c8ctl-plugin-nano 1.17.0 → 1.18.1

package/README.md

@@ -150,6 +150,9 @@ c8ctl nano hire
 c8ctl nano hire --name reviewer --rank senior --command copilot \
   --model gpt-5 --capabilities code-review,testing
 
+# Give the harness command-line switches (e.g. run copilot with --allow-all)
+c8ctl nano hire --name coder --rank senior --command copilot --arg --allow-all
+
 # List profiles
 c8ctl nano hire --list
 ```
@@ -204,6 +207,16 @@ the job with a decremented retry count, and a job that outlives `--job-timeout`
 is killed. Profiles are stored in the plugin's `config.json` (see `c8ctl nano
 config`).
 
+> **Activation lock vs. kill deadline.** `--job-timeout` is the harness *kill*
+> deadline. The broker's job-activation lock is derived as `--job-timeout +
+> --lock-grace` (grace defaults to `120000`ms) so it strictly outlasts the kill:
+> the worker always reports the outcome (complete/fail) before the lock lapses.
+> Without that gap a lock expiring exactly as the harness dies lets the broker
+> re-activate the still-retryable job (a second agent starts) and the stale
+> `fail` is rejected with a 409 "job cannot be failed in the current state".
+> Raising `--job-timeout` alone does **not** fix this — it moves both coupled
+> deadlines together; widen `--lock-grace` (or keep the default) instead.
+
 > **Trust boundary.** The profile `command` is run through a shell so you can
 > write a full invocation (args, pipes, multi-word commands). It is
 > **operator-authored** — only what you put in your own `config.json` is
@@ -327,6 +340,24 @@ envelope layers on top (job-specific tuning wins), and the reserved `AGENT_*`
 variables and resolved secrets always win over user-supplied env so they can't be
 shadowed. For **secret** values use `secretRefs`, not `--env`.
 
+**Command-line switches.** Some harnesses take switches rather than env vars —
+e.g. `copilot --allow-all`. Append them to the harness command with a repeatable
+`--arg` (each `--arg` is one argv token). They are persisted on the profile at
+hire time and can be extended at work time:
+
+```bash
+c8ctl nano hire --name coder --rank senior --command copilot --arg --allow-all
+c8ctl nano work coder --arg --verbose            # appends to the profile args
+```
+
+The command is spawned through a shell (so `command` still resolves on `PATH`),
+but each `--arg` is shell-quoted as a single literal token, so a value with
+spaces or shell metacharacters can't break out or inject. They apply on the
+container path on any OS, and on the host path on POSIX systems. **On a Windows
+host (`sandbox=none`), `--arg` is rejected** with a clear error — the POSIX
+quoting isn't honoured by `cmd.exe` — so use a container sandbox
+(`--sandbox docker|podman`) or bake the switches into `--command` there.
+
 **Disk hygiene.** Host job **workspaces** and container sandboxes both get
 automatic cleanup so leaked artifacts can't fill the disk. Workspaces under
 `<state>/agent-runs` are removed after each job and swept at startup + on

package/c8ctl-plugin.js

@@ -1416,6 +1416,39 @@ function parseEnvPairs(input) {
   return { env, errors };
 }
 
+// Normalize a stored/CLI argument list (string | string[]) into a clean string[]:
+// each entry is one whole argv token (e.g. "--allow-all"), coerced to a string,
+// with null/undefined and empty tokens dropped. Interior whitespace is preserved
+// so a single arg may carry a value like "--foo=a b" intact.
+function normalizeArgList(input) {
+  const list = input == null ? [] : (Array.isArray(input) ? input : [input]);
+  const out = [];
+  for (const item of list) {
+    if (item == null) continue;
+    const s = String(item);
+    if (s.length === 0) continue;
+    out.push(s);
+  }
+  return out;
+}
+
+// POSIX single-quote a string so it survives `sh -c`/shell:true as one literal
+// argv token, no matter what it contains (spaces, $, quotes, globs). Empty
+// string → ''. This is what keeps structured `--arg` values injection-safe even
+// though the harness is spawned through a shell (for PATH resolution).
+function shQuote(s) {
+  return `'${String(s).replace(/'/g, `'\\''`)}'`;
+}
+
+// Build the shell command line for the agent harness: the base command followed
+// by each structured argument, shell-quoted. With no args the command is used
+// verbatim (preserving pre-existing hires that baked switches into the command).
+function buildAgentCommandLine(command, args) {
+  const list = normalizeArgList(args);
+  if (list.length === 0) return command;
+  return `${command} ${list.map(shQuote).join(' ')}`;
+}
+
 // A worker job-type token: rank/capability tokens use `:` (rank↔cap) and `+`
 // (combined caps) as delimiters, and code-first `@nanobpm/workflow` job types
 // are `<flowId>:<taskName>` or an explicit override. The first character must be
@@ -1445,6 +1478,46 @@ function parseJobTypeFlags(input) {
   return { jobTypes, errors };
 }
 
+/**
+ * The broker job-activation lock must strictly outlast the harness kill
+ * deadline: the worker has to report the outcome (complete/fail) before the lock
+ * lapses, or the broker re-activates the still-retryable job (a second agent
+ * starts) and the stale `fail` is rejected 409 "job cannot be failed in the
+ * current state". So lock = kill + grace. Non-finite or non-positive inputs
+ * fall back to fixed defaults (5m kill / 2m grace). All inputs are coerced to
+ * safe positive integers (positive fractional values floor to at least 1) and
+ * grace is capped so a positive kill always fits and `kill + grace` stays within
+ * the safe-integer range, so the invariant lock > kill holds strictly for every
+ * accepted input — including values at or beyond 2^53 where float addition
+ * would otherwise round `kill + grace` back down to `kill`.
+ *
+ * Returns BOTH derived deadlines from this single computation so the caller
+ * never re-derives (and drifts): `killMs` is the *clamped* harness kill deadline
+ * the caller must actually enforce, and `lockMs` is the broker activation lock.
+ * The caller must use `killMs` — not the raw input — for the harness timeout, or
+ * the lock > kill invariant breaks for large inputs (the raw input can exceed
+ * the clamped `killMs`, and thus reach or exceed `lockMs`).
+ *
+ * @returns {{ killMs: number, lockMs: number }}
+ */
+function deriveJobLockMs(jobTimeoutMs, lockGraceMs) {
+  const MAX = Number.MAX_SAFE_INTEGER;
+  const toSafeMs = (value, fallback) => {
+    // Floor positive fractional values to at least 1 so a sub-millisecond input
+    // (e.g. 0.5) never collapses to a non-positive value.
+    const n = Number.isFinite(value) && value > 0 ? Math.max(1, Math.floor(value)) : fallback;
+    return Math.min(n, MAX);
+  };
+  // Cap grace to MAX - 1 so there is always room for a positive kill while
+  // keeping kill + grace within the safe-integer range.
+  const grace = Math.min(toSafeMs(lockGraceMs, 2 * 60_000), MAX - 1);
+  // Cap kill so kill + grace stays a safe integer and floor it at 1 so the
+  // internal kill is always positive; the sum is then exact and strictly
+  // greater than kill (never equal to it via float rounding).
+  const killMs = Math.max(1, Math.min(toSafeMs(jobTimeoutMs, 5 * 60_000), MAX - grace));
+  return { killMs, lockMs: killMs + grace };
+}
+
 /** A profile name must be a safe, filesystem/token-friendly slug. */
 function isValidProfileName(name) {
   return typeof name === 'string' && /^[a-z0-9][a-z0-9._-]*$/i.test(name);
@@ -1513,6 +1586,7 @@ function normalizeStoredProfile(name, profile) {
       name,
       rank,
       command,
+      args: normalizeArgList(profile.args),
       model: typeof profile.model === 'string' ? profile.model.trim() : '',
       capabilities: normalizeCapabilities(profile.capabilities),
       sandbox,
@@ -1541,7 +1615,7 @@ async function hireWorker(req, flags) {
     logger.info('Hired agent profiles:');
     for (const name of names.sort()) {
       const p = hires[name];
-      logger.info(`  ${name}  [${p.rank}]  ${p.command}  (model: ${p.model || '-'}; caps: ${normalizeCapabilities(p.capabilities).join(', ') || '-'})`);
+      logger.info(`  ${name}  [${p.rank}]  ${buildAgentCommandLine(p.command, p.args)}  (model: ${p.model || '-'}; caps: ${normalizeCapabilities(p.capabilities).join(', ') || '-'})`);
     }
     logger.info('');
     logger.info('Put one to work with: c8ctl nano work <name>');
@@ -1557,11 +1631,14 @@ async function hireWorker(req, flags) {
   let capabilities = flags?.capabilities !== undefined ? flags.capabilities : undefined;
   let sandbox = flags?.sandbox !== undefined ? String(flags.sandbox).trim().toLowerCase() : undefined;
   let image = flags?.image !== undefined ? String(flags.image).trim() : undefined;
+  // Structured command-line switches appended to the command when spawned, e.g.
+  // `--arg --allow-all` for `copilot`. Repeatable; each --arg is one argv token.
+  const commandArgs = normalizeArgList(flags?.arg);
   const envFromFlags = flags?.env !== undefined;
   const { env: profileEnv, errors: envErrors } = parseEnvPairs(flags?.env);
   if (envErrors.length > 0) {
     logger.error(envErrors.join('; '));
-    logger.info('Example: c8ctl nano hire --name coder --rank senior --command copilot --env COPILOT_ENABLE_ALL_TOOLS=1 --env FOO=bar');
+    logger.info('Example: c8ctl nano hire --name coder --rank senior --command copilot --arg --allow-all --env COPILOT_ENABLE_ALL_TOOLS=1');
     process.exit(1);
   }
 
@@ -1659,6 +1736,7 @@ async function hireWorker(req, flags) {
     name,
     rank,
     command,
+    args: commandArgs,
     model: model || '',
     capabilities: normalizeCapabilities(capabilities),
     sandbox,
@@ -1669,9 +1747,10 @@ async function hireWorker(req, flags) {
   writeHire(profile);
 
   const matrix = jobTypeMatrix(profile.rank, profile.capabilities);
-  logger.info(`${existed ? 'Updated' : 'Hired'} "${name}" [${profile.rank}] → ${profile.command}`);
+  logger.info(`${existed ? 'Updated' : 'Hired'} "${name}" [${profile.rank}] → ${buildAgentCommandLine(profile.command, profile.args)}`);
   logger.info(`  model: ${profile.model || '(none)'}`);
   logger.info(`  capabilities: ${profile.capabilities.join(', ') || '(none)'}`);
+  if (profile.args.length > 0) logger.info(`  args: ${profile.args.map(shQuote).join(' ')}`);
   logger.info(`  sandbox: ${profile.sandbox}${CONTAINER_SANDBOXES.has(profile.sandbox) ? ` (image ${profile.image})` : ''}`);
   const envKeys = Object.keys(profile.env);
   if (envKeys.length > 0) logger.info(`  env: ${envKeys.join(', ')}`);
@@ -2450,9 +2529,13 @@ function baseAgentEnv(profile, job) {
  * Both paths resolve to the same result contract.
  */
 function runAgentJob(profile, job, opts = {}) {
-  const { timeoutMs, envelope, sandbox = 'none', image, runId, secretEnv = {}, passThroughSecretNames = [], cwd, extraEnv = {}, profileEnv = {}, resultFile, stream = false, streamPrefix = '', onStreamOut, onStreamErr } = opts;
+  const { timeoutMs, envelope, sandbox = 'none', image, runId, secretEnv = {}, passThroughSecretNames = [], cwd, extraEnv = {}, profileEnv = {}, resultFile, stream = false, streamPrefix = '', onStreamOut, onStreamErr, args: commandArgs } = opts;
   const payload = JSON.stringify(buildAgentPayload(profile, job, envelope));
   const agentEnv = baseAgentEnv(profile, job);
+  // The harness command line: the profile command plus its structured switches
+  // (persisted `--arg`s, possibly extended at work time via opts.args), each
+  // shell-quoted. Spawned through a shell so `command` still resolves on PATH.
+  const commandLine = buildAgentCommandLine(profile.command, commandArgs ?? profile.args);
   // Static, non-secret env for the harness: the worker/profile's env (e.g. a
   // harness's permission toggles) plus the per-job envelope's setup.env
   // (job-specific tuning wins over the profile default). Reserved AGENT_* and
@@ -2461,9 +2544,16 @@ function runAgentJob(profile, job, opts = {}) {
 
   if (!CONTAINER_SANDBOXES.has(sandbox)) {
     // Host: hand the agent the result file by its real path.
+    // Defense in depth: --arg tokens are POSIX single-quoted, which cmd.exe on
+    // a Windows host does not honour, so args would be mis-parsed under the
+    // shell:true spawn. workAgent already rejects this at startup, but guard the
+    // spawn site too so the invariant holds for any direct caller of runAgentJob.
+    if (commandLine !== profile.command && process.platform === 'win32') {
+      return Promise.resolve({ ok: false, exitCode: null, stdout: '', stderr: '', error: 'command-line args (--arg) are not supported for host execution on Windows; use a container sandbox or bake switches into the command', truncated: false, stderrTruncated: false });
+    }
     const resultEnv = resultFile ? { [AGENT_RESULT_FILE_ENV]: resultFile } : {};
     return spawnCaptureOneShot({
-      command: profile.command,
+      command: commandLine,
       shell: true,
       // Own process group so the timeout handler can kill the whole tree.
       detached: process.platform !== 'win32',
@@ -2516,7 +2606,7 @@ function runAgentJob(profile, job, opts = {}) {
     ...mountArgs,
     ...envArgs,
     image,
-    'sh', '-c', profile.command,
+    'sh', '-c', commandLine,
   ];
 
   return spawnCaptureOneShot({
@@ -2618,12 +2708,28 @@ async function workAgent(req, flags) {
   }
   const profileEnv = { ...profile.env, ...workEnv };
 
+  // Structured command-line switches: the profile's persisted `--arg`s, extended
+  // by any work-time `--arg` (appended). Lets an operator add switches (e.g.
+  // `--allow-all`) at dispatch time without re-hiring.
+  const effectiveArgs = [...profile.args, ...normalizeArgList(flags?.arg)];
+
   const intFlag = (v, dflt) => {
     const n = Number.parseInt(String(v ?? ''), 10);
     return Number.isFinite(n) && n > 0 ? n : dflt;
   };
   const maxParallelJobs = intFlag(flags?.['max-parallel'], 1);
   const jobTimeoutMs = intFlag(flags?.['job-timeout'], 5 * 60_000);
+  // The broker's job-activation lock MUST outlast the harness kill deadline: the
+  // worker has to report the outcome (complete/fail) before the lock lapses,
+  // otherwise the broker re-activates the still-retryable job (a second agent
+  // starts) and the stale `fail` is rejected with a 409 "job cannot be failed in
+  // the current state". So lock = harness kill + grace. Raising --job-timeout
+  // alone does not help — it moves both coupled deadlines together.
+  const lockGraceMs = intFlag(flags?.['lock-grace'], 2 * 60_000);
+  // deriveJobLockMs is the single source of truth for both deadlines: the harness
+  // MUST enforce the clamped `jobKillMs` (not the raw --job-timeout), or a very
+  // large --job-timeout would outlive the broker lock and re-break the invariant.
+  const { killMs: jobKillMs, lockMs: jobLockMs } = deriveJobLockMs(jobTimeoutMs, lockGraceMs);
 
   // Sandbox: flag overrides the stored profile default. `none` runs on the host
   // (legacy); `docker`/`podman` run each job in a throwaway labelled container.
@@ -2638,6 +2744,17 @@ async function workAgent(req, flags) {
     logger.error(`--sandbox ${sandbox} requires an --image (or hire the profile with --image).`);
     process.exit(1);
   }
+  // Structured --arg tokens are POSIX single-quoted (shQuote) for the harness
+  // shell. On the host path that shell is the platform default — cmd.exe on
+  // Windows, which does not honour single quotes — so the quoting would leak
+  // literal quote characters and mis-parse the switches. The container path
+  // always targets the image's `sh`, so it stays correct regardless of host OS.
+  // Fail fast with actionable guidance rather than silently corrupting argv.
+  if (!isContainer && effectiveArgs.length > 0 && process.platform === 'win32') {
+    logger.error('--arg is not supported for host execution on Windows (cmd.exe does not honour POSIX quoting).');
+    logger.error('Use a container sandbox (--sandbox docker|podman --image <ref>) or bake the switches into --command.');
+    process.exit(1);
+  }
 
   const secretResolver = makeSecretResolver(flags?.['secret-resolver']);
   if (!secretResolver) {
@@ -2713,14 +2830,14 @@ async function workAgent(req, flags) {
   const jobTypes = [...new Set([...matrix, ...extraJobTypes])];
   const camunda = globalThis.c8ctl.createClient();
 
-  logger.info(`Putting "${name}" [${profile.rank}] to work → ${profile.command}`);
+  logger.info(`Putting "${name}" [${profile.rank}] to work → ${buildAgentCommandLine(profile.command, effectiveArgs)}`);
   logger.info(`  model: ${profile.model || '(none)'}; capabilities: ${profile.capabilities.join(', ') || '(none)'}`);
   logger.info(`  sandbox: ${sandbox}${isContainer ? ` (image ${image})` : ''}`);
   const profileEnvKeys = Object.keys(profileEnv);
   if (profileEnvKeys.length > 0) logger.info(`  harness env: ${profileEnvKeys.join(', ')}`);
   const extraNote = extraJobTypes.length > 0 ? ` (${extraJobTypes.length} via --job-type)` : '';
   logger.info(`  listening on ${jobTypes.length} job type(s)${extraNote}: ${jobTypes.join('  ')}`);
-  logger.info(`  max parallel: ${maxParallelJobs}; job timeout: ${jobTimeoutMs}ms`);
+  logger.info(`  max parallel: ${maxParallelJobs}; job timeout: ${jobKillMs}ms; activation lock: ${jobLockMs}ms`);
   logger.info('Polling for work — press Ctrl-C to stop.');
 
   const workers = jobTypes.map((jobType) =>
@@ -2728,9 +2845,9 @@ async function workAgent(req, flags) {
       jobType,
       workerName: `${name}:${jobType}`,
       maxParallelJobs,
-      jobTimeoutMs,
+      jobTimeoutMs: jobLockMs,
       jobHandler: async (job) => {
-        logger.info(`[${jobType}] job ${job.jobKey} (instance ${job.processInstanceKey ?? '-'}) → ${profile.command}`);
+        logger.info(`[${jobType}] job ${job.jobKey} (instance ${job.processInstanceKey ?? '-'}) → ${buildAgentCommandLine(profile.command, effectiveArgs)}`);
 
         // Disk-budget admission shed: if the engine data root is below the free
         // floor, don't start a container — fail (retryable) so work sheds until
@@ -2811,7 +2928,7 @@ async function workAgent(req, flags) {
           } catch { resultDir = null; resultFile = null; }
 
           result = await runAgentJob(profile, job, {
-            timeoutMs: jobTimeoutMs,
+            timeoutMs: jobKillMs,
             envelope,
             sandbox,
             image,
@@ -2824,6 +2941,7 @@ async function workAgent(req, flags) {
             resultFile,
             stream,
             streamPrefix: `[${jobType} ${job.jobKey}] `,
+            args: effectiveArgs,
             // Route the --stream tee through c8ctl's output-mode-aware logger so
             // spying never corrupts a structured/JSON output mode.
             onStreamOut: stream ? (line) => logger.info(line) : undefined,
@@ -4273,6 +4391,9 @@ export {
   sanitizeResultVars,
   parseEnvPairs,
   normalizeEnvMap,
+  normalizeArgList,
+  shQuote,
+  buildAgentCommandLine,
   reapAgentContainers,
   diskBudgetOk,
   containerEngineAvailable,
@@ -4288,6 +4409,7 @@ export {
   normalizeStoredProfile,
   jobTypeMatrix,
   parseJobTypeFlags,
+  deriveJobLockMs,
   AGENT_TASK_NS,
   AGENT_RESULT_KEY,
   RESULT_SENTINEL,
@@ -4327,6 +4449,7 @@ export const metadata = {
         { command: 'c8ctl nano update --check', description: 'Check whether a newer nano release is available' },
         { command: 'c8ctl nano hire', description: 'Interactively create a CLI agent worker profile (name, rank, command, model, capabilities)' },
         { command: 'c8ctl nano hire --name reviewer --rank senior --command copilot --model gpt-5 --capabilities code-review,testing', description: 'Create a profile non-interactively' },
+        { command: 'c8ctl nano hire --name coder --rank senior --command copilot --arg --allow-all', description: 'Hire copilot with a command-line switch (copilot --allow-all)' },
         { command: 'c8ctl nano hire --name coder --rank senior --command copilot --env COPILOT_ENABLE_ALL_TOOLS=1', description: 'Persist a harness startup env var (e.g. permissions) on the profile' },
         { command: 'c8ctl nano hire --list', description: 'List hired agent profiles' },
         { command: 'c8ctl nano hire --name coder --rank senior --command "agent-harness" --sandbox docker --image ghcr.io/acme/agent:1', description: 'Create a profile that runs each job in a throwaway Docker container' },
@@ -4375,6 +4498,7 @@ export const commands = {
       name: { type: 'string', description: 'hire/work: agent profile name (alt to positional arg)' },
       rank: { type: 'string', description: 'hire: agent rank (principal|senior|junior|decider)' },
       command: { type: 'string', description: 'hire: CLI command that runs the agent harness (e.g. copilot, claude, pi)' },
+      arg: { type: 'string', multiple: true, description: 'hire/work: command-line switch/arg appended to the harness command (repeatable), e.g. --arg --allow-all. Persisted on hire; work appends more.' },
       model: { type: 'string', description: 'hire: model name passed to the harness (AGENT_MODEL)' },
       capabilities: { type: 'string', description: 'hire: comma-separated capability list' },
       sandbox: { type: 'string', description: 'hire/work: execution sandbox none|docker|podman (default none). Containers isolate each job.' },
@@ -4390,6 +4514,7 @@ export const commands = {
       list: { type: 'boolean', description: 'hire: list existing agent profiles instead of creating one' },
       'max-parallel': { type: 'string', description: 'work: max concurrent jobs per worker (default 1)' },
       'job-timeout': { type: 'string', description: 'work: max harness runtime per job in ms; the spawned process is killed past this (default 300000)' },
+      'lock-grace': { type: 'string', description: 'work: extra ms added to --job-timeout to derive the broker activation lock, so the worker reports before the lock lapses (default 120000)' },
       'job-type': { type: 'string', multiple: true, description: 'work: extra job type to service alongside the rank×capability matrix (repeatable)' },
     },
     handler: async (args, flags) => {
@@ -4533,8 +4658,8 @@ function printUsage() {
   console.log('  c8ctl nano set <bin|model-dir> <path>');
   console.log('  c8ctl nano config');
   console.log('  c8ctl nano update [--check]');
-  console.log('  c8ctl nano hire [--name <n>] [--rank <r>] [--command <c>] [--model <m>] [--capabilities <a,b>] [--sandbox none|docker|podman] [--image <ref>] [--env NAME=VALUE ...] [--list]');
-  console.log('  c8ctl nano work <profileName> [--max-parallel <n>] [--job-timeout <ms>] [--job-type <token> ...] [--sandbox none|docker|podman] [--image <ref>] [--env NAME=VALUE ...] [--secret-resolver host] [--min-free-mb <n>] [--clone-timeout <ms>] [--keep-runs] [--stream]');
+  console.log('  c8ctl nano hire [--name <n>] [--rank <r>] [--command <c>] [--arg <switch> ...] [--model <m>] [--capabilities <a,b>] [--sandbox none|docker|podman] [--image <ref>] [--env NAME=VALUE ...] [--list]');
+  console.log('  c8ctl nano work <profileName> [--arg <switch> ...] [--max-parallel <n>] [--job-timeout <ms>] [--lock-grace <ms>] [--job-type <token> ...] [--sandbox none|docker|podman] [--image <ref>] [--env NAME=VALUE ...] [--secret-resolver host] [--min-free-mb <n>] [--clone-timeout <ms>] [--keep-runs] [--stream]');
   console.log('');
   console.log('Subcommands:');
   console.log('  start    Spawn an N-node local cluster wired to talk to each other on localhost');
@@ -4577,6 +4702,7 @@ function printUsage() {
   console.log('  --max-parallel <n>   work: max concurrent jobs per worker (default 1)');
   console.log('  --job-type <token>   work: extra job type to service alongside the rank×capability matrix (repeatable)');
   console.log('  --job-timeout <ms>   work: max harness runtime per job in ms (default 300000)');
+  console.log('  --lock-grace <ms>    work: extra ms over --job-timeout for the broker activation lock (default 120000)');
   console.log('  --secret-resolver <r> work: secret resolver for task secretRefs (host; default host)');
   console.log('  --reap-age <ms>      work: age before a finished agent container/workspace is reaped (default 3600000)');
   console.log('  --reap-interval <ms> work: how often to sweep finished agent containers/workspaces (default 300000)');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.17.0",
+  "version": "1.18.1",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -49,12 +49,12 @@
     "semantic-release": "^25.0.3"
   },
   "optionalDependencies": {
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.17.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.17.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.17.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.17.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.17.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.17.0",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.17.0"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.18.1",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.18.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.18.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.18.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.18.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.18.1",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.18.1"
   }
 }