c8ctl-plugin-nano 1.26.0 → 1.26.2

package/README.md

@@ -346,13 +346,21 @@ the harness:
    as the checkout target) into a throwaway workspace under
    `<state>/agent-runs/run-*`;
 3. create `branch.create` (if set) off that target;
-4. run the harness **in the workspace** (`cwd`), with `AGENT_WORKSPACE`,
+4. set a **committer identity** on the workspace, preferring the operator's own
+   (`GIT_AUTHOR_*` env → global `git config user.name/email` → the
+   `gh`-authenticated GitHub user), and only falling back to `nano-agent` when
+   none resolve — so autonomous commits are authored by the human running the
+   fleet (who has signed any CLA/DCO), not an anonymous bot;
+5. run the harness **in the workspace** (`cwd`), with `AGENT_WORKSPACE`,
    `AGENT_REPO_URL`, `AGENT_REPO_BRANCH`, `AGENT_REPO_REF` exported and the job
    envelope on stdin;
-5. on success, enumerate new commits, `git push` the branch when `branch.push`
+6. on success, enumerate new commits, `git push` the branch when `branch.push`
    (default true), and — when `task.allowPr` — **reconcile the PR the agent
    opened** for the branch (`gh pr list --head <branch>`; `openedBy` reports the
-   PR's actual author login, or `null` when none is found).
+   PR's actual author login, or `null` when none is found), then post a one-time
+   attribution comment recording that the change was agent-generated (marker-
+   guarded so convergence rounds don't repeat it; disable with
+   `NANO_AGENT_ATTRIBUTION=0`, rename the agent with `NANO_AGENT_NAME`).
 
 The token is delivered to git via `GIT_ASKPASS` (env), never on argv or in the
 remote URL, and is redacted from all logs/results. Credential helpers are

package/c8ctl-plugin.js

@@ -2295,14 +2295,9 @@ function makeSecretResolver(kind) {
 // Resolve the names a job needs (setup.secretRefs, plus the repo/PR credential
 // when allowPr). Returns resolved values + a list of names that were missing so
 // the caller can fail the job with a clear provisioning error.
-function resolveJobSecrets(resolver, envelope) {
+function resolveJobSecrets(resolver, envelope, { ghAuthToken = ghAuthTokenFromCli } = {}) {
   const names = new Set();
   for (const n of envelope.setup?.secretRefs || []) if (n) names.add(n);
-  if (envelope.task?.allowPr) {
-    const provider = envelope.repository?.provider || 'github';
-    const authRef = envelope.repository?.authRef || (provider === 'github' ? 'GITHUB_TOKEN' : undefined);
-    if (authRef) names.add(authRef);
-  }
   const resolved = {};
   const missing = [];
   for (const name of names) {
@@ -2310,6 +2305,34 @@ function resolveJobSecrets(resolver, envelope) {
     if (v === undefined) missing.push(name);
     else resolved[name] = v;
   }
+  // The github clone/push credential is resolved with a gh-CLI fallback so a
+  // default GITHUB_TOKEN isn't reported "missing" merely because it isn't in the
+  // env when `gh auth login` provides it. A custom authRef stays strict.
+  if (envelope.task?.allowPr) {
+    const provider = envelope.repository?.provider || 'github';
+    const authRef = envelope.repository?.authRef;
+    const ref = normalizeAuthRef(authRef);
+    if (ref.kind === 'invalid') {
+      // A present-but-blank authRef is a misconfiguration: surface it as missing
+      // so provisioning sheds rather than silently borrowing the default/gh token.
+      if (!missing.includes('repository.authRef')) missing.push('repository.authRef');
+    } else {
+      const ghAuthRef = ref.kind === 'custom'
+        ? ref.name
+        : (provider === 'github' ? 'GITHUB_TOKEN' : undefined);
+      if (ghAuthRef) {
+        names.add(ghAuthRef);
+        const token = githubCloneToken({ provider, authRef, secretResolver: resolver, ghAuthToken });
+        const missingIdx = missing.indexOf(ghAuthRef);
+        if (token) {
+          resolved[ghAuthRef] = token;
+          if (missingIdx !== -1) missing.splice(missingIdx, 1);
+        } else if (missingIdx === -1) {
+          missing.push(ghAuthRef);
+        }
+      }
+    }
+  }
   return { resolved, missing, names: [...names] };
 }
 
@@ -2460,6 +2483,147 @@ function credArgs() {
   return ['-c', 'credential.helper='];
 }
 
+// Fall back to the `gh` CLI's stored credential when GITHUB_TOKEN is not exported
+// to the env. Most interactive setups authenticate with `gh auth login` (keychain)
+// rather than an env var, so an env-only secret resolver yields no token and a
+// private/internal clone fails with "could not read Username". Best effort: returns
+// a trimmed token, or null when gh is missing / not logged in. The token is fed to
+// git via GIT_ASKPASS only (never argv/URL/helper), preserving the ephemeral-token
+// guarantee.
+// Memoized for the process lifetime: this is a synchronous spawnSync (up to a
+// 10s timeout) that can be reached per job, and jobs may run concurrently
+// (maxParallelJobs > 1), so consult the CLI at most once per worker run rather
+// than blocking every handler. A sentinel distinguishes "not yet computed" from
+// a cached null (gh missing / not logged in).
+//
+// Memoization alone still lets the *first* job pay the synchronous spawn on the
+// event loop, stalling any sibling handlers (and lock-extension heartbeats) for
+// up to the timeout. So `nano work` primes this cache once at startup via
+// `primeGhAuthToken()` — before the poll loop — moving the one unavoidable
+// blocking spawn off the job-handling path entirely. Any later call is a warm
+// cache hit; the memoization here is the safety net for paths that never primed.
+const GH_AUTH_TOKEN_UNSET = Symbol('gh-auth-token-unset');
+let ghAuthTokenCache = GH_AUTH_TOKEN_UNSET;
+function ghAuthTokenFromCli() {
+  if (ghAuthTokenCache !== GH_AUTH_TOKEN_UNSET) return ghAuthTokenCache;
+  let token = null;
+  try {
+    const r = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8', timeout: 10_000 });
+    const tok = r.status === 0 ? (r.stdout || '').trim() : '';
+    token = tok || null;
+  } catch {
+    token = null;
+  }
+  ghAuthTokenCache = token;
+  return token;
+}
+
+// Warm the gh-token cache once, off the job-handling path. Safe to call any
+// number of times: the first call performs the (possibly blocking) lookup, the
+// rest are cache hits. Returns true once the cache is populated.
+function primeGhAuthToken() {
+  ghAuthTokenFromCli();
+  return ghAuthTokenCache !== GH_AUTH_TOKEN_UNSET;
+}
+
+// Read the operator's own git identity from their GLOBAL config, using the real
+// host environment (process.env) rather than a job's sanitized gitEnv — so it
+// resolves even on the anonymous clone path, where gitEnv points
+// GIT_CONFIG_GLOBAL at /dev/null. Returns { name, email }, each possibly ''.
+function hostGitIdentity() {
+  const read = (key) => {
+    try {
+      const r = spawnSync('git', ['config', '--global', '--get', key], { encoding: 'utf8', timeout: 5_000 });
+      return r.status === 0 ? (r.stdout || '').trim() : '';
+    } catch {
+      return '';
+    }
+  };
+  return { name: read('user.name'), email: read('user.email') };
+}
+
+// Fall back to the gh-authenticated GitHub user for a committer identity. Uses
+// the account's public email, or the id+login noreply address when the email is
+// private/unset. Returns { name, email }, each possibly ''.
+function ghUserIdentity() {
+  try {
+    const r = spawnSync('gh', ['api', 'user', '--jq', '[.name // "", .login // "", .email // "", (.id // "" | tostring)] | @tsv'],
+      { encoding: 'utf8', timeout: 10_000,
+        env: { ...process.env, GH_PROMPT_DISABLED: '1', GH_NO_UPDATE_NOTIFIER: '1' } });
+    if (r.status !== 0) return { name: '', email: '' };
+    const [name = '', login = '', email = '', id = ''] = (r.stdout || '').trim().split('\t');
+    const resolvedName = name || login || '';
+    const resolvedEmail = email || (id && login ? `${id}+${login}@users.noreply.github.com` : '');
+    return { name: resolvedName, email: resolvedEmail };
+  } catch {
+    return { name: '', email: '' };
+  }
+}
+
+// Resolve the committer identity the harness stamps onto the cloned workspace.
+// Per-field precedence: explicit GIT_AUTHOR_* env → the operator's global git
+// config → the gh-authenticated GitHub user → the `nano-agent` fallback.
+// Preferring the operator's real identity means autonomous commits are authored
+// by the human running the fleet (who has signed any CLA) rather than an
+// anonymous bot that hasn't; the agent's own authorship is recorded as a PR
+// comment (see postAgentAttribution) instead of forged onto the commit. Both the
+// git-config and gh lookups are lazy and performed at most once each, and only
+// when a higher-precedence source didn't already supply the field — so explicit
+// GIT_AUTHOR_* env fully short-circuits them (no `git config`/`gh` spawns, hence
+// no added latency or failure modes when the override is present).
+// `gitIdentity`/`ghIdentity` are injectable for testing.
+function resolveCommitterIdentity({ gitIdentity = hostGitIdentity, ghIdentity = ghUserIdentity } = {}) {
+  const envName = process.env.GIT_AUTHOR_NAME || '';
+  const envEmail = process.env.GIT_AUTHOR_EMAIL || '';
+  let g = null;
+  const gitOnce = () => (g ??= (gitIdentity() || { name: '', email: '' }));
+  let gh = null;
+  const ghOnce = () => (gh ??= (ghIdentity() || { name: '', email: '' }));
+
+  const name = envName || gitOnce().name || ghOnce().name || 'nano-agent';
+  const email = envEmail || gitOnce().email || ghOnce().email || 'nano-agent@users.noreply.github.com';
+
+  const source =
+    (envName || envEmail) ? 'env'
+      : (g && (g.name || g.email)) ? 'git-global'
+        : (gh && (gh.name || gh.email)) ? 'gh'
+          : 'fallback';
+  return { name, email, source };
+}
+
+// Normalize a repository authRef into one of three intents. Trimming matters so
+// a present-but-blank authRef ('' or whitespace) is treated as a misconfiguration
+// rather than "absent": absence enables the default/gh fallback, but a blank
+// custom ref must NOT silently borrow the operator's gh login.
+//   { kind: 'default' }        no custom authRef configured (undefined/null)
+//   { kind: 'custom', name }   a non-empty custom authRef (strict)
+//   { kind: 'invalid' }        authRef present but blank (config error)
+function normalizeAuthRef(authRef) {
+  if (authRef === undefined || authRef === null) return { kind: 'default' };
+  const trimmed = String(authRef).trim();
+  if (trimmed === '') return { kind: 'invalid' };
+  return { kind: 'custom', name: trimmed };
+}
+
+// Resolve the github clone/push credential. The default credential (env
+// GITHUB_TOKEN) falls back to the gh CLI's stored token so `gh auth login`
+// setups work without exporting GITHUB_TOKEN. A custom `authRef` is honored
+// strictly (env/secret resolver only, no gh fallback) so a misconfigured named
+// secret surfaces as missing rather than silently borrowing the operator's gh
+// login. An authRef that is present but blank is a misconfiguration and yields no
+// token (never the gh fallback). `ghAuthToken` is injectable for testing.
+// Returns a token or null.
+function githubCloneToken({ provider, authRef, secretResolver, ghAuthToken = ghAuthTokenFromCli }) {
+  const prov = provider || 'github';
+  const ref = normalizeAuthRef(authRef);
+  if (ref.kind === 'invalid') return null;
+  const usesDefault = prov === 'github' && ref.kind === 'default';
+  const name = ref.kind === 'custom' ? ref.name : (prov === 'github' ? 'GITHUB_TOKEN' : null);
+  let token = name ? (secretResolver.resolve(name) || null) : null;
+  if (!token && usesDefault) token = ghAuthToken() || null;
+  return token;
+}
+
 // Clone repo into <runDir>/workspace and check out / create the working branch.
 // Returns { workspaceDir, gitEnv, startSha, workingBranch, remote }. Throws a
 // ProvisionError (token-redacted) on any git failure so the caller can shed.
@@ -2517,9 +2681,15 @@ function provisionRepo({ envelope, token, runDir, timeoutMs = 120_000 }) {
     }
   }
 
-  // Give the harness a committer identity in case it commits (many do).
-  runGit(['config', 'user.name', process.env.GIT_AUTHOR_NAME || 'nano-agent'], { cwd: workspaceDir, env: gitEnv });
-  runGit(['config', 'user.email', process.env.GIT_AUTHOR_EMAIL || 'nano-agent@users.noreply.github.com'], { cwd: workspaceDir, env: gitEnv });
+  // Give the harness a committer identity in case it commits (many do). Prefer
+  // the operator's real identity (git global / gh user) over the `nano-agent`
+  // fallback so autonomous commits are authored by the human running the fleet —
+  // who has signed any CLA — instead of an anonymous bot. The agent's authorship
+  // is instead recorded as a PR comment (postAgentAttribution). Set via repo-
+  // level config, which overrides global, so the identity is deterministic.
+  const committer = resolveCommitterIdentity();
+  runGit(['config', 'user.name', committer.name], { cwd: workspaceDir, env: gitEnv });
+  runGit(['config', 'user.email', committer.email], { cwd: workspaceDir, env: gitEnv });
 
   // Determine the working branch. With branch.create we make a real branch.
   // Otherwise we're on whatever the clone checked out: a branch only if
@@ -2549,15 +2719,7 @@ function provisionRepo({ envelope, token, runDir, timeoutMs = 120_000 }) {
 // gh returns whatever PR is open for the head branch, which may not be ours.
 function reconcileAgentPr({ workspaceDir, token, branch, provider }) {
   if (provider && provider !== 'github') return { openedBy: null, found: false, error: `PR reconcile unsupported for provider "${provider}"` };
-  const env = { ...process.env };
-  if (token) {
-    env.GH_TOKEN = token;
-  } else {
-    // No job token ⇒ honor the anonymous guarantee: never let gh fall back to an
-    // operator-provided token in the ambient env. Scrub every gh auth source so
-    // PR reconcile can only use credentials we were explicitly handed.
-    for (const k of ['GH_TOKEN', 'GITHUB_TOKEN', 'GH_ENTERPRISE_TOKEN', 'GITHUB_ENTERPRISE_TOKEN']) delete env[k];
-  }
+  const env = ghAuthEnv(token, workspaceDir);
   try {
     const r = spawnSync('gh', ['pr', 'list', '--head', branch, '--state', 'all', '--json', 'number,url,state,isDraft,title,author', '--limit', '1'],
       { cwd: workspaceDir, env, encoding: 'utf8', timeout: 30_000 });
@@ -2572,6 +2734,96 @@ function reconcileAgentPr({ workspaceDir, token, branch, provider }) {
   }
 }
 
+// Build the gh environment for PR-side calls: inject the resolved job token, or
+// (anonymous path) scrub every ambient gh credential so we can only use what we
+// were explicitly handed. Scrubbing the token env vars alone is not enough — gh
+// will still authenticate from its on-disk config (hosts.yml / OS keychain), so
+// in the anonymous path we also point gh at a private, empty GH_CONFIG_DIR
+// (created inside the harness-reaped workspace) and disable interactive prompts,
+// guaranteeing a token-less job cannot act as the operator via stored creds.
+function ghAuthEnv(token, workspaceDir) {
+  const env = { ...process.env };
+  // These apply on every path: workers are non-interactive, so gh must fail
+  // fast rather than block on an auth/update prompt — even a provided token can
+  // be invalid/expired, in which case gh would otherwise try to prompt.
+  env.GH_PROMPT_DISABLED = '1';
+  env.GH_NO_UPDATE_NOTIFIER = '1';
+  if (token) {
+    env.GH_TOKEN = token;
+    return env;
+  }
+  for (const k of ['GH_TOKEN', 'GITHUB_TOKEN', 'GH_ENTERPRISE_TOKEN', 'GITHUB_ENTERPRISE_TOKEN']) delete env[k];
+  // Fail closed: always point gh at an isolated (empty) config dir so it can
+  // never fall back to the operator's on-disk config/keychain. Set GH_CONFIG_DIR
+  // unconditionally — even if mkdirSync fails, gh reading a missing/empty dir
+  // errors out rather than silently authenticating as the operator, preserving
+  // the "token-less job cannot act as the operator" guarantee.
+  const dir = join(workspaceDir || tmpdir(), '.nano-gh-anon');
+  env.GH_CONFIG_DIR = dir;
+  try {
+    mkdirSync(dir, { recursive: true });
+  } catch {
+    // Directory couldn't be created; GH_CONFIG_DIR still points at it so gh
+    // fails closed rather than using ambient operator credentials.
+  }
+  return env;
+}
+
+// The agent whose authorship we record on the PR. Because commits are now
+// authored under the operator's own identity (so they satisfy CLA/DCO), this
+// comment preserves the provenance that the change was machine-generated.
+const AGENT_ATTRIBUTION_NAME = process.env.NANO_AGENT_NAME || 'nano-agent';
+const ATTRIBUTION_MARKER = '<!-- nano-agent-attribution -->';
+
+// Post a one-time attribution comment on the agent-opened PR, recording that the
+// change was produced by the autonomous agent even though the commits carry the
+// operator's identity. Idempotent via a hidden marker so convergence's repeated
+// rounds don't spam the thread. Gated off with NANO_AGENT_ATTRIBUTION=0. Best
+// effort: never throws; returns a small status object.
+function postAgentAttribution({ workspaceDir, token, number, agentName = AGENT_ATTRIBUTION_NAME }) {
+  if (!coerceBool(process.env.NANO_AGENT_ATTRIBUTION, true)) return { posted: false, reason: 'disabled' };
+  if (!number) return { posted: false, reason: 'no-pr' };
+  const env = ghAuthEnv(token, workspaceDir);
+  try {
+    // Ask jq for a single boolean ("marker present?") rather than streaming every
+    // comment body back through stdout. On PRs with many/large comments the full
+    // dump can be slow and can exceed spawnSync's output buffer (maxBuffer),
+    // surfacing as existing.error and wedging attribution forever; a lone
+    // true/false keeps output tiny while preserving idempotency.
+    const markerFilter = `any((.comments // [])[].body; contains(${JSON.stringify(ATTRIBUTION_MARKER)}))`;
+    const existing = spawnSync('gh', ['pr', 'view', String(number), '--json', 'comments', '--jq', markerFilter],
+      { cwd: workspaceDir, env, encoding: 'utf8', timeout: 30_000 });
+    // Idempotency hinges on reliably reading the existing comments: if we cannot
+    // verify whether the marker is already present (transient gh failure — rate
+    // limit, auth glitch, timeout), do NOT post. Posting blind would let repeated
+    // convergence rounds spam duplicate attribution comments. Bail out instead.
+    if (existing.error) {
+      return { posted: false, error: `gh not runnable: ${redactToken(existing.error.message, token).trim().slice(0, 200)}` };
+    }
+    if (existing.status !== 0) {
+      return { posted: false, error: redactToken(existing.stderr || existing.stdout, token).trim().slice(0, 200) || `gh pr view failed (exit ${existing.status ?? 'null'}${existing.signal ? `, signal ${existing.signal}` : ''})` };
+    }
+    if ((existing.stdout || '').trim() === 'true') {
+      return { posted: false, reason: 'exists' };
+    }
+    const body = `${ATTRIBUTION_MARKER}\n`
+      + `🤖 The changes in this PR were produced by **${agentName}**, an autonomous agent. `
+      + `Commits are authored under the operator's own git identity when one is resolvable (the human running the fleet), so they can satisfy CLA/DCO requirements; `
+      + `this note records that the work was generated by the agent.`;
+    const r = spawnSync('gh', ['pr', 'comment', String(number), '--body', body],
+      { cwd: workspaceDir, env, encoding: 'utf8', timeout: 30_000 });
+    if (r.error) {
+      return { posted: false, error: `gh not runnable: ${redactToken(r.error.message, token).trim().slice(0, 200)}` };
+    }
+    if (r.status !== 0) {
+      return { posted: false, error: redactToken(r.stderr || r.stdout, token).trim().slice(0, 200) || `gh pr comment failed (exit ${r.status ?? 'null'}${r.signal ? `, signal ${r.signal}` : ''})` };
+    }
+    return { posted: true };
+  } catch (err) {
+    return { posted: false, error: err.message };
+  }
+}
+
 // After the harness runs: enumerate new commits, push the branch (when
 // branch.push), and reconcile the agent-opened PR (when task.allowPr). A push
 // failure is reported (pushError) rather than thrown — the process model decides
@@ -2604,6 +2856,11 @@ function finalizeGit({ workspaceDir, gitEnv, startSha, workingBranch, envelope,
 
   if (workingBranch && envelope.task?.allowPr) {
     out.pr = reconcileAgentPr({ workspaceDir, token, branch: workingBranch, provider: envelope.repository?.provider || 'github' });
+    // Record the agent's authorship on the PR (commits carry the operator's
+    // identity now, so this preserves the machine-generated provenance).
+    if (out.pr?.found && out.pr.number && (envelope.repository?.provider || 'github') === 'github') {
+      out.attribution = postAgentAttribution({ workspaceDir, token, number: out.pr.number });
+    }
   }
   return out;
 }
@@ -3194,6 +3451,12 @@ async function workAgent(req, flags) {
   const extraNote = extraJobTypes.length > 0 ? ` (${extraJobTypes.length} via --job-type)` : '';
   logger.info(`  listening on ${jobTypes.length} job type(s)${extraNote}: ${jobTypes.join('  ')}`);
   logger.info(`  max parallel: ${maxParallelJobs}; recovery window: ${recoveryWindowMs}ms; idle timeout: ${idleTimeoutMs}ms; hard cap: ${hardCapMs > 0 ? `${hardCapMs}ms` : 'off'}; poll timeout: ${pollTimeoutMs}ms`);
+  // Warm the gh-token cache now, off the job-handling path: githubCloneToken()
+  // may consult `gh auth token` (a synchronous spawn, up to 10s) as its default
+  // credential fallback, and doing that inside a job handler would stall sibling
+  // handlers + lock heartbeats when maxParallelJobs > 1. Priming here pays that
+  // cost once at startup so every later lookup is a warm cache hit.
+  primeGhAuthToken();
   logger.info('Polling for work — press Ctrl-C to stop.');
 
   // When launched under the supervisor, report per-job activity — which job(s)
@@ -3295,8 +3558,8 @@ async function workAgent(req, flags) {
         let repoToken = null;
         if (hasRepo) {
           const provider = envelope.repository.provider || 'github';
-          const authRef = envelope.repository.authRef || (provider === 'github' ? 'GITHUB_TOKEN' : null);
-          if (authRef) repoToken = secretResolver.resolve(authRef) || null; // optional: absent → anonymous clone
+          const authRef = envelope.repository.authRef;
+          repoToken = githubCloneToken({ provider, authRef, secretResolver }); // absent → anonymous clone
           try {
             mkdirSync(agentRunsRoot(), { recursive: true });
             runDir = mkdtempSync(join(agentRunsRoot(), 'run-'));
@@ -6215,8 +6478,14 @@ export {
   provisionRepo,
   finalizeGit,
   reconcileAgentPr,
+  resolveCommitterIdentity,
+  postAgentAttribution,
   reapAgentRunDirs,
   authUrl,
+  githubCloneToken,
+  ghAuthTokenFromCli,
+  primeGhAuthToken,
+  ghAuthEnv,
   redactToken,
   agentRunsRoot,
   ProvisionError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.26.0",
+  "version": "1.26.2",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -47,12 +47,12 @@
     "semantic-release": "^25.0.3"
   },
   "optionalDependencies": {
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.26.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.26.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.26.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.26.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.26.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.26.0",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.26.0"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.26.2",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.26.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.26.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.26.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.26.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.26.2",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.26.2"
   }
 }