@capybara-hq/kernel 0.1.0-rc.5 → 0.1.0-rc.6

package/dist/admin/admin.controller.d.ts

@@ -8,6 +8,8 @@ import { type Principal } from "../identity/principal.js";
 import { SessionService } from "../identity/sessions.js";
 import { type DeploymentSettings, SettingsService } from "../identity/settings.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { type ModelDisabledPatch, type ModelProviderParams } from "../models/enablement.controller.js";
+import { type ModelDisableResult, ModelEnablement } from "../models/enablement.js";
 import { type ModelPrice, type ModelPricePut, PricesService } from "../models/prices.js";
 import { ModelPurposesService, type PurposeListing, type PurposePut } from "../models/purposes.js";
 import { type Org, OrgsService } from "../orgs/orgs.service.js";
@@ -104,8 +106,9 @@ export declare class AdminController {
     private readonly registry;
     private readonly catalogRequests;
     private readonly displayNames;
+    private readonly enablement;
     private readonly config;
-    constructor(accounts: AccountsService, sessions: SessionService, log: Logger, orgs: OrgsService, settings: SettingsService, prices: PricesService, purposes: ModelPurposesService, plugins: ExtensionAdmin, registry: ProviderRegistry, catalogRequests: CatalogRequestsService, displayNames: ExtensionDisplayNames, config: KernelConfigService);
+    constructor(accounts: AccountsService, sessions: SessionService, log: Logger, orgs: OrgsService, settings: SettingsService, prices: PricesService, purposes: ModelPurposesService, plugins: ExtensionAdmin, registry: ProviderRegistry, catalogRequests: CatalogRequestsService, displayNames: ExtensionDisplayNames, enablement: ModelEnablement, config: KernelConfigService);
     /** 后台概览的四个数字（只读计数，不含任何对话内容）。 */
     overview(): Promise<AdminOverview>;
     /**
@@ -139,7 +142,8 @@ export declare class AdminController {
     /**
      * 模型供应商与模型（后台「模型」页）：每个供应商带状态，列模型失败的标 `error`，不影响其他供应商；
      * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。Each provider carries its extension's
-     * display name (null when it has none).
+     * display name (null when it has none); every model of the platform's list carries `disabled`
+     * (the platform's disabled list, spec B §5.3).
      */
     getModels(): Promise<{
         providers: (ProviderStatus & {
@@ -148,6 +152,13 @@ export declare class AdminController {
         prices: ModelPrice[];
         currency: string;
     }>;
+    /**
+     * The platform's disabled models of one provider (spec B §5.3): disables and enables the ids the
+     * body names (others keep their state); such a model is invisible to every org. The response
+     * lists the agents and purposes, across orgs, that now point at a newly disabled model (the
+     * disable is not refused for them).
+     */
+    patchModelsDisabled(principal: Principal, params: z.infer<typeof ModelProviderParams>, body: z.infer<typeof ModelDisabledPatch>): Promise<ModelDisableResult>;
     /** 模型价格表（每百万 token）与币种（部署设置 `priceCurrency`）。 */
     getModelPrices(): Promise<{
         prices: ModelPrice[];

package/dist/admin/admin.controller.js

@@ -21,7 +21,9 @@ import { DEPLOYMENT_SETTINGS_PATCH, SettingsService, } from "../identity/setting
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
-import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
+import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
+import { ModelDisabledPatchDto, ModelProviderParamsDto, } from "../models/enablement.controller.js";
+import { ModelEnablement } from "../models/enablement.js";
 import { MODEL_PRICE_PUT, PricesService, } from "../models/prices.js";
 import { purposeTargetOf } from "../models/purposes.controller.js";
 import { ModelPurposesService, PurposePutDto, withDeclaredByNames, } from "../models/purposes.js";
@@ -73,8 +75,9 @@ let AdminController = class AdminController {
     registry;
     catalogRequests;
     displayNames;
+    enablement;
     config;
-    constructor(accounts, sessions, log, orgs, settings, prices, purposes, plugins, registry, catalogRequests, displayNames, config) {
+    constructor(accounts, sessions, log, orgs, settings, prices, purposes, plugins, registry, catalogRequests, displayNames, enablement, config) {
         this.accounts = accounts;
         this.sessions = sessions;
         this.log = log;
@@ -86,6 +89,7 @@ let AdminController = class AdminController {
         this.registry = registry;
         this.catalogRequests = catalogRequests;
         this.displayNames = displayNames;
+        this.enablement = enablement;
         this.config = config;
     }
     /** 后台概览的四个数字（只读计数，不含任何对话内容）。 */
@@ -175,7 +179,8 @@ let AdminController = class AdminController {
     /**
      * 模型供应商与模型（后台「模型」页）：每个供应商带状态，列模型失败的标 `error`，不影响其他供应商；
      * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。Each provider carries its extension's
-     * display name (null when it has none).
+     * display name (null when it has none); every model of the platform's list carries `disabled`
+     * (the platform's disabled list, spec B §5.3).
      */
     async getModels() {
         const [providers, prices] = await Promise.all([
@@ -188,6 +193,19 @@ let AdminController = class AdminController {
             ...prices,
         };
     }
+    /**
+     * The platform's disabled models of one provider (spec B §5.3): disables and enables the ids the
+     * body names (others keep their state); such a model is invisible to every org. The response
+     * lists the agents and purposes, across orgs, that now point at a newly disabled model (the
+     * disable is not refused for them).
+     */
+    async patchModelsDisabled(principal, params, body) {
+        const actor = requireUser(principal);
+        return this.enablement.setPlatform(params.provider, body, {
+            accountId: actor.account.id,
+            tokenId: patTokenId(actor),
+        });
+    }
     /** 模型价格表（每百万 token）与币种（部署设置 `priceCurrency`）。 */
     async getModelPrices() {
         const [prices, settings] = await Promise.all([this.prices.list(), this.settings.get()]);
@@ -244,6 +262,12 @@ __decorate([
 __decorate([
     Get("models")
 ], AdminController.prototype, "getModels", null);
+__decorate([
+    Patch("models/:provider/disabled"),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(ModelProviderParamsDto)),
+    __param(2, ZBody(ModelDisabledPatchDto))
+], AdminController.prototype, "patchModelsDisabled", null);
 __decorate([
     Get("model-prices")
 ], AdminController.prototype, "getModelPrices", null);
@@ -275,6 +299,7 @@ AdminController = __decorate([
     __param(8, Inject(ProviderRegistry)),
     __param(9, Inject(CatalogRequestsService)),
     __param(10, Inject(ExtensionDisplayNames)),
-    __param(11, Inject(KernelConfigService))
+    __param(11, Inject(ModelEnablement)),
+    __param(12, Inject(KernelConfigService))
 ], AdminController);
 export { AdminController };

package/dist/agents/agents.service.d.ts

@@ -105,7 +105,9 @@ export declare class AgentsService {
      */
     private checkTools;
     /**
-     * 校验主模型与兜底都可解析，并用各自模型的参数声明严格校验 `modelParams` / `fallbackParams`
+     * 校验主模型与兜底都可解析：enabled `chat` models in the org (`resolve`'s default kind; a model the
+     * platform or the org disabled, or an embedding model → 400 `agent.model_unavailable`, spec B
+     * §5.3），并用各自模型的参数声明严格校验 `modelParams` / `fallbackParams`
      * （没有兜底时 `fallbackParams` 必须为空）；不合法 → `validation_failed`，details 逐键点名。返回提示。
      */
     private checkModels;

package/dist/agents/agents.service.js

@@ -305,13 +305,15 @@ let AgentsService = class AgentsService {
         return keys;
     }
     /**
-     * 校验主模型与兜底都可解析，并用各自模型的参数声明严格校验 `modelParams` / `fallbackParams`
+     * 校验主模型与兜底都可解析：enabled `chat` models in the org (`resolve`'s default kind; a model the
+     * platform or the org disabled, or an embedding model → 400 `agent.model_unavailable`, spec B
+     * §5.3），并用各自模型的参数声明严格校验 `modelParams` / `fallbackParams`
      * （没有兜底时 `fallbackParams` 必须为空）；不合法 → `validation_failed`，details 逐键点名。返回提示。
      */
-    async checkModels(def) {
+    async checkModels(orgId, def) {
         const registry = this.providers;
-        const main = await registry.resolve(def.model);
-        const fallback = def.fallback === null ? null : await registry.resolve(def.fallback);
+        const main = await registry.resolve(orgId, def.model);
+        const fallback = def.fallback === null ? null : await registry.resolve(orgId, def.fallback);
         const details = [
             ...paramIssues("modelParams", main.info.parameters, def.modelParams),
             ...paramIssues("fallbackParams", fallback?.info.parameters ?? [], def.fallbackParams),
@@ -369,7 +371,7 @@ let AgentsService = class AgentsService {
     async createChecked(orgId, actorAccountId, request, template, actorTokenId, auditDetail) {
         const input = { ...request, definition: deriveInstructions(request.definition, null) };
         // 先解析模型（可能访问供应商），不在持有组织行锁时做
-        const warnings = await this.checkModels(input.definition);
+        const warnings = await this.checkModels(orgId, input.definition);
         const toolKeys = await this.checkTools(orgId, input.definition);
         if (input.visibility !== "members" && (input.memberIds?.length ?? 0) > 0) {
             throw new ApiError("validation_failed", "memberIds requires visibility 'members'");
@@ -478,7 +480,7 @@ let AgentsService = class AgentsService {
      */
     async update(orgId, agentId, actorAccountId, request, actorTokenId, auditDetail) {
         const patch = request;
-        const warnings = patch.definition ? await this.checkModels(patch.definition) : [];
+        const warnings = patch.definition ? await this.checkModels(orgId, patch.definition) : [];
         const toolKeys = patch.definition ? await this.checkTools(orgId, patch.definition) : null;
         const agent = await this.updateIn(orgId, agentId, actorAccountId, patch, toolKeys, actorTokenId, auditDetail);
         return { agent, warnings };

package/dist/agents/from-template.service.js

@@ -62,7 +62,7 @@ let AgentsFromTemplate = class AgentsFromTemplate {
             enabledPlugins: await this.host.enabledPlugins(orgId),
             resolveModel: async (ref) => {
                 try {
-                    return (await this.providers.resolve(ref)).info.parameters;
+                    return (await this.providers.resolve(orgId, ref)).info.parameters;
                 }
                 catch {
                     return null;
@@ -79,8 +79,8 @@ let AgentsFromTemplate = class AgentsFromTemplate {
                 }
             },
             defaultModel: async () => {
-                for (const p of await this.providers.list()) {
-                    const m = p.models[0];
+                for (const p of await this.providers.list(orgId)) {
+                    const m = p.models.find((x) => x.kind === "chat");
                     if (m)
                         return { provider: p.provider, model: m.id };
                 }

package/dist/agents/models.controller.d.ts

@@ -1,19 +1,48 @@
-import type { LocalizedName, ModelInfo } from "@capybara-hq/plugin-sdk";
+import type { LocalizedName } from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
 import { ExtensionDisplayNames } from "../extensions/display-name.js";
-import { ProviderRegistry } from "../runtime/providers.js";
+import { type Principal } from "../identity/principal.js";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { type KernelModelInfo, ProviderRegistry, type ProviderStatus } from "../runtime/providers.js";
+declare const ModelsQuery: z.ZodObject<{
+    kind: z.ZodOptional<z.ZodEnum<{
+        chat: "chat";
+        embedding: "embedding";
+        image_generation: "image_generation";
+        other: "other";
+        rerank: "rerank";
+        speech_to_text: "speech_to_text";
+        text_to_speech: "text_to_speech";
+        video_generation: "video_generation";
+    }>>;
+}, z.core.$strip>;
 /**
  * 可选模型（`/api/v1/orgs/:orgId/models`）：已安装的模型供应商及其模型，列表缓存在 Redis。Each provider
- * carries its extension's display name (null when it has none).
+ * carries its extension's display name (null when it has none). Listed for the org (its effective
+ * provider config: a provider needing configuration there is absent); only enabled models (neither
+ * the platform nor the org disabled them, spec B §5.3), optionally of one `?kind=`; every model
+ * carries its normalised `kind` (`other` for a kind this kernel does not know).
  */
 export declare class ModelsController {
     private readonly registry;
     private readonly displayNames;
     constructor(registry: ProviderRegistry, displayNames: ExtensionDisplayNames);
-    list(): Promise<{
+    list(org: OrgContext, q: z.infer<typeof ModelsQuery>): Promise<{
         providers: {
             provider: string;
             displayName: LocalizedName | null;
-            models: ModelInfo[];
+            models: KernelModelInfo[];
         }[];
     }>;
+    /**
+     * The org's model catalog (the settings page; `org.models.manage`, people only): every provider
+     * with its status for the org and every model the platform left on, each with `disabled` for the
+     * org's own list.
+     */
+    catalog(principal: Principal, org: OrgContext): Promise<{
+        providers: (ProviderStatus & {
+            displayName: LocalizedName | null;
+        })[];
+    }>;
 }
+export {};

package/dist/agents/models.controller.js

@@ -8,12 +8,35 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Get, Inject } from "@nestjs/common";
+import { z } from "zod";
 import { ExtensionDisplayNames } from "../extensions/display-name.js";
-import { OrgAction } from "../orgs/org.guard.js";
-import { ProviderRegistry } from "../runtime/providers.js";
+import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZQuery } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { ProviderRegistry, } from "../runtime/providers.js";
+const ModelsQuery = z.object({
+    kind: z
+        .enum([
+        "chat",
+        "embedding",
+        "rerank",
+        "image_generation",
+        "video_generation",
+        "speech_to_text",
+        "text_to_speech",
+        "other",
+    ])
+        .optional(),
+});
+class ModelsQueryDto extends createZodDto(ModelsQuery, "ModelsQuery") {
+}
 /**
  * 可选模型（`/api/v1/orgs/:orgId/models`）：已安装的模型供应商及其模型，列表缓存在 Redis。Each provider
- * carries its extension's display name (null when it has none).
+ * carries its extension's display name (null when it has none). Listed for the org (its effective
+ * provider config: a provider needing configuration there is absent); only enabled models (neither
+ * the platform nor the org disabled them, spec B §5.3), optionally of one `?kind=`; every model
+ * carries its normalised `kind` (`other` for a kind this kernel does not know).
  */
 let ModelsController = class ModelsController {
     registry;
@@ -22,8 +45,8 @@ let ModelsController = class ModelsController {
         this.registry = registry;
         this.displayNames = displayNames;
     }
-    async list() {
-        const providers = await this.registry.list();
+    async list(org, q) {
+        const providers = await this.registry.list(org.orgId, q.kind === undefined ? {} : { kind: q.kind });
         const names = await this.displayNames.many(providers.map((p) => p.provider));
         return {
             providers: providers.map((p) => ({
@@ -33,11 +56,32 @@ let ModelsController = class ModelsController {
             })),
         };
     }
+    /**
+     * The org's model catalog (the settings page; `org.models.manage`, people only): every provider
+     * with its status for the org and every model the platform left on, each with `disabled` for the
+     * org's own list.
+     */
+    async catalog(principal, org) {
+        requireUser(principal);
+        const providers = await this.registry.catalog(org.orgId);
+        const names = await this.displayNames.many(providers.map((p) => p.plugin));
+        return {
+            providers: providers.map((p) => ({ ...p, displayName: names.get(p.plugin) ?? null })),
+        };
+    }
 };
 __decorate([
     Get(),
-    OrgAction("agents.use")
+    OrgAction("agents.use"),
+    __param(0, CurrentOrg()),
+    __param(1, ZQuery(ModelsQueryDto))
 ], ModelsController.prototype, "list", null);
+__decorate([
+    Get("catalog"),
+    OrgAction("org.models.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg())
+], ModelsController.prototype, "catalog", null);
 ModelsController = __decorate([
     Controller("api/v1/orgs/:orgId/models"),
     __param(0, Inject(ProviderRegistry)),

package/dist/agents/readiness.controller.d.ts

@@ -9,11 +9,11 @@ import { AgentsService } from "./agents.service.js";
  * a vendor call; `agents` is the number of agents the caller can see (the agent list's
  * visibility). Humans and service tokens (`org.read`).
  *
- * `modelProvider` is deployment-wide, not about this org: model providers are not org-scoped
- * (an org's model purposes map onto the deployment's providers but cannot add one), so every org
- * of the deployment reads the same value. It is read from this replica's provider registry, which
- * follows the per-replica extension reconcile: right after a provider is enabled, a replica that
- * has not reconciled yet may still answer `none` for a moment.
+ * `modelProvider` counts the deployment's providers whose effective config is valid in this org
+ * (spec B §5.5: a provider the platform installed without a key needs each org's own). It is read
+ * from this replica's provider registry, which follows the per-replica extension reconcile: right
+ * after a provider is enabled, a replica that has not reconciled yet may still answer `none` for
+ * a moment.
  */
 export declare class ReadinessController {
     private readonly registry;

package/dist/agents/readiness.controller.js

@@ -21,11 +21,11 @@ const viewerOf = (p) => (p.kind === "user" ? p.account.id : null);
  * a vendor call; `agents` is the number of agents the caller can see (the agent list's
  * visibility). Humans and service tokens (`org.read`).
  *
- * `modelProvider` is deployment-wide, not about this org: model providers are not org-scoped
- * (an org's model purposes map onto the deployment's providers but cannot add one), so every org
- * of the deployment reads the same value. It is read from this replica's provider registry, which
- * follows the per-replica extension reconcile: right after a provider is enabled, a replica that
- * has not reconciled yet may still answer `none` for a moment.
+ * `modelProvider` counts the deployment's providers whose effective config is valid in this org
+ * (spec B §5.5: a provider the platform installed without a key needs each org's own). It is read
+ * from this replica's provider registry, which follows the per-replica extension reconcile: right
+ * after a provider is enabled, a replica that has not reconciled yet may still answer `none` for
+ * a moment.
  */
 let ReadinessController = class ReadinessController {
     registry;
@@ -37,7 +37,7 @@ let ReadinessController = class ReadinessController {
     async get(principal, org) {
         const visible = await this.agents.listVisible(org.orgId, viewerOf(principal));
         return {
-            modelProvider: this.registry.hasProvider() ? "ready" : "none",
+            modelProvider: (await this.registry.hasProvider(org.orgId)) ? "ready" : "none",
             agents: visible.length,
         };
     }

package/dist/catalog/marketplaces.service.d.ts

@@ -181,7 +181,7 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.3";
+    readonly sdk: "0.1.0-rc.4";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;

package/dist/config/schema.d.ts

@@ -232,6 +232,10 @@ export declare const KernelConfigSchema: z.ZodObject<{
         judgeMaxOutputTokens: z.ZodDefault<z.ZodNumber>;
         maxConsecutiveErrors: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
+    models: z.ZodPrefault<z.ZodObject<{
+        listTimeoutMs: z.ZodDefault<z.ZodNumber>;
+        embedTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
     hooks: z.ZodPrefault<z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         usageReportConcurrency: z.ZodDefault<z.ZodNumber>;

package/dist/config/schema.js

@@ -1252,6 +1252,30 @@ export const KernelConfigSchema = z.object({
         path: ["defaultTokenCap"],
     })
         .prefault({}),
+    models: z
+        .object({
+        listTimeoutMs: z
+            .number()
+            .int()
+            .positive()
+            .max(300_000)
+            .default(10_000)
+            .meta(meta({
+            hot: true,
+            description: "Time limit in milliseconds for one model provider's model list (listModels, which may page through a large platform catalog); a provider that exceeds it is treated as failing to list",
+        })),
+        embedTimeoutMs: z
+            .number()
+            .int()
+            .positive()
+            .max(600_000)
+            .default(60_000)
+            .meta(meta({
+            hot: true,
+            description: "Time limit in milliseconds for one embed call to a model provider (one batch of an extension's ctx.models.embed); the call is aborted and fails with a timeout model error",
+        })),
+    })
+        .prefault({}),
     hooks: z
         .object({
         timeoutMs: z

package/dist/conversations/conversations.service.d.ts

@@ -372,9 +372,10 @@ export declare class ConversationsService {
      * The selection a message switches to, or null when it changes nothing. A model equal to the
      * agent's means "back to the agent's model" (null); a model change without `effort` resets the
      * effort. The target model must resolve (`agent.model_unavailable`) and declare the effort
-     * (`validation_failed`). Resolving is the agent editor's check: providers are deployment-scoped
-     * and serve chat models only. If per-org provider enablement is added, this check and the run
-     * worker's `fallBackIfUnavailable` must follow it.
+     * (`validation_failed`). Resolving is the agent editor's check, for the org (its effective
+     * provider config, spec B §5.5) and its disabled lists: a model the platform or the org disabled,
+     * or a non-chat model, is refused (spec B §5.3), as the run worker's `fallBackIfUnavailable` falls
+     * back from it.
      */
     private planSwitch;
     /**

package/dist/conversations/conversations.service.js

@@ -205,7 +205,7 @@ let ConversationsService = class ConversationsService {
         if (prior)
             return prior;
         const environmentId = await this.environments.forNew(orgId, accountId, pick);
-        const next = await this.planSwitch(agent.definition, NO_SELECTION, input);
+        const next = await this.planSwitch(orgId, agent.definition, NO_SELECTION, input);
         const extra = await this.resolveExtra(orgId, accountId, input);
         const invoked = await this.prepareSkill(orgId, agentId, undefined, agent.definition, input);
         const id = randomUUID();
@@ -701,7 +701,7 @@ let ConversationsService = class ConversationsService {
             : undefined;
         const next = agent === undefined || (input.model === undefined && input.effort === undefined)
             ? null
-            : await this.planSwitch(agent, conv.selection, input);
+            : await this.planSwitch(orgId, agent, conv.selection, input);
         const extra = await this.resolveExtra(orgId, accountId, input);
         const invoked = agent === undefined
             ? undefined
@@ -741,16 +741,17 @@ let ConversationsService = class ConversationsService {
      * The selection a message switches to, or null when it changes nothing. A model equal to the
      * agent's means "back to the agent's model" (null); a model change without `effort` resets the
      * effort. The target model must resolve (`agent.model_unavailable`) and declare the effort
-     * (`validation_failed`). Resolving is the agent editor's check: providers are deployment-scoped
-     * and serve chat models only. If per-org provider enablement is added, this check and the run
-     * worker's `fallBackIfUnavailable` must follow it.
+     * (`validation_failed`). Resolving is the agent editor's check, for the org (its effective
+     * provider config, spec B §5.5) and its disabled lists: a model the platform or the org disabled,
+     * or a non-chat model, is refused (spec B §5.3), as the run worker's `fallBackIfUnavailable` falls
+     * back from it.
      */
-    async planSwitch(agent, current, input) {
+    async planSwitch(orgId, agent, current, input) {
         const next = planSelection(agent.model, current, input);
         if (next === null)
             return null;
         const { model, effort } = next;
-        const { info } = await this.providers.resolve(model ?? agent.model);
+        const { info } = await this.providers.resolve(orgId, model ?? agent.model);
         if (effort !== null) {
             const knob = info.parameters.find((p) => p.key === "effort");
             const values = knob?.schema?.enum ?? [];
@@ -771,7 +772,7 @@ let ConversationsService = class ConversationsService {
         if (pick.model === undefined && pick.effort === undefined)
             return;
         const agent = await this.agents.get(orgId, conv.agentId, accountId);
-        await this.planSwitch(agent.definition, conv.selection, pick);
+        await this.planSwitch(orgId, agent.definition, conv.selection, pick);
     }
     /**
      * Writes the message (preceded by its `model_switched` when it switches) inside `t` and updates

package/dist/ctx/create-ctx.d.ts

@@ -4,6 +4,8 @@ import { Kysely } from "kysely";
 import { type RegisteredHook } from "../extensions/hooks.js";
 import { RegistrationLedger } from "../extensions/ledger.js";
 import type { LockService } from "../infra/lock/lock.service.js";
+import type { ModelEmbeddings } from "../models/embeddings.js";
+import type { HookRunner } from "../runtime/hook-calls.js";
 import type { EmbedTokens } from "../ui/embed-token.js";
 import { type UiActionHandler, type UiRender } from "../ui/registry.js";
 import { type BusSubscriber } from "./bus.js";
@@ -22,6 +24,17 @@ export interface KernelDeps {
     keyring: Keyring;
     /** Verifies embed tokens (`ctx.ui` embed requests; the one `EmbedTokens` provider). */
     embedTokens: Pick<EmbedTokens, "verify">;
+    /**
+     * The `ctx.models` broker (the one `ModelEmbeddings` provider). Absent (a ctx built alone in a
+     * test): `ctx.models` calls reject.
+     */
+    models?: Pick<ModelEmbeddings, "embed" | "describe">;
+    /**
+     * The host's hook registry: `ctx.models.embed` fires `model.request` through it (spec B §5.4).
+     * A required key, so no builder leaves policy hooks out by omission (fail closed by
+     * construction); only a ctx built alone in a test passes `undefined` (no hooks fire).
+     */
+    hooks: HookRunner | undefined;
     runWorkers: boolean;
     /** 内核 logger（`debug` 可选：插件 Logger 没有它，测试可不给）。 */
     log: Logger & {
@@ -102,7 +115,8 @@ export declare class LiveConfig {
  * `deploymentConfig` may be a {@link LiveConfig} (shared by the instance, replaceable in place);
  * otherwise a fixed value is wrapped.
  * - Granted automatically: `kv`, `lock`, `bus`, `queue`, `log`, `db`, `config`, `provide`;
- * - `secrets` only with `permissions.secrets`, `storage` only with `permissions.storage`; `http.route`
+ * - `secrets` only with `permissions.secrets`, `storage` only with `permissions.storage`, `models`
+ *   only with `permissions.models` (and only its `embedding` purposes, through `deps.models`); `http.route`
  *   only the method + path declared in `permissions.http`; `tools.register` only names declared in
  *   `permissions.tools`; `ui.view` / `ui.action` only ids declared in `permissions.ui.views` (during
  *   setup only); `ui.invalidate` sends a refresh over the kernel bus (namespace `kernel`), across

package/dist/ctx/create-ctx.js

@@ -164,7 +164,8 @@ export class LiveConfig {
  * `deploymentConfig` may be a {@link LiveConfig} (shared by the instance, replaceable in place);
  * otherwise a fixed value is wrapped.
  * - Granted automatically: `kv`, `lock`, `bus`, `queue`, `log`, `db`, `config`, `provide`;
- * - `secrets` only with `permissions.secrets`, `storage` only with `permissions.storage`; `http.route`
+ * - `secrets` only with `permissions.secrets`, `storage` only with `permissions.storage`, `models`
+ *   only with `permissions.models` (and only its `embedding` purposes, through `deps.models`); `http.route`
  *   only the method + path declared in `permissions.http`; `tools.register` only names declared in
  *   `permissions.tools`; `ui.view` / `ui.action` only ids declared in `permissions.ui.views` (during
  *   setup only); `ui.invalidate` sends a refresh over the kernel bus (namespace `kernel`), across
@@ -218,6 +219,24 @@ export function createExtensionContext(deps, manifest, deploymentConfig, extensi
             plugins: async () => [name],
         }).forPlugin(name)
         : undefined;
+    // ctx.models: only with permissions.models; the broker accepts only the purposes declared there
+    // with kind embedding (spec B §5.4), aborted by this instance's signal
+    // a frozen copy: the approved manifest, not an object the extension could change later
+    const declaredModels = Object.freeze(structuredClone(perms.models ?? []).map((m) => Object.freeze(m)));
+    const modelsApi = declaredModels.length > 0
+        ? {
+            embed: async (req) => {
+                if (!deps.models)
+                    throw new Error(`plugin ${name}: ctx.models is not available`);
+                return deps.models.embed(name, declaredModels, req, lifecycle.signal, deps.hooks);
+            },
+            describe: async (req) => {
+                if (!deps.models)
+                    throw new Error(`plugin ${name}: ctx.models is not available`);
+                return deps.models.describe(name, declaredModels, req);
+            },
+        }
+        : undefined;
     const declaredRoutes = new Set((perms.http ?? []).map((r) => `${r.method} ${r.path}`));
     const declaredTools = new Set(perms.tools ?? []);
     const declaredHooks = new Set(perms.hooks ?? []);
@@ -561,7 +580,8 @@ export function createExtensionContext(deps, manifest, deploymentConfig, extensi
             return closing;
         },
     };
-    // 声明了 secrets / storage 时是普通属性；未声明时是不可枚举的抛错 getter——展开 / 打印 ctx 不会触发越权与审计
+    // secrets / storage / models: a plain property when declared; otherwise a non-enumerable getter
+    // that throws, so spreading or printing ctx triggers no denial and no audit
     const gated = (key, api) => {
         if (api) {
             Object.assign(ctx, { [key]: api });
@@ -575,6 +595,7 @@ export function createExtensionContext(deps, manifest, deploymentConfig, extensi
     };
     gated("secrets", secretsApi);
     gated("storage", storageApi);
+    gated("models", modelsApi);
     return ctx;
 }
 /**

package/dist/db/kernel-schema.d.ts

@@ -1012,6 +1012,28 @@ export interface UsageReportSweepTable {
     watermark: Ts;
     updated_at: ColumnType<Date, Date | string | undefined, Date | string>;
 }
+/** A model disabled on the platform (`org_id` null) or in one org (0089, spec B §5.3). */
+export interface ModelDisabledTable {
+    org_id: string | null;
+    provider: string;
+    model: string;
+    disabled_by: string | null;
+    disabled_at: Ts;
+}
+/** One model call outside a conversation, e.g. an extension's embed call (0089, spec B §5.4). */
+export interface ModelUsageTable {
+    id: Generated<string>;
+    org_id: string;
+    extension: string;
+    purpose: string;
+    provider: string;
+    model: string;
+    input_tokens: number;
+    occurred_at: Ts;
+    reported_at: TsNullable;
+    /** Set when the row's `usage.report` job gave up after its last attempt (the sweep skips it). */
+    report_failed_at: TsNullable;
+}
 export interface KernelDatabase {
     accounts: AccountsTable;
     identities: IdentitiesTable;
@@ -1071,6 +1093,8 @@ export interface KernelDatabase {
     eval_runs: EvalRunsTable;
     eval_results: EvalResultsTable;
     model_purpose_mappings: ModelPurposeMappingsTable;
+    model_disabled: ModelDisabledTable;
+    model_usage: ModelUsageTable;
     extension_packages: ExtensionPackagesTable;
     extension_blobs: ExtensionBlobsTable;
     extension_installs: ExtensionInstallsTable;

package/dist/errors.d.ts

@@ -280,6 +280,9 @@ export declare const ERROR_CODES: {
     readonly "eval.candidate_invalid": 400;
     readonly "model.unconfigured": 409;
     readonly "model.purpose_unknown": 404;
+    readonly "model.provider_not_found": 404;
+    /** An extension's `ctx.models.embed` call was denied by a `model.request` policy hook. */
+    readonly "model.hook_denied": 403;
     readonly "eval.result_not_found": 404;
 };
 export type ErrorCode = keyof typeof ERROR_CODES;