@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.5

package/dist/roles/worker-role.js

@@ -8,6 +8,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Inject, Injectable } from "@nestjs/common";
+import { PluginScopeSyncProcessor } from "../catalog/scope-sync.js";
 import { ChannelsProcessor } from "../channels/channels.module.js";
 import { ChannelOutbound } from "../channels/outbound.js";
 import { TitleQueue } from "../conversations/titles.js";
@@ -24,8 +25,8 @@ import { UsageReporter } from "../runtime/usage-report.js";
 /**
  * The worker role's parts, driven by `KernelLifecycle` at fixed points of its start order and stop
  * phases (so they stay ordered after the extension load and before the extension host closes): the
- * queue consumers (runs, sub-agent runs, evals, maintenance, channel deliveries, `usage.report`,
- * titles) and the schedulers of the `@LockedCron` / `@LockedInterval` jobs. Provided only by
+ * queue consumers (runs, sub-agent runs, evals, maintenance, the plugin scope sync, channel
+ * deliveries, `usage.report`, titles) and the schedulers of the `@LockedCron` / `@LockedInterval` jobs. Provided only by
  * `WorkerModule`, so a process without the worker role has none of them.
  */
 let WorkerRole = class WorkerRole {
@@ -44,13 +45,14 @@ let WorkerRole = class WorkerRole {
     channelsProcessor;
     evalsProcessor;
     maintenanceProcessor;
+    scopeProcessor;
     /** The startup config (the roles). */
     config;
     /** The run worker was started: the runs phase drains it. */
     runsStarted = false;
     /** The eval worker was started: the runs phase drains it. */
     evalsStarted = false;
-    constructor(config, log, intervals, scheduledRuns, runWorker, evalWorker, usageReport, titles, channelOutbound, runsProcessor, subagentRunsProcessor, usageProcessor, titleProcessor, channelsProcessor, evalsProcessor, maintenanceProcessor) {
+    constructor(config, log, intervals, scheduledRuns, runWorker, evalWorker, usageReport, titles, channelOutbound, runsProcessor, subagentRunsProcessor, usageProcessor, titleProcessor, channelsProcessor, evalsProcessor, maintenanceProcessor, scopeProcessor) {
         this.log = log;
         this.intervals = intervals;
         this.scheduledRuns = scheduledRuns;
@@ -66,6 +68,7 @@ let WorkerRole = class WorkerRole {
         this.channelsProcessor = channelsProcessor;
         this.evalsProcessor = evalsProcessor;
         this.maintenanceProcessor = maintenanceProcessor;
+        this.scopeProcessor = scopeProcessor;
         this.config = config.get();
     }
     /**
@@ -92,6 +95,7 @@ let WorkerRole = class WorkerRole {
         }
         checkpoint();
         this.maintenanceProcessor.start();
+        this.scopeProcessor.start();
         this.channelOutbound.startWorker(this.channelsProcessor.worker);
         this.usageReport.startWorker(this.usageProcessor.worker);
         this.titles.startWorker(this.titleProcessor.worker);
@@ -101,6 +105,8 @@ let WorkerRole = class WorkerRole {
         // The gate opens: from here on ticks run; the runOnStart jobs run once now, in the background
         this.scheduledRuns.open();
         this.intervals.runStartJobs();
+        // Every plugin's scope converges once per worker start (a failed or lost sync is retried)
+        this.scopeProcessor.resync();
     }
     /**
      * Closes the start gate and stops the schedulers (no new tick; the runs in progress get the stop
@@ -117,9 +123,9 @@ let WorkerRole = class WorkerRole {
     drainEvals(budgetMs) {
         return this.evalsStarted ? this.evalWorker.close(budgetMs) : undefined;
     }
-    /** Closes the maintenance queue's worker. */
-    closeMaintenance() {
-        return this.maintenanceProcessor.worker.close();
+    /** Closes the maintenance queue's worker and the plugin scope sync's (it stops between pairs). */
+    async closeMaintenance() {
+        await Promise.all([this.maintenanceProcessor.worker.close(), this.scopeProcessor.close()]);
     }
 };
 WorkerRole = __decorate([
@@ -139,6 +145,7 @@ WorkerRole = __decorate([
     __param(12, Inject(TitleProcessor)),
     __param(13, Inject(ChannelsProcessor)),
     __param(14, Inject(EvalsProcessor)),
-    __param(15, Inject(MaintenanceProcessor))
+    __param(15, Inject(MaintenanceProcessor)),
+    __param(16, Inject(PluginScopeSyncProcessor))
 ], WorkerRole);
 export { WorkerRole };

package/dist/roles/worker.module.d.ts

@@ -5,7 +5,7 @@ import type { KernelConfig } from "../config/schema.js";
  * `worker`: the cron scheduler and the `@LockedInterval` scheduler (`KernelScheduleModule`, the one
  * place `ScheduleModule.forRoot` is imported), every fixed-period job (`@LockedCron` /
  * `@LockedInterval`, each once per tick across replicas), every queue consumer (`@Processor`: runs,
- * sub-agent runs, `usage.report`, titles, evals, maintenance, channel deliveries) and
+ * sub-agent runs, `usage.report`, titles, evals, maintenance, channel deliveries, the plugin scope sync) and
  * {@link WorkerRole}, which `KernelLifecycle` drives. A process without the worker role runs no cron
  * and no BullMQ worker (the queues' producers exist on every role).
  */

package/dist/roles/worker.module.js

@@ -10,18 +10,22 @@ import { BackgroundModule } from "../background/background.module.js";
 import { BackgroundTaskPollJob } from "../background/poll.job.js";
 import { CatalogModule } from "../catalog/catalog.module.js";
 import { CatalogJobs } from "../catalog/jobs.js";
+import { PlatformMigration } from "../catalog/platform-migration.js";
+import { PluginScopeWorkersModule } from "../catalog/scope-sync-workers.js";
 import { ChannelsModule, ChannelWorkersModule } from "../channels/channels.module.js";
 import { GatewayCheckJob } from "../channels/supervisor.js";
 import { AttachmentsModule } from "../conversations/attachments.module.js";
 import { AttachmentCleanupJob } from "../conversations/attachments.service.js";
 import { EventLogModule } from "../conversations/event-log.js";
 import { TitlesModule } from "../conversations/titles.js";
+import { LegacySandboxCleanupJob } from "../environments/legacy-cleanup.job.js";
 import { EvalWorkersModule } from "../evals/evals.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { PluginsReconcileJob } from "../extensions/lifecycle.js";
 import { KernelScheduleModule } from "../infra/schedule/schedule.module.js";
 import { DirectoryScanJob } from "../orgs/directory-sync.js";
 import { OffboardSweepJob } from "../orgs/offboarding.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
 import { OrgsModule } from "../orgs/orgs.module.js";
 import { MaintenanceModule } from "../runtime/maintenance.js";
 import { RuntimeWorkersModule } from "../runtime/run-processors.js";
@@ -40,7 +44,7 @@ import { WorkerRole } from "./worker-role.js";
  * `worker`: the cron scheduler and the `@LockedInterval` scheduler (`KernelScheduleModule`, the one
  * place `ScheduleModule.forRoot` is imported), every fixed-period job (`@LockedCron` /
  * `@LockedInterval`, each once per tick across replicas), every queue consumer (`@Processor`: runs,
- * sub-agent runs, `usage.report`, titles, evals, maintenance, channel deliveries) and
+ * sub-agent runs, `usage.report`, titles, evals, maintenance, channel deliveries, the plugin scope sync) and
  * {@link WorkerRole}, which `KernelLifecycle` drives. A process without the worker role runs no cron
  * and no BullMQ worker (the queues' producers exist on every role).
  */
@@ -55,6 +59,7 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 EvalWorkersModule.forRoot(config),
                 ChannelWorkersModule.forRoot(config),
                 MaintenanceModule,
+                PluginScopeWorkersModule,
                 // the domains the fixed-period jobs call
                 RuntimeModule,
                 UsageReportModule,
@@ -67,6 +72,7 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 ToolsModule,
                 CatalogModule,
                 OrgsModule,
+                OrgLockModule,
                 ExtensionsModule,
                 ChannelsModule,
             ],
@@ -76,9 +82,11 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 AttachmentCleanupJob,
                 StoragePurgeJob,
                 SandboxSweepJobs,
+                LegacySandboxCleanupJob,
                 BackgroundTaskPollJob,
                 ToolJobs,
                 CatalogJobs,
+                PlatformMigration,
                 DirectoryScanJob,
                 OffboardSweepJob,
                 PluginsReconcileJob,

package/dist/runtime/context/build.d.ts

@@ -54,8 +54,8 @@ export interface BuildModelRequestInput {
     model: ModelInfo;
     step: number;
     /**
-     * loop 已吸收到的位置（R31）：the largest seq of the absorbable events (`user_message` and
-     * `background_task_finished`, {@link isAbsorbable}) the loop took. 提供时：
+     * loop 已吸收到的位置（R31）：the largest seq of the absorbable events (`user_message`,
+     * `background_task_finished` and `subagent_delivery`, {@link isAbsorbable}) the loop took. 提供时：
      * - seq 大于它的可吸收事件不进请求（运行中途到达、尚未被吸收的插话或后台任务结束，由后续步骤吸收或触发下一轮）；
      * - 每个可吸收事件放在**吸收它的那次模型调用**的位置：日志里第一个 `request.absorbedUpToSeq`
      *   不小于它的 `model_call` 之前（没有该字段的旧 model_call 视为吸收了它之前的全部消息），
@@ -232,8 +232,10 @@ export declare function summaryText(summary: string): string;
  * - messages：最近一条摘要（若有）作为首条 user 消息，其后按 seq 回放 `coversUpToSeq` 之后的
  *   `user_message` / `assistant_message`（content 原样，含 opaque；aborted 的也回放；媒体引用按
  *   {@link resolveMedia} 换成 base64 或文字占位）/ `reminder`
- *   （`role: "system"`，放在它所在的位置）/ `background_task_finished`（`role: "system"`, the text of
- *   {@link renderBackgroundFinished}, placed like a user_message）；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
+ *   （`role: "system"`，放在它所在的位置）/ `tools_changed` (`role: "system"`, the text of {@link toolsChangedText}, at its position) /
+ *   `background_task_finished`（`role: "system"`, the text of
+ *   {@link renderBackgroundFinished}, placed like a user_message）/ `subagent_delivery` (likewise,
+ *   the text of {@link renderSubagentDelivery})；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
  *   （同一步的多个结果合并，按该 assistant 消息里 tool_call 的顺序；找不到对应调用的结果不进请求）。
  *   其他事件不进请求。提供 `absorbedUpToSeq` 时，
  *   尚未被吸收的可吸收事件不进请求，运行中途到达的放在吸收它的调用处（见 BuildModelRequestInput）。

package/dist/runtime/context/build.js

@@ -3,8 +3,10 @@ import { MEDIA_LIMITS, } from "@capybara-hq/plugin-sdk";
 import { renderBackgroundFinished } from "../../background/render.js";
 import { isAbsorbable, } from "../../conversations/events.js";
 import { catalogText, isAlwaysLoaded } from "../../tools/builtins/tool-search.js";
+import { renderSubagentDelivery } from "../subagents/render.js";
 import { LEGACY_CATALOG_HEADER, LEGACY_SKILL_TEXTS, usesLegacyToolNames } from "./legacy-text.js";
 import { invokedSkillNames, invokedSkillsText, SKILL_TEXTS, skillsCatalogEvents, snapshotChangeText, snapshotCurrentText, snapshotSystemText, systemSkillsCatalog, } from "./skills.js";
+import { toolsChangedText } from "./tool-changes.js";
 /**
  * 平台行为规范（模型可见，英文）。短而通用（spec 6 原则 5）；不放时间戳、会话 ID 等会变化的内容，
  * 保证同一 agent 版本在所有会话中 system 前缀一致、可命中提示词缓存。改动它会让所有缓存失效。
@@ -332,8 +334,10 @@ export function summaryText(summary) {
  * - messages：最近一条摘要（若有）作为首条 user 消息，其后按 seq 回放 `coversUpToSeq` 之后的
  *   `user_message` / `assistant_message`（content 原样，含 opaque；aborted 的也回放；媒体引用按
  *   {@link resolveMedia} 换成 base64 或文字占位）/ `reminder`
- *   （`role: "system"`，放在它所在的位置）/ `background_task_finished`（`role: "system"`, the text of
- *   {@link renderBackgroundFinished}, placed like a user_message）；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
+ *   （`role: "system"`，放在它所在的位置）/ `tools_changed` (`role: "system"`, the text of {@link toolsChangedText}, at its position) /
+ *   `background_task_finished`（`role: "system"`, the text of
+ *   {@link renderBackgroundFinished}, placed like a user_message）/ `subagent_delivery` (likewise,
+ *   the text of {@link renderSubagentDelivery})；`tool_result` 事件还原为紧随其 assistant 消息之后的一条 user 消息
  *   （同一步的多个结果合并，按该 assistant 消息里 tool_call 的顺序；找不到对应调用的结果不进请求）。
  *   其他事件不进请求。提供 `absorbedUpToSeq` 时，
  *   尚未被吸收的可吸收事件不进请求，运行中途到达的放在吸收它的调用处（见 BuildModelRequestInput）。
@@ -381,7 +385,7 @@ export function buildModelRequest(input) {
             lastCall = absorbedBy(e);
     }
     /**
-     * 第 i 个事件（可吸收事件：user_message / background_task_finished）的放置方式：
+     * 第 i 个事件（可吸收事件：user_message / background_task_finished / subagent_delivery）的放置方式：
      * - `inline`：在吸收它的调用（之后第一个 `absorbedBy ≥ seq` 的 model_call，或本次请求）之前，
      *   没有「由未吸收它的调用生成的回复」→ 按 seq 原位回放（常规情况，与不提供 absorbedUpToSeq 时一致）；
      * - `deferred`：它之后有非空 assistant_message 是由一次没有吸收它的 model_call 生成的（它在那一步
@@ -467,10 +471,20 @@ export function buildModelRequest(input) {
     };
     /** 被某次模型调用跳过（运行中途到达）、尚未被吸收的可吸收事件，按 seq 升序。 */
     let deferred = [];
-    /** An absorbable event as a request message: a user turn, or a finished task's system text. */
-    const absorbableMessage = (e) => e.type === "user_message"
-        ? { role: "user", content: userBlocks(e) }
-        : { role: "system", content: renderBackgroundFinished(e.payload) };
+    /**
+     * An absorbable event as a request message: a user turn, or the system text of a finished task
+     * or a sub-agent's delivery.
+     */
+    const absorbableMessage = (e) => {
+        switch (e.type) {
+            case "user_message":
+                return { role: "user", content: userBlocks(e) };
+            case "background_task_finished":
+                return { role: "system", content: renderBackgroundFinished(e.payload) };
+            case "subagent_delivery":
+                return { role: "system", content: renderSubagentDelivery(e.payload) };
+        }
+    };
     /**
      * 把已被吸收（seq ≤ upTo）的延后消息按 seq 顺序放进 messages，插在末尾连续的 system 提醒之前
      * （若有）。这样某一步自己写在 model_call 之前的提醒（含收尾提醒）仍排在它所跟随的用户消息之后，
@@ -575,6 +589,11 @@ export function buildModelRequest(input) {
                 messages.push({ role: "system", content: e.payload.text });
                 reminderSeqs.push(e.seq);
                 break;
+            // the tool set changed since the previous request (tool naming spec §9.1); one covered by
+            // the summary is dropped: the request's tool list is current anyway
+            case "tools_changed":
+                messages.push({ role: "system", content: toolsChangedText(e.payload) });
+                break;
             // hook_denied is not model-visible: the model sees only the denied tool call's tool_result
             // (and nothing for a denied model request), so request building skips it
             case "hook_denied":

package/dist/runtime/context/claude-tools.d.ts

@@ -8,6 +8,7 @@
  * run writes a new snapshot announcing the new map, and old snapshots keep their text (phase C
  * changed the Task / Agent line, sub-agents spec §16.5; the tool-naming change shortened it to the
  * Claude Code names, spec 2026-10-29 §6; background Bash made TaskOutput and TaskStop available,
- * spec 2026-11-05 §4.4; WebFetch and WebSearch joined the same-name list with the web tools).
+ * spec 2026-11-05 §4.4; WebFetch and WebSearch joined the same-name list with the web tools;
+ * SendMessage joined it when it replaced `Agent` with `resume`, agent map spec §4.2).
  */
 export declare const CLAUDE_CODE_TOOL_MAP: string;

package/dist/runtime/context/claude-tools.js

@@ -8,17 +8,18 @@
  * run writes a new snapshot announcing the new map, and old snapshots keep their text (phase C
  * changed the Task / Agent line, sub-agents spec §16.5; the tool-naming change shortened it to the
  * Claude Code names, spec 2026-10-29 §6; background Bash made TaskOutput and TaskStop available,
- * spec 2026-11-05 §4.4; WebFetch and WebSearch joined the same-name list with the web tools).
+ * spec 2026-11-05 §4.4; WebFetch and WebSearch joined the same-name list with the web tools;
+ * SendMessage joined it when it replaced `Agent` with `resume`, agent map spec §4.2).
  */
 export const CLAUDE_CODE_TOOL_MAP = [
     "Some skills in this conversation were written for Claude Code. Its tools Bash, Read, Write, Edit,",
-    "Glob, Grep, Skill, AskUserQuestion, ToolSearch, Agent, WebFetch and WebSearch have the same names here, when they are",
+    "Glob, Grep, Skill, AskUserQuestion, ToolSearch, Agent, SendMessage, WebFetch and WebSearch have the same names here, when they are",
     "in your tools. For the others:",
     "- MultiEdit -> several Edit calls",
     "- TodoWrite -> plugin__todo__write when it is in your tools; otherwise keep the task list in your replies",
-    "- Task -> Agent; SendMessage to a sub-agent -> Agent with resume; model names haiku / sonnet / opus -> fast / standard / capable",
+    "- Task -> Agent; model names haiku / sonnet / opus -> fast / standard / capable",
     "- TaskOutput -> TaskOutput, TaskStop -> TaskStop",
     "- Any other tool a skill names (for example NotebookEdit, EnterWorktree) -> not available unless one of your tools does the same job",
     // biome-ignore lint/suspicious/noTemplateCurlyInString: the literal Claude Code variable the model reads
-    "The sandbox tools exist only when this agent has a sandbox; without them a skill's scripts cannot run. A path such as ${CLAUDE_PLUGIN_ROOT}/skills/<name>/... means /skills/<name>/... after Skill has copied that skill into the sandbox.",
+    "The sandbox tools exist only when this agent has a sandbox; without them a skill's scripts cannot run. A path such as ${CLAUDE_PLUGIN_ROOT}/skills/<name>/... means /skills/<name>@<version-id>/... after Skill has copied that skill into the sandbox.",
 ].join("\n");

package/dist/runtime/context/compaction.js

@@ -1,5 +1,7 @@
 import { renderBackgroundFinished } from "../../background/render.js";
+import { renderSubagentDelivery } from "../subagents/render.js";
 import { latestSummary } from "./build.js";
+import { toolsChangedText } from "./tool-changes.js";
 /** 压缩请求的标记：放在 system 中，便于识别（model-fake 据此返回摘要）。 */
 export const COMPACTION_MARKER = "CAPYBARA_COMPACTION";
 /** 压缩请求的输出上限。 */
@@ -112,9 +114,16 @@ function transcriptLine(e) {
         }
         case "reminder":
             return `System reminder: ${e.payload.text}`;
+        // a tool set change is a system message of the request (build.ts); kept in the transcript so
+        // the summary does not carry an earlier "I have no such tool" forward as current
+        case "tools_changed":
+            return `System reminder: ${toolsChangedText(e.payload)}`;
         // a finished background task is a system message of the request (build.ts)
         case "background_task_finished":
             return `System reminder: ${renderBackgroundFinished(e.payload)}`;
+        // a sub-agent's delivery is a system message of the request (build.ts)
+        case "subagent_delivery":
+            return `System reminder: ${renderSubagentDelivery(e.payload)}`;
         // phase D: a forked skill's report is user content of the request (build.ts)
         case "skill_fork_result":
             return `User: ${e.payload.text}`;

package/dist/runtime/context/reminders.d.ts

@@ -3,3 +3,5 @@
  * 调用方先把它写成 `reminder` 事件，再由 `buildModelRequest` 按事件重建进请求。
  */
 export declare function turnLimitReminder(step: number, maxSteps: number): string | null;
+/** 所用模型不支持工具（`capabilities.tools` 为 false）时的提醒（模型可见，英文）。 */
+export declare const TOOLS_UNSUPPORTED_REMINDER = "Tools are unavailable for this model. Answer without calling tools.";

package/dist/runtime/context/reminders.js

@@ -9,3 +9,5 @@ export function turnLimitReminder(step, maxSteps) {
         return null;
     return `You are close to the step limit for this turn (step ${step} of ${maxSteps}). Wrap up and give the user your best answer now.`;
 }
+/** 所用模型不支持工具（`capabilities.tools` 为 false）时的提醒（模型可见，英文）。 */
+export const TOOLS_UNSUPPORTED_REMINDER = "Tools are unavailable for this model. Answer without calling tools.";

package/dist/runtime/context/skills.js

@@ -81,11 +81,18 @@ export function sameSnapshot(a, b) {
 function catalogChanges(prev, next, pinnedIds) {
     const before = new Map(prev.map((s) => [s.id, s]));
     const after = new Map(next.map((s) => [s.id, s]));
-    const added = next.filter((s) => !before.has(s.id));
-    const removed = prev.filter((s) => !after.has(s.id));
+    // A skill renamed under its id (the platform components migration renames a clashing org skill)
+    // reads as its old name removed and its new name added: the model calls skills by name.
+    const renamed = (s, other) => {
+        const o = other.get(s.id);
+        return o !== undefined && o.name !== s.name;
+    };
+    const added = next.filter((s) => !before.has(s.id) || renamed(s, before));
+    const removed = prev.filter((s) => !after.has(s.id) || renamed(s, after));
     const updated = next.filter((s) => {
         const p = before.get(s.id);
         return (p !== undefined &&
+            p.name === s.name &&
             !pinnedIds?.has(s.id) &&
             (p.version !== s.version || p.description !== s.description || p.source !== s.source));
     });

package/dist/runtime/context/tool-changes.d.ts

@@ -0,0 +1,27 @@
+import type { ConversationEvent, EventPayload } from "../../conversations/events.js";
+/**
+ * Tool set changes mid-conversation (tool naming spec §9.1). The kernel resolves the tools on every
+ * step, so an extension switched on in the org, a connector set up or a sub-agent roster added
+ * changes the next request's tool list; earlier answers in the history ("I have no web search")
+ * would still contradict it. A step whose resolved set differs from the one the previous request
+ * offered logs a `tools_changed` event before its request; request building renders it at its
+ * position as a system message ({@link toolsChangedText}).
+ */
+export type ToolsChange = Pick<EventPayload<"tools_changed">, "added" | "removed">;
+/**
+ * The tool set the conversation's previous model request offered, from the log alone: the last
+ * `model_call`'s `tools` and `catalog` keys (with `ToolSearch` the catalog holds the deferred
+ * tools, so the union is the whole resolved set), then any `tools_changed` logged after it (a
+ * step that logged its change and crashed before its request: the change is not logged twice).
+ * Skipped: a `model_call` without recorded tools (older logs) and a call whose tools were left out
+ * because its model has no tool support (empty, with that step's unsupported reminder): those say
+ * nothing about the resolved set. Null when no request offered a known set yet.
+ */
+export declare function previousToolSet(events: readonly ConversationEvent[]): Set<string> | null;
+/**
+ * The change from the previous request's tool set to `current` (sorted names), or null: before
+ * the conversation's first request (its list is the baseline) and when nothing changed.
+ */
+export declare function toolSetChange(events: readonly ConversationEvent[], current: readonly string[]): ToolsChange | null;
+/** The model-visible text of a `tools_changed` event (English). */
+export declare function toolsChangedText(change: ToolsChange): string;

package/dist/runtime/context/tool-changes.js

@@ -0,0 +1,60 @@
+import { TOOLS_UNSUPPORTED_REMINDER } from "./reminders.js";
+/**
+ * The tool set the conversation's previous model request offered, from the log alone: the last
+ * `model_call`'s `tools` and `catalog` keys (with `ToolSearch` the catalog holds the deferred
+ * tools, so the union is the whole resolved set), then any `tools_changed` logged after it (a
+ * step that logged its change and crashed before its request: the change is not logged twice).
+ * Skipped: a `model_call` without recorded tools (older logs) and a call whose tools were left out
+ * because its model has no tool support (empty, with that step's unsupported reminder): those say
+ * nothing about the resolved set. Null when no request offered a known set yet.
+ */
+export function previousToolSet(events) {
+    const unsupported = new Set();
+    for (const e of events) {
+        if (e.type === "reminder" && e.payload.text === TOOLS_UNSUPPORTED_REMINDER) {
+            unsupported.add(`${e.runId ?? ""}\u0000${e.payload.step}`);
+        }
+    }
+    let known = null;
+    for (const e of events) {
+        if (e.type === "model_call") {
+            const { tools, catalog } = e.payload.request;
+            if (tools === undefined)
+                continue;
+            const keys = [...tools, ...(catalog ?? [])].map((t) => t.key);
+            if (keys.length === 0 && unsupported.has(`${e.runId ?? ""}\u0000${e.payload.step}`))
+                continue;
+            known = new Set(keys);
+        }
+        else if (e.type === "tools_changed" && known !== null) {
+            for (const k of e.payload.removed)
+                known.delete(k);
+            for (const k of e.payload.added)
+                known.add(k);
+        }
+    }
+    return known;
+}
+/**
+ * The change from the previous request's tool set to `current` (sorted names), or null: before
+ * the conversation's first request (its list is the baseline) and when nothing changed.
+ */
+export function toolSetChange(events, current) {
+    const before = previousToolSet(events);
+    if (before === null)
+        return null;
+    const now = new Set(current);
+    const added = [...now].filter((k) => !before.has(k)).sort();
+    const removed = [...before].filter((k) => !now.has(k)).sort();
+    return added.length === 0 && removed.length === 0 ? null : { added, removed };
+}
+/** The model-visible text of a `tools_changed` event (English). */
+export function toolsChangedText(change) {
+    const parts = ["Your tools changed."];
+    if (change.added.length > 0)
+        parts.push(`Now available: ${change.added.join(", ")}.`);
+    if (change.removed.length > 0)
+        parts.push(`No longer available: ${change.removed.join(", ")}.`);
+    parts.push("Use the current tool list; it replaces anything said earlier in this conversation about which tools you have.");
+    return parts.join(" ");
+}

package/dist/runtime/hook-calls.js

@@ -112,6 +112,8 @@ export function hookDeniedAudit(at, payload, denial) {
                 : {}),
             // M-1: the named plugin is enabled but not loaded on the replica that handled the call
             ...(denial.notLoaded ? { notLoaded: true } : {}),
+            // layering spec A §6: the named plugin's effective config is not valid in the organization
+            ...(denial.needsConfig ? { needsConfig: true } : {}),
         },
     };
 }

package/dist/runtime/langgraph-loop.d.ts

@@ -32,7 +32,9 @@ export interface LangGraphLoopHooks {
  * worker 崩溃后由其他副本从最近的 checkpoint 续跑（spec 4.4、Review Focus 1）。
  *
  * 图：`prepare → model →（tool_use）tools → prepare …`；prepare 发现步数超过上限 → `wrapUp` → 结束；
- * prepare finding the deadline passed, or (a sub-agent's run) its parent's token budget used up → end;
+ * prepare finding the deadline passed → end; a sub-agent's run finding its tree's token budget used
+ * up → `wrapUp` (one tool-less call that hands back its findings) → end, or end at once when the
+ * run has made no step yet (nothing new to report);
  * 模型中止或正常结束 → 结束。`durability: "sync"`：每个节点的 checkpoint 在下一个节点开始前落库。
  *
  * 幂等：`runModelStep` / `runFinalWrapUp` 按 (runId, step) 幂等，续跑重新执行 model 节点时若回复已在日志里，

package/dist/runtime/langgraph-loop.js

@@ -1,15 +1,20 @@
 import { Annotation, END, START, StateGraph } from "@langchain/langgraph";
 import { MediaCache } from "./media-cache.js";
 import { runFinalWrapUp, runModelStep, } from "./model-call.js";
-import { subagentBudgetUsedUp } from "./subagents/limits.js";
+import { budgetRunOf, subagentBudgetUsedUp } from "./subagents/limits.js";
 import { isForkInvocation } from "./subagents/skill-fork.js";
 /**
  * 图状态：只记录进度，消息每步从事件日志重建（runModelStep 自己读日志），checkpoint 很小。
  * - `step`：当前（最近一次进入的）步骤编号，prepare 节点 +1；
- * - `consumedUpToSeq`：已吸收的最大可吸收事件 seq（user_message / background_task_finished; a
- *   finish TaskOutput or TaskStop already reported is absorbed like any other, rendered short）；
+ * - `consumedUpToSeq`：已吸收的最大可吸收事件 seq（user_message / background_task_finished /
+ *   subagent_delivery; a finish TaskOutput or TaskStop already reported is absorbed like any
+ *   other, rendered short）；
  * - `lastStopReason`：最近一步模型调用的停止原因；
  * - `outcome`：图的结束方式（在决定结束的节点里写入，续跑已结束的图时直接读出，不依赖当前时间）。
+ * - `budgetWrapUp`: set when a sub-agent's tree used its token budget after the run made a step: the
+ *   run goes to the `wrapUp` node for one tool-less call that hands back what it found, then ends
+ *   with `budget` (sub-agents spec §8.3). Null otherwise (the step limit routes there by `step`; a channel cannot share the
+ *   node's name).
  *
  * 所有 channel 都是默认的 LastValue（不用实验性的 DeltaChannel，也没有子图）：
  * 每个 checkpoint 自带完整状态，`pruneToLatest` 之后仍能独立还原（R19）。
@@ -19,8 +24,15 @@ const LoopState = Annotation.Root({
     consumedUpToSeq: Annotation(),
     lastStopReason: Annotation(),
     outcome: Annotation(),
+    budgetWrapUp: Annotation(),
 });
-const INITIAL = { step: 0, consumedUpToSeq: 0, lastStopReason: null, outcome: null };
+const INITIAL = {
+    step: 0,
+    consumedUpToSeq: 0,
+    lastStopReason: null,
+    outcome: null,
+    budgetWrapUp: null,
+};
 /**
  * prepare 节点在停机信号下抛出：本次 invoke 以它结束，checkpoint 停在 prepare 之前
  * （LangGraph 把出错的任务记为该 checkpoint 上的 pending error，`invoke(null)` 续跑时重新执行它）。
@@ -56,7 +68,9 @@ class LoopSuspended extends Error {
  * worker 崩溃后由其他副本从最近的 checkpoint 续跑（spec 4.4、Review Focus 1）。
  *
  * 图：`prepare → model →（tool_use）tools → prepare …`；prepare 发现步数超过上限 → `wrapUp` → 结束；
- * prepare finding the deadline passed, or (a sub-agent's run) its parent's token budget used up → end;
+ * prepare finding the deadline passed → end; a sub-agent's run finding its tree's token budget used
+ * up → `wrapUp` (one tool-less call that hands back its findings) → end, or end at once when the
+ * run has made no step yet (nothing new to report);
  * 模型中止或正常结束 → 结束。`durability: "sync"`：每个节点的 checkpoint 在下一个节点开始前落库。
  *
  * 幂等：`runModelStep` / `runFinalWrapUp` 按 (runId, step) 幂等，续跑重新执行 model 节点时若回复已在日志里，
@@ -130,6 +144,7 @@ export class LangGraphLoop {
             accountId: ctx.triggerAccountId,
             ...(ctx.conversationKind !== undefined && { conversationKind: ctx.conversationKind }),
             ...(ctx.parent !== undefined && { parentRunId: ctx.parent.runId, parent: ctx.parent }),
+            ...(ctx.subagent === true && { subagent: true }),
         });
         const deps = this.stepDeps;
         const hooks = this.hooks;
@@ -140,11 +155,14 @@ export class LangGraphLoop {
             // 否则 consumed_seq 越过它们、也不会再起新一轮。
             if (timedOut())
                 return { outcome: "max_duration" };
-            // a sub-agent stops before its next request once its parent run's children used their token
-            // budget (spec §8.3; fresh read, in-flight requests of siblings may overshoot by one each)
+            // a sub-agent stops before its next request once its tree used its token budget (spec §8.3,
+            // agent map §6: on the budget run; fresh read, in-flight requests of others may overshoot by
+            // one each). A run that made a step hands back what it found in one final tool-less call
+            // (one more over); a run stopped before its first step (a wake of a stopped tree) has
+            // nothing new to report and ends at once.
             if (ctx.parent !== undefined &&
-                (await subagentBudgetUsedUp(deps.db, deps.config, ctx.orgId, ctx.parent.runId))) {
-                return { outcome: "budget" };
+                (await subagentBudgetUsedUp(deps.db, deps.config, ctx.orgId, ctx.parent.budgetRunId ?? (await budgetRunOf(deps.db, ctx.parent.runId))))) {
+                return s.step > 0 ? { step: s.step + 1, budgetWrapUp: true } : { outcome: "budget" };
             }
             let consumed = s.consumedUpToSeq;
             // the run's first prepare (also when it runs again after a suspend on its fork's sub-agent)
@@ -173,8 +191,10 @@ export class LangGraphLoop {
         const model = async (s) => {
             const r = await runModelStep(deps, input(s.step, s.consumedUpToSeq));
             await hooks.afterModelStep?.(ctx.runId, s.step, r);
+            // budget used up by a compaction call before the step's request: hand back in the wrap-up,
+            // at this step (it logged no request)
             if (r.budget)
-                return { outcome: "budget" };
+                return { budgetWrapUp: true };
             if (r.aborted) {
                 return { lastStopReason: "aborted", outcome: timedOut() ? "max_duration" : "aborted" };
             }
@@ -218,11 +238,12 @@ export class LangGraphLoop {
             return {};
         };
         const wrapUp = async (s) => {
-            const r = await runFinalWrapUp(deps, input(s.step, s.consumedUpToSeq));
+            const budget = s.budgetWrapUp === true;
+            const r = await runFinalWrapUp(deps, input(s.step, s.consumedUpToSeq), budget ? "budget" : "max_steps");
             await hooks.afterModelStep?.(ctx.runId, s.step, r);
             return {
                 lastStopReason: r.aborted ? "aborted" : r.stopReason,
-                outcome: r.budget ? "budget" : r.aborted && !timedOut() ? "aborted" : "max_steps",
+                outcome: r.aborted && !timedOut() ? "aborted" : budget || r.budget ? "budget" : "max_steps",
             };
         };
         return new StateGraph(LoopState)
@@ -235,12 +256,9 @@ export class LangGraphLoop {
             // (aborted / completed: a fork invocation's run ended in its first prepare, phase D)
             if (s.outcome !== null)
                 return END;
-            return s.step > ctx.limits.maxSteps ? "wrapUp" : "model";
+            return s.budgetWrapUp === true || s.step > ctx.limits.maxSteps ? "wrapUp" : "model";
         }, ["model", "wrapUp", END])
-            .addConditionalEdges("model", (s) => (s.outcome === null ? "tools" : END), [
-            "tools",
-            END,
-        ])
+            .addConditionalEdges("model", (s) => (s.budgetWrapUp === true ? "wrapUp" : s.outcome === null ? "tools" : END), ["tools", "wrapUp", END])
             .addEdge("tools", "prepare")
             .addEdge("wrapUp", END)
             .compile({ checkpointer: this.saver });