin's scope), so a
+-- skill or skill version it creates has no creator. Relaxing NOT NULL is expand-only: rows written
+-- before keep their creator, and dropping NOT NULL on a nullable column is a no-op.
+ALTER TABLE skills ALTER COLUMN created_by DROP NOT NULL;
+ALTER TABLE skill_versions ALTER COLUMN created_by DROP NOT NULL;

package/src/migrations/0077_scope_requests.sql

@@ -0,0 +1,52 @@
+-- Requests under plugin scope (phase 1, spec 2026-11-05-plugin-component-management-design.md
+-- §5.1). A request has a kind: `access` (an org admin asks the enterprise admin to add the org to a
+-- `named` item shown to other orgs), `import` (an org admin asks for a marketplace entry that is not
+-- in the catalog yet: no item, the entry instead) or `enable` (a member asks the org admin to switch
+-- an `optional` item on). Expand-only: `stage`, `version`, `org_decided_*` stay (the new code still
+-- writes `stage` so the old NOT NULL and CHECK hold, and reads none of them).
+
+-- Whether orgs outside a `named` item's list see it (as requestable). Never makes it usable.
+ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS shown_to_others boolean NOT NULL DEFAULT true;
+
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'access';
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_kind_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_kind_check
+  CHECK (kind IN ('access', 'import', 'enable'));
+-- An `import` request names a marketplace entry; its item is written when the import's confirm
+-- commits.
+ALTER TABLE catalog_requests ALTER COLUMN item_id DROP NOT NULL;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS marketplace_id text
+  REFERENCES marketplaces(id) ON DELETE SET NULL;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS entry_name text;
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS entry_version text;
+ALTER TABLE catalog_requests DROP CONSTRAINT IF EXISTS catalog_requests_target_check;
+ALTER TABLE catalog_requests ADD CONSTRAINT catalog_requests_target_check
+  CHECK (kind = 'import' AND entry_name IS NOT NULL OR kind <> 'import' AND item_id IS NOT NULL);
+-- The optional reason of a rejection, shown to the requester.
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS reason text;
+-- The prepared import of an approved `import` request (it resolves when that staging is confirmed;
+-- a staging that expires leaves it pending).
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS staging_id uuid;
+CREATE INDEX IF NOT EXISTS catalog_requests_staging_idx
+  ON catalog_requests (staging_id) WHERE staging_id IS NOT NULL;
+-- The requester dismissed the decision notice from the inbox.
+ALTER TABLE catalog_requests ADD COLUMN IF NOT EXISTS dismissed_at timestamptz;
+
+-- One pending request per (org, kind, item or entry): replaces the old (org, item) index.
+DROP INDEX IF EXISTS directory_requests_pending_uq;
+CREATE UNIQUE INDEX IF NOT EXISTS catalog_requests_pending_item_uq
+  ON catalog_requests (org_id, kind, item_id)
+  WHERE status = 'pending' AND item_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS catalog_requests_pending_entry_uq
+  ON catalog_requests (org_id, marketplace_id, entry_name)
+  WHERE status = 'pending' AND kind = 'import';
+CREATE INDEX IF NOT EXISTS catalog_requests_kind_idx
+  ON catalog_requests (kind, status, created_at);
+CREATE INDEX IF NOT EXISTS catalog_requests_requester_idx
+  ON catalog_requests (org_id, requested_by) WHERE status IN ('approved', 'rejected');
+
+-- Rows written before kinds: a member's request (stage org) was an `enable` one; decided requests
+-- from before are not shown to their requesters as new decisions.
+UPDATE catalog_requests SET kind = 'enable' WHERE stage = 'org' AND kind = 'access';
+UPDATE catalog_requests SET dismissed_at = now()
+  WHERE status <> 'pending' AND dismissed_at IS NULL;

package/src/migrations/0078_scope_grant_switches.sql

@@ -0,0 +1,18 @@
+-- Plugin scope follow-up to 0075 (spec 2026-11-05-plugin-component-management-design.md §6
+-- "Migration of what exists"): 0075 put the orgs granted a `needs_approval` item on its `named`
+-- list, where a listed org without a switch row wants the plugin on. A grant only allowed an
+-- install; an org that never installed it did not have it on. Such orgs get an explicit switch
+-- row `enabled = false`, so the plugin stays off there until an org admin switches it on.
+-- Expand-only and idempotent: inserts only, ON CONFLICT DO NOTHING (a switch row an org admin or
+-- 0075 wrote wins).
+INSERT INTO catalog_item_org_switches (item_id, org_id, enabled)
+  SELECT s.item_id, s.org_id, false
+  FROM catalog_item_scope_orgs s
+  JOIN catalog_items i ON i.id = s.item_id AND i.policy = 'needs_approval'
+  JOIN catalog_org_grants g ON g.item_id = s.item_id AND g.org_id = s.org_id
+  WHERE NOT EXISTS (
+    SELECT 1 FROM plugin_installs p
+    WHERE p.item_id = s.item_id AND p.org_id = s.org_id
+      AND p.status IN ('installing', 'installed', 'upgrading')
+  )
+  ON CONFLICT DO NOTHING;

package/src/migrations/0079_scope_live_install_switches.sql

@@ -0,0 +1,19 @@
+-- Plugin scope follow-up to 0075 (spec 2026-11-05-plugin-component-management-design.md §6
+-- "Migration of what exists"): 0075 listed and switched on only the org installs with status
+-- `installed`. An install that was `installing` or `upgrading` when 0075 ran got no switch row,
+-- which for an `optional` item means off, and no place on a `named` item's org list; the worker's
+-- start-time scope resync would then uninstall it. Such installs get what 0075 gave installed ones:
+-- the org on the named list and a switch row `enabled = true` (builtin / `all` items need none).
+-- Expand-only and idempotent: inserts only, ON CONFLICT DO NOTHING (a row an org admin, 0075 or
+-- 0078 wrote wins).
+INSERT INTO catalog_item_scope_orgs (item_id, org_id)
+  SELECT DISTINCT p.item_id, p.org_id FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope = 'named'
+  WHERE p.status IN ('installing', 'upgrading')
+  ON CONFLICT DO NOTHING;
+
+INSERT INTO catalog_item_org_switches (item_id, org_id, enabled)
+  SELECT DISTINCT p.item_id, p.org_id, true FROM plugin_installs p
+  JOIN catalog_items i ON i.id = p.item_id AND i.scope <> 'all'
+  WHERE p.status IN ('installing', 'upgrading')
+  ON CONFLICT DO NOTHING;

package/src/migrations/0080_rename_enterprise_admin.sql

@@ -0,0 +1,18 @@
+-- The deployment-level role "enterprise admin" becomes "super admin" (plugin and component
+-- management spec §13.4b): accounts.is_enterprise_admin becomes is_super_admin, and the stored
+-- deployment setting orgCreation "enterprise_admin" becomes "super_admin". Historical audit rows
+-- are not rewritten. No compatibility layer (release candidate).
+
+-- capybara:allow-destructive column rename; code is renamed in the same release (release candidate, no compatibility layer)
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+             WHERE table_schema = 'capybara' AND table_name = 'accounts'
+               AND column_name = 'is_enterprise_admin') THEN
+    ALTER TABLE accounts RENAME COLUMN is_enterprise_admin TO is_super_admin;
+  END IF;
+END
+$$;
+
+UPDATE deployment_settings SET value = '"super_admin"'::jsonb
+  WHERE key = 'orgCreation' AND value = '"enterprise_admin"'::jsonb;