@nocobase/app-plugin-agents 0.1.0-beta.1 → 0.1.0-beta.2

package/dist/shared/variables.d.ts

@@ -6,6 +6,10 @@
  * Variables are set on an agent, on a working directory (`workdir`), or on a scope the application registers (the
  * group a run's subject belongs to, say), and a run gets them merged: the subject's scopes < its working directories <
  * the agent, a later scope replacing an earlier one's value.
+ *
+ * A run's variables go to whichever runner takes it, including a personal runner of whoever may use the agent: sharing
+ * an agent shares the tokens it works with. A variable marked `teamRunnersOnly` keeps a run that gets it off personal
+ * runners: only a team runner takes such a run.
  */
 /** The scopes this plugin knows; the application registers the others (`GET agents/vocabulary` lists them). */
 export declare const CORE_VARIABLE_SCOPES: readonly ["agent", "workdir"];
@@ -13,10 +17,18 @@ export declare const CORE_VARIABLE_SCOPES: readonly ["agent", "workdir"];
 export type VariableScope = string;
 export interface Variable {
     readonly name: string;
+    /** Only team runners receive it: a run that gets it waits for one (`secretsNotAllowed`); absent means false. */
+    readonly teamRunnersOnly?: boolean;
     readonly updatedAt: string;
     readonly updatedById: string | null;
     readonly updatedByName: string | null;
 }
+/** A variable named by where it is kept, such as one that asks for a team runner. */
+export interface VariableRef {
+    readonly scope: VariableScope;
+    readonly scopeId: string;
+    readonly name: string;
+}
 export interface VariableValue {
     readonly name: string;
     readonly value: string;

package/dist/shared/variables.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../../shared/variables.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+GAA+G;AAC/G,eAAO,MAAM,oBAAoB,+BAAgC,CAAC;AAElE,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,sBAAsB,iDAKzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,sGAAsG;AACtG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,EAAE,MAAoC,CAAC;AAEzE,4CAA4C;AAC5C,eAAO,MAAM,wBAAwB,EAAE,MAAiB,CAAC;AAEzD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,MAAM,MAAM,mBAAmB,GAC7B,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;AAEpD,qEAAqE;AACrE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,GAAG,IAAI,CAM5B"}
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../../shared/variables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+GAA+G;AAC/G,eAAO,MAAM,oBAAoB,+BAAgC,CAAC;AAElE,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gHAAgH;IAChH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,sBAAsB,iDAKzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,sGAAsG;AACtG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,EAAE,MAAoC,CAAC;AAEzE,4CAA4C;AAC5C,eAAO,MAAM,wBAAwB,EAAE,MAAiB,CAAC;AAEzD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,MAAM,MAAM,mBAAmB,GAC7B,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;AAEpD,qEAAqE;AACrE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,GAAG,IAAI,CAM5B"}

package/dist/shared/variables.js

@@ -6,6 +6,10 @@
  * Variables are set on an agent, on a working directory (`workdir`), or on a scope the application registers (the
  * group a run's subject belongs to, say), and a run gets them merged: the subject's scopes < its working directories <
  * the agent, a later scope replacing an earlier one's value.
+ *
+ * A run's variables go to whichever runner takes it, including a personal runner of whoever may use the agent: sharing
+ * an agent shares the tokens it works with. A variable marked `teamRunnersOnly` keeps a run that gets it off personal
+ * runners: only a team runner takes such a run.
  */
 /** The scopes this plugin knows; the application registers the others (`GET agents/vocabulary` lists them). */
 export const CORE_VARIABLE_SCOPES = ['agent', 'workdir'];

package/dist/shared/variables.js.map

@@ -1 +1 @@
-{"version":3,"file":"variables.js","sourceRoot":"","sources":["../../shared/variables.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC;AAiBlE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,SAAS;CACD,CAAC;AAiBX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAW,2BAA2B,CAAC;AAEzE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAW,CAAC,GAAG,IAAI,CAAC;AAEzD,yHAAyH;AACzH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAY;IAC3D,OAAO,CACL,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1D,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAKD,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,WAA8B,EAAE,EAChC,GAAY;IAEZ,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"variables.js","sourceRoot":"","sources":["../../shared/variables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC;AA0BlE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,SAAS;CACD,CAAC;AAiBX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAW,2BAA2B,CAAC;AAEzE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAW,CAAC,GAAG,IAAI,CAAC;AAEzD,yHAAyH;AACzH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAY;IAC3D,OAAO,CACL,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1D,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAKD,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,WAA8B,EAAE,EAChC,GAAY;IAEZ,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@nocobase/app-plugin-agents",
   "displayName": "Agents",
   "description": "Agents for NocoBase applications: agents, the model services online agents call, their runs and conversations, and the runners people connect to run them (registration, the long-poll claim, slots, the sweeper, build jobs, and the runner and CLI tarballs the application serves).",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.2",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -144,7 +144,7 @@
     "yaml": "^2.9.0",
     "zod": "^4.6.5",
     "@nocobase/agent-protocol": "^0.1.0-beta.1",
-    "@nocobase/app-cli-client": "^0.1.0-beta.0",
+    "@nocobase/app-cli-client": "^0.1.0-beta.1",
     "@nocobase/cli-envelope": "^0.1.0-beta.0"
   },
   "peerDependencies": {
@@ -160,16 +160,16 @@
     "react-router": "^7.0.2",
     "recharts": "^3.8.0",
     "remark-gfm": "^4.0.1",
-    "@nocobase/app-cli": "^1.0.0-beta.14",
+    "@nocobase/app-cli": "^1.0.0-beta.15",
     "@nocobase/app-client": "^2.0.0-beta.2",
     "@nocobase/app-plugin-authentication": "^2.0.0-beta.2",
     "@nocobase/app-plugin-authorization": "^1.0.0-beta.25",
-    "@nocobase/app-plugin-file": "^1.0.0-beta.20",
-    "@nocobase/app-server": "^2.0.0-beta.1",
+    "@nocobase/app-plugin-file": "^1.0.0-beta.21",
+    "@nocobase/app-server": "^2.0.0-beta.2",
     "@nocobase/authorization": "^1.0.0-beta.12",
     "@nocobase/db": "^1.0.0-beta.18",
     "@nocobase/i18n": "^1.0.0-beta.5",
-    "@nocobase/markdown-mermaid": "^0.1.0-beta.0",
+    "@nocobase/markdown-mermaid": "^0.1.0-beta.1",
     "@nocobase/service-provider": "^0.0.2-beta.1"
   },
   "devDependencies": {
@@ -185,10 +185,10 @@
     "react-dom": "^19.2.8",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@nocobase/app-testing": "0.1.0-beta.1",
     "@nocobase/db-postgres": "0.1.0-beta.3",
     "@nocobase/db-sqlite": "0.1.0-beta.4",
-    "@nocobase/dev-config": "0.1.0-beta.19",
+    "@nocobase/app-testing": "0.1.0-beta.1",
+    "@nocobase/dev-config": "0.1.0-beta.20",
     "@nocobase/jobs": "0.1.0-beta.2"
   },
   "scripts": {

package/skills/nocobase-app-plugin-agents/references/extension-points.md

@@ -25,6 +25,9 @@ Rules that are easy to miss:
 
 - `context.assemble`, brief sections and mounts run inside the claim's transaction and read the database through the claim's connection only (on SQLite it is the only connection). Read anything else in the provider's optional `prepare(run)`, which runs before the transaction. A throw leaves the run queued; three failures fail it `setupFailed`.
 - `runs.enqueue` takes an optional outer transaction; inside another plugin's transaction, publish the collected events after it commits.
+- To tell a person before queuing whether a runner would take their work, call `eligibility.canClaim` (online now) or `mayQueue` (some registered runner could) with the subject's variable scopes; a variable marked `teamRunnersOnly` needs a team runner. Enqueue itself does not refuse: such work waits with `secretsNotAllowed`.
+- Forward `notice` / `notice.cleared` for `run_secrets_not_allowed` to the actor and owner; its subject is a run and its parameters name the run, the agent and the team-only variables. Deduplicate by the notice key. Existing copied queue components must merge the `secretsNotAllowed` type and label from the Registry.
+- A repository provider minting credentials in `prepare` implements idempotent `discard(run, prepared)` to revoke undelivered credentials. The plugin calls it outside the transaction on a skipped or rolled-back claim; the App implements the code host revocation API.
 - A subject kind takes runner agents only unless its binding lists `online` in `agentTypes`; a run of another type is refused with `AGENT_TYPE_NOT_ALLOWED`.
 - Name commands in a brief with `commandRef(dialect, cli, id, flag?)` rather than spelling them, so online and runner agents both get the right form.
 - The App's CLI commands are its API routes: a route declares `...cliRoute({ command, action, ... })` in `describeRoute()`, and lists `runToken` in its `security` when a run may call it. The command manifest (`GET /api/cli/manifest`) offers each caller only the commands whose `action` the gate allows. There is no separate command registry.

package/skills/nocobase-app-plugin-agents/references/runners.md

@@ -12,7 +12,7 @@ A runner registers once per App with a one-time registration token (10 minutes):
 
 Then on the runner's machine: `nocobase-runner register --server <App URL> --token <token>`, and `nocobase-runner start` or `nocobase-runner service install` (launchd on macOS, a systemd user unit on Linux). The install script does all of this in one line; see [Distribution](distribution.md).
 
-A runner authenticates afterwards with its own key. Personal runners (`ownerOnly`) run only work their owner started; their owner may share them with the team. `nocobase-runner unregister --server <url>` or "Revoke" on the Runtimes page ends a registration.
+A runner authenticates afterwards with its own key. Personal runners (`ownerOnly`) run only work their owner started, and receive its variables like any runner, except those marked "Team runtimes only" (`teamRunnersOnly`): a run that gets one goes to a team runner. Their owner may share them with the team. `nocobase-runner unregister --server <url>` or "Revoke" on the Runtimes page ends a registration.
 
 ## How work reaches a runner
 

package/skills/nocobase-app-plugin-agents/references/verification-and-troubleshooting.md

@@ -15,7 +15,7 @@ Test what the App builds on the plugin, not the plugin itself. `@nocobase/app-pl
 | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Runners                   | `GET /api/agents/runners` (`runtime list`): `status` (`online`, `offline`, `revoked`, `upgrade_required`), `lastSeenAt`, `tools` (installed, version, signed in), `policy`, `updateVersion`, `requiredProtocol` |
 | Agents that can take work | `GET /api/agents/available` (`agent list`): each agent and whether it can take work now                                                                                                                         |
-| Why a run waits           | The run's detail and `runs.workload()`: `RUN_WAIT_REASONS` (`noRunnerOnline`, `toolUnavailable`, `noSharedRunner`, `missingFeatures`, `concurrencyFull`, `runnersBusy`, …)                                      |
+| Why a run waits           | The run's detail and `runs.workload()`: `RUN_WAIT_REASONS` (`noRunnerOnline`, `toolUnavailable`, `noSharedRunner`, `missingFeatures`, `secretsNotAllowed`, `concurrencyFull`, `runnersBusy`, …)                 |
 | A run's history           | `GET /api/agents/runs/:runId` and its events (`run get`, `run events`); `failureReason` and `failureDetail`                                                                                                     |
 | Models                    | `GET /api/agents/models` (what agents may use), `POST /api/agents/checkModel` (`model check`), `GET /api/agents/defaultModels`                                                                                  |
 | Tarballs served           | `GET /api/agents/dist/manifest` signed in; `GET /api/agents/dist/products/<product>/targets/linux-x64?format=env`                                                                                               |