@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/models/purposes.js

@@ -14,7 +14,7 @@ import { ModelRef, paramIssues } from "../agents/definition.js";
 import { ApiError } from "../errors.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -27,7 +27,7 @@ import { ProviderListError, ProviderRegistry } from "../runtime/providers.js";
 /**
  * 模型用途映射（C9）：内核与插件按「用途」取模型，不在代码里写死模型。
  * - 用途 = 内核用途 {@link KERNEL_PURPOSES}（目前只有评委 `eval`），或已加载插件 `permissions.models` 声明的；
- * - 映射 = 部署默认（`org_id` 为 null，企业管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
+ * - 映射 = 部署默认（`org_id` 为 null，超级管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
  *   生效的映射先取组织覆盖、再取部署默认，都没有 → `model.unconfigured`；
  * - 目标模型按部署范围解析（与运行时一致），参数按目标模型自己的声明严格校验；不做模型白名单；
  * - 每次都查 PG，不在进程内缓存（多副本下改映射立即生效）。`ctx.models` 仍预留，插件暂不能调用。
@@ -41,22 +41,36 @@ export const KERNEL_PURPOSES = [
     { purpose: "eval", kind: "chat", label: { zh: "评测评委", en: "Eval judge" } },
     /** Conversation titles (UI refresh B); unmapped → the conversation's current chat model. */
     { purpose: "title", kind: "chat", label: { zh: "会话标题", en: "Conversation titles" } },
+    /**
+     * The `WebFetch` extraction call (web tools spec §5); unmapped → the calling conversation's
+     * current chat model (a sub-agent's call: the sub-agent's).
+     */
+    { purpose: "web_fetch", kind: "chat", label: { zh: "网页提取", en: "Web page extraction" } },
     {
         purpose: "subagent_fast",
         kind: "chat",
-        label: { zh: "子代理：快速", en: "Sub-agent: fast" },
+        label: { zh: "子智能体：快速", en: "Sub-agent: fast" },
     },
     {
         purpose: "subagent_standard",
         kind: "chat",
-        label: { zh: "子代理：标准", en: "Sub-agent: standard" },
+        label: { zh: "子智能体：标准", en: "Sub-agent: standard" },
     },
     {
         purpose: "subagent_capable",
         kind: "chat",
-        label: { zh: "子代理：最强", en: "Sub-agent: capable" },
+        label: { zh: "子智能体：最强", en: "Sub-agent: capable" },
     },
 ];
+/** {@link PurposeListing}s of `views`, the display names read in one call. */
+export async function withDeclaredByNames(views, names) {
+    const plugins = views.map((v) => v.declaredBy).filter((d) => d !== "kernel");
+    const found = await names.many(plugins);
+    return views.map((v) => ({
+        ...v,
+        declaredByName: v.declaredBy === "kernel" ? null : (found.get(v.declaredBy) ?? null),
+    }));
+}
 /** `PUT …/model-purposes/:purpose` 的 body：设映射，或 `target: null` 清除。 */
 export const PURPOSE_PUT = z
     .object({
@@ -201,7 +215,7 @@ let ModelPurposesService = class ModelPurposesService {
         const [view] = await this.views([decl], orgId ?? undefined);
         return view;
     }
-    /** The mapping write of {@link set}, under the enterprise admin or org lock. */
+    /** The mapping write of {@link set}, under the super admin or org lock. */
     async write(orgId, purpose, target, actor, actorTokenId) {
         if (orgId === null)
             await this.adminLock.lockAndAuthorize(actor);
@@ -238,7 +252,7 @@ let ModelPurposesService = class ModelPurposesService {
             detail: { scope: orgId === null ? "deployment" : "org", target },
         });
     }
-    /** 设置（或 `null` 清除）部署默认；只有企业管理员（事务内复核）。 */
+    /** 设置（或 `null` 清除）部署默认；只有超级管理员（事务内复核）。 */
     setDefault(purpose, target, actor, actorTokenId) {
         return this.set(null, purpose, target, actor, actorTokenId);
     }
@@ -254,6 +268,27 @@ let ModelPurposesService = class ModelPurposesService {
         }
         return view.effective;
     }
+    /** The target a {@link chat} call on `purpose` uses: the mapping, else `fallback` when unmapped. */
+    async chatTarget(orgId, purpose, fallback) {
+        try {
+            return await this.resolve(orgId, purpose);
+        }
+        catch (e) {
+            if (!(e instanceof ApiError && e.code === "model.unconfigured") || !fallback)
+                throw e;
+            return fallback;
+        }
+    }
+    /**
+     * The limits of the model a {@link chat} call on `purpose` would use now (the same mapping and
+     * `fallback` rule): its context window and output cap, so a caller can size its request (e.g.
+     * the `WebFetch` page) before the call. Fails as `chat` does before sending.
+     */
+    async chatLimits(orgId, purpose, opts = {}) {
+        const target = await this.chatTarget(orgId, purpose, opts.fallback);
+        const { info } = await this.providers.resolve(target.model);
+        return { contextWindow: info.contextWindow, maxOutputTokens: info.maxOutputTokens };
+    }
     /**
      * 按用途发一次对话请求：解析映射、按目标模型的声明宽松处理参数（补默认值，与运行时一致），用 `consumeModelStream`
      * 收完（只有流空闲看门狗）。输出上限取 `min(req.maxOutputTokens, 目标模型的 maxOutputTokens)`。
@@ -261,22 +296,17 @@ let ModelPurposesService = class ModelPurposesService {
      * `opts.fallback`: the target used when the purpose is not mapped (`model.unconfigured`).
      * `opts.beforeSend`: called with the resolved target and the final request just before sending;
      * what it throws is thrown as is (a pre-send failure, e.g. a denied `model.request` hook).
+     * `opts.paramDefaults`: values for parameters the target does not set, kept only where the
+     * target model declares the key and the value fits it (e.g. `thinking: "off"` for a short call).
      */
     async chat(orgId, purpose, req, signal, opts = {}) {
-        let target;
-        try {
-            target = await this.resolve(orgId, purpose);
-        }
-        catch (e) {
-            if (!(e instanceof ApiError && e.code === "model.unconfigured") || !opts.fallback)
-                throw e;
-            target = opts.fallback;
-        }
+        const target = await this.chatTarget(orgId, purpose, opts.fallback);
         const { provider, info } = await this.providers.resolve(target.model);
         const request = {
             ...req,
             model: info.id,
-            params: sanitizeParams(info.parameters, target.params).value,
+            // undeclared or unfitting defaults are dropped like any other parameter
+            params: sanitizeParams(info.parameters, { ...opts.paramDefaults, ...target.params }).value,
             // 输出上限不超过目标模型自己的上限（与运行时 assembleModelRequest 一致）
             maxOutputTokens: Math.min(req.maxOutputTokens, info.maxOutputTokens),
         };
@@ -311,7 +341,7 @@ ModelPurposesService = __decorate([
     __param(2, Inject(KernelConfigService)),
     __param(3, Inject(ProviderRegistry)),
     __param(4, Inject(TransactionHost)),
-    __param(5, Inject(EnterpriseAdminLock)),
+    __param(5, Inject(SuperAdminLock)),
     __param(6, Inject(OrgLock))
 ], ModelPurposesService);
 export { ModelPurposesService };

package/dist/orgs/directory-sync.d.ts

@@ -1,5 +1,6 @@
 import type { Queue } from "bullmq";
 import type { Redis } from "ioredis";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { OrgExtensionConfigs } from "../extensions/org-config.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { ExternalIdentities } from "../identity/external.js";
@@ -35,9 +36,11 @@ export declare const DIRECTORY_MAX_PAGES = 10000;
 export type DirectorySyncTrigger = "schedule" | "changed" | "manual";
 /**
  * 不同步的原因（陈旧任务、插件已停用 / 配置不再有效、组织已删除、另一同步在跑；`not_configured`：插件的
- * `Directory.configured` 说这份组织配置没配好通讯录，Ruling A28，静默跳过）。
+ * `Directory.configured` 说这份组织配置没配好通讯录，Ruling A28，静默跳过）。`needs_config`: the
+ * extension's effective deployment config for the org is not valid (layering spec A §6): skipped
+ * silently like `not_configured`; the org admin sees the extension as needing configuration.
  */
-export type DirectorySkipReason = "plugin_unavailable" | "org_not_found" | "not_enabled" | "config_invalid" | "not_configured" | "locked";
+export type DirectorySkipReason = "plugin_unavailable" | "org_not_found" | "not_enabled" | "config_invalid" | "not_configured" | "needs_config" | "locked";
 export type DirectorySyncResult = {
     status: "skipped";
     reason: DirectorySkipReason;
@@ -122,18 +125,23 @@ export declare class DirectorySync {
     private readonly redis;
     private readonly registry;
     private readonly orgConfigs;
+    private readonly effective;
     private readonly external;
     private readonly offboarding;
     private readonly orgLock;
     private readonly queue;
     readonly lockService: LockService;
     readonly log: KernelLogger;
-    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, external: Pick<ExternalIdentities, "resolve">, offboarding: Pick<Offboarding, "offboard" | "afterOffboard">, orgLock: OrgLock, queue: Pick<Queue, "add">, lockService: LockService, log: KernelLogger);
+    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, effective: Pick<EffectiveConfigs, "get">, external: Pick<ExternalIdentities, "resolve">, offboarding: Pick<Offboarding, "offboard" | "afterOffboard">, orgLock: OrgLock, queue: Pick<Queue, "add">, lockService: LockService, log: KernelLogger);
     /** A `directory-sync` job (dispatched by `MaintenanceProcessor`). */
     runSyncJob(data: SyncJobData): Promise<void>;
     /** 插件提供的 `directory@1`；未加载或不提供时 undefined。 */
     private provider;
-    /** The org exists, the extension provides a directory, is enabled in the org and its org config satisfies the schema (reuses the `OrgExtensionConfigs.get` validation). */
+    /**
+     * The org exists, the extension provides a directory, is enabled in the org, its org config
+     * satisfies the schema (reuses the `OrgExtensionConfigs.get` validation) and its effective
+     * deployment config for the org is valid (layering spec A §6).
+     */
     private eligible;
     /**
      * 投递一次 `directory_changed` 同步（按分钟桶去重）；返回 job id。入站 `directory_changed` 经
@@ -146,7 +154,8 @@ export declare class DirectorySync {
      * Manual trigger by an admin: re-checks `org.members.manage` live under the org row lock, then that
      * the extension can sync (does not provide a directory -> `extension.not_found`, not enabled ->
      * `extension.not_enabled`, config no longer valid -> `extension.config_invalid`, the extension says
-     * the directory is not configured -> `directory.not_configured`, Ruling A28), and enqueues a sync
+     * the directory is not configured -> `directory.not_configured`, Ruling A28; the effective config
+     * is not valid in the org -> `extension.needs_config`, layering spec A §6), and enqueues a sync
      * job with a unique id.
      */
     request(orgId: string, plugin: string, actorAccountId: string, actorTokenId?: string): Promise<{

package/dist/orgs/directory-sync.js

@@ -12,6 +12,7 @@ import { DIRECTORY_EXTENSION_POINT, } from "@capybara-hq/plugin-sdk";
 import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { enabledExtensionsByOrg } from "../extensions/enabled.js";
 import { OrgExtensionConfigs } from "../extensions/org-config.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
@@ -80,6 +81,8 @@ export function directorySyncJobId(orgId, plugin, trigger, now = new Date()) {
             return `${base}-manual-${randomUUID()}`;
     }
 }
+/** Skips that log nothing and enqueue nothing: Ruling A28 and an org needing configuration. */
+const silentSkip = (reason) => reason === "not_configured" || reason === "needs_config";
 /** 组织已删除（同步途中）：停止本轮。 */
 class OrgGone extends Error {
 }
@@ -122,18 +125,20 @@ let DirectorySync = class DirectorySync {
     redis;
     registry;
     orgConfigs;
+    effective;
     external;
     offboarding;
     orgLock;
     queue;
     lockService;
     log;
-    constructor(db, txHost, redis, registry, orgConfigs, external, offboarding, orgLock, queue, lockService, log) {
+    constructor(db, txHost, redis, registry, orgConfigs, effective, external, offboarding, orgLock, queue, lockService, log) {
         this.db = db;
         this.txHost = txHost;
         this.redis = redis;
         this.registry = registry;
         this.orgConfigs = orgConfigs;
+        this.effective = effective;
         this.external = external;
         this.offboarding = offboarding;
         this.orgLock = orgLock;
@@ -144,8 +149,8 @@ let DirectorySync = class DirectorySync {
     /** A `directory-sync` job (dispatched by `MaintenanceProcessor`). */
     async runSyncJob(data) {
         const r = await this.sync(data.orgId, data.plugin, data);
-        // 通讯录未配置（Ruling A28）静默跳过
-        if (r.status === "skipped" && r.reason !== "not_configured") {
+        // 通讯录未配置（Ruling A28）and an org needing configuration (spec A §6) are skipped silently
+        if (r.status === "skipped" && !silentSkip(r.reason)) {
             this.log.info("directory sync skipped", {
                 orgId: data.orgId,
                 plugin: data.plugin,
@@ -159,7 +164,11 @@ let DirectorySync = class DirectorySync {
             .list("directory")
             .find((e) => e.plugin === plugin && e.capability === DIRECTORY_EXTENSION_POINT)?.impl;
     }
-    /** The org exists, the extension provides a directory, is enabled in the org and its org config satisfies the schema (reuses the `OrgExtensionConfigs.get` validation). */
+    /**
+     * The org exists, the extension provides a directory, is enabled in the org, its org config
+     * satisfies the schema (reuses the `OrgExtensionConfigs.get` validation) and its effective
+     * deployment config for the org is valid (layering spec A §6).
+     */
     async eligible(orgId, plugin) {
         const directory = this.provider(plugin);
         if (!directory)
@@ -186,11 +195,21 @@ let DirectorySync = class DirectorySync {
         }
         if (!cfg?.enabled)
             return { ok: false, reason: "not_enabled" };
+        let effective;
+        try {
+            effective = await this.effective.get(orgId, plugin);
+        }
+        catch (err) {
+            this.log.warn("directory sync: cannot read the effective config", { orgId, plugin, err });
+            return { ok: false, reason: "config_invalid" };
+        }
+        if (!effective.ok)
+            return { ok: false, reason: "needs_config" };
         // Ruling A28：插件说通讯录没配好（组织只用它的别的能力）→ 不同步；插件实现出错按未配置处理
         if (directory.configured !== undefined) {
             let configured = false;
             try {
-                configured = directory.configured(cfg.config) === true;
+                configured = directory.configured(cfg.config, effective.config) === true;
             }
             catch {
                 configured = false;
@@ -198,7 +217,7 @@ let DirectorySync = class DirectorySync {
             if (!configured)
                 return { ok: false, reason: "not_configured" };
         }
-        return { ok: true, directory, orgConfig: cfg.config };
+        return { ok: true, directory, orgConfig: cfg.config, config: effective.config };
     }
     /**
      * 投递一次 `directory_changed` 同步（按分钟桶去重）；返回 job id。入站 `directory_changed` 经
@@ -207,7 +226,7 @@ let DirectorySync = class DirectorySync {
      */
     async enqueue(orgId, plugin, now = new Date()) {
         const e = await this.eligible(orgId, plugin);
-        if (!e.ok && e.reason === "not_configured")
+        if (!e.ok && silentSkip(e.reason))
             return undefined;
         return this.addJob(orgId, plugin, "changed", directorySyncJobId(orgId, plugin, "changed", now));
     }
@@ -234,7 +253,8 @@ let DirectorySync = class DirectorySync {
      * Manual trigger by an admin: re-checks `org.members.manage` live under the org row lock, then that
      * the extension can sync (does not provide a directory -> `extension.not_found`, not enabled ->
      * `extension.not_enabled`, config no longer valid -> `extension.config_invalid`, the extension says
-     * the directory is not configured -> `directory.not_configured`, Ruling A28), and enqueues a sync
+     * the directory is not configured -> `directory.not_configured`, Ruling A28; the effective config
+     * is not valid in the org -> `extension.needs_config`, layering spec A §6), and enqueues a sync
      * job with a unique id.
      */
     async request(orgId, plugin, actorAccountId, actorTokenId) {
@@ -252,6 +272,8 @@ let DirectorySync = class DirectorySync {
                     throw new ApiError("extension.config_invalid", `Invalid organization config for extension ${plugin}`);
                 case "not_configured":
                     throw new ApiError("directory.not_configured", `The directory of extension ${plugin} is not configured for this organization`);
+                case "needs_config":
+                    throw new ApiError("extension.needs_config", `Extension ${plugin} needs configuration in this organization`);
             }
         }
         const jobId = await this.addJob(orgId, plugin, "manual", directorySyncJobId(orgId, plugin, "manual"), { accountId: actorAccountId, tokenId: actorTokenId });
@@ -324,7 +346,7 @@ let DirectorySync = class DirectorySync {
         // 锁丢了（续租失败、过期后被他人取得）：停止本轮，不再移除任何人
         const signal = lease.lost;
         try {
-            return await this.run(orgId, plugin, e.directory, e.orgConfig, signal, opts);
+            return await this.run(orgId, plugin, e.directory, e.orgConfig, e.config, signal, opts);
         }
         finally {
             await lease.release().catch(() => { });
@@ -346,7 +368,7 @@ let DirectorySync = class DirectorySync {
             this.log.warn("directory sync: cannot enqueue follow-up sync", { orgId, plugin, err });
         }
     }
-    async run(orgId, plugin, directory, orgConfig, signal, opts) {
+    async run(orgId, plugin, directory, orgConfig, config, signal, opts) {
         const source = `directory:${plugin}`;
         const counts = { added: 0, removed: 0, skippedLastOwner: 0, failed: 0, total: 0 };
         /** 本轮仍在职的账号（只在本次任务内使用）。 */
@@ -363,6 +385,7 @@ let DirectorySync = class DirectorySync {
                 signal.throwIfAborted();
                 const r = await directory.listMembers({
                     orgConfig,
+                    config,
                     ...(cursor !== undefined && { cursor }),
                     signal: AbortSignal.any([signal, AbortSignal.timeout(DIRECTORY_PAGE_TIMEOUT_MS)]),
                 });
@@ -409,7 +432,7 @@ let DirectorySync = class DirectorySync {
             if (!still.ok) {
                 partial = true;
                 // 途中通讯录配置被清空（Ruling A28）：照样不移除，但不记警告
-                if (still.reason !== "not_configured") {
+                if (!silentSkip(still.reason)) {
                     this.log.warn("directory sync: plugin no longer eligible before removals", {
                         orgId,
                         plugin,
@@ -609,12 +632,13 @@ DirectorySync = __decorate([
     __param(2, Inject(REDIS)),
     __param(3, Inject(ExtensionRegistry)),
     __param(4, Inject(OrgExtensionConfigs)),
-    __param(5, Inject(ExternalIdentities)),
-    __param(6, Inject(Offboarding)),
-    __param(7, Inject(OrgLock)),
-    __param(8, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
-    __param(9, Inject(LockService)),
-    __param(10, Inject(KERNEL_LOGGER))
+    __param(5, Inject(EffectiveConfigs)),
+    __param(6, Inject(ExternalIdentities)),
+    __param(7, Inject(Offboarding)),
+    __param(8, Inject(OrgLock)),
+    __param(9, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
+    __param(10, Inject(LockService)),
+    __param(11, Inject(KERNEL_LOGGER))
 ], DirectorySync);
 export { DirectorySync };
 /** The hourly directory scan ({@link DirectorySync.scan}), once per tick across replicas; a worker-role job (`WorkerModule`). */

package/dist/orgs/offboarding.d.ts

@@ -30,8 +30,8 @@ export interface OffboardResult {
     runs: InFlightRun[];
     /** 负责的 agent 转交给的所有者；没有转交时为 null。 */
     newOwnerId: string | null;
-    /** 此人在该组织的对话里还没销毁的沙箱（按对话 id），提交后投递销毁。 */
-    sandboxConversations: string[];
+    /** The person's environments in the org, soft-deleted here; destroyed by a job after commit. */
+    environments: string[];
     /** Conversations whose queued messages were deleted (`changed: queue` after commit). */
     queueConversations: string[];
 }
@@ -66,7 +66,7 @@ export declare class Offboarding {
     private readonly redis;
     private readonly registry;
     private readonly eventLog;
-    /** The departed member's sandboxes: one-off maintenance jobs, destroyed one by one by a worker. */
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
     private readonly sandboxJobs;
     /** Stops the departed member's runs (`by: null`, a system action). */
     private readonly runs;
@@ -75,7 +75,7 @@ export declare class Offboarding {
     private readonly questions;
     readonly log: KernelLogger;
     constructor(db: KernelDb, txHost: TransactionHost, sessions: Pick<SessionService, "markRevoked">, redis: Pick<Redis, "set" | "exists">, registry: Pick<ExtensionRegistry, "list">, eventLog: Pick<EventLog, "notify" | "publishChanged">, 
-    /** The departed member's sandboxes: one-off maintenance jobs, destroyed one by one by a worker. */
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
     sandboxJobs: Pick<SandboxJobs, "destroy">, 
     /** Stops the departed member's runs (`by: null`, a system action). */
     runs: OffboardingRunControl, credentials: Pick<Credentials, "clearAccount">, approvals: Pick<ApprovalsService, "cancelPendingFor">, questions: Pick<QuestionsService, "cancelPendingFor">, log: KernelLogger);
@@ -83,7 +83,9 @@ export declare class Offboarding {
      * In the caller's transaction (`mandatory`: the caller holds the org row lock, order org row →
      * membership, and did the "last owner" checks)：
      * 1. 删除成员关系（非成员 → `member.not_found`；删后组织没有 owner → `org.last_owner`），清空指向该组织的会话当前组织；
-     * 2. 吊销该账号**全部**会话与个人令牌（令牌与会话是账号级的，无法只吊销「该组织下」的，按保守处理）；
+     * 2. Removal and directory offboarding revoke **every** session and personal token of the
+     *    account (both are account-wide, so conservatively all); a person who leaves (`left`) keeps
+     *    them, and the session's current org is cleared (the membership check ends the access);
      * 3. 删除其在该组织所有连接器上的个人凭据；
      * 4. 取消其作为处理人的 pending 审批与提问（写 cancelled 事件），记下此人在该组织进行中的运行（提交后中止）；
      * 5. 其负责的该组织 agent 转给组织所有者（最早加入的 owner）并置 `needs_reassignment = true`；
@@ -93,7 +95,9 @@ export declare class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. 记下此人在该组织对话里还没销毁的沙箱（提交后销毁，尽力而为）。
+     * 9. Soft-deletes the person's environments in the org and clears their default row (the
+     *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
+     *    any left).
      */
     offboard(orgId: string, accountId: string, reason: OffboardReason, actor?: {
         actorAccountId?: string;
@@ -104,8 +108,8 @@ export declare class Offboarding {
     /**
      * After the commit (callers register it with the infra `afterCommit` inside their transaction):
      * writes the session revocation markers, publishes the cancelled events, stops the person's
-     * runs in the org and schedules destroying their conversations' sandboxes. A failing step only
-     * logs a warning.
+     * runs in the org and schedules destroying their environments. A failing step only logs a
+     * warning.
      */
     afterOffboard(r: OffboardResult): Promise<void>;
     /**

package/dist/orgs/offboarding.js

@@ -10,6 +10,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { DIRECTORY_EXTENSION_POINT } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
+import { retargetSetupRequests } from "../agents/pending-connector-requests.js";
 import { EventLog } from "../conversations/event-log.js";
 import { ApiError } from "../errors.js";
 import { enabledExtensionsQuery } from "../extensions/enabled.js";
@@ -62,7 +63,7 @@ let Offboarding = class Offboarding {
     questions;
     log;
     constructor(db, txHost, sessions, redis, registry, eventLog, 
-    /** The departed member's sandboxes: one-off maintenance jobs, destroyed one by one by a worker. */
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
     sandboxJobs, 
     /** Stops the departed member's runs (`by: null`, a system action). */
     runs, credentials, approvals, questions, log) {
@@ -83,7 +84,9 @@ let Offboarding = class Offboarding {
      * In the caller's transaction (`mandatory`: the caller holds the org row lock, order org row →
      * membership, and did the "last owner" checks)：
      * 1. 删除成员关系（非成员 → `member.not_found`；删后组织没有 owner → `org.last_owner`），清空指向该组织的会话当前组织；
-     * 2. 吊销该账号**全部**会话与个人令牌（令牌与会话是账号级的，无法只吊销「该组织下」的，按保守处理）；
+     * 2. Removal and directory offboarding revoke **every** session and personal token of the
+     *    account (both are account-wide, so conservatively all); a person who leaves (`left`) keeps
+     *    them, and the session's current org is cleared (the membership check ends the access);
      * 3. 删除其在该组织所有连接器上的个人凭据；
      * 4. 取消其作为处理人的 pending 审批与提问（写 cancelled 事件），记下此人在该组织进行中的运行（提交后中止）；
      * 5. 其负责的该组织 agent 转给组织所有者（最早加入的 owner）并置 `needs_reassignment = true`；
@@ -93,7 +96,9 @@ let Offboarding = class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. 记下此人在该组织对话里还没销毁的沙箱（提交后销毁，尽力而为）。
+     * 9. Soft-deletes the person's environments in the org and clears their default row (the
+     *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
+     *    any left).
      */
     async offboard(orgId, accountId, reason, actor = {}) {
         const deleted = await this.db
@@ -150,21 +155,29 @@ let Offboarding = class Offboarding {
             .where("account_id", "=", accountId)
             .where("current_org_id", "=", orgId)
             .execute();
-        const sessions = await this.db
-            .updateTable("sessions")
-            .set({ revoked_at: sql `now()` })
-            .where("account_id", "=", accountId)
-            .where("revoked_at", "is", null)
-            .returning("id")
-            .execute();
-        const tokens = await this.db
-            .updateTable("api_tokens")
-            .set({ revoked_at: sql `now()` })
-            .where("kind", "=", "personal")
-            .where("account_id", "=", accountId)
-            .where("revoked_at", "is", null)
-            .returning("id")
-            .execute();
+        // A person who leaves keeps their sign-in and personal tokens: the org guard reads the
+        // membership on every request, so access to this org ends with the row above, and their other
+        // orgs keep working. Removal and directory offboarding revoke both (account-wide, conservative).
+        const revoke = reason !== "left";
+        const sessions = revoke
+            ? await this.db
+                .updateTable("sessions")
+                .set({ revoked_at: sql `now()` })
+                .where("account_id", "=", accountId)
+                .where("revoked_at", "is", null)
+                .returning("id")
+                .execute()
+            : [];
+        const tokens = revoke
+            ? await this.db
+                .updateTable("api_tokens")
+                .set({ revoked_at: sql `now()` })
+                .where("kind", "=", "personal")
+                .where("account_id", "=", accountId)
+                .where("revoked_at", "is", null)
+                .returning("id")
+                .execute()
+            : [];
         // in this transaction (the approvals and questions services join it: `mandatory`)
         const credentials = await this.credentials.clearAccount(orgId, accountId);
         const approvals = await this.approvals.cancelPendingFor(orgId, accountId);
@@ -200,6 +213,8 @@ let Offboarding = class Offboarding {
             .where("deleted_at", "is", null)
             .returning("id")
             .execute();
+        // their connector setup requests follow them to the org owner (ruling P4-T6-4)
+        await retargetSetupRequests(this.db.db, agents.map((a) => a.id), owner.account_id);
         const threads = await this.db
             .updateTable("channel_threads")
             .set({ archived_at: sql `now()` })
@@ -244,13 +259,19 @@ let Offboarding = class Offboarding {
                 .where("id", "in", queueConversations)
                 .execute();
         }
-        const sandboxes = await this.db
-            .selectFrom("sandboxes")
-            .innerJoin("conversations", "conversations.id", "sandboxes.conversation_id")
-            .select("sandboxes.conversation_id")
-            .where("conversations.org_id", "=", orgId)
-            .where("conversations.account_id", "=", accountId)
-            .where("sandboxes.status", "<>", "destroyed")
+        const environments = await this.db
+            .updateTable("environments")
+            .set({ deleted_at: sql `now()`, updated_at: sql `now()` })
+            .where("org_id", "=", orgId)
+            .where("owner_kind", "=", "personal")
+            .where("owner_account_id", "=", accountId)
+            .where("deleted_at", "is", null)
+            .returning("id")
+            .execute();
+        await this.db
+            .deleteFrom("environment_defaults")
+            .where("org_id", "=", orgId)
+            .where("account_id", "=", accountId)
             .execute();
         await audit(this.db.db, {
             ...(actor.actorAccountId !== undefined && { actorAccountId: actor.actorAccountId }),
@@ -272,7 +293,7 @@ let Offboarding = class Offboarding {
                 channelThreadsArchived: Number(threads.numUpdatedRows),
                 toolGrantsDeleted: Number(grants.numDeletedRows),
                 ...(excluded.length > 0 && { directoryExcluded: excluded }),
-                ...(sandboxes.length > 0 && { sandboxesToDestroy: sandboxes.length }),
+                ...(environments.length > 0 && { environmentsDeleted: environments.length }),
                 ...(queued.length > 0 && { queuedMessagesDeleted: queued.length }),
             },
         });
@@ -286,7 +307,7 @@ let Offboarding = class Offboarding {
                 status: r.status,
             })),
             newOwnerId: agents.length > 0 ? owner.account_id : null,
-            sandboxConversations: sandboxes.map((r) => r.conversation_id),
+            environments: environments.map((r) => r.id),
             queueConversations,
         };
     }
@@ -315,8 +336,8 @@ let Offboarding = class Offboarding {
     /**
      * After the commit (callers register it with the infra `afterCommit` inside their transaction):
      * writes the session revocation markers, publishes the cancelled events, stops the person's
-     * runs in the org and schedules destroying their conversations' sandboxes. A failing step only
-     * logs a warning.
+     * runs in the org and schedules destroying their environments. A failing step only logs a
+     * warning.
      */
     async afterOffboard(r) {
         const { sessions, log, eventLog } = this;
@@ -344,13 +365,13 @@ let Offboarding = class Offboarding {
         }
         for (const run of r.runs)
             await this.stopRun(run);
-        if (r.sandboxConversations.length > 0) {
+        if (r.environments.length > 0) {
             try {
-                await this.sandboxJobs.destroy(r.sandboxConversations);
+                await this.sandboxJobs.destroy(r.environments);
             }
             catch (err) {
-                log.warn("offboarding: cannot schedule sandbox destruction", {
-                    count: r.sandboxConversations.length,
+                log.warn("offboarding: cannot schedule environment destruction", {
+                    count: r.environments.length,
                     err,
                 });
             }

package/dist/orgs/org-lock.d.ts

@@ -35,6 +35,11 @@ export declare class OrgLock {
         org: LockedOrg;
         role: OrgRole;
     }>;
+    /**
+     * {@link lockAndAuthorize} for an account; for the kernel itself (`null`: a job acting for no
+     * person, such as the plugin scope sync) only the lock, since no role applies.
+     */
+    lockFor(orgId: string, actor: string | null, action: OrgAction): Promise<void>;
 }
 /** The one {@link OrgLock}: identity (service tokens), orgs and the other domains import it. */
 export declare class OrgLockModule {

package/dist/orgs/org-lock.js

@@ -67,6 +67,16 @@ let OrgLock = class OrgLock {
         }
         return { org, role: m.role };
     }
+    /**
+     * {@link lockAndAuthorize} for an account; for the kernel itself (`null`: a job acting for no
+     * person, such as the plugin scope sync) only the lock, since no role applies.
+     */
+    async lockFor(orgId, actor, action) {
+        if (actor === null)
+            await this.lock(orgId);
+        else
+            await this.lockAndAuthorize(orgId, actor, action);
+    }
 };
 __decorate([
     Transactional({ propagation: "mandatory" })
@@ -77,6 +87,9 @@ __decorate([
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], OrgLock.prototype, "lockAndAuthorize", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], OrgLock.prototype, "lockFor", null);
 OrgLock = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),