@capybara-hq/kernel 0.1.0-rc.8 → 0.1.0-rc.9

package/dist/tools/registry.d.ts

@@ -12,6 +12,18 @@ import { BuiltinTools } from "./builtins/builtin-tools.js";
 import { OrgToolSwitches } from "./org-tool-switches.js";
 export { BUILTIN_TOOL_NAMES } from "./builtin-names.js";
 export { canonicalJson } from "./canonical-json.js";
+/**
+ * What a tool's `unavailable` is asked with: the org, and for a run's listing the root
+ * conversation (`conversationId`; the sandbox tools follow its environment, ruling R8), whether
+ * the run is an eval replay (`replay`: its tool calls are never executed), and a `memo` shared by
+ * the tools of one listing (one answer per question per listing).
+ */
+export interface ToolListingScope {
+    orgId: string;
+    conversationId?: string;
+    replay?: boolean;
+    memo?: Map<string, unknown>;
+}
 /** A problem of a saved definition's `disabledTools` (`path` is `disabledTools.<i>`). */
 export interface ToolRefIssue {
     path: string;
@@ -82,11 +94,9 @@ export interface BuiltinTool {
     /**
      * The factual reason this tool is unavailable for the org right now (English, actionable; it goes
      * into the "tool unavailable" reminder), or null when it is available. May be async (e.g. a
-     * per-org extension-point default).
+     * per-org extension-point default). See {@link ToolListingScope} for what a listing passes.
      */
-    unavailable?: (ctx: {
-        orgId: string;
-    }) => Promise<string | null> | string | null;
+    unavailable?: (ctx: ToolListingScope) => Promise<string | null> | string | null;
     /**
      * A policy key derived from the validated input (Platform tool spec §6.2), or null to use the
      * tool key. With a key, agent and parent policies, grants and approvals are keyed by it (an
@@ -334,6 +344,13 @@ export declare class ToolRegistry {
          * it reaches its parent with neither tool (`SendMessage` only to its own sub-agents).
          */
         forkChild?: boolean;
+        /**
+         * The root conversation of the run (a sub-agent's tree root): tools whose availability
+         * depends on the conversation's environment (the sandbox tools) are listed by it.
+         */
+        sandboxConversationId?: string;
+        /** An eval replay's listing: its calls are never executed (the sandbox tools are listed). */
+        replay?: boolean;
     }): Promise<AgentTools>;
     /** 是否启用 `ToolSearch`（见 {@link forAgent}）；先比阈值，超过才读组织设置。 */
     private searchActive;

package/dist/tools/registry.js

@@ -348,6 +348,14 @@ let ToolRegistry = class ToolRegistry {
     }
     async resolve(orgId, def) {
         const disabled = def.disabledTools ?? [];
+        const scope = {
+            orgId,
+            ...(def.sandboxConversationId !== undefined && {
+                conversationId: def.sandboxConversationId,
+            }),
+            ...(def.replay === true && { replay: true }),
+            memo: new Map(),
+        };
         const tools = [];
         const unavailable = [];
         const hidden = [];
@@ -373,7 +381,7 @@ let ToolRegistry = class ToolRegistry {
             const b = this.builtins.find((x) => x.spec.name === name);
             if (!b)
                 continue;
-            const why = (await b.unavailable?.({ orgId })) ?? null;
+            const why = (await b.unavailable?.(scope)) ?? null;
             if (why !== null) {
                 hidden.push({ ref: name, reason: why });
                 continue;
@@ -392,7 +400,7 @@ let ToolRegistry = class ToolRegistry {
             if (name === BUILTIN.Bash) {
                 for (const companion of BASH_COMPANION_TOOLS) {
                     const c = this.builtins.find((x) => x.spec.name === companion);
-                    if (c && ((await c.unavailable?.({ orgId })) ?? null) === null) {
+                    if (c && ((await c.unavailable?.(scope)) ?? null) === null) {
                         add(builtinTool(c, c.spec));
                     }
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/kernel",
-  "version": "0.1.0-rc.8",
+  "version": "0.1.0-rc.9",
   "description": "Capybara kernel: config, database, plugin host and HTTP API of the Capybara agent platform",
   "license": "Apache-2.0",
   "repository": {
@@ -32,6 +32,7 @@
   "dependencies": {
     "@fastify/cookie": "^11.1.3",
     "@fastify/static": "^9.3.0",
+    "@fastify/websocket": "^11.3.7",
     "@langchain/core": "^1.2.18",
     "@langchain/langgraph": "^1.5.1",
     "@langchain/langgraph-checkpoint": "^1.2.0",
@@ -64,13 +65,15 @@
     "yaml": "^2.9.1",
     "yauzl": "3.4.0",
     "zod": "^4.6.7",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.5"
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.6"
   },
   "devDependencies": {
     "@langchain/langgraph-checkpoint-validation": "^1.2.0",
     "@types/pg": "^8.23.1",
     "@types/semver": "^7.8.0",
+    "@types/ws": "^8.18.2",
     "@types/yauzl": "3.4.0",
+    "ws": "^8.22.0",
     "@capybara-hq/testing": "0.1.0-rc.9"
   },
   "scripts": {

package/src/migrations/0093_connected_environments.sql

@@ -0,0 +1,37 @@
+-- Environments phase 2 (spec 2026-11-07-environments-design §6, §13): a person's own machine,
+-- connected through the device program, becomes an environment with source 'device'. Expand-only:
+-- the source CHECK list grows and a new table holds the connected machine.
+
+-- 0088 left the CHECK unnamed, so Postgres named it environments_source_check; re-add it under
+-- the same name with the longer list.
+ALTER TABLE environments DROP CONSTRAINT IF EXISTS environments_source_check;
+ALTER TABLE environments
+  ADD CONSTRAINT environments_source_check CHECK (source IN ('cloud', 'device'));
+
+-- The machine connected to a device environment. credential_hash is a hash of the machine's
+-- long-lived credential (cap_dev_...), never the credential itself; revoking a machine sets
+-- revoked_at and keeps the row, so only one unrevoked machine exists per environment.
+-- program_version, mode, roots and session_isolation are what the program reported on its last
+-- connection; last_seen_at is the last time it connected or pinged.
+CREATE TABLE IF NOT EXISTS environment_machines (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  environment_id text NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+  account_id text NOT NULL,
+  credential_hash text NOT NULL UNIQUE,
+  name text NOT NULL,
+  os text NOT NULL,
+  arch text NOT NULL,
+  program_version text,
+  mode text CHECK (mode IN ('os', 'docker')),
+  roots jsonb,
+  session_isolation boolean NOT NULL DEFAULT false,
+  last_seen_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  revoked_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS environment_machines_active_uq
+  ON environment_machines (environment_id)
+  WHERE revoked_at IS NULL;
+-- The org cascade delete looks rows up by org (as environment_instances_org_idx in 0088).
+CREATE INDEX IF NOT EXISTS environment_machines_org_idx ON environment_machines (org_id);

package/src/migrations/0094_environment_paths_idx.sql

@@ -0,0 +1,7 @@
+-- Environments phase 2 (spec 2026-11-07-environments-design §13.1, ruling R22): every sandbox tool
+-- call reads the conversation's latest environment_paths event; a partial index answers it
+-- without scanning the conversation's events backwards. Not CONCURRENTLY, like the other index
+-- migrations (0025).
+CREATE INDEX IF NOT EXISTS conversation_events_environment_paths_idx
+  ON conversation_events (conversation_id, seq)
+  WHERE type = 'environment_paths';