c8ctl-plugin-nano 1.38.1 → 1.39.1

package/c8ctl-plugin.js

@@ -2458,18 +2458,12 @@ function resolveBrokerRestConfig(env = process.env, opts = {}) {
 // exposes no usable restAddress. The token same-origin gate lives in
 // resolveBrokerRestConfig (re-run against the profile base), never duplicated.
 function resolveAutoRestConfig(camunda, env = process.env) {
-  const cfg = readConfig() || {};
-  const hasExplicitBase = Boolean(env.NANO_REST_URL || env.NANO_BASE_URL || cfg.nanoUrl);
-  if (!hasExplicitBase && camunda && typeof camunda.getConfig === 'function') {
-    let profileBase = '';
-    try {
-      profileBase = normalizeRestBase(camunda.getConfig()?.restAddress);
-    } catch {
-      // ignore — degrade to the resolveBrokerRestConfig (localhost) default below
-    }
-    if (profileBase) return resolveBrokerRestConfig(env, { baseUrl: profileBase });
-  }
-  return resolveBrokerRestConfig(env);
+  // Derive the base from the single canonical resolver (explicit override →
+  // profile restAddress → localhost), then run it through resolveBrokerRestConfig
+  // so the token same-origin gate stays single-sourced. resolveWorkerEngineBase
+  // always returns a base, so opts.baseUrl always pins it here.
+  const baseUrl = resolveWorkerEngineBase(camunda, env);
+  return resolveBrokerRestConfig(env, { baseUrl });
 }
 
 // ---------------------------------------------------------------------------
@@ -2483,82 +2477,43 @@ function resolveAutoRestConfig(camunda, env = process.env) {
 // exist" is answerable from that engine alone.
 //
 // `@nanobpm/agentic/demand` already reads deployed `taskDefinition` leaves over
-// C8 REST (`process-definitions/search` → `/{key}/xml`), but its scanner reads
-// type/element/process only. Not every service task is an agent task — plain
-// connectors and record-keepers (e.g. `pr.record-plan`) are ordinary workers.
-// The demand scanner is therefore extended HERE to read `zeebe:taskHeaders` and
-// keep only leaves whose service task carries an `io.nanobpm.agentTask.` header
-// (e.g. `senior:plan` carries `io.nanobpm.agentTask.task.prompt`; a record-keeper
-// does not). Advertise the raw job-type string the engine matches (`senior:plan`)
-// verbatim — colon-named types are NOT forced through the agentic dot-grammar.
+// C8 REST (`process-definitions/search` → `/{key}/xml`). As of
+// `@nanobpm/agentic@0.4.0` its `scanTaskDefinitions(xml)` tags every leaf with a
+// canonical `agentic: boolean` — true iff the service task declares a
+// `<zeebe:linkedResource … linkName="prompt">` base-prompt side-car (its internal
+// `hasPromptLink`). That flag is the SINGLE SOURCE OF TRUTH for agentic-ness (see
+// the package's `demand/taskdef.d.ts` and nano-workforce SPEC "Agent job
+// contract"): every external agent task delivers its base prompt through a
+// `linkName="prompt"` linked resource, and no in-process worker task does. Not
+// every service task is an agent task — plain connectors and record-keepers
+// (e.g. `pr.record-plan`) are ordinary workers, and they carry no prompt link.
+//
+// Per AGENTS.md "Derivation Over Duplication: No Drift Surfaces", this plugin
+// CONSUMES that flag rather than re-implementing the scan, so the detector can
+// never drift out of lock-step with the package again (as it did in #95, when a
+// local copy keyed on the legacy `io.nanobpm.agentTask` header missed the current
+// linked-prompt marker). Advertise the raw job-type string the engine matches
+// (`senior:plan`) verbatim — colon-named types are NOT forced through the agentic
+// dot-grammar.
 // ---------------------------------------------------------------------------
 
-// True iff a serviceTask body carries a `zeebe:header` (inside its
-// `zeebe:taskHeaders`) under the agent-task
-// namespace — the LEGACY marker that distinguishes an agent task from a plain
-// connector / record-keeper. Matches the exact `io.nanobpm.agentTask` key and
-// any flattened `io.nanobpm.agentTask.*` dotpath key (element templates emit the
-// latter, e.g. `io.nanobpm.agentTask.task.prompt`). Older deployments carry this;
-// the current `@nanobpm/workflow` toolchain emits the linked-prompt marker below
-// instead, so BOTH must be recognised (jwulf/c8ctl-plugin-nano#95).
-function serviceTaskHasAgentHeader(body) {
-  const headerRe = /<zeebe:header\b[^>]*\bkey\s*=\s*"([^"]*)"/g;
-  let m;
-  while ((m = headerRe.exec(body)) !== null) {
-    const key = m[1];
-    if (key === AGENT_TASK_NS || key.startsWith(`${AGENT_TASK_NS}.`)) return true;
-  }
-  return false;
-}
-
-// True iff a serviceTask body links a prompt resource — the CURRENT canonical
-// agent-task marker emitted by `@nanobpm/workflow` / the Urban toolchain:
-// `<zeebe:linkedResource … resourceType="GenericScript" linkName="prompt" />`.
-// An agent task links the model/prompt the harness runs; a plain connector /
-// record-keeper does not. Matched by the `linkName="prompt"` binding (attribute
-// order-independent) so a compiled model with no `io.nanobpm.agentTask` header
-// is still discovered (jwulf/c8ctl-plugin-nano#95). Kept in lock-step with the
-// authored nano-workforce models (resources/processes/*.bpmn), where every
-// `senior:*` service task carries this binding and none carry the legacy header.
-// NOTE: this mirrors `@nanobpm/agentic@0.4.0`'s released `scanTaskDefinitions`
-// `agentic` flag (its internal `hasPromptLink`); #102 tracks replacing this local
-// copy by consuming that detector once the `^0.1.0 → ^0.4.0` bump is vetted.
-function serviceTaskHasLinkedPrompt(body) {
-  const re = new RegExp(`<zeebe:linkedResource\\b[^>]*\\blinkName\\s*=\\s*"${DEFAULT_PROMPT_LINK_NAME}"`);
-  return re.test(String(body || ''));
-}
-
-// True iff a serviceTask is an *agent* task — by EITHER the legacy
-// `io.nanobpm.agentTask.*` header OR the current linked-prompt marker. Either
-// alone is sufficient; deployments in the wild carry one or the other.
-function serviceTaskIsAgentTask(body) {
-  return serviceTaskHasAgentHeader(body) || serviceTaskHasLinkedPrompt(body);
-}
-
-// Scan one deployed BPMN document for its *agent* task-definition leaves: every
-// `<bpmn:serviceTask>` carrying BOTH a non-empty `<zeebe:taskDefinition type>`
-// AND an agent-task marker (legacy `io.nanobpm.agentTask.` header OR a
+// Scan one deployed BPMN document for its *agent* task-definition leaves: the
+// subset of `@nanobpm/agentic` `demand.scanTaskDefinitions(xml)` leaves whose
+// canonical `agentic` flag is set (i.e. the service task declares a
 // `linkName="prompt"` linked resource). Returns `{ taskType, process }` leaves in
-// first-occurrence order. This is the agent-aware extension of the demand
-// package's `scanTaskDefinitions` (which reads type/element/process only).
-function scanAgentTaskLeaves(xml) {
-  const source = String(xml || '');
-  const procMatch = source.match(/<bpmn:process\b[^>]*\bid\s*=\s*"([^"]*)"/);
-  const proc = procMatch ? procMatch[1] : '';
-  const out = [];
-  const blockRe = /<bpmn:serviceTask\b[^>]*>([\s\S]*?)<\/bpmn:serviceTask>/g;
-  let block;
-  while ((block = blockRe.exec(source)) !== null) {
-    const body = block[1];
-    const tdMatch = body.match(/<zeebe:taskDefinition\b[^>]*>/);
-    if (!tdMatch) continue;
-    const typeMatch = tdMatch[0].match(/\btype\s*=\s*"([^"]*)"/);
-    const taskType = typeMatch ? typeMatch[1] : '';
-    if (!taskType) continue;
-    if (!serviceTaskIsAgentTask(body)) continue;
-    out.push({ taskType, process: proc });
+// first-occurrence order. The published `scanTaskDefinitions` is INJECTED so this
+// stays a pure, synchronous function; `readDeployedAgentJobTypes` supplies the
+// real one from the lazily-imported demand surface (`agentic.mjs`).
+function scanAgentTaskLeaves(xml, scanTaskDefinitions) {
+  if (typeof scanTaskDefinitions !== 'function') {
+    throw new TypeError(
+      'scanAgentTaskLeaves: `scanTaskDefinitions` must be an injected function ' +
+        `(got ${typeof scanTaskDefinitions}); pass demand.scanTaskDefinitions from ./agentic.mjs`
+    );
   }
-  return out;
+  return scanTaskDefinitions(String(xml || ''))
+    .filter((leaf) => leaf.agentic)
+    .map((leaf) => ({ taskType: leaf.taskType, process: leaf.process }));
 }
 
 // Read the distinct deployed *agent* job types through a demand C8RestReader
@@ -2567,12 +2522,13 @@ function scanAgentTaskLeaves(xml) {
 // optional `scope` narrows to one app/network — kept only when the leaf's
 // `bpmn:process` id equals or is prefixed by the scope string.
 async function readDeployedAgentJobTypes(reader, { scope = '' } = {}) {
+  const { demand } = await import('./agentic.mjs');
   const keys = await reader.searchProcessDefinitionKeys();
   const seen = new Set();
   const out = [];
   for (const key of keys) {
     const xml = await reader.getProcessDefinitionXml(key);
-    for (const leaf of scanAgentTaskLeaves(xml)) {
+    for (const leaf of scanAgentTaskLeaves(xml, demand.scanTaskDefinitions)) {
       if (scope && !(leaf.process === scope || leaf.process.startsWith(scope))) continue;
       if (seen.has(leaf.taskType)) continue;
       seen.add(leaf.taskType);
@@ -2685,28 +2641,117 @@ function normalizeRestBase(addr) {
   return String(addr || '').replace(/\/+$/, '').replace(/\/v2$/i, '');
 }
 
+// The ONE place that answers "what engine base does this worker use?" — the
+// single source of truth for the worker's engine-base precedence chain:
+//
+//   explicit override (NANO_REST_URL → NANO_BASE_URL → persisted cfg.nanoUrl)
+//     → active c8ctl profile restAddress (the client that activates jobs)
+//     → localhost default (DEFAULT_NANO_URL).
+//
+// Every worker engine reference derives from this (derivation over duplication):
+// the `--auto` job-type read (resolveAutoRestConfig, injecting it into the
+// resolveBrokerRestConfig token gate), the linked-prompt fetch
+// (resolveLinkedPromptSource), the `supervisor status` engine column
+// (workerEngine), and the agentic visibility channel base (resolveAgenticConfig).
+// Before this existed the chain was hand-copied at each site and the agentic copy
+// silently lost the profile fallback, so a profile-only remote worker degraded to
+// its own localhost and never enrolled (jwulf/c8ctl-plugin-nano#107, sibling of
+// #93/#99). Sharing this resolver fixes that by construction and removes the
+// drift surface. The token same-origin gate stays in resolveBrokerRestConfig,
+// never duplicated here.
+function resolveWorkerEngineBase(camunda, env = process.env) {
+  // readConfig() swallows parse/IO errors and returns {} — never throws.
+  const cfg = readConfig() || {};
+  const explicit = env.NANO_REST_URL || env.NANO_BASE_URL || cfg.nanoUrl;
+  if (explicit) return normalizeRestBase(explicit);
+  if (camunda && typeof camunda.getConfig === 'function') {
+    try {
+      const profileBase = normalizeRestBase(camunda.getConfig()?.restAddress);
+      if (profileBase) return profileBase;
+    } catch {
+      // degrade to the localhost default below rather than throw
+    }
+  }
+  return DEFAULT_NANO_URL;
+}
+
+// The engine authority reported in the supervisor activity marker's ENGINE
+// column (#99): the base the worker actually POLLS JOBS from. The SDK job worker
+// (`camunda.createJobWorker`) activates jobs against the client's OWN profile
+// restAddress — which is NOT affected by the explicit NANO_REST_URL / NANO_BASE_URL
+// / cfg.nanoUrl overrides that resolveWorkerEngineBase prefers for auxiliary REST
+// reads (linked prompts, `--auto` reads, agentic channel). Reporting an override
+// there would make the ENGINE column claim an engine the worker is not polling,
+// violating supervisorEngineCell's "engine this worker polls jobs from" contract.
+// So prefer the profile restAddress (the polling engine) and fall back to the
+// canonical resolver only when the client exposes no usable base.
+function resolveWorkerPollEngineBase(camunda, env = process.env) {
+  if (camunda && typeof camunda.getConfig === 'function') {
+    try {
+      const profileBase = normalizeRestBase(camunda.getConfig()?.restAddress);
+      if (profileBase) return profileBase;
+    } catch {
+      // degrade to the canonical resolver below rather than throw
+    }
+  }
+  return resolveWorkerEngineBase(camunda, env);
+}
+
+// The base URL for a linked-prompt fetch. A linked-resource `resourceKey` is
+// BROKER-LOCAL: it lives on the engine the SDK client activated this job against
+// — the polling engine (its OWN profile restAddress). So the prompt fetch must
+// target that same broker, NOT the NANO_BASE_URL / cfg.nanoUrl auxiliary-read
+// overrides that resolveWorkerEngineBase prefers. Those overrides steer reads
+// that are NOT broker-local; honoring them here makes the base drift from the
+// activation broker so a broker-local resourceKey 404s ("prompt resource N fetch
+// failed") even while job activation still succeeds. Precedence:
+//
+//   explicit NANO_REST_URL  (same-broker escape hatch, e.g. a caching proxy in
+//                            front of the polling engine)
+//     → polling engine base (resolveWorkerPollEngineBase → profile restAddress)
+//     → localhost default.
+//
+// NANO_REST_URL is retained as an explicit escape hatch, but NANO_BASE_URL /
+// cfg.nanoUrl are deliberately NOT — steering the prompt fetch to a different
+// engine than the one that issued the broker-local resourceKey is the very bug
+// this resolves.
+function resolveLinkedPromptBase(camunda, env = process.env) {
+  const explicit = env.NANO_REST_URL;
+  if (explicit) return normalizeRestBase(explicit);
+  return resolveWorkerPollEngineBase(camunda, env);
+}
+
 // Derive the linked-resource fetch base URL + auth headers from the SAME SDK
 // client that activated the job. A linked-resource `resourceKey` is broker-local,
-// so prompt content must be fetched from the broker this worker is connected to
-// — never a localhost default (the cause of "prompt resource N fetch failed").
-// An explicit NANO_REST_URL / NANO_REST_TOKEN override still wins as an operator
-// escape hatch. Both getConfig()/getAuthHeaders() are guarded so an older or
-// atypical client runtime degrades to the override/legacy path rather than throw.
+// so prompt content must be fetched from the broker this worker POLLS jobs from
+// (the polling engine — its profile restAddress). The base comes from
+// resolveLinkedPromptBase (explicit NANO_REST_URL escape hatch → polling engine
+// base → localhost); it deliberately does NOT follow the NANO_BASE_URL /
+// cfg.nanoUrl auxiliary-read overrides, since those would point the fetch at an
+// engine that never issued this broker-local resourceKey (the cause of "prompt
+// resource N fetch failed"). getAuthHeaders() is guarded so an older or atypical
+// client runtime degrades to the legacy path rather than throw.
+//
+// The base URL is invariant for a worker's lifetime, so callers on the per-job
+// hot path pass the once-at-startup `resolveLinkedPromptBase` result via
+// `baseUrl` to skip the synchronous config.json read (existsSync + readFileSync)
+// that this resolver would otherwise repeat on every job; only the auth headers
+// (which the client may rotate) are resolved per call. When `baseUrl` is omitted
+// it falls back to computing the base itself, so standalone callers and tests
+// keep the single-argument behaviour.
 //
 // TODO: once c8ctl bumps @camunda8/orchestration-cluster-api to v10 (10.0.0-alpha
 // exposes the typed camunda.getResourceContentBinary({resourceKey}) → Blob), drop
 // this raw /content/binary fetch and call that method directly. The pinned ^9.1.0
 // SDK only exposes the deprecated getResourceContent, which 406s for generic
 // (Markdown) prompt resources — see camunda/orchestration-cluster-api-js.
-async function resolveLinkedPromptSource(camunda, env = process.env) {
-  let baseUrl = env.NANO_REST_URL || '';
-  if (!baseUrl && camunda && typeof camunda.getConfig === 'function') {
-    try {
-      baseUrl = normalizeRestBase(camunda.getConfig().restAddress);
-    } catch {
-      // ignore — fall back to the legacy resolveBrokerRestConfig base below
-    }
-  }
+async function resolveLinkedPromptSource(camunda, env = process.env, { baseUrl: preResolvedBase } = {}) {
+  // The fetch base follows resolveLinkedPromptBase (explicit NANO_REST_URL escape
+  // hatch → polling engine base → localhost) so it tracks the broker the job was
+  // activated against — the resourceKey is broker-local. A caller-supplied
+  // pre-resolved base (already normalized at worker startup) is reused verbatim to
+  // avoid a per-job config.json read.
+  const baseUrl = preResolvedBase ?? resolveLinkedPromptBase(camunda, env);
   let authHeaders;
   if (env.NANO_REST_TOKEN) {
     authHeaders = { Authorization: `Bearer ${env.NANO_REST_TOKEN}` };
@@ -4121,13 +4166,19 @@ function buildResultEnvelope(result, { sandbox, image, git, result: agentResult,
  *     secret is ignored (LOCAL mode).
  *   - OFF: NANO_AGENTIC=off (or 0/false/no), or persisted `agentic:false`.
  *
- * Env wins over persisted config; the base URL falls back to the configured nano
- * URL (the app's own port) and ultimately DEFAULT_NANO_URL, so it is never empty.
+ * Env wins over persisted config; when no explicit agentic target is set the base
+ * URL defers to the shared resolveWorkerEngineBase (explicit engine override →
+ * active c8ctl profile restAddress → localhost default), so a profile-only remote
+ * worker discovers the agentic channel of the engine its jobs actually run on
+ * rather than its own loopback (jwulf/c8ctl-plugin-nano#107). It is never empty.
  * Returns `null` only when disabled (the off-switch).
  *
+ * @param {object} [camunda] the SDK client that activates jobs — its
+ *   getConfig().restAddress supplies the profile engine base when no explicit
+ *   agentic/engine override is set. Threaded from the `work` call site.
  * @returns {{ url: string, token: string, credential: string, bufferCapacity: number, secure: boolean, explicitUrl: boolean } | null}
  */
-function resolveAgenticConfig() {
+function resolveAgenticConfig(camunda) {
   const cfg = readConfig();
   // Explicit off-switch (env wins). Lets an operator fully opt out of visibility.
   const offSetting = process.env.NANO_AGENTIC
@@ -4136,14 +4187,14 @@ function resolveAgenticConfig() {
 
   // An explicit agentic target (env NANO_AGENTIC_URL or persisted `agenticUrl`)
   // is used verbatim and short-circuits hub auto-discovery (#75). When neither is
-  // set the URL below is the ENGINE base (nanoUrl → NANO_BASE_URL → default), off
-  // which `resolveAgenticTarget()` discovers the embedded app's own /agentic port.
+  // set the base defers to the shared worker-engine resolver (explicit engine
+  // override → profile restAddress → localhost default) — NOT a re-inlined
+  // nanoUrl → NANO_BASE_URL → default chain — so agentic discovery targets the
+  // same engine the worker's jobs run on (jwulf/c8ctl-plugin-nano#107).
   const explicitUrl = !!(process.env.NANO_AGENTIC_URL || cfg.agenticUrl);
   const url = process.env.NANO_AGENTIC_URL
     || cfg.agenticUrl
-    || cfg.nanoUrl
-    || process.env.NANO_BASE_URL
-    || DEFAULT_NANO_URL;
+    || resolveWorkerEngineBase(camunda);
   // SECURE-mode shared secret. Named NANO_AGENTIC_SECRET to match the server's env
   // var EXACTLY (Tab A → Slot A): set the same name + value on the server and every
   // worker box. The worker presents it as its identity token; the hub verifies it
@@ -4387,11 +4438,11 @@ async function discoverAgenticHubs(engineBaseUrl, {
  *     no projects API / not a nano engine, or discovery error/timeout). The
  *     worker continues doing real work with no channel.
  *
- * @param {{ fetchImpl?: Function, wsProbe?: Function, timeoutMs?: number }} [opts]
+ * @param {{ camunda?: object, fetchImpl?: Function, wsProbe?: Function, timeoutMs?: number }} [opts]
  * @returns {Promise<{ status: string, config?: object, message?: string, candidates?: Array }>}
  */
-async function resolveAgenticTarget(opts = {}) {
-  const base = resolveAgenticConfig();
+async function resolveAgenticTarget({ camunda, ...opts } = {}) {
+  const base = resolveAgenticConfig(camunda);
   if (!base) return { status: 'off' };
   // Explicit target wins verbatim and skips discovery entirely.
   if (base.explicitUrl) return { status: 'connect', config: base };
@@ -4730,7 +4781,9 @@ async function workAgent(req, flags) {
   // no capability, no app enrol endpoint, no channel connection. It is the
   // mutually-exclusive counterpart to capability-resolved SERVE: in `--auto`
   // the rank×capability matrix is bypassed entirely (any deployed agent job is
-  // served, gated only by the `io.nanobpm.agentTask.` task header), and the
+  // served, gated only by the leaf's canonical `agentic` flag — the
+  // `linkName="prompt"` linked-resource marker read by
+  // `@nanobpm/agentic`'s demand scanner), and the
   // desired set is reconciled by polling the engine rather than watching the
   // profile. `--auto-scope <process-id|prefix>` narrows the blast radius to one
   // app/network; without it, every agent job type on the engine is served.
@@ -4810,24 +4863,30 @@ async function workAgent(req, flags) {
     installParentDeathWatchdog({ parentPid: Number.isInteger(daemonPid) ? daemonPid : undefined });
   }
   const activeJobs = new Map(); // jobKey -> { type, since (ms epoch) }
-  // Which engine this worker polls jobs from + the live agentic-visibility
-  // channel status, both surfaced to `supervisor status` via the activity
-  // marker (#99). `agenticState` starts 'starting' and is updated once the
-  // channel target is resolved and again on each connect/disconnect below.
-  // The engine must name the ACTUAL polling authority: jobs are activated by
-  // `camunda.createJobWorker()` against the active c8ctl profile engine
-  // (`camunda.getConfig().restAddress`), whereas `restConfig` can honor the
-  // auxiliary NANO_REST_URL/NANO_BASE_URL/nanoUrl overrides (for `--auto`
-  // reads). Derive from the profile engine, using restConfig only as a
-  // fallback, so the column can't advertise an override host jobs aren't
-  // polled from.
-  const workerEngine = (() => {
-    try {
-      const profileBase = normalizeRestBase(camunda?.getConfig?.()?.restAddress);
-      if (profileBase) return profileBase;
-    } catch { /* degrade to the auxiliary REST config below */ }
-    return restConfig?.baseUrl || null;
-  })();
+  // Which engine this worker polls jobs from, surfaced to `supervisor status` via
+  // the activity marker (#99). Derived from resolveWorkerPollEngineBase — the SDK
+  // client's OWN profile restAddress (the base createJobWorker actually activates
+  // against), NOT the NANO_* / cfg.nanoUrl override that resolveWorkerEngineBase
+  // prefers for auxiliary REST reads. That keeps the ENGINE column honest: it
+  // reports the engine the worker truly polls, never an override the job worker
+  // ignores. Falls back to the canonical resolver only when the client exposes no
+  // usable profile base.
+  const workerEngine = resolveWorkerPollEngineBase(camunda);
+  // Base URL for the per-job linked-prompt fetch (issue #63). This follows
+  // resolveLinkedPromptBase — the polling engine (profile restAddress the SDK
+  // activates jobs against), since the linked resourceKey is BROKER-LOCAL and must
+  // be fetched from the broker that issued it — with NANO_REST_URL as the only
+  // explicit escape hatch. It deliberately does NOT follow the NANO_BASE_URL /
+  // cfg.nanoUrl auxiliary-read overrides resolveWorkerEngineBase prefers: pointing
+  // the prompt fetch at a different engine than the activation broker would 404 a
+  // broker-local resourceKey while job activation still succeeds. Computed ONCE at
+  // startup so the per-job hot path skips a config.json read. It coincides with
+  // `workerEngine` (the polling engine) unless NANO_REST_URL is set.
+  const linkedPromptBase = resolveLinkedPromptBase(camunda);
+  // The live agentic-visibility channel status, also surfaced to `supervisor
+  // status` via the activity marker (#99). `agenticState` starts 'starting' and
+  // is updated once the channel target is resolved and again on each
+  // connect/disconnect below.
   let agenticState = { status: 'starting' };
   const writeActivity = () => {
     if (!activityFile) return;
@@ -4879,7 +4938,7 @@ async function workAgent(req, flags) {
   // worker joins with the well-known LOCAL token and no credential; SECURE mode
   // (NANO_AGENTIC_SECRET) sends a real per-peer shared secret as the identity;
   // NANO_AGENTIC=off disables it (see resolveAgenticConfig).
-  const agenticTarget = await resolveAgenticTarget({ logger });
+  const agenticTarget = await resolveAgenticTarget({ camunda, logger });
   let agenticCfg = null;
   // buildAgenticUrl can throw on a malformed/unsupported explicit NANO_AGENTIC_URL.
   // This is only the display URL for the activity marker, so compute it
@@ -5048,8 +5107,10 @@ async function workAgent(req, flags) {
         try {
           // Fetch the prompt from the broker the SDK client is connected to,
           // deriving base URL + auth from that client (not restConfig, whose base
-          // defaults to localhost) — the resourceKey is broker-local.
-          const promptSource = await resolveLinkedPromptSource(camunda);
+          // defaults to localhost) — the resourceKey is broker-local. The base is
+          // invariant, so reuse the once-at-startup linkedPromptBase and let the
+          // resolver only compute per-job auth headers (no per-job config.json read).
+          const promptSource = await resolveLinkedPromptSource(camunda, process.env, { baseUrl: linkedPromptBase });
           const linked = await resolveLinkedPrompt(job.customHeaders ?? {}, {
             baseUrl: promptSource.baseUrl || restConfig.baseUrl,
             authHeaders: promptSource.authHeaders,
@@ -5864,6 +5925,10 @@ function summarizeSupervisorWorker(w, now = Date.now()) {
     startedAtMs,
     lastExit: w.lastExit ?? null,
     args: Array.isArray(w.args) ? w.args : [],
+    // The per-worker log path (logs/supervisor/worker-<id>.log). Carried through
+    // so `supervisor status` can surface it (see formatSupervisorLogsLines);
+    // null when the source record predates it (e.g. an older persisted state).
+    logFile: w.logFile ?? null,
     activity,
     engine,
     agentic,
@@ -6070,6 +6135,30 @@ function createSupervisorLiveView({
   };
 }
 
+/**
+ * The `Logs:` block for `supervisor status`, derived purely from the status
+ * payload so it renders identically for a live daemon status and a synthesized
+ * one. Lists the daemon log and each worker's log file, plus a hint at the
+ * existing tailer. Returns an empty array (no section) when no log path is
+ * known — an older persisted state, or a dead daemon whose frame carried none.
+ */
+function formatSupervisorLogsLines(status) {
+  const daemonLog = status?.daemon?.logFile || null;
+  const workers = Array.isArray(status?.workers) ? status.workers : [];
+  const workerLogs = workers
+    .filter((w) => w && w.logFile)
+    .map((w) => ({ label: String(w.id), path: String(w.logFile) }));
+  const entries = [];
+  if (daemonLog) entries.push({ label: 'daemon', path: String(daemonLog) });
+  for (const w of workerLogs) entries.push(w);
+  if (entries.length === 0) return [];
+  const labelWidth = Math.max(...entries.map((e) => e.label.length));
+  const out = ['', 'Logs:'];
+  for (const e of entries) out.push(`  ${e.label.padEnd(labelWidth)}  ${e.path}`);
+  out.push('  View: c8ctl nano supervisor logs [<id>] [--follow]');
+  return out;
+}
+
 /** Render a supervisor status object as an aligned text table. */
 function formatSupervisorStatus(status) {
   const lines = [];
@@ -6083,6 +6172,7 @@ function formatSupervisorStatus(status) {
   lines.push('');
   if (workers.length === 0) {
     lines.push('  No workers. Add one with: c8ctl nano supervisor add <profile>');
+    lines.push(...formatSupervisorLogsLines(status));
     return lines.join('\n');
   }
   const rows = workers.map((w) => ({
@@ -6107,6 +6197,7 @@ function formatSupervisorStatus(status) {
   const fmt = (r) => '  ' + cols.map((c) => r[c].padEnd(width[c])).join('  ');
   lines.push(fmt(head));
   for (const r of rows) lines.push(fmt(r));
+  lines.push(...formatSupervisorLogsLines(status));
   return lines.join('\n');
 }
 
@@ -8858,6 +8949,9 @@ export {
   pickLinkedResource,
   resolveBrokerRestConfig,
   resolveAutoRestConfig,
+  resolveWorkerEngineBase,
+  resolveWorkerPollEngineBase,
+  resolveLinkedPromptBase,
   resourceContentUrl,
   fetchLinkedResourceContent,
   resolveLinkedPrompt,
@@ -8909,9 +9003,6 @@ export {
   jobTypeMatrix,
   diffJobTypes,
   parseJobTypeFlags,
-  serviceTaskHasAgentHeader,
-  serviceTaskHasLinkedPrompt,
-  serviceTaskIsAgentTask,
   scanAgentTaskLeaves,
   readDeployedAgentJobTypes,
   resolveAutoJobTypes,
@@ -8942,6 +9033,7 @@ export {
   formatDuration,
   summarizeSupervisorWorker,
   formatSupervisorStatus,
+  formatSupervisorLogsLines,
   reageSupervisorStatus,
   clampToWidth,
   createSupervisorLiveView,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.38.1",
+  "version": "1.39.1",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -52,17 +52,17 @@
     "semantic-release": "^25.0.3"
   },
   "dependencies": {
-    "@nanobpm/agentic": "^0.1.0",
+    "@nanobpm/agentic": "^0.4.0",
     "@nanobpm/urban-agent-client": "^0.1.4"
   },
   "optionalDependencies": {
     "node-pty": "^1.0.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.38.1",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.38.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.38.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.38.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.38.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.38.1",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.38.1"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.39.1",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.39.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.39.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.39.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.39.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.39.1",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.39.1"
   }
 }