plugin-agent-orchestrator 1.0.21 → 1.0.23

package/src/server/tools/delegate-task.ts

@@ -6,7 +6,7 @@ import { createReactAgent } from '@langchain/langgraph/prebuilt';
 import { DynamicStructuredTool } from '@langchain/core/tools';
 import { HumanMessage, SystemMessage } from '@langchain/core/messages';
 import type PluginAIServer from '@nocobase/plugin-ai/dist/server';
-import type { ToolsEntry } from '@nocobase/ai';
+import type { ToolsEntry, ToolsRuntime } from '@nocobase/ai';
 import {
   ExecutionSpanService,
   getOrchestratorTraceContext,
@@ -39,10 +39,11 @@ type AgentExecutionResult = {
   messages: any[];
 };
 
-type EmployeeSkillConfig = {
-  name: string;
-  autoCall: boolean;
-};
+type ToolRuntimeInput = string | ToolsRuntime | undefined;
+
+function getToolCallId(runtime: ToolRuntimeInput) {
+  return typeof runtime === 'string' ? runtime : runtime?.toolCallId;
+}
 
 function sanitizeToolPart(value: string) {
   return (value || '').replace(/[^a-zA-Z0-9_-]/g, '_');
@@ -154,7 +155,8 @@ function createDelegateToolOptions(
           .describe('Optional additional context to help the sub-agent understand the task better.'),
       }),
     },
-    invoke: async (ctx: Context, args: { task: string; context?: string }, id: string) => {
+    invoke: async (ctx: Context, args: { task: string; context?: string }, runtime?: ToolRuntimeInput) => {
+      const id = getToolCallId(runtime) || `delegate-${Date.now()}`;
       const callingEmployee = await resolveCallingEmployee(ctx, plugin);
       if (!callingEmployee) {
         await logDelegation(ctx, plugin, {
@@ -312,8 +314,9 @@ function createDispatchToolOptions(
     invoke: async (
       ctx: Context,
       args: { tasks: Array<{ subAgent: string; task: string; context?: string }> },
-      id: string,
+      runtime?: ToolRuntimeInput,
     ) => {
+      const id = getToolCallId(runtime) || `dispatch-${Date.now()}`;
       const callingEmployee = await resolveCallingEmployee(ctx, plugin);
       if (!callingEmployee) {
         const distinctSubs = Array.from(new Set((args.tasks ?? []).map((t) => t.subAgent).filter(Boolean)));
@@ -706,9 +709,9 @@ export function invalidateDelegateToolsCache() {
  *
  * Tool resolution uses the CORE toolsManager (app.aiManager.toolsManager) —
  * the same manager that AIEmployee.getToolsMap() uses (see ai-employee.ts:1286).
- * This ensures tool names in skillSettings.skills[].name match correctly.
+ * This ensures tool names in skillSettings.tools[].name match correctly.
  *
- * skillSettings.skills shape (verified against ai-employee.ts:1028):
+ * skillSettings.tools shape:
  *   { name: string, autoCall: boolean }[]
  */
 async function invokeDelegateTask(

package/src/server/tools/skill-execute.ts

@@ -1,160 +1,194 @@
-import { parseJsonText } from '../skill-hub/utils/json-fields';
-
-export function createSkillExecuteTool(plugin: any) {
-  return {
-    scope: 'CUSTOM',
-    execution: 'backend',
-    defaultPermission: 'ASK',
-
-    introduction: {
-      title: 'Skill Hub - Universal Skill Executor',
-      about:
-        'A universal gateway to execute predefined specialized skills (data processing, complex calculations, file generation, etc.) inside a secure Python/Node.js sandbox.',
-    },
-
-    definition: {
-      name: 'skill_hub_execute',
-      description: `A universal gateway to execute various predefined specialized skills (e.g., data transformation, calculations, document/presentation generation) in an isolated sandbox.
-HOW TO USE THIS TOOL:
-1. If you don't know the exact 'skillName' or its required 'input' schema, first call this tool with { "action": "list" } to discover all available skills.
-2. For complex workflow skills, call { "action": "describe", "skillName": "<exact_skill_name>" } to load the full instructions before execution.
-3. To run a skill, call this tool with { "action": "execute", "skillName": "<exact_skill_name>", "input": { <parameters> } }.
-CRITICAL: Do NOT guess or hallucinate the 'input' object. You MUST strictly provide the parameters matching the JSON schema defined for that specific skill.
-The skill's output may contain text results, structured JSON data, or download URLs for generated files.
-IMPORTANT: If the skill returns file download URLs, you MUST format them as clickable Markdown links (e.g., [Download filename.ext](/api/attachments/...)) in your final response to the user.`,
-      schema: {
-        type: 'object',
-        properties: {
-          action: {
-            type: 'string',
-            enum: ['list', 'describe', 'execute'],
-            description: '"list" to see available skills, "describe" to load full instructions, "execute" to run one',
-          },
-          skillName: {
-            type: 'string',
-            description: 'Skill name (required for "execute" action)',
-          },
-          input: {
-            type: 'object',
-            description: 'Input parameters matching the skill inputSchema',
-          },
-        },
-        required: ['action'],
-      },
-    },
-
-    async invoke(ctx: any, args: Record<string, any>, _id?: string) {
-      plugin.app.logger.info(`[skill-execute] Tool invoked with action: ${args.action}, skillName: ${args.skillName}`);
-
-      // Action: list available skills
-      if (args.action === 'list') {
-        const skills = await plugin.db.getRepository('skillDefinitions').find({
-          filter: { enabled: true },
-          fields: ['name', 'title', 'description', 'language', 'inputSchema', 'instructions', 'storageType'],
-        });
-
-        const skillList = skills.map((s: any) => ({
-          name: s.get('name'),
-          title: s.get('title'),
-          description: s.get('description'),
-          language: s.get('language'),
-          inputSchema: parseJsonText(s.get('inputSchema'), null),
-          hasInstructions: !!s.get('instructions') || s.get('storageType') === 'plugin',
-          storageType: s.get('storageType'),
-        }));
-
-        return {
-          status: 'success',
-          content: JSON.stringify({ skills: skillList }),
-        };
-      }
-
-      // Action: describe one skill with full workflow instructions
-      if (args.action === 'describe') {
-        if (!args.skillName) {
-          return { status: 'error', content: 'Missing skillName parameter' };
-        }
-
-        const skill = await plugin.db.getRepository('skillDefinitions').findOne({
-          filter: { name: args.skillName, enabled: true },
-        });
-
-        if (!skill) {
-          return {
-            status: 'error',
-            content: `Skill "${args.skillName}" not found or disabled`,
-          };
-        }
-
-        const instructions =
-          typeof plugin.getSkillInstructions === 'function'
-            ? await plugin.getSkillInstructions(skill)
-            : skill.get('instructions');
-
-        return {
-          status: 'success',
-          content: JSON.stringify({
-            name: skill.get('name'),
-            title: skill.get('title'),
-            description: skill.get('description'),
-            language: skill.get('language'),
-            inputSchema: parseJsonText(skill.get('inputSchema'), null),
-            packages: parseJsonText(skill.get('packages'), []),
-            storageType: skill.get('storageType'),
-            storageUrl: skill.get('storageUrl'),
-            instructions,
-          }),
-        };
-      }
-
-      // Action: execute skill
-      if (args.action === 'execute') {
-        if (!args.skillName) {
-          return { status: 'error', content: 'Missing skillName parameter' };
-        }
-
-        const skill = await plugin.db.getRepository('skillDefinitions').findOne({
-          filter: { name: args.skillName, enabled: true },
-        });
-
-        if (!skill) {
-          return {
-            status: 'error',
-            content: `Skill "${args.skillName}" not found or disabled`,
-          };
-        }
-
-        try {
-          const result = await plugin.executeSkill(skill, args.input || {}, ctx);
-
-          return {
-            status: result.status === 'succeeded' ? 'success' : 'error',
-            content: JSON.stringify({
-              message:
-                result.status === 'succeeded'
-                  ? `Executed successfully. ${result.files?.length || 0} file(s) generated.`
-                  : `Failed: ${result.stderr}`,
-              stdout: result.stdout,
-              stderr: result.stderr,
-              files: result.files,
-              execId: result.execId,
-              agentLoopRunId: result.agentLoopRunId,
-              agentLoopStepId: result.agentLoopStepId,
-              durationMs: result.durationMs,
-            }),
-          };
-        } catch (error) {
-          return {
-            status: 'error',
-            content: `Execution error: ${error instanceof Error ? error.message : String(error)}`,
-          };
-        }
-      }
-
-      return {
-        status: 'error',
-        content: `Unknown action "${args.action}". Use "list", "describe", or "execute".`,
-      };
-    },
-  };
-}
+import { parseJsonText } from '../skill-hub/utils/json-fields';
+import type { ToolsRuntime } from '@nocobase/ai';
+
+type ToolRuntimeInput = string | ToolsRuntime | undefined;
+
+function normalizeRuntime(runtime: ToolRuntimeInput): ToolsRuntime | undefined {
+  if (!runtime) return undefined;
+  if (typeof runtime === 'string') {
+    return { toolCallId: runtime, writer: () => {} };
+  }
+  return runtime;
+}
+
+export function createSkillExecuteTool(plugin: any) {
+  return {
+    scope: 'CUSTOM',
+    execution: 'backend',
+    // Intentionally fixed to ASK. This is the universal gateway: a single tool
+    // whose `execute` action can run ANY enabled skill by name, so the
+    // per-skill `autoCall` flag cannot be honored here — the harness decides
+    // approval from `defaultPermission` before invoke, when the target skill is
+    // not yet known. The per-skill dynamic tools (`skill_hub_<name>`) are the
+    // fast path that respect `autoCall: true → ALLOW`. Keeping the generic
+    // gateway on ASK is deliberate defense-in-depth, not an oversight.
+    defaultPermission: 'ASK',
+
+    introduction: {
+      title: 'Skill Hub - Universal Skill Executor',
+      about:
+        'A universal gateway to execute predefined specialized skills (data processing, complex calculations, file generation, etc.) inside a secure Python/Node.js sandbox.',
+    },
+
+    definition: {
+      name: 'skill_hub_execute',
+      description: `A universal gateway to execute various predefined specialized skills (e.g., data transformation, calculations, document/presentation generation) in an isolated sandbox.
+HOW TO USE THIS TOOL:
+1. If you don't know the exact 'skillName' or its required 'input' schema, first call this tool with { "action": "list" } to discover all available skills.
+2. For complex workflow skills, call { "action": "describe", "skillName": "<exact_skill_name>" } to load the full instructions before execution.
+3. To run a skill, call this tool with { "action": "execute", "skillName": "<exact_skill_name>", "input": { <parameters> } }.
+CRITICAL: Do NOT guess or hallucinate the 'input' object. You MUST strictly provide the parameters matching the JSON schema defined for that specific skill.
+The skill's output may contain text results, structured JSON data, or download URLs for generated files.
+IMPORTANT: If the skill returns file download URLs, you MUST format them as clickable Markdown links (e.g., [Download filename.ext](/api/attachments/...)) in your final response to the user.`,
+      schema: {
+        type: 'object',
+        properties: {
+          action: {
+            type: 'string',
+            enum: ['list', 'describe', 'execute'],
+            description: '"list" to see available skills, "describe" to load full instructions, "execute" to run one',
+          },
+          skillName: {
+            type: 'string',
+            description: 'Skill name (required for "execute" action)',
+          },
+          input: {
+            type: 'object',
+            description: 'Input parameters matching the skill inputSchema',
+          },
+        },
+        required: ['action'],
+      },
+    },
+
+    async invoke(ctx: any, args: Record<string, any>, runtime?: ToolRuntimeInput) {
+      plugin.app.logger.info(`[skill-execute] Tool invoked with action: ${args.action}, skillName: ${args.skillName}`);
+
+      // Action: list available skills
+      if (args.action === 'list') {
+        const skills = await plugin.db.getRepository('skillDefinitions').find({
+          filter: { enabled: true },
+          fields: ['name', 'title', 'description', 'language', 'inputSchema', 'instructions', 'storageType'],
+        });
+
+        const skillList = skills.map((s: any) => ({
+          name: s.get('name'),
+          title: s.get('title'),
+          description: s.get('description'),
+          language: s.get('language'),
+          inputSchema: parseJsonText(s.get('inputSchema'), null),
+          hasInstructions: !!s.get('instructions') || s.get('storageType') === 'plugin',
+          storageType: s.get('storageType'),
+        }));
+
+        return {
+          status: 'success',
+          content: JSON.stringify({ skills: skillList }),
+        };
+      }
+
+      // Action: describe one skill with full workflow instructions
+      if (args.action === 'describe') {
+        if (!args.skillName) {
+          return { status: 'error', content: 'Missing skillName parameter' };
+        }
+
+        const skill = await plugin.db.getRepository('skillDefinitions').findOne({
+          filter: { name: args.skillName, enabled: true },
+        });
+
+        if (!skill) {
+          return {
+            status: 'error',
+            content: `Skill "${args.skillName}" not found or disabled`,
+          };
+        }
+
+        const instructions =
+          typeof plugin.getSkillInstructions === 'function'
+            ? await plugin.getSkillInstructions(skill)
+            : skill.get('instructions');
+
+        return {
+          status: 'success',
+          content: JSON.stringify({
+            name: skill.get('name'),
+            title: skill.get('title'),
+            description: skill.get('description'),
+            language: skill.get('language'),
+            inputSchema: parseJsonText(skill.get('inputSchema'), null),
+            packages: parseJsonText(skill.get('packages'), []),
+            storageType: skill.get('storageType'),
+            storageUrl: skill.get('storageUrl'),
+            instructions,
+          }),
+        };
+      }
+
+      // Action: execute skill
+      if (args.action === 'execute') {
+        if (!args.skillName) {
+          return { status: 'error', content: 'Missing skillName parameter' };
+        }
+
+        const skill = await plugin.db.getRepository('skillDefinitions').findOne({
+          filter: { name: args.skillName, enabled: true },
+        });
+
+        if (!skill) {
+          return {
+            status: 'error',
+            content: `Skill "${args.skillName}" not found or disabled`,
+          };
+        }
+
+        try {
+          const normalizedRuntime = normalizeRuntime(runtime);
+          const previousRuntime = ctx.runtime;
+          if (normalizedRuntime) {
+            ctx.runtime = normalizedRuntime;
+          }
+          let result;
+          try {
+            result = await plugin.executeSkill(skill, args.input || {}, ctx);
+          } finally {
+            if (normalizedRuntime) {
+              if (previousRuntime === undefined) {
+                delete ctx.runtime;
+              } else {
+                ctx.runtime = previousRuntime;
+              }
+            }
+          }
+
+          return {
+            status: result.status === 'succeeded' ? 'success' : 'error',
+            content: JSON.stringify({
+              message:
+                result.status === 'succeeded'
+                  ? `Executed successfully. ${result.files?.length || 0} file(s) generated.`
+                  : `Failed: ${result.stderr}`,
+              stdout: result.stdout,
+              stderr: result.stderr,
+              files: result.files,
+              execId: result.execId,
+              agentLoopRunId: result.agentLoopRunId,
+              agentLoopStepId: result.agentLoopStepId,
+              durationMs: result.durationMs,
+            }),
+          };
+        } catch (error) {
+          return {
+            status: 'error',
+            content: `Execution error: ${error instanceof Error ? error.message : String(error)}`,
+          };
+        }
+      }
+
+      return {
+        status: 'error',
+        content: `Unknown action "${args.action}". Use "list", "describe", or "execute".`,
+      };
+    },
+  };
+}

package/src/server/utils/ai-manager.ts

@@ -0,0 +1,24 @@
+/**
+ * Single accessor for the core AI tools manager.
+ *
+ * plugin-ai exposes the tools manager at `app.aiManager.toolsManager`, and the
+ * same instance is reachable via `pluginAI.ai.toolsManager`. Mixing the two
+ * access paths risks registering tools on one object while resolving them on
+ * another if the wiring ever diverges. Every orchestrator call site goes
+ * through this helper so registration and resolution always share one manager.
+ */
+export function getAIToolsManager(app: any) {
+  const toolsManager = app?.aiManager?.toolsManager;
+  if (!toolsManager) {
+    throw new Error(
+      '[AgentOrchestrator] app.aiManager.toolsManager is not available. ' +
+        'Ensure @nocobase/plugin-ai is enabled and loaded before plugin-agent-orchestrator.',
+    );
+  }
+  return toolsManager;
+}
+
+/** Same accessor, but returns undefined instead of throwing (best-effort call sites). */
+export function tryGetAIToolsManager(app: any) {
+  return app?.aiManager?.toolsManager;
+}

package/src/server/utils/ctx-utils.ts

@@ -44,6 +44,20 @@ export function currentUserId(ctx: any) {
   return ctx?.state?.currentUser?.id || ctx?.auth?.user?.id;
 }
 
+/**
+ * Whether the current request is made by an admin/root user.
+ * Mirrors the owner/admin check used by skillHub:download so list/get
+ * scoping and file access stay consistent.
+ */
+export function isAdminUser(ctx: any): boolean {
+  const roles = ctx?.state?.currentUser?.roles || ctx?.auth?.user?.roles;
+  if (!Array.isArray(roles)) return false;
+  return roles.some((r: any) => {
+    const name = typeof r === 'string' ? r : r?.name;
+    return name === 'root' || name === 'admin';
+  });
+}
+
 /** Get action params values from ctx. */
 export function valuesFromCtx(ctx: any) {
   return ctx?.action?.params?.values || ctx?.request?.body || {};

package/src/server/utils/skill-settings.ts

@@ -0,0 +1,116 @@
+export type EmployeeToolBinding = {
+  name: string;
+  autoCall?: boolean;
+};
+
+type RecordLike = Record<string, unknown>;
+
+function isRecord(value: unknown): value is RecordLike {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+export function isOrchestratorToolName(name: string) {
+  return (
+    name === 'orchestrator_plan_goal' ||
+    name === 'orchestrator_execute_plan' ||
+    name === 'orchestrator_status' ||
+    name === 'orchestrator_cancel' ||
+    name === 'external_rag_search' ||
+    name === 'skill_hub_execute' ||
+    name.startsWith('delegate_') ||
+    name.startsWith('dispatch_subagents_') ||
+    name.startsWith('skill_hub_') ||
+    name.startsWith('browser_') ||
+    name.startsWith('drawio-')
+  );
+}
+
+function toToolBinding(value: unknown): EmployeeToolBinding | null {
+  if (typeof value === 'string') {
+    const name = value.trim();
+    return name ? { name, autoCall: false } : null;
+  }
+  if (!isRecord(value) || typeof value.name !== 'string') {
+    return null;
+  }
+  const name = value.name.trim();
+  if (!name) {
+    return null;
+  }
+  return {
+    name,
+    autoCall: value.autoCall === true,
+  };
+}
+
+function addToolBinding(toolsByName: Map<string, EmployeeToolBinding>, binding: EmployeeToolBinding | null) {
+  if (!binding) return;
+  if (!toolsByName.has(binding.name)) {
+    toolsByName.set(binding.name, binding);
+  }
+}
+
+export function normalizeAIEmployeeSkillSettings(value: unknown): {
+  changed: boolean;
+  skillSettings: RecordLike & { skills: string[]; tools: EmployeeToolBinding[] };
+} {
+  const source = isRecord(value) ? value : {};
+  const toolsByName = new Map<string, EmployeeToolBinding>();
+  const nextSkills: string[] = [];
+  let changed = false;
+
+  const sourceTools = source.tools;
+  if (Array.isArray(sourceTools)) {
+    for (const item of sourceTools) {
+      const binding = toToolBinding(item);
+      if (binding) {
+        addToolBinding(toolsByName, binding);
+        if (typeof item === 'string') {
+          changed = true;
+        }
+      } else {
+        changed = true;
+      }
+    }
+  }
+
+  const sourceSkills = source.skills;
+  if (Array.isArray(sourceSkills)) {
+    for (const item of sourceSkills) {
+      if (typeof item === 'string') {
+        const name = item.trim();
+        if (!name) {
+          changed = true;
+          continue;
+        }
+        if (isOrchestratorToolName(name)) {
+          addToolBinding(toolsByName, { name, autoCall: false });
+          changed = true;
+          continue;
+        }
+        nextSkills.push(name);
+        if (name !== item) {
+          changed = true;
+        }
+        continue;
+      }
+
+      const legacyToolBinding = toToolBinding(item);
+      if (legacyToolBinding) {
+        addToolBinding(toolsByName, legacyToolBinding);
+      }
+      changed = true;
+    }
+  }
+
+  const normalized = {
+    ...source,
+    skills: nextSkills,
+    tools: Array.from(toolsByName.values()),
+  };
+
+  return {
+    changed,
+    skillSettings: normalized,
+  };
+}

package/dist/client/AIEmployeeSelect.d.ts

@@ -1,11 +0,0 @@
-import React from 'react';
-/**
- * Reusable Select component for AI Employees.
- * P3 FIX: Uses shared AIEmployeesContext instead of making its own API call.
- */
-export declare const AIEmployeeSelect: React.FC<{
-    value?: string;
-    onChange?: (value: string) => void;
-    exclude?: string;
-    placeholder?: string;
-}>;

package/dist/client/AIEmployeesContext.d.ts

@@ -1,30 +0,0 @@
-import React from 'react';
-interface AIEmployeeInfo {
-    username: string;
-    nickname: string;
-    about?: string;
-    skills: string[];
-}
-interface AIEmployeesContextType {
-    employees: AIEmployeeInfo[];
-    employeeMap: Map<string, string>;
-    skillsMap: Map<string, Set<string>>;
-    loading: boolean;
-    refresh: () => void;
-}
-/**
- * P3 FIX: Shared context provider that fetches aiEmployees once
- * and shares the data across RulesTab, TracingTab, and AIEmployeeSelect.
- *
- * Also exposes each employee's configured skills so RulesTab can warn when
- * a delegation rule exists but the leader hasn't added the corresponding
- * delegate_<leader>_to_<sub> tool to its skillSettings.
- */
-export declare const AIEmployeesProvider: React.FC<{
-    children: React.ReactNode;
-}>;
-/**
- * Hook to access shared AI employees data.
- */
-export declare const useAIEmployees: () => AIEmployeesContextType;
-export {};

package/dist/client/AgentRunsTab.d.ts

@@ -1,2 +0,0 @@
-import React from 'react';
-export declare const AgentRunsTab: React.FC;

package/dist/client/HarnessProfilesTab.d.ts

@@ -1,2 +0,0 @@
-import React from 'react';
-export declare const HarnessProfilesTab: React.FC;

package/dist/client/OrchestratorSettings.d.ts

@@ -1,3 +0,0 @@
-import React from 'react';
-declare const OrchestratorSettings: React.FC;
-export { OrchestratorSettings };

package/dist/client/RulesTab.d.ts

@@ -1,2 +0,0 @@
-import React from 'react';
-export declare const RulesTab: React.FC;

package/dist/client/TracingTab.d.ts

@@ -1,2 +0,0 @@
-import React from 'react';
-export declare const TracingTab: React.FC;