@capybara-hq/kernel 0.1.0-rc.5 → 0.1.0-rc.6

package/dist/errors.js

@@ -280,6 +280,9 @@ export const ERROR_CODES = {
     "eval.candidate_invalid": 400,
     "model.unconfigured": 409,
     "model.purpose_unknown": 404,
+    "model.provider_not_found": 404,
+    /** An extension's `ctx.models.embed` call was denied by a `model.request` policy hook. */
+    "model.hook_denied": 403,
     "eval.result_not_found": 404,
 };
 /** 业务代码抛出的 API 错误；由 HTTP 层的错误过滤器转成错误信封。 */

package/dist/evals/run-replay.js

@@ -435,8 +435,10 @@ export async function replayRun(d, s, candidate, evalRunId, signal) {
         return metered;
     };
     const registry = {
-        resolve: async (ref) => {
-            const r = await d.registry.resolve(ref);
+        // the case's org (its effective provider config), whatever the replayed step passes
+        // (and its disabled lists: a candidate disabled there is refused, spec B §5.3)
+        resolve: async (_orgId, ref, opts) => {
+            const r = await d.registry.resolve(s.orgId, ref, opts);
             return { ...r, provider: meter(r.provider) };
         },
     };

package/dist/evals/runs.service.d.ts

@@ -149,7 +149,8 @@ export declare class EvalRunsService {
     private liveSet;
     /**
      * 解析模型；不存在 / 不可用 → `eval.candidate_invalid`（供应商列表暂时失败照常抛出）。
-     * 按部署范围解析，与运行时一致；组织级模型准入若在第二段落地，须同样覆盖评测候选。
+     * Resolved for the org (its effective provider config), as the runtime does; per-org model
+     * admission must cover eval candidates the same way.
      */
     private resolveModel;
     /**

package/dist/evals/runs.service.js

@@ -187,11 +187,12 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
     }
     /**
      * 解析模型；不存在 / 不可用 → `eval.candidate_invalid`（供应商列表暂时失败照常抛出）。
-     * 按部署范围解析，与运行时一致；组织级模型准入若在第二段落地，须同样覆盖评测候选。
+     * Resolved for the org (its effective provider config), as the runtime does; per-org model
+     * admission must cover eval candidates the same way.
      */
-    async resolveModel(ref) {
+    async resolveModel(orgId, ref) {
         try {
-            return await this.d.registry.resolve(ref);
+            return await this.d.registry.resolve(orgId, ref);
         }
         catch (e) {
             if (e instanceof ProviderListError)
@@ -208,7 +209,7 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
      * 校验候选：版本存在（该集合的 agent）、模型可解析、参数按所用模型的声明严格通过（`paramIssues`）。
      * 所用模型 = 候选模型，否则候选版本的模型，否则 agent 当前版本的模型。返回候选版本的定义。
      */
-    async checkCandidate(agentId, c) {
+    async checkCandidate(orgId, agentId, c) {
         const versionDef = await versionDefinition(this.d.db, agentId, c.agentVersion);
         if (c.agentVersion !== undefined && versionDef === undefined) {
             throw candidateInvalid(`Agent version ${c.agentVersion} does not exist`, [
@@ -227,7 +228,7 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
         }
         if (model === undefined)
             return versionDef;
-        const { info } = await this.resolveModel(model);
+        const { info } = await this.resolveModel(orgId, model);
         if (c.modelParams !== undefined) {
             const issues = paramIssues("candidate.modelParams", info.parameters, c.modelParams);
             if (issues.length > 0)
@@ -239,7 +240,7 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
      * 各用例的回放计划与成本：只读写入时存好的列（`plan_step` / `plan_run`、`base_model`），不读快照。
      * 给了候选参数时按每个用例实际所用的模型严格校验（同一模型在一次调用里只解析一次）。
      */
-    async plan(setId, mode, c, versionDef) {
+    async plan(orgId, setId, mode, c, versionDef) {
         const table = await this.d.prices.table();
         const versionOnly = c.agentVersion !== undefined && c.model === undefined;
         const rows = await this.d.db
@@ -277,7 +278,7 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
                 const key = priceKey(model.provider, model.model);
                 if (!infos.has(key)) {
                     try {
-                        infos.set(key, (await this.d.registry.resolve(model)).info);
+                        infos.set(key, (await this.d.registry.resolve(orgId, model)).info);
                     }
                     catch (e) {
                         if (e instanceof ProviderListError)
@@ -329,7 +330,7 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
         }
         let maxOutputTokens = configured;
         try {
-            const { info } = await this.d.registry.resolve(target.model);
+            const { info } = await this.d.registry.resolve(orgId, target.model);
             maxOutputTokens = Math.min(configured, info.maxOutputTokens);
         }
         catch (e) {
@@ -396,8 +397,8 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
         const set = await this.liveSet(orgId, setId);
         await this.assertAgentLive(set.agent_id);
         const caps = this.tokenCaps(input.tokenCap);
-        const versionDef = await this.checkCandidate(set.agent_id, input.candidate);
-        const plans = await this.plan(setId, input.mode, input.candidate, versionDef);
+        const versionDef = await this.checkCandidate(orgId, set.agent_id, input.candidate);
+        const plans = await this.plan(orgId, setId, input.mode, input.candidate, versionDef);
         const judge = await this.judgePricing(orgId, set.rubric, input.judge);
         return { estimate: await this.summarize(plans, judge), ...caps };
     }
@@ -421,11 +422,11 @@ let EvalRunsService = EvalRunsService_1 = class EvalRunsService {
         const set = await this.liveSet(orgId, setId);
         await this.assertAgentLive(set.agent_id);
         const tokenCap = this.tokenCaps(input.tokenCap).effectiveTokenCap;
-        const versionDef = await this.checkCandidate(set.agent_id, input.candidate);
+        const versionDef = await this.checkCandidate(orgId, set.agent_id, input.candidate);
         if (input.judge)
             await this.d.purposes.resolve(orgId, "eval");
         const judge = await this.judgePricing(orgId, set.rubric, input.judge);
-        const planned = await this.plan(setId, input.mode, input.candidate, versionDef);
+        const planned = await this.plan(orgId, setId, input.mode, input.candidate, versionDef);
         if (planned.length === 0) {
             throw new ApiError("eval.nothing_to_replay", "The eval set has nothing to replay");
         }

package/dist/evals/step-replay.d.ts

@@ -92,7 +92,8 @@ export declare class ReplayAttemptError extends Error {
  * 否则带候选的定义、版本与参数——参数按候选模型的声明宽松处理，与运行时一致），用 `consumeModelStream` 收完。
  * 请求发出之前的错误原样抛出（`agent.model_unavailable`、取附件暂时失败为 `MediaUnavailableError`）；请求发出之后的
  * 错误包成 {@link ReplayAttemptError}（带估算用量，调用方计入预算后按 `cause` 分类重试）。
- * 模型按部署范围解析（与运行时一致；组织级模型准入若在第二段落地，须同样覆盖评测候选）。
+ * The candidate model resolves in the snapshot's org like the runtime (its effective provider
+ * config and disabled lists: a model disabled there is `agent.model_unavailable`, spec B §5.3).
  * 不另设单次请求的墙钟时限：与运行时一样只有流空闲看门狗（`streamIdleTimeoutMs` / `runtime.streamIdleMs`）。
  */
 export declare function replayStep(d: StepReplayDeps, s: CaseSnapshot, call: {

package/dist/evals/step-replay.js

@@ -126,12 +126,13 @@ function baselineOf(s, call) {
  * 否则带候选的定义、版本与参数——参数按候选模型的声明宽松处理，与运行时一致），用 `consumeModelStream` 收完。
  * 请求发出之前的错误原样抛出（`agent.model_unavailable`、取附件暂时失败为 `MediaUnavailableError`）；请求发出之后的
  * 错误包成 {@link ReplayAttemptError}（带估算用量，调用方计入预算后按 `cause` 分类重试）。
- * 模型按部署范围解析（与运行时一致；组织级模型准入若在第二段落地，须同样覆盖评测候选）。
+ * The candidate model resolves in the snapshot's org like the runtime (its effective provider
+ * config and disabled lists: a model disabled there is `agent.model_unavailable`, spec B §5.3).
  * 不另设单次请求的墙钟时限：与运行时一样只有流空闲看门狗（`streamIdleTimeoutMs` / `runtime.streamIdleMs`）。
  */
 export async function replayStep(d, s, call, candidate, signal) {
     const baseline = baselineOf(s, call);
-    const { provider, info } = await d.registry.resolve(candidate.model);
+    const { provider, info } = await d.registry.resolve(s.orgId, candidate.model);
     let media;
     if (d.media) {
         try {

package/dist/extensions/config-hash.d.ts

@@ -0,0 +1,10 @@
+import type { core } from "zod";
+/**
+ * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
+ * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
+ * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
+ * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
+ * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
+ * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
+ */
+export declare function deploymentConfigHash(schema: core.$ZodType | undefined, config: unknown): string;

package/dist/extensions/config-hash.js

@@ -0,0 +1,38 @@
+import { createHash } from "node:crypto";
+import { configFields, getPath, setPath } from "../config/fields.js";
+/** 键排序后的 JSON（对象键顺序不影响结果）；undefined 字段与 JSON.stringify 一样省略。 */
+const canonicalJson = (v) => {
+    if (Array.isArray(v))
+        return `[${v.map((x) => (x === undefined ? "null" : canonicalJson(x))).join(",")}]`;
+    if (v !== null && typeof v === "object") {
+        const entries = Object.entries(v)
+            .filter(([, x]) => x !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([k, x]) => `${JSON.stringify(k)}:${canonicalJson(x)}`).join(",")}}`;
+    }
+    return JSON.stringify(v) ?? "null";
+};
+/** 遮蔽 secret 字段后参与摘要的固定占位值。 */
+const SECRET_PLACEHOLDER = "<secret>";
+/**
+ * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
+ * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
+ * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
+ * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
+ * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
+ * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
+ */
+export function deploymentConfigHash(schema, config) {
+    let redacted = null;
+    if (schema) {
+        redacted = structuredClone(config);
+        if (redacted !== null && typeof redacted === "object") {
+            for (const f of configFields(schema)) {
+                if (f.meta?.secret && getPath(redacted, f.path) !== undefined) {
+                    setPath(redacted, f.path, SECRET_PLACEHOLDER);
+                }
+            }
+        }
+    }
+    return createHash("sha256").update(canonicalJson(redacted)).digest("hex").slice(0, 16);
+}

package/dist/extensions/extensions.module.js

@@ -6,19 +6,16 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 import { Module } from "@nestjs/common";
 import { SuperAdminLockModule } from "../identity/super-admin.js";
+import { ModelsModule } from "../models/models.module.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
 import { StorageModule } from "../storage/storage.module.js";
 import { EmbedTokensModule } from "../ui/embed-token.js";
 import { ExtensionAdminOps } from "./admin-ops.js";
 import { ExtensionAdmin } from "./admin-view.js";
-import { ExtensionApprovals } from "./approvals.js";
-import { ExtensionBlobs } from "./blobs.js";
 import { BootstrapService } from "./bootstrap.js";
 import { ExtensionDeploymentConfigService } from "./deployment-config.js";
 import { ExtensionDisplayNames } from "./display-name.js";
-import { EffectiveConfigs } from "./effective-config.js";
 import { ExtensionHost } from "./host.js";
-import { ExtensionInstalls } from "./installs.js";
 import { ExtensionLifecycle } from "./lifecycle.js";
 import { PluginApproveLock, PluginDeploymentConfigLock, PluginInstallLock } from "./locks.js";
 import { OrgExtensionConfigs } from "./org-config.js";
@@ -26,6 +23,7 @@ import { OrgOverrides } from "./org-overrides.js";
 import { ExtensionPointDefaults } from "./point-defaults.js";
 import { ExtensionRegistryModule } from "./registry.js";
 import { ReplicaStatusStore } from "./sources.js";
+import { ExtensionStateModule } from "./state.module.js";
 /**
  * The extensions domain: the extension host (it builds each `ctx` from the injected kernel
  * services), the package store and install records (the desired state the host converges to, one
@@ -43,14 +41,14 @@ ExtensionsModule = __decorate([
             StorageModule,
             // ctx.ui verifies embed tokens with the one provider the UI routes issue them with
             EmbedTokensModule,
+            ExtensionStateModule,
+            // ctx.models: the embeddings broker (models domain, below the host through ExtensionStateModule)
+            ModelsModule,
         ],
         providers: [
             PluginInstallLock,
             PluginApproveLock,
             PluginDeploymentConfigLock,
-            ExtensionApprovals,
-            ExtensionBlobs,
-            ExtensionInstalls,
             ReplicaStatusStore,
             ExtensionHost,
             ExtensionLifecycle,
@@ -58,7 +56,6 @@ ExtensionsModule = __decorate([
             ExtensionAdminOps,
             ExtensionDisplayNames,
             ExtensionDeploymentConfigService,
-            EffectiveConfigs,
             OrgExtensionConfigs,
             OrgOverrides,
             ExtensionPointDefaults,
@@ -66,11 +63,9 @@ ExtensionsModule = __decorate([
         ],
         exports: [
             ExtensionRegistryModule,
+            ExtensionStateModule,
             PluginInstallLock,
             PluginApproveLock,
-            ExtensionApprovals,
-            ExtensionBlobs,
-            ExtensionInstalls,
             ReplicaStatusStore,
             ExtensionHost,
             ExtensionLifecycle,
@@ -78,7 +73,6 @@ ExtensionsModule = __decorate([
             ExtensionAdminOps,
             ExtensionDisplayNames,
             ExtensionDeploymentConfigService,
-            EffectiveConfigs,
             OrgExtensionConfigs,
             OrgOverrides,
             ExtensionPointDefaults,

package/dist/extensions/host.d.ts

@@ -10,9 +10,11 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import type { KernelLogger } from "../log.js";
+import { ModelEmbeddings } from "../models/embeddings.js";
 import { EmbedTokens } from "../ui/embed-token.js";
 import type { UiActionHandler, UiRender } from "../ui/registry.js";
 import { ExtensionApprovals, type PendingExtension } from "./approvals.js";
+import { deploymentConfigHash } from "./config-hash.js";
 import { EffectiveConfigs } from "./effective-config.js";
 import { HookRegistry } from "./hooks.js";
 import type { InflightTracker } from "./inflight.js";
@@ -21,15 +23,7 @@ import { type ExtensionInstance } from "./instance.js";
 import { type PermissionSet } from "./permission-set.js";
 import { type ExtensionPointEntry, ExtensionRegistry } from "./registry.js";
 import { type ExtensionSource, ReplicaStatusStore } from "./sources.js";
-/**
- * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
- * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
- * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
- * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
- * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
- * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
- */
-export declare function deploymentConfigHash(schema: core.$ZodType | undefined, config: unknown): string;
+export { deploymentConfigHash };
 /** One item of {@link ExtensionHost.uiContributions}: a UI contribution from the manifest with its registered view / action (embeds have none). */
 export interface LoadedUiContribution {
     plugin: string;
@@ -255,7 +249,9 @@ export declare class ExtensionHost {
      * Each hook call's effective config for its organization, and the providers excluded from an
      * org's point resolution (layering spec A §6).
      */
-    effective: Pick<EffectiveConfigs, "get">);
+    effective: Pick<EffectiveConfigs, "get">, 
+    /** `ctx.models`: the embeddings broker (spec B §5.4). */
+    models: Pick<ModelEmbeddings, "embed" | "describe">);
     /** The startup config's `extensionConfig` (file / Nacos merged with env). */
     private get extensionConfig();
     /** `extensionPermissions.autoApprove` (development and trials only; see `planApprovals`). */

package/dist/extensions/host.js

@@ -7,14 +7,13 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, resolve as resolvePath } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { EXTENSION_POINT_CARDINALITY, parseExtensionPoint, SDK_VERSION, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
-import { changedPaths, configFields, getPath, secretValues, setPath, unreachableSecrets, } from "../config/fields.js";
+import { changedPaths, configFields, secretValues, unreachableSecrets } from "../config/fields.js";
 import { pluginSchemaName, queryEnabledPlugins, } from "../ctx/create-ctx.js";
 import { kernelDb } from "../db/kernel-schema.js";
 import { migrate } from "../db/migrator.js";
@@ -25,10 +24,12 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import { KERNEL_LOGGER, KEYRING, REDIS, REDIS_SUBSCRIBER } from "../infra/tokens.js";
 import { KERNEL_APP_OPTIONS } from "../lifecycle/tokens.js";
+import { ModelEmbeddings } from "../models/embeddings.js";
 import { packagePath } from "../packages/tgz.js";
 import { EmbedTokens } from "../ui/embed-token.js";
 import { ExtensionApprovals, planApprovals, readSnapshots, withPreApproved, } from "./approvals.js";
 import { ExtensionBlobIntegrityError } from "./blobs.js";
+import { deploymentConfigHash } from "./config-hash.js";
 import { toIssues } from "./config-issues.js";
 import { configFormSchema, describeConfigUiProblems } from "./config-json-schema.js";
 import { EffectiveConfigs } from "./effective-config.js";
@@ -42,42 +43,7 @@ import { ExtensionRegistry } from "./registry.js";
 import { ExtensionResolveError, resolveExtensions } from "./resolve.js";
 import { ReplicaStatusStore, } from "./sources.js";
 import { PackageShaMismatchError, packageRootOf } from "./sync.js";
-/** 键排序后的 JSON（对象键顺序不影响结果）；undefined 字段与 JSON.stringify 一样省略。 */
-const canonicalJson = (v) => {
-    if (Array.isArray(v))
-        return `[${v.map((x) => (x === undefined ? "null" : canonicalJson(x))).join(",")}]`;
-    if (v !== null && typeof v === "object") {
-        const entries = Object.entries(v)
-            .filter(([, x]) => x !== undefined)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-        return `{${entries.map(([k, x]) => `${JSON.stringify(k)}:${canonicalJson(x)}`).join(",")}}`;
-    }
-    return JSON.stringify(v) ?? "null";
-};
-/** 遮蔽 secret 字段后参与摘要的固定占位值。 */
-const SECRET_PLACEHOLDER = "<secret>";
-/**
- * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
- * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
- * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
- * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
- * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
- * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
- */
-export function deploymentConfigHash(schema, config) {
-    let redacted = null;
-    if (schema) {
-        redacted = structuredClone(config);
-        if (redacted !== null && typeof redacted === "object") {
-            for (const f of configFields(schema)) {
-                if (f.meta?.secret && getPath(redacted, f.path) !== undefined) {
-                    setPath(redacted, f.path, SECRET_PLACEHOLDER);
-                }
-            }
-        }
-    }
-    return createHash("sha256").update(canonicalJson(redacted)).digest("hex").slice(0, 16);
-}
+export { deploymentConfigHash };
 const CLOSED_DURING_LOAD = "plugin host closed during load";
 /** 停机时等进行中的 unload / reload 的上限（之后直接关闭 setup 中的 ctx、撤销其余实例）。 */
 const CLOSE_LIFECYCLE_WAIT_MS = 2_000;
@@ -415,7 +381,9 @@ let ExtensionHost = class ExtensionHost {
      * Each hook call's effective config for its organization, and the providers excluded from an
      * org's point resolution (layering spec A §6).
      */
-    effective) {
+    effective, 
+    /** `ctx.models`: the embeddings broker (spec B §5.4). */
+    models) {
         this.registry = registry;
         this.installs = installs;
         this.approvals = approvals;
@@ -424,6 +392,16 @@ let ExtensionHost = class ExtensionHost {
         this.log = log;
         this.effective = effective;
         const c = config.get();
+        this.hooks = new HookRegistry({
+            instances: () => this.registry.all(),
+            current: (plugin) => this.registry.current(plugin),
+            expectedPolicy: (mount) => this.expectedPolicy(mount),
+            enabledPlugins: (orgId) => this.enabledPlugins(orgId),
+            effectiveConfig: (orgId, plugin) => effective.get(orgId, plugin),
+            locks,
+            config: () => ({ hooks: { timeoutMs: this.config.get().hooks.timeoutMs } }),
+            log,
+        });
         this.deps = {
             db: kdb.pool,
             dbUrl: c.db.url,
@@ -433,20 +411,13 @@ let ExtensionHost = class ExtensionHost {
             redisUrl: c.redis.url,
             keyring,
             embedTokens,
+            models,
+            // ctx.models.embed fires model.request through the same registry (spec B §5.4)
+            hooks: this.hooks,
             locks,
             runWorkers: c.roles.includes("worker"),
             log,
         };
-        this.hooks = new HookRegistry({
-            instances: () => this.registry.all(),
-            current: (plugin) => this.registry.current(plugin),
-            expectedPolicy: (mount) => this.expectedPolicy(mount),
-            enabledPlugins: (orgId) => this.enabledPlugins(orgId),
-            effectiveConfig: (orgId, plugin) => effective.get(orgId, plugin),
-            locks,
-            config: () => ({ hooks: { timeoutMs: this.config.get().hooks.timeoutMs } }),
-            log,
-        });
         this.registry.onChange(() => {
             this.installedCache = undefined;
         });
@@ -2201,6 +2172,7 @@ ExtensionHost = __decorate([
     __param(10, Inject(LockService)),
     __param(11, Inject(KERNEL_LOGGER)),
     __param(12, Inject(KERNEL_APP_OPTIONS)),
-    __param(13, Inject(EffectiveConfigs))
+    __param(13, Inject(EffectiveConfigs)),
+    __param(14, Inject(ModelEmbeddings))
 ], ExtensionHost);
 export { ExtensionHost };

package/dist/extensions/state.module.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The extension state the model domain reads below the host: the install records with their
+ * packages and approvals, and each extension's effective config per org. Apart from
+ * `ExtensionsModule` so the model provider registry (and the `ctx.models` broker the host injects)
+ * can depend on it without a module cycle (writing-kernel-api: a cycle is cut by moving the shared
+ * part into its own provider both sides inject). `ExtensionsModule` re-exports it.
+ */
+export declare class ExtensionStateModule {
+}

package/dist/extensions/state.module.js

@@ -0,0 +1,38 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { SuperAdminLockModule } from "../identity/super-admin.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
+import { StorageModule } from "../storage/storage.module.js";
+import { ExtensionApprovals } from "./approvals.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionRegistryModule } from "./registry.js";
+/**
+ * The extension state the model domain reads below the host: the install records with their
+ * packages and approvals, and each extension's effective config per org. Apart from
+ * `ExtensionsModule` so the model provider registry (and the `ctx.models` broker the host injects)
+ * can depend on it without a module cycle (writing-kernel-api: a cycle is cut by moving the shared
+ * part into its own provider both sides inject). `ExtensionsModule` re-exports it.
+ */
+let ExtensionStateModule = class ExtensionStateModule {
+};
+ExtensionStateModule = __decorate([
+    Module({
+        imports: [ExtensionRegistryModule, SuperAdminLockModule, OrgLockModule, StorageModule],
+        providers: [ExtensionApprovals, ExtensionBlobs, ExtensionInstalls, EffectiveConfigs],
+        exports: [
+            ExtensionRegistryModule,
+            ExtensionApprovals,
+            ExtensionBlobs,
+            ExtensionInstalls,
+            EffectiveConfigs,
+        ],
+    })
+], ExtensionStateModule);
+export { ExtensionStateModule };

package/dist/http/api.module.js

@@ -47,6 +47,7 @@ import { MeController } from "../identity/me.controller.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
 import { InboxModule } from "../inbox/inbox.module.js";
 import { PlatformInboxController } from "../inbox/platform-inbox.controller.js";
+import { ModelEnablementController } from "../models/enablement.controller.js";
 import { ModelsModule } from "../models/models.module.js";
 import { ModelPurposesController } from "../models/purposes.controller.js";
 import { DirectorySyncController } from "../orgs/directory-sync.controller.js";
@@ -92,6 +93,7 @@ const CONTROLLERS = [
     AgentSaveAsTemplateController,
     PendingConnectorsController,
     ModelsController,
+    ModelEnablementController,
     ReadinessController,
     ConversationsController,
     BackgroundController,

package/dist/http/plugin-dispatch.d.ts

@@ -45,7 +45,10 @@ export declare function createPluginRouter(routes: Route[]): PluginRouter;
  * - `req.signal` aborts only when the client disconnects before the response is written (not on
  *   normal completion); long-lived handlers use it to unsubscribe;
  * - a throwing handler is logged (path redacted with `redactPath`) and returns 500 `internal` (the
- *   error message is not echoed).
+ *   error message is not echoed), except a `model.hook_denied` `ApiError` that escaped from
+ *   `ctx.models.embed` (an organization policy hook denied the call, spec B §5.4): a deliberate
+ *   outcome, not a failure, so it answers 403 `model.hook_denied` with a generic message (the
+ *   routes are unauthenticated: the policy extension's name and reason are not echoed).
  * - Fastify's own errors (a body over 1 MiB and so on) are mapped to the error envelope by the
  *   scope's error handler: 4xx by the common error code table (413 `payload_too_large`, 415
  *   `unsupported_media_type` and so on), 5xx are logged and return `internal`.

package/dist/http/plugin-dispatch.js

@@ -1,6 +1,6 @@
 import { Readable } from "node:stream";
 import FindMyWay from "find-my-way";
-import { errorBody } from "../errors.js";
+import { ApiError, ERROR_CODES, errorBody } from "../errors.js";
 import { ACCESS_COOKIE, REFRESH_COOKIE } from "../identity/cookies.js";
 import { codeForStatus, redactPath } from "./error.filter.js";
 /** 插件路由都在此前缀下（ctx.http.route 已加 `/plugins/<name>` 前缀）。 */
@@ -47,7 +47,10 @@ export function createPluginRouter(routes) {
  * - `req.signal` aborts only when the client disconnects before the response is written (not on
  *   normal completion); long-lived handlers use it to unsubscribe;
  * - a throwing handler is logged (path redacted with `redactPath`) and returns 500 `internal` (the
- *   error message is not echoed).
+ *   error message is not echoed), except a `model.hook_denied` `ApiError` that escaped from
+ *   `ctx.models.embed` (an organization policy hook denied the call, spec B §5.4): a deliberate
+ *   outcome, not a failure, so it answers 403 `model.hook_denied` with a generic message (the
+ *   routes are unauthenticated: the policy extension's name and reason are not echoed).
  * - Fastify's own errors (a body over 1 MiB and so on) are mapped to the error envelope by the
  *   scope's error handler: 4xx by the common error code table (413 `payload_too_large`, 415
  *   `unsupported_media_type` and so on), 5xx are logged and return `internal`.
@@ -108,6 +111,15 @@ export async function registerPluginDispatch(fastify, getTable, log) {
             res = await pluginHandler(webReq);
         }
         catch (err) {
+            if (err instanceof ApiError && err.code === "model.hook_denied") {
+                log.warn("plugin handler refused: a policy hook denied its model call", {
+                    method: req.method,
+                    path: redactPath(path),
+                });
+                return reply
+                    .code(ERROR_CODES["model.hook_denied"])
+                    .send(errorBody(err.code, "An organization policy denied this model call"));
+            }
             log.error("plugin handler failed", { method: req.method, path: redactPath(path), err });
             return reply.code(500).send(errorBody("internal", "Internal error"));
         }

package/dist/infra/config/kernel-config.service.js

@@ -28,6 +28,9 @@ const HOT_APPLIERS = {
     "auth.trustedIdentitySources": () => { },
     // The hook registry reads the time limit on every run.
     "hooks.timeoutMs": () => { },
+    // The provider registry reads the list time limit at every listModels call.
+    "models.listTimeoutMs": () => { },
+    "models.embedTimeoutMs": () => { },
     // SandboxService reads the shared-lease cap at every acquisition.
     "sandbox.maxConcurrentCommands": () => { },
     // The environments service reads the personal limit at every create.

package/dist/infra/events/kernel-events.d.ts

@@ -95,6 +95,14 @@ export interface KernelEventMap {
     "background_task.finished": {
         conversationId: string;
     };
+    /**
+     * An extension's `ctx.models.embed` call wrote a `model_usage` row (after the commit, spec B
+     * §5.4). The usage reporter enqueues its `usage.report` delivery; a lost event is re-derived by
+     * the usage sweep (rows whose `reported_at` is still null).
+     */
+    "model_usage.recorded": {
+        id: string;
+    };
 }
 type Handler<K extends keyof KernelEventMap> = (payload: KernelEventMap[K]) => Promise<void> | void;
 /** Typed in-process event emitter; handlers run in order, a failing one is logged and skipped. */