@capybara-hq/kernel 0.1.0-rc.5 → 0.1.0-rc.6

package/dist/models/enablement.js

@@ -0,0 +1,263 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { ExtensionRegistry, ExtensionRegistryModule } from "../extensions/registry.js";
+import { audit } from "../identity/audit.js";
+import { SuperAdminLock, SuperAdminLockModule } from "../identity/super-admin.js";
+import { CacheService } from "../infra/cache/cache.service.js";
+import { Cacheable, CacheEvict } from "../infra/cache/cacheable.decorator.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OrgLock, OrgLockModule } from "../orgs/org-lock.js";
+/** The key of a model in a disabled set: `provider\u0000model`. */
+export const modelKey = (provider, model) => `${provider}\u0000${model}`;
+/** How long a disabled list stays cached (s); every write evicts it after its commit. */
+const DISABLED_TTL_SECONDS = 300;
+/** The cache key of a scope's disabled list (`platform` or `org.<id>`). */
+const PLATFORM_SCOPE = "platform";
+const orgScope = (orgId) => `org.${orgId}`;
+/**
+ * Models disabled on two layers (spec B §5.3, table `model_disabled`): the platform's list (the
+ * super admin; such a model is invisible to every org) and each org's (an org admin). Every model a
+ * provider lists is enabled unless a layer disabled it; a row keys on the model id, so it applies to
+ * whichever list the org sees, and an id the list does not contain is kept harmlessly. Disabling
+ * never creates an org config copy.
+ *
+ * The lists are read from PG and cached in Redis (`@Cacheable`, evicted after the commit of each
+ * write), never in process memory. `ProviderRegistry` filters its lists and `resolve` with them;
+ * purposes check their targets with {@link isEnabled}.
+ */
+let ModelEnablement = class ModelEnablement {
+    kdb;
+    txHost;
+    cacheService;
+    extensions;
+    adminLock;
+    orgLock;
+    constructor(kdb, txHost, cacheService, extensions, adminLock, orgLock) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.cacheService = cacheService;
+        this.extensions = extensions;
+        this.adminLock = adminLock;
+        this.orgLock = orgLock;
+    }
+    get db() {
+        return this.kdb.db;
+    }
+    /** One layer's disabled models (keys {@link modelKey}): the platform's (`null`) or the org's own. */
+    async disabled(orgId) {
+        return new Set(await this.disabledKeys(orgId === null ? PLATFORM_SCOPE : orgScope(orgId)));
+    }
+    async disabledKeys(scope) {
+        const orgId = scope === PLATFORM_SCOPE ? null : scope.slice("org.".length);
+        const rows = await this.rowsOf(orgId);
+        return rows.map((r) => modelKey(r.provider, r.model)).sort();
+    }
+    rowsOf(orgId, provider) {
+        let q = this.db
+            .selectFrom("model_disabled")
+            .select(["provider", "model"])
+            .where((eb) => (orgId === null ? eb("org_id", "is", null) : eb("org_id", "=", orgId)));
+        if (provider !== undefined)
+            q = q.where("provider", "=", provider);
+        return q.execute();
+    }
+    /**
+     * The extensions `orgId` explicitly turned off: a row of the org's own switch
+     * (`extension_org_configs.enabled = false`, what the org's extension or plugin switch writes when
+     * an org admin turns it off), never a required bootstrap plugin. An extension with no row for the
+     * org is not in the set (it keeps working as before: spec A §8 with B's no-breakage anti-goal).
+     * Read from PG on every call (one small query; the switch has its own writers, nothing to evict).
+     */
+    async switchedOff(orgId) {
+        const rows = await this.db
+            .selectFrom("extension_org_configs as eoc")
+            .leftJoin("extension_installs as ri", (j) => j.onRef("ri.name", "=", "eoc.plugin").on("ri.required", "=", true))
+            .select("eoc.plugin")
+            .where("eoc.org_id", "=", orgId)
+            .where("eoc.enabled", "=", false)
+            .where("ri.name", "is", null)
+            .execute();
+        return new Set(rows.map((r) => r.plugin));
+    }
+    /** Whether neither the platform nor `orgId` disabled the model (the lists only; see the class). */
+    async isEnabled(orgId, provider, model) {
+        const key = modelKey(provider, model);
+        const [platform, org] = await Promise.all([this.disabled(null), this.disabled(orgId)]);
+        return !platform.has(key) && !org.has(key);
+    }
+    /**
+     * Changes the platform's disabled ids of `provider` by `change` (super admin, re-checked under
+     * the lock): ids in neither list keep their stored state. Returns what now points at a newly
+     * disabled model, across orgs.
+     */
+    async setPlatform(provider, change, actor) {
+        await this.adminLock.lockAndAuthorize(actor.accountId);
+        return this.apply(null, provider, change, actor);
+    }
+    /**
+     * Changes the org's disabled ids of `provider` by `change` (`org.models.manage`, re-checked under
+     * the org lock): ids in neither list keep their stored state, so rows for models the org's page
+     * does not show (platform-disabled, or no longer listed) survive. Returns what in the org now
+     * points at a newly disabled model (its agents, its overrides and the deployment defaults it uses).
+     */
+    async setOrg(orgId, provider, change, actor) {
+        await this.orgLock.lockAndAuthorize(orgId, actor.accountId, "org.models.manage");
+        return this.apply(orgId, provider, change, actor);
+    }
+    async apply(orgId, provider, change, actor) {
+        if (!this.extensions.list("model-provider").some((e) => e.plugin === provider)) {
+            throw new ApiError("model.provider_not_found", `Model provider ${provider} is not installed`);
+        }
+        const disable = new Set(change.disable);
+        const both = change.enable.filter((m) => disable.has(m));
+        if (both.length > 0) {
+            throw new ApiError("validation_failed", `A model cannot be both disabled and enabled: ${[...new Set(both)].join(", ")}`);
+        }
+        const had = new Set((await this.rowsOf(orgId, provider)).map((r) => r.model));
+        const added = [...disable].filter((m) => !had.has(m)).sort();
+        const removed = [...new Set(change.enable)].filter((m) => had.has(m)).sort();
+        if (removed.length > 0) {
+            await this.db
+                .deleteFrom("model_disabled")
+                .where((eb) => (orgId === null ? eb("org_id", "is", null) : eb("org_id", "=", orgId)))
+                .where("provider", "=", provider)
+                .where("model", "in", removed)
+                .execute();
+        }
+        if (added.length > 0) {
+            await this.db
+                .insertInto("model_disabled")
+                .values(added.map((model) => ({
+                org_id: orgId,
+                provider,
+                model,
+                disabled_by: actor.accountId,
+            })))
+                .execute();
+        }
+        if (added.length > 0 || removed.length > 0) {
+            await audit(this.db, {
+                actorAccountId: actor.accountId,
+                ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
+                ...(orgId !== null && { orgId }),
+                action: orgId === null ? "model.disabled_set" : "org.model_disabled_set",
+                target: provider,
+                detail: {
+                    scope: orgId === null ? "platform" : "org",
+                    disabled: added,
+                    enabled: removed,
+                },
+            });
+        }
+        return {
+            affected: {
+                agents: await this.agentsUsing(orgId, provider, added),
+                purposes: await this.purposesUsing(orgId, provider, added),
+            },
+        };
+    }
+    /** Live agents (of `orgId`, or of every org) whose current version uses one of `models`. */
+    async agentsUsing(orgId, provider, models) {
+        if (models.length === 0)
+            return [];
+        const wanted = new Set(models);
+        let q = this.db
+            .selectFrom("agents as a")
+            .innerJoin("agent_versions as v", (j) => j.onRef("v.agent_id", "=", "a.id").onRef("v.version", "=", "a.current_version"))
+            .select(["a.id", "a.org_id", "v.definition"])
+            .where("a.deleted_at", "is", null)
+            .orderBy("a.org_id")
+            .orderBy("a.id");
+        if (orgId !== null)
+            q = q.where("a.org_id", "=", orgId);
+        const out = [];
+        for (const r of await q.execute()) {
+            const def = r.definition;
+            const uses = [def?.model, def?.fallback].some((x) => {
+                const ref = x;
+                return ref?.provider === provider && typeof ref.model === "string" && wanted.has(ref.model);
+            });
+            if (uses) {
+                out.push({
+                    id: r.id,
+                    name: typeof def?.name === "string" ? def.name : r.id,
+                    orgId: r.org_id,
+                });
+            }
+        }
+        return out;
+    }
+    /**
+     * Purpose mappings targeting one of `models`: for the platform every default and override, for
+     * an org its overrides and the deployment defaults (an org that disabled a default's model has
+     * that purpose unconfigured).
+     */
+    async purposesUsing(orgId, provider, models) {
+        if (models.length === 0)
+            return [];
+        let q = this.db
+            .selectFrom("model_purpose_mappings")
+            .select(["purpose", "org_id"])
+            .where("provider", "=", provider)
+            .where("model", "in", models)
+            .orderBy("purpose")
+            .orderBy("org_id", (ob) => ob.nullsFirst());
+        if (orgId === null) {
+            return (await q.execute()).map((r) => ({ purpose: r.purpose, orgId: r.org_id }));
+        }
+        q = q.where((eb) => eb.or([eb("org_id", "is", null), eb("org_id", "=", orgId)]));
+        const rows = await q.execute();
+        // a default the org overrides is not what the org uses
+        const overridden = new Set((await this.db
+            .selectFrom("model_purpose_mappings")
+            .select("purpose")
+            .where("org_id", "=", orgId)
+            .execute()).map((r) => r.purpose));
+        return rows
+            .filter((r) => r.org_id !== null || !overridden.has(r.purpose))
+            .map((r) => ({ purpose: r.purpose, orgId: r.org_id }));
+    }
+};
+__decorate([
+    Cacheable({ key: "capk:model-disabled:#{0}", ttl: DISABLED_TTL_SECONDS })
+], ModelEnablement.prototype, "disabledKeys", null);
+__decorate([
+    Transactional(),
+    CacheEvict({ key: `capk:model-disabled:${PLATFORM_SCOPE}` })
+], ModelEnablement.prototype, "setPlatform", null);
+__decorate([
+    Transactional(),
+    CacheEvict({ key: "capk:model-disabled:org.#{0}" })
+], ModelEnablement.prototype, "setOrg", null);
+ModelEnablement = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(CacheService)),
+    __param(3, Inject(ExtensionRegistry)),
+    __param(4, Inject(SuperAdminLock)),
+    __param(5, Inject(OrgLock))
+], ModelEnablement);
+export { ModelEnablement };
+/** The one {@link ModelEnablement}: the provider registry, purposes and the controllers read it. */
+let ModelEnablementModule = class ModelEnablementModule {
+};
+ModelEnablementModule = __decorate([
+    Module({
+        imports: [ExtensionRegistryModule, SuperAdminLockModule, OrgLockModule],
+        providers: [ModelEnablement],
+        exports: [ModelEnablement],
+    })
+], ModelEnablementModule);
+export { ModelEnablementModule };

package/dist/models/models.module.d.ts

@@ -1,3 +1,7 @@
-/** Model prices and model purposes. */
+/**
+ * Model prices, model purposes, the model disabled lists and the `ctx.models` embeddings broker.
+ * Below the extension host (the host injects {@link ModelEmbeddings} for `ctx.models`): it must not
+ * import `ExtensionsModule`.
+ */
 export declare class ModelsModule {
 }

package/dist/models/models.module.js

@@ -9,16 +9,28 @@ import { ExtensionRegistryModule } from "../extensions/registry.js";
 import { IdentityModule } from "../identity/identity.module.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
 import { ProvidersModule } from "../runtime/providers.js";
+import { ModelEmbeddings } from "./embeddings.js";
+import { ModelEnablementModule } from "./enablement.js";
 import { PricesService } from "./prices.js";
 import { ModelPurposesService } from "./purposes.js";
-/** Model prices and model purposes. */
+/**
+ * Model prices, model purposes, the model disabled lists and the `ctx.models` embeddings broker.
+ * Below the extension host (the host injects {@link ModelEmbeddings} for `ctx.models`): it must not
+ * import `ExtensionsModule`.
+ */
 let ModelsModule = class ModelsModule {
 };
 ModelsModule = __decorate([
     Module({
-        imports: [ExtensionRegistryModule, IdentityModule, OrgLockModule, ProvidersModule],
-        providers: [PricesService, ModelPurposesService],
-        exports: [PricesService, ModelPurposesService],
+        imports: [
+            ExtensionRegistryModule,
+            IdentityModule,
+            OrgLockModule,
+            ProvidersModule,
+            ModelEnablementModule,
+        ],
+        providers: [PricesService, ModelPurposesService, ModelEmbeddings],
+        exports: [PricesService, ModelPurposesService, ModelEnablementModule, ModelEmbeddings],
     })
 ], ModelsModule);
 export { ModelsModule };

package/dist/models/purposes.d.ts

@@ -13,7 +13,9 @@ import { ProviderRegistry } from "../runtime/providers.js";
  * - 用途 = 内核用途 {@link KERNEL_PURPOSES}（目前只有评委 `eval`），或已加载插件 `permissions.models` 声明的；
  * - 映射 = 部署默认（`org_id` 为 null，超级管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
  *   生效的映射先取组织覆盖、再取部署默认，都没有 → `model.unconfigured`；
- * - 目标模型按部署范围解析（与运行时一致），参数按目标模型自己的声明严格校验；不做模型白名单；
+ * - a target's kind must equal the purpose's kind; an org's override must be enabled in the org on
+ *   save (a deployment default: not disabled on the platform), and an effective target disabled in
+ *   the org (by either layer) counts as unconfigured there (spec B §5.3)；参数按目标模型自己的声明严格校验；
  * - 每次都查 PG，不在进程内缓存（多副本下改映射立即生效）。`ctx.models` 仍预留，插件暂不能调用。
  */
 /**
@@ -139,7 +141,7 @@ export declare class ModelPurposesService {
     readonly txHost: TransactionHost;
     private readonly adminLock;
     private readonly orgLock;
-    constructor(db: KernelDb, extensions: ExtensionRegistry, config: KernelConfigService, providers: Pick<ProviderRegistry, "resolve">, txHost: TransactionHost, adminLock: SuperAdminLock, orgLock: OrgLock);
+    constructor(db: KernelDb, extensions: ExtensionRegistry, config: KernelConfigService, providers: Pick<ProviderRegistry, "resolve" | "platformInfo">, txHost: TransactionHost, adminLock: SuperAdminLock, orgLock: OrgLock);
     /** 全部已声明的用途：内核的在前，其后按插件加载顺序。 */
     private declared;
     private find;
@@ -147,7 +149,10 @@ export declare class ModelPurposesService {
     private views;
     /** 全部用途与映射；不给 `orgId` = 部署级视图（`override` 一律为 null）。 */
     list(orgId?: string): Promise<PurposeView[]>;
-    /** 校验目标：模型可解析（部署范围）、参数按它的声明严格通过。 */
+    /**
+     * 校验目标：模型可解析且启用（an org's override for the org, a deployment default in the
+     * platform view）、its kind is the purpose's `kind`、参数按它的声明严格通过。
+     */
     private check;
     private set;
     /** The mapping write of {@link set}, under the super admin or org lock. */
@@ -156,7 +161,16 @@ export declare class ModelPurposesService {
     setDefault(purpose: string, target: PurposeTarget | null, actor: string, actorTokenId?: string): Promise<PurposeView>;
     /** 设置（或 `null` 清除）组织覆盖；事务内锁组织并复核 `org.models.manage`。 */
     setOrg(orgId: string, purpose: string, target: PurposeTarget | null, actor: string, actorTokenId?: string): Promise<PurposeView>;
-    /** 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。 */
+    /**
+     * 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。
+     * An effective target the org cannot use counts as unconfigured there (spec B §5.3): checked in
+     * the registry's org view, so a model the platform or the org disabled, a provider off or needing
+     * configuration in the org, a model gone from the org's list or of another kind than the purpose
+     * all give `model.unconfigured`. A provider whose list fails (`ProviderListError`) keeps the
+     * mapping: the call that follows resolves the model again and fails there, retryably, so paths
+     * that only read the mapping (sub-agent tiers, eval start, `ctx.models.describe`) do not fail on
+     * a transient list error.
+     */
     resolve(orgId: string, purpose: string): Promise<PurposeTarget>;
     /** The target a {@link chat} call on `purpose` uses: the mapping, else `fallback` when unmapped. */
     private chatTarget;

package/dist/models/purposes.js

@@ -29,7 +29,9 @@ import { ProviderListError, ProviderRegistry } from "../runtime/providers.js";
  * - 用途 = 内核用途 {@link KERNEL_PURPOSES}（目前只有评委 `eval`），或已加载插件 `permissions.models` 声明的；
  * - 映射 = 部署默认（`org_id` 为 null，超级管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
  *   生效的映射先取组织覆盖、再取部署默认，都没有 → `model.unconfigured`；
- * - 目标模型按部署范围解析（与运行时一致），参数按目标模型自己的声明严格校验；不做模型白名单；
+ * - a target's kind must equal the purpose's kind; an org's override must be enabled in the org on
+ *   save (a deployment default: not disabled on the platform), and an effective target disabled in
+ *   the org (by either layer) counts as unconfigured there (spec B §5.3)；参数按目标模型自己的声明严格校验；
  * - 每次都查 PG，不在进程内缓存（多副本下改映射立即生效）。`ctx.models` 仍预留，插件暂不能调用。
  */
 /**
@@ -189,11 +191,17 @@ let ModelPurposesService = class ModelPurposesService {
     async list(orgId) {
         return this.views(this.declared(), orgId);
     }
-    /** 校验目标：模型可解析（部署范围）、参数按它的声明严格通过。 */
-    async check(target) {
+    /**
+     * 校验目标：模型可解析且启用（an org's override for the org, a deployment default in the
+     * platform view）、its kind is the purpose's `kind`、参数按它的声明严格通过。
+     */
+    async check(orgId, target, kind) {
         let info;
         try {
-            ({ info } = await this.providers.resolve(target.model));
+            info =
+                orgId === null
+                    ? await this.providers.platformInfo(target.model, { kind: "callable" })
+                    : (await this.providers.resolve(orgId, target.model, { kind: "callable" })).info;
         }
         catch (e) {
             if (e instanceof ProviderListError)
@@ -203,6 +211,14 @@ let ModelPurposesService = class ModelPurposesService {
             }
             throw e;
         }
+        if (info.kind !== kind) {
+            throw invalid([
+                {
+                    path: "target.model",
+                    message: `this purpose needs ${kind === "embedding" ? "an" : "a"} ${kind} model, not ${info.kind}`,
+                },
+            ]);
+        }
         const issues = paramIssues("target.params", info.parameters, target.params);
         if (issues.length > 0)
             throw invalid(issues);
@@ -210,7 +226,7 @@ let ModelPurposesService = class ModelPurposesService {
     async set(orgId, purpose, target, actor, actorTokenId) {
         const decl = this.find(purpose);
         if (target)
-            await this.check(target);
+            await this.check(orgId, target, decl.kind);
         await this.write(orgId, purpose, target, actor, actorTokenId);
         const [view] = await this.views([decl], orgId ?? undefined);
         return view;
@@ -260,12 +276,33 @@ let ModelPurposesService = class ModelPurposesService {
     setOrg(orgId, purpose, target, actor, actorTokenId) {
         return this.set(orgId, purpose, target, actor, actorTokenId);
     }
-    /** 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。 */
+    /**
+     * 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。
+     * An effective target the org cannot use counts as unconfigured there (spec B §5.3): checked in
+     * the registry's org view, so a model the platform or the org disabled, a provider off or needing
+     * configuration in the org, a model gone from the org's list or of another kind than the purpose
+     * all give `model.unconfigured`. A provider whose list fails (`ProviderListError`) keeps the
+     * mapping: the call that follows resolves the model again and fails there, retryably, so paths
+     * that only read the mapping (sub-agent tiers, eval start, `ctx.models.describe`) do not fail on
+     * a transient list error.
+     */
     async resolve(orgId, purpose) {
-        const [view] = await this.views([this.find(purpose)], orgId);
+        const decl = this.find(purpose);
+        const [view] = await this.views([decl], orgId);
         if (!view?.effective) {
             throw new ApiError("model.unconfigured", `No model is configured for the "${purpose}" purpose`);
         }
+        try {
+            await this.providers.resolve(orgId, view.effective.model, { kind: decl.kind });
+        }
+        catch (e) {
+            if (e instanceof ProviderListError)
+                return view.effective;
+            if (e instanceof ApiError && e.code === "agent.model_unavailable") {
+                throw new ApiError("model.unconfigured", `The model configured for the "${purpose}" purpose is not available in this organization`);
+            }
+            throw e;
+        }
         return view.effective;
     }
     /** The target a {@link chat} call on `purpose` uses: the mapping, else `fallback` when unmapped. */
@@ -286,7 +323,7 @@ let ModelPurposesService = class ModelPurposesService {
      */
     async chatLimits(orgId, purpose, opts = {}) {
         const target = await this.chatTarget(orgId, purpose, opts.fallback);
-        const { info } = await this.providers.resolve(target.model);
+        const { info } = await this.providers.resolve(orgId, target.model);
         return { contextWindow: info.contextWindow, maxOutputTokens: info.maxOutputTokens };
     }
     /**
@@ -301,7 +338,7 @@ let ModelPurposesService = class ModelPurposesService {
      */
     async chat(orgId, purpose, req, signal, opts = {}) {
         const target = await this.chatTarget(orgId, purpose, opts.fallback);
-        const { provider, info } = await this.providers.resolve(target.model);
+        const { provider, info } = await this.providers.resolve(orgId, target.model);
         const request = {
             ...req,
             model: info.id,

package/dist/platform/exclusions.js

@@ -50,6 +50,12 @@ export const PLATFORM_EXCLUSIONS = [
         reason: "Platform model catalog read that an agent could mirror later",
         issue: "https://github.com/capybara-hq/core/issues/91",
     },
+    {
+        route: "PATCH /api/v1/admin/models/:provider/disabled",
+        category: "later",
+        reason: "Platform model disabled list write that an agent could mirror later behind confirmation",
+        issue: "https://github.com/capybara-hq/core/issues/91",
+    },
     {
         route: "GET /api/v1/admin/model-prices",
         category: "later",
@@ -193,6 +199,12 @@ export const PLATFORM_EXCLUSIONS = [
         reason: "Model list available to the org, readable by an agent later",
         issue: "https://github.com/capybara-hq/core/issues/91",
     },
+    {
+        route: "GET /api/v1/orgs/:orgId/models/catalog",
+        category: "later",
+        reason: "Org model catalog with enablement, readable by an agent later",
+        issue: "https://github.com/capybara-hq/core/issues/91",
+    },
     {
         route: "POST /api/v1/orgs/:orgId/agents/:agentId/pending-connectors/:key/bind",
         category: "later",
@@ -1048,6 +1060,12 @@ export const PLATFORM_EXCLUSIONS = [
         reason: "Org model per purpose, settable by an agent later",
         issue: "https://github.com/capybara-hq/core/issues/91",
     },
+    {
+        route: "PATCH /api/v1/orgs/:orgId/models/:provider/disabled",
+        category: "later",
+        reason: "Org model disabled list write that an agent could mirror later behind confirmation",
+        issue: "https://github.com/capybara-hq/core/issues/91",
+    },
     // orgs
     {
         route: "POST /api/v1/orgs/:orgId/extensions/:extension/directory/sync",

package/dist/runtime/hook-calls.d.ts

@@ -1,4 +1,4 @@
-import type { AvailableHook, HookModelRequest, HookParentScope, HookPayloads, HookScope, Logger, ModelRequest } from "@capybara-hq/plugin-sdk";
+import type { AvailableHook, EmbeddingRequestHookPayload, HookModelRequest, HookParentScope, HookPayloads, HookScope, Logger, ModelRequest } from "@capybara-hq/plugin-sdk";
 import type { AppendEvent, EventLog } from "../conversations/event-log.js";
 import type { EventPayload } from "../conversations/events.js";
 import type { HookOutcome, HookRegistry } from "../extensions/hooks.js";
@@ -67,6 +67,13 @@ export declare function hookDeniedEvent(at: DenialSite, mount: Extract<Available
  * and that the named plugin is only the first policy plugin on the mount.
  */
 export declare function hookDeniedAudit(at: DenialSite, payload: EventPayload<"hook_denied">, denial: HookDenial): AuditEntry;
+/**
+ * The `hook.denied` audit entry of a denied embedding call (`ctx.models.embed`, spec B §5.4): no
+ * actor and no conversation; the target is the calling extension. The detail has the same fields
+ * as a conversation denial's (mount, plugin, sanitized reason, cause, raw error, markers) plus the
+ * call's purpose, extension, embedding purpose and model.
+ */
+export declare function embeddingDeniedAudit(call: Pick<EmbeddingRequestHookPayload, "orgId" | "extension" | "embeddingPurpose" | "provider" | "model">, denial: HookDenial): AuditEntry;
 /** Audit entry shape (the argument of `audit()`). */
 export type AuditEntry = Parameters<typeof audit>[1];
 /**

package/dist/runtime/hook-calls.js

@@ -105,15 +105,46 @@ export function hookDeniedAudit(at, payload, denial) {
             conversationId: at.conversationId,
             runId: at.runId,
             ...(at.agentId !== undefined && { agentId: at.agentId }),
-            // the raw hook error: audit only, never in the conversation event (Ruling R12)
-            ...(denial.detail !== undefined && { error: denial.detail }),
-            ...(denial.preflight
-                ? { preflight: true, firstPolicyPlugin: denial.plugin, causedByPlugin: false }
-                : {}),
-            // M-1: the named plugin is enabled but not loaded on the replica that handled the call
-            ...(denial.notLoaded ? { notLoaded: true } : {}),
-            // layering spec A §6: the named plugin's effective config is not valid in the organization
-            ...(denial.needsConfig ? { needsConfig: true } : {}),
+            ...denialAuditDetail(denial),
+        },
+    };
+}
+/** The denial's audit-only fields: the raw hook error and the R10 / M-1 / spec A §6 markers. */
+function denialAuditDetail(denial) {
+    return {
+        // the raw hook error: audit only, never in the conversation event (Ruling R12)
+        ...(denial.detail !== undefined && { error: denial.detail }),
+        ...(denial.preflight
+            ? { preflight: true, firstPolicyPlugin: denial.plugin, causedByPlugin: false }
+            : {}),
+        // M-1: the named plugin is enabled but not loaded on the replica that handled the call
+        ...(denial.notLoaded ? { notLoaded: true } : {}),
+        // layering spec A §6: the named plugin's effective config is not valid in the organization
+        ...(denial.needsConfig ? { needsConfig: true } : {}),
+    };
+}
+/**
+ * The `hook.denied` audit entry of a denied embedding call (`ctx.models.embed`, spec B §5.4): no
+ * actor and no conversation; the target is the calling extension. The detail has the same fields
+ * as a conversation denial's (mount, plugin, sanitized reason, cause, raw error, markers) plus the
+ * call's purpose, extension, embedding purpose and model.
+ */
+export function embeddingDeniedAudit(call, denial) {
+    return {
+        orgId: call.orgId,
+        action: "hook.denied",
+        target: call.extension,
+        detail: {
+            mount: "model.request",
+            plugin: denial.plugin,
+            reason: denial.reason,
+            cause: denial.cause,
+            purpose: "embedding",
+            extension: call.extension,
+            embeddingPurpose: call.embeddingPurpose,
+            provider: call.provider,
+            model: call.model,
+            ...denialAuditDetail(denial),
         },
     };
 }

package/dist/runtime/model-call.d.ts

@@ -1,4 +1,4 @@
-import { type ContentBlock, type Logger, type ModelProvider, type ModelRequest, type ModelStreamEvent, type ModelUsage, type StopReason } from "@capybara-hq/plugin-sdk";
+import { type ContentBlock, type Logger, type ModelRequest, type ModelStreamEvent, type ModelUsage, type StopReason } from "@capybara-hq/plugin-sdk";
 import type { AgentDefinition } from "../agents/definition.js";
 import type { AppendEvent, EventLog } from "../conversations/event-log.js";
 import { type ConversationEvent } from "../conversations/events.js";
@@ -9,7 +9,7 @@ import { type BuildModelRequestInput, type MediaBytes, type MediaInfo, type Mode
 import { type ConversationKindForHooks, type HookRunner } from "./hook-calls.js";
 import type { SubagentParent } from "./loop.js";
 import { MediaCache } from "./media-cache.js";
-import { type ProviderRegistry } from "./providers.js";
+import { type BoundProvider, type ProviderRegistry } from "./providers.js";
 import type { StepLog } from "./step-log.js";
 import type { UsageReporter } from "./usage-report.js";
 /** 单轮收尾的尾部提醒（模型可见，英文；spec 6 轮次额度收尾）。 */
@@ -28,6 +28,11 @@ export declare const TOOLS_UNAVAILABLE_PREFIX = "The following tools are unavail
 export declare const TOOLS_AVAILABLE_AGAIN = "All previously unavailable tools are available again.";
 /** 不可用工具提醒：`The following tools are unavailable in this run: <ref> (<reason>), ...`。 */
 export declare function toolsUnavailableReminder(unavailable: readonly UnavailableTool[]): string;
+/**
+ * `run_failed` message of a model request denied by a policy hook (user-facing, never model-visible);
+ * also the message of the `model.hook_denied` error a denied `ctx.models.embed` call rejects with.
+ */
+export declare const modelDeniedText: (plugin: string, reason: string) => string;
 /**
  * 流式增量的出口（推给前端等订阅方）；`step_reset` 表示丢弃本步已推出的增量、重新开始。
  * `stream_end` (the step's model stream completed) and `step_end` (the step's `assistant_message`
@@ -212,6 +217,6 @@ export declare function assembleModelRequest(input: AssembleModelRequestInput):
  * 外部 `signal` 触发 → `StepAborted`。每次 `next()` 都与停止信号竞速，供应商不响应 signal 也不会卡住。
  * 运行时与评测单步回放（`evals/step-replay.ts`）、评委共用。
  */
-export declare function consumeModelStream(provider: ModelProvider, request: ModelRequest, idleMs: number, signal: AbortSignal, onDelta: (ev: Exclude<ModelStreamEvent, {
+export declare function consumeModelStream(provider: BoundProvider, request: ModelRequest, idleMs: number, signal: AbortSignal, onDelta: (ev: Exclude<ModelStreamEvent, {
     type: "message_complete";
 }>) => void): Promise<StreamOutcome>;