c8ctl-plugin-nano 1.30.0 → 1.31.0

package/README.md

@@ -219,6 +219,66 @@ name is generated, so two `work reviewer` processes never collide at the
 broker. (`--name` names the worker; the profile to run is always the
 positional argument.)
 
+### Live agent visibility: the `/agentic` channel + live terminals
+
+A running worker can appear **live on the Workforce visibility page** and stream
+its agents' terminals to an operator's cockpit. This rides the app's agentic
+channel (ADR 0056), served **same-port** on the app's own HTTP base URL at path
+**`/agentic`** — not a sidecar, so there's no extra port to open.
+
+**Connecting.** Enrolment is opt-in: a worker only connects when it has both an
+ADR 0028 **identity token** and a **capability credential** (the same `?token=…`
+pattern the blackboard uses). Point it at the app and hand it the two secrets via
+env (or persisted config); the channel URL defaults to the configured nano URL:
+
+```bash
+# Enrol this worker on the app's same-port /agentic channel
+export NANO_AGENTIC_URL=http://localhost:8080     # app base URL; channel is served at /agentic
+export NANO_AGENTIC_TOKEN=<identity-token>         # ADR 0028 identity
+export NANO_AGENTIC_CREDENTIAL=<capability-cred>   # capability credential
+c8ctl nano work reviewer
+#   agentic channel: announcing presence as ‹worker› on ws://localhost:8080/agentic
+```
+
+Without both secrets the worker runs **exactly as before, off the channel** — no
+visibility, no relay, nothing else changes. A valid identity + capability
+connects; an invalid identity is rejected (unauthorized) and a missing capability
+is rejected (forbidden).
+
+**How presence appears.** On connect the worker **announces** its identity, its
+`host`, and the set of `jobKeys` it is currently running, then **heartbeats** to
+stay live and **re-announces** after a reconnect so its row survives a hub
+restart. When `work` stops it **deregisters cleanly**, so the worker disappears
+from the visibility page on exit.
+
+**Opting a role into a live terminal (PTY vs pipe).** Each role chooses whether
+its agent harness runs on a full **PTY** (a real terminal — streamed on the relay
+lane and **steerable**: an operator's keystrokes reach the running agent) or a
+plain **pipe** (streamed, not interactive). It's a **per-role opt-in**, set on
+the hire profile and defaulting to `pipe`:
+
+```bash
+# Hire a role whose harness runs on a full, steerable PTY
+c8ctl nano hire --name coder --rank senior --command copilot --terminal pty
+
+# Override the mode for a one-off worker without re-hiring
+NANO_AGENTIC_TERMINAL=pipe c8ctl nano work coder
+```
+
+A PTY needs the optional native `node-pty` dependency; when it is
+**unavailable** (not installed, or Windows) a `pty` role **gracefully falls
+back to a pipe** that still relays. (If `node-pty` is present but a PTY can't be
+spawned at runtime, that job fails rather than falling back.) Each job's terminal
+streams on its own relay stream
+named `job:‹jobKey›`, so output and steer-in are routed from the `jobKey` alone.
+
+**Surviving a hub outage.** A worker that starts **before** the app, or survives
+a **hub restart**, buffers its outbound frames in a **bounded** local ring and
+**drains them in order** on reconnect (no loss or reorder within the bound). The
+bound is operator-tunable for a long expected outage; raise it with
+`NANO_AGENTIC_BUFFER_CAPACITY` (frames). When the bound is hit the worker warns
+rather than silently shedding.
+
 ### Live profile reload (no restart on `assign`)
 
 A running `c8ctl nano work <name>` **watches** the profile it is servicing. When
@@ -332,8 +392,32 @@ composed in FEEL, a task may supply per-instance context via **`task.appendPromp
 separator/preamble), so a null/empty append leaves the base untouched. This lets the
 static prompt live in a model header/side-car while the dynamic tail (e.g. plan-revision
 feedback, a per-task brief) is built per instance.
+
+**Live prompts via linked resources.** A service task can declare a Zeebe/Camunda-parity
+**linked resource** for its prompt instead of baking it into a model header:
+
+```xml
+<zeebe:linkedResources>
+  <zeebe:linkedResource resourceId="plan.md" bindingType="latest" linkName="prompt"/>
+</zeebe:linkedResources>
+```
+
+At job activation the engine resolves the `resourceId` to the **latest** deployed key and
+delivers a `linkedResources` custom header (`[{resourceKey, resourceType, linkName}]`). The
+header carries the **key, not the content** — the worker fetches the bytes over the broker
+REST API (`GET /v2/resources/{resourceKey}/content/binary`, reusing the same nano endpoint
+the worker already talks to; override with `NANO_REST_URL`/`NANO_REST_TOKEN`) and uses the
+UTF-8 content as the **base prompt**. The entry whose `linkName` is `prompt` wins over the
+header-baked `task.prompt` chain; `appendPrompt` still composes onto it. Redeploying just
+the resource updates the prompt for the **next activation** — no process redeploy, no
+worker restart. Jobs without `linkedResources` behave exactly as before (fallback chain).
+A declared prompt resource that can't be fetched **fails the job** (retryable provisioning
+error) rather than running an agent with an empty prompt, and the resolved `resourceKey` is
+logged and echoed on the output envelope as `promptResourceKey` for audit (the engine keeps
+only `latest`, so the key is the reproducibility handle).
+
 On completion the plugin writes an **output envelope** back under
-`io.nanobpm.agentResult` (`{schemaVersion, status, sandbox, image, output, truncated, stderrTruncated, exitCode, signal, error}`). When a repository was
+`io.nanobpm.agentResult` (`{schemaVersion, status, sandbox, image, output, truncated, stderrTruncated, exitCode, signal, error, promptResourceKey?}`). When a repository was
 provisioned (below) it also carries `{repository, branch, baseSha, headSha, commits[], pushed, pushError?, gitError?, pr?}`.
 
 **Git provisioning (host).** When `--sandbox none` (the default) and the envelope

package/c8ctl-plugin.js

@@ -2072,6 +2072,15 @@ function killTree(child) {
 // envelope is written back on the job's completion variables.
 const AGENT_TASK_NS = 'io.nanobpm.agentTask';
 const AGENT_RESULT_KEY = 'io.nanobpm.agentResult';
+// Zeebe/Camunda-parity linked resources (issue #63). At job activation the
+// engine resolves each declared `<zeebe:linkedResource resourceId … linkName>`
+// to the LATEST deployed key and delivers this custom header: a JSON array of
+// `{ resourceKey, resourceType, linkName }`. The header carries the key, not the
+// content — the worker fetches the bytes over the broker REST API. The entry
+// whose `linkName` matches DEFAULT_PROMPT_LINK_NAME supplies the agent's base
+// prompt (live-updatable by redeploying just the resource).
+const LINKED_RESOURCES_HEADER = 'linkedResources';
+const DEFAULT_PROMPT_LINK_NAME = 'prompt';
 const TASK_ENVELOPE_SCHEMA_VERSION = 1;
 // The result-envelope version is intentionally independent of the task-envelope
 // version so the two contracts can evolve separately without silently coupling.
@@ -2236,7 +2245,13 @@ function collectEnvelopeFrom(source) {
 
 // Normalize the assembled envelope to schema v1, coercing header string values
 // (element templates write everything as strings) into bool/int as needed.
-function normalizeTaskEnvelope(customHeaders, variables) {
+//
+// `opts.basePromptOverride` (issue #63): when a `linkName: prompt` linked
+// resource resolves, its fetched content is passed here and WINS over the
+// header-baked `task.prompt` / `variables.prompt` / `variables.task` chain. The
+// FEEL-composed `appendPrompt` concatenation is unchanged — it still appends to
+// whatever base was resolved.
+function normalizeTaskEnvelope(customHeaders, variables, opts = {}) {
   const raw = deepMerge(collectEnvelopeFrom(customHeaders), collectEnvelopeFrom(variables));
   const str = (v) => (v == null ? undefined : String(v));
   const env = {
@@ -2272,9 +2287,12 @@ function normalizeTaskEnvelope(customHeaders, variables) {
   };
 
   const task = isPlainObject(raw.task) ? raw.task : {};
-  // Base prompt: the reserved `task.prompt` (typically a model header filled at deploy time),
-  // else a plain `prompt`/`task` job variable (the pre-header delivery path).
-  const basePrompt = str(task.prompt) ?? str(variables?.prompt) ?? str(variables?.task);
+  // Base prompt: an override supplied by a resolved `linkName: prompt` linked
+  // resource (issue #63) wins; else the reserved `task.prompt` (typically a model
+  // header filled at deploy time), else a plain `prompt`/`task` job variable (the
+  // pre-header delivery path).
+  const overrideBase = opts && opts.basePromptOverride != null ? String(opts.basePromptOverride) : undefined;
+  const basePrompt = overrideBase ?? str(task.prompt) ?? str(variables?.prompt) ?? str(variables?.task);
   // Verbatim dynamic append: a header-delivered base prompt can't be composed in FEEL, so a task
   // may supply per-instance context (e.g. plan-revision feedback, a per-task brief) via the
   // reserved `task.appendPrompt`, or a plain `appendPrompt` variable. It is concatenated onto the
@@ -2297,7 +2315,133 @@ function normalizeTaskEnvelope(customHeaders, variables) {
   return env;
 }
 
-// ---- Secret resolution (pluggable; only host-env implemented for now) ------
+// ---- Linked resources → live agent prompt (issue #63) ----------------------
+// A job's `linkedResources` activation header carries KEYS (not content); the
+// worker resolves each to the LATEST deployed bytes over the broker REST API, so
+// an agent prompt can be updated by redeploying one Markdown resource — no
+// process redeploy, no harness restart.
+
+// Parse the `linkedResources` custom header off an activated job. The engine
+// delivers a JSON array; element-template/header transport stringifies it. Also
+// tolerate an already-parsed array. Anything malformed/absent → [] (fallback
+// path). Never throws.
+function parseLinkedResources(customHeaders) {
+  if (!isPlainObject(customHeaders)) return [];
+  const raw = customHeaders[LINKED_RESOURCES_HEADER];
+  if (raw == null) return [];
+  let val = raw;
+  if (typeof raw === 'string') {
+    if (!raw.trim()) return [];
+    try { val = JSON.parse(raw); } catch { return []; }
+  }
+  if (!Array.isArray(val)) return [];
+  return val.filter((e) => isPlainObject(e) && e.resourceKey != null);
+}
+
+// Select the linked resource that supplies the base prompt: the first entry
+// whose `linkName` matches (default `prompt`). Returns the entry or null.
+function pickLinkedResource(linkedResources, linkName = DEFAULT_PROMPT_LINK_NAME) {
+  if (!Array.isArray(linkedResources)) return null;
+  return linkedResources.find((e) => isPlainObject(e) && String(e.linkName) === String(linkName)) || null;
+}
+
+// The broker REST base URL + optional bearer the harness uses to fetch resource
+// content — the SAME nano endpoint the worker already talks to (env wins over
+// persisted config, falling back to the default localhost port). A local nano
+// cluster is unauthenticated, so the token is optional; when set (e.g. against a
+// secured gateway) it is sent as a Bearer credential.
+// Same-origin test for two URLs (protocol + host + port). Returns false if
+// either string is missing or unparseable, so a token is never forwarded to an
+// endpoint we can't positively confirm matches.
+function sameOrigin(a, b) {
+  if (!a || !b) return false;
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
+
+function resolveBrokerRestConfig(env = process.env) {
+  // readConfig() swallows parse/IO errors and never throws (returns {}), so no
+  // local try/catch is needed here.
+  const cfg = readConfig() || {};
+  const baseUrl =
+    env.NANO_REST_URL ||
+    env.NANO_BASE_URL ||
+    cfg.nanoUrl ||
+    DEFAULT_NANO_URL;
+  // An explicit REST token always wins. The agentic identity token is only a
+  // fallback for single-token deployments where the broker REST endpoint IS the
+  // agentic endpoint — so only forward it when the REST base URL is same-origin
+  // as the agentic URL. This prevents leaking the identity token to a different
+  // NANO_REST_URL host when no REST token is set (see resolveAgenticConfig).
+  let token = env.NANO_REST_TOKEN || '';
+  if (!token) {
+    const agenticToken = env.NANO_AGENTIC_TOKEN || cfg.agenticToken || '';
+    const agenticUrl =
+      env.NANO_AGENTIC_URL ||
+      cfg.agenticUrl ||
+      cfg.nanoUrl ||
+      env.NANO_BASE_URL ||
+      DEFAULT_NANO_URL;
+    if (agenticToken && sameOrigin(baseUrl, agenticUrl)) token = agenticToken;
+  }
+  return { baseUrl, token };
+}
+
+// Build the content endpoint. Per issue #63 / nano-bpm #759 the non-binary
+// `/content` variant is deprecated for non-RPA types (Markdown → 406), so the
+// worker always fetches `/content/binary`.
+function resourceContentUrl(baseUrl, resourceKey) {
+  const base = String(baseUrl || '').replace(/\/+$/, '');
+  return `${base}/v2/resources/${encodeURIComponent(String(resourceKey))}/content/binary`;
+}
+
+// Fetch a linked resource's bytes and decode UTF-8. A non-2xx or network error
+// is surfaced as a ProvisionError so the caller fails the job with a clear
+// provisioning message (never runs an agent with a silently-empty prompt).
+async function fetchLinkedResourceContent(resourceKey, opts = {}) {
+  const { baseUrl, token, fetchImpl = fetch, timeoutMs = 15_000 } = opts;
+  const url = resourceContentUrl(baseUrl, resourceKey);
+  const controller = new AbortController();
+  const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
+  let res;
+  try {
+    const headers = { Accept: 'application/octet-stream' };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    res = await fetchImpl(url, { method: 'GET', headers, signal: controller.signal });
+  } catch (err) {
+    throw new ProvisionError(`prompt resource ${resourceKey} fetch failed: ${err && err.message ? err.message : String(err)}`);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+  if (!res || !res.ok) {
+    const status = res ? res.status : '?';
+    throw new ProvisionError(`prompt resource ${resourceKey} fetch failed: HTTP ${status} from ${url}`);
+  }
+  try {
+    return await res.text();
+  } catch (err) {
+    throw new ProvisionError(`prompt resource ${resourceKey} decode failed: ${err && err.message ? err.message : String(err)}`);
+  }
+}
+
+// Resolve the base prompt from a `linkName: prompt` linked resource, if the job
+// declares one. Returns `{ basePrompt, resourceKey }` when a prompt resource is
+// present and fetched, or null when no such entry exists (→ fall back to the
+// header-baked task.prompt chain). Throws a ProvisionError when a declared
+// prompt resource cannot be fetched — a provisioning failure, not a silent
+// empty-prompt run.
+async function resolveLinkedPrompt(customHeaders, opts = {}) {
+  const { linkName = DEFAULT_PROMPT_LINK_NAME, baseUrl, token, fetchImpl, timeoutMs } = opts;
+  const entry = pickLinkedResource(parseLinkedResources(customHeaders), linkName);
+  if (!entry) return null;
+  const resourceKey = entry.resourceKey;
+  const basePrompt = await fetchLinkedResourceContent(resourceKey, { baseUrl, token, fetchImpl, timeoutMs });
+  return { basePrompt, resourceKey, resourceType: entry.resourceType ?? null, linkName: String(linkName) };
+}
+
 // Secrets are referenced by NAME, never by value, in the model. A resolver maps
 // a name → value at run time. The wrapper injects them into the child ENV, so
 // values never appear in argv or `docker inspect`.
@@ -3416,7 +3560,7 @@ function runAgentJob(profile, job, opts = {}) {
 
 // Shape the io.nanobpm.agentResult output envelope. When a repository was
 // provisioned (increment 2a), the `git` block adds branch/commits/push/PR facts.
-function buildResultEnvelope(result, { sandbox, image, git, result: agentResult } = {}) {
+function buildResultEnvelope(result, { sandbox, image, git, result: agentResult, promptResourceKey } = {}) {
   const status = result.ok ? 'completed' : (result.timedOut ? 'timedOut' : 'failed');
   const env = {
     schemaVersion: RESULT_ENVELOPE_SCHEMA_VERSION,
@@ -3430,6 +3574,10 @@ function buildResultEnvelope(result, { sandbox, image, git, result: agentResult
     signal: result.signal ?? null,
     error: result.error ?? null,
   };
+  // Audit (issue #63): record which linked-resource key supplied the base prompt.
+  // The engine only keeps `latest` per resourceId (no pinning), so recording the
+  // resolved key is the only reproducibility handle for which prompt version ran.
+  if (promptResourceKey != null) env.promptResourceKey = String(promptResourceKey);
   // The agent's structured result (as returned via $AGENT_RESULT_FILE / sentinel),
   // preserved verbatim for auditability even when merged into the completion vars.
   if (isPlainObject(agentResult)) env.result = agentResult;
@@ -3685,6 +3833,10 @@ async function workAgent(req, flags) {
   const jobTypes = [...new Set([...matrix, ...extraJobTypes])];
   const camunda = globalThis.c8ctl.createClient();
 
+  // Broker REST endpoint for live linked-resource prompts (issue #63) — the same
+  // nano endpoint this worker already talks to. Resolved once at startup.
+  const restConfig = resolveBrokerRestConfig();
+
   logger.info(`Putting "${name}" [${profile.rank}] to work → ${buildAgentCommandLine(profile.command, effectiveArgs)}`);
   logger.info(`  worker: ${workerName}`);
   logger.info(`  model: ${profile.model || '(none)'}; capabilities: ${profile.capabilities.join(', ') || '(none)'}`);
@@ -3853,9 +4005,33 @@ async function workAgent(req, flags) {
           }
         }
 
+        // Live agent prompt (issue #63): if the job declares a `linkName: prompt`
+        // linked resource, fetch its LATEST deployed content and use it as the
+        // base prompt (it wins over the header-baked task.prompt). A declared
+        // prompt resource that can't be fetched is a provisioning failure — fail
+        // (retryable) rather than run an agent with an empty prompt.
+        let promptResourceKey = null;
+        let basePromptOverride;
+        try {
+          const linked = await resolveLinkedPrompt(job.customHeaders ?? {}, {
+            baseUrl: restConfig.baseUrl,
+            token: restConfig.token,
+          });
+          if (linked) {
+            basePromptOverride = linked.basePrompt;
+            promptResourceKey = linked.resourceKey;
+            logger.info(`[${jobType}] job ${job.jobKey} base prompt from linked resource key ${promptResourceKey} (linkName=${linked.linkName}, ${Buffer.byteLength(String(basePromptOverride), 'utf8')} bytes)`);
+          }
+        } catch (err) {
+          const retries = Math.max(0, (Number(job.retries) || 1) - 1);
+          const msg = err instanceof ProvisionError ? err.message : `prompt resource fetch failed: ${err.message}`;
+          logger.warn(`[${jobType}] job ${job.jobKey} not provisioned — ${msg}; retries left ${retries}`);
+          return job.fail({ errorMessage: msg.slice(0, 2000), retries, retryBackOff: 15_000 });
+        }
+
         // Assemble + normalize the task envelope from headers (defaults) and
         // variables (overrides), then resolve any secrets it references.
-        const envelope = normalizeTaskEnvelope(job.customHeaders ?? {}, job.variables ?? {});
+        const envelope = normalizeTaskEnvelope(job.customHeaders ?? {}, job.variables ?? {}, { basePromptOverride });
         const { resolved, missing, names } = resolveJobSecrets(secretResolver, envelope);
         if (missing.length > 0) {
           const retries = Math.max(0, (Number(job.retries) || 1) - 1);
@@ -4000,7 +4176,7 @@ async function workAgent(req, flags) {
         if (resultDir) { try { rmSync(resultDir, { recursive: true, force: true }); } catch { /* best effort */ } liveRunDirs.delete(resultDir); }
         const resultVars = sanitizeResultVars(rawResult);
 
-        const resultEnvelope = buildResultEnvelope(result, { sandbox, image, git: gitResult, result: rawResult });
+        const resultEnvelope = buildResultEnvelope(result, { sandbox, image, git: gitResult, result: rawResult, promptResourceKey });
         if (result.ok) {
           const gitNote = gitResult
             ? ` [${gitResult.branch ? `branch ${gitResult.branch}` : 'detached HEAD'}: ${gitResult.commits.length} commit(s), ${gitResult.branch ? (gitResult.pushed ? 'pushed' : (gitResult.pushError ? 'push FAILED' : 'not pushed')) : 'no branch to push'}${gitResult.pr?.found ? `, PR #${gitResult.pr.number}` : ''}]`
@@ -6894,6 +7070,12 @@ export {
 export {
   normalizeTaskEnvelope,
   collectEnvelopeFrom,
+  parseLinkedResources,
+  pickLinkedResource,
+  resolveBrokerRestConfig,
+  resourceContentUrl,
+  fetchLinkedResourceContent,
+  resolveLinkedPrompt,
   coerceBool,
   coerceInt,
   deepMerge,
@@ -6940,6 +7122,8 @@ export {
   derivePollTimeoutMs,
   AGENT_TASK_NS,
   AGENT_RESULT_KEY,
+  LINKED_RESOURCES_HEADER,
+  DEFAULT_PROMPT_LINK_NAME,
   RESULT_SENTINEL,
   RESERVED_RESULT_KEYS,
   SANDBOXES,
@@ -7013,9 +7197,11 @@ export const metadata = {
         { command: 'c8ctl nano hire --name coder --rank senior --command copilot --env COPILOT_ENABLE_ALL_TOOLS=1', description: 'Persist a harness startup env var (e.g. permissions) on the profile' },
         { command: 'c8ctl nano hire --list', description: 'List hired agent profiles' },
         { command: 'c8ctl nano hire --name coder --rank senior --command "agent-harness" --sandbox docker --image ghcr.io/acme/agent:1', description: 'Create a profile that runs each job in a throwaway Docker container' },
+        { command: 'c8ctl nano hire --name coder --rank senior --command copilot --terminal pty', description: 'Opt this role into a full, steerable live terminal (PTY) streamed on the agentic relay lane (default: pipe)' },
         { command: 'c8ctl nano assign reviewer code-review,testing', description: 'Grant more capabilities (comma-separated, like hire) to an existing hire — additive; running workers hot-reload it' },
         { command: 'c8ctl nano work reviewer', description: 'Spawn Nano job workers for the "reviewer" profile and poll for work' },
         { command: 'c8ctl nano work coder --sandbox docker --image ghcr.io/acme/agent:1', description: 'Run jobs in isolated containers with disk-hygiene reaping' },
+        { command: 'NANO_AGENTIC_URL=http://localhost:8080 NANO_AGENTIC_TOKEN=<identity-token> NANO_AGENTIC_CREDENTIAL=<capability-cred> c8ctl nano work reviewer', description: 'Enrol the worker on the app\'s same-port /agentic channel so it appears live (presence + relay terminals) on the Workforce visibility page' },
         { command: 'c8ctl nano supervisor start --worker reviewer --worker coder', description: 'Start a detached supervisor managing several workers from one terminal' },
         { command: 'c8ctl nano supervisor', description: 'Attach an interactive console to the supervisor (detach with Ctrl-D, leaving it running)' },
         { command: 'c8ctl nano supervisor status', description: 'List supervised workers (pid, state, serviced job / idle, restarts, uptime) without the console' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -57,12 +57,12 @@
   },
   "optionalDependencies": {
     "node-pty": "^1.0.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.30.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.30.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.30.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.30.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.30.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.30.0",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.30.0"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.31.0",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.31.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.31.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.31.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.31.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.31.0",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.31.0"
   }
 }