@capybara-hq/kernel 0.1.0-rc.6 → 0.1.0-rc.7

package/dist/tools/registry.js

@@ -10,6 +10,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { createHash } from "node:crypto";
 import { connectorToolKey, extensionToolKey } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
+import { builtinDisabled, connectorToolDisabled, extensionToolDisabled, } from "../agents/definition.js";
 import { EffectiveConfigs, NEEDS_CONFIG_REASON } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
@@ -19,7 +20,7 @@ import { readOrgSettings } from "../orgs/settings.service.js";
 import { estimateTokens } from "../runtime/context/tokens.js";
 import { SUBAGENT_LIMIT_DEFAULTS, subagentLimits } from "../runtime/subagents/limits.js";
 import { resolveRoster } from "../runtime/subagents/roster.js";
-import { AGENT_TOOL, BASH_COMPANION_TOOLS, BUILTIN, BUILTIN_TOOL_NAMES, SEND_MESSAGE, SKILL_LOAD, SUBAGENT_HANDBACK, SUBAGENT_MESSAGE_TOOLS, TOOL_SEARCH, } from "./builtin-names.js";
+import { AGENT_BUILTIN_NAMES, AGENT_TOOL, BASH_COMPANION_TOOLS, BUILTIN, SEND_MESSAGE, SKILL_LOAD, SUBAGENT_HANDBACK, TOOL_SEARCH, } from "./builtin-names.js";
 import { agentToolSpec } from "./builtins/agent.js";
 import { BuiltinTools } from "./builtins/builtin-tools.js";
 import { canonicalJson } from "./canonical-json.js";
@@ -85,23 +86,21 @@ const builtinTool = (b, spec) => ({
     ...(b.callPolicy !== undefined && { callPolicy: b.callPolicy }),
 });
 /**
- * Tool registry: resolves the references in an agent definition into the tools available for this
- * run. Not cached (reads PG and the host live every time), so changes take effect right away across
- * replicas.
+ * Tool registry: resolves what an agent has for this run (tools default-on spec §4): everything
+ * the org offers minus the definition's `disabledTools`. Not cached (reads PG and the host live
+ * every time), so changes take effect right away across replicas.
  *
- * Availability:
- * - builtin: in `builtins`;
- * - extension tools: the extension is loaded and registered the tool, this org enabled the
- *   extension (`extension_org_configs.enabled`, spec 2.2 "installed at deployment level, enabled at
- *   org level"; required bootstrap plugins are enabled in every org, `enabled.ts`), and the
- *   extension's effective config for the org is valid (layering spec A §6) and the org did not
- *   turn the tool off (§7);
- * - connector tools: the connector belongs to this org, is not deleted or disabled, the connector is
- *   installed, the tool status is `enabled` and the key is valid.
- *   `tools: "all"` takes only enabled tools; disabled / pending-review ones count as deliberately
- *   turned off by an admin and are not reported; named tools report their reason one by one.
- * Only the first of a key is kept; the same source referenced twice is deduplicated silently,
- * different sources with the same key report a duplicate.
+ * What is offered:
+ * - builtins: every {@link AGENT_BUILTIN_NAMES} entry registered here that can run (`unavailable`
+ *   says why not), `TaskOutput` / `TaskStop` with `Bash`, `Agent` while its roster is not empty;
+ * - extension tools: every tool registered by an extension loaded on this replica and enabled in
+ *   the org (`extension_org_configs.enabled`; required bootstrap plugins are enabled in every org,
+ *   `enabled.ts`), whose effective config for the org is valid (layering spec A §6) and that the
+ *   org did not switch off (§7: the org's switch wins);
+ * - connector tools: every enabled tool of every live, active connector of the org whose
+ *   connector extension is installed, with a valid key.
+ * What cannot be offered goes to `hidden` with the reason; nothing is reported to the model as
+ * unavailable except two sources with one key (the first wins).
  */
 let ToolRegistry = class ToolRegistry {
     db;
@@ -213,92 +212,93 @@ let ToolRegistry = class ToolRegistry {
         return (await this.connectorKindsFor(orgId)).some((k) => k.kind === kind);
     }
     /**
-     * 保存 agent 时校验工具引用（只看「存在」，停用 / 待复核 / 插件未启用等运行时状态不拒绝，由 `forAgent` 报不可用）：
-     * - 内置：名字在 {@link BUILTIN_TOOL_NAMES} 中；
-     * - 插件：插件已加载且注册了该工具，key 合法；
-     * - 连接器：连接器属于本组织且未删除；点名的工具必须在连接器的工具快照中。
-     * 不同来源拼出同一个 key 也报出来（不截断、不猜）。
-     * 返回 `keys`：这些引用可能产生的全部工具 key（`"all"` 含连接器当前所有工具，不论状态），供校验 `toolPolicies`。
+     * Checks a definition's `disabledTools` on save (existence only): a builtin an agent can turn off
+     * ({@link AGENT_BUILTIN_NAMES}), an extension loaded here and the tools it registered, a live
+     * connector of the org and tools of its snapshot. An entry equal to one of `kept` (the current
+     * version's) is not re-checked: a connector deleted or an extension uninstalled later never
+     * blocks other edits. Returns `keys`: every tool key the agent could have, on or turned off (all
+     * its builtins, every loaded extension's tools, every tool of the org's live connectors in any
+     * status), the keys `toolPolicies` may use.
      */
-    async checkRefs(orgId, refs) {
+    async checkDisabled(orgId, disabled, kept = []) {
         const issues = [];
-        const owner = new Map();
+        const keys = new Set();
+        for (const name of AGENT_BUILTIN_NAMES)
+            keys.add(name);
+        for (const name of BASH_COMPANION_TOOLS)
+            keys.add(name);
         const pluginTools = this.host.tools();
-        const connectorIds = [
-            ...new Set(refs.flatMap((r) => (r.kind === "connector" ? [r.connectorId] : []))),
-        ];
-        const apps = await this.loadConnectors(orgId, connectorIds);
-        const claim = (path, key, source) => {
-            const prev = owner.get(key);
-            if (prev === undefined)
-                owner.set(key, source);
-            else if (prev !== source) {
-                issues.push({ path, message: `Tool key "${key}" is already used by another tool` });
-            }
-        };
-        refs.forEach((ref, i) => {
-            const path = `tools.${i}`;
+        for (const t of pluginTools)
+            keys.add(extensionToolKey(t.plugin, t.spec.name));
+        const apps = await this.loadOrgConnectors(orgId, { includeDeleted: false });
+        for (const app of apps)
+            for (const t of app.tools)
+                keys.add(connectorToolKey(app.slug, t.name));
+        const builtins = new Set(AGENT_BUILTIN_NAMES);
+        const keptJson = new Set(kept.map((r) => canonicalJson(r)));
+        disabled.forEach((ref, i) => {
+            const path = `disabledTools.${i}`;
+            if (keptJson.has(canonicalJson(ref)))
+                return;
             if (ref.kind === "builtin") {
-                if (!BUILTIN_TOOL_NAMES.includes(ref.name)) {
+                if (!builtins.has(ref.name)) {
                     const renamed = legacyKeySaveText(ref.name);
                     issues.push({
                         path,
-                        message: renamed === null
-                            ? `Built-in tool "${ref.name}" does not exist`
-                            : `Built-in tool ${renamed}`,
+                        message: renamed !== null
+                            ? `Built-in tool ${renamed}`
+                            : `"${ref.name}" is not a built-in tool an agent can turn off`,
                     });
-                    return;
-                }
-                claim(path, ref.name, `builtin:${ref.name}`);
-                // offered with Bash (see resolve), so their policies validate too
-                if (ref.name === BUILTIN.Bash) {
-                    for (const c of BASH_COMPANION_TOOLS)
-                        claim(path, c, `builtin:${c}`);
                 }
             }
             else if (ref.kind === "plugin") {
-                const key = extensionToolKey(ref.plugin, ref.name);
-                if (!pluginTools.some((x) => x.plugin === ref.plugin && x.spec.name === ref.name)) {
-                    issues.push({ path, message: `Plugin tool "${key}" does not exist` });
+                const own = pluginTools.filter((x) => x.plugin === ref.plugin);
+                if (own.length === 0) {
+                    issues.push({ path, message: `Extension "${ref.plugin}" has no tools` });
                     return;
                 }
-                const issue = toolKeyIssue(key);
-                if (issue) {
-                    issues.push({ path, message: issue });
+                if (ref.tools === "all")
                     return;
+                for (const name of ref.tools) {
+                    if (!own.some((x) => x.spec.name === name)) {
+                        issues.push({
+                            path,
+                            message: `Extension tool "${extensionToolKey(ref.plugin, name)}" does not exist`,
+                        });
+                    }
                 }
-                claim(path, key, `plugin:${ref.plugin}:${ref.name}`);
             }
             else {
-                const app = apps.get(ref.connectorId);
-                if (!app || app.deleted) {
+                const app = apps.find((a) => a.id === ref.connectorId);
+                if (!app) {
                     issues.push({ path, message: `Connector "${ref.connectorId}" does not exist` });
                     return;
                 }
-                const names = ref.tools === "all" ? app.tools.map((t) => t.name) : [...new Set(ref.tools)];
-                for (const name of names) {
+                if (ref.tools === "all")
+                    return;
+                for (const name of ref.tools) {
                     if (!app.tools.some((t) => t.name === name)) {
                         issues.push({
                             path,
                             message: `Tool "${name}" does not exist in connector ${app.slug}`,
                         });
-                        continue;
                     }
-                    claim(path, connectorToolKey(app.slug, name), `connector:${app.id}:${name}`);
                 }
             }
         });
-        return { keys: new Set(owner.keys()), issues };
+        return { keys, issues };
     }
     /**
-     * 解析 agent 引用的工具（见类注释），再判定是否启用 `ToolSearch`：组织设置 `toolSearch === "on"`，且
-     * 可用工具数 > `tools.searchThresholdTools` 或其定义的估算 token > `tools.searchThresholdTokens`。
-     * 启用时把内置 `ToolSearch` 追加到末尾。定义里显式引用的 `ToolSearch` 忽略（由这里按设置管理）。
-     * `skillLoad`：对话日志里有技能目录快照（`skills_catalog`，Ruling M17）→ 加入内置 `Skill`（始终完整加载）；
-     * 定义里显式引用的 `Skill` 同样忽略。
+     * Resolves what the agent has (see the class comment), then decides on `ToolSearch`: the org
+     * setting `toolSearch === "on"` and more than `tools.searchThresholdTools` tools or more than
+     * `tools.searchThresholdTokens` estimated definition tokens; when on, the builtin `ToolSearch` is
+     * appended. `skillLoad`: the log has a skills catalog snapshot (`skills_catalog`, Ruling M17) →
+     * the builtin `Skill` is added (always fully loaded).
      */
     async forAgent(orgId, def) {
-        const { tools, unavailable, hidden } = await this.resolve(orgId, def);
+        const resolved = await this.resolve(orgId, def);
+        const { unavailable, hidden } = resolved;
+        const tools = filterSubagentTools(resolved.tools, def.subagentTools);
         // `SendMessage` to an agent that has `Agent` (to reach its sub-agents) or a parent;
         // `SubagentHandback` to a sub-agent only; a fork invocation's child reports by its reply
         const toParent = def.child === true && def.forkChild !== true;
@@ -347,6 +347,7 @@ let ToolRegistry = class ToolRegistry {
         return (await readOrgSettings(this.db.db, orgId)).toolSearch === "on";
     }
     async resolve(orgId, def) {
+        const disabled = def.disabledTools ?? [];
         const tools = [];
         const unavailable = [];
         const hidden = [];
@@ -365,155 +366,135 @@ let ToolRegistry = class ToolRegistry {
                 });
             }
         };
-        const [enabledPlugins, offKeys] = def.tools.some((r) => r.kind === "plugin")
-            ? await Promise.all([this.enabledPlugins(orgId), this.switches.offKeys(orgId)])
-            : [new Set(), new Set()];
-        const connectorIds = [
-            ...new Set(def.tools.flatMap((r) => (r.kind === "connector" ? [r.connectorId] : []))),
-        ];
-        const apps = await this.loadConnectors(orgId, connectorIds);
-        const pluginTools = this.host.tools();
-        // one effective config read per extension and resolution, however many of its tools are named
-        const configured = new Map();
-        const configuredIn = (plugin) => {
-            let ok = configured.get(plugin);
-            if (!ok) {
-                ok = this.effective.get(orgId, plugin).then((e) => e.ok);
-                configured.set(plugin, ok);
+        // builtins
+        for (const name of AGENT_BUILTIN_NAMES) {
+            if (builtinDisabled(disabled, name))
+                continue;
+            const b = this.builtins.find((x) => x.spec.name === name);
+            if (!b)
+                continue;
+            const why = (await b.unavailable?.({ orgId })) ?? null;
+            if (why !== null) {
+                hidden.push({ ref: name, reason: why });
+                continue;
             }
-            return ok;
-        };
-        for (const ref of def.tools) {
-            if (ref.kind === "builtin") {
-                if (ref.name === TOOL_SEARCH || ref.name === SKILL_LOAD)
-                    continue;
-                if (SUBAGENT_MESSAGE_TOOLS.has(ref.name))
+            // `Agent`: the description lists this definition's roster (sub-agents spec §4.3); with an
+            // empty roster there is nothing to dispatch, so the tool is not offered at all
+            let spec = b.spec;
+            if (name === AGENT_TOOL) {
+                const roster = await resolveRoster(this.db.db, orgId, { subagents: def.subagents });
+                if (roster.length === 0)
                     continue;
-                const b = this.builtins.find((x) => x.spec.name === ref.name);
-                if (!b) {
-                    unavailable.push({ ref: ref.name, reason: "Built-in tool does not exist" });
-                    continue;
-                }
-                const why = (await b.unavailable?.({ orgId })) ?? null;
-                if (why !== null) {
-                    unavailable.push({ ref: ref.name, reason: why });
-                    continue;
-                }
-                // `Agent`: the description lists this definition's roster (sub-agents spec §4.3); with an
-                // empty roster there is nothing to dispatch, so the tool is not offered at all
-                let spec = b.spec;
-                if (b.spec.name === AGENT_TOOL) {
-                    const roster = await resolveRoster(this.db.db, orgId, { subagents: def.subagents });
-                    if (roster.length === 0)
-                        continue;
-                    spec = agentToolSpec(roster, await this.maxConcurrentSubagents(orgId));
-                }
-                add(builtinTool(b, spec));
-                // `TaskOutput` and `TaskStop` come with an available `Bash` (background Bash spec §2)
-                if (b.spec.name === BUILTIN.Bash) {
-                    for (const name of BASH_COMPANION_TOOLS) {
-                        const c = this.builtins.find((x) => x.spec.name === name);
-                        if (c && ((await c.unavailable?.({ orgId })) ?? null) === null)
-                            add(builtinTool(c, c.spec));
+                spec = agentToolSpec(roster, await this.maxConcurrentSubagents(orgId));
+            }
+            add(builtinTool(b, spec));
+            // `TaskOutput` and `TaskStop` come with an available `Bash` (background Bash spec §2)
+            if (name === BUILTIN.Bash) {
+                for (const companion of BASH_COMPANION_TOOLS) {
+                    const c = this.builtins.find((x) => x.spec.name === companion);
+                    if (c && ((await c.unavailable?.({ orgId })) ?? null) === null) {
+                        add(builtinTool(c, c.spec));
                     }
                 }
             }
-            else if (ref.kind === "plugin") {
-                const key = extensionToolKey(ref.plugin, ref.name);
-                const t = pluginTools.find((x) => x.plugin === ref.plugin && x.spec.name === ref.name);
-                if (!t) {
-                    unavailable.push({ ref: key, reason: "Plugin tool does not exist" });
-                    continue;
+        }
+        // extension tools: the extensions enabled in the org
+        const pluginTools = this.host.tools();
+        if (pluginTools.length > 0) {
+            const [enabledPlugins, offKeys] = await Promise.all([
+                this.enabledPlugins(orgId),
+                this.switches.offKeys(orgId),
+            ]);
+            // one effective config read per extension and resolution, however many tools it has
+            const configured = new Map();
+            const configuredIn = (plugin) => {
+                let ok = configured.get(plugin);
+                if (!ok) {
+                    ok = this.effective.get(orgId, plugin).then((e) => e.ok);
+                    configured.set(plugin, ok);
                 }
-                if (!enabledPlugins.has(ref.plugin)) {
-                    unavailable.push({
-                        ref: key,
-                        reason: `Plugin ${ref.plugin} is not enabled in this organization`,
-                    });
+                return ok;
+            };
+            for (const t of pluginTools) {
+                if (!enabledPlugins.has(t.plugin))
                     continue;
-                }
+                if (extensionToolDisabled(disabled, t.plugin, t.spec.name))
+                    continue;
+                const key = extensionToolKey(t.plugin, t.spec.name);
                 // the pipeline refuses such calls too (a resumed step), this keeps them from the model
                 if (offKeys.has(key)) {
-                    unavailable.push({ ref: key, reason: toolTurnedOffReason(key) });
+                    hidden.push({ ref: key, reason: toolTurnedOffReason(key) });
                     continue;
                 }
-                if (!(await configuredIn(ref.plugin))) {
-                    unavailable.push({ ref: key, reason: `Plugin ${ref.plugin} ${NEEDS_CONFIG_REASON}` });
+                if (!(await configuredIn(t.plugin))) {
+                    hidden.push({ ref: key, reason: `Plugin ${t.plugin} ${NEEDS_CONFIG_REASON}` });
                     continue;
                 }
                 const issue = toolKeyIssue(key);
                 if (issue) {
-                    unavailable.push({ ref: key, reason: issue });
+                    hidden.push({ ref: key, reason: issue });
                     continue;
                 }
                 add({
                     key,
-                    source: { kind: "plugin", plugin: ref.plugin, name: ref.name },
+                    source: { kind: "plugin", plugin: t.plugin, name: t.spec.name },
                     spec: t.spec,
                     specHash: specHash(t.spec),
                     defaultPolicy: t.spec.defaultPolicy ?? policyFromAnnotations(t.spec.annotations),
                 });
             }
-            else {
-                const app = apps.get(ref.connectorId);
-                if (!app) {
-                    unavailable.push({ ref: `app:${ref.connectorId}`, reason: "App does not exist" });
+        }
+        // connector tools: the org's live connectors
+        for (const app of await this.loadOrgConnectors(orgId, { includeDeleted: false })) {
+            if (disabled.some((r) => r.kind === "connector" && r.connectorId === app.id && r.tools === "all")) {
+                continue;
+            }
+            const all = connectorToolKey(app.slug, "*");
+            if (app.status !== "active") {
+                hidden.push({ ref: all, reason: `App ${app.slug} is disabled` });
+                continue;
+            }
+            if (!this.findConnector(app.connector)) {
+                hidden.push({
+                    ref: all,
+                    reason: `Connector ${app.connector} for app ${app.slug} is not installed`,
+                });
+                continue;
+            }
+            for (const t of app.tools) {
+                if (connectorToolDisabled(disabled, app.id, t.name))
                     continue;
-                }
-                const all = connectorToolKey(app.slug, "*");
-                if (app.deleted) {
-                    unavailable.push({ ref: all, reason: `App ${app.slug} was deleted` });
+                const key = connectorToolKey(app.slug, t.name);
+                // 远端已不再提供（漂移检测置停用并标记，见 drift.ts）
+                if (t.gone) {
+                    hidden.push({ ref: key, reason: `Tool no longer exists in app ${app.slug}` });
                     continue;
                 }
-                if (app.status !== "active") {
-                    unavailable.push({ ref: all, reason: `App ${app.slug} is disabled` });
+                if (t.status === "disabled") {
+                    hidden.push({ ref: key, reason: "Tool is disabled" });
                     continue;
                 }
-                if (!this.findConnector(app.connector)) {
-                    unavailable.push({
-                        ref: all,
-                        reason: `Connector ${app.connector} for app ${app.slug} is not installed`,
-                    });
+                if (t.status === "pending_review") {
+                    hidden.push({ ref: key, reason: "Tool is pending review" });
                     continue;
                 }
-                const wanted = ref.tools === "all"
-                    ? app.tools
-                    : ref.tools.map((name) => app.tools.find((t) => t.name === name) ?? { name, missing: true });
-                // 「all」里未启用的工具不算 agent 点名要的，不进 unavailable（不提醒），只记进 hidden 备查
-                const notEnabled = ref.tools === "all" ? hidden : unavailable;
-                for (const t of wanted) {
-                    const key = connectorToolKey(app.slug, t.name);
-                    // 远端已不再提供（漂移检测置停用并标记，见 drift.ts）：与「没有这一行」同一个事实
-                    if ("missing" in t || t.gone) {
-                        notEnabled.push({ ref: key, reason: `Tool no longer exists in app ${app.slug}` });
-                        continue;
-                    }
-                    if (t.status === "disabled") {
-                        notEnabled.push({ ref: key, reason: "Tool is disabled" });
-                        continue;
-                    }
-                    if (t.status === "pending_review") {
-                        notEnabled.push({ ref: key, reason: "Tool is pending review" });
-                        continue;
-                    }
-                    const issue = toolKeyIssue(key);
-                    if (issue) {
-                        unavailable.push({ ref: key, reason: issue });
-                        continue;
-                    }
-                    add({
-                        key,
-                        source: {
-                            kind: "connector",
-                            connectorId: app.id,
-                            name: t.name,
-                            ...(t.source === "resources" && { resources: true }),
-                        },
-                        spec: t.spec,
-                        specHash: t.specHash,
-                        defaultPolicy: t.defaultPolicy,
-                    });
+                const issue = toolKeyIssue(key);
+                if (issue) {
+                    hidden.push({ ref: key, reason: issue });
+                    continue;
                 }
+                add({
+                    key,
+                    source: {
+                        kind: "connector",
+                        connectorId: app.id,
+                        name: t.name,
+                        ...(t.source === "resources" && { resources: true }),
+                    },
+                    spec: t.spec,
+                    specHash: t.specHash,
+                    defaultPolicy: t.defaultPolicy,
+                });
             }
         }
         return { tools, unavailable, hidden };
@@ -537,56 +518,50 @@ let ToolRegistry = class ToolRegistry {
     async enabledPlugins(orgId) {
         return this.host.enabledPlugins(orgId);
     }
-    async loadConnectors(orgId, ids) {
-        const out = new Map();
-        if (ids.length === 0)
-            return out;
-        // 软删除的连接器也读出来，只为给出「已删除」这个更准确的原因（slug 可能已被新连接器复用，按 id 区分）
+    /** The org's connectors (live ones, sorted by slug) with their tool snapshots (by name). */
+    async loadOrgConnectors(orgId, _opts) {
         const apps = await this.db
             .selectFrom("connectors")
-            .select(["id", "slug", "connector", "status", "deleted_at"])
+            .select(["id", "slug", "connector", "status"])
             .where("org_id", "=", orgId)
-            .where("id", "in", ids)
+            .where("deleted_at", "is", null)
+            .orderBy("slug")
+            .orderBy("id")
             .execute();
-        const live = apps.filter((a) => a.deleted_at === null).map((a) => a.id);
-        const toolRows = live.length === 0
-            ? []
-            : await this.db
-                .selectFrom("connector_tools")
-                .select([
-                "connector_id",
-                "name",
-                "spec",
-                "spec_hash",
-                "status",
-                "default_policy",
-                "source",
-                "missing_since",
-            ])
-                .where("connector_id", "in", live)
-                .orderBy("name")
-                .execute();
-        for (const a of apps) {
-            out.set(a.id, {
-                id: a.id,
-                slug: a.slug,
-                connector: a.connector,
-                status: a.status,
-                deleted: a.deleted_at !== null,
-                tools: toolRows
-                    .filter((t) => t.connector_id === a.id)
-                    .map((t) => ({
-                    name: t.name,
-                    spec: t.spec,
-                    specHash: t.spec_hash,
-                    status: t.status,
-                    defaultPolicy: t.default_policy,
-                    source: t.source,
-                    gone: t.missing_since !== null,
-                })),
-            });
-        }
-        return out;
+        if (apps.length === 0)
+            return [];
+        const toolRows = await this.db
+            .selectFrom("connector_tools")
+            .select([
+            "connector_id",
+            "name",
+            "spec",
+            "spec_hash",
+            "status",
+            "default_policy",
+            "source",
+            "missing_since",
+        ])
+            .where("connector_id", "in", apps.map((a) => a.id))
+            .orderBy("name")
+            .execute();
+        return apps.map((a) => ({
+            id: a.id,
+            slug: a.slug,
+            connector: a.connector,
+            status: a.status,
+            tools: toolRows
+                .filter((t) => t.connector_id === a.id)
+                .map((t) => ({
+                name: t.name,
+                spec: t.spec,
+                specHash: t.spec_hash,
+                status: t.status,
+                defaultPolicy: t.default_policy,
+                source: t.source,
+                gone: t.missing_since !== null,
+            })),
+        }));
     }
 };
 ToolRegistry = __decorate([
@@ -600,3 +575,17 @@ ToolRegistry = __decorate([
     __param(6, Inject(KernelConfigService))
 ], ToolRegistry);
 export { ToolRegistry };
+/**
+ * `tools` narrowed by a sub-agent's key filter (tools default-on spec §4): `deny` keys removed,
+ * and with `allow` only its keys kept. `TaskOutput` / `TaskStop` follow `Bash`, as they come with
+ * it. Without a filter the list is returned as it is.
+ */
+export function filterSubagentTools(tools, filter) {
+    if (filter === undefined)
+        return tools;
+    const companions = new Set(BASH_COMPANION_TOOLS);
+    const deny = new Set(filter.deny ?? []);
+    const allow = filter.allow === undefined ? null : new Set(filter.allow);
+    const keep = (key) => !deny.has(key) && (allow === null || allow.has(key));
+    return tools.filter((t) => (companions.has(t.key) ? keep(BUILTIN.Bash) : keep(t.key)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.6",
+  "version": "0.1.0-rc.7",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -64,14 +64,14 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.4"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.5"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
     "@types/pg": "^8.23.1",
     "@types/semver": "^7.8.0",
     "@types/yauzl": "3.4.0",
-    "@capybara-hq/testing": "0.1.0-rc.7"
+    "@capybara-hq/testing": "0.1.0-rc.8"
   },
   "scripts": {
     "build": "tsc -b"

package/src/migrations/0090_initial_passwords.sql

@@ -0,0 +1,27 @@
+-- Platform tool phase 2 (spec 2026-11-07-platform-tool-design.md §14.5 item 2): the super admin's
+-- agent creates an account with a kernel-generated one-time password. Expand-only.
+--
+-- must_change_password: the account must set its own password before anything else (the auth
+-- guard refuses every route but the password change, /me and logout until it does).
+ALTER TABLE capybara.accounts ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false;
+
+-- The generated password, sealed with the master keyring (AES-256-GCM, AAD = account id), waiting
+-- for the person who approved the creation to read it once on the web. Keyed by the account; the
+-- tool call it came from (conversation_id, run_id, call_id: a call id is unique only within its run)
+-- and its recipient decide who may read it. Read once (deleted as it is read), dropped when the
+-- account changes its password, and dropped after expires_at by the hourly cleanup job.
+CREATE TABLE IF NOT EXISTS capybara.account_initial_passwords (
+  account_id text PRIMARY KEY REFERENCES capybara.accounts(id) ON DELETE CASCADE,
+  recipient_account_id text NOT NULL REFERENCES capybara.accounts(id) ON DELETE CASCADE,
+  conversation_id text NOT NULL REFERENCES capybara.conversations(id) ON DELETE CASCADE,
+  run_id text NOT NULL,
+  call_id text NOT NULL,
+  master_key_id text NOT NULL,
+  ciphertext bytea NOT NULL,
+  expires_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS account_initial_passwords_call_idx
+  ON capybara.account_initial_passwords (conversation_id, run_id, call_id);
+CREATE INDEX IF NOT EXISTS account_initial_passwords_expires_idx
+  ON capybara.account_initial_passwords (expires_at);