c8ctl-plugin-nano 1.31.0 → 1.33.0

package/README.md

@@ -212,6 +212,54 @@ c8ctl nano work reviewer --max-parallel 2 --recovery-window 300000
 c8ctl nano work reviewer --name reviewer-eu  # name this worker (else auto ‹host›-‹profile›-‹random›)
 ```
 
+#### Zero-config enrolment: `--auto` (serve every deployed agent job type)
+
+`--auto` is the **"Borland Delphi on your machine"** onboarding ramp: skip the
+capability wiring entirely and subscribe the worker to **all deployed *agent*
+job types**, read straight from the engine.
+
+```bash
+c8ctl nano work coder --auto                  # serve every agent job type on the engine
+c8ctl nano work coder --auto --auto-scope my-app   # scope to one app/network (process-id prefix)
+```
+
+How it works and why it needs no wiring:
+
+- **Engine-read demand.** The worker already holds the engine (C8 REST) endpoint
+  from its c8ctl profile. `--auto` enumerates the deployed process definitions
+  (`process-definitions/search` → `/{key}/xml`) and scans their
+  `<zeebe:taskDefinition type>` leaves for the job types the engine matches. The
+  engine is the guaranteed shared rendezvous: if a worker can execute an app's
+  agent jobs at all, it and the app are already on the same engine, so *what
+  agent job types exist* is answerable from that engine alone — **no cross-machine
+  app discovery, no app enrol endpoint, no channel connection**.
+- **Agent-task header filter.** Not every service task is an agent task —
+  connectors and record-keepers (e.g. `pr.record-plan`) are plain workers.
+  `--auto` keeps only leaves whose service task carries an
+  **`io.nanobpm.agentTask.`** task header (e.g. `senior:plan` carries
+  `io.nanobpm.agentTask.task.prompt`; a record-keeper does not).
+- **One poller per agent job type, reconciled on change.** It opens one poller
+  per agent job type and re-reads the engine periodically, adding pollers for
+  newly deployed agent processes and draining pollers for undeployed ones — the
+  same in-place reconcile the profile watch uses, sourced from the engine instead
+  of the profile.
+- **Raw job-type grammar.** The job type the engine matches (`senior:plan`) is
+  advertised **verbatim** — colon-named types are not forced through any
+  dot-grammar.
+
+`--auto` is **mutually exclusive** with capability-resolved serving: it bypasses
+the rank×capability matrix (any `--job-type` extras are still added). The prompt
+a worker needs already rides the job header (`io.nanobpm.agentTask.task.prompt`)
+plus per-instance context, so a generic `--auto` worker needs no baked
+specialisation.
+
+> **Trust.** Engine-read has **no capability gate** — an `--auto` worker will
+> serve *any* deployed agent job on its engine. That is the accepted trade for the
+> local/zero-config target; capability-gated serving is the specialised
+> (capability-declared) enrolment path. Use `--auto-scope <process-id | prefix>`
+> to narrow the blast radius to one app/network.
+
+
 The optional `--name` sets **this worker's name** — the `workerName` it
 registers under at the broker (`‹name›:‹jobType›`) and how it shows up in
 supervisor status/logs. Omit it and a distinct `‹host›-‹profile›-‹random›`
@@ -696,7 +744,7 @@ release onto a machine that already has nano installed:
 
 ```bash
 c8ctl nano update          # check npm for a newer release and install it
-c8ctl nano update --check  # only report whether an update is available
+c8ctl nano update --check  # report whether an update is available (no install)
 ```
 
 `update` compares the installed plugin version against the latest published on
@@ -706,6 +754,15 @@ with it. It only ever drives npm — it never touches the private upstream sourc
 so it works for any npm-installed user. After updating, restart any running
 cluster (`c8ctl nano restart`) so it picks up the new binary.
 
+Whenever an update is available, `update` (and `update --check`) also prints a
+**changelog of what changed since the installed release** — the per-version
+"Features" / "Bug Fixes" notes pulled from the plugin's public
+[GitHub Releases](https://github.com/jwulf/c8ctl-plugin-nano/releases) (where
+semantic-release records them). This lookup is best-effort and non-blocking: if
+GitHub is unreachable or rate-limited it degrades to a link to the releases page
+and the update proceeds normally. Set `GH_TOKEN` (or `GITHUB_TOKEN`) to raise the
+unauthenticated API rate limit.
+
 If the plugin is running from a local checkout rather than a global npm install,
 `update` prints the manual command instead of reinstalling in place.
 

package/agentic.mjs

@@ -74,6 +74,19 @@ export * as presence from '@nanobpm/agentic/presence';
 export * as relay from '@nanobpm/agentic/relay';
 export * as transcript from '@nanobpm/agentic/transcript';
 
+// ---------------------------------------------------------------------------
+// Demand read — @nanobpm/agentic/demand.
+//
+// The read-only C8 REST mirror of the engine's deployed `taskDefinition` leaves
+// (ADR 0056 S4). `nano work --auto` (jwulf/c8ctl-plugin-nano#66) consumes its
+// `httpC8RestReader` to enumerate deployed process definitions and read each
+// one's BPMN XML straight from the engine the worker already talks to — the
+// zero-config enrolment source. The header-filter that narrows those leaves to
+// *agent* job types lives in the plugin (`scanAgentTaskLeaves`), extending the
+// package's type/element/process-only scanner with a `zeebe:taskHeaders` read.
+// ---------------------------------------------------------------------------
+export * as demand from '@nanobpm/agentic/demand';
+
 // ---------------------------------------------------------------------------
 // Worker-side channel client — @nanobpm/urban-agent-client.
 //

package/c8ctl-plugin.js

@@ -125,6 +125,11 @@ const READINESS_TIMEOUT_MS = 60_000;
 const READINESS_POLL_MS = 500;
 const HEALTH_TIMEOUT_MS = 1_500;
 const STOP_GRACE_MS = 8_000;
+// Upper bound on one `--auto` engine-read reconcile (enumerate deployed
+// definitions + fetch each BPMN). A read that stalls past this is treated as a
+// transient failure so the running poller set is KEPT and, crucially, shutdown
+// — which awaits the in-flight reconcile — can never hang on a wedged engine.
+const AUTO_ENGINE_READ_TIMEOUT_MS = 15_000;
 const PROCESSOS_STATE_FILE = 'processos.json';
 const SUPERVISOR_STATE_FILE = 'supervisor.json';
 const PROCESSOS_DEFAULT_PORT = 8090;
@@ -2390,6 +2395,127 @@ function resolveBrokerRestConfig(env = process.env) {
   return { baseUrl, token };
 }
 
+// ---------------------------------------------------------------------------
+// `nano work --auto`: zero-config engine-read enrolment (issue #66).
+//
+// Subscribe a generic worker to ALL deployed *agent* job types by reading the
+// demand straight from the engine (C8 REST) the worker already talks to — no
+// capability, no app enrol endpoint, no hub rendezvous. The engine is the
+// guaranteed shared rendezvous: if a worker can execute an app's agent jobs at
+// all, it and the app are already on the same engine, so "what agent job types
+// exist" is answerable from that engine alone.
+//
+// `@nanobpm/agentic/demand` already reads deployed `taskDefinition` leaves over
+// C8 REST (`process-definitions/search` → `/{key}/xml`), but its scanner reads
+// type/element/process only. Not every service task is an agent task — plain
+// connectors and record-keepers (e.g. `pr.record-plan`) are ordinary workers.
+// The demand scanner is therefore extended HERE to read `zeebe:taskHeaders` and
+// keep only leaves whose service task carries an `io.nanobpm.agentTask.` header
+// (e.g. `senior:plan` carries `io.nanobpm.agentTask.task.prompt`; a record-keeper
+// does not). Advertise the raw job-type string the engine matches (`senior:plan`)
+// verbatim — colon-named types are NOT forced through the agentic dot-grammar.
+// ---------------------------------------------------------------------------
+
+// True iff a serviceTask body carries a `zeebe:taskHeader` under the agent-task
+// namespace — the marker that distinguishes an agent task from a plain
+// connector / record-keeper. Matches the exact `io.nanobpm.agentTask` key and
+// any flattened `io.nanobpm.agentTask.*` dotpath key (element templates emit the
+// latter, e.g. `io.nanobpm.agentTask.task.prompt`).
+function serviceTaskHasAgentHeader(body) {
+  const headerRe = /<zeebe:header\b[^>]*\bkey\s*=\s*"([^"]*)"/g;
+  let m;
+  while ((m = headerRe.exec(body)) !== null) {
+    const key = m[1];
+    if (key === AGENT_TASK_NS || key.startsWith(`${AGENT_TASK_NS}.`)) return true;
+  }
+  return false;
+}
+
+// Scan one deployed BPMN document for its *agent* task-definition leaves: every
+// `<bpmn:serviceTask>` carrying BOTH a non-empty `<zeebe:taskDefinition type>`
+// AND an `io.nanobpm.agentTask.` task header. Returns `{ taskType, process }`
+// leaves in first-occurrence order. This is the header-aware extension of the
+// demand package's `scanTaskDefinitions` (which reads type/element/process only).
+function scanAgentTaskLeaves(xml) {
+  const source = String(xml || '');
+  const procMatch = source.match(/<bpmn:process\b[^>]*\bid\s*=\s*"([^"]*)"/);
+  const proc = procMatch ? procMatch[1] : '';
+  const out = [];
+  const blockRe = /<bpmn:serviceTask\b[^>]*>([\s\S]*?)<\/bpmn:serviceTask>/g;
+  let block;
+  while ((block = blockRe.exec(source)) !== null) {
+    const body = block[1];
+    const tdMatch = body.match(/<zeebe:taskDefinition\b[^>]*>/);
+    if (!tdMatch) continue;
+    const typeMatch = tdMatch[0].match(/\btype\s*=\s*"([^"]*)"/);
+    const taskType = typeMatch ? typeMatch[1] : '';
+    if (!taskType) continue;
+    if (!serviceTaskHasAgentHeader(body)) continue;
+    out.push({ taskType, process: proc });
+  }
+  return out;
+}
+
+// Read the distinct deployed *agent* job types through a demand C8RestReader
+// seam: enumerate the deployed definitions, fetch each one's BPMN XML, scan the
+// agent leaves, and return the distinct job types in first-occurrence order. An
+// optional `scope` narrows to one app/network — kept only when the leaf's
+// `bpmn:process` id equals or is prefixed by the scope string.
+async function readDeployedAgentJobTypes(reader, { scope = '' } = {}) {
+  const keys = await reader.searchProcessDefinitionKeys();
+  const seen = new Set();
+  const out = [];
+  for (const key of keys) {
+    const xml = await reader.getProcessDefinitionXml(key);
+    for (const leaf of scanAgentTaskLeaves(xml)) {
+      if (scope && !(leaf.process === scope || leaf.process.startsWith(scope))) continue;
+      if (seen.has(leaf.taskType)) continue;
+      seen.add(leaf.taskType);
+      out.push(leaf.taskType);
+    }
+  }
+  return out;
+}
+
+// Build the live C8 v2 REST reader from the broker REST config. `httpC8RestReader`
+// appends `/process-definitions/...` to its `restAddress`, and the C8 v2 API is
+// mounted under `/v2` on the broker (same base the linked-resource fetch uses),
+// so the reader's address is `<baseUrl>/v2`. The demand module is imported lazily
+// through the single agentic surface (`agentic.mjs`) so the whole agentic module
+// graph only loads when `--auto` is actually used.
+async function defaultC8RestReader(restConfig) {
+  const { demand } = await import('./agentic.mjs');
+  const base = String(restConfig?.baseUrl || DEFAULT_NANO_URL).replace(/\/+$/, '');
+  return demand.httpC8RestReader({
+    restAddress: `${base}/v2`,
+    token: restConfig?.token ? restConfig.token : undefined,
+  });
+}
+
+// Resolve the desired job-type set for `--auto`: all deployed agent job types
+// read from the engine, optionally scoped to one process-id/prefix. A test may
+// inject an in-memory `readerFactory` to drive it without a live engine. The
+// whole read is time-bounded (`timeoutMs`, 0 disables) and a timeout rejects
+// with a clear error, so a stalled engine read settles the awaited promise
+// (KEEP the running set) instead of wedging the reconcile — and, via shutdown's
+// `await inFlightReconcile`, wedging `Ctrl-C`/SIGTERM.
+async function resolveAutoJobTypes({ restConfig, scope = '', readerFactory, timeoutMs = AUTO_ENGINE_READ_TIMEOUT_MS } = {}) {
+  const read = (async () => {
+    const reader = readerFactory ? await readerFactory() : await defaultC8RestReader(restConfig);
+    return readDeployedAgentJobTypes(reader, { scope });
+  })();
+  if (!(timeoutMs > 0)) return read;
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Error(`engine read timed out after ${timeoutMs}ms`)), timeoutMs);
+  });
+  try {
+    return await Promise.race([read, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // Build the content endpoint. Per issue #63 / nano-bpm #759 the non-binary
 // `/content` variant is deprecated for non-RPA types (Markdown → 406), so the
 // worker always fetches `/content/binary`.
@@ -3830,19 +3956,59 @@ async function workAgent(req, flags) {
     logger.error(jobTypeErrors.join('; '));
     process.exit(1);
   }
-  const jobTypes = [...new Set([...matrix, ...extraJobTypes])];
+  // Zero-config engine-read enrolment (issue #66). `--auto` subscribes this
+  // worker to ALL deployed *agent* job types read straight from the engine —
+  // no capability, no app enrol endpoint, no channel connection. It is the
+  // mutually-exclusive counterpart to capability-resolved SERVE: in `--auto`
+  // the rank×capability matrix is bypassed entirely (any deployed agent job is
+  // served, gated only by the `io.nanobpm.agentTask.` task header), and the
+  // desired set is reconciled by polling the engine rather than watching the
+  // profile. `--auto-scope <process-id|prefix>` narrows the blast radius to one
+  // app/network; without it, every agent job type on the engine is served.
+  //
+  // TRUST: engine-read has no capability gate — a `--auto` worker will serve any
+  // deployed agent job on its engine. That is the accepted trade for the
+  // local/zero-config target; capability-gated serving is the specialised path.
+  const autoMode = coerceBool(flags?.auto, false);
+  const autoScope = flags?.['auto-scope'] ? String(flags['auto-scope']).trim() : '';
+  if (!autoMode && autoScope) {
+    logger.error('--auto-scope requires --auto (it narrows the engine-read agent job types).');
+    process.exit(1);
+  }
   const camunda = globalThis.c8ctl.createClient();
 
   // Broker REST endpoint for live linked-resource prompts (issue #63) — the same
-  // nano endpoint this worker already talks to. Resolved once at startup.
+  // nano endpoint this worker already talks to. Resolved once at startup, and
+  // reused as the C8 REST source for `--auto`'s engine-read enrolment.
   const restConfig = resolveBrokerRestConfig();
 
+  // The desired job-type set. In `--auto` it is engine-read (∪ any --job-type
+  // extras); otherwise it is the rank×capability matrix (∪ extras). The initial
+  // engine read is best-effort — a transient failure starts the worker with no
+  // auto pollers and the poll reconcile below fills them in on the next pass,
+  // rather than refusing to start.
+  let jobTypes;
+  if (autoMode) {
+    try {
+      const autoTypes = await resolveAutoJobTypes({ restConfig, scope: autoScope });
+      jobTypes = [...new Set([...autoTypes, ...extraJobTypes])];
+    } catch (err) {
+      logger.warn(`--auto: initial engine read failed (${err?.message || err}); starting with no auto pollers — will retry on the next poll.`);
+      jobTypes = [...new Set(extraJobTypes)];
+    }
+  } else {
+    jobTypes = [...new Set([...matrix, ...extraJobTypes])];
+  }
+
   logger.info(`Putting "${name}" [${profile.rank}] to work → ${buildAgentCommandLine(profile.command, effectiveArgs)}`);
   logger.info(`  worker: ${workerName}`);
   logger.info(`  model: ${profile.model || '(none)'}; capabilities: ${profile.capabilities.join(', ') || '(none)'}`);
   logger.info(`  sandbox: ${sandbox}${isContainer ? ` (image ${image})` : ''}`);
   const profileEnvKeys = Object.keys(profileEnv);
   if (profileEnvKeys.length > 0) logger.info(`  harness env: ${profileEnvKeys.join(', ')}`);
+  if (autoMode) {
+    logger.info(`  enrolment: --auto (zero-config engine read${autoScope ? `, scope "${autoScope}"` : ', all agent job types'}) — no capability gate; serves any deployed agent job on this engine.`);
+  }
   const extraNote = extraJobTypes.length > 0 ? ` (${extraJobTypes.length} via --job-type)` : '';
   logger.info(`  listening on ${jobTypes.length} job type(s)${extraNote}: ${jobTypes.join('  ')}`);
   logger.info(`  max parallel: ${maxParallelJobs}; recovery window: ${recoveryWindowMs}ms; idle timeout: ${idleTimeoutMs}ms; hard cap: ${hardCapMs > 0 ? `${hardCapMs}ms` : 'off'}; poll timeout: ${pollTimeoutMs}ms`);
@@ -4248,12 +4414,20 @@ async function workAgent(req, flags) {
 
   for (const jobType of jobTypes) spawnJobType(jobType);
 
-  // ---- Live profile watch: reconcile the poller set when the watched profile's
-  // job types change (e.g. `c8ctl nano assign <name> …`) — start pollers for
-  // added types, gracefully drain pollers for removed types — without a restart
-  // and without disturbing unchanged types' in-flight work. ----
+  // ---- Live reconcile: keep the poller set in step with the desired job-type
+  // set — start pollers for added types, gracefully drain pollers for removed
+  // types — without a restart and without disturbing unchanged types' in-flight
+  // work. The DESIRED set comes from one of two sources depending on mode:
+  //   - default: the watched profile's rank×capability matrix (∪ --job-type),
+  //     reconciled when the on-disk profile changes (e.g. `nano assign`);
+  //   - --auto:  the engine's deployed *agent* job types, reconciled by polling
+  //     the engine (the deployed set changes as apps deploy/undeploy). ----
   const configFile = getConfigFile();
   const WATCH_INTERVAL_MS = 1500;
+  // How often `--auto` re-reads the engine's deployed agent job types to pick up
+  // newly deployed / undeployed agent processes. Deploys are occasional, so a
+  // few seconds of latency is fine; the read is a couple of cheap C8 REST calls.
+  const AUTO_POLL_INTERVAL_MS = 5000;
   let reconciling = false;
   // Set when a profile change arrives while a reconcile is already in flight, so
   // we run one more pass after the current drain completes instead of dropping
@@ -4263,10 +4437,21 @@ async function workAgent(req, flags) {
   // before snapshotting `workers` (avoids double-stops / missed drains).
   let inFlightReconcile = null;
 
-  // Desired job types from the CURRENT on-disk profile (matrix ∪ --job-type
-  // extras). Returns { skip } for a transient/torn read, a vanished profile, or
-  // an invalid edit — callers must then KEEP the running set, never tear down.
-  const desiredJobTypes = () => {
+  // Desired job types. In `--auto` this is the engine's deployed agent job types
+  // (∪ --job-type extras), read fresh each pass; a transient engine-read failure
+  // returns { skip } so the running set is KEPT, never torn down. Otherwise it is
+  // the CURRENT on-disk profile's matrix (∪ extras), with { skip } for a
+  // transient/torn read, a vanished profile, or an invalid edit — callers must
+  // then KEEP the running set, never tear down.
+  const desiredJobTypes = async () => {
+    if (autoMode) {
+      try {
+        const autoTypes = await resolveAutoJobTypes({ restConfig, scope: autoScope });
+        return { jobTypes: [...new Set([...autoTypes, ...extraJobTypes])] };
+      } catch (err) {
+        return { skip: `engine read failed: ${err?.message || err}` };
+      }
+    }
     let stored;
     try {
       stored = readHiresStrict()[name];
@@ -4309,9 +4494,11 @@ async function workAgent(req, flags) {
   };
 
   const runReconcilePass = async () => {
-      const desired = desiredJobTypes();
+      const desired = await desiredJobTypes();
       if (desired.skip) {
-        if (desired.skip === 'deleted') {
+        if (autoMode) {
+          logger.warn(`--auto reconcile skipped — ${desired.skip}; keeping the current ${workers.size} worker(s) running.`);
+        } else if (desired.skip === 'deleted') {
           logger.warn(`Profile "${name}" is gone from config — keeping the current ${workers.size} worker(s) running.`);
         } else {
           logger.warn(`Profile "${name}" reload skipped — ${desired.skip}; keeping current workers.`);
@@ -4320,7 +4507,8 @@ async function workAgent(req, flags) {
       }
       const { added, removed } = diffJobTypes([...workers.keys()], desired.jobTypes);
       if (added.length === 0 && removed.length === 0) return;
-      logger.info(`Profile "${name}" changed — reconciling job types (+${added.length} / -${removed.length}).`);
+      const source = autoMode ? 'engine deployed set' : `Profile "${name}"`;
+      logger.info(`${source} changed — reconciling job types (+${added.length} / -${removed.length}).`);
       for (const jt of added) {
         spawnJobType(jt);
         logger.info(`  + now listening on ${jt}`);
@@ -4344,37 +4532,58 @@ async function workAgent(req, flags) {
       logger.info(`  now listening on ${workers.size} job type(s): ${[...workers.keys()].join('  ')}`);
   };
 
-  // `watchFile` (polling stat) is deliberate over `fs.watch`: it survives the
-  // atomic temp+rename that `writeConfig` does (fs.watch would rebind to the old
-  // inode and go silent), and it's uniform across platforms. Profile edits are
-  // rare + manual, so a ~1.5s poll latency is fine.
-  watchFile(configFile, { interval: WATCH_INTERVAL_MS }, (curr, prev) => {
-    // Fires each interval; act only on real changes. Compare mtime, ctime and
-    // size, not mtime alone: on filesystems with coarse mtime resolution (or two
-    // edits within one mtime tick) mtimeMs can be unchanged while size/ctimeMs
-    // differ, and an mtime-only guard would skip a genuine profile update.
-    if (
-      curr.mtimeMs === prev.mtimeMs &&
-      curr.ctimeMs === prev.ctimeMs &&
-      curr.size === prev.size
-    ) return;
-    // `reconcile()` owns the `inFlightReconcile` handle: a change arriving while
-    // a reconcile is already running coalesces into the current pass and returns
-    // that same in-flight promise, so shutdown always waits for the real one.
-    reconcile().catch((err) => logger.warn(`profile reload failed: ${err?.message || err}`));
-  });
+  // Reconcile trigger. In `--auto` a periodic engine poll re-reads the deployed
+  // agent job types; otherwise a profile-file watch fires on profile edits.
+  let autoPollTimer = null;
+  if (autoMode) {
+    // Self-standing interval poll (not watchFile) since the desired set is
+    // derived from the engine, not the on-disk profile. Skip a tick while a
+    // reconcile is already in flight: calling reconcile() then would set
+    // reconcileRequested and make the in-flight pass loop back-to-back, so an
+    // engine read that consistently outlasts AUTO_POLL_INTERVAL_MS would run
+    // reconciles as fast as the read completes and hammer the broker. Skipping
+    // keeps polling rate-limited to the configured interval regardless of
+    // engine-read latency; the next tick re-reads the latest engine state.
+    autoPollTimer = setInterval(() => {
+      if (inFlightReconcile) return;
+      reconcile().catch((err) => logger.warn(`--auto reconcile failed: ${err?.message || err}`));
+    }, AUTO_POLL_INTERVAL_MS);
+    if (typeof autoPollTimer.unref === 'function') autoPollTimer.unref();
+  } else {
+    // `watchFile` (polling stat) is deliberate over `fs.watch`: it survives the
+    // atomic temp+rename that `writeConfig` does (fs.watch would rebind to the old
+    // inode and go silent), and it's uniform across platforms. Profile edits are
+    // rare + manual, so a ~1.5s poll latency is fine.
+    watchFile(configFile, { interval: WATCH_INTERVAL_MS }, (curr, prev) => {
+      // Fires each interval; act only on real changes. Compare mtime, ctime and
+      // size, not mtime alone: on filesystems with coarse mtime resolution (or two
+      // edits within one mtime tick) mtimeMs can be unchanged while size/ctimeMs
+      // differ, and an mtime-only guard would skip a genuine profile update.
+      if (
+        curr.mtimeMs === prev.mtimeMs &&
+        curr.ctimeMs === prev.ctimeMs &&
+        curr.size === prev.size
+      ) return;
+      // `reconcile()` owns the `inFlightReconcile` handle: a change arriving while
+      // a reconcile is already running coalesces into the current pass and returns
+      // that same in-flight promise, so shutdown always waits for the real one.
+      reconcile().catch((err) => logger.warn(`profile reload failed: ${err?.message || err}`));
+    });
+  }
 
   // Keep the process alive until a stop signal, then drain gracefully.
   await new Promise((resolve) => {
     const stop = async (signal) => {
       if (draining) return;
       draining = true;
-      // Stop watching first so no new reconcile can be triggered, then wait for
-      // any in-flight reconcile to finish before snapshotting `workers` — this
-      // prevents double-stops, missed drains, or a wrong worker count on exit.
-      unwatchFile(configFile);
+      // Stop the reconcile trigger first so no new reconcile can be triggered,
+      // then wait for any in-flight reconcile to finish before snapshotting
+      // `workers` — this prevents double-stops, missed drains, or a wrong worker
+      // count on exit.
+      if (autoPollTimer) clearInterval(autoPollTimer);
+      else unwatchFile(configFile);
       if (inFlightReconcile) {
-        logger.info('Waiting for in-flight profile reconcile to finish before shutdown…');
+        logger.info('Waiting for in-flight reconcile to finish before shutdown…');
         await inFlightReconcile;
       }
       const list = [...workers.values()];
@@ -4465,6 +4674,8 @@ const WORK_FORWARD_FLAGS = {
   'clone-timeout': 'value',
   'keep-runs': 'boolean',
   stream: 'boolean',
+  auto: 'boolean',
+  'auto-scope': 'value',
   arg: 'list',
   env: 'list',
   'job-type': 'list',
@@ -4477,11 +4688,21 @@ const WORK_FORWARD_FLAGS = {
 function reconstructWorkArgs(flags) {
   const out = [];
   if (!flags || typeof flags !== 'object') return out;
+  // `--auto-scope` is meaningless without `--auto` — `workAgent` exits fast with
+  // "--auto-scope requires --auto". Forwarding the orphan flag to a supervised
+  // worker would guarantee an immediate crash/restart loop, so drop it here at
+  // the forwarding boundary when `--auto` is not truthy (mirrors that guard).
+  // Parse booleans through `coerceBool()` so forwarding matches `workAgent`'s
+  // parsing semantics — c8ctl may pass boolean flags as strings like `'1'`,
+  // `'yes'` or `'on'`, and treating only `true`/`'true'` as enabled would
+  // silently drop `--auto`/`--keep-runs`/`--stream` for supervised workers.
+  const autoOn = coerceBool(flags.auto, false);
   for (const [name, kind] of Object.entries(WORK_FORWARD_FLAGS)) {
+    if (name === 'auto-scope' && !autoOn) continue;
     const v = flags[name];
     if (v === undefined || v === null) continue;
     if (kind === 'boolean') {
-      if (v === true || v === 'true') out.push(`--${name}`);
+      if (coerceBool(v, false)) out.push(`--${name}`);
     } else if (kind === 'list') {
       const items = Array.isArray(v) ? v : [v];
       for (const item of items) {
@@ -5789,6 +6010,183 @@ function compareSemver(a, b) {
   return 0;
 }
 
+// ---------------------------------------------------------------------------
+// Update changelog. `update --check` (and the pre-pull path of a real update)
+// shows what changed between the installed release and latest. The authoritative
+// source is this plugin's PUBLIC GitHub Releases — semantic-release records the
+// generated notes there (@semantic-release/github). The committed CHANGELOG.md
+// is deliberately NOT maintained (the release config dropped the changelog/git
+// plugins so it never pushes to the protected `main`) and isn't even in the npm
+// `files`, so it can't be the source. Every lookup here is best-effort and
+// non-blocking: any failure (offline, rate-limited, private) degrades to a link,
+// never to a failed `update`.
+// ---------------------------------------------------------------------------
+
+/** `owner/repo` parsed from the plugin package's `repository` field (null if absent). */
+function githubRepoSlug() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(pluginDir, 'package.json'), 'utf8'));
+    const raw = pkg?.repository?.url ?? (typeof pkg?.repository === 'string' ? pkg.repository : '');
+    const m = String(raw).match(/github\.com[/:]([^/\s]+\/[^/\s]+?)(?:\.git)?(?:[/#?].*)?$/i);
+    return m ? m[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Keep only the releases strictly newer than `currentVersion` and no newer than
+ * `latestVersion` (when known), newest-first. Pure over its `releases` input (an
+ * array of GitHub release objects) so it is unit-testable without a network call.
+ */
+function filterReleasesSince(releases, currentVersion, latestVersion) {
+  if (!Array.isArray(releases)) return [];
+  const items = [];
+  for (const r of releases) {
+    if (!r || r.draft || r.prerelease) continue;
+    const tag = r.tag_name || r.name || '';
+    const norm = String(tag).replace(/^v/, '');
+    // Require a plain vX.Y.Z tag: a prerelease/build suffix (e.g. -rc.1, +meta)
+    // must exclude the release rather than be normalised away into the window.
+    if (!/^\d+\.\d+\.\d+$/.test(norm)) continue;
+    const ver = norm;
+    if (!currentVersion || compareSemver(ver, currentVersion) <= 0) continue;
+    if (latestVersion && compareSemver(ver, latestVersion) > 0) continue;
+    items.push({ version: ver, tag, body: r.body || '', url: r.html_url || '' });
+  }
+  items.sort((a, b) => compareSemver(b.version, a.version));
+  return items;
+}
+
+/**
+ * Render one semantic-release release body to tight terminal lines: drop the
+ * redundant `# [x.y.z](…)` header, turn `### Features` into a `Features:` label,
+ * flatten `* **scope:** subject ([abc](url))` bullets to `• scope: subject`
+ * (stripping any `([label](url))` commit/PR link groups and inlining any
+ * remaining `[text](url)` as its text). Returns an array of already-indented lines.
+ */
+function renderReleaseBody(body) {
+  const out = [];
+  for (const line of String(body).split(/\r?\n/)) {
+    if (/^#{1,2}\s+\[?\d+\.\d+\.\d+/.test(line)) continue; // redundant version header
+    const heading = line.match(/^#{2,3}\s+(.*\S)\s*$/);
+    if (heading) {
+      out.push(`    ${heading[1]}:`);
+      continue;
+    }
+    const bullet = line.match(/^\s*[*-]\s+(.*)$/);
+    if (bullet) {
+      let text = bullet[1]
+        .replace(/\s*\(\[[^\]]*\]\([^)]*\)\)/g, '') // ([label](url)) commit/PR link groups
+        .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1') // inline [text](url) -> text
+        .replace(/\*\*(.*?)\*\*/g, '$1') // **scope** -> scope
+        .replace(/\s+/g, ' ')
+        .trim();
+      if (text) out.push(`      \u2022 ${text}`);
+    }
+  }
+  return out;
+}
+
+/** Cap on release pages walked, so a repo with a huge history can never hang the walk. */
+const RELEASE_PAGE_LIMIT = 20;
+
+/**
+ * True once a page contains a published (non-draft/non-prerelease) vX.Y.Z release
+ * at or below `current`. Because the releases API returns newest-first, everything
+ * after that point is older than the installed version, so the walk can stop.
+ */
+function reachedInstalledRelease(page, current) {
+  if (!current || !Array.isArray(page)) return false;
+  for (const r of page) {
+    if (!r || r.draft || r.prerelease) continue;
+    const norm = String(r.tag_name || r.name || '').replace(/^v/, '');
+    if (!/^\d+\.\d+\.\d+$/.test(norm)) continue;
+    if (compareSemver(norm, current) <= 0) return true;
+  }
+  return false;
+}
+
+/**
+ * Fetch this plugin's GitHub releases newer than `current` (best-effort; null on
+ * any failure). Paginates newest-first, stopping as soon as it reaches the
+ * installed release (or a bounded page cap), so the window stays accurate even
+ * when the installed version is far behind and there are >100 releases since.
+ */
+async function fetchReleaseNotesSince(slug, current, latest, timeoutMs = 5000) {
+  if (!slug) return null;
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    const headers = {
+      accept: 'application/vnd.github+json',
+      'user-agent': 'c8ctl-plugin-nano',
+      'x-github-api-version': '2022-11-28',
+    };
+    const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+    if (token) headers.authorization = `Bearer ${token}`;
+    try {
+      const all = [];
+      for (let page = 1; page <= RELEASE_PAGE_LIMIT; page++) {
+        const res = await fetch(
+          `https://api.github.com/repos/${slug}/releases?per_page=100&page=${page}`,
+          { headers, redirect: 'follow', signal: ctrl.signal },
+        );
+        if (!res.ok) return null;
+        const arr = await res.json();
+        if (!Array.isArray(arr) || arr.length === 0) break;
+        all.push(...arr);
+        // Newest-first: once we hit the installed release (or a short final
+        // page), everything remaining is older than `current` — stop early.
+        if (arr.length < 100 || reachedInstalledRelease(arr, current)) break;
+      }
+      return filterReleasesSince(all, current, latest);
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Print the changelog between the installed release and `latest`. Best-effort:
+ * on any fetch failure it prints a single line pointing at the releases page and
+ * returns, so it can never block or fail an `update`.
+ */
+async function printChangelogSince(_name, current, latest) {
+  const logger = getLogger();
+  const slug = githubRepoSlug();
+  const releasesUrl = slug ? `https://github.com/${slug}/releases` : null;
+  const releases = await fetchReleaseNotesSince(slug, current, latest);
+
+  if (releases === null) {
+    if (releasesUrl) logger.info(`See what changed: ${releasesUrl}`);
+    logger.info('');
+    return;
+  }
+  if (releases.length === 0) {
+    // Nothing resolved between the two (only a build-metadata bump, or a
+    // degraded resolution: current is null / tags don't match vX.Y.Z). Point
+    // at the releases page so the best-effort feature still leaves a trail.
+    if (releasesUrl) logger.info(`See what changed: ${releasesUrl}`);
+    logger.info('');
+    return;
+  }
+
+  logger.info(`What's changed since v${current ?? '?'}:`);
+  logger.info('');
+  for (const rel of releases) {
+    logger.info(`  v${rel.version}`);
+    const lines = renderReleaseBody(rel.body);
+    if (lines.length === 0) logger.info('      (no notes)');
+    else for (const l of lines) logger.info(l);
+    logger.info('');
+  }
+  if (releasesUrl) logger.info(`Full release notes: ${releasesUrl}`);
+  logger.info('');
+}
+
 /**
  * Resolve how npm must be spawned on the given platform. Spawning `npm`
  * directly is not portable: on Windows npm is a `npm.cmd` shim, so bare
@@ -5921,7 +6319,8 @@ function manualUpdateCommand(name, info) {
   return `  npm install -g ${name}@latest`;
 }
 
-function updatePlugin(req) {
+async function updatePlugin(req) {
+  const logger = getLogger();
   const { name, version: current } = pluginPackage();
 
   // The nano server binary ships with the plugin as its platform package
@@ -5942,44 +6341,47 @@ function updatePlugin(req) {
   const info = pluginInstallInfo();
   const manual = manualUpdateCommand(name, info);
 
-  console.log(`Installed: ${name} v${current ?? '?'}${nanoNote}`);
+  logger.info(`Installed: ${name} v${current ?? '?'}${nanoNote}`);
 
   let latest;
   try {
     latest = npmLatestVersion(name);
   } catch (err) {
-    console.log(`Could not check npm for updates: ${err.message}`);
-    console.log('Pull the latest release manually with:');
-    console.log(manual);
+    logger.info(`Could not check npm for updates: ${err.message}`);
+    logger.info('Pull the latest release manually with:');
+    logger.info(manual);
     return;
   }
-  console.log(`Latest:    ${name} v${latest}  (npm)`);
-  console.log('');
+  logger.info(`Latest:    ${name} v${latest}  (npm)`);
+  logger.info('');
 
   if (current && compareSemver(current, latest) >= 0) {
     if (!nanoBin) {
       // Plugin is current but npm never fetched the matching server binary.
-      console.log('Plugin is current, but the nano server binary is not installed for this platform.');
-      console.log('Provision it by reinstalling the plugin so npm fetches the platform package:');
-      console.log('  c8ctl sync plugin');
+      logger.info('Plugin is current, but the nano server binary is not installed for this platform.');
+      logger.info('Provision it by reinstalling the plugin so npm fetches the platform package:');
+      logger.info('  c8ctl sync plugin');
       return;
     }
-    console.log('Already on the latest release — nothing to do.');
+    logger.info('Already on the latest release — nothing to do.');
     return;
   }
 
-  console.log(`Update available: v${current ?? '?'} -> v${latest}`);
+  logger.info(`Update available: v${current ?? '?'} -> v${latest}`);
+  logger.info('');
+
+  await printChangelogSince(name, current, latest);
 
   if (req.check) {
-    console.log('Run `c8ctl nano update` to pull it (or manually):');
-    console.log(manual);
+    logger.info('Run `c8ctl nano update` to pull it (or manually):');
+    logger.info(manual);
     return;
   }
 
   if (info.mode === 'local') {
-    console.log('This plugin runs from a local checkout, so it cannot self-update in place.');
-    console.log('Update it with:');
-    console.log(manual);
+    logger.info('This plugin runs from a local checkout, so it cannot self-update in place.');
+    logger.info('Update it with:');
+    logger.info(manual);
     return;
   }
 
@@ -5988,8 +6390,8 @@ function updatePlugin(req) {
       ? ['install', `${name}@${latest}`, '--prefix', info.prefix]
       : ['install', '-g', `${name}@${latest}`];
   const where = info.mode === 'managed' ? 'the c8ctl plugin store' : "npm's global prefix";
-  console.log(`Pulling ${name}@${latest} into ${where}...`);
-  console.log('');
+  logger.info(`Pulling ${name}@${latest} into ${where}...`);
+  logger.info('');
   try {
     runNpm(installArgs, { stdio: 'inherit' });
   } catch (err) {
@@ -6006,14 +6408,14 @@ function updatePlugin(req) {
       `npm ${installArgs.join(' ')} failed${code}. ${hint}`,
     );
   }
-  console.log('');
+  logger.info('');
   if (info.mode === 'managed') {
-    console.log(`Updated to v${latest}. The new plugin and bundled nano server load on your next c8ctl command.`);
+    logger.info(`Updated to v${latest}. The new plugin and bundled nano server load on your next c8ctl command.`);
   } else {
-    console.log(`Updated to v${latest}.`);
+    logger.info(`Updated to v${latest}.`);
   }
-  console.log('Restart any running cluster to use the new server binary:');
-  console.log('  c8ctl nano restart');
+  logger.info('Restart any running cluster to use the new server binary:');
+  logger.info('  c8ctl nano restart');
 }
 
 // ---------------------------------------------------------------------------
@@ -7061,6 +7463,7 @@ function parseProcessosRequest(args, flags) {
 export { resolveBinary, findBinary, launcherEnvMarkers };
 export { setConfig, unsetConfig, readConfig, writeConfig, getConfigFile, SETTING_ALIASES };
 export { buildNpmInvocation };
+export { compareSemver, githubRepoSlug, filterReleasesSince, renderReleaseBody };
 export {
   webConsoleUrl,
   consoleLinkLabel,
@@ -7119,6 +7522,10 @@ export {
   jobTypeMatrix,
   diffJobTypes,
   parseJobTypeFlags,
+  serviceTaskHasAgentHeader,
+  scanAgentTaskLeaves,
+  readDeployedAgentJobTypes,
+  resolveAutoJobTypes,
   derivePollTimeoutMs,
   AGENT_TASK_NS,
   AGENT_RESULT_KEY,
@@ -7190,7 +7597,7 @@ export const metadata = {
         { command: 'c8ctl nano set model-dir <path>', description: 'Set the workspace dir (models + workers)' },
         { command: 'c8ctl nano config', description: 'Show current plugin configuration and paths' },
         { command: 'c8ctl nano update', description: 'Pull the latest published nano release (re-installs via npm)' },
-        { command: 'c8ctl nano update --check', description: 'Check whether a newer nano release is available' },
+        { command: 'c8ctl nano update --check', description: 'Check for a newer nano release and show the changelog since the installed version (no install)' },
         { command: 'c8ctl nano hire', description: 'Interactively create a CLI agent worker profile (name, rank, command, model, capabilities)' },
         { command: 'c8ctl nano hire --name reviewer --rank senior --command copilot --model gpt-5 --capabilities code-review,testing', description: 'Create a profile non-interactively' },
         { command: 'c8ctl nano hire --name coder --rank senior --command copilot --arg --allow-all', description: 'Hire copilot with a command-line switch (copilot --allow-all)' },
@@ -7200,6 +7607,8 @@ export const metadata = {
         { command: 'c8ctl nano hire --name coder --rank senior --command copilot --terminal pty', description: 'Opt this role into a full, steerable live terminal (PTY) streamed on the agentic relay lane (default: pipe)' },
         { command: 'c8ctl nano assign reviewer code-review,testing', description: 'Grant more capabilities (comma-separated, like hire) to an existing hire — additive; running workers hot-reload it' },
         { command: 'c8ctl nano work reviewer', description: 'Spawn Nano job workers for the "reviewer" profile and poll for work' },
+        { command: 'c8ctl nano work coder --auto', description: 'Zero-config: serve every deployed agent job type read straight from the engine — no capability, no wiring (great for a local single-tenant plane)' },
+        { command: 'c8ctl nano work coder --auto --auto-scope my-app', description: 'Zero-config, scoped to one app: serve only agent job types deployed under process ids prefixed "my-app"' },
         { command: 'c8ctl nano work coder --sandbox docker --image ghcr.io/acme/agent:1', description: 'Run jobs in isolated containers with disk-hygiene reaping' },
         { command: 'NANO_AGENTIC_URL=http://localhost:8080 NANO_AGENTIC_TOKEN=<identity-token> NANO_AGENTIC_CREDENTIAL=<capability-cred> c8ctl nano work reviewer', description: 'Enrol the worker on the app\'s same-port /agentic channel so it appears live (presence + relay terminals) on the Workforce visibility page' },
         { command: 'c8ctl nano supervisor start --worker reviewer --worker coder', description: 'Start a detached supervisor managing several workers from one terminal' },
@@ -7247,7 +7656,7 @@ export const commands = {
       purge: { type: 'boolean', description: 'stop/restart: also delete per-node engine data' },
       force: { type: 'boolean', description: 'start: stop any existing cluster first' },
       workspace: { type: 'boolean', description: 'clean: also delete the workspace (models + workers)' },
-      check: { type: 'boolean', description: 'update: only report whether a new release is available; do not install' },
+      check: { type: 'boolean', description: 'update: report whether a new release is available (with the changelog since the installed version); do not install' },
       binary: { type: 'string', description: 'Path to the nanobpmn server binary' },
       name: { type: 'string', description: 'work/supervisor add: worker name (auto ‹host›-‹profile›-‹random› if omitted); hire/assign: agent profile name' },
       rank: { type: 'string', description: 'hire: agent rank (principal|senior|junior|decider)' },
@@ -7274,6 +7683,8 @@ export const commands = {
       'lock-grace': { type: 'string', description: 'work: DEPRECATED and ignored — the broker lock is now auto-managed via --recovery-window.' },
       'poll-timeout': { type: 'string', description: 'work: broker long-poll window in ms each activateJobs request is held open (fewer reconnects → fewer transient connect errors); default 30000, 0 = broker default, negative = return immediately' },
       'job-type': { type: 'string', multiple: true, description: 'work: extra job type to service alongside the rank×capability matrix (repeatable)' },
+      auto: { type: 'boolean', description: 'work: zero-config enrolment — serve ALL deployed agent job types read straight from the engine (no capability, no app enrol endpoint, no channel). Mutually exclusive with capability-resolved serving; has NO capability gate (serves any deployed agent job on the engine).' },
+      'auto-scope': { type: 'string', description: 'work: with --auto, narrow the served agent job types to those whose bpmn:process id equals or is prefixed by this value (one app/network). Default: all agent job types on the engine.' },
       worker: { type: 'string', multiple: true, description: 'supervisor start: profile to launch as a supervised worker (repeatable)' },
       instances: { type: 'string', description: `supervisor add: spawn N distinct auto-named instances of the profile in one call (default 1, max ${MAX_ADD_INSTANCES}; cannot combine with --name)` },
       attach: { type: 'boolean', description: 'supervisor start: attach the interactive console after starting the daemon' },
@@ -7326,7 +7737,7 @@ export const commands = {
             showConfig();
             break;
           case 'update':
-            updatePlugin(req);
+            await updatePlugin(req);
             break;
           case 'hire':
             await hireWorker(req, flags);
@@ -7431,7 +7842,7 @@ function printUsage() {
   console.log('  c8ctl nano update [--check]');
   console.log('  c8ctl nano hire [--name <n>] [--rank <r>] [--command <c>] [--arg <switch> ...] [--model <m>] [--capabilities <a,b>] [--sandbox none|docker|podman] [--image <ref>] [--terminal pty|pipe] [--env NAME=VALUE ...] [--list]');
   console.log('  c8ctl nano assign <profileName> <cap[,cap...]> [--name <n>] [--capabilities <a,b>]');
-  console.log('  c8ctl nano work <profileName> [--arg <switch> ...] [--max-parallel <n>] [--recovery-window <ms>] [--idle-timeout <ms>] [--job-timeout <ms>] [--poll-timeout <ms>] [--job-type <token> ...] [--sandbox none|docker|podman] [--image <ref>] [--env NAME=VALUE ...] [--secret-resolver host] [--min-free-mb <n>] [--clone-timeout <ms>] [--keep-runs] [--stream]');
+  console.log('  c8ctl nano work <profileName> [--auto [--auto-scope <p>]] [--arg <switch> ...] [--max-parallel <n>] [--recovery-window <ms>] [--idle-timeout <ms>] [--job-timeout <ms>] [--poll-timeout <ms>] [--job-type <token> ...] [--sandbox none|docker|podman] [--image <ref>] [--env NAME=VALUE ...] [--secret-resolver host] [--min-free-mb <n>] [--clone-timeout <ms>] [--keep-runs] [--stream]');
   console.log('  c8ctl nano supervisor [start|status|add|remove|restart|stop|logs|attach] ... (manage many workers from one terminal)');
   console.log('');
   console.log('Subcommands:');
@@ -7478,6 +7889,8 @@ function printUsage() {
   console.log('  --list               hire: list existing agent profiles instead of creating one');
   console.log('  --max-parallel <n>   work: max concurrent jobs per worker (default 1)');
   console.log('  --job-type <token>   work: extra job type to service alongside the rank×capability matrix (repeatable)');
+  console.log('  --auto               work: zero-config enrolment — serve ALL deployed agent job types read from the engine (no capability, no app enrol endpoint, no channel). NO capability gate: serves any deployed agent job on the engine.');
+  console.log('  --auto-scope <p>     work: with --auto, narrow to agent job types whose bpmn:process id equals or is prefixed by <p> (one app/network); default all');
   console.log('  --recovery-window <ms> work: broker activation-lock window, auto-refreshed while the agent runs; also the node-loss reclaim time (default 300000)');
   console.log('  --idle-timeout <ms>  work: max silence (no agent stdout/stderr) before the harness is killed as wedged and the job reclaimed (default 300000)');
   console.log('  --job-timeout <ms>   work: OPTIONAL absolute hard cap on total harness runtime; killed past this (default 0 = unlimited)');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -57,12 +57,12 @@
   },
   "optionalDependencies": {
     "node-pty": "^1.0.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.31.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.31.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.31.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.31.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.31.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.31.0",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.31.0"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.33.0",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.33.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.33.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.33.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.33.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.33.0",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.33.0"
   }
 }