@nocobase/app-plugin-agents 0.1.0-beta.9 → 1.0.0-beta.15

package/dist/server/core/agents/agent.service.js

@@ -1,115 +1,61 @@
 /**
- * Agents: who they are, their type, which tool or model they work with and how, their skills, which runners may run
- * them and who may wake them. An agent's type is chosen when it is created and never changes: a `runner` agent drives a
- * coding tool on a runner, an `online` agent talks to a model of a model service on the server and has no tool, runners,
- * tool policy or variables (`checkType`); its skills are read in a sandbox, their scripts never run.
- * Who may change an agent is the route's concern (the `agents.agents` settings item, or the `agents.config` `edit`
- * action's level); the service checks the values and the revision an edit was made against, and keeps the history of
- * every change (`agent.history.ts`).
+ * Agents: one for each coding tool and model the runners report (`syncRunner`), and the application's own
+ * (`ensureSystem`). Nobody creates or deletes an agent. Someone who manages agents writes what an agent discovered from
+ * runners is good at, chooses its default reasoning effort and enables or disables it (`update`); everything else about
+ * it is the application's, the same for each (`setDefaults`: its instructions and business actions). Who may change an
+ * agent is the route's concern; the service checks the values and the revision an edit was made against, and keeps
+ * the history of every change (`agent.history.ts`).
  *
- * Archiving or deleting an agent withdraws its queued runs and announces `agent.removed`, so the application lets go
- * of the work it gave the agent (the assembling application clears it as executor of unfinished issues).
+ * Disabling an agent withdraws its queued runs and announces `agent.removed`, so the application lets go of the work
+ * it gave the agent.
  */
-import { AgentToolSchema, PERMISSION_MODES } from '@nocobase/agent-protocol';
+import { createHash } from 'node:crypto';
 import { z } from 'zod';
-import { AGENT_ACCESS, CONFIRM_CHANGES, AGENT_TYPES, effortsFor, isOnlineEntry, isRunnerEntry, MAX_MODEL_ENTRIES, sameEntry, } from '../../../shared/agents.js';
-import { offers } from '../../../shared/models.js';
-import { invalid, notFound, precondition, ProtocolError, } from '../../kernel/errors.js';
+import { effortsFor, MAX_MODEL_ENTRIES, } from '../../../shared/agents.js';
+import { agentNameOf, discoveryKey } from '../../../shared/model-catalog.js';
+import { lockDiscovery, preferences, } from './discovery.js';
+import { reportedModels } from '../../../shared/runners.js';
+import { invalid, notFound, ProtocolError } from '../../kernel/errors.js';
 import { cleanList } from '../../kernel/values.js';
-import { attachmentsRepo, replaceAttachments, skillsRepo, } from '../skills/skill.store.js';
 import { diffAgents, listChanges, recordChange, } from './agent.history.js';
-import { deleteAgent, findAgent, insertAgent, listAgents, replaceUsers, reviseAgent, } from './agent.store.js';
-const ToolPolicyPatchSchema = z
-    .object({
-    permissionMode: z.enum(PERMISSION_MODES),
-    allowedCommands: z.array(z.string().max(500)).max(200),
-    deniedPatterns: z.array(z.string().max(500)).max(200),
-    allowedDownloads: z.array(z.string().max(500)).max(200),
-    maxTurns: z.number().int().positive(),
-    idleTimeoutMs: z.number().int().min(60_000).max(86_400_000),
-})
-    .partial();
-/** An entry's reasoning effort; empty for the default. Which values its tool or service takes is `checkType`'s. */
-const EffortSchema = z
-    .string()
-    .trim()
-    .max(32)
-    .nullable()
-    .optional()
-    .transform((effort) => (effort ? effort : null));
-const RunnerEntrySchema = z.strictObject({
-    tool: AgentToolSchema,
-    model: z
-        .string()
-        .trim()
-        .max(200)
-        .nullable()
+import { agentDirectory, agentNamesOf, agentsRepo, findAgent, insertAgent, isRemoved, listAgents, reviseAgent, updateAgent, } from './agent.store.js';
+/** What changing an agent accepts. */
+export const AgentPatchSchema = z.strictObject({
+    description: z.string().max(10_000).nullable().optional().meta({
+        description: 'What it is good at: the project manager hands it work by this. Required to enable it.',
+    }),
+    effort: z.string().trim().max(32).nullable().optional().meta({
+        description: "Its default reasoning effort, one of its tool's; null for the tool's default.",
+    }),
+    enabled: z
+        .boolean()
         .optional()
-        .transform((model) => (model ? model : null)),
-    effort: EffortSchema,
-});
-const OnlineEntrySchema = z.strictObject({
-    modelService: z.string().trim().min(1).max(100),
-    model: z.string().trim().min(1).max(200),
-    effort: EffortSchema,
-});
-/**
- * An agent's list of tools and models: runner entries (`{ tool, model?, effort? }`) or online ones
- * (`{ modelService, model, effort? }`).
- */
-export const ModelEntriesSchema = z
-    .array(z.union([RunnerEntrySchema, OnlineEntrySchema]))
-    .max(MAX_MODEL_ENTRIES)
-    .meta({
-    description: 'The tools and models, in order, the first its default, each with an optional reasoning effort its tool or service takes: `[{"tool":"codex","model":"gpt-5","effort":"high"},{"tool":"claude"}]` for a runner agent, `[{"modelService":"openai","model":"gpt-5","effort":"low"}]` for an online one. A runner agent needs at least one; an online agent may have none until a model is configured.',
-});
-const fields = {
-    name: z.string().trim().min(1).max(200),
-    description: z.string().max(10_000).nullable(),
-    avatar: z.string().trim().max(500).nullable(),
-    modelEntries: ModelEntriesSchema,
-    instructions: z.string().max(100_000).nullable(),
-    runnerIds: z.array(z.string().min(1).max(64)).max(100),
-    skillIds: z.array(z.string().min(1).max(64)).max(100),
-    actions: z.array(z.string().min(1).max(100)).max(100),
-    confirmChanges: z.enum(CONFIRM_CHANGES),
-    access: z.enum(AGENT_ACCESS),
-    userIds: z.array(z.string().min(1).max(64)).max(500),
-    ownerUserId: z.string().min(1).max(64),
-    maxConcurrentRuns: z.number().int().min(1).max(100),
-    maxAttempts: z.number().int().min(1).max(10),
-    toolPolicy: ToolPolicyPatchSchema.nullable(),
-};
-/** What creating an agent accepts. */
-export const AgentInputSchema = z.strictObject({
-    ...fields,
-    type: z.enum(AGENT_TYPES).optional(),
-    modelEntries: fields.modelEntries.optional(),
-    description: fields.description.optional(),
-    avatar: fields.avatar.optional(),
-    instructions: fields.instructions.optional(),
-    runnerIds: fields.runnerIds.optional(),
-    skillIds: fields.skillIds.optional(),
-    actions: fields.actions.optional(),
-    confirmChanges: fields.confirmChanges.optional(),
-    access: fields.access.optional(),
-    userIds: fields.userIds.optional(),
-    ownerUserId: fields.ownerUserId.optional(),
-    maxConcurrentRuns: fields.maxConcurrentRuns.optional(),
-    maxAttempts: fields.maxAttempts.optional(),
-    toolPolicy: fields.toolPolicy.optional(),
-});
-/**
- * What updating an agent accepts: any field of the input but its type, and the revision the edit was made against. A
- * patch naming a type is refused (`AGENT_TYPE_IMMUTABLE`) rather than having it ignored.
- */
-export const AgentPatchSchema = z
-    .strictObject(fields)
-    .partial()
-    .extend({
-    expectedRevision: z.number().int().min(1),
-    type: z.never({ error: 'An agent keeps its type.' }).optional(),
+        .meta({ description: 'Offer it work, or stop offering it.' }),
+    expectedRevision: z
+        .number()
+        .int()
+        .min(1)
+        .describe('The revision last read; reject if the record has changed.'),
 });
+const NO_DEFAULTS = { instructions: null, actions: [] };
+/** How often a runner's report refreshes when its tools and models were last seen. */
+const REPORT_REFRESH_MS = 10 * 60_000;
+/** How many runs of one discovered agent may run at once: as many as the runners' slots allow. */
+const RUNNER_AGENT_CONCURRENCY = 100;
+/** How many attempts a run of any agent gets. */
+const AGENT_ATTEMPTS = 3;
+/** The effort a discovered agent starts with: `medium` when its tool takes it, else the tool's default. */
+function initialEffort(tool) {
+    return effortsFor({ tool }).includes('medium') ? 'medium' : null;
+}
+/** The fixed id of the agent of a tool and model, so two runners reporting it at once create one. */
+export function runnerAgentId(tool, model) {
+    const hash = createHash('sha256')
+        .update(`${tool}\u0000${model}`)
+        .digest('hex')
+        .slice(0, 20);
+    return `runner-${tool}-${hash}`;
+}
 /** Thrown inside an update's transaction when the patch changes nothing, to roll the raised revision back. */
 class Unchanged extends Error {
     agent;
@@ -121,200 +67,178 @@ class Unchanged extends Error {
 function revisionConflict(current) {
     return new ProtocolError('REVISION_CONFLICT', 'The agent was changed by someone else since you opened it. Reload it to see what changed, then make your change again.', { revision: current });
 }
-function columns(input) {
-    const values = {};
-    for (const key of [
-        'name',
-        'description',
-        'avatar',
-        'modelEntries',
-        'instructions',
-        'confirmChanges',
-        'access',
-        'ownerUserId',
-        'maxConcurrentRuns',
-        'maxAttempts',
-        'toolPolicy',
-    ])
-        if (input[key] !== undefined)
-            values[key] = input[key];
-    if (input.runnerIds !== undefined)
-        values.runnerIds = cleanList(input.runnerIds);
-    if (input.actions !== undefined)
-        values.actions = cleanList(input.actions);
-    return values;
+/** Whether work may be given to the agent: enabled, with at least one tool and model. */
+export function isWorkable(agent) {
+    return agent.status === 'enabled' && agent.modelEntries.length > 0;
 }
-/** Attaches `skillIds` to the agent; unknown skills are refused. */
-async function attachSkills(conn, agentId, skillIds, ids, now) {
-    const unique = cleanList(skillIds);
-    if (unique.length > 0) {
-        const found = await skillsRepo(conn).findMany({
-            filter: (f) => f.or(unique.map((id) => f.string('id').eq(id))),
-        });
-        if (found.length !== unique.length)
-            throw invalid('Some of the skills do not exist.');
-    }
-    await replaceAttachments(conn, 'agent', agentId, unique, () => ids.next(), now);
-}
-/**
- * 400 unless the fields fit the type: a runner agent's entries name coding tools, at least one; an online agent's name
- * model services and their models (none while it is not configured), and it has none of what only a runner uses
- * (runners, a tool policy), nor a business action meant for runner agents only. No entry is listed twice, and each
- * entry's effort is one its tool or service takes.
- */
-async function checkType(deps, agent, 
-/** The entries saved before; an online entry among them stays even when its service no longer offers it. */
-previous) {
-    const wrongType = (key) => (deps.actionTypes?.(key) ?? AGENT_TYPES).includes(agent.type) === false;
-    const refused = agent.actions.filter(wrongType);
-    if (refused.length > 0)
-        throw invalid(`A ${agent.type} agent cannot be given ${refused.join(', ')}.`, { reason: 'ACTION_NOT_FOR_TYPE', actions: refused });
-    const entries = agent.modelEntries;
-    if (entries.length === 0 && agent.type === 'runner')
-        throw invalid('A runner agent needs at least one coding tool (modelEntries).');
-    if (entries.some((entry, index) => entries.slice(0, index).some((other) => sameEntry(entry, other))))
-        throw invalid('The same tool and model are listed twice.');
-    for (const entry of entries)
-        if (entry.effort &&
-            !effortsFor(entry).includes(entry.effort) &&
-            // An effort saved before its tool dropped it stays until someone changes it.
-            !previous.some((saved) => sameEntry(saved, entry) && saved.effort === entry.effort))
-            throw invalid(`${isRunnerEntry(entry) ? entry.tool : entry.modelService} takes no reasoning effort ${entry.effort}: use one of ${effortsFor(entry).join(', ')}.`, { reason: 'EFFORT_UNSUPPORTED' });
-    if (agent.type === 'runner') {
-        if (!entries.every(isRunnerEntry))
-            throw invalid('A runner agent works with coding tools: each entry names a tool, not a model service.');
-        return;
-    }
-    if (!entries.every(isOnlineEntry))
-        throw invalid('An online agent has no coding tool: each entry names a model service and a model.');
-    if (agent.runnerIds.length > 0 || agent.toolPolicy !== null)
-        throw invalid('An online agent runs on the server: it takes no runners or tool policy.');
-    // An entry saved before its service changed stays until someone changes it; a new one must be offered now.
-    const added = entries.filter((entry) => !previous.some((saved) => sameEntry(saved, entry)));
-    if (added.length === 0)
-        return;
-    const catalog = await deps.models();
-    for (const entry of added)
-        if (!offers(catalog, entry.modelService, entry.model))
-            throw invalid(`The model service ${entry.modelService} does not offer the model ${entry.model}.`, { reason: 'MODEL_UNAVAILABLE' });
+/** The tools and models a runner reports signed in, normalized, each once. */
+export function reportedCombos(runner) {
+    const tools = [...new Set(runner.tools.map((tool) => tool.kind))];
+    return tools.flatMap((tool) => reportedModels(runner, tool).map((model) => ({ tool, model })));
 }
 export function createAgentService(deps) {
     const { tx, ids, clock, people } = deps;
+    let defaults = () => NO_DEFAULTS;
     const require = async (conn, id) => {
         const agent = await findAgent(conn, id);
-        if (!agent)
+        if (!agent || (await isRemoved(conn, id)))
             throw notFound('Agent');
         return agent;
     };
-    /** Raises the revision from `agent.revision` with `values`, or refuses when someone got there first. */
-    const revise = async (conn, agent, values) => {
-        if (!(await reviseAgent(conn, agent.id, agent.revision, values)))
-            throw revisionConflict((await require(conn, agent.id)).revision);
-    };
-    const removed = (unit, agent, reason, byUserId) => unit.emit({
+    const removed = (unit, agent, byUserId) => unit.emit({
         type: 'agent.removed',
         agentId: agent.id,
         name: agent.name,
-        reason,
+        reason: 'disabled',
         byUserId,
     });
+    /** The defaults as stored: the instructions, and the actions each once. */
+    const currentDefaults = () => {
+        const value = defaults();
+        return {
+            instructions: value.instructions,
+            actions: cleanList(value.actions),
+        };
+    };
+    async function createRunnerAgent(unit, tool, model, now) {
+        const id = runnerAgentId(tool, model);
+        const { instructions, actions } = currentDefaults();
+        try {
+            // A savepoint: another runner's report creating the same agent at once leaves this transaction usable.
+            await unit.conn.transaction((conn) => insertAgent(conn, {
+                id,
+                name: agentNameOf(tool, model),
+                description: null,
+                nameText: null,
+                descriptionText: null,
+                avatar: null,
+                type: 'runner',
+                source: 'runner',
+                status: 'pending',
+                tool,
+                model,
+                modelEntries: [{ tool, model, effort: initialEffort(tool) }],
+                instructions,
+                runnerIds: [],
+                actions: [...actions],
+                confirmChanges: 'larger',
+                access: 'everyone',
+                ownerUserId: 'system',
+                maxConcurrentRuns: RUNNER_AGENT_CONCURRENCY,
+                maxAttempts: AGENT_ATTEMPTS,
+                toolPolicy: null,
+                lastReportedAt: now,
+                createdAt: now,
+                updatedAt: now,
+            }));
+        }
+        catch (error) {
+            if (await agentsRepo(unit.conn).findOne({ filter: { id } }))
+                return false;
+            throw error;
+        }
+        await recordChange(unit.conn, {
+            id: ids.next(),
+            agentId: id,
+            revision: 1,
+            action: 'created',
+            actorUserId: null,
+            changes: [],
+            createdAt: now,
+        });
+        return true;
+    }
     return {
-        list: (options = {}) => listAgents(tx.read(), options.includeArchived ?? false),
+        setIgnored: (groups, ignored) => tx.run(async ({ conn, emit }) => {
+            const result = [];
+            const lockedGroups = [];
+            // Stable ordering avoids deadlocks between overlapping batches.
+            for (const group of [...groups].sort((a, b) => a.key.localeCompare(b.key))) {
+                lockedGroups.push(await lockDiscovery(conn, group.key, group.expectedRevision));
+            }
+            const agents = await listAgents(conn);
+            for (const group of lockedGroups) {
+                const members = agents.filter((agent) => agent.source === 'runner' &&
+                    agent.tool &&
+                    agent.model &&
+                    discoveryKey(agent.tool, agent.model) === group.key);
+                if (!members.some((agent) => agent.status === 'pending') ||
+                    members.some((agent) => agent.status === 'enabled'))
+                    throw invalid('Only pending discovery groups can be ignored or restored. Reload the list.', { reason: 'DISCOVERY_NOT_PENDING' });
+                await preferences(conn).updateMany({
+                    filter: { key: group.key },
+                    values: { ignored },
+                });
+                for (const member of members)
+                    emit({ type: 'agent.changed', agentId: member.id });
+                result.push({ ...group, ignored });
+            }
+            return result;
+        }),
+        list: () => listAgents(tx.read()),
         get: (id) => require(tx.read(), id),
         find: findAgent,
+        names: agentNamesOf,
+        directory: agentDirectory,
         async findWorkable(conn, id) {
             const agent = await findAgent(conn, id);
-            if (!agent || agent.archivedAt)
+            if (!agent || !isWorkable(agent) || (await isRemoved(conn, id)))
                 return null;
             return agent;
         },
-        listActive: (conn) => listAgents(conn, false),
-        async create(createdById, input) {
-            const type = input.type ?? 'runner';
-            await checkType(deps, {
-                type,
-                modelEntries: input.modelEntries ?? [],
-                runnerIds: input.runnerIds ?? [],
-                toolPolicy: input.toolPolicy ?? null,
-                skillIds: input.skillIds ?? [],
-                actions: input.actions ?? [],
-            }, []);
-            return tx.run(async ({ conn, emit }) => {
-                const now = clock.now().toISOString();
-                const id = ids.next();
-                await insertAgent(conn, {
-                    id,
-                    name: input.name,
-                    description: input.description ?? null,
-                    nameText: null,
-                    descriptionText: input.descriptionText
-                        ? { ...input.descriptionText }
-                        : null,
-                    avatar: input.avatar ?? null,
-                    type,
-                    modelEntries: [...(input.modelEntries ?? [])],
-                    instructions: input.instructions ?? null,
-                    runnerIds: cleanList(input.runnerIds ?? []),
-                    actions: cleanList(input.actions ?? []),
-                    confirmChanges: input.confirmChanges ?? 'larger',
-                    access: input.access ?? 'ownerOnly',
-                    ownerUserId: input.ownerUserId ?? createdById,
-                    maxConcurrentRuns: input.maxConcurrentRuns ?? 2,
-                    maxAttempts: input.maxAttempts ?? 3,
-                    toolPolicy: input.toolPolicy ?? null,
-                    createdAt: now,
-                    updatedAt: now,
-                });
-                await replaceUsers(conn, id, cleanList(input.userIds ?? []), () => ids.next(), now);
-                if (input.skillIds !== undefined)
-                    await attachSkills(conn, id, input.skillIds, ids, now);
-                await recordChange(conn, {
-                    id: ids.next(),
-                    agentId: id,
-                    revision: 1,
-                    action: 'created',
-                    actorUserId: createdById,
-                    changes: [],
-                    createdAt: now,
-                });
-                emit({ type: 'agent.changed', agentId: id });
-                return require(conn, id);
-            });
+        async listActive(conn) {
+            return (await listAgents(conn)).filter(isWorkable);
         },
         async update(id, byUserId, patch) {
             const current = await require(tx.read(), id);
-            await checkType(deps, {
-                type: current.type,
-                modelEntries: patch.modelEntries ?? current.modelEntries,
-                runnerIds: patch.runnerIds ?? current.runnerIds,
-                toolPolicy: patch.toolPolicy === undefined
-                    ? current.toolPolicy
-                    : patch.toolPolicy,
-                skillIds: patch.skillIds ?? current.skillIds,
-                actions: patch.actions ?? current.actions,
-            }, current.modelEntries);
+            if (current.source !== 'runner')
+                throw invalid('This agent is kept by the application: change it in the application’s settings.', { reason: 'AGENT_MANAGED' });
+            const effort = patch.effort === undefined ? undefined : patch.effort;
+            const entry = current.modelEntries[0];
+            if (effort && entry && !effortsFor(entry).includes(effort))
+                throw invalid(`${entry.tool} takes no reasoning effort ${effort}: use one of ${effortsFor(entry).join(', ')}.`, { reason: 'EFFORT_UNSUPPORTED' });
+            const description = patch.description === undefined
+                ? current.description
+                : patch.description?.trim()
+                    ? patch.description.trim()
+                    : null;
+            const status = patch.enabled === undefined
+                ? current.status
+                : patch.enabled
+                    ? 'enabled'
+                    : current.status === 'pending'
+                        ? 'pending'
+                        : 'disabled';
+            if (status === 'enabled' && !description)
+                throw invalid('Write what the agent is good at before enabling it: the project manager hands it work by this.', { reason: 'GOOD_AT_REQUIRED' });
             try {
-                return await tx.run(async ({ conn, emit }) => {
+                return await tx.run(async (unit) => {
+                    const { conn, emit } = unit;
                     const before = await require(conn, id);
+                    if (before.tool && before.model) {
+                        const group = await lockDiscovery(conn, discoveryKey(before.tool, before.model));
+                        if (patch.enabled && group.ignored)
+                            throw invalid('Restore this discovery group before enabling it.', { reason: 'DISCOVERY_IGNORED' });
+                    }
                     if (patch.expectedRevision !== before.revision)
                         throw revisionConflict(before.revision);
                     const now = clock.now().toISOString();
-                    await revise(conn, before, {
-                        ...columns(patch),
-                        // Editing a field drops its translation: what someone wrote shows as written.
-                        ...(patch.name !== undefined && patch.name !== before.name
-                            ? { nameText: null }
-                            : {}),
-                        ...(patch.description !== undefined &&
-                            (patch.description ?? null) !== before.description
-                            ? { descriptionText: null }
-                            : {}),
+                    const modelEntries = effort === undefined
+                        ? [...before.modelEntries]
+                        : before.modelEntries.map((item, index) => index === 0 ? { ...item, effort } : item);
+                    if (!(await reviseAgent(conn, id, before.revision, {
+                        description,
+                        descriptionText: description === before.description && before.descriptionText
+                            ? {
+                                key: before.descriptionText.key,
+                                ns: before.descriptionText.ns,
+                            }
+                            : null,
+                        status,
+                        modelEntries: modelEntries.slice(0, MAX_MODEL_ENTRIES),
                         updatedAt: now,
-                    });
-                    if (patch.userIds !== undefined)
-                        await replaceUsers(conn, id, cleanList(patch.userIds), () => ids.next(), now);
-                    if (patch.skillIds !== undefined)
-                        await attachSkills(conn, id, patch.skillIds, ids, now);
+                    })))
+                        throw revisionConflict((await require(conn, id)).revision);
                     const after = await require(conn, id);
                     const changes = diffAgents(before, after);
                     if (changes.length === 0)
@@ -323,11 +247,19 @@ export function createAgentService(deps) {
                         id: ids.next(),
                         agentId: id,
                         revision: after.revision,
-                        action: 'updated',
+                        action: before.status !== after.status
+                            ? after.status === 'enabled'
+                                ? 'enabled'
+                                : 'disabled'
+                            : 'updated',
                         actorUserId: byUserId,
                         changes,
                         createdAt: now,
                     });
+                    if (before.status === 'enabled' && after.status !== 'enabled') {
+                        await deps.owned?.withdrawQueued(unit, id, byUserId);
+                        removed(unit, after, byUserId);
+                    }
                     emit({ type: 'agent.changed', agentId: id });
                     return after;
                 });
@@ -338,59 +270,161 @@ export function createAgentService(deps) {
                 throw error;
             }
         },
-        archive: (id, byUserId) => tx.run(async (unit) => {
-            const agent = await require(unit.conn, id);
-            if (agent.archivedAt)
-                return agent;
+        ensureSystem: (input, byUserId = null) => tx.run(async ({ conn, emit }) => {
             const now = clock.now().toISOString();
-            await revise(unit.conn, agent, { archivedAt: now, updatedAt: now });
-            await recordChange(unit.conn, {
-                id: ids.next(),
-                agentId: id,
-                revision: agent.revision + 1,
-                action: 'archived',
-                actorUserId: byUserId,
-                changes: [],
-                createdAt: now,
+            const values = {
+                name: input.name,
+                nameText: input.nameText ? { ...input.nameText } : null,
+                description: input.description,
+                instructions: input.instructions,
+                actions: cleanList(input.actions),
+                modelEntries: input.modelEntries
+                    .slice(0, MAX_MODEL_ENTRIES)
+                    .map((entry) => ({ ...entry })),
+            };
+            const before = await findAgent(conn, input.id);
+            if (!before) {
+                await insertAgent(conn, {
+                    id: input.id,
+                    ...values,
+                    descriptionText: null,
+                    avatar: null,
+                    type: 'runner',
+                    source: 'system',
+                    status: 'enabled',
+                    tool: null,
+                    model: null,
+                    runnerIds: [],
+                    confirmChanges: 'larger',
+                    access: 'everyone',
+                    ownerUserId: 'system',
+                    maxConcurrentRuns: RUNNER_AGENT_CONCURRENCY,
+                    maxAttempts: AGENT_ATTEMPTS,
+                    toolPolicy: null,
+                    lastReportedAt: null,
+                    createdAt: now,
+                    updatedAt: now,
+                });
+                await recordChange(conn, {
+                    id: ids.next(),
+                    agentId: input.id,
+                    revision: 1,
+                    action: 'created',
+                    actorUserId: byUserId,
+                    changes: [],
+                    createdAt: now,
+                });
+                emit({ type: 'agent.changed', agentId: input.id });
+                return (await findAgent(conn, input.id));
+            }
+            const unchanged = !(await isRemoved(conn, input.id)) &&
+                before.source === 'system' &&
+                before.status === 'enabled' &&
+                before.name === values.name &&
+                JSON.stringify(before.nameText) === JSON.stringify(values.nameText) &&
+                before.description === values.description &&
+                before.instructions === values.instructions &&
+                JSON.stringify(before.actions) === JSON.stringify(values.actions) &&
+                JSON.stringify(before.modelEntries) ===
+                    JSON.stringify(values.modelEntries.map((entry) => ({
+                        tool: entry.tool,
+                        model: entry.model ?? null,
+                        effort: entry.effort ?? null,
+                    })));
+            if (unchanged)
+                return before;
+            await reviseAgent(conn, input.id, before.revision, {
+                ...values,
+                source: 'system',
+                status: 'enabled',
+                archivedAt: null,
+                deletedAt: null,
+                updatedAt: now,
             });
-            await deps.owned?.withdrawQueued(unit, id, byUserId);
-            unit.emit({ type: 'agent.changed', agentId: id });
-            removed(unit, agent, 'archived', byUserId);
-            return require(unit.conn, id);
-        }),
-        restore: (id, byUserId) => tx.run(async ({ conn, emit }) => {
-            const agent = await require(conn, id);
-            if (!agent.archivedAt)
-                return agent;
-            const now = clock.now().toISOString();
-            await revise(conn, agent, { archivedAt: null, updatedAt: now });
+            const after = (await findAgent(conn, input.id));
             await recordChange(conn, {
                 id: ids.next(),
-                agentId: id,
-                revision: agent.revision + 1,
-                action: 'restored',
+                agentId: input.id,
+                revision: after.revision,
+                action: 'updated',
                 actorUserId: byUserId,
-                changes: [],
+                changes: diffAgents(before, after),
                 createdAt: now,
             });
-            emit({ type: 'agent.changed', agentId: id });
-            return require(conn, id);
+            emit({ type: 'agent.changed', agentId: input.id });
+            return after;
         }),
-        remove: (id, byUserId) => tx.run(async (unit) => {
-            const { conn } = unit;
-            const agent = await require(conn, id);
-            if (!agent.archivedAt)
-                throw precondition('AGENT_NOT_ARCHIVED', 'Archive the agent before deleting it.');
-            if (deps.owned && (await deps.owned.openRuns(conn, id)) > 0)
-                throw precondition('AGENT_HAS_ACTIVE_RUNS', 'The agent still has runs that have not ended.');
-            await attachmentsRepo(conn).deleteMany({
-                filter: { scope: 'agent', scopeId: id },
+        async syncRunner(unit, runner) {
+            const combos = reportedCombos(runner);
+            if (combos.length === 0)
+                return;
+            const now = clock.now();
+            const nowText = now.toISOString();
+            const known = new Map((await agentsRepo(unit.conn).findMany({
+                filter: (f) => f.or(combos.map((combo) => f.string('id').eq(runnerAgentId(combo.tool, combo.model)))),
+            })).map((record) => [record.id, record]));
+            const created = [];
+            const stale = [];
+            for (const combo of combos) {
+                const id = runnerAgentId(combo.tool, combo.model);
+                const record = known.get(id);
+                if (!record) {
+                    if (await createRunnerAgent(unit, combo.tool, combo.model, nowText))
+                        created.push(id);
+                    continue;
+                }
+                const generated = agentNameOf(combo.tool, combo.model);
+                if (record.status === 'pending' &&
+                    record.name ===
+                        `${{ claude: 'Claude', codex: 'Codex', pi: 'Pi', opencode: 'OpenCode' }[combo.tool]} · ${combo.model.split('/').at(-1)}` &&
+                    record.name !== generated)
+                    await updateAgent(unit.conn, id, { name: generated });
+                if (!record.lastReportedAt ||
+                    now.getTime() - Date.parse(record.lastReportedAt) >= REPORT_REFRESH_MS)
+                    stale.push(id);
+            }
+            if (stale.length > 0)
+                await agentsRepo(unit.conn).updateMany({
+                    filter: (f) => f.or(stale.map((id) => f.string('id').eq(id))),
+                    values: { lastReportedAt: nowText },
+                });
+            for (const id of created)
+                unit.emit({ type: 'agent.changed', agentId: id });
+        },
+        setDefaults(provider) {
+            defaults = provider;
+            return () => {
+                if (defaults === provider)
+                    defaults = () => NO_DEFAULTS;
+            };
+        },
+        async applyDefaults(options = {}) {
+            const { instructions, actions } = currentDefaults();
+            return tx.run(async ({ conn, emit }) => {
+                const records = await agentsRepo(conn).findMany({
+                    filter: (f) => f.and([
+                        f.string('source').eq('runner'),
+                        f.date('deletedAt').empty(),
+                    ]),
+                });
+                let changed = 0;
+                for (const record of records) {
+                    const agent = (await findAgent(conn, record.id));
+                    if ((options.preserveInstructions ||
+                        agent.instructions === instructions) &&
+                        JSON.stringify(agent.actions) === JSON.stringify(actions))
+                        continue;
+                    await updateAgent(conn, record.id, {
+                        ...(options.preserveInstructions ? {} : { instructions }),
+                        actions: [...actions],
+                        updatedAt: clock.now().toISOString(),
+                    });
+                    emit({ type: 'agent.changed', agentId: record.id });
+                    changed += 1;
+                }
+                return changed;
             });
-            await deps.owned?.clearVariables(conn, id);
-            await deleteAgent(conn, id);
-            unit.emit({ type: 'agent.changed', agentId: id });
-            removed(unit, agent, 'deleted', byUserId);
-        }),
+        },
         async history(id, options = {}) {
             const conn = tx.read();
             await require(conn, id);
@@ -416,15 +450,7 @@ export function createAgentService(deps) {
                 createdAt: clock.now().toISOString(),
             });
         },
-        mayInvoke(agent, userId) {
-            if (agent.archivedAt)
-                return false;
-            if (agent.ownerUserId === userId)
-                return true;
-            if (agent.access === 'everyone')
-                return true;
-            return agent.access === 'users' && agent.userIds.includes(userId);
-        },
+        mayInvoke: (agent) => isWorkable(agent),
     };
 }
 //# sourceMappingURL=agent.service.js.map