feat(sources,organize): site agent capabilities and organize.minSizeBytes setting (W10-pre2)

- site.list / site.health_check / site.refresh_login / site.user_data capabilities
  over the W9-A site center services; outputs whitelisted (no secret refs,
  cookies, passwords, login names); execute kinds need automation grant.
  IDs use snake_case (CapabilityId regex); registry count 17 -> 21.
- settings.organize.minSizeBytes (default 50 MiB); file-manager identify /
  organize and planImport take request > setting > port default.
- tests and runbook notes (sites, files).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/capability.ts

@@ -68,6 +68,10 @@ export const CAPABILITY_IDS = [
   "inventory.query",
   "agent.spawn",
   "agent.await",
+  "site.list",
+  "site.health_check",
+  "site.refresh_login",
+  "site.user_data",
 ] as const;
 export const KnownCapabilityId = z.enum(CAPABILITY_IDS);
 export type KnownCapabilityId = z.infer<typeof KnownCapabilityId>;
@@ -297,6 +301,53 @@ export const CAPABILITY_CATALOG: Record<KnownCapabilityId, CapabilityDescriptor>
     true,
     false,
   ),
+  // W10-pre2 站点能力(W9-A 站点中心的 Agent 入口);输出一律不含凭证、Cookie 与 secret 引用
+  "site.list": d(
+    "site.list",
+    "列出站点",
+    "列出已登记站点的健康、登录状态与账号摘要(不含凭证)",
+    "read",
+    "SiteList",
+    "read",
+    "low",
+    true,
+    false,
+  ),
+  // 只读站点首页并写回健康列,重跑无害:声明 replay safe
+  "site.health_check": d(
+    "site.health_check",
+    "检测站点",
+    "检测站点首页连通与登录态,写回站点健康状态",
+    "execute",
+    "SiteHealthCheck",
+    "admin",
+    "low",
+    true,
+    false,
+    "safe",
+  ),
+  "site.refresh_login": d(
+    "site.refresh_login",
+    "刷新站点登录",
+    "对站点账号重新登录或校验 Cookie / API Key,成功后拉取用户数据;需持续授权或审批",
+    "execute",
+    "SiteLoginRefresh",
+    "admin",
+    "medium",
+    true,
+    false,
+  ),
+  "site.user_data": d(
+    "site.user_data",
+    "查站点用户数据",
+    "读取站点账号的最新用户数据(上传、下载、分享率、魔力、做种)与按天历史",
+    "read",
+    "SiteUserData",
+    "read",
+    "low",
+    true,
+    false,
+  ),
 };
 
 function d(
@@ -309,6 +360,8 @@ function d(
   riskLevel: RiskLevel,
   idempotent: boolean,
   supportsPreview: boolean,
+  /** 缺省按类别推导;仅对幂等且副作用可重跑的能力显式给 safe */
+  replay?: CapabilityReplay,
 ): CapabilityDescriptor {
   return {
     id,
@@ -323,6 +376,6 @@ function d(
     idempotent,
     supportsPreview,
     // 有副作用的类别一律不可重放
-    replay: kind === "read" || kind === "preview" ? "safe" : "never",
+    replay: replay ?? (kind === "read" || kind === "preview" ? "safe" : "never"),
   };
 }