@capybara-hq/kernel 0.1.0-rc.6 → 0.1.0-rc.8

package/dist/runtime/run-worker.js

@@ -32,6 +32,7 @@ import { ConversationLock } from "./conversation-lock.js";
 import { RunError } from "./model-call.js";
 import { ProviderListError, ProviderRegistry } from "./providers.js";
 import { ORG_QUOTA_LEASE_MS, orgRunLimit, RUN_QUOTA } from "./quota.js";
+import { RunContextService } from "./run-context.service.js";
 import { RunDrafts, streamSink } from "./run-drafts.js";
 import { RunFinish, TERMINAL_STATUSES } from "./run-finish.js";
 import { RunQueue } from "./run-queue.js";
@@ -84,6 +85,7 @@ let RunWorker = class RunWorker {
     titles;
     models;
     skillsCatalog;
+    runContext;
     pipeline;
     finisher;
     txHost;
@@ -111,6 +113,8 @@ let RunWorker = class RunWorker {
     models, 
     /** Run start's skills catalog snapshot (reads the pinned skills' bodies, phase B). */
     skillsCatalog, 
+    /** Run start's run context (run context spec §5): who the agent is, the day, the person. */
+    runContext, 
     /**
      * In the terminal transaction of every run: writes its open `Agent` call results
      * (`stopOpenAgentCalls`; a no-op without dispatches); `fire` runs their observe hooks after the
@@ -135,6 +139,7 @@ let RunWorker = class RunWorker {
         this.titles = titles;
         this.models = models;
         this.skillsCatalog = skillsCatalog;
+        this.runContext = runContext;
         this.pipeline = pipeline;
         this.finisher = finisher;
         this.txHost = txHost;
@@ -511,6 +516,8 @@ let RunWorker = class RunWorker {
         let saved;
         let maxSteps = runtime.maxSteps;
         let parent;
+        /** A sub-agent's name in its run context: the roster name, or the forked skill's. */
+        let childName;
         if (conv.kind === "subagent") {
             // a sub-agent runs its effective definition frozen at dispatch, never agent_versions
             // (spec §6.3), and works for the parent call that dispatched this run
@@ -525,6 +532,7 @@ let RunWorker = class RunWorker {
                 ? trigger.payload.dispatch?.narrowed
                 : undefined);
             maxSteps = Math.min(started.payload.maxSteps, runtime.maxSteps);
+            childName = started.payload.template.invokedSkill?.name ?? started.payload.agentType;
             const row = await dispatchOfChildRun(this.db, runId);
             const otherAgent = started.payload.template.source === "agent";
             const parentConversationId = row?.parentConversationId ?? started.payload.parent.conversationId;
@@ -620,6 +628,22 @@ let RunWorker = class RunWorker {
                 });
                 return "finished";
             }
+            // run context (spec §5): after the catalog, before the run is running, so before any
+            // compaction and model call; a retried run start finds its event or no change
+            await this.runContext.record({
+                orgId: conv.org_id,
+                conversationId,
+                runId,
+                triggerSeq: Number(run.trigger_seq),
+                agent,
+                ...(parent !== undefined && {
+                    subagent: {
+                        parentConversationId: parent.conversationId,
+                        parentRunId: parent.runId,
+                        name: childName ?? agent.name,
+                    },
+                }),
+            });
             const updated = await this.db
                 .updateTable("runs")
                 .set({ status: "running", started_at: sql `COALESCE(started_at, now())` })
@@ -946,11 +970,12 @@ RunWorker = __decorate([
     __param(15, Inject(TitleQueue)),
     __param(16, Inject(ProviderRegistry)),
     __param(17, Inject(SkillsCatalogService)),
-    __param(18, Inject(ToolPipeline)),
-    __param(19, Inject(RunFinish)),
-    __param(20, Inject(TransactionHost)),
-    __param(21, Inject(RunDrafts)),
-    __param(22, Optional()),
-    __param(22, Inject(RUN_HOOKS))
+    __param(18, Inject(RunContextService)),
+    __param(19, Inject(ToolPipeline)),
+    __param(20, Inject(RunFinish)),
+    __param(21, Inject(TransactionHost)),
+    __param(22, Inject(RunDrafts)),
+    __param(23, Optional()),
+    __param(23, Inject(RUN_HOOKS))
 ], RunWorker);
 export { RunWorker };

package/dist/runtime/runtime.module.js

@@ -24,6 +24,7 @@ import { ConversationLock } from "./conversation-lock.js";
 import { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
 import { ProvidersModule } from "./providers.js";
 import { EVAL_QUOTA, EVAL_QUOTA_PREFIX, OrgQuota, RUN_QUOTA, RUN_QUOTA_PREFIX } from "./quota.js";
+import { RunContextService } from "./run-context.service.js";
 import { RunControl } from "./run-control.js";
 import { RunDrafts } from "./run-drafts.js";
 import { RunFinish } from "./run-finish.js";
@@ -79,6 +80,7 @@ RuntimeModule = __decorate([
             RunDrafts,
             AgentLoops,
             RunSteps,
+            RunContextService,
             RunWorker,
             // a finished background task wakes an idle conversation (background Bash spec §3)
             BackgroundWake,

package/dist/runtime/subagents/definition.d.ts

@@ -1,5 +1,5 @@
 import { type AgentTemplateTier } from "@capybara-hq/plugin-sdk";
-import type { AgentDefinition, AgentToolRef, ModelRef } from "../../agents/definition.js";
+import { type AgentDefinition, type DisabledToolRef, type ModelRef } from "../../agents/definition.js";
 import type { EventPayload } from "../../conversations/events.js";
 import type { KernelSchemaDb } from "../../db/kernel-schema.js";
 import type { KernelConfigService } from "../../infra/config/kernel-config.service.js";
@@ -77,31 +77,31 @@ export declare function effectiveDefinition(d: EffectiveDefinitionDeps, a: Child
     tierFallback: boolean;
 }>;
 /**
- * What a follow-up (`resume`) may still use (final review I1, spec §5.3): the frozen tools and
- * org skills intersected with the current version they come from. Recorded on the follow-up's
- * task message (`user_message.dispatch.narrowed`), so the run and its replay read it from the log.
+ * What a follow-up (`resume`) may still use (final review I1, spec §5.3): the frozen definition's
+ * turned-off tools together with the current version's (it can lose tools, never gain them), and
+ * the frozen org skills intersected with the current ones. Recorded on the follow-up's task message
+ * (`user_message.dispatch.narrowed`), so the run and its replay read it from the log.
  */
 export interface FollowUpNarrowing {
-    tools: AgentToolRef[];
+    /** Absent in logs from before tools were on by default (no tool narrowing then). */
+    disabledTools?: DisabledToolRef[] | undefined;
     skills?: {
         orgSkills: string[];
         pinned?: string[] | undefined;
     } | undefined;
 }
-/**
- * The refs of `frozen` that `current` still has: a builtin or plugin tool by name, a connector by
- * id; a connector's `all` meets the other side's names (`all` on both stays `all`), and a
- * connector left with no names is dropped. Pure: a connector `current` lists is not looked up.
- */
-export declare function intersectTools(frozen: readonly AgentToolRef[], current: readonly AgentToolRef[]): AgentToolRef[];
 /**
  * The narrowing of a follow-up (final review I1): `frozen` (the child's `subagent_started`
  * definition) against `current`, the definition a fresh dispatch would read now: the dispatching
  * parent run's version for `general` / inline / plugin children, the dispatched org agent's
  * current version for an org agent child (whose tools are its own at dispatch too, §5.5). Its
- * `orgSkills` keep only those `current` still selects; a pinned id that was one of the frozen org
- * skills goes with it (the agent's own skills stay).
+ * `disabledTools` are both lists together; its `orgSkills` keep only those `current` still
+ * selects; a pinned id that was one of the frozen org skills goes with it (the agent's own skills
+ * stay).
+ */
+export declare function narrowFollowUp(frozen: Pick<AgentDefinition, "disabledTools" | "skills">, current: Pick<AgentDefinition, "disabledTools" | "skills">): FollowUpNarrowing;
+/**
+ * The definition a child run uses: the frozen one with its trigger's follow-up narrowing. A
+ * narrowing logged before tools were on by default (no `disabledTools`) narrows only skills.
  */
-export declare function narrowFollowUp(frozen: Pick<AgentDefinition, "tools" | "skills">, current: Pick<AgentDefinition, "tools" | "skills">): FollowUpNarrowing;
-/** The definition a child run uses: the frozen one with its trigger's follow-up narrowing. */
 export declare function childRunDefinition(frozen: AgentDefinition, narrowed: FollowUpNarrowing | undefined): AgentDefinition;

package/dist/runtime/subagents/definition.js

@@ -1,4 +1,5 @@
-import { connectorToolKey, extensionToolKey, parseToolKey, SKILL_ENTRY_FILE, sanitizeParams, } from "@capybara-hq/plugin-sdk";
+import { SKILL_ENTRY_FILE, sanitizeParams, } from "@capybara-hq/plugin-sdk";
+import { canonicalDisabledTools, } from "../../agents/definition.js";
 import { loadTemplates } from "../../agents/templates.js";
 import { ApiError } from "../../errors.js";
 import { PINNED_SKILLS_LIMITS } from "../../skills/catalog.js";
@@ -38,78 +39,28 @@ export function stricterPolicies(base, over) {
     }
     return out;
 }
-async function loadConnectors(db, orgId, refs) {
-    const ids = [...new Set(refs.flatMap((r) => (r.kind === "connector" ? [r.connectorId] : [])))];
-    const out = new Map();
-    if (ids.length === 0)
-        return out;
-    const rows = await db
-        .selectFrom("connectors")
-        .select(["id", "slug"])
-        .where("org_id", "=", orgId)
-        .where("deleted_at", "is", null)
-        .where("id", "in", ids)
-        .execute();
-    const tools = rows.length === 0
-        ? []
-        : await db
-            .selectFrom("connector_tools")
-            .select(["connector_id", "name"])
-            .where("connector_id", "in", rows.map((r) => r.id))
-            .orderBy("name")
-            .execute();
-    for (const r of rows) {
-        out.set(r.id, {
-            slug: r.slug,
-            tools: tools.filter((t) => t.connector_id === r.id).map((t) => t.name),
-        });
-    }
-    return out;
-}
 /**
- * Narrows tool refs by resolved key (spec §5.3): keeps a key when `allow` (if given) lists it and
- * neither `deny` nor {@link CHILD_REMOVED_TOOLS} does (nor, with `removeAgent`, it is `Agent`). A connector ref with `tools: "all"` stays
- * live only when nothing can narrow it (no allowlist and no deny key under `mcp__<slug>__`), so a tool
- * the connector gains later never slips past the template; otherwise it becomes the kept names, or
- * is dropped. A connector that no longer exists keeps its ref only without an allowlist.
+ * A child's key filter (tools default-on spec §4): `deny` = the parent's own filter's (a nested
+ * child), {@link CHILD_REMOVED_TOOLS}, `Agent` when the child is at the depth limit, and the
+ * template's `disallowedTools`; `allow` = the template's `tools` allowlist met with the parent's
+ * (absent on both = everything the parent has). Keys are deduplicated in first-seen order.
  */
-function narrowTools(refs, connectors, allow, deny, removeAgent) {
-    const removed = new Set(CHILD_REMOVED_TOOLS);
-    if (removeAgent)
-        removed.add(AGENT_TOOL);
-    const keep = (key) => !removed.has(key) && !deny.has(key) && (allow === null || allow.has(key));
-    const out = [];
-    for (const ref of refs) {
-        if (ref.kind === "builtin") {
-            if (keep(ref.name))
-                out.push(ref);
-        }
-        else if (ref.kind === "plugin") {
-            if (keep(extensionToolKey(ref.plugin, ref.name)))
-                out.push(ref);
-        }
-        else {
-            const c = connectors.get(ref.connectorId);
-            if (!c) {
-                if (allow === null)
-                    out.push(ref);
-                continue;
-            }
-            const ownsKey = (k) => {
-                const parsed = parseToolKey(k);
-                return parsed?.kind === "connector" && parsed.slug === c.slug;
-            };
-            if (ref.tools === "all" && allow === null && ![...deny].some(ownsKey)) {
-                out.push(ref);
-                continue;
-            }
-            const names = ref.tools === "all" ? c.tools : ref.tools;
-            const kept = names.filter((name) => keep(connectorToolKey(c.slug, name)));
-            if (kept.length > 0)
-                out.push({ ...ref, tools: kept });
-        }
-    }
-    return out;
+function childFilter(removeAgent, template, parent) {
+    const deny = [
+        ...new Set([
+            ...(parent?.deny ?? []),
+            ...CHILD_REMOVED_TOOLS,
+            ...(removeAgent ? [AGENT_TOOL] : []),
+            ...(template?.disallowedTools ?? []),
+        ]),
+    ];
+    const own = template?.tools === undefined ? undefined : [...new Set(template.tools)];
+    const allow = own === undefined
+        ? parent?.allow
+        : parent?.allow === undefined
+            ? own
+            : own.filter((k) => parent.allow?.includes(k));
+    return { ...(allow !== undefined && { allow: [...allow] }), deny };
 }
 /**
  * The template's skills the parent selects (its `orgSkills` or the parent agent's own skills),
@@ -236,10 +187,12 @@ function orgAgentDefinition(d, a) {
     // block stays: it is the roster the child dispatches from (agent map spec §4.1); pending
     // connectors are authoring data too (ruling P4-6)
     const { skills, instructionFiles: _files, pendingConnectors: _pending, ...rest } = own;
+    const { subagentTools: _filter, ...ownRest } = rest;
     const definition = {
-        ...rest,
+        ...ownRest,
         // its own tools, not intersected with the parent's; only the child-removed ones go
-        tools: narrowTools(own.tools, new Map(), null, new Set(), atMaxDepth(a)),
+        disabledTools: own.disabledTools ?? [],
+        subagentTools: childFilter(atMaxDepth(a), null),
         // its policies, then the parent's on top, stricter wins (keys outside its tools are inert)
         toolPolicies: stricterPolicies(own.toolPolicies ?? {}, a.parent.toolPolicies ?? {}),
         ...(skills !== undefined && {
@@ -298,8 +251,6 @@ export async function effectiveDefinition(d, a) {
             ...(row.platformTemplateId !== undefined && { platformTemplateId: row.platformTemplateId }),
         };
     }
-    const connectors = await loadConnectors(d.db, a.orgId, parent.tools);
-    const tools = narrowTools(parent.tools, connectors, template?.tools !== undefined ? new Set(template.tools) : null, new Set(template?.disallowedTools ?? []), atMaxDepth(a));
     const toolPolicies = stricterPolicies(parent.toolPolicies ?? {}, template?.toolPolicies ?? {});
     const { pinned, warnings } = await pinnedFor(d.db, a, template?.skills ?? [], entry.source === "plugin" ? { plugin: entry.plugin } : null, template?.selectedSkills ?? []);
     const tier = a.tier ?? template?.model ?? "inherit";
@@ -322,7 +273,8 @@ export async function effectiveDefinition(d, a) {
         fallback: m.fallback,
         modelParams,
         fallbackParams: m.fallbackParams,
-        tools,
+        disabledTools: parent.disabledTools ?? [],
+        subagentTools: childFilter(atMaxDepth(a), template, parent.subagentTools),
         toolPolicies,
         ...((parentSkills !== undefined || pinned.length > 0) && {
             skills: {
@@ -341,57 +293,32 @@ export async function effectiveDefinition(d, a) {
         tierFallback: m.tierFallback,
     };
 }
-/**
- * The refs of `frozen` that `current` still has: a builtin or plugin tool by name, a connector by
- * id; a connector's `all` meets the other side's names (`all` on both stays `all`), and a
- * connector left with no names is dropped. Pure: a connector `current` lists is not looked up.
- */
-export function intersectTools(frozen, current) {
-    const out = [];
-    for (const ref of frozen) {
-        if (ref.kind === "builtin") {
-            if (current.some((c) => c.kind === "builtin" && c.name === ref.name))
-                out.push(ref);
-        }
-        else if (ref.kind === "plugin") {
-            if (current.some((c) => c.kind === "plugin" && c.plugin === ref.plugin && c.name === ref.name)) {
-                out.push(ref);
-            }
-        }
-        else {
-            const c = current.find((x) => x.kind === "connector" && x.connectorId === ref.connectorId);
-            if (!c)
-                continue;
-            if (c.tools === "all") {
-                out.push(ref);
-                continue;
-            }
-            const names = ref.tools === "all" ? c.tools : ref.tools.filter((n) => c.tools.includes(n));
-            if (names.length > 0)
-                out.push({ ...ref, tools: names });
-        }
-    }
-    return out;
-}
 /**
  * The narrowing of a follow-up (final review I1): `frozen` (the child's `subagent_started`
  * definition) against `current`, the definition a fresh dispatch would read now: the dispatching
  * parent run's version for `general` / inline / plugin children, the dispatched org agent's
  * current version for an org agent child (whose tools are its own at dispatch too, §5.5). Its
- * `orgSkills` keep only those `current` still selects; a pinned id that was one of the frozen org
- * skills goes with it (the agent's own skills stay).
+ * `disabledTools` are both lists together; its `orgSkills` keep only those `current` still
+ * selects; a pinned id that was one of the frozen org skills goes with it (the agent's own skills
+ * stay).
  */
 export function narrowFollowUp(frozen, current) {
-    const tools = intersectTools(frozen.tools, current.tools);
+    const disabledTools = canonicalDisabledTools([
+        ...(frozen.disabledTools ?? []),
+        ...(current.disabledTools ?? []),
+    ]);
     if (frozen.skills === undefined)
-        return { tools };
+        return { disabledTools };
     const frozenOrg = new Set(frozen.skills.orgSkills);
     const now = new Set(current.skills?.orgSkills ?? []);
     const orgSkills = frozen.skills.orgSkills.filter((id) => now.has(id));
     const pinned = frozen.skills.pinned?.filter((id) => !frozenOrg.has(id) || now.has(id));
-    return { tools, skills: { orgSkills, ...(pinned !== undefined && { pinned }) } };
+    return { disabledTools, skills: { orgSkills, ...(pinned !== undefined && { pinned }) } };
 }
-/** The definition a child run uses: the frozen one with its trigger's follow-up narrowing. */
+/**
+ * The definition a child run uses: the frozen one with its trigger's follow-up narrowing. A
+ * narrowing logged before tools were on by default (no `disabledTools`) narrows only skills.
+ */
 export function childRunDefinition(frozen, narrowed) {
     if (narrowed === undefined)
         return frozen;
@@ -403,5 +330,9 @@ export function childRunDefinition(frozen, narrowed) {
             orgSkills: narrowed.skills.orgSkills,
             ...(narrowed.skills.pinned !== undefined && { pinned: narrowed.skills.pinned }),
         };
-    return { ...rest, tools: narrowed.tools, ...(kept !== undefined && { skills: kept }) };
+    return {
+        ...rest,
+        ...(Array.isArray(narrowed.disabledTools) && { disabledTools: narrowed.disabledTools }),
+        ...(kept !== undefined && { skills: kept }),
+    };
 }

package/dist/skills/changes.controller.js

@@ -11,6 +11,7 @@ import { Controller, Delete, Get, HttpCode, Inject, Param, Post } from "@nestjs/
 import { z } from "zod";
 import { AgentsService } from "../agents/agents.service.js";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
+import { InboxNoticeParams } from "../inbox/inbox.schemas.js";
 import { InboxService } from "../inbox/inbox.service.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZParam } from "../infra/validation/zod-params.js";
@@ -25,7 +26,7 @@ const DecideBody = z
     .strict();
 class SkillChangeDecideBody extends createZodDto(DecideBody, "SkillChangeDecideBody") {
 }
-const NoticeParamsSchema = z.object({ id: z.string().min(1).max(100) });
+const NoticeParamsSchema = InboxNoticeParams;
 class NoticeParams extends createZodDto(NoticeParamsSchema, "InboxNoticeParams") {
 }
 /**

package/dist/skills/changes.service.d.ts

@@ -130,7 +130,7 @@ export declare class SkillChangesService {
      * agent → `skill.not_found`。同名的待处理改动一并取消（发起对话追加回退快照，提交后删草稿）。审计 `skill.deleted`。
      * 各对话下一次运行开始时目录里去掉它；之后同名可再写为新技能。
      */
-    deleteAgentSkill(orgId: string, agentId: string, skillId: string, accountId: string, actorTokenId?: string): Promise<void>;
+    deleteAgentSkill(orgId: string, agentId: string, skillId: string, accountId: string, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<void>;
     /** The transaction of {@link write}. */
     private writeIn;
     /** The transaction of {@link decide}. */

package/dist/skills/changes.service.js

@@ -146,8 +146,8 @@ let SkillChangesService = class SkillChangesService {
      * agent → `skill.not_found`。同名的待处理改动一并取消（发起对话追加回退快照，提交后删草稿）。审计 `skill.deleted`。
      * 各对话下一次运行开始时目录里去掉它；之后同名可再写为新技能。
      */
-    async deleteAgentSkill(orgId, agentId, skillId, accountId, actorTokenId) {
-        const cancelled = await this.deleteAgentSkillIn(orgId, agentId, skillId, accountId, actorTokenId);
+    async deleteAgentSkill(orgId, agentId, skillId, accountId, actorTokenId, auditDetail) {
+        const cancelled = await this.deleteAgentSkillIn(orgId, agentId, skillId, accountId, actorTokenId, auditDetail);
         await this.finishCancel(orgId, cancelled);
     }
     /** The transaction of {@link write}. */
@@ -401,7 +401,7 @@ let SkillChangesService = class SkillChangesService {
         return { updated, revertSeq };
     }
     /** The transaction of {@link deleteAgentSkill}. */
-    async deleteAgentSkillIn(orgId, agentId, skillId, accountId, actorTokenId) {
+    async deleteAgentSkillIn(orgId, agentId, skillId, accountId, actorTokenId, auditDetail) {
         await this.keyShareOrg(orgId);
         const agent = await this.db
             .selectFrom("agents")
@@ -471,7 +471,7 @@ let SkillChangesService = class SkillChangesService {
             orgId,
             action: "skill.deleted",
             target: skillId,
-            detail: { name: r.name, agentId },
+            detail: { name: r.name, agentId, ...auditDetail },
         });
         return out;
     }

package/dist/skills/invocable.controller.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import type { z } from "zod";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
 import { type InvocableSkill, SkillInvoker } from "./invoke.js";

package/dist/skills/invocable.controller.js

@@ -8,13 +8,13 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Get, Header, Inject, Param } from "@nestjs/common";
-import { z } from "zod";
 import { CurrentPrincipal, requireUser } from "../identity/principal.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
 import { SkillInvoker } from "./invoke.js";
-const ListQuery = z.object({ conversationId: z.string().min(1).max(100).optional() }).strict();
+import { InvocableSkillsQuerySchema } from "./skills.schemas.js";
+const ListQuery = InvocableSkillsQuerySchema;
 class InvocableSkillsQuery extends createZodDto(ListQuery, "InvocableSkillsQuery") {
 }
 /**

package/dist/skills/invoke.d.ts

@@ -1,5 +1,5 @@
 import { AgentLookup } from "../agents/agent-lookup.js";
-import type { AgentDefinition } from "../agents/definition.js";
+import { type AgentDefinition } from "../agents/definition.js";
 import type { EventPayload } from "../conversations/events.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import { ApiError } from "../errors.js";
@@ -128,7 +128,7 @@ export declare class SkillInvoker {
         conversationId: string;
         skill: InvocationRecord;
     }): Promise<{
-        task: (child: Pick<AgentDefinition, "tools">) => string;
+        task: (child: Pick<AgentDefinition, "disabledTools" | "subagentTools">) => string;
         warning?: string;
     }>;
     /** Reads and parses the version's SKILL.md (checked against the manifest), returns the body. */

package/dist/skills/invoke.js

@@ -10,6 +10,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { escapeSkillInvocationTags, hasShellInjection, parseSkillMd, renderSkillBody, renderSkillInvocation, SKILL_ENTRY_FILE, SKILL_INVOCATION_LIMITS, skillDigest, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { AgentLookup } from "../agents/agent-lookup.js";
+import { builtinDisabled } from "../agents/definition.js";
 import { ApiError } from "../errors.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
@@ -289,7 +290,13 @@ SkillInvoker = __decorate([
     __param(3, Inject(KERNEL_LOGGER))
 ], SkillInvoker);
 export { SkillInvoker };
-const hasBuiltin = (agent, name) => (agent.tools ?? []).some((t) => t.kind === "builtin" && t.name === name);
+/**
+ * Does the definition leave builtin `name` on (tools default-on spec §4): not turned off and not
+ * removed by a sub-agent's key filter. Whether it can run now (a sandbox) is not checked.
+ */
+const hasBuiltin = (agent, name) => !builtinDisabled(agent.disabledTools, name) &&
+    !(agent.subagentTools?.deny ?? []).includes(name) &&
+    (agent.subagentTools?.allow === undefined || agent.subagentTools.allow.includes(name));
 /** The skill's own body over the rendered limit: a 400 on `skill` naming the skill. */
 function tooLarge(name, render) {
     try {

package/dist/skills/skills.controller.d.ts

@@ -3,21 +3,12 @@ import { OwnedItems, type OwnedSkillDeletePreview } from "../catalog/owned-items
 import { type CreatedAttachment } from "../conversations/attachments.service.js";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
+import { SkillCreateBody, SkillIdParams } from "./skills.schemas.js";
 import { type SkillDetail, type SkillSummary, SkillsService, type UploadedSkill } from "./skills.service.js";
 declare const UploadBody: z.ZodObject<{
     name: z.ZodString;
     size: z.ZodNumber;
 }, z.core.$strict>;
-declare const CreateBody: z.ZodObject<{
-    uploadId: z.ZodOptional<z.ZodString>;
-    name: z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
-    description: z.ZodOptional<z.ZodString>;
-    body: z.ZodOptional<z.ZodString>;
-    shareable: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strict>;
-declare const IdParams: z.ZodObject<{
-    id: z.ZodString;
-}, z.core.$strip>;
 declare const ShareableBody: z.ZodObject<{
     shareable: z.ZodBoolean;
 }, z.core.$strict>;
@@ -46,7 +37,7 @@ export declare class SkillsController {
     /** The org's own items: 可共享 and the delete of a promoted skill (rulings P3-3, P3-19). */
     owned: OwnedItems);
     createUpload(principal: Principal, org: OrgContext, body: z.infer<typeof UploadBody>): Promise<CreatedAttachment>;
-    create(principal: Principal, org: OrgContext, body: z.infer<typeof CreateBody>): Promise<UploadedSkill>;
+    create(principal: Principal, org: OrgContext, body: z.infer<typeof SkillCreateBody>): Promise<UploadedSkill>;
     list(principal: Principal, org: OrgContext): Promise<{
         skills: SkillSummary[];
     }>;
@@ -56,7 +47,7 @@ export declare class SkillsController {
      * skill of the org's own (P3-6: an agent's skill or a copy of another owner's platform skill ->
      * 409 `catalog.not_owned`); one it promoted writes its platform row too (ruling P3-2).
      */
-    setShareable(principal: Principal, org: OrgContext, params: z.infer<typeof IdParams>, body: z.infer<typeof ShareableBody>): Promise<{
+    setShareable(principal: Principal, org: OrgContext, params: z.infer<typeof SkillIdParams>, body: z.infer<typeof ShareableBody>): Promise<{
         id: string;
         shareable: boolean;
     }>;
@@ -65,7 +56,7 @@ export declare class SkillsController {
      * `transferred` when it was shared and another org uses it (`orgs`), else `removed`; `agents`
      * the org's agents that lose it.
      */
-    deletePreview(principal: Principal, org: OrgContext, params: z.infer<typeof IdParams>): Promise<OwnedSkillDeletePreview>;
+    deletePreview(principal: Principal, org: OrgContext, params: z.infer<typeof SkillIdParams>): Promise<OwnedSkillDeletePreview>;
     /**
      * Soft-deletes the skill; one the org shared that another org uses is transferred to the
      * platform first (P3-19, platform notice `ownership_transferred`). 204.

package/dist/skills/skills.controller.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { hasControlChars, isSkillName, MEDIA_NAME_MAX_CHARS, SKILL_LIMITS, } from "@capybara-hq/plugin-sdk";
+import { hasControlChars, MEDIA_NAME_MAX_CHARS } from "@capybara-hq/plugin-sdk";
 import { Controller, Delete, Get, HttpCode, Inject, Param, Post, Put } from "@nestjs/common";
 import { z } from "zod";
 import { OwnedItems } from "../catalog/owned-items.js";
@@ -16,7 +16,7 @@ import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principa
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZParam } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
-import { SKILL_WRITE_MAX_BYTES } from "../tools/builtins/skill-write.js";
+import { SkillCreateBody, SkillIdParams, SkillShareableSchema } from "./skills.schemas.js";
 import { SkillsService, } from "./skills.service.js";
 const UploadBody = z
     .object({
@@ -28,28 +28,12 @@ const UploadBody = z
     size: z.number().int().min(1).max(SKILL_PACKAGE_UPLOAD_MAX_BYTES),
 })
     .strict();
-const CreateBody = z
-    .object({
-    uploadId: z.string().min(1).max(100).optional(),
-    name: z
-        .string()
-        .refine(isSkillName, "name must be 1-64 lowercase letters, digits and single hyphens")
-        .optional(),
-    description: z.string().min(1).max(SKILL_LIMITS.descriptionMaxChars).optional(),
-    body: z.string().max(SKILL_WRITE_MAX_BYTES).optional(),
-    shareable: z.boolean().optional(),
-})
-    .strict()
-    .refine((v) => v.uploadId !== undefined
-    ? v.name === undefined && v.description === undefined && v.body === undefined
-    : v.name !== undefined && v.description !== undefined && v.body !== undefined, "send either { uploadId } or { name, description, body }");
 class SkillUploadBody extends createZodDto(UploadBody, "SkillUploadBody") {
 }
-class SkillCreateBody extends createZodDto(CreateBody, "SkillCreateBody") {
+class SkillCreateBodyDto extends createZodDto(SkillCreateBody, "SkillCreateBody") {
 }
-const IdParams = z.object({ id: z.string().min(1).max(100) });
-const ShareableBody = z.object({ shareable: z.boolean() }).strict();
-class SkillIdParams extends createZodDto(IdParams, "SkillIdParams") {
+const ShareableBody = SkillShareableSchema;
+class SkillIdParamsDto extends createZodDto(SkillIdParams, "SkillIdParams") {
 }
 class SkillShareableBody extends createZodDto(ShareableBody, "SkillShareableBody") {
 }
@@ -147,7 +131,7 @@ __decorate([
     OrgAction("skills.manage"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, ZBody(SkillCreateBody))
+    __param(2, ZBody(SkillCreateBodyDto))
 ], SkillsController.prototype, "create", null);
 __decorate([
     Get(),
@@ -167,7 +151,7 @@ __decorate([
     OrgAction("skills.manage"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, ZParam(SkillIdParams)),
+    __param(2, ZParam(SkillIdParamsDto)),
     __param(3, ZBody(SkillShareableBody))
 ], SkillsController.prototype, "setShareable", null);
 __decorate([
@@ -175,7 +159,7 @@ __decorate([
     OrgAction("skills.manage"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, ZParam(SkillIdParams))
+    __param(2, ZParam(SkillIdParamsDto))
 ], SkillsController.prototype, "deletePreview", null);
 __decorate([
     Delete(":id"),