@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/models/purposes.js

@@ -14,7 +14,7 @@ import { ModelRef, paramIssues } from "../agents/definition.js";
 import { ApiError } from "../errors.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -27,9 +27,11 @@ import { ProviderListError, ProviderRegistry } from "../runtime/providers.js";
 /**
  * 模型用途映射（C9）：内核与插件按「用途」取模型，不在代码里写死模型。
  * - 用途 = 内核用途 {@link KERNEL_PURPOSES}（目前只有评委 `eval`），或已加载插件 `permissions.models` 声明的；
- * - 映射 = 部署默认（`org_id` 为 null，企业管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
+ * - 映射 = 部署默认（`org_id` 为 null，超级管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
  *   生效的映射先取组织覆盖、再取部署默认，都没有 → `model.unconfigured`；
- * - 目标模型按部署范围解析（与运行时一致），参数按目标模型自己的声明严格校验；不做模型白名单；
+ * - a target's kind must equal the purpose's kind; an org's override must be enabled in the org on
+ *   save (a deployment default: not disabled on the platform), and an effective target disabled in
+ *   the org (by either layer) counts as unconfigured there (spec B §5.3)；参数按目标模型自己的声明严格校验；
  * - 每次都查 PG，不在进程内缓存（多副本下改映射立即生效）。`ctx.models` 仍预留，插件暂不能调用。
  */
 /**
@@ -49,19 +51,28 @@ export const KERNEL_PURPOSES = [
     {
         purpose: "subagent_fast",
         kind: "chat",
-        label: { zh: "子代理：快速", en: "Sub-agent: fast" },
+        label: { zh: "子智能体：快速", en: "Sub-agent: fast" },
     },
     {
         purpose: "subagent_standard",
         kind: "chat",
-        label: { zh: "子代理：标准", en: "Sub-agent: standard" },
+        label: { zh: "子智能体：标准", en: "Sub-agent: standard" },
     },
     {
         purpose: "subagent_capable",
         kind: "chat",
-        label: { zh: "子代理：最强", en: "Sub-agent: capable" },
+        label: { zh: "子智能体：最强", en: "Sub-agent: capable" },
     },
 ];
+/** {@link PurposeListing}s of `views`, the display names read in one call. */
+export async function withDeclaredByNames(views, names) {
+    const plugins = views.map((v) => v.declaredBy).filter((d) => d !== "kernel");
+    const found = await names.many(plugins);
+    return views.map((v) => ({
+        ...v,
+        declaredByName: v.declaredBy === "kernel" ? null : (found.get(v.declaredBy) ?? null),
+    }));
+}
 /** `PUT …/model-purposes/:purpose` 的 body：设映射，或 `target: null` 清除。 */
 export const PURPOSE_PUT = z
     .object({
@@ -180,11 +191,17 @@ let ModelPurposesService = class ModelPurposesService {
     async list(orgId) {
         return this.views(this.declared(), orgId);
     }
-    /** 校验目标：模型可解析（部署范围）、参数按它的声明严格通过。 */
-    async check(target) {
+    /**
+     * 校验目标：模型可解析且启用（an org's override for the org, a deployment default in the
+     * platform view）、its kind is the purpose's `kind`、参数按它的声明严格通过。
+     */
+    async check(orgId, target, kind) {
         let info;
         try {
-            ({ info } = await this.providers.resolve(target.model));
+            info =
+                orgId === null
+                    ? await this.providers.platformInfo(target.model, { kind: "callable" })
+                    : (await this.providers.resolve(orgId, target.model, { kind: "callable" })).info;
         }
         catch (e) {
             if (e instanceof ProviderListError)
@@ -194,6 +211,14 @@ let ModelPurposesService = class ModelPurposesService {
             }
             throw e;
         }
+        if (info.kind !== kind) {
+            throw invalid([
+                {
+                    path: "target.model",
+                    message: `this purpose needs ${kind === "embedding" ? "an" : "a"} ${kind} model, not ${info.kind}`,
+                },
+            ]);
+        }
         const issues = paramIssues("target.params", info.parameters, target.params);
         if (issues.length > 0)
             throw invalid(issues);
@@ -201,12 +226,12 @@ let ModelPurposesService = class ModelPurposesService {
     async set(orgId, purpose, target, actor, actorTokenId) {
         const decl = this.find(purpose);
         if (target)
-            await this.check(target);
+            await this.check(orgId, target, decl.kind);
         await this.write(orgId, purpose, target, actor, actorTokenId);
         const [view] = await this.views([decl], orgId ?? undefined);
         return view;
     }
-    /** The mapping write of {@link set}, under the enterprise admin or org lock. */
+    /** The mapping write of {@link set}, under the super admin or org lock. */
     async write(orgId, purpose, target, actor, actorTokenId) {
         if (orgId === null)
             await this.adminLock.lockAndAuthorize(actor);
@@ -243,7 +268,7 @@ let ModelPurposesService = class ModelPurposesService {
             detail: { scope: orgId === null ? "deployment" : "org", target },
         });
     }
-    /** 设置（或 `null` 清除）部署默认；只有企业管理员（事务内复核）。 */
+    /** 设置（或 `null` 清除）部署默认；只有超级管理员（事务内复核）。 */
     setDefault(purpose, target, actor, actorTokenId) {
         return this.set(null, purpose, target, actor, actorTokenId);
     }
@@ -251,12 +276,33 @@ let ModelPurposesService = class ModelPurposesService {
     setOrg(orgId, purpose, target, actor, actorTokenId) {
         return this.set(orgId, purpose, target, actor, actorTokenId);
     }
-    /** 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。 */
+    /**
+     * 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。
+     * An effective target the org cannot use counts as unconfigured there (spec B §5.3): checked in
+     * the registry's org view, so a model the platform or the org disabled, a provider off or needing
+     * configuration in the org, a model gone from the org's list or of another kind than the purpose
+     * all give `model.unconfigured`. A provider whose list fails (`ProviderListError`) keeps the
+     * mapping: the call that follows resolves the model again and fails there, retryably, so paths
+     * that only read the mapping (sub-agent tiers, eval start, `ctx.models.describe`) do not fail on
+     * a transient list error.
+     */
     async resolve(orgId, purpose) {
-        const [view] = await this.views([this.find(purpose)], orgId);
+        const decl = this.find(purpose);
+        const [view] = await this.views([decl], orgId);
         if (!view?.effective) {
             throw new ApiError("model.unconfigured", `No model is configured for the "${purpose}" purpose`);
         }
+        try {
+            await this.providers.resolve(orgId, view.effective.model, { kind: decl.kind });
+        }
+        catch (e) {
+            if (e instanceof ProviderListError)
+                return view.effective;
+            if (e instanceof ApiError && e.code === "agent.model_unavailable") {
+                throw new ApiError("model.unconfigured", `The model configured for the "${purpose}" purpose is not available in this organization`);
+            }
+            throw e;
+        }
         return view.effective;
     }
     /** The target a {@link chat} call on `purpose` uses: the mapping, else `fallback` when unmapped. */
@@ -277,7 +323,7 @@ let ModelPurposesService = class ModelPurposesService {
      */
     async chatLimits(orgId, purpose, opts = {}) {
         const target = await this.chatTarget(orgId, purpose, opts.fallback);
-        const { info } = await this.providers.resolve(target.model);
+        const { info } = await this.providers.resolve(orgId, target.model);
         return { contextWindow: info.contextWindow, maxOutputTokens: info.maxOutputTokens };
     }
     /**
@@ -292,7 +338,7 @@ let ModelPurposesService = class ModelPurposesService {
      */
     async chat(orgId, purpose, req, signal, opts = {}) {
         const target = await this.chatTarget(orgId, purpose, opts.fallback);
-        const { provider, info } = await this.providers.resolve(target.model);
+        const { provider, info } = await this.providers.resolve(orgId, target.model);
         const request = {
             ...req,
             model: info.id,
@@ -332,7 +378,7 @@ ModelPurposesService = __decorate([
     __param(2, Inject(KernelConfigService)),
     __param(3, Inject(ProviderRegistry)),
     __param(4, Inject(TransactionHost)),
-    __param(5, Inject(EnterpriseAdminLock)),
+    __param(5, Inject(SuperAdminLock)),
     __param(6, Inject(OrgLock))
 ], ModelPurposesService);
 export { ModelPurposesService };

package/dist/orgs/directory-sync.d.ts

@@ -1,5 +1,6 @@
 import type { Queue } from "bullmq";
 import type { Redis } from "ioredis";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { OrgExtensionConfigs } from "../extensions/org-config.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { ExternalIdentities } from "../identity/external.js";
@@ -35,9 +36,11 @@ export declare const DIRECTORY_MAX_PAGES = 10000;
 export type DirectorySyncTrigger = "schedule" | "changed" | "manual";
 /**
  * 不同步的原因（陈旧任务、插件已停用 / 配置不再有效、组织已删除、另一同步在跑；`not_configured`：插件的
- * `Directory.configured` 说这份组织配置没配好通讯录，Ruling A28，静默跳过）。
+ * `Directory.configured` 说这份组织配置没配好通讯录，Ruling A28，静默跳过）。`needs_config`: the
+ * extension's effective deployment config for the org is not valid (layering spec A §6): skipped
+ * silently like `not_configured`; the org admin sees the extension as needing configuration.
  */
-export type DirectorySkipReason = "plugin_unavailable" | "org_not_found" | "not_enabled" | "config_invalid" | "not_configured" | "locked";
+export type DirectorySkipReason = "plugin_unavailable" | "org_not_found" | "not_enabled" | "config_invalid" | "not_configured" | "needs_config" | "locked";
 export type DirectorySyncResult = {
     status: "skipped";
     reason: DirectorySkipReason;
@@ -122,18 +125,23 @@ export declare class DirectorySync {
     private readonly redis;
     private readonly registry;
     private readonly orgConfigs;
+    private readonly effective;
     private readonly external;
     private readonly offboarding;
     private readonly orgLock;
     private readonly queue;
     readonly lockService: LockService;
     readonly log: KernelLogger;
-    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, external: Pick<ExternalIdentities, "resolve">, offboarding: Pick<Offboarding, "offboard" | "afterOffboard">, orgLock: OrgLock, queue: Pick<Queue, "add">, lockService: LockService, log: KernelLogger);
+    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, effective: Pick<EffectiveConfigs, "get">, external: Pick<ExternalIdentities, "resolve">, offboarding: Pick<Offboarding, "offboard" | "afterOffboard">, orgLock: OrgLock, queue: Pick<Queue, "add">, lockService: LockService, log: KernelLogger);
     /** A `directory-sync` job (dispatched by `MaintenanceProcessor`). */
     runSyncJob(data: SyncJobData): Promise<void>;
     /** 插件提供的 `directory@1`；未加载或不提供时 undefined。 */
     private provider;
-    /** The org exists, the extension provides a directory, is enabled in the org and its org config satisfies the schema (reuses the `OrgExtensionConfigs.get` validation). */
+    /**
+     * The org exists, the extension provides a directory, is enabled in the org, its org config
+     * satisfies the schema (reuses the `OrgExtensionConfigs.get` validation) and its effective
+     * deployment config for the org is valid (layering spec A §6).
+     */
     private eligible;
     /**
      * 投递一次 `directory_changed` 同步（按分钟桶去重）；返回 job id。入站 `directory_changed` 经
@@ -146,7 +154,8 @@ export declare class DirectorySync {
      * Manual trigger by an admin: re-checks `org.members.manage` live under the org row lock, then that
      * the extension can sync (does not provide a directory -> `extension.not_found`, not enabled ->
      * `extension.not_enabled`, config no longer valid -> `extension.config_invalid`, the extension says
-     * the directory is not configured -> `directory.not_configured`, Ruling A28), and enqueues a sync
+     * the directory is not configured -> `directory.not_configured`, Ruling A28; the effective config
+     * is not valid in the org -> `extension.needs_config`, layering spec A §6), and enqueues a sync
      * job with a unique id.
      */
     request(orgId: string, plugin: string, actorAccountId: string, actorTokenId?: string): Promise<{

package/dist/orgs/directory-sync.js

@@ -12,6 +12,7 @@ import { DIRECTORY_EXTENSION_POINT, } from "@capybara-hq/plugin-sdk";
 import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { enabledExtensionsByOrg } from "../extensions/enabled.js";
 import { OrgExtensionConfigs } from "../extensions/org-config.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
@@ -80,6 +81,8 @@ export function directorySyncJobId(orgId, plugin, trigger, now = new Date()) {
             return `${base}-manual-${randomUUID()}`;
     }
 }
+/** Skips that log nothing and enqueue nothing: Ruling A28 and an org needing configuration. */
+const silentSkip = (reason) => reason === "not_configured" || reason === "needs_config";
 /** 组织已删除（同步途中）：停止本轮。 */
 class OrgGone extends Error {
 }
@@ -122,18 +125,20 @@ let DirectorySync = class DirectorySync {
     redis;
     registry;
     orgConfigs;
+    effective;
     external;
     offboarding;
     orgLock;
     queue;
     lockService;
     log;
-    constructor(db, txHost, redis, registry, orgConfigs, external, offboarding, orgLock, queue, lockService, log) {
+    constructor(db, txHost, redis, registry, orgConfigs, effective, external, offboarding, orgLock, queue, lockService, log) {
         this.db = db;
         this.txHost = txHost;
         this.redis = redis;
         this.registry = registry;
         this.orgConfigs = orgConfigs;
+        this.effective = effective;
         this.external = external;
         this.offboarding = offboarding;
         this.orgLock = orgLock;
@@ -144,8 +149,8 @@ let DirectorySync = class DirectorySync {
     /** A `directory-sync` job (dispatched by `MaintenanceProcessor`). */
     async runSyncJob(data) {
         const r = await this.sync(data.orgId, data.plugin, data);
-        // 通讯录未配置（Ruling A28）静默跳过
-        if (r.status === "skipped" && r.reason !== "not_configured") {
+        // 通讯录未配置（Ruling A28）and an org needing configuration (spec A §6) are skipped silently
+        if (r.status === "skipped" && !silentSkip(r.reason)) {
             this.log.info("directory sync skipped", {
                 orgId: data.orgId,
                 plugin: data.plugin,
@@ -159,7 +164,11 @@ let DirectorySync = class DirectorySync {
             .list("directory")
             .find((e) => e.plugin === plugin && e.capability === DIRECTORY_EXTENSION_POINT)?.impl;
     }
-    /** The org exists, the extension provides a directory, is enabled in the org and its org config satisfies the schema (reuses the `OrgExtensionConfigs.get` validation). */
+    /**
+     * The org exists, the extension provides a directory, is enabled in the org, its org config
+     * satisfies the schema (reuses the `OrgExtensionConfigs.get` validation) and its effective
+     * deployment config for the org is valid (layering spec A §6).
+     */
     async eligible(orgId, plugin) {
         const directory = this.provider(plugin);
         if (!directory)
@@ -186,11 +195,21 @@ let DirectorySync = class DirectorySync {
         }
         if (!cfg?.enabled)
             return { ok: false, reason: "not_enabled" };
+        let effective;
+        try {
+            effective = await this.effective.get(orgId, plugin);
+        }
+        catch (err) {
+            this.log.warn("directory sync: cannot read the effective config", { orgId, plugin, err });
+            return { ok: false, reason: "config_invalid" };
+        }
+        if (!effective.ok)
+            return { ok: false, reason: "needs_config" };
         // Ruling A28：插件说通讯录没配好（组织只用它的别的能力）→ 不同步；插件实现出错按未配置处理
         if (directory.configured !== undefined) {
             let configured = false;
             try {
-                configured = directory.configured(cfg.config) === true;
+                configured = directory.configured(cfg.config, effective.config) === true;
             }
             catch {
                 configured = false;
@@ -198,7 +217,7 @@ let DirectorySync = class DirectorySync {
             if (!configured)
                 return { ok: false, reason: "not_configured" };
         }
-        return { ok: true, directory, orgConfig: cfg.config };
+        return { ok: true, directory, orgConfig: cfg.config, config: effective.config };
     }
     /**
      * 投递一次 `directory_changed` 同步（按分钟桶去重）；返回 job id。入站 `directory_changed` 经
@@ -207,7 +226,7 @@ let DirectorySync = class DirectorySync {
      */
     async enqueue(orgId, plugin, now = new Date()) {
         const e = await this.eligible(orgId, plugin);
-        if (!e.ok && e.reason === "not_configured")
+        if (!e.ok && silentSkip(e.reason))
             return undefined;
         return this.addJob(orgId, plugin, "changed", directorySyncJobId(orgId, plugin, "changed", now));
     }
@@ -234,7 +253,8 @@ let DirectorySync = class DirectorySync {
      * Manual trigger by an admin: re-checks `org.members.manage` live under the org row lock, then that
      * the extension can sync (does not provide a directory -> `extension.not_found`, not enabled ->
      * `extension.not_enabled`, config no longer valid -> `extension.config_invalid`, the extension says
-     * the directory is not configured -> `directory.not_configured`, Ruling A28), and enqueues a sync
+     * the directory is not configured -> `directory.not_configured`, Ruling A28; the effective config
+     * is not valid in the org -> `extension.needs_config`, layering spec A §6), and enqueues a sync
      * job with a unique id.
      */
     async request(orgId, plugin, actorAccountId, actorTokenId) {
@@ -252,6 +272,8 @@ let DirectorySync = class DirectorySync {
                     throw new ApiError("extension.config_invalid", `Invalid organization config for extension ${plugin}`);
                 case "not_configured":
                     throw new ApiError("directory.not_configured", `The directory of extension ${plugin} is not configured for this organization`);
+                case "needs_config":
+                    throw new ApiError("extension.needs_config", `Extension ${plugin} needs configuration in this organization`);
             }
         }
         const jobId = await this.addJob(orgId, plugin, "manual", directorySyncJobId(orgId, plugin, "manual"), { accountId: actorAccountId, tokenId: actorTokenId });
@@ -324,7 +346,7 @@ let DirectorySync = class DirectorySync {
         // 锁丢了（续租失败、过期后被他人取得）：停止本轮，不再移除任何人
         const signal = lease.lost;
         try {
-            return await this.run(orgId, plugin, e.directory, e.orgConfig, signal, opts);
+            return await this.run(orgId, plugin, e.directory, e.orgConfig, e.config, signal, opts);
         }
         finally {
             await lease.release().catch(() => { });
@@ -346,7 +368,7 @@ let DirectorySync = class DirectorySync {
             this.log.warn("directory sync: cannot enqueue follow-up sync", { orgId, plugin, err });
         }
     }
-    async run(orgId, plugin, directory, orgConfig, signal, opts) {
+    async run(orgId, plugin, directory, orgConfig, config, signal, opts) {
         const source = `directory:${plugin}`;
         const counts = { added: 0, removed: 0, skippedLastOwner: 0, failed: 0, total: 0 };
         /** 本轮仍在职的账号（只在本次任务内使用）。 */
@@ -363,6 +385,7 @@ let DirectorySync = class DirectorySync {
                 signal.throwIfAborted();
                 const r = await directory.listMembers({
                     orgConfig,
+                    config,
                     ...(cursor !== undefined && { cursor }),
                     signal: AbortSignal.any([signal, AbortSignal.timeout(DIRECTORY_PAGE_TIMEOUT_MS)]),
                 });
@@ -409,7 +432,7 @@ let DirectorySync = class DirectorySync {
             if (!still.ok) {
                 partial = true;
                 // 途中通讯录配置被清空（Ruling A28）：照样不移除，但不记警告
-                if (still.reason !== "not_configured") {
+                if (!silentSkip(still.reason)) {
                     this.log.warn("directory sync: plugin no longer eligible before removals", {
                         orgId,
                         plugin,
@@ -609,12 +632,13 @@ DirectorySync = __decorate([
     __param(2, Inject(REDIS)),
     __param(3, Inject(ExtensionRegistry)),
     __param(4, Inject(OrgExtensionConfigs)),
-    __param(5, Inject(ExternalIdentities)),
-    __param(6, Inject(Offboarding)),
-    __param(7, Inject(OrgLock)),
-    __param(8, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
-    __param(9, Inject(LockService)),
-    __param(10, Inject(KERNEL_LOGGER))
+    __param(5, Inject(EffectiveConfigs)),
+    __param(6, Inject(ExternalIdentities)),
+    __param(7, Inject(Offboarding)),
+    __param(8, Inject(OrgLock)),
+    __param(9, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
+    __param(10, Inject(LockService)),
+    __param(11, Inject(KERNEL_LOGGER))
 ], DirectorySync);
 export { DirectorySync };
 /** The hourly directory scan ({@link DirectorySync.scan}), once per tick across replicas; a worker-role job (`WorkerModule`). */

package/dist/orgs/offboarding.d.ts

@@ -30,8 +30,8 @@ export interface OffboardResult {
     runs: InFlightRun[];
     /** 负责的 agent 转交给的所有者；没有转交时为 null。 */
     newOwnerId: string | null;
-    /** 此人在该组织的对话里还没销毁的沙箱（按对话 id），提交后投递销毁。 */
-    sandboxConversations: string[];
+    /** The person's environments in the org, soft-deleted here; destroyed by a job after commit. */
+    environments: string[];
     /** Conversations whose queued messages were deleted (`changed: queue` after commit). */
     queueConversations: string[];
 }
@@ -66,7 +66,7 @@ export declare class Offboarding {
     private readonly redis;
     private readonly registry;
     private readonly eventLog;
-    /** The departed member's sandboxes: one-off maintenance jobs, destroyed one by one by a worker. */
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
     private readonly sandboxJobs;
     /** Stops the departed member's runs (`by: null`, a system action). */
     private readonly runs;
@@ -75,7 +75,7 @@ export declare class Offboarding {
     private readonly questions;
     readonly log: KernelLogger;
     constructor(db: KernelDb, txHost: TransactionHost, sessions: Pick<SessionService, "markRevoked">, redis: Pick<Redis, "set" | "exists">, registry: Pick<ExtensionRegistry, "list">, eventLog: Pick<EventLog, "notify" | "publishChanged">, 
-    /** The departed member's sandboxes: one-off maintenance jobs, destroyed one by one by a worker. */
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
     sandboxJobs: Pick<SandboxJobs, "destroy">, 
     /** Stops the departed member's runs (`by: null`, a system action). */
     runs: OffboardingRunControl, credentials: Pick<Credentials, "clearAccount">, approvals: Pick<ApprovalsService, "cancelPendingFor">, questions: Pick<QuestionsService, "cancelPendingFor">, log: KernelLogger);
@@ -95,7 +95,9 @@ export declare class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. 记下此人在该组织对话里还没销毁的沙箱（提交后销毁，尽力而为）。
+     * 9. Soft-deletes the person's environments in the org and clears their default row (the
+     *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
+     *    any left).
      */
     offboard(orgId: string, accountId: string, reason: OffboardReason, actor?: {
         actorAccountId?: string;
@@ -106,8 +108,8 @@ export declare class Offboarding {
     /**
      * After the commit (callers register it with the infra `afterCommit` inside their transaction):
      * writes the session revocation markers, publishes the cancelled events, stops the person's
-     * runs in the org and schedules destroying their conversations' sandboxes. A failing step only
-     * logs a warning.
+     * runs in the org and schedules destroying their environments. A failing step only logs a
+     * warning.
      */
     afterOffboard(r: OffboardResult): Promise<void>;
     /**

package/dist/orgs/offboarding.js

@@ -10,6 +10,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { DIRECTORY_EXTENSION_POINT } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
+import { retargetSetupRequests } from "../agents/pending-connector-requests.js";
 import { EventLog } from "../conversations/event-log.js";
 import { ApiError } from "../errors.js";
 import { enabledExtensionsQuery } from "../extensions/enabled.js";
@@ -62,7 +63,7 @@ let Offboarding = class Offboarding {
     questions;
     log;
     constructor(db, txHost, sessions, redis, registry, eventLog, 
-    /** The departed member's sandboxes: one-off maintenance jobs, destroyed one by one by a worker. */
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
     sandboxJobs, 
     /** Stops the departed member's runs (`by: null`, a system action). */
     runs, credentials, approvals, questions, log) {
@@ -95,7 +96,9 @@ let Offboarding = class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. 记下此人在该组织对话里还没销毁的沙箱（提交后销毁，尽力而为）。
+     * 9. Soft-deletes the person's environments in the org and clears their default row (the
+     *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
+     *    any left).
      */
     async offboard(orgId, accountId, reason, actor = {}) {
         const deleted = await this.db
@@ -210,6 +213,8 @@ let Offboarding = class Offboarding {
             .where("deleted_at", "is", null)
             .returning("id")
             .execute();
+        // their connector setup requests follow them to the org owner (ruling P4-T6-4)
+        await retargetSetupRequests(this.db.db, agents.map((a) => a.id), owner.account_id);
         const threads = await this.db
             .updateTable("channel_threads")
             .set({ archived_at: sql `now()` })
@@ -254,13 +259,19 @@ let Offboarding = class Offboarding {
                 .where("id", "in", queueConversations)
                 .execute();
         }
-        const sandboxes = await this.db
-            .selectFrom("sandboxes")
-            .innerJoin("conversations", "conversations.id", "sandboxes.conversation_id")
-            .select("sandboxes.conversation_id")
-            .where("conversations.org_id", "=", orgId)
-            .where("conversations.account_id", "=", accountId)
-            .where("sandboxes.status", "<>", "destroyed")
+        const environments = await this.db
+            .updateTable("environments")
+            .set({ deleted_at: sql `now()`, updated_at: sql `now()` })
+            .where("org_id", "=", orgId)
+            .where("owner_kind", "=", "personal")
+            .where("owner_account_id", "=", accountId)
+            .where("deleted_at", "is", null)
+            .returning("id")
+            .execute();
+        await this.db
+            .deleteFrom("environment_defaults")
+            .where("org_id", "=", orgId)
+            .where("account_id", "=", accountId)
             .execute();
         await audit(this.db.db, {
             ...(actor.actorAccountId !== undefined && { actorAccountId: actor.actorAccountId }),
@@ -282,7 +293,7 @@ let Offboarding = class Offboarding {
                 channelThreadsArchived: Number(threads.numUpdatedRows),
                 toolGrantsDeleted: Number(grants.numDeletedRows),
                 ...(excluded.length > 0 && { directoryExcluded: excluded }),
-                ...(sandboxes.length > 0 && { sandboxesToDestroy: sandboxes.length }),
+                ...(environments.length > 0 && { environmentsDeleted: environments.length }),
                 ...(queued.length > 0 && { queuedMessagesDeleted: queued.length }),
             },
         });
@@ -296,7 +307,7 @@ let Offboarding = class Offboarding {
                 status: r.status,
             })),
             newOwnerId: agents.length > 0 ? owner.account_id : null,
-            sandboxConversations: sandboxes.map((r) => r.conversation_id),
+            environments: environments.map((r) => r.id),
             queueConversations,
         };
     }
@@ -325,8 +336,8 @@ let Offboarding = class Offboarding {
     /**
      * After the commit (callers register it with the infra `afterCommit` inside their transaction):
      * writes the session revocation markers, publishes the cancelled events, stops the person's
-     * runs in the org and schedules destroying their conversations' sandboxes. A failing step only
-     * logs a warning.
+     * runs in the org and schedules destroying their environments. A failing step only logs a
+     * warning.
      */
     async afterOffboard(r) {
         const { sessions, log, eventLog } = this;
@@ -354,13 +365,13 @@ let Offboarding = class Offboarding {
         }
         for (const run of r.runs)
             await this.stopRun(run);
-        if (r.sandboxConversations.length > 0) {
+        if (r.environments.length > 0) {
             try {
-                await this.sandboxJobs.destroy(r.sandboxConversations);
+                await this.sandboxJobs.destroy(r.environments);
             }
             catch (err) {
-                log.warn("offboarding: cannot schedule sandbox destruction", {
-                    count: r.sandboxConversations.length,
+                log.warn("offboarding: cannot schedule environment destruction", {
+                    count: r.environments.length,
                     err,
                 });
             }

package/dist/orgs/org-lock.d.ts

@@ -35,6 +35,11 @@ export declare class OrgLock {
         org: LockedOrg;
         role: OrgRole;
     }>;
+    /**
+     * {@link lockAndAuthorize} for an account; for the kernel itself (`null`: a job acting for no
+     * person, such as the plugin scope sync) only the lock, since no role applies.
+     */
+    lockFor(orgId: string, actor: string | null, action: OrgAction): Promise<void>;
 }
 /** The one {@link OrgLock}: identity (service tokens), orgs and the other domains import it. */
 export declare class OrgLockModule {

package/dist/orgs/org-lock.js

@@ -67,6 +67,16 @@ let OrgLock = class OrgLock {
         }
         return { org, role: m.role };
     }
+    /**
+     * {@link lockAndAuthorize} for an account; for the kernel itself (`null`: a job acting for no
+     * person, such as the plugin scope sync) only the lock, since no role applies.
+     */
+    async lockFor(orgId, actor, action) {
+        if (actor === null)
+            await this.lock(orgId);
+        else
+            await this.lockAndAuthorize(orgId, actor, action);
+    }
 };
 __decorate([
     Transactional({ propagation: "mandatory" })
@@ -77,6 +87,9 @@ __decorate([
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], OrgLock.prototype, "lockAndAuthorize", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], OrgLock.prototype, "lockFor", null);
 OrgLock = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),

package/dist/orgs/org.guard.d.ts

@@ -1,5 +1,7 @@
 import { type CanActivate, type ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { type Principal } from "../identity/principal.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { type OrgAction as Action, type OrgRole } from "./roles.js";
 /** OrgGuard 放在请求上的组织上下文。 */
@@ -21,6 +23,14 @@ export declare const ORG_ACTION_KEY = "capybara:org:action";
 export declare function OrgAction(action: Action): MethodDecorator & ClassDecorator;
 /** 参数装饰器：取 OrgGuard 放在 `req.org` 上的 `{ orgId, role }`。 */
 export declare const CurrentOrg: () => ParameterDecorator;
+/**
+ * The org role check of {@link OrgGuard}, read live from PG: the caller's role in `orgId` (a
+ * person's membership, a service token's own org and role) allows `action`, else 404
+ * `org.not_found` (missing, soft-deleted, not a member: existence is not disclosed) or 403
+ * `forbidden` (HUMAN_ONLY for a service token, role too low). Also run before the body of an org
+ * package upload is read (ruling P3-29).
+ */
+export declare function authorizeOrgAction(db: Pick<KernelSchemaDb, "selectFrom">, p: Principal, orgId: string, action: Action): Promise<OrgRole>;
 /**
  * 组织守卫：每个请求实时从 PG 读组织与成员角色（不缓存）。
  * - 组织不存在、已软删除、或调用者不是成员 → 404 `org.not_found`（不泄露组织是否存在）。