feat(agent-runner): add admin reconcile primitives

# Conflicts:
#	src/langbot/pkg/box/workspace.py
#	src/langbot/pkg/provider/tools/loaders/mcp_stdio.py
#	src/langbot/pkg/provider/tools/loaders/native.py
#	src/langbot/pkg/provider/tools/loaders/skill.py
#	tests/unit_tests/box/test_workspace.py
#	tests/unit_tests/provider/test_mcp_box_integration.py

AGENTS.md

@@ -125,6 +125,14 @@ uv run python -m langbot.pkg.persistence.alembic_runner autogenerate "descriptio
 
 Review and edit the generated script before committing. Migrations execute automatically on startup. `autogenerate` detects schema changes (add/drop columns, tables, type changes) but **data migrations** (e.g. mutating JSON field contents) must be hand-written into the generated script. `env.py` sets `render_as_batch=True`, so SQLite's ALTER TABLE limits are handled automatically — no need to branch per database. More in the wiki ["开发配置"](https://docs.langbot.app/zh/develop/dev-config#数据库迁移).
 
+When writing a migration, follow these rules:
+
+- **Revision id ≤ 32 characters.** PostgreSQL stores `alembic_version.version_num` as `varchar(32)`; a longer id raises `StringDataRightTruncationError` at runtime. Prefer short, descriptive ids like `0005_add_llm_context_length`.
+- **Guard every operation against missing tables/columns.** Fresh installs build the schema via `create_all()` and then stamp the Alembic baseline, so a migration may run against a table that already has the change — or, in tests, against an empty database. Check `inspector.get_table_names()` / `inspector.get_columns(...)` before `add_column` / `drop_column`, mirroring the existing migrations.
+- **Keep a single linear head.** Chain `down_revision` to the current head; do not create branches. Run the migration tests after adding one: `uv run pytest tests/integration/persistence/ -q` (the PostgreSQL test needs a running PG via `TEST_POSTGRES_URL`).
+
+> **Legacy migration system (deprecated — do not extend).** The old 3.x migration system under `src/langbot/pkg/persistence/migrations/` (`DBMigration` subclasses in `dbmXXX_*.py`, run from `pkg/persistence/mgr.py`) is **frozen**. Do **not** add new `dbmXXX_*.py` files. The chain is capped at `required_database_version = 25` (`pkg/utils/constants.py`); those files only exist to upgrade pre-existing 3.x databases up to the Alembic baseline and are kept read-only. All new schema changes go through Alembic.
+
 ## Some Principles
 
 - Keep it simple, stupid.

docs/agent-runner-pluginization/AGENT_CONTEXT_PROTOCOL.md

@@ -0,0 +1,150 @@
+# Agent-owned Context 协议设计
+
+本文档描述插件化 AgentRunner 场景下的上下文边界**设计理由**。结论先行：LangBot 不应成为最终 agentic context manager；它提供 context substrate，AgentRunner 或其背后的 runtime 自己决定如何管理历史、压缩、召回和 KV cache。
+
+> 涉及的数据结构（`AgentRunContext`、`ContextAccess`、`AgentRunAPIProxy` 等）唯一定义在 [PROTOCOL_V1.md](./PROTOCOL_V1.md)。本文只讲语义和约束，不重抄 schema。
+
+## 1. 设计原则
+
+### 1.1 Agent 拥有上下文策略
+
+不同 runner 背后的 runtime 差异很大：
+
+- 官方 local-agent 可能依赖 LangBot 的模型、工具、知识库和存储。
+- Claude Code SDK / Codex 类 runtime 有自己的 session、transcript、tool loop 和上下文压缩。
+- Pi Agent SDK 或外部 agent 平台可能只需要当前事件和一个外部 conversation key。
+
+因此 LangBot 不应强行决定最终传给模型的历史窗口。Host 只提供：当前事件的完整结构化信息、稳定身份和会话引用、可授权读取的 history / event / artifact / state API、可投影给外部 harness 的 scoped context / SDK-owned MCP bridge / resource handles、payload hard cap 和权限 guardrail。
+
+### 1.2 Host 不定义通用历史窗口
+
+历史窗口策略不是 AgentRunner 协议或 Query entry adapter 的核心概念。Host 只提供 history pull API、cursor、hard cap 和权限边界；runner 自己决定是否读取、读取多少、如何截断和压缩。
+
+正确的问题不是"LangBot 每轮裁几轮历史给 agent"，而是：
+
+- 这类 runner 是否自管 context？
+- 事件到来时 host 应 inline 哪些最小信息？
+- agent 需要更多上下文时通过什么 API 拉取？
+- host 如何保证安全、可审计和可分页？
+
+### 1.3 Host 保存事实源，Agent 管理 working context
+
+三类数据要分开：
+
+- `EventLog`: Host 保存原始事件、工具调用、投递结果、错误和系统事件。
+- `Transcript`: Host 从 EventLog 投影出的对话视图，用于 UI、审计和按需历史读取。
+- `Working context`: Agent 本轮实际送进模型或 runtime 的上下文，由 AgentRunner 决定。
+
+LangBot 不提供 host-side inline history window。简单 runner 如果需要历史窗口，应在 runner 内部通过 Host history API 拉取并裁剪。
+
+## 2. Event 到来时传什么
+
+默认 `AgentRunContext`（PROTOCOL_V1 §5.2）应尽量小且稳定。默认规则：
+
+- Host MUST NOT inline full history by default.
+- Host SHOULD inline only current event / input and context handles.
+- Runner owns working-context assembly.
+- Runner MAY use Host history / event / artifact / state / storage API when authorized.
+- Official runners MUST consume Host infrastructure through the same public API as third-party runners.
+
+### 2.1 必须 inline 的内容
+
+当前 event 的类型/id/时间/source；当前输入文本和结构化内容；附件/文件/图片的 metadata 和 artifact ref；actor / subject / conversation / thread / bot / workspace；delivery 能力；已授权资源列表；context cursors 和可用 API 能力；Agent/runner config。这些是 agent 决定下一步所需的最低信息。
+
+### 2.2 默认不 inline 的内容
+
+完整历史消息、大文件全文、大工具结果、全量知识库内容、平台原始 payload 大对象、每轮重新生成的大段 summary。这些会破坏跨进程序列化成本、泄露范围、KV cache 稳定性，也会迫使 host 替 agent 做 context 策略。
+
+### 2.3 不提供 Host Inline History Window
+
+`AgentRunContext` 不包含 `bootstrap` 字段。Host 不下发历史窗口，也不通过 Pipeline 配置决定窗口大小。runner 若需要类似 `recent_tail` 的策略，应在自己的 manifest/config schema 中声明参数，并在 runner 内部通过 history API 读取、裁剪和压缩。Host 只负责权限、分页、hard cap 和事实源。
+
+## 3. ContextAccess 的作用
+
+`ContextAccess`（PROTOCOL_V1 §5.8）是 host 交给 agent 的上下文读取入口描述，告诉 agent：当前事件位于哪条 conversation / thread、若需要更多历史从哪个 cursor 开始拉、host inline 了什么没 inline 什么、当前 run 有哪些 context API 权限。
+
+## 4. Agent 如何获取更多上下文
+
+所有 API 都走 `AgentRunAPIProxy`（PROTOCOL_V1 §8），由 host 用 `run_id` 校验。
+
+外部 harness 不能直接访问 LangBot 资源。无论是 history、event、artifact、state、model、tool、knowledge base，还是 LangBot skills，都必须通过 SDK runtime 转发到 Host API，并由 Host 按 active `run_id`、runner identity、binding resource policy 和 caller plugin identity 校验。harness 自己的 native tools 只属于 harness 执行环境，不能绕过 SDK runtime 访问 LangBot 内部资源。
+
+### 4.1 History
+
+```python
+await api.history_page(conversation_id=ctx.context.conversation_id,
+                       before_cursor=ctx.context.latest_cursor,
+                       limit=50, direction="backward", include_artifacts=False)
+```
+
+返回 `HistoryPage`（schema 见 PROTOCOL_V1 §8）。
+
+约束：`limit` 有 host hard cap；默认只能读当前 conversation / thread；跨会话读取需 binding policy / run authorization snapshot 授权；返回 artifact ref，不默认返回大文件内容。
+
+### 4.2 Search
+
+```python
+await api.history_search(query="用户之前提到的数据库连接信息",
+                         filters={"conversation_id": ..., "event_types": ["message.received"]},
+                         top_k=10)
+```
+
+Search 可先用数据库全文索引，后续接 embedding recall。它是 host 检索能力，不等于 agent 的长期记忆策略。
+
+### 4.3 Event / Artifact / State
+
+- Event API（`events.get` / `events.page`）用于读取非消息事件、工具事件、系统事件。Agent 不应把所有事件都当成 user/assistant message。
+- Artifact API（`artifact_metadata` / `artifact_read` / `artifact_read_range`）必须校验 artifact 所属 conversation / run / binding，校验 MIME / 大小 / 过期 / 权限，大文件按 range/file-key 读取，工具大结果也应 artifact 化。
+- State API（`state.get` / `set`）是可选寄宿能力。自管 runtime 可以完全不用；依附 LangBot 的官方 runner 可以使用，例如 `external.session_id`、`summary.checkpoint`。
+
+### 4.4 大文件与工具协作
+
+大文件、多模态输入和工具产物不要内联进 prompt 或 tool result：message/content 里只放小文本和必要摘要；大文件、图片、音频、长工具输出返回 artifact ref（`artifact_id`、`mime_type`、`size`、`digest`、`summary`、`expires_at`、`permissions`）。工具之间传递大结果时传 artifact ref，不传完整 blob。Host 校验 artifact 是否属于当前 run / scope，默认不允许插件直接读任意本地路径；临时文件应有 TTL 和清理机制。
+
+### 4.5 External harness context projection
+
+外部 harness 的总体边界以 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md) §4.8 为准。本节只描述 context projection 的推荐形态。
+
+Claude Code、Codex、Kimi Code 这类 runtime 通常已有自己的 session、工具 loop、MCP 加载、上下文压缩和工作目录。LangBot 不应把它们改造成"host prompt assembler"，而应提供可审计的事件和资源投影。推荐 projection 形态：
+
+- `agent-context.json`：结构化 JSON，包含 `run_id`、`event`、`actor`、`subject`、`input`、`delivery`、`resources`、`context`、`state`、`runtime`。
+- `LANGBOT_CONTEXT.md`：人类可读摘要。
+- `resources`：只包含本次 run 授权后的资源句柄和能力摘要，不暴露 Host 内部私有对象、secret 或资源内容。
+- `skills`：LangBot skills 不是直接投影给 harness native tool loop 的文件能力；已授权 skill 应由 Host / sandbox 封装成 scoped tools，再通过 `ctx.resources.tools`、`AgentRunAPIProxy` 或 SDK-owned MCP bridge 暴露。
+- `MCP config`：只投影 per-run、scoped 的 SDK-owned bridge 或外部 MCP 连接配置；LangBot 资源访问必须回到 SDK runtime / Host API，不允许 harness 通过自带 MCP/native tool 直接读 Host 内部资源。
+- `state pointers`：外部 session id、working directory、checkpoint 等小型 JSON 状态通过 Host state API 保存。
+
+当前官方外部 harness 路径由 LiteLLM Agent Platform runner 承担（现状见 OFFICIAL_RUNNER_PLUGINS §7）。这类 projection 是"把 LangBot 事实源和授权资源句柄交给 harness"，不是"把 LangBot 资源本体或内部权限交给 harness"，也不是"由 LangBot 决定最终模型上下文"。
+
+## 5. Runner 上下文边界
+
+Host 只给当前事件、当前输入和 context handles。Runner 是否能拉取历史、事件、artifact、state 或 storage，以运行时 `ctx.context.available_apis` 为准；runner 自己决定是否拉取历史、是否搜索、何时摘要、如何构造最终 prompt。
+
+## 6. KV cache 友好的上下文管理
+
+支持 Claude Code SDK、Codex、Pi Agent SDK 等 runtime 时，必须避免每轮由 LangBot 重组大块 prompt：
+
+- 稳定 session key：`workspace/bot/binding/runner/conversation/thread`。
+- 每轮只传 delta：当前 event、artifact refs、少量 runtime metadata。
+- 历史 append-only：不要每轮改写同一段 history 文本。
+- Summary checkpoint 稳定：只有压缩发生时产生新 checkpoint。
+- 大文件和工具结果 artifact 化。
+- Tool/context API schema 稳定，数据通过 API 拉取而非塞入 prompt。
+- 对自管 runtime，优先让它复用自身 session/cache，而不是强制 LangBot 每轮重放 transcript。
+- LiteLLM 接入后，模型窗口元信息应作为 resource/runtime metadata 暴露给 runner，由 runner 决定预算和压缩策略。
+
+稳定 session key 的用途是隔离外部 runtime 的 resume/cache/state，不是改变 PROTOCOL_V1 §13 定义的 Agent 复用和 dispatch 边界。只有当某个外部 harness 的同一 native session 不支持并发 turn 时，runner 或 future runtime control plane 才应按 external session key 做 turn-level 串行化。
+
+对长期运行的 external harness / daemon，推荐运行形态是 reader 与 writer 分离：一个 session reader 独占读取 stdout/SSE/native event stream，并把 native event 转成 `AgentRunResult` 或 task progress；用户输入只作为 turn write 进入该 session。当前一次性 CLI subprocess runner 可以继续在单次 `run(ctx)` 内同步收集 stdout，但后续改成长连接时不应让多个 request 同时读取同一 native stream。
+
+## 7. Host guardrail
+
+Agent 自管 context 不代表无限制访问。LangBot 仍必须控制：每次 run 的 active `run_id`、runner identity、当前 binding 的 resource policy、conversation / actor / subject scope、page size / artifact read size / API rate limit、跨会话读取权限、数据脱敏和敏感变量过滤、审计日志。Host 不负责"最佳上下文策略"，但负责"不越权、不爆内存、不不可审计"。
+
+外部 harness 的 native tools、shell、MCP 或 skill 机制不构成 LangBot 资源授权边界。只要访问的是 LangBot 持有的资源，就必须经 SDK runtime 转发并接受 Host 校验；完整边界见 HOST_SDK §4.8。
+
+## 8. 官方 runner 与业务编排边界
+
+官方 runner 插件可以把状态寄宿在 LangBot，但必须和第三方 runner 一样通过公开 Host API 消费。LangBot core 不内置官方 agent 的业务流程（prompt 组装、tool loop、RAG 编排、summary/compaction、"local-agent 专用"状态字段）。
+
+官方 local-agent 应作为"依附 LangBot 基础设施的复杂 runner 参考实现"：transcript/history 通过 `api.history_page()` / `api.history_search()` 读取，summary/checkpoint/外部 session id/用户偏好通过 `api.state_get()` / `api.state_set()` 或 storage 方法保存，图片/文件/工具大结果通过 `api.artifact_metadata()` / `api.artifact_read_range()` 读取，模型/工具/知识库通过 `api.invoke_llm()` / `api.call_tool()` / `api.retrieve_knowledge()` 调用。这样 LangBot 保持为通用 agent host，不变成内置 agent 框架。具体迁移要求见 [OFFICIAL_RUNNER_PLUGINS.md](./OFFICIAL_RUNNER_PLUGINS.md)。

docs/agent-runner-pluginization/AGENT_RUNNER_QA_GUIDE.md

@@ -0,0 +1,227 @@
+# Agent Runner QA 指南
+
+本文档是 agent-runner 插件化下一轮测试的唯一 QA 入口。它合并并取代旧的 Phase 1 验收矩阵与 2026-05-18 / 2026-05-29 两份本地 QA 报告。
+
+目标不是保留完整历史流水账，而是指导测试 agent 用最小但高价值的路径判断当前分支是否仍然健康。
+
+## 1. 测试边界
+
+当前主线验证的是 AgentRunner Protocol v1：
+
+```text
+event -> binding -> runner.run(ctx) -> result stream
+```
+
+本指南验证：
+
+- Host 能通过当前 Query entry adapter 进入 event-first `run(event, binding)` 主链路。
+- Runner 来自插件 registry，而不是旧内置 runner 分支。
+- `local-agent` 能消费 Host 模型、工具、知识库、history、state、artifact 等基础设施。
+- 外部 harness runner（当前为 LiteLLM Agent Platform 统一入口）能消费 event-first context，并把外部 session 指针写回 host-owned state。
+- 错误、权限裁剪、无输出、timeout 等路径不会破坏主聊天流程。
+
+本指南不验证：
+
+- Runtime Control Plane v2。
+- EventGateway / EventRouter 完整落地由外部 EBA 分支联调；本指南只验证本分支 Host 底座。
+- 发布级 path isolation、secret filtering、MCP allowlist、资源配额和 workspace cleanup。
+- 所有外部服务 runner 的真实凭据联调。
+
+这些属于后续能力或发布门槛，分别见 [RUNTIME_CONTROL_PLANE_V2.md](./RUNTIME_CONTROL_PLANE_V2.md) 与 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md)。
+
+## 2. 状态定义
+
+测试报告只使用以下状态：
+
+| 状态 | 含义 |
+| --- | --- |
+| PASS | 按步骤执行，用户可见行为和日志证据都满足通过条件。 |
+| FAIL | 环境可用，但行为不满足通过条件。 |
+| BLOCKED | 凭据、CLI、外部服务、测试数据或本地配置缺失导致无法执行。必须写清阻塞原因。 |
+| N/A | 当前 runner 或平台明确不支持该能力。必须引用 manifest、文档或配置说明。 |
+
+不能使用“看起来正常”“大概通过”“基本没问题”等模糊状态。
+
+## 3. 执行顺序
+
+推荐按以下顺序执行，前一层失败时不要继续扩大测试面：
+
+1. Host / SDK / runner 单测。
+2. WebUI 登录与 Pipeline Debug Chat 基础 smoke。
+3. `local-agent` 高价值场景。
+4. LiteLLM Agent Platform 外部 harness smoke。
+5. 权限和错误路径补充检查。
+6. 汇总 PASS / FAIL / BLOCKED，并给出下一步建议。
+
+用户可见流程必须通过 WebUI 或真实消息平台验证。API / curl 只能作为诊断证据，不能单独让 UI case PASS。
+
+## 4. 必跑基线
+
+### 4.1 单测基线
+
+在 LangBot 仓库运行：
+
+```bash
+uv run --frozen pytest tests/unit_tests/agent
+```
+
+如果本次改动只触及默认配置或 API service，也至少补跑相关目标测试，例如：
+
+```bash
+uv run pytest tests/unit_tests/api/test_pipeline_service_defaults.py
+```
+
+通过条件：
+
+- agent 单测全 PASS，或失败项已确认与本次 agent-runner 路径无关。
+- 若失败来自 `context_builder`、`orchestrator`、`session_registry`、`resource_builder`、`plugin/handler.py` 的 run action 权限路径，不应进入 UI smoke。
+
+### 4.2 环境基线
+
+用 `langbot-skills` 做环境检查：
+
+```bash
+cd "$LANGBOT_SKILLS_REPO"
+bin/lbs env doctor
+bin/lbs case list
+```
+
+`LANGBOT_SKILLS_REPO` 指向当前工作区里的 `langbot-skills` 仓库。优先使用已有 case，而不是临时发明测试路径。
+
+推荐首批 case：
+
+- `webui-login-state`
+- `pipeline-debug-chat`
+- `local-agent-basic-debug-chat`
+- `local-agent-rag-debug-chat`（改动涉及 RAG / knowledge）
+- `local-agent-plugin-tool-call-debug-chat`（改动涉及 tool / resource policy）
+
+## 5. WebUI 主链路 Smoke
+
+### 5.1 Runner registry
+
+步骤：
+
+1. 打开 WebUI Pipeline 配置页。
+2. 查看 AI runner 下拉列表。
+3. 选择 `plugin:langbot/local-agent/default`。
+4. 保存并刷新页面。
+
+通过条件：
+
+- runner 选项来自插件 registry。
+- 保存后配置仍为 `ai.runner.id` + `ai.runner_config[id]`。
+- `runner_config` 表示 Agent/runner config，不表示插件实例状态。
+- 不读取或回写旧 `ai.runner.runner` 字段。
+- 不出现旧内置 runner stage 名（例如裸 `local-agent`）作为当前选中项或配置 surface。
+- 插件没有循环重启或 metadata 加载失败。
+
+### 5.2 主聊天路径
+
+步骤：
+
+1. 使用绑定 `plugin:langbot/local-agent/default` 的 Pipeline。
+2. 在 Debug Chat 发送确定性普通文本。
+3. 查看 WebUI 回复和后端日志。
+
+通过条件：
+
+- 用户可见回复正常。
+- 后端日志显示走 `AgentRunOrchestrator` / `RUN_AGENT`。
+- 不走旧内置 local-agent 主执行分支。
+- conversation transcript 写入用户消息和助手消息。
+
+## 6. `local-agent` 高价值测试
+
+只保留最能覆盖架构边界的场景。
+
+| ID | 场景 | 操作 | 通过条件 |
+| --- | --- | --- | --- |
+| LA-01 | 绑定 prompt | 配置 system prompt 后发送文本。 | runner 使用 `ctx.config.prompt`，不读取 `ctx.adapter.extra["prompt"]`；回复体现绑定 prompt。 |
+| LA-02 | history API | 连续两轮对话，第二轮引用第一轮 marker。 | runner 通过 Host history API 或自管上下文读取历史，不依赖 inline history window。 |
+| LA-03 | 流式 / 非流式 | 分别用支持流式和关闭流式的路径发送文本。 | 流式 UI 不重复、不空白；非流式只输出最终消息。 |
+| LA-04 | 工具调用 | 绑定测试工具，发送会触发工具的 prompt。 | `ctx.resources.tools` 只包含授权工具；工具调用 started/completed；最终回复包含工具结果。 |
+| LA-05 | RAG | 绑定测试知识库，发送命中文档的 prompt。 | `ctx.resources.knowledge_bases` 包含所选知识库；runner 通过授权 API 检索；回复使用检索内容。 |
+| LA-06 | 多模态 | 发送图片输入。 | `ctx.input.contents` 保留图片；支持视觉模型时正常处理，不支持时受控失败。 |
+| LA-07 | fallback / 错误 | 模拟 primary 模型失败或 runner 抛错。 | fallback 或 `run.failed` 行为受控；后续请求不受影响。 |
+| LA-08 | 无输出保护 | 测试 runner 完成但不产出消息。 | 不产生空白成功回复；按受控失败或明确缺陷处理。 |
+| LA-09 | steering / 运行中追加消息 | 使用支持 steering 的 runner，第一条消息触发长 run；run 未结束时在同 conversation 追加第二条消息。 | 第二条消息被 active run claim，不启动并发 run；runner 通过 `steering_pull` 看到追加输入；EventLog 有 `queued` -> `steering.injected`，若未消费则有 `steering.dropped` 终态；后续普通消息仍可处理。 |
+
+Rerank、remove-think、文件输入等场景只在本次改动直接涉及时补测，不作为每轮必跑项。
+
+## 7. LiteLLM Agent Platform Harness Smoke
+
+这些测试用于验证 Claude Code / Codex 这类自管 runtime 经 LiteLLM Agent Platform 能走同一条 Host 协议路径。若 LiteLLM Agent Platform 服务不可用、目标 harness 没有 CLI/登录态/代理配置，标记 BLOCKED，不要伪造 PASS。
+
+Smoke 前应优先保留一层轻量单测或 fixture 测试：LiteLLM Agent Platform HTTP session、消息发送、结果解析、`run_id` 提示词注入和 LangBot MCP gateway 必须有稳定测试覆盖。WebUI smoke 证明真实链路可用，但不能替代转换层和错误映射测试。
+
+### 7.1 LiteLLM Agent Platform runner
+
+步骤：
+
+1. 确认 LiteLLM Agent Platform 服务可访问，目标 harness（例如 Claude Code 或 Codex）在该服务所在机器上可执行且已登录。
+2. 绑定 `plugin:langbot/litellm-agent-platform-agent/default`。
+3. 配置 `base-url`、`api-mode`、`agent-id` 或 `harness` 等必要字段。
+4. 在 Debug Chat 执行一次确定性真实 smoke。
+5. 检查 LangBot MCP gateway、`run_id` 回填和 host-owned state。
+
+通过条件：
+
+- WebUI 可见回复包含预期 sentinel。
+- 发送给 LiteLLM 的消息包含当前 LangBot `run_id` 和可访问资源摘要。
+- Harness 通过 gateway 调用 `langbot_history_page`、`langbot_retrieve_knowledge` 或 `langbot_call_tool` 时必须携带正确 `run_id`；错误 run id 被拒绝。
+- `external.session_id` 写入 host-owned state。
+- LiteLLM 服务错误、timeout、empty output 都转成受控 `run.failed`。
+- resume 到同一 external session 时，全局锁边界符合 PROTOCOL_V1 §13。
+
+### 7.2 API 型外部 runner
+
+Dify、n8n、Coze、DashScope、Langflow、Tbox 等外部服务 runner 不作为每轮必跑项。只有在本次改动触及对应 runner 或凭据已经可用时执行 smoke。
+
+通过条件：
+
+- runner 可选，配置可保存。
+- 请求成功，或外部服务错误被清晰返回。
+- 外部服务凭据缺失时标记 BLOCKED，并记录缺失项。
+
+## 8. 权限与隔离补充
+
+以下优先用单测 / targeted fixture 覆盖，不要求每次通过 UI 人工构造恶意 runner。
+
+| 场景 | 推荐证据 |
+| --- | --- |
+| 未授权模型调用被拒绝 | `plugin/handler.py` run action 权限测试或目标单测。 |
+| 未授权工具调用被拒绝 | `ctx.resources.tools` 与 host action 拒绝日志。 |
+| 未授权知识库检索被拒绝 | `ctx.resources.knowledge_bases` 与 host action 拒绝日志。 |
+| run_id 结束后复用被拒绝 | session registry 注销测试。 |
+| 插件身份不匹配被拒绝 | `caller_plugin_identity` mismatch 测试。 |
+| 绑定插件身份的 run_id 省略 caller identity 被拒绝 | `_validate_run_authorization(..., caller_plugin_identity=None)` 返回错误。 |
+| 未注册 Runtime 连接伪造插件身份被剥离 | SDK runtime forwarding 测试：请求自带 `caller_plugin_identity` 时，未注册连接转发前必须 `pop`，已注册连接必须覆盖为真实插件身份。 |
+| storage/state scope 越权被拒绝 | state/storage proxy 单测。 |
+| steering claim 异常不杀 consumer loop | controller 单测：无效 runner / registry 异常只让当前消息回到普通 session 槽位路径，消息消费循环继续。 |
+| steering queue 未消费有终态 | session registry / orchestrator 单测：队列有上限；run unregister 时未 pull 项写 `steering.dropped` 审计。 |
+
+如果这些单测失败，不能用 WebUI 正常回复替代。
+
+## 9. 证据要求
+
+每轮测试报告至少记录：
+
+- LangBot commit、SDK commit、相关 runner 插件 commit。
+- Pipeline UUID/name、runner id、关键 runner config 摘要。
+- WebUI 截图或 Playwright 操作记录。
+- 后端日志中对应 query id / run id 的关键行。
+- `langbot-skills` case/report 路径。
+- 外部 harness runner 的 context 文件、session id、working directory、CLI 错误摘要。
+- FAIL/BLOCKED 的复现步骤和归属仓库建议。
+
+报告结论必须回答：
+
+- 是否建议继续进入下一阶段测试。
+- 是否存在主聊天路径阻塞。
+- 是否只是凭据 / 外部服务 / 本机 CLI 缺失导致 BLOCKED。
+- 是否需要进入 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md) 的发布级验收。
+
+## 10. 历史高价值记录
+
+历史高价值记录与当前 runner 验收状态见 [STATUS.md](./STATUS.md)。本指南只保留可重复执行的测试步骤和证据要求。

docs/agent-runner-pluginization/EVENT_BASED_AGENT.md

@@ -0,0 +1,92 @@
+# Event Based Agent 接入设计
+
+> 本文记录 EBA 如何接入当前 AgentRunner Protocol v1 / Host 底座。EventGateway、EventRouter、Event subscription/notification 由外部 EBA 分支实现并联调；本分支只保留 event-first 入口和 envelope/binding models。
+>
+> 数据结构唯一定义在 [PROTOCOL_V1.md](./PROTOCOL_V1.md)（runner 可见）与 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md)（Host 内部模型）；本文只讲 EBA 语义，不重抄 schema。
+> 与当前 runner 外化分支、后续 Agent Platform / Runtime Control Plane 的边界见 [EXTENSION_SCOPE_MATRIX.md](./EXTENSION_SCOPE_MATRIX.md)。
+
+本文描述 EBA 接入时，事件如何进入 LangBot、如何触发 AgentRunner，以及如何复用插件化 agent 基础设施。本分支不实现完整 EventBus / EventRouter / Platform API；这些能力正在外部 EBA 分支联调。这里的目标是把协议边界说清楚，避免当前消息入口继续绑死 Pipeline 和用户文本消息。
+
+## 1. 设计目标
+
+- 消息、撤回、入群、好友申请、定时任务、API 调用都能抽象为 host event。
+- EventRouter 可以根据 event type、bot、workspace、conversation、actor、subject 解析 `AgentBinding`。
+- AgentRunner 通过同一套 orchestrator 被调用。
+- 非消息事件不伪造成用户文本消息。
+- 平台动作执行通过显式 capability / permission / result type 预留，不混入普通文本回复。
+
+## 2. 事件不是消息
+
+`message.received` 只是事件的一种。协议不应假设：一定有用户文本、一定有 conversation history、一定要返回一条聊天消息、actor 一定等于 sender、subject 一定等于当前消息。
+
+| event_type | actor | subject | input |
+| --- | --- | --- | --- |
+| `message.received` | 发消息的人 | 当前消息 | 文本、图片、文件等 |
+| `message.recalled` | 撤回操作者，未知时为系统 | 被撤回消息 | 通常为空 |
+| `group.member_joined` | 新成员或邀请人 | 群/成员关系 | 通常为空 |
+| `friend.request_received` | 申请人 | 好友申请 | 验证消息或申请理由 |
+| `schedule.triggered` | 系统 | 定时任务 | 任务 payload |
+| `api.invoked` | API caller | API request | request payload |
+
+## 3. 稳定事件名
+
+先保留的稳定事件名（作为插件协议的一部分保持稳定）：
+
+- `message.received`
+- `message.recalled`
+- `group.member_joined`
+- `friend.request_received`
+
+平台原始事件名只能进入 `ctx.event.source_event_type` / `raw_ref`，不能成为 `ctx.event.event_type` 的公共契约。
+
+## 4. Event Envelope 与 Binding
+
+- 入口事件用 `AgentEventEnvelope`（HOST_SDK §4.1）承载；顶层字段使用 LangBot 稳定协议名，平台原始事件名和原始 payload 放 `metadata` / `raw_ref`。
+- 触发关系用 `AgentBinding`（HOST_SDK §4.2）表达。EBA 阶段 binding 通过 `event_types`、`scope`、`filters` 决定哪些事件触发当前 bot / channel 绑定的 Agent。
+
+EBA dispatch 基数、Agent 复用和 fan-out 边界以 PROTOCOL_V1 §13 为准；本节只说明外部 EBA 分支的 EventRouter 如何产出当前 v1 主线需要的 binding。
+
+Binding scope 示例：workspace 全局、bot 级、platform channel 级、conversation / group / thread 级、user / actor 级。旧 Pipeline 可迁移为 `message.received` 的临时 binding source，但目标持久配置应是 Agent，不是 Pipeline。
+
+Event Source 可包括：`platform_adapter`（飞书、QQ、微信、Telegram 等）、`webui`、`http_api`、`scheduler`、`system`。EventRouter 不应写死平台 adapter 的类名。
+
+## 5. EventRouter 调用链
+
+```text
+Platform Adapter / WebUI / API
+  -> Event Gateway normalize payload
+  -> EventLog append raw event
+  -> EventRouter resolve one effective AgentBinding
+  -> AgentRunOrchestrator.run(event, binding)
+  -> AgentRunContextBuilder.build(event, binding)
+  -> PluginRuntimeConnector.run_agent()
+  -> AgentRunResult stream
+  -> DeliveryController render / platform action
+```
+
+约束：必须复用现有 orchestrator，不能为 EBA 单独实现另一套 plugin runner 调用协议；非消息事件不能绕过 resource authorization；delivery 和 platform action 走统一权限模型；外部 harness runner 也通过同一套 envelope/binding/context/result 协议接入，不为 Claude Code / Codex / Kimi 单独发明队列协议。observer / fan-out / parallel arbitration 的额外语义仍按 PROTOCOL_V1 §13 处理。
+
+## 6. 平台动作执行
+
+EBA 后 `action.requested`（PROTOCOL_V1 §7.3，当前仅 telemetry 不执行）将用于请求 host 执行平台动作：
+
+```json
+{ "type": "action.requested",
+  "data": { "action": "friend.request.accept",
+            "target": {"platform": "wechat", "request_id": "..."},
+            "payload": {"reason": "policy matched"} } }
+```
+
+Host 必须校验：binding / platform action policy 是否授权该 action、actor / bot / workspace 是否允许、是否需要人工审批，以及当前 run session / caller identity 是否匹配。EBA 还可能预留 `delivery.requested`（请求投递到某 surface）。
+
+Delivery 方面，event 不一定回复到当前聊天窗口：消息事件通常带 reply target；系统事件可能没有默认 reply target，需要 runner 返回 `action.requested` 或由 binding 的 delivery policy 决定投递位置（`DeliveryContext` 见 PROTOCOL_V1 §5.7）。
+
+## 7. 与 Context 协议的关系
+
+EBA 事件进入 AgentRunner 时仍遵循 [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md)：inline 当前事件、大 payload 用 raw/artifact ref、不默认 inline 完整 history、agent 按需通过 API 拉取、Host 保留 EventLog 和权限 guardrail。非消息事件可以被投影进 Transcript，但不能强制伪装为 user message；AgentRunner 根据 event type 自己决定是否纳入模型上下文。
+
+## 8. EBA 分支联调内容
+
+外部 EBA 分支负责联调 EventGateway 完整实现、EventRouter 与 BindingResolver 集成、`AgentBinding` 持久模型和 UI、`DeliveryContext` 完整实现、platform action permission model 和执行器、真实平台事件接入。
+
+当前底座已完成：① 把当前 Pipeline 消息入口适配成 `message.received` event → ② 增加 `AgentBinding` 抽象，先由 current config 生成 → ③ context builder 改为从 event + binding 构造 → ④ 引入 EventLog / Transcript。外部 EBA 分支在此基础上联调：⑤ 非消息事件协议测试与真实事件来源 → ⑥ 真实 EventRouter、binding persistence / UI 和 platform action。

docs/agent-runner-pluginization/EXTENSION_SCOPE_MATRIX.md

@@ -0,0 +1,51 @@
+# AgentRunner 外化扩展边界矩阵
+
+本文用于回答一个问题：本分支只做 AgentRunner 外化时，哪些能力已经作为扩展底座完成，哪些由外部 EBA / Agent Platform / Runtime Control Plane 分支接入，后续分支接入时应该走哪个扩展点。
+
+结论：本分支不实现完整 Agent Platform，也不实现完整 EBA。EBA 完整事件网关与事件路由由外部 EBA 分支联调。本分支必须把 runner 外化的 Host / SDK 边界做干净，让外部分支只需要接入持久模型、事件路由或 runtime task，而不需要重写 `AgentRunner Protocol v1`。
+
+调度基数、Agent 复用、插件实例无状态、Pipeline adapter 和 fan-out 边界的单一事实源是 [PROTOCOL_V1.md](./PROTOCOL_V1.md) §13；本矩阵只说明后续能力应该接入哪个扩展点。
+
+## 1. 分支边界
+
+| 范围 | 本分支职责 | 不在本分支做 |
+| --- | --- | --- |
+| AgentRunner Protocol v1 | 定义 Host 调用 runner 的稳定合同：discovery、`AgentRunContext`、result stream、Host pull API、错误和权限边界。 | 不定义 Agent Platform 的产品数据库模型；不定义 runtime task queue。 |
+| Host runner 外化底座 | 提供 `AgentEventEnvelope`、`AgentBinding` 运行投影、`run(event, binding)`、resource authorization、run-scoped session、EventLog / Transcript / Artifact / State。 | 不实现 EventGateway、scheduler、integration provider、Agent 管控面 UI。 |
+| 当前 Pipeline 入口 | 通过 `QueryEntryAdapter` 把旧 Query / Pipeline config 投影成 event + binding，作为迁移期入口。 | 不继续把 Pipeline 当作长期 agent 配置中心。 |
+| 官方 runner 插件 | 作为协议消费者验证 local-agent / 外部 harness runner 能接入 Host 基础设施。 | 不让官方 runner 的内部实现反向决定 Host / SDK 协议形态。 |
+
+## 2. 扩展矩阵
+
+| 能力 | 当前分支状态 | 后续归属 | 后续接入方式 | 禁止事项 |
+| --- | --- | --- | --- | --- |
+| Product `Agent` | 已有运行期 `AgentConfig` / `AgentBinding` 投影；还没有正式持久化产品对象。 | Agent Platform / binding persistence UI。 | 持久 Agent 保存 runner id、runner config、resource/state/delivery policy；运行前投影为 `AgentBinding`。 | 不把持久 Agent schema 加进 SDK 协议；插件实例边界见 PROTOCOL_V1 §13。 |
+| Bot / channel 绑定 Agent | 已有单次运行前的 `AgentBinding` 解析投影；目标调度语义见 PROTOCOL_V1 §13。 | EBA / Agent Platform。 | EventRouter 根据 bot、channel、workspace、conversation、event type 解析有效 `AgentBinding`。 | 不在本矩阵重定义 fan-out / observer 语义；需要时按 §3 新增设计。 |
+| Agent session / run | 当前只有 `run_id` 和 active `AgentRunSessionRegistry`，用于权限校验和生命周期。 | Agent Platform / Runtime Control Plane。 | 如需要可新增持久 `AgentRun` / `AgentSession` / task 表，但执行仍回到 `run(event, binding)` 或 runtime-managed 等价入口。 | 不把持久 session 字段塞进 `AgentRunContext` 顶层；不要求所有 runner 长期持有 LangBot session。 |
+| EventLog / Transcript / Artifact | 已完成 Host-owned store 和 pull API；runner 不直接写 DB。 | 本分支持续维护底座；Agent Platform 可复用。 | 外部 EBA、scheduler、integration、runtime task 都写同一套 EventLog / Transcript / Artifact。 | 不让 runner / sandbox 直接访问 Host DB；不把大 payload 内联进 prompt。 |
+| Host-owned state / storage | 已有 state snapshot、`state.updated` 处理和 State API；storage 作为授权能力保留。 | 本分支持续维护底座；Runtime / Platform 可复用。 | 外部 session id、working directory、checkpoint 等小 JSON 用 state；大对象用 storage / artifact。 | 不把跨轮次状态存在插件实例内；不绕过 run-scoped authorization。 |
+| EventGateway / EventRouter | 本分支只提供 event-first envelope 和 `run(event, binding)` 入口。 | EBA 分支（联调中）。 | EventGateway 规范化平台/WebUI/API/scheduler 事件；EventRouter 解析一个 binding；调用现有 orchestrator。 | 不为 EBA 新增另一套 runner 调用协议；不把非消息事件伪装成 user message。 |
+| Scheduler / Automation | 不实现。文档中只把 `scheduler` 作为 future event source。 | EBA / Agent Platform。 | 定时任务触发 `schedule.triggered` host event，复用 EventGateway -> EventRouter -> `run(event, binding)`。 | 不直接调用某个 runner 插件；不绕过 EventLog / authorization。 |
+| Integration provider | 不实现。IM platform adapter 仍是当前平台接入系统。 | EBA / Agent Platform。 | OAuth/webhook/outbound provider 应先转成 canonical host event 或 platform action，再交给 AgentRunner。 | 不把 Linear/Slack/GitHub 等 provider 私有 payload 扩散到 runner 协议顶层。 |
+| Platform action / delivery | `action.requested` 已预留但当前仅 telemetry，不执行。`DeliveryContext` 只作为上下文/策略投影。 | EBA / platform action executor。 | 后续 executor 校验 runner capability、binding policy、actor/bot/workspace 权限和审批后执行。 | 不让 runner 直接调用平台 adapter 私有 API；不把平台动作伪装成文本回复副作用。 |
+| Runtime registry / worker / task queue | 不实现。当前官方外部 harness 通过 LiteLLM Agent Platform runner 调用外部平台，不在本分支维护本机 subprocess worker。 | Runtime Control Plane v2。 | 第一阶段先补 Host-owned `AgentRun` / `AgentRunEvent` / run control primitives；完整 runtime registry、heartbeat、task queue、daemon claim、progress/audit 是后续可选阶段。 | 不把 heartbeat/task/warm pool 放进 Protocol v1；不让管理插件拥有 runtime/task 事实源。 |
+| Warm pool / reconcile / diagnose | 不实现。 | Runtime Control Plane v2 / deployment layer。 | 作为 task/runtime 的运维能力，围绕 Host-owned runtime/task/audit 表实现。 | 不把 runtime 运维语义写进普通 runner 协议；不把 pod/task 细节泄漏给普通 runner。 |
+| Agent memory | 不实现通用长期记忆产品层；提供 history/state/storage/artifact 基础能力。 | Agent Platform 或具体 runner/plugin。 | 平台 memory 可通过 Host storage/state 或独立产品表实现，runner 通过授权 API 拉取。 | 不在 Host core 内置通用 agentic memory 策略；不默认把 memory 全量 inline 到 context。 |
+| External harness native session | LiteLLM Agent Platform runner 支持 external session id state handoff 和 LangBot resource projection。 | 官方 runner 后续增强；Runtime Control Plane v2 可接管执行。 | 外部平台调用继续走 `runner.run(ctx)`；如后续引入长连接/daemon 模式，按 external session key 串行 turn，reader 独占 native stream。 | 不把具体 provider native wire 变成 LangBot 协议；全局锁边界见 PROTOCOL_V1 §13。 |
+
+## 3. 后续分支接入规则
+
+外部 EBA、Agent Platform 或 Runtime Control Plane 分支接入时，默认遵守以下规则：
+
+- 新入口只生产或解析 Host 内部模型：`AgentEventEnvelope`、持久 Agent 投影出的 `AgentBinding`、以及必要的 delivery/resource/state policy。
+- runner 调用仍走 `AgentRunOrchestrator.run(event, binding)`，除非 Runtime Control Plane 明确引入 runtime-managed 执行模式；即便如此，runner 可见合同仍应保持 Protocol v1。
+- Host-owned facts 继续写入 EventLog / Transcript / Artifact / State；产品层可以新增更高阶视图，但不能替代这些事实源。
+- 新能力如果需要持久化，优先加 Host-owned 表或 service；不要把事实源藏在插件 storage 或 runner subprocess 内。
+- 新 result type 可以按 Protocol v1 的演进规则增加；不能用入口 adapter 私有字段绕过 schema。
+- 任何 fan-out、observer agent、parallel arbitration、platform action execution 都必须单独定义 delivery、state conflict、approval 和 audit 语义。
+
+## 4. 与 LiteLLM Agent Platform 的关系
+
+这里的 LiteLLM Agent Platform 指面向 agent 产品层的实体拆分：`Agent` 描述可配置 agent，`Session` / `SessionMessage` 描述会话事实，`Automation` 描述自动触发，`IntegrationBinding` 描述外部集成连接，`Memory` 描述长期记忆，`WarmTask` 描述预热/后台任务。这些拆分对 LangBot 后续产品层有参考价值，但不能直接搬进本分支。
+
+LangBot 当前分支的对应目标是更底层的：把 IM/WebUI/API 等入口统一投影到 Host event，把 Agent / binding 配置统一投影到 runner binding，把 runner 能力统一收束到 Protocol v1。完整 Agent Platform 可以在这个底座之上构建，而不应反过来污染本分支的 runner 外化边界。

docs/agent-runner-pluginization/HOST_SDK_INFRASTRUCTURE.md

@@ -0,0 +1,257 @@
+# LangBot Host 与 SDK 基础设施设计
+
+本文档描述 LangBot 作为 agent host 的内部能力与分层架构，以及 Host 内部模型。
+
+- SDK ↔ Host 的协议数据结构（`AgentRunContext`、`AgentRunnerManifest`、`AgentRunResult`、`AgentRunAPIProxy` 等）的**唯一定义在** [PROTOCOL_V1.md](./PROTOCOL_V1.md)；本文只引用，不重抄。
+- 测试执行入口和 smoke 记录见 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md)；安全发布门槛见 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md)。
+- 本文定义的 Host 内部模型（`AgentEventEnvelope`、`AgentBinding`、`AgentRunnerDescriptor`）不属于 SDK 协议字段。
+
+## 1. 目标
+
+LangBot 要转为 agent host，而不是内置 runner 容器：
+
+- 接收 IM、WebUI、API 和外部 EBA 分支 EventRouter 产生的事件。
+- 根据事件、bot、workspace、scope 解析应该调用的 Agent / agent binding。
+- 发现、校验和调用插件提供的 AgentRunner。
+- 为每次 run 提供受限资源、状态、存储、上下文引用和生命周期控制。
+- 接收 AgentRunner 返回的事件流，投递到 IM、WebUI 或其他 output surface。
+
+## 2. 非目标
+
+- 不把 Pipeline 当作长期架构中心。
+- 不要求所有 AgentRunner 依赖 LangBot 的上下文管理。
+- 不要求官方 local-agent 的旧行为反向塑造 host 协议。
+- 不在 host 中实现通用 agentic prompt assembler。
+- 不强制 runner 使用 LangBot state / storage；只提供可选、受控的寄宿能力。
+- 不实现 EventGateway / EventRouter：它们由外部 EBA 分支提供并联调。本分支只定义 host-side envelope/binding models 和 `run(event, binding)` 入口。
+
+## 3. 分层架构
+
+```text
+IM / WebUI / API / EventRouter (external EBA branch)
+        |
+        v
+Event Gateway (external EBA branch)
+        |
+        v
+AgentBindingResolver
+        |
+        v
+AgentRunOrchestrator
+        |-- AgentRunnerRegistry
+        |-- AgentResourceBuilder
+        |-- AgentContextBuilder
+        |-- AgentRunSessionRegistry
+        |-- PersistentStateStore / EventLogStore / TranscriptStore / ArtifactStore
+        v
+Plugin Runtime / AgentRunner
+        |
+        v
+AgentRunResult stream
+        |
+        v
+Delivery / Renderer / Platform API
+```
+
+目标产品模型、单绑定调度、Agent 复用、插件实例无状态和 fan-out 边界以 [PROTOCOL_V1.md](./PROTOCOL_V1.md) §13 为准。本文只说明 Host 如何把当前入口投影为内部模型。当前 Pipeline 只应接入在 Query entry adapter 位置：它可以继续产生 `message.received` 并投影出临时 `AgentConfig` / `AgentBinding`，但不应再拥有 runner 选择、上下文裁剪和业务 agent 执行的核心语义。EventGateway / EventRouter 由外部 EBA 分支实现并联调。
+
+## 4. LangBot 侧能力
+
+### 4.1 Event Gateway / EventRouter（External EBA Branch Integration Point）
+
+> EventGateway / EventRouter 由外部 EBA 分支实现并联调，不在本分支范围。本分支只保留 event-first 入口和 envelope/binding models。
+
+Event Gateway 将把入口统一成 host event（IM 平台消息、WebUI debug chat、API 触发、后续非消息事件），输出稳定的 `AgentEventEnvelope`（Host 内部模型）：
+
+```python
+class AgentEventEnvelope(BaseModel):
+    event_id: str
+    event_type: str
+    event_time: int | None
+    source: str
+    bot_id: str | None
+    workspace_id: str | None
+    conversation_id: str | None
+    thread_id: str | None
+    actor: ActorRef | None
+    subject: SubjectRef | None
+    input: AgentInput          # 见 PROTOCOL_V1 §5.6
+    delivery: DeliveryContext  # 见 PROTOCOL_V1 §5.7
+    raw_ref: RawEventRef | None
+    metadata: dict[str, Any] = {}
+```
+
+`AgentEventEnvelope` 是 Host 内部入口模型；投影给 runner 的是 `ctx.event`（PROTOCOL_V1 §5.4）。原始平台 payload 存为 raw event 或 artifact ref，不扩散到 runner 协议顶层。
+
+**当前 adapter source**：`QueryEntryAdapter.query_to_event(query)` 从 Query 生成 `AgentEventEnvelope`。
+
+### 4.2 AgentConfig 与 AgentBinding
+
+`AgentConfig` 是迁移期的 Host 内部 Agent 配置投影（不暴露给 SDK）。当前 Query entry adapter 从 Pipeline config 投影出它；未来持久 Agent 也应先投影成这个运行期配置，再由 BindingResolver 结合事件和 scope 解析为 `AgentBinding`。
+
+```python
+class AgentConfig(BaseModel):
+    agent_id: str | None = None
+    runner_id: str
+    runner_config: dict[str, Any] = {}
+    resource_policy: ResourcePolicy = ResourcePolicy()
+    state_policy: StatePolicy = StatePolicy()
+    delivery_policy: DeliveryPolicy = DeliveryPolicy()
+    event_types: list[str] = ["message.received"]
+    enabled: bool = True
+    metadata: dict[str, Any] = {}
+```
+
+`AgentBinding` 是"什么事件调用哪个 AgentRunner、带什么 Agent 配置"的 Host 内部运行投影（不暴露给 SDK）。它是 EventRouter / 当前 QueryEntryAdapter 在一次运行前解析出的有效绑定。
+
+```python
+class AgentBinding(BaseModel):
+    binding_id: str
+    enabled: bool
+    scope: BindingScope
+    event_types: list[str]
+    filters: list[EventFilter] = []   # EBA 阶段使用，见 EVENT_BASED_AGENT
+    runner_id: str
+    runner_config: dict[str, Any]
+    resource_policy: ResourcePolicy
+    state_policy: StatePolicy
+    delivery_policy: DeliveryPolicy
+```
+
+BindingResolver 的基数、fan-out 和冲突处理约束见 PROTOCOL_V1 §13；本节只定义 Host 内部投影形态。
+
+**当前 adapter source**：`QueryEntryAdapter.config_to_agent_config(query, runner_id)`
+先把 current config 投影为迁移期 `AgentConfig`，再由
+`AgentBindingResolver.resolve_one(event, [agent_config])` 解析出唯一
+`AgentBinding`。Pipeline 当前只是迁移期 Agent config source（AI runner config
+→ runner_config、extension preference → resource_policy、output settings →
+delivery_policy），但新设计不再把这些字段命名为 Pipeline 专属概念。
+
+### 4.3 AgentRunnerRegistry
+
+Registry 收集 runner descriptor（来自插件 runtime、开发期本地插件）：
+
+```python
+class AgentRunnerDescriptor(BaseModel):
+    id: str
+    source: Literal["plugin"]
+    label: I18nObject
+    description: I18nObject | None = None
+    plugin_author: str
+    plugin_name: str
+    runner_name: str
+    capabilities: AgentRunnerCapabilities    # 见 PROTOCOL_V1 §4.3
+    permissions: AgentRunnerPermissions      # 见 PROTOCOL_V1 §4.4
+    config_schema: list[DynamicFormItemSchema]
+    plugin_version: str | None = None
+    raw_manifest: dict[str, Any] = {}
+```
+
+职责：调用 `plugin_connector.list_agent_runners()` 拉取 runner、校验 typed `AgentRunnerManifest`、输出 descriptor、缓存 discovery 结果并提供 `refresh()`。单个插件 manifest 失败只记 warning，不影响其它 runner。`plugin:author/name/runner` 是稳定 id 格式；插件实例边界见 PROTOCOL_V1 §13。
+
+Host 内置 runner / adapter 不能作为 `AgentRunnerDescriptor.source` 绕过插件
+runtime、`run_id`、`ctx.resources` 和 `AgentRunAPIProxy` 权限链。若需要
+开发期调试 adapter，应放在 Host 内部测试入口，不进入可选 runner 列表。
+
+刷新触发点：插件安装/卸载/升级/重启后；Pipeline metadata 请求时发现缓存为空；可选 TTL（优先保证正确性）。
+
+### 4.4 AgentRunOrchestrator
+
+Orchestrator 是唯一运行入口：
+
+```text
+run(event, binding)
+  -> resolve runner descriptor
+  -> build resources
+  -> build context
+  -> register run session
+  -> call plugin runtime
+  -> normalize result stream
+  -> update state
+  -> unregister run session
+```
+
+它负责：`run_id` 生成和生命周期、timeout/deadline/cancellation、插件异常隔离、result schema 校验和大小限制、`state.updated` 处理、delivery backpressure 和 telemetry。
+
+典型 run 时序：
+
+```text
+QueryEntryAdapter / EventRouter
+  -> AgentRunOrchestrator.run(event, binding)
+  -> AgentRunnerRegistry.resolve(runner_id)
+  -> AgentResourceBuilder.freeze_snapshot(binding, event)
+  -> AgentRunSessionRegistry.register(run_id, runner_id, snapshot)
+  -> AgentContextBuilder.build(event, binding, snapshot)
+  -> PluginRuntimeConnector.run_agent(ctx)
+       -> AgentRunAPIProxy action
+          -> validate active run session + caller identity + snapshot
+          -> Host API / Store
+       <- AgentRunResult stream
+  -> apply state.updated to PersistentStateStore
+  -> write message.completed / artifact.created to Transcript / ArtifactStore
+  -> render delivery or raise RunnerExecutionError
+  -> AgentRunSessionRegistry.unregister(run_id)
+```
+
+`run_from_query()` 保留为 Query entry adapter 入口，但内部转换成 event + binding 后走统一 `run()`。约束：`ChatMessageHandler` 不解析 `plugin:*`、不实例化 wrapper、不知道 runner 组件细节；`PipelineService` 从 registry 读取 metadata，不直接访问插件 runtime；跨请求持久化状态必须走授权 storage / 外部服务。
+
+### 4.5 Resource Authorization
+
+LangBot 在每次 run 前生成 `ctx.resources`（PROTOCOL_V1 §6），来自 manifest permissions 与 binding policy 的交集：
+
+1. `descriptor.permissions` 声明 runner 需要的 LangBot 资源访问上限。
+2. binding / resource policy 允许的资源范围。
+3. Agent/runner config 中选择的模型、知识库、文件等资源。
+4. 当前 event / actor / bot / workspace 的实际权限。
+5. `ctx.context.available_apis` 暴露的 pull API 能力。
+
+这次裁剪结果必须冻结为 run-scoped authorization snapshot，并由
+`AgentRunSessionRegistry` 按 `run_id` 保存。`ctx.resources` 是投影给 runner
+看的同一份授权结果；运行期每个 proxy action 只依据该 snapshot 校验 active
+run session、caller plugin identity、resource id、scope、payload size、rate
+limit 和 deadline。Handler 不应重新执行授权裁剪，否则 build-time 与 runtime
+授权逻辑会漂移。
+
+SDK 侧本地校验只用于开发体验，host 侧 run authorization snapshot 才是安全边界。`spec.capabilities` 只帮助 Host 判断 runner 是否需要 tool / knowledge / skill 等资源投影，不能替代 permissions 或 binding policy。
+
+资源裁剪应通用，不写死 local-agent。selector 与资源的映射示例：`model-fallback-selector` → primary/fallback LLM、`llm-model-selector` → LLM、`rerank-model-selector` → rerank 模型、`knowledge-base-multi-selector` → 知识库；新增 selector 时在 resource builder 中统一扩展。
+
+执行/文件/skill/MCP 等能力的接入方向：先由 Host / sandbox 封装成普通 scoped tool，再通过 `ctx.resources.tools` 和 SDK runtime 转发进入 runner；runner 不应识别或硬编码执行环境 provider。外部 harness 的 native tools 不能直接访问 LangBot 资源。
+
+### 4.6 State / Storage
+
+LangBot 可提供 host-owned state 让 runner 寄宿状态（conversation / actor / subject / runner / binding / workspace state），但**不是强制**。Host 只需提供：授权开关、scope key、get/set/list/delete API（见 PROTOCOL_V1 §8）、持久化 backend、审计和清理策略。外部 agent runtime 可维护自己的 session 和 memory。进程内 state store 只能作为过渡实现，不能作为正式生产语义。
+
+### 4.7 EventLog / Transcript / Artifact（事实源）
+
+- `EventLog`: durable append-only，保存原始事件、系统事件、工具调用、投递结果、错误。
+- `Transcript`: 从 EventLog 投影出的对话视图，用于 UI、审计和按需历史读取。
+- `ArtifactStore`: 保存大文件、多模态输入、工具大结果、平台附件。
+
+三类数据与 working context 的边界、读取约束见 [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md)。AgentRunner 可读取这些能力，但不被迫使用 LangBot 作为唯一记忆系统。
+
+### 4.8 External harness resource projection
+
+Claude Code、Codex、Kimi Code 等外部 harness runner 可能不直接调用 LangBot 的 model/tool loop，而是把 LangBot 事件和授权资源句柄投影到自己的 harness 执行。Host 侧仍保持统一边界：Host 负责构造 event-first context、资源授权、state/storage、EventLog/Transcript/ArtifactStore 和审计；Host 或 binding policy 决定哪些 MCP bridge、skill-backed tool、artifact、history/state 句柄可投影给 runner；runner plugin 把 scoped projection 转成目标 harness 可消费形式；所有 LangBot 资源访问必须经 SDK runtime / `AgentRunAPIProxy` / SDK-owned MCP bridge 转发并接受 Host 校验；外部 harness 负责自己的 native session、tool loop、压缩、权限模式和 resume，但不能用 native tools 绕过 Host 授权。
+
+投影的具体形态（context 文件、resource handles、LangBot MCP gateway、state pointers）见 AGENT_CONTEXT_PROTOCOL §4.5；当前 LiteLLM Agent Platform runner 形态见 OFFICIAL_RUNNER_PLUGINS §7。发布级隔离要求见 SECURITY_HARDENING。
+
+## 5. SDK 侧协议
+
+SDK 组件入口如下；所有数据结构定义见 PROTOCOL_V1。
+
+```python
+class AgentRunner(BaseComponent):
+    __kind__ = "AgentRunner"
+
+    @classmethod
+    def get_config_schema(cls) -> list[dict]: ...
+
+    async def run(self, ctx: AgentRunContext) -> AsyncGenerator[AgentRunResult, None]: ...
+    # ctx: PROTOCOL_V1 §5.2 ; AgentRunResult: PROTOCOL_V1 §7
+```
+
+- Manifest / capabilities / effective access：PROTOCOL_V1 §4。Capabilities 来自组件 manifest 的 `spec.capabilities`，不是 SDK 基类 classmethod。
+- `AgentRunContext`：PROTOCOL_V1 §5.2。`messages` / `bootstrap` 不是协议字段。
+- `AgentRunResult`：PROTOCOL_V1 §7。
+- `AgentRunAPIProxy`：PROTOCOL_V1 §8，是 runner 访问 host 能力的唯一入口，所有请求带 `run_id`。

docs/agent-runner-pluginization/OFFICIAL_RUNNER_PLUGINS.md

@@ -0,0 +1,136 @@
+# 官方 AgentRunner 插件迁移计划
+
+本文档描述内置 `RequestRunner` 迁出 LangBot 后，官方 runner 插件如何组织、迁移和验收。它是 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md) 和 [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md) 的下游落地计划，不是 LangBot 宿主协议的设计前提。QA 入口和 smoke 记录见 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md)。
+
+官方 `local-agent` 可以外移，也可以重写。设计重点不是保留旧内置 runner 的内部结构，而是验证一个依附 LangBot host 基础设施的官方 agent 能否完整工作。同时，LangBot host 协议必须服务 Claude Code SDK、Codex、Pi Agent SDK、外部 Agent 平台等自管 context/runtime 的 runner，不能被官方插件的实现细节绑死。
+
+## 1. 仓库组织
+
+官方 runner 插件与 LangBot 主仓库、SDK 仓库以不同节奏迭代：LangBot 主仓库只维护宿主协议和调度，SDK 仓库维护 AgentRunner 组件和 runtime 协议，官方 runner 插件承载业务 runner 的具体实现和第三方平台适配。
+
+当前推荐"官方插件可独立发布，必要时共享 SDK helper"。开发期采用本地多目录布局：
+
+```text
+langbot-app/
+  langbot-local-agent/                # plugin:langbot/local-agent/default
+    manifest.yaml
+    components/agent_runner/default.{yaml,py}
+  langbot-agent-runner/               # 外部服务 runner 仓库
+    litellm-agent-platform-agent/  dify-agent/  n8n-agent/  ...
+```
+
+后续可聚合进 monorepo，也可继续独立发布——这个选择不影响协议设计。重复逻辑优先沉淀到 SDK 或明确的共享 helper 包，不要把宿主私有结构泄漏给插件。旧 `src/langbot/pkg/provider/runners/*` 只作为历史行为对齐基准；当前未发布分支不提供旧内置 runner 的运行时 fallback。
+
+## 2. 插件命名和 runner id
+
+| 旧 runner | 官方插件 | runner id |
+| --- | --- | --- |
+| `local-agent` | `langbot/local-agent` | `plugin:langbot/local-agent/default` |
+| `dify-service-api` | `langbot/dify-agent` | `plugin:langbot/dify-agent/default` |
+| `n8n-service-api` | `langbot/n8n-agent` | `plugin:langbot/n8n-agent/default` |
+| `coze-api` | `langbot/coze-agent` | `plugin:langbot/coze-agent/default` |
+| - | `langbot/litellm-agent-platform-agent` | `plugin:langbot/litellm-agent-platform-agent/default` |
+| `dashscope-app-api` | `langbot/dashscope-agent` | `plugin:langbot/dashscope-agent/default` |
+| `deerflow-api` | `langbot/deerflow-agent` | `plugin:langbot/deerflow-agent/default` |
+| `langflow-api` | `langbot/langflow-agent` | `plugin:langbot/langflow-agent/default` |
+| `tbox-app-api` | `langbot/tbox-agent` | `plugin:langbot/tbox-agent/default` |
+| `weknora-api` | `langbot/weknora-agent` | `plugin:langbot/weknora-agent/default` |
+
+每个插件可后续提供多个 runner，但迁移目标的默认 runner 统一叫 `default`。
+
+## 3. 迁移批次
+
+- **Batch 1（打通协议）**：`local-agent`（能力最完整基准）、`litellm-agent-platform-agent`（外部 code-agent harness 统一入口）、`dify-agent`（传统 service API runner）。
+- **Batch 2（外部 workflow）**：`n8n-agent`、`langflow-agent`（webhook/workflow 输入输出、timeout、外部 conversation id）。
+- **Batch 3（平台 Agent API）**：`coze-agent`、`dashscope-agent`、`tbox-agent`、`deerflow-agent`、`weknora-agent`（平台特有响应格式、引用资料、文件/图片输入、外部 thread/session 状态）。
+
+## 4. 每个官方插件的组件要求
+
+每个插件至少包含一个 `AgentRunner` 组件，manifest 示例：
+
+```yaml
+apiVersion: langbot/v1
+kind: AgentRunner
+metadata:
+  name: default
+  label: { en_US: Dify Agent, zh_Hans: Dify Agent }
+  description:
+    en_US: Run a Dify application as a LangBot AgentRunner.
+    zh_Hans: 将 Dify 应用作为 LangBot AgentRunner 运行。
+spec:
+  config: []
+  capabilities:        # 字段语义见 PROTOCOL_V1 §4.3
+    streaming: true
+execution:
+  python: { path: ./main.py, attr: DefaultAgentRunner }
+```
+
+## 5. local-agent 插件方向
+
+`local-agent` 是官方插件中能力最完整的消费者，但不是宿主协议的设计中心。它需要证明：一个主要依附 LangBot host 能力的 agent runner 可以通过公开协议完成模型、工具、知识库、状态、history、artifact、上下文压缩和消息投递。
+
+迁移或重写需覆盖旧内置 runner 的用户可见能力：model primary/fallback 选择、prompt、knowledge-bases、rerank-model、rerank-top-k、function calling、streaming、multimodal input、conversation history、monitoring metadata。
+
+责任边界与 Host API 消费方式见 AGENT_CONTEXT_PROTOCOL §8。关键约束：
+
+- 从 `ctx.config` 读取静态绑定 `prompt`，**不**读取 `ctx.adapter.extra["prompt"]`；不消费 Query entry adapter 生成的历史窗口。
+- 通过 `AgentRunAPIProxy.history` 拉取 transcript，而不是依赖 host 每轮强塞历史窗口。
+- `ctx.input.contents` 保留图片/文件等多模态内容；RAG 只替换/插入文本部分，不丢图片/文件。
+- 不能绕过 `ctx.resources` 调用未授权模型、工具或知识库。
+- manifest 声明功能能力、LangBot 资源 permissions 和配置表单；实际授权来自 manifest permissions 与 binding resource policy、runner config、`ctx.context.available_apis` 和 Host run session snapshot 的交集。
+
+### 5.1 Native Execution / Skills 后续接入
+
+本阶段不把 sandbox/skills 做成 AgentRunner 协议字段。后续 sandbox/skills 分支合并后，命令执行、文件操作、skill、MCP managed process 应先由 Host / sandbox 封装成 scoped tools，再通过 `ctx.resources.tools` 和 SDK runtime 转发暴露给 runner。这让 local-agent 只消费授权后的 Host 基础设施，而不是直接持有宿主机执行能力。
+
+## 6. 外部 runner 插件要求
+
+外部平台 runner 迁移遵循：旧配置字段尽量保持同名便于 migration 复制；输出统一转换为 `AgentRunResult`；外部 API timeout 从 runner config 读取；平台 conversation id 存 plugin storage 或 context runtime state，不依赖 LangBot 内置 conversation uuid 私有结构；流式按平台能力声明，没有流式就只发 `message.completed`。
+
+### 6.1 Code-agent harness runner
+
+Claude Code、Codex、Kimi Code 这类 runner 不一定通过 LangBot 的模型/工具 loop 执行，可以依赖自己的 harness，但仍必须遵守统一 Host 边界。总体边界见 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md) §4.8；context projection 形态见 [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md) §4.5；发布级要求见 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md)。
+
+本文件只补充官方 runner 的实现要求：输入来自 `ctx.event` / `ctx.input`，不依赖 Pipeline 私有 `Query`；外部 session id / workspace / checkpoint 写入 Host state 或 plugin storage；插件实例边界见 PROTOCOL_V1 §13；CLI / subprocess runner 必须处理 timeout、取消、空输出、非零退出和 stderr 映射。
+
+实现结构应把 provider-native output 解析与 LangBot result stream 组装分开：Claude stream-json、Codex JSONL、Kimi / OpenCode 事件等只在 runner adapter 内解析，输出统一归一为 `AgentRunResult`（`message.completed` / `message.delta`、`state.updated`、`artifact.created`、`run.completed` / `run.failed`）。未知 native event 不应导致 run 崩溃；应记录诊断 metadata 或 warning。新增 harness 时优先补 native fixture -> `AgentRunResult` 的转换测试，再接 WebUI smoke。
+
+并发约束应按外部 session 粒度表达，而不是按 Agent / runner id / 插件实例表达；Agent 复用和全局锁边界见 PROTOCOL_V1 §13。若 runner 使用 `external.session_id` / `thread_id` resume 到同一 native session，且该 harness 不支持并发 turn，runner 应按稳定 external session key 串行写入；一次性 subprocess runner 可以只在单次 `run(ctx)` 内处理，长连接/daemon runner 则应采用 reader 独占 native stream、turn writer 串行写入的结构。
+
+### 6.2 LangBot MCP gateway
+
+外部 harness 不能直接持有进程内的 `plugin_runtime_handler`，也不能用自己的 native tools 直接访问 LangBot 资源。当前 LiteLLM Agent Platform runner 通过稳定 HTTP MCP gateway 把 harness 的工具请求转回 SDK runtime / Host API：
+
+- Gateway 由 runner 插件启动，暴露稳定的 `langbot_history_page`、`langbot_retrieve_knowledge`、`langbot_call_tool` 等最小工具面。
+- Harness 每次调用必须携带当前 LangBot `run_id`；Host 仍按 run session、caller identity 和授权快照校验。
+- Gateway 只转发 LangBot 资产访问，不承担外部 harness 的文件、进程或 native tool 权限边界。
+
+第一批工具保持很小：history page、knowledge retrieve、authorized tool call。新增工具必须先有 Host action 权限与 run-scoped authorization，再由 gateway 投影。
+
+## 7. LiteLLM Agent Platform runner 当前形态
+
+`litellm-agent-platform-agent` 是当前外部 harness runner 的统一入口，用来把 Claude Code、Codex 等具体执行器交给 LiteLLM Agent Platform / lite-harness 管理，而不是在 LangBot 官方 runner 仓库中维护每个 CLI provider 的独立适配器。本地 smoke 验收入口与记录见 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md)。
+
+当前形态：
+
+- Runner ID：`plugin:langbot/litellm-agent-platform-agent/default`。
+- Runner 通过 HTTP 调用 LiteLLM Agent Platform，外部 harness 的安装、登录态、workspace 和 provider-native 权限由该平台所在运行环境负责。
+- Runner 会把当前 LangBot `run_id`、可访问资源摘要和 gateway 使用规则注入本次消息；harness 通过 gateway 回填 `run_id` 后访问 LangBot 资产。
+- 外部 session id 写回 Host state，后续轮次可复用目标平台会话。
+
+### 7.1 当前限制
+
+这不是发布级安全边界实现；LangBot 只约束 LangBot 持有资产的访问，外部 harness 的文件、进程、workspace、provider-native MCP 和模型凭据由 LiteLLM Agent Platform 部署侧承担。当前 `run_id` 由系统提示词传递给 harness 并由 gateway 校验，后续若 LiteLLM 原生支持 run-scoped MCP session，可切换为平台级传递。runtime 管控面方向见 [RUNTIME_CONTROL_PLANE_V2.md](./RUNTIME_CONTROL_PLANE_V2.md)。
+
+## 8. 发布和安装策略
+
+最终 LangBot 安装/升级时需保证官方 runner 插件可用，可选方案：首次启动检测缺失并提示安装；打包发行版预装；migration 前检查插件存在性。当前分支未发布，因此不把历史配置兼容或旧内置 runner fallback 写入运行时协议面。建议顺序：开发阶段用本地路径插件 → 发布前支持 marketplace 安装 → 若发布升级需要迁移历史配置，再在 release gate 中实现一次性 migration 并要求官方插件已可用。
+
+## 9. 验收标准
+
+- 每个目标 runner 都有对应官方 AgentRunner 插件和稳定 runner id；当前配置只使用 `ai.runner.id` + `ai.runner_config[id]`。
+- LangBot 主聊天路径不再通过 `RequestRunner` 执行业务 runner。
+- 官方插件测试覆盖非流式、流式、错误、timeout、配置缺失。
+- `local-agent` 能完成模型 fallback、tool calling、知识库检索、多模态输入、静态绑定 prompt 消费、history API 拉取、rerank。
+- `litellm-agent-platform-agent` 或同类 code-agent harness runner 能消费 event-first context、投影 scoped resources、保存 external session state，并通过 WebUI Debug Chat smoke。
+- `local-agent` 覆盖旧内置 runner 的用户可见核心能力；代码结构和运行路径不需要相同。

docs/agent-runner-pluginization/PROTOCOL_V1.md

@@ -0,0 +1,770 @@
+# LangBot AgentRunner Protocol v1
+
+本文档是 LangBot Host 与插件 SDK / Runtime / AgentRunner 之间协议合同的**唯一规范来源（single source of truth）**。
+
+- 本文件描述当前 Protocol v1 稳定合同，不混入验收流水。当前实现状态见 [STATUS.md](./STATUS.md)，测试执行入口见 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md)，安全发布门槛见 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md)。
+- 本文件之外的任何文档**不得重新定义这里的数据结构**，只能引用，例如"见 PROTOCOL_V1 §4.2"。
+- Host 内部模型（`AgentEventEnvelope`、`AgentBinding`、Descriptor、各 Store）不属于 SDK 协议，定义在 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md)。
+
+## 1. 协议目标
+
+Protocol v1 只解决四件事：
+
+- LangBot 如何发现插件提供的 AgentRunner。
+- LangBot 如何把一次事件调用封装成 `AgentRunContext`。
+- AgentRunner 如何以事件流形式返回运行结果。
+- AgentRunner 如何通过受限 API 访问 LangBot host 能力。
+
+Protocol v1 **不定义**：
+
+- LangBot 内部如何持久化 `AgentBinding`（见 HOST_SDK）。
+- AgentRunner 内部如何组装 prompt、压缩历史、管理 memory（见 [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md)）。
+- 官方 runner 的具体实现（见 [OFFICIAL_RUNNER_PLUGINS.md](./OFFICIAL_RUNNER_PLUGINS.md)）。
+- Pipeline 的长期配置模型。
+- 发布级安全 hardening 的完整实现（见 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md)）。
+
+## 2. 参与方
+
+| 名称 | 职责 |
+| --- | --- |
+| LangBot Host | 事件入口、绑定解析、权限、资源、存储、生命周期、结果投递。 |
+| Plugin Runtime | 加载插件，响应 Host 的 runner discovery 和 run 调用。 |
+| AgentRunner | 插件提供的 agent 执行组件。 |
+| AgentRunAPIProxy | AgentRunner 访问 Host 能力的受限 API。 |
+| AgentBinding | Host 内部的事件到 runner 绑定配置，不直接暴露给 SDK（见 HOST_SDK §4.2）。 |
+
+产品层的 `Agent` 替代旧 Pipeline 承载 agent 配置：bot / IM channel
+绑定一个 Agent，一个 Agent 可以被多个 bot / channel 复用。Host 内部的
+`AgentBinding` 是一次事件运行前解析出的有效绑定，只影响 Host 构造出的
+`ctx.config`、`ctx.resources`、`ctx.context` 和 `ctx.delivery`。SDK 不需要知道
+Agent / binding 的持久化形态。
+
+外部 harness runner（Claude Code、Codex、Kimi Code 等）也是 `AgentRunner`：它们消费 event-first `AgentRunContext`、返回 `AgentRunResult`，并通过 Host 授权的 state/storage/artifact API 保存跨轮次指针。它们内部可以继续使用自己的 session、tool loop、MCP、上下文压缩和权限模型。
+
+## 3. 协议演进
+
+当前 AgentRunner 合同不暴露显式 `protocol_version` 字段。协议演进先按字段级兼容规则处理：
+
+- 新增可选字段保持向后兼容。
+- 删除字段或改变既有字段语义，需要在 SDK 发布前完成；发布后应走新的显式兼容方案。
+- 结果流演进：Host **必须忽略未知 result type 并记录 warning**（除非该 type 明确要求强校验）。SDK envelope 接收入站未知 `type` 字符串，runner 侧可按原字符串转发或忽略；新增 result type 不提升大版本。
+- SDK 入站 context 类实体偏宽松，用于兼容 Host 附加的非核心字段；manifest、result payload、page/result 返回与错误模型偏严格，未知字段默认禁止。安全边界仍在 Host，SDK 校验只提升开发体验。
+
+## 4. Discovery 协议
+
+### 4.1 LIST_AGENT_RUNNERS
+
+Host 调用 Plugin Runtime 获取当前插件暴露的 runner 列表，请求无额外 payload。返回：
+
+```python
+class ListAgentRunnersResponse(BaseModel):
+    runners: list[AgentRunnerDiscovery]
+
+class AgentRunnerDiscovery(BaseModel):
+    plugin_author: str
+    plugin_name: str
+    runner_name: str
+    runner_description: I18nObject | None = None
+    manifest: AgentRunnerManifest
+    capabilities: AgentRunnerCapabilities  # compatibility alias of manifest.capabilities
+    permissions: AgentRunnerPermissions    # compatibility alias of manifest.permissions
+    config: list[DynamicFormItemSchema] = []
+```
+
+`manifest` 是 SDK typed `AgentRunnerManifest`，由 Runtime 从插件组件 manifest 解析并校验后返回。`plugin_author` / `plugin_name` / `runner_name` 保留为 transport 寻址字段；Host 以它们生成稳定 runner id，并把 `manifest.id` 校验为 `plugin:author/name/runner`。单个 runner manifest 解析失败时 Runtime/Host 记录 warning 并跳过该 runner，不影响同一插件或其它插件的 runner discovery。
+
+`capabilities` / `permissions` 顶层字段是兼容旧 discovery 消费方的冗余别名；新代码必须以 `manifest.capabilities` / `manifest.permissions` 为准。
+
+### 4.2 AgentRunnerManifest
+
+这里的 manifest 指 Runtime 返回给 Host 的 typed runner manifest：
+
+```python
+class AgentRunnerManifest(BaseModel):
+    id: str
+    name: str
+    label: I18nObject
+    description: I18nObject | None = None
+    capabilities: AgentRunnerCapabilities = AgentRunnerCapabilities()
+    permissions: AgentRunnerPermissions = AgentRunnerPermissions()
+    config_schema: list[DynamicFormItemSchema] = []
+    metadata: dict[str, Any] = {}
+```
+
+- runner id 由 Host 生成，格式 `plugin:author/name/runner`。
+- `name` 是插件内 runner 名称，例如 `default`。
+- `config_schema` 只描述绑定配置表单，不代表插件实例状态。
+- `capabilities` 是 Host 用于 UI 和资源投影的 typed bool model；它不是权限授予。
+- `permissions` 是 runner 申请的 LangBot 资源访问上限；实际授权仍必须与 binding policy 求交。
+- `metadata` 只放展示、诊断、非稳定扩展信息。
+
+### 4.3 Capabilities
+
+```python
+class AgentRunnerCapabilities(BaseModel):
+    streaming: bool = False
+    tool_calling: bool = False
+    knowledge_retrieval: bool = False
+    multimodal_input: bool = False
+    skill_authoring: bool = False
+    interrupt: bool = False
+    steering: bool = False
+
+    model_config = ConfigDict(extra="forbid")
+```
+
+- `streaming`: runner 可以返回 `message.delta`。
+- `tool_calling`: runner 可能调用 Host tool API。
+- `knowledge_retrieval`: runner 可能调用 Host knowledge API。
+- `multimodal_input`: runner 可以处理非纯文本 input / artifact。
+- `skill_authoring`: runner 需要 Host 提供 skill facts 以及 skill authoring tools，例如 `activate` / `register_skill`。
+- `interrupt`: runner 支持取消或中断。
+- `steering`: runner 支持在 turn 边界通过 Host pull API 消费同 conversation 在途追加消息。
+
+Capabilities 字段全部是 `bool`，未知 key 禁止进入 typed manifest。早期草案里的上下文/会话类 capability 已删除；对应语义由 event-first context 和 runner-owned context 原则表达。
+
+### 4.4 Permissions 与 Effective Access
+
+```python
+class AgentRunnerPermissions(BaseModel):
+    models: list[Literal["invoke", "stream", "rerank"]] = []
+    tools: list[Literal["detail", "call"]] = []
+    knowledge_bases: list[Literal["list", "retrieve"]] = []
+    history: list[Literal["page", "search"]] = []
+    events: list[Literal["get", "page"]] = []
+    artifacts: list[Literal["metadata", "read"]] = []
+    storage: list[Literal["plugin", "workspace"]] = []
+    files: list[Literal["config", "knowledge"]] = []
+
+    model_config = ConfigDict(extra="forbid")
+```
+
+平台动作执行不属于当前 permissions。Platform action executor / EBA action 分支落地前，runner 只能返回 `action.requested` telemetry，Host 不执行平台动作。
+
+Runner 实际可用 LangBot 资源来自 Host 在 run 前冻结的授权快照：
+
+```text
+effective_access = manifest.permissions ∩ binding.resource_policy ∩ current scope/config
+```
+
+具体落地：
+
+1. `AgentResourceBuilder` 先用 manifest permissions 与 binding resource policy / runner config 求交，生成 `ctx.resources`。
+2. `AgentContextBuilder` 用 manifest permissions 与 binding state/storage policy 求交，生成 `ctx.context.available_apis`。
+3. `AgentRunSessionRegistry` 冻结 run-scoped resources 与 available APIs。
+4. Runtime handler / `AgentRunAPIProxy` 按 active `run_id`、runner identity、caller plugin identity、resource id、scope、payload size、rate limit 和 deadline 校验每次调用。
+
+反承诺：manifest permissions **只约束 LangBot 持有的资源访问**。它不承诺限制外部 harness 的 native shell、文件系统、CLI、MCP、网络或本机权限；这些能力由 operator/runtime/sandbox 另行约束，见 HOST_SDK §4.8 与 SECURITY_HARDENING。
+
+默认原则：
+
+- Host 不得默认 inline 全量历史。
+- Host 只 inline 当前 event / input 和 context handles。
+- Runner 拥有 working context assembly。
+- Runner 可在授权后通过 Host history / event / artifact / state API 拉取更多上下文。
+- 历史窗口策略不属于 Protocol v1 字段，也不属于 Host 通用语义。
+
+context 边界的设计理由见 [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md)。
+
+## 5. Run 协议
+
+### 5.1 RUN_AGENT
+
+Host 调用 Runtime：
+
+```python
+class AgentRunRequest(BaseModel):
+    runner_id: str
+    runner_name: str
+    context: AgentRunContext
+```
+
+Runtime 返回 `AgentRunResult` 异步流。底层 transport 可继续用 `plugin_author` / `plugin_name` / `runner_name` 定位组件，但协议语义以 `runner_id` 和 `context` 为准。
+
+### 5.2 AgentRunContext
+
+这是 SDK 看到的**唯一权威 context 定义**。
+
+```python
+class AgentRunContext(BaseModel):
+    run_id: str
+    trigger: AgentTrigger
+    event: AgentEventContext
+    conversation: ConversationContext | None = None
+    actor: ActorContext | None = None
+    subject: SubjectContext | None = None
+    input: AgentInput
+    delivery: DeliveryContext
+    resources: AgentResources
+    context: ContextAccess
+    state: AgentRunState
+    runtime: AgentRuntimeContext
+    config: dict[str, Any] = {}
+    adapter: AdapterContext | None = None
+    metadata: dict[str, Any] = {}
+```
+
+核心约束：
+
+- `event` 是必选字段，Protocol v1 是 event-first。
+- `input` 表示当前事件的主输入，不等于历史消息。
+- `bootstrap` / `messages` **不是协议字段**；Host 不内联历史窗口。
+- `adapter` 只放入口 adapter 的非核心元数据，runner 不应依赖它做长期能力。
+- `config` 是 Agent/runner config，不是插件实例状态。
+
+### 5.3 AgentTrigger
+
+```python
+class AgentTrigger(BaseModel):
+    type: str
+    source: Literal["platform", "webui", "api", "scheduler", "system", "host_adapter"]
+    timestamp: int | None = None
+```
+
+`trigger.type` 应与 `event.event_type` 一致或更粗粒度。例如入口适配器触发消息时：
+
+```json
+{ "type": "message.received", "source": "host_adapter" }
+```
+
+### 5.4 AgentEventContext
+
+```python
+class AgentEventContext(BaseModel):
+    event_id: str
+    event_type: str
+    event_time: int | None = None
+    source: str
+    source_event_type: str | None = None
+    raw_ref: RawEventRef | None = None
+    data: dict[str, Any] = {}
+```
+
+- `event_type` 使用 LangBot 稳定协议名，例如 `message.received`。稳定事件名清单见 [EVENT_BASED_AGENT.md](./EVENT_BASED_AGENT.md)。
+- 平台原始事件名放入 `source_event_type`。
+- 大型原始 payload 必须放入 `raw_ref` 或 artifact，不应直接塞入 `data`。
+
+### 5.5 Conversation / Actor / Subject
+
+```python
+class ConversationContext(BaseModel):
+    conversation_id: str | None = None
+    thread_id: str | None = None
+    launcher_type: str | None = None
+    launcher_id: str | None = None
+    sender_id: str | None = None
+    bot_id: str | None = None
+    workspace_id: str | None = None
+    session_id: str | None = None
+
+class ActorContext(BaseModel):
+    actor_type: str
+    actor_id: str | None = None
+    actor_name: str | None = None
+    metadata: dict[str, Any] = {}
+
+class SubjectContext(BaseModel):
+    subject_type: str
+    subject_id: str | None = None
+    data: dict[str, Any] = {}
+```
+
+示例：
+
+- 消息事件：actor 是发消息的人，subject 是当前消息。
+- 入群事件：actor 是新成员或邀请人，subject 是群/成员关系。
+- 定时事件：actor 可以是 system，subject 是 schedule。
+
+### 5.6 AgentInput
+
+```python
+class AgentInput(BaseModel):
+    text: str | None = None
+    contents: list[ContentElement] = []
+    attachments: list[ArtifactRef] = []
+```
+
+- 文本、多模态、附件都属于当前 event input。
+- 大文件、图片、音频、工具大结果应以 artifact ref 传递。
+- 平台原始消息链不属于 SDK `AgentInput`；需要诊断时放在 Host 内部 envelope 或 `ctx.adapter.extra` 的一次性兼容字段中，不作为长期 runner 合同。
+
+### 5.7 DeliveryContext
+
+```python
+class DeliveryContext(BaseModel):
+    surface: str
+    reply_target: dict[str, Any] | None = None
+    supports_streaming: bool = False
+    supports_edit: bool = False
+    supports_reaction: bool = False
+    max_message_size: int | None = None
+    platform_capabilities: dict[str, Any] = {}
+```
+
+Runner 可参考 delivery 能力决定返回 `message.delta`、`message.completed` 或 `action.requested`。
+
+### 5.8 ContextAccess
+
+```python
+class ContextAccess(BaseModel):
+    conversation_id: str | None = None
+    thread_id: str | None = None
+    latest_cursor: str | None = None
+    event_seq: int | None = None
+    transcript_seq: int | None = None
+    has_history_before: bool = False
+    inline_policy: InlineContextPolicy
+    available_apis: ContextAPICapabilities
+
+class InlineContextPolicy(BaseModel):
+    mode: Literal["none", "current_event", "recent_tail", "summary_tail"]
+    delivered_count: int = 0
+    source_total_count: int | None = None
+    messages_complete: bool = False
+    reason: str | None = None
+
+class ContextAPICapabilities(BaseModel):
+    prompt_get: bool = False
+    history_page: bool = False
+    history_search: bool = False
+    event_get: bool = False
+    event_page: bool = False
+    artifact_metadata: bool = False
+    artifact_read: bool = False
+    state: bool = False
+    storage: bool = False
+    steering_pull: bool = False
+```
+
+`ContextAccess` 告诉 runner：Host inline 了什么、没 inline 什么、需要更多上下文时走哪些 API。它是 runner 按需读取上下文的入口说明，不是 Host 的业务上下文编排策略。
+
+### 5.9 AgentRuntimeContext
+
+```python
+class AgentRuntimeContext(BaseModel):
+    langbot_version: str | None = None
+    trace_id: str | None = None
+    deadline_at: float | None = None
+    metadata: dict[str, Any] = {}
+```
+
+### 5.10 AgentRunState
+
+```python
+class AgentRunState(BaseModel):
+    conversation: dict[str, Any] = {}
+    actor: dict[str, Any] = {}
+    subject: dict[str, Any] = {}
+    runner: dict[str, Any] = {}
+```
+
+State 是可选 host-owned snapshot。Runner 也可以完全自管状态。
+
+## 6. Resources
+
+```python
+class SkillResource(BaseModel):
+    skill_name: str
+    display_name: str | None = None
+    description: str | None = None
+
+class AgentResources(BaseModel):
+    models: list[ModelResource] = []
+    tools: list[ToolResource] = []
+    knowledge_bases: list[KnowledgeBaseResource] = []
+    skills: list[SkillResource] = []
+    files: list[FileResource] = []
+    storage: StorageResource = StorageResource()
+    platform_capabilities: dict[str, Any] = {}
+```
+
+`skills` 只包含本次 run 中 pipeline-visible 的 skill facts，例如 `skill_name`、`display_name` 和 `description`。Host 不把这些 facts 追加到 system prompt，也不把它们编排进工具描述；runner 可以自行决定是否放入 model prompt、转换成 MCP surface，或只在自己的策略层使用。
+
+资源列表是本次 run 的授权结果。History / Event / Artifact 访问通过 `ctx.context.available_apis` 和 Host 侧 run session 校验控制，不作为可枚举 resource list 暴露。Runner 只能通过 `AgentRunAPIProxy` 访问这些能力。
+
+## 7. Result Stream
+
+### 7.1 AgentRunResult envelope
+
+```python
+JSONValue = str | int | float | bool | None | list["JSONValue"] | dict[str, "JSONValue"]
+
+ResultType = Literal[
+    "message.delta",
+    "message.completed",
+    "tool.call.started",
+    "tool.call.completed",
+    "artifact.created",
+    "state.updated",
+    "action.requested",
+    "run.completed",
+    "run.failed",
+]
+
+class AgentRunResult(BaseModel):
+    run_id: str
+    type: AgentRunResultType | str
+    data: dict[str, Any] = {}
+    usage: LLMTokenUsage | None = None
+    sequence: int | None = None
+    timestamp: int | None = None
+```
+
+SDK 当前实现是单一 envelope：`type` 枚举 + `data` dict。Payload 由 SDK typed model 构造并 dump，但 wire 不改成 discriminated union；这样新旧版本偏斜时 Host 仍可按 §3 忽略未知 `type`。
+
+`usage` 是 runner 可选上报的 token 使用量，沿用 SDK `LLMTokenUsage`：
+
+```python
+class LLMTokenUsage(BaseModel):
+    prompt_tokens: int | None = None
+    completion_tokens: int | None = None
+    total_tokens: int | None = None
+    # provider-specific detail/cached/reasoning counters are preserved as extra fields
+```
+
+约束：
+
+- 运行时能观测到 provider/runtime usage 时，SHOULD 在 terminal `run.completed.usage` 上报本次 run 的最终聚合 token usage。
+- `run.failed.usage` MAY 上报失败前已经产生的部分 usage。
+- 不能观测 usage 的 runner 合法地省略该字段；缺失表示 unknown，Host 不得按 0 处理。
+- ACP 等外部协议不保证统一 usage；ACP runner 只能在具体 provider/native event 提供 usage 时填充本字段。
+- cost 不作为 runner result 的权威字段。Host 后续应基于 usage、model identity、时间和自身价格表计算账单成本；provider 原始 cost 如需保留，可放在 `usage` extra 字段中作为非权威 telemetry。
+
+Host 边界分级校验：
+
+- `message.delta`、`message.completed`、`artifact.created`、`state.updated`、`action.requested`、`run.completed`、`run.failed` 属于会影响投递或 Host 副作用的严格 payload；校验失败时丢弃该 result 并记录 warning。
+- `tool.call.started`、`tool.call.completed` 当前只作为 telemetry，payload 宽松兼容。
+- 未知 `type` 忽略并记录 warning。
+
+### 7.2 稳定 result payloads
+
+| type | `data` payload |
+| --- | --- |
+| `message.delta` | `{ "chunk": MessageChunk }` |
+| `message.completed` | `{ "message": Message }` |
+| `tool.call.started` | `{ "tool_call_id": str, "tool_name": str, "parameters": dict }` |
+| `tool.call.completed` | `{ "tool_call_id": str, "tool_name": str, "result": dict \| None, "error": str \| None }` |
+| `artifact.created` | `{ "artifact_type": str, "artifact_id"?: str, "mime_type"?: str, "name"?: str, "size_bytes"?: int, "sha256"?: str, "metadata"?: dict, "content_base64"?: str }` |
+| `state.updated` | `{ "scope": "conversation" \| "actor" \| "subject" \| "runner", "key": str, "value": JSONValue }` |
+| `action.requested` | `{ "action": str, "target": dict \| None, "payload": dict \| None }` |
+| `run.completed` | `{ "finish_reason": str, "message"?: Message }` |
+| `run.failed` | `{ "code": str, "error": str, "retryable": bool }` |
+
+`artifact.created.content_base64` 是小 artifact 的 inline 通道；Host 解码后写入 ArtifactStore，当前 hard cap 是 1 MiB。大 artifact 应使用外部存储 / file key / 后续上传通道，不应塞入 result event。
+
+### 7.3 稳定 result types
+
+| type | 说明 | 当前消费 |
+| --- | --- | --- |
+| `message.delta` | 流式消息片段。 | ✅ |
+| `message.completed` | 完整消息。 | ✅ |
+| `tool.call.started` | 工具调用开始的可观测事件。 | telemetry |
+| `tool.call.completed` | 工具调用完成的可观测事件。 | telemetry |
+| `artifact.created` | runner 生成 artifact。 | ✅ |
+| `state.updated` | runner 请求更新 host-owned state。 | ✅ |
+| `action.requested` | runner 请求 Host 执行平台动作。 | **reserved / 仅 telemetry，不执行** |
+| `run.completed` | run 正常结束。 | ✅ |
+| `run.failed` | run 失败。 | ✅ |
+
+`action.requested` 是为 EBA 和 platform API 保留的协议表面：本分支 Host 收到后只记 telemetry，**不执行**，runner 作者不应在当前 Host 底座中依赖其副作用。真实执行器由外部 EBA / platform action 分支接入；执行模型见 EVENT_BASED_AGENT §6。
+
+Host 必须校验 `state.updated` 的 scope、key、value 大小和 JSON 可序列化性。本分支 `action.requested` 仍只记录 telemetry。
+
+### 7.4 Stream delivery semantics
+
+- Host 按 Runtime stream 顺序消费 result。当前 v1 不定义跨连接 replay，也不承诺 at-least-once；从 Host 视角，收到的 result 最多应用一次。
+- `sequence` 是单个 `run_id` 内的结果序号。in-process / stdio 这类天然有序的在线 stream 可以省略；任何会缓冲、重放、跨进程队列或 runtime-managed task 的 transport 必须提供从 1 开始严格递增的 `sequence`。
+- Host 看到已提供 `sequence` 的 result 时，应按 `(run_id, sequence)` 做重复检测，并在缺号或乱序时记录 warning；除非 transport 明确声明 replay 语义，Host 不应自行等待缺失序号重排用户可见输出。
+- `run.failed.data.retryable` 只表示整次 run 理论上可由上层重试；Protocol v1 不自动重试 run，也不自动重试 proxy action。
+- History / Event / Transcript cursor 是 opaque token。runner 不得解析 cursor，也不得假设 cursor 在不同 API、conversation、thread 或 retention window 之间可比较；当前实现即使返回数字字符串，也只是实现细节。
+
+### 7.5 示例
+
+```json
+{ "type": "message.delta",     "data": { "chunk": { "role": "assistant", "content": "hel" } } }
+{ "type": "message.completed", "data": { "message": { "role": "assistant", "content": "hello" } } }
+{ "type": "state.updated",     "data": { "scope": "conversation", "key": "external.session_id", "value": "abc" } }
+{ "type": "action.requested",  "data": { "action": "message.edit", "target": {"message_id": "..."}, "payload": {"text": "..."} } }
+```
+
+## 8. AgentRunAPIProxy
+
+所有 proxy action 必须携带 `run_id`。Host 必须校验：active run session 存在、caller plugin identity 匹配、resource 在本次 `ctx.resources` 中授权、scope 不越界、payload size / rate limit / deadline 合法。
+
+```python
+# Model
+await api.invoke_llm(llm_model_uuid, messages, funcs=None, extra_args=None)
+await api.invoke_llm_with_usage(llm_model_uuid, messages, funcs=None, extra_args=None)
+async for chunk in api.invoke_llm_stream(llm_model_uuid, messages, funcs=None, extra_args=None):
+    ...
+async for event in api.invoke_llm_stream_events(llm_model_uuid, messages, funcs=None, extra_args=None):
+    ...
+await api.invoke_rerank(rerank_model_id, query, documents, top_k=None)
+
+# Tool
+await api.get_tool_detail(tool_name)
+await api.call_tool(tool_name, parameters)
+
+# Knowledge
+await api.retrieve_knowledge(kb_id, query_text, top_k=5, filters=None)
+
+# History（返回 Transcript projection，不返回原始平台 payload）
+await api.get_prompt()
+await api.history_page(conversation_id=None, before_cursor=None, after_cursor=None,
+                       limit=50, direction="backward", include_artifacts=False)
+await api.history_search(query, filters=None, top_k=10)
+
+# Event（返回稳定 event envelope 或受限 raw ref，不默认返回大 payload）
+await api.event_get(event_id)
+await api.event_page(conversation_id=None, event_types=None, before_cursor=None, limit=50)
+await api.steering_pull(mode="all", limit=None)
+
+# Artifact（必须支持大小限制、MIME 校验、过期时间和授权范围）
+await api.artifact_metadata(artifact_id)
+await api.artifact_read(artifact_id, offset=0, limit=None)
+await api.artifact_read_range(artifact_id, offset=0, length=65536)
+
+# State / Storage
+await api.state_get(scope, key);   await api.state_set(scope, key, value);   await api.state_delete(scope, key)
+await api.state_list(scope, prefix=None, limit=100)
+await api.get_plugin_storage(key); await api.set_plugin_storage(key, value); await api.delete_plugin_storage(key)
+await api.get_plugin_storage_keys()
+await api.get_workspace_storage(key); await api.set_workspace_storage(key, value); await api.delete_workspace_storage(key)
+await api.get_workspace_storage_keys()
+
+# Files / Host info
+await api.get_file(file_key)
+await api.get_langbot_version()
+```
+
+`invoke_llm()` / `invoke_llm_stream()` 的第一个参数在 SDK 中命名为
+`llm_model_uuid`，wire payload 字段也是 `llm_model_uuid`。该值对 runner
+仍是 opaque identifier，不应解析其内部格式。
+
+`invoke_llm()` 和 `invoke_llm_stream()` 保持兼容：前者返回 `Message`，后者只
+yield `MessageChunk`。需要 provider 真实 token 计量的 runner 应使用
+`invoke_llm_with_usage()` 或 `invoke_llm_stream_events()`。Host response 可在
+原有 `{message: ...}` / `{chunk: ...}` 外额外携带可选 `usage` 字段；streaming
+场景允许在所有 chunk 之后追加一个 usage-only event。`usage` 至少保留
+OpenAI-compatible 的 `prompt_tokens`、`completion_tokens`、`total_tokens`，
+若 provider 返回 `prompt_tokens_details` / `completion_tokens_details` 或
+cache token counters，Host / SDK 不应丢弃这些字段。没有 usage 的 provider
+必须继续返回成功响应，SDK 将 usage 置为 `None`。
+
+`get_prompt()` 返回当前 query-backed run 的 Host effective prompt messages：
+`list[Message]` 的 JSON 形式。该能力只在 `ctx.context.available_apis.prompt_get`
+为 true 时可用；没有 query 缓存、prompt 已过期或非 query entry run 时 Host
+可以返回错误或空列表。Runner 应在不可用时回退到自己的 config/prompt 策略。
+
+`steering_pull(mode="all")` 是推荐默认：Host 按 claim 顺序返回全部 pending steering 输入并清空对应队列。`mode="one-at-a-time"` 仅用于 runner 主动节流，每次返回一条。Host 不合并多条用户消息；runner 负责在 turn 边界决定模型侧格式。
+
+Steering 审计使用 EventLog 而不是 Transcript schema 扩展：被 active run 吸收的原始 `message.received` 事件保留原事件类型，并在 `metadata.steering` 标记 `status="queued"`、`trigger_behavior="absorbed_into_active_run"`、`claimed_by_run_id`、`claimed_runner_id`、`claimed_at`。Runner 成功 pull 后，Host 追加 `steering.injected` EventLog 记录，`metadata.steering.status="injected"` 并引用 `source_event_id`。若 run 结束时仍有已 claim 但未 pull 的 steering 输入，Host 追加 `steering.dropped` EventLog 记录，`metadata.steering.status="dropped"` 并引用 `source_event_id`；这不是用户消息事实的删除，只是 dispatch 终态。Transcript 继续只表示会话事实，不承担 dispatch 行为标记。
+
+`state` 与 `storage` 的建议边界：`state` 放小型 JSON（conversation / actor / subject / runner），`storage` 放 blob 或较大数据（插件私有数据、workspace 数据、checkpoint）。
+
+Compaction checkpoint 的推荐 state 约定：
+
+- scope: `conversation`
+- key: `runner.compaction.checkpoint`
+- value:
+
+```json
+{
+  "schema_version": "langbot.local_agent.compaction_checkpoint.v1",
+  "summary": "<conversation_summary>...</conversation_summary>",
+  "covers_until": "transcript-cursor-or-seq",
+  "tokens_before": 12345,
+  "created_at": 1710000000,
+  "conversation_id": "conv-..."
+}
+```
+
+`covers_until` 是摘要覆盖到的 transcript 游标锚点。Runner 读取 checkpoint 后应只拉取该游标之后的 transcript；若 checkpoint 缺失、schema 不匹配、conversation 不匹配或游标不可用，应回退到无 checkpoint 的尾部历史拉取行为。
+
+Proxy 返回数据结构也属于本协议：
+
+```python
+class TranscriptItem(BaseModel):
+    transcript_id: str
+    event_id: str
+    conversation_id: str | None = None
+    thread_id: str | None = None
+    role: str
+    item_type: str = "message"
+    content: str | None = None
+    content_json: dict[str, Any] | None = None
+    artifact_refs: list[dict[str, Any]] = []
+    seq: int | None = None
+    cursor: str | None = None
+    created_at: int | None = None
+    metadata: dict[str, Any] = {}
+
+class HistoryPage(BaseModel):
+    items: list[TranscriptItem] = []
+    next_cursor: str | None = None
+    prev_cursor: str | None = None
+    has_more: bool = False
+    total_count: int | None = None
+
+class HistorySearchResult(BaseModel):
+    items: list[TranscriptItem] = []
+    total_count: int | None = None
+    query: str
+
+class AgentEventRecord(BaseModel):
+    event_id: str
+    event_type: str
+    event_time: int | None = None
+    source: str
+    bot_id: str | None = None
+    workspace_id: str | None = None
+    conversation_id: str | None = None
+    thread_id: str | None = None
+    actor_type: str | None = None
+    actor_id: str | None = None
+    actor_name: str | None = None
+    subject_type: str | None = None
+    subject_id: str | None = None
+    input_summary: str | None = None
+    input_ref: str | None = None
+    raw_ref: str | None = None
+    seq: int | None = None
+    cursor: str | None = None
+    created_at: int | None = None
+    metadata: dict[str, Any] = {}
+
+class EventPage(BaseModel):
+    items: list[AgentEventRecord] = []
+    next_cursor: str | None = None
+    prev_cursor: str | None = None
+    has_more: bool = False
+    total_count: int | None = None
+
+class SteeringInputItem(BaseModel):
+    claimed_run_id: str
+    runner_id: str
+    claimed_at: int | None = None
+    event: AgentEventContext
+    input: AgentInput
+    conversation: ConversationContext | None = None
+    actor: ActorContext | None = None
+    subject: SubjectContext | None = None
+    metadata: dict[str, Any] = {}
+
+class SteeringPullResult(BaseModel):
+    items: list[SteeringInputItem] = []
+
+class ArtifactMetadata(BaseModel):
+    artifact_id: str
+    artifact_type: str
+    mime_type: str | None = None
+    name: str | None = None
+    size_bytes: int | None = None
+    sha256: str | None = None
+    source: str
+    conversation_id: str | None = None
+    run_id: str | None = None
+    runner_id: str | None = None
+    created_at: int | None = None
+    expires_at: int | None = None
+    metadata: dict[str, Any] = {}
+
+class ArtifactReadResult(BaseModel):
+    artifact_id: str
+    mime_type: str | None = None
+    size_bytes: int | None = None
+    offset: int = 0
+    length: int | None = None
+    content_base64: str | None = None
+    file_key: str | None = None
+    has_more: bool = False
+```
+
+## 9. 错误模型
+
+```python
+class AgentAPIError(BaseModel):
+    code: str
+    message: str
+    retryable: bool = False
+    details: dict[str, Any] = {}
+```
+
+| code | 说明 |
+| --- | --- |
+| `unauthorized` | 未授权访问资源或 scope。 |
+| `not_found` | 资源不存在或对当前 runner 不可见。 |
+| `deadline_exceeded` | 超过 run deadline。 |
+| `payload_too_large` | 请求或响应过大。 |
+| `rate_limited` | Host 限流。 |
+| `invalid_argument` | 参数错误。 |
+| `runtime_error` | Host 或下游能力错误。 |
+
+SDK runner-facing proxy 在 Host 返回结构化错误或畸形响应时抛出 `AgentAPIException`，其中 `error` 字段为 `AgentAPIError`。Legacy transport 只返回字符串错误时，SDK 使用 `host.action_error` 包装，避免 runner 继续依赖裸 `KeyError` 或字符串匹配。
+
+Runner 失败使用 `run.failed`：
+
+```json
+{ "type": "run.failed", "data": { "code": "runner.error", "error": "failed to call external agent", "retryable": false } }
+```
+
+## 10. Timeout 与 Cancellation
+
+- Host 在 `ctx.runtime.deadline_at` 下发总 deadline；SDK proxy 必须用该 deadline 限制单次 action timeout。
+- Host 可以取消 active run；Runtime 应尽力中断 runner。
+- Protocol v1 的 run 绑定当前 Host 进程和当前 runtime channel，不保证跨 Host 重启恢复。Host 重启、runtime channel 断开或 run session 丢失时，Runtime / external harness connector 必须 fail-fast 并尽力取消仍在执行的 runner，不得继续使用旧 `run_id` 调用 Host API。
+- Runner 支持中断时应返回或触发 `run.failed`，code 为 `cancelled`。
+- Host 必须 unregister active run session。
+
+## 11. Security 与 Guardrail（协议层）
+
+Protocol v1 的安全边界在 Host：
+
+- Runner 不能直接访问未授权 model/tool/kb/history/artifact/storage。
+- SDK 本地校验只提升开发体验，不能替代 Host 校验。
+- 所有 resource id 对 runner 来说都是 opaque。
+- 默认只能访问当前 conversation / thread 的 history；跨会话、workspace 级访问必须额外授权。
+- 大 payload 必须 artifact 化；`artifact.created.content_base64` 只用于小 artifact，当前 Host hard cap 是 1 MiB。
+- Host 必须记录 run_id、runner_id、action、resource、scope、result。
+
+Host 不负责业务编排：不拼接全量历史、不替 runner 做 prompt assembly、不内置 agent memory / tool loop / 上下文压缩策略。这些由官方或第三方 AgentRunner 插件实现。
+
+外部 harness runner 的边界统一见 HOST_SDK §4.8。简言之：harness native permission mode、allowed/disallowed tools、shell/MCP 权限只是额外执行约束，不能替代 Host 对 LangBot 资源的授权。
+
+> 发布级路径隔离、MCP allowlist、secret redaction、配额、workspace 清理等**不属于** v1 协议闭环，是生产默认启用前的 release gate，见 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md)。
+
+## 12. Pipeline Adapter 边界
+
+Pipeline 是当前入口 adapter，不是协议中心。目标产品模型中 Agent 会替代
+Pipeline 承载 runner config、resource policy 和 delivery policy；当前 Query
+entry adapter 只是迁移桥。它负责：
+
+- 从 `Query` 构造 `AgentEventContext` 和临时 `AgentBinding`（见 HOST_SDK §4.2）。
+- 从当前 Agent/runner config 构造 `ctx.config`。
+- 将 Query-only 字段放入 `ctx.adapter`，例如 filtered params 放 `ctx.adapter.extra["params"]`。
+
+约束：
+
+- adapter **不**定义历史窗口、prompt 组装或 agentic context 策略。
+- `ctx.adapter.extra` 只允许承载一次性、JSON-safe、入口相关的非核心元数据，例如 `params`；不得承载 `prompt`、history window、RAG 结果、tool schema 或授权资源。
+- 静态绑定 prompt 属于 `ctx.config.prompt`。preprocessing / hook 后的动态有效指令不通过 `ctx.adapter.extra` 主动推送；后续如需要保留这类能力，应通过 Host prompt/instruction pull API 暴露（占位见 HOST_SDK §4.8）。
+- 新 runner 不应长期依赖 `adapter`，应只依赖 event-first context 和 Host API。
+
+## 13. 已确认约束
+
+- v1 / EBA 主线是 `one event -> one AgentBinding -> one run_id -> one runner`。
+- 一个 bot / IM channel 在同一时间只绑定一个负责 agentic 处理的 Agent；一个 Agent 可以被多个 bot / channel 复用。
+- 如果配置层出现多个匹配 AgentBinding，BindingResolver 必须按明确规则选出一个或拒绝配置，不应默认 fan-out。
+- observer agent、多 runner fan-out、并行裁决、result 合并等能力需要单独设计 delivery、state、platform action 和 audit 语义，不属于当前 v1 契约。
+- `AgentRunnerDescriptor.source` 只允许 `plugin`；Host 内置 adapter 不能作为 runner source 绕过插件/runtime/proxy 权限链。
+- `ctx.resources` 与 proxy action 校验必须来自同一个 run authorization snapshot；runtime handler 不应重新执行资源裁剪。
+- v1 不要求 Agent、AgentRunner 插件实例或 runner id 全局串行。多个 bot / channel 可复用同一个 Agent；并发隔离依赖 `run_id`、binding、conversation / thread scope 和 Host authorization snapshot。
+- 外部 harness runner 当前是 MVP / dev path，证明协议可接入，不代表发布级安全边界或 Docker 生产可用性完成。
+
+## 14. 开放问题
+
+- `AgentBinding` 是否需要进入 SDK 文档作为只读诊断信息，还是完全 Host 内部。
+- ArtifactStore 是否复用现有 BinaryStorage backend，还是引入独立实体。
+- State 与 Storage 的边界是否需要更强类型。
+- platform action 的审批模型如何表达。
+- Host 侧 scoped MCP / skill / workspace projection 是否需要从 runner config 上移为一等 resource projection API。

docs/agent-runner-pluginization/README.md

@@ -0,0 +1,153 @@
+# Agent Runner 插件化文档入口
+
+本文档是 agent-runner 插件化工作的路由页。具体设计拆到独立文档中维护，避免把 LangBot 宿主架构、SDK 协议、上下文管理、EBA 接入边界和官方 runner 迁移混在同一份 README 里。
+
+## 背景与问题
+
+旧 runner 路径主要围绕 Pipeline / Query 和 `pkg/provider/runners` 内置实现展开，扩展外部 agent runtime 时容易把 runner 选择、上下文裁剪、资源授权和消息投递绑在同一条聊天链路里。这个分支要把 LangBot 收敛成 Agent Host：Host 负责事件、绑定、授权、事实源和结果投递；AgentRunner 作为插件或外部 harness 消费统一协议并自主管理 prompt / history / memory。
+
+## 文档维护原则（单一事实源）
+
+- **协议数据结构（schema）唯一定义在 [PROTOCOL_V1.md](./PROTOCOL_V1.md)。** 其他文档不得重抄 schema，只能引用，例如"见 PROTOCOL_V1 §4.2"。
+- 当前实现状态、spec 差距与 runner 验收状态归 [STATUS.md](./STATUS.md)；测试执行入口归 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md)，安全发布门槛归 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md)。
+- Host 内部模型（`AgentEventEnvelope`、`AgentBinding`、Descriptor、各 Store）定义在 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md)，不属于 SDK 协议。
+- 其余专题文档只讲"为什么/边界/怎么用"，避免重复叙述。
+
+## 本分支目标
+
+**本分支目标：AgentRunner 外化 / 插件化基础设施**
+
+本分支只做 LangBot 作为 Agent Host 的基础能力建设，为后续用 `Agent`
+替代 Pipeline 承载 agent 配置打底：
+
+- LangBot 与 SDK 的稳定协议合同（Protocol v1）
+- Host-side `AgentEventEnvelope` / `AgentBinding` 模型
+- `run(event, binding)` event-first 入口
+- `QueryEntryAdapter`：Query → AgentEventEnvelope + AgentBinding
+- EventLog / Transcript / ArtifactStore / PersistentStateStore
+- History / Event / Artifact / State pull APIs
+- SDK runtime forwarding pull APIs + `caller_plugin_identity` 验证路径
+
+## 本分支不实现
+
+以下能力由其他分支负责，本分支只保留 integration point。EBA 完整事件网关与事件路由当前由外部 EBA 分支联调：
+
+- **EventGateway / EventRouter**：完整事件网关实现、事件路由、事件持久化管理
+- **Event subscription / Event notification**：事件订阅、推送通知
+- **BindingResolver persistence UI**：绑定配置的持久化 UI 和 event router 集成（如由其他模块负责）
+- **Scheduler / Background event source**：定时任务、后台事件源
+- **Runtime control plane v2 / Run Ledger**：先补 Host-owned `AgentRun` / `AgentRunEvent` / run control primitives；runtime registry、heartbeat、task queue 和 daemon claim 是后续可选阶段，不进入 Protocol v1 主线。
+
+EventGateway / EventRouter 在本文档中描述为 **external EBA branch integration point**，由外部 EBA 分支提供并联调。本分支只定义 host-side envelope/binding models 和 `run(event, binding)` orchestrator 入口。
+
+本分支与外部 EBA / Agent Platform / Runtime Control Plane 的扩展边界见 [EXTENSION_SCOPE_MATRIX.md](./EXTENSION_SCOPE_MATRIX.md)。
+
+## 目标产品模型
+
+未来产品层应把 `Agent` 理解为 Pipeline 的替代物：原先 bot 绑定 Pipeline，Pipeline 携带 agent/provider/RAG/tool 等配置；后续应改为 bot 或 IM channel 绑定一个 Agent，Agent 携带 runner id、runner config、resource/state/delivery policy 等 agent 配置。
+
+调度基数、Agent 复用、插件实例无状态、Pipeline adapter 和 fan-out 边界的规范来源是 [PROTOCOL_V1.md](./PROTOCOL_V1.md) §13；README 不复写这些约束。
+
+## 当前入口关系
+
+**当前 Pipeline 是入口 adapter，不再是 agent runner 设计核心。**
+
+主入口仍可由 Pipeline 触发，但内部已转换成 event-first path：`run_from_query()` 经 `QueryEntryAdapter` 把 `Query` 转换为 `AgentEventEnvelope` + `AgentBinding`，再委托到统一的 `run(event, binding, ...)`。Pipeline path 因此获得了 event-first host capabilities（EventLog / Transcript / ArtifactStore / PersistentStateStore 写入，History / Event / Artifact / State pull API 可用）。
+
+下一轮测试路径、状态定义和 smoke 记录见 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md)。
+
+## 术语表
+
+| 术语 | 含义 |
+| --- | --- |
+| Protocol v1 | Host 调用 AgentRunner 的 runner 可见合同：discovery、`AgentRunContext`、result stream、Host pull API 和错误模型。 |
+| Agent | 目标产品层配置对象，保存 runner id、runner config 和资源/状态/投递策略；不等于插件实例。 |
+| AgentConfig | Host 内部迁移期配置投影，由当前 Pipeline config 或未来持久 Agent 生成。 |
+| AgentBinding / binding | Host 在一次事件运行前解析出的有效绑定，决定调用哪个 runner 以及带什么策略。 |
+| envelope | Host 内部事件封装，即 `AgentEventEnvelope`；runner 看到的是由它投影出的 `ctx.event`。 |
+| descriptor / manifest | runner discovery 的能力和配置描述；manifest 来自插件，descriptor 是 Host 校验后的注册表视图。 |
+| EBA | Event Based Agent，把消息、撤回、入群、定时任务等都统一成 host event 的接入方向；完整网关和路由在外部 EBA 分支联调。 |
+| harness runner | LiteLLM Agent Platform、Claude Code、Codex 等已有自身 session / tool loop / MCP / 压缩机制的外部 runtime adapter。 |
+| projection | Host 把内部事实源、授权资源或配置裁剪成 runner / harness 可消费视图的过程。 |
+| Runtime Control Plane | v2 Host 能力层，第一阶段重点是 Host-owned run/result ledger 与 control primitives；runtime registry、heartbeat、task queue 和 daemon claim 是后续可选阶段，不是 Protocol v1 主线。 |
+
+## 设计文档
+
+| 文档 | 关注点 |
+| --- | --- |
+| [PROTOCOL_V1.md](./PROTOCOL_V1.md) | **🔒 唯一 schema 事实源**。LangBot Host 与 SDK / Runtime / AgentRunner 的协议合同：版本协商、discovery、run context、result stream、proxy actions、错误和 adapter 边界。 |
+| [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md) | LangBot 宿主能力与分层架构、Host 内部模型（`AgentEventEnvelope` / `AgentBinding` / Descriptor / 各 Store）、runner 发现、绑定、资源授权、状态、存储、生命周期和调用链。 |
+| [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md) | Agent-owned context 方向：事件到来时 LangBot 传什么，agent 如何按需拉取更多历史 / artifact / state，以及如何支持 KV cache 友好的上下文管理。 |
+| [EXTENSION_SCOPE_MATRIX.md](./EXTENSION_SCOPE_MATRIX.md) | AgentRunner 外化与外部 EBA / Agent Platform / Runtime Control Plane 的扩展边界矩阵，说明哪些是本分支底座、哪些由外部分支接入。 |
+| [EVENT_BASED_AGENT.md](./EVENT_BASED_AGENT.md) | EBA 接入边界：事件模型、事件来源、触发绑定、非消息事件如何复用 AgentRunner 调度；完整 EventGateway / EventRouter 由外部 EBA 分支联调。 |
+| [RUNTIME_CONTROL_PLANE_V2.md](./RUNTIME_CONTROL_PLANE_V2.md) | Agent Platform v2 / runtime 管控面决策：第一阶段优先把 `AgentRun` / `AgentRunEvent` / run control 做成 Host 事实源；完整 runtime registry / daemon 管控是后续可选阶段。**标注为 future design note**。 |
+| [OFFICIAL_RUNNER_PLUGINS.md](./OFFICIAL_RUNNER_PLUGINS.md) | 官方 runner 插件迁移，包括 local-agent 和外部 runner。它是下游落地计划，不是 LangBot 基础能力设计的前置约束。 |
+| [RUN_STEERING_AND_CHECKPOINT.md](./RUN_STEERING_AND_CHECKPOINT.md) | 运行中消息注入（steering / follow-up）与压缩摘要持久化（compaction checkpoint）的设计与落地状态记录；schema 仍以 PROTOCOL_V1 为准。 |
+| [STATUS.md](./STATUS.md) | 当前实现状态、spec 与实现已知差距、runner 验收状态和历史高价值记录。 |
+| [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md) | Agent Runner QA 指南：保留最高价值测试路径，指导 agent 开展下一轮 WebUI / runner smoke 验证。 |
+| [SECURITY_HARDENING.md](./SECURITY_HARDENING.md) | 安全发布级 hardening 的后续发布门槛：路径隔离、权限边界、secret、资源配额、MCP / skill 投影和审计。 |
+
+## 工作拆分
+
+### 1. LangBot + SDK 基础设施
+
+目标是把 LangBot 从内置 runner 执行器变成 agent host：
+
+- LangBot 与 SDK 的稳定协议合同
+- runner manifest / descriptor / registry
+- Agent / binding 配置解析
+- run orchestration 和生命周期管理
+- resource authorization 与 `run_id` 级权限校验
+- host-owned state / storage / event log / transcript / artifact 能力
+- SDK `AgentRunner`、`AgentRunContext`、`AgentRunResult`、`AgentRunAPIProxy`
+
+协议合同详见 [PROTOCOL_V1.md](./PROTOCOL_V1.md)。
+
+详见 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md)。
+
+### 2. Agent-owned context
+
+LangBot 不应成为最终 agentic context manager。它应提供事实源、默认上下文引用和按需读取 API；agent 或其背后的 runtime 负责历史剪裁、摘要、召回和 KV cache 策略。
+
+Host 不定义通用历史窗口字段或策略；runner 通过 Host pull API 按需拉取历史并自行管理 working context。
+
+详见 [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md)。
+
+### 3. Event Based Agent（External Branch）
+
+消息只是事件的一种。外部 EBA 分支中的 `message.received`、`message.recalled`、`group.member_joined`、`friend.request_received` 等事件都应能通过统一事件 envelope 触发 AgentRunner。
+
+EBA dispatch 的基数和 fan-out 边界仍以 PROTOCOL_V1 §13 为准；本文档只列出本分支提供给外部 EBA 分支复用的入口点。
+
+**本分支不实现 EBA 完整能力，只提供：**
+- event-first envelope (`AgentEventEnvelope`)
+- AgentBinding model
+- `run(event, binding)` 入口
+- QueryEntryAdapter（当前 AgentEventEnvelope / AgentBinding 的 Query entry adapter source）
+
+详见 [EVENT_BASED_AGENT.md](./EVENT_BASED_AGENT.md)。
+
+### 4. 官方 runner 插件
+
+官方 `local-agent` 和外部 runner 迁移是下游工作。它们需要依附 LangBot 提供的宿主能力，但不应反过来决定宿主协议。
+
+`local-agent` 可以外移，也可以重写。验收重点是它能完整消费 LangBot 的模型、工具、知识库、存储、事件、history API 和 result stream，而不是保留旧内置 runner 的内部结构。
+
+详见 [OFFICIAL_RUNNER_PLUGINS.md](./OFFICIAL_RUNNER_PLUGINS.md)。
+
+### 5. Runtime Control Plane v2（Future）
+
+当前 AgentRunner v1 主线只负责 `event -> binding -> runner.run(ctx) -> result stream`。
+后续 Agent Platform v2 应先在 Host 侧新增持久 `AgentRun` / `AgentRunEvent`、result persistence、cancel/finalize/query 等通用 run control primitives。完整 runtime registry、heartbeat、task queue、daemon claim 和 runtime audit 只有在复用需求明确后再作为可选阶段下沉到 Host。
+
+在这些 Host 能力之上，可以构建独立 agent 管控面插件；插件负责 UI、策略和编排体验，runtime/task 的事实源仍由 Host 持有。
+
+详见 [RUNTIME_CONTROL_PLANE_V2.md](./RUNTIME_CONTROL_PLANE_V2.md)。
+
+## 约束事实源
+
+本分支已确认约束不在 README 重写：
+
+- Runner 可见协议、result stream 和调度边界见 [PROTOCOL_V1.md](./PROTOCOL_V1.md)。
+- Host 内部 `AgentConfig` / `AgentBinding` 投影见 [HOST_SDK_INFRASTRUCTURE.md](./HOST_SDK_INFRASTRUCTURE.md)。
+- 外部 EBA / Agent Platform / Runtime Control Plane 接入边界见 [EXTENSION_SCOPE_MATRIX.md](./EXTENSION_SCOPE_MATRIX.md)。

docs/agent-runner-pluginization/RUNTIME_CONTROL_PLANE_V2.md

@@ -0,0 +1,539 @@
+# Agent Platform / Runtime Control Plane Decision Note
+
+本文档记录 AgentRunner 插件化之后，LangBot 如何继续演进成 Agent Platform 基础设施层。这里讨论的是 Host capability layer，不是 `AgentRunner Protocol v2`，也不是把某个具体 Agent Platform 产品写进 LangBot core。
+
+> 本文是当前决策版。协议数据结构仍以 [PROTOCOL_V1.md](./PROTOCOL_V1.md) 为准；测试执行入口见 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md)；扩展边界见 [EXTENSION_SCOPE_MATRIX.md](./EXTENSION_SCOPE_MATRIX.md)。
+>
+> 实现状态说明：本文描述的是 Runtime Control Plane v2 的目标能力和分阶段落地建议。当前 AgentRunner 插件化主线已经具备 event-first context、run-scoped authorization、EventLog / Transcript / Artifact / State 等 Host capability，但尚未实现持久 `AgentRun` / `AgentRunEvent` ledger 和完整 run control API。当前实现状态以 [STATUS.md](./STATUS.md) 为准。
+
+## 1. 当前决策
+
+LangBot 后续定位应更像 **Agent Host / infrastructure provider / transfer layer**，而不是把某个完整 Agent Platform 产品固化进 core。
+
+结论：
+
+- **Agent Platform 产品形态做成插件**。插件负责 agent 管理、策略、业务队列、UI、编排、多 agent 协作和产品体验。
+- **Agent Platform 所需的基础事实源做进 Host**。当前 Host 已保存 event、artifact、state、transcript 和 active run 权限快照；后续应补齐持久 run、result、审计关联和通用控制状态。
+- **不在第一阶段把 runtime registry / daemon worker 管控做成 Host 必选能力**。远程 harness / daemon 可以先由 AgentRunner 插件和 SDK remote layer 自己维护连接、心跳和本地执行。
+- **不把业务调度写进 Host**。Host 提供通用 run/result/control primitives，Platform 插件决定哪些事件触发哪些 agent、如何排队、如何分配、是否 fan-out。
+
+推荐分层：
+
+```text
+LangBot Host
+  Current: EventLog / runtime AgentBinding / Artifact / State / Transcript / active run authorization
+  Planned: Agent / Binding / Run / RunEvent / audit / result persistence / control primitives
+
+Agent Platform plugin
+  Agent management UI / project-task model / event routing policy
+  Business queue / multi-agent orchestration / runtime selection policy
+
+AgentRunner plugin / external harness runtime
+  Connects LiteLLM Agent Platform / remote agent / subprocess / HTTP API
+  Executes and converts provider-native events to AgentRunResult
+```
+
+## 2. Platform 与非 Platform 的区别
+
+当前 LangBot 已经具备 Agent Host 的核心特征：
+
+- 抹平不同 AgentRunner。
+- 从 IM / Pipeline 入口触发 runner。
+- 有 event-first context 方向。
+- 有 Host-owned EventLog / Transcript / Artifact / State。
+- 有 runner config 下发和 active run-scoped authorization。
+- 有 `run_id` 串联 event、transcript、artifact、state 和内存授权上下文。
+
+这还不是完整 Agent Platform。完整 Platform 至少还需要：
+
+- 可管理的 agent 资产：agent profile、binding、resource policy、runner config、可用状态。
+- 可观察的执行生命周期：run status、result stream、失败原因、artifact、审计、回放。
+- 可运营的控制面：取消、重试、排队、并发、超时、恢复、诊断。
+- 可产品化的调度体验：事件订阅、路由策略、任务板、多 agent 协作、项目/工作区视图。
+
+因此，区别不只是“有没有调度”，而是是否具备：
+
+```text
+managed agent assets + observable run lifecycle + operational run control
+```
+
+Host 负责这些能力的通用事实源和安全边界；Platform 插件负责把它们组装成具体产品。
+
+### 2.1 当前实现边界
+
+当前代码中的 `run_id` 已经是重要关联键，但还不是持久 Run 模型：
+
+- `EventLog` 保存输入事件和审计入口，并记录 `run_id` / `runner_id`。
+- `Transcript` 保存对话历史投影，并用 `run_id` 关联 assistant 输出。
+- `ArtifactStore` 保存输入和 runner 产物，并用 `run_id` 做访问边界的一部分。
+- `PersistentStateStore` 保存 runner state，但不等同于 run lifecycle。
+- `AgentRunSessionRegistry` 保存 active run 的内存态授权快照，用于 proxy action 校验；进程结束或 run 结束后不作为可回放事实源。
+
+因此本文后续提到的 `AgentRun` / `AgentRunEvent` / `run.create` / `run.append_result` / `run.cancel` 都是 Runtime Control Plane v2 应新增的能力，不应理解为当前已经存在的 API。
+
+## 3. 基础概念
+
+### 3.1 Event
+
+Event 表示“发生了什么”：
+
+```text
+message.received
+github.issue.opened
+scheduler.tick
+user.approved
+system.webhook.received
+```
+
+EBA 负责把外部输入标准化成 event。Event 本身不是 queue，也不等同于一次 agent 执行。当前 `EventLog` 记录的是输入事件和审计事实；未来 `AgentRunEvent` 记录的是某次 run 的输出事件流，二者不能混用。
+
+### 3.2 Run
+
+Run 表示“某个 agent / binding / runner 针对某个 event 的一次执行”。
+
+Run 应由 Host 持久化，成为执行状态、结果、权限和审计的事实源：
+
+```text
+run_id
+event_id
+agent_id / binding_id
+runner_id
+status
+created_at / started_at / finished_at
+error / failure_reason
+delivery target
+metadata
+```
+
+当前 `AgentRunSessionRegistry` 只保存 active run 的内存态授权信息，不足以支撑 Platform 的回放、审计、取消、重试和异步执行。
+
+### 3.3 RunEvent / RunResult
+
+RunEvent 是一次 run 过程中产生的结果事件流，对应 runner 返回的 `AgentRunResult`。它不同于 EBA/EventLog 的输入事件：
+
+```text
+message.delta
+message.completed
+tool.call.started
+tool.call.completed
+artifact.created
+state.updated
+action.requested
+run.completed
+run.failed
+```
+
+Host 应保存这些输出事件，按 `run_id + sequence` 可回放。Transcript、Artifact、State 可以由这些 result event 触发写入现有 store，并保留能回溯到 `AgentRunEvent` 的关联。
+
+### 3.4 Queue
+
+Queue 不是 EBA 的替代品。
+
+EBA 负责产生 event；queue 负责处理“这个 event 对应的执行 work item 何时执行、谁来执行、如何取消/重试/恢复”。
+
+队列可以分两层：
+
+- **业务队列**：由 Platform 插件管理，例如项目任务、优先级、agent team、workflow、人工审批。
+- **执行队列 / run queue**：可选 Host 原语，例如 queued / running / completed / failed / cancelled、claim lease、dispatch timeout、orphan recovery。
+
+第一阶段不要求 Host 内置完整执行队列。Platform 插件可以先管理业务队列；在 Phase 1 / Phase 2 能力落地前，插件仍只能通过现有 `AgentRunOrchestrator.run(...)` 同步执行路径和现有 Host stores 获得有限的 run 关联能力。
+
+### 3.5 Runtime / Daemon
+
+Runtime / daemon 表示执行位置或执行能力，例如某台机器上的 Claude Code / Codex CLI。
+
+当前决策：
+
+- Host 不在第一阶段维护完整 runtime registry。
+- AgentRunner 插件可以通过 SDK remote layer 与 daemon 保持连接、心跳和执行通道。
+- 外部 harness / agent 不应直接访问 LangBot Host 或数据库。访问 LangBot 资源必须通过 daemon / AgentRunner plugin / SDK runtime / `AgentRunAPIProxy` / scoped MCP bridge，并接受 run-scoped authorization 校验。
+- 如果后续多个插件都需要共享 runtime 状态，再把薄的 `RuntimeLease` / registry 下沉为 Host 通用能力。
+
+## 4. Host 应新增的最小能力
+
+第一阶段最重要的不是 daemon registry，而是让 Host 成为 run/result 的事实源。
+
+### 4.1 AgentRun Store
+
+新增持久 `AgentRun`：
+
+```text
+id / run_id
+event_id
+agent_id
+binding_id
+runner_id
+conversation_id / thread_id
+workspace_id / bot_id
+status
+status_reason
+created_at / started_at / finished_at / updated_at
+deadline_at
+cancel_requested_at
+usage_json
+cost_json
+metadata_json
+```
+
+建议 status 至少包含：
+
+```text
+created
+running
+completed
+failed
+cancelled
+timeout
+```
+
+如果后续加执行队列，再引入：
+
+```text
+queued
+claimed
+dispatching
+```
+
+### 4.2 AgentRunEvent Store
+
+新增持久 `AgentRunEvent`：
+
+```text
+id
+run_id
+sequence
+type
+data_json
+usage_json
+created_at
+source
+artifact_refs_json
+metadata_json
+```
+
+约束：
+
+- 同一 `run_id` 内 `sequence` 单调递增。
+- append 必须幂等，支持远程 daemon / plugin 重试。
+- 未知 result type 可保存但 Host 只对已知类型执行副作用。
+- 大 payload 仍应转 artifact，不直接塞入 result event。
+- `usage_json` 保存 `AgentRunResult.usage` 原样结构；缺失表示 unknown，不等于 0。
+
+### 4.3 Run Control API
+
+Host 提供通用控制原语：
+
+```text
+run.create
+run.get
+run.list
+run.events.page
+run.cancel
+run.append_result
+run.finalize
+```
+
+语义：
+
+- `run.create` 创建 Host-owned run 和授权快照。
+- `run.append_result` 只允许受信 SDK/runtime 路径调用，必须绑定 run 创建时固化的授权快照，写入 `AgentRunEvent` 并触发 transcript/artifact/state/delivery 副作用。
+- `run.finalize` 关闭 run，更新 terminal status。
+- `run.cancel` 设置取消意图；同步 runner 通过 context/deadline 感知，远程 runner 通过插件/daemon 通道感知。
+
+第一阶段可以只暴露给插件 runtime action，不一定先做公开 HTTP API。
+
+### 4.4 Result Persistence In Orchestrator
+
+当前 `AgentRunOrchestrator.run()` 已经处理：
+
+```text
+event -> binding -> context -> runner invocation -> result normalization
+```
+
+需要补齐：
+
+- run 开始时创建 `AgentRun`。
+- 每个 `AgentRunResult` 进入 `AgentRunEvent`。
+- `run.completed` / 正常 generator 结束时标记 completed。
+- `run.failed` / exception / timeout 标记 failed 或 timeout。
+- terminal result 携带 usage 时，写入 `AgentRunEvent.usage_json` 并汇总到 `AgentRun.usage_json`。
+- `state.updated`、`artifact.created`、transcript 写入继续走现有 journal，但应与 `AgentRunEvent` 有可追踪关系。
+
+### 4.5 Usage / Cost Accounting
+
+SDK 侧 `AgentRunResult` 已提供可选 `usage` 字段，用于把不同 runner / external harness / provider-native event 的 token usage 归一到同一个 run result envelope。
+
+语义：
+
+- `run.completed.usage` SHOULD 表示本次 run 的最终聚合 token usage。
+- `run.failed.usage` MAY 表示失败前已知的部分 token usage。
+- 没有 usage 表示 upstream runtime 没有报告或 adapter 暂未接入；Host 不得按 0 计费或按 0 判断上下文消耗。
+- Host 应把 event-level usage 原样写入 `AgentRunEvent.usage_json`，并在 terminal event 或 finalize 阶段汇总到 `AgentRun.usage_json`。
+- cost 应由 Host 根据 usage、runner/model identity、发生时间和价格表计算，写入 `AgentRun.cost_json`；runner/provider 上报的 cost 只能作为非权威 telemetry 保留在 metadata 或 usage extra 中。
+
+这层约束先解决协议位置和持久化位置；具体 ACP、LiteLLM、remote daemon、local subprocess runner 如何从 native event 中抽取 usage，可在各插件后续适配。
+
+### 4.6 Authorization Snapshot
+
+异步或远程执行时，run 创建时必须固化授权快照：
+
+- runner identity
+- binding identity
+- caller plugin identity
+- resource policy
+- allowed tools/models/files/knowledge bases/storage scopes
+- state scopes
+- conversation/thread/workspace scope
+
+后续 append result、state API、artifact API、history API 都以这个 snapshot 校验，不重新扩大权限。
+
+## 5. SDK 侧应新增的最小能力
+
+SDK 不需要马上定义完整 daemon registry，但需要让插件和 runner 使用 Host run/result 能力。
+
+### 5.1 Entities
+
+新增或补齐：
+
+```text
+AgentRun
+AgentRunStatus
+AgentRunEvent
+RunEventPage
+RunCreateRequest / RunCreateResult
+RunAppendResultRequest
+```
+
+这些是 Host control primitives，不替代 `AgentRunContext` / `AgentRunResult`。
+
+### 5.2 Proxy Methods
+
+在 SDK proxy 中提供：
+
+```python
+create_run(...)
+get_run(run_id)
+list_runs(...)
+page_run_events(run_id, cursor=None, limit=...)
+cancel_run(run_id)
+append_run_result(run_id, result, sequence=None)
+finalize_run(run_id, status, error=None)
+```
+
+访问边界：
+
+- 普通 AgentRunner 在同步 `run(ctx)` 内不一定需要直接调用这些 API；Host orchestrator 可自动记录。
+- Platform 插件可以创建/查询/取消 run。
+- AgentRunner 插件或 daemon bridge 可以 append/finalize 自己负责的 run。
+- 外部 harness 仍不能直接调用 Host；必须经 SDK runtime / proxy / bridge。
+
+### 5.3 Plugin-Daemon Heartbeat
+
+远程 daemon 的初始心跳可以是 SDK / AgentRunner plugin 私有能力：
+
+```text
+daemon <-> AgentRunner plugin / SDK remote layer <-> LangBot plugin runtime <-> Host
+```
+
+Host 第一阶段只需要知道：
+
+- 相关插件是否在线。
+- run 是否有 progress/result。
+- run 是否超时或取消。
+
+如果后续需要跨插件共享 daemon 可用性，再把 heartbeat/registry 下沉为 Host 能力。
+
+## 6. Platform 插件应负责什么
+
+Agent Platform 插件可以负责：
+
+- 管理哪些 agent 可用。
+- 维护产品层 agent profile、项目、任务板、workflow、team。
+- 订阅 EBA event，决定哪些 event 触发哪些 agent。
+- 维护业务 queue：优先级、重试策略、人工审批、分配规则。
+- 选择 runner / runtime / daemon。
+- 在 Run Control API 落地后，调用 Host run API 创建、取消、查询执行。
+- 展示 run status、result stream、artifact、失败原因和审计。
+
+Platform 插件不应负责：
+
+- 在 Host Run Ledger 落地后，私有保存通用 run/result 事实源。
+- 绕过 Host 直接写 transcript/artifact/state。
+- 让外部 harness 直接访问 LangBot DB 或 Host 内部资源。
+- 把某个业务队列语义强塞进 AgentRunner Protocol v1。
+
+## 7. 与 EBA 的关系
+
+EBA 做好后，事件流可以进入两种路径。
+
+直接执行路径：
+
+```text
+EventGateway
+  -> EventRouter resolves AgentBinding
+  -> AgentRunOrchestrator.run(event, binding)
+  -> Host records AgentRun / AgentRunEvent (after Run Ledger lands)
+  -> delivery
+```
+
+Platform 插件编排路径：
+
+```text
+EventGateway
+  -> Platform plugin receives/subscribes event
+  -> plugin applies policy / business queue
+  -> plugin creates Host run (after Run Control API lands)
+  -> runner/plugin/daemon executes
+  -> Host records result and state
+  -> plugin displays / Host delivers
+```
+
+这两条路径最终应共享 Host run/result/artifact/state 事实源。当前阶段可共享的是 event/transcript/artifact/state 和同步执行链路；持久 run/result ledger 需要 Runtime Control Plane v2 Phase 1 补齐。区别在于是否有 Platform 插件参与产品化调度和业务队列。
+
+## 8. 与 AgentRunner Protocol v1 的关系
+
+本设计不改变 v1 的 runner 可见合同：
+
+```text
+AgentRunContext -> AgentRunner.run(ctx) -> AgentRunResult stream
+```
+
+必须保持：
+
+- `AgentRunContext` 不塞入 daemon/worker/pod 细节。
+- `AgentRunResult` 仍是 runner 输出的统一事件流。
+- 普通 runner 不需要知道 task queue / runtime registry。
+- 远程 harness 可以自管 session、tool loop、MCP、上下文压缩，但访问 LangBot 资源必须通过 SDK proxy / bridge。
+- Runtime-managed execution 是 placement / transport 选择，不是普通 runner 协议的强制概念。
+
+## 9. 分阶段实施建议
+
+### Phase 1: Run Ledger
+
+目标：Host 成为执行状态和结果事实源。
+
+范围：
+
+- `AgentRun` 表。
+- `AgentRunEvent` 表。
+- Orchestrator 自动创建/更新 run。
+- Journal 持久化每个 `AgentRunResult`。
+- Run 查询和事件分页 API。
+- SDK entities + proxy 方法。
+
+复杂度：中等。
+
+预计改动：
+
+```text
+Host: 12-20 个文件
+SDK: 4-8 个文件
+Tests: 8-15 个文件
+```
+
+### Phase 2: Platform Plugin Queue On Host Run Primitives
+
+目标：Platform 插件管理业务 queue，Host 提供 run/result/cancel 原语。
+
+范围：
+
+- `run.create`
+- `run.cancel`
+- `run.append_result`
+- `run.finalize`
+- result append 的 sequence/idempotency。
+- 受权限保护的远程 append/finalize。
+- Platform 插件可基于 Host run 构建任务板和调度体验。
+
+复杂度：中等偏高。
+
+预计改动：
+
+```text
+Host: 20-35 个文件
+SDK: 8-14 个文件
+Tests: 15-25 个文件
+```
+
+### Phase 3: Optional Host Execution Queue / Claim Lease
+
+目标：当多个插件重复实现 claim/cancel/retry/recovery 时，再下沉执行队列到 Host。
+
+范围：
+
+- `queued/running/completed/failed/cancelled` 状态机扩展。
+- `claim_run` / `lease_until`。
+- dispatch timeout。
+- retry / orphan recovery。
+- cancel propagation。
+- 并发 claim 防重。
+
+复杂度：高。
+
+预计改动：
+
+```text
+Host: 35-55 个文件
+SDK: 12-20 个文件
+Tests: 25-40 个文件
+```
+
+### Phase 4: Optional Runtime Registry
+
+目标：当 Host 需要统一管理多个 daemon / worker 时，再引入 runtime registry。
+
+范围：
+
+- runtime register / heartbeat / deregister。
+- capability report：provider、version、login status、workspace access、slot。
+- runtime online/offline。
+- runtime scoped auth。
+- runtime audit。
+- runtime gone recovery。
+- task wakeup / long polling / websocket。
+- 多 Host 实例下的 relay / distributed lock。
+
+复杂度：很高。
+
+预计改动：
+
+```text
+Host: 55-80+ 个文件
+SDK: 18-30 个文件
+Tests: 40+ 个文件
+```
+
+不建议现在直接进入此阶段。
+
+## 10. 设计原则
+
+- 先把 run/result 事实源做进 Host，再谈完整 runtime control plane。
+- Agent Platform 产品做插件；Host 做基础设施。
+- Host 不写业务调度策略，但要保存通用状态、结果、权限和审计。
+- EBA event 不是 queue；queue 是执行生命周期问题。
+- 业务 queue 可以先在 Platform 插件里；执行 queue 只有在复用需求明确后再下沉 Host。
+- Daemon registry 不应污染 AgentRunner Protocol v1。
+- 外部 harness 不直接访问 LangBot Host 或 DB。
+- 所有 LangBot 资源访问必须走 SDK runtime / `AgentRunAPIProxy` / scoped MCP bridge。
+- Docker / remote / local subprocess 只是 runtime placement，不是 runner 协议差异。
+
+## 11. 非目标
+
+当前阶段不做：
+
+- 完整 Multica 式 runtime registry。
+- Host 内置项目管理、任务板、agent team、workflow 产品逻辑。
+- 把 daemon heartbeat / worker liveness 放进 `AgentRunContext`。
+- 把业务 queue 定义为 AgentRunner Protocol 字段。
+- 让 Platform 插件私有保存 run/result 事实源。
+- 让外部 agent/harness 直连 Host 内部资源。
+
+## 12. 待定问题
+
+- Host 是否需要最小持久 `Agent` / `Binding` 模型，还是继续由 Pipeline / Platform 插件投影运行期 `AgentBinding`。
+- Platform 插件创建 run 时，是否传完整 `AgentBinding` snapshot，还是引用 Host-owned binding id。
+- `AgentRunEvent` 与现有 `EventLog` / `Transcript` 的查询关系：直接 join，还是通过专门 view 聚合。
+- `run.append_result` 的认证粒度：runner plugin identity、run token、scoped capability token，或 SDK runtime 内部 channel。
+- 取消语义：同步 runner、external harness runtime/session 如何统一感知 cancel。
+- 何时把插件私有 daemon heartbeat 提升为 Host `RuntimeLease`。
+- 若未来 Host 做 claim lease，Platform 插件业务 queue 与 Host execution queue 如何避免双队列混乱。

docs/agent-runner-pluginization/RUN_STEERING_AND_CHECKPOINT.md

@@ -0,0 +1,154 @@
+# Run Steering 与 Compaction Checkpoint（Design Note）
+
+本文档记录两项 Host/runner 协作能力：**运行中消息注入（steering / follow-up）**和
+**压缩摘要持久化（compaction checkpoint）**。两者来自官方 local-agent 对照
+Pi agent harness（`pi-mono/packages/agent`，下称 pi-agent-core）的差距分析：
+local-agent 已移植 Pi 的事件生命周期、并行工具语义、hook 扩展点和压缩预算模型，
+这两项需要 Host 协议、授权与 runner turn 边界协同才能闭环。
+
+> 本文是设计备忘，不是 schema 事实源。涉及的数据结构最终落到
+> [PROTOCOL_V1.md](./PROTOCOL_V1.md)；上下文边界语义以
+> [AGENT_CONTEXT_PROTOCOL.md](./AGENT_CONTEXT_PROTOCOL.md) 为准；
+> run 持久化与控制原语以 [RUNTIME_CONTROL_PLANE_V2.md](./RUNTIME_CONTROL_PLANE_V2.md) 为准。
+
+## 1. Run Steering / Follow-up（运行中消息注入）
+
+### 1.1 问题
+
+IM 场景下用户在 agent 运行中追加消息非常常见（补充信息、纠正方向、"算了别查了"）。
+当前主线是 `one event -> one AgentBinding -> one run_id -> one runner`
+（PROTOCOL_V1 §13）：同会话的新消息要么等待当前 run 结束后触发新 run，
+要么并发触发独立 run。两种行为都无法把新消息送进**正在执行的 tool loop**，
+用户体验是"agent 自顾自跑完过期任务，然后才看到新消息"。
+
+cancel（PROTOCOL_V1 §10）不解决这个问题：cancel 丢弃已完成的工作；
+steering 是在保留当前进度的前提下改变后续方向。
+
+### 1.2 Pi 的参考语义
+
+pi-agent-core 区分两个队列，注入时机都在 turn 边界，不打断进行中的模型流或工具执行：
+
+- **steering**：运行中插入。当前 assistant 消息的全部 tool call 完成后、
+  下一次模型调用前，注入排队的用户消息；模型在下一 turn 看到它们。
+- **follow-up**：排队后续工作。仅当没有 pending tool call 且没有 steering 消息、
+  run 即将自然结束时检查；若有排队消息则注入并继续下一 turn，而不是结束 run。
+
+两个队列各自支持 `one-at-a-time`（每次注入一条）和 `all`（一次注入全部）模式。
+
+### 1.3 设计方向
+
+职责划分遵循既有原则：Host 拥有事件路由和会话事实源，runner 拥有 turn 边界。
+
+- **Host 侧**：BindingResolver / dispatch 层识别"同 conversation 存在 active run
+  且 runner 声明支持 steering"的新消息事件，将其写入 run-scoped steering queue，
+  并标记该事件已被在途 run 认领（不再触发新 run，避免破坏 §13 的基数约束）。
+  事件仍照常进 EventLog / Transcript（事实源不变，改变的只是触发行为）。
+- **Runner 侧**：在 turn 边界（tool batch 完成后、下一次模型调用前，以及 run
+  即将自然结束前）通过 run-scoped pull API 拉取 pending steering 输入，
+  注入 working context。local-agent 的 `AgentLoopHooks.prepare_next_turn` /
+  `should_stop_after_turn` 已预留了对应的注入点。
+- **能力协商**：runner manifest 声明 `steering` capability（参照 PROTOCOL_V1 §4.3）；
+  未声明的 runner 保持现状（新消息按现有规则另起 run）。
+- **回执**：被 steering 消费的事件通过 EventLog 审计。原始 `message.received`
+  记录在 `metadata.steering` 标记 queued/absorbed 与 `claimed_by_run_id`；
+  runner 成功 pull 后，Host 追加 `steering.injected` 记录并引用源事件。
+  run 结束时仍未被 pull 的已 claim 输入，Host 追加 `steering.dropped` 记录作为
+  dispatch 终态；原始 Transcript 事实不删除。
+  Transcript 继续只表示会话事实，不扩展 dispatch 行为字段。
+
+已落地的协议面（最终定义归 PROTOCOL_V1）：
+
+1. `ContextAccess.available_apis` 增加 steering pull 能力位。
+2. `AgentRunAPIProxy` 增加 steering 拉取 action：默认 `mode=all`，Host 保序返回全部
+   pending 输入；`one-at-a-time` 仅作为 runner 主动节流选项。
+3. dispatch 层的"认领"规则：`message.received` 可被同 conversation 的 active run
+   吸收，原事件写 EventLog / Transcript，dispatch 行为写入 EventLog metadata。
+4. Host 对单 run steering queue 设置内存上限，队列满时不再 claim 新消息，消息回到
+   正常 dispatch 路径，避免 active run 无限吞入同会话输入。
+
+### 1.4 边界
+
+- 不引入 Host 替 runner 做 prompt 拼接：Host 只递队列，注入位置和格式由 runner 决定。
+- 不与 observer / fan-out 混淆：steering 仍是单 run 内的输入补充，不产生第二个 runner。
+- 远程 / 外部 harness runner（claude-code、codex 等）若其底层 session 自带
+  steering 能力，adapter 可以直接转发；协议面保持一致。
+
+## 2. Compaction Checkpoint 持久化
+
+### 2.1 问题
+
+local-agent 当前是无状态 runner：每次 run 重新拉取 transcript 尾部
+（默认 50 条）、重新估算 token、重新生成压缩摘要。后果：
+
+- 长会话中每 run 重复压缩计算，摘要每次重新生成，不同 run 之间措辞漂移，
+  对 provider KV cache 不友好（AGENT_CONTEXT_PROTOCOL §"Summary checkpoint 稳定"
+  已写明期望：只有压缩发生时才产生新 checkpoint）。
+- 历史一旦超过 fetch limit，更早的内容永久不可见——没有 checkpoint 记录
+  "已压缩到哪里、压缩出了什么"。
+
+pi-agent-core 把 compaction 条目持久化进 session tree：摘要带
+`tokensBefore` 和覆盖范围，后续 turn 直接复用，只在再次越过阈值时增量压缩。
+
+### 2.2 现状盘点
+
+协议面和主消费路径已具备：
+
+- State / Storage API 已定义（PROTOCOL_V1 §8 "State / Storage"），
+  且 AGENT_CONTEXT_PROTOCOL 已点名 `summary.checkpoint` 是 state 的预期用法。
+- Host 会根据 binding state policy 暴露 `ContextAccess.available_apis.state`。
+- local-agent 会在 state API 可用时读取/写入 `runner.compaction.checkpoint`；
+  缺失、schema 不匹配、conversation 不匹配或游标失败时回退尾部历史拉取。
+- LLM 生成摘要**不依赖**本项 Host 能力——runner 用已授权的 `invoke_llm`
+  即可生成；checkpoint 只解决"存下来、下次复用"。
+
+### 2.3 设计方向
+
+- **存放位置**：state，scope=`conversation`（小 JSON，符合 PROTOCOL_V1 §8
+  对 state/storage 的边界建议）。若未来摘要膨胀，超出部分放 storage 并在
+  state 中留引用。
+- **key 约定**：`runner.compaction.checkpoint`（runner 命名空间内）。
+- **内容约定**（schema 落 PROTOCOL_V1 或 runner 文档，此处只列语义）：
+  - `schema_version`
+  - `summary`：压缩摘要文本（LLM 生成或确定性生成）
+  - `covers_until`：已被摘要覆盖的 transcript 游标（seq / message id），
+    是增量压缩和"从哪继续拉历史"的锚点
+  - `tokens_before` / `created_at`：诊断与失效判断
+- **消费流程**：run 开始时读 checkpoint → 只拉取 `covers_until` 之后的
+  transcript → 压缩触发时基于旧摘要增量生成新摘要、写回新 checkpoint。
+  checkpoint 缺失或解析失败时回退到现行为（全量拉尾部），保证向后兼容。
+- **失效规则**：`covers_until` 在 Host transcript 中不存在（会话被清理 / 重置）
+  即作废；runner 不得信任跨 conversation 的 checkpoint。
+- **授权**：Host 对声明需要 state 的 runner binding 开启
+  `available_apis.state`；校验沿用现有 run-scoped state 校验
+  （scope、key、value 大小、JSON 可序列化，见 PROTOCOL_V1 §7.2 对
+  `state.updated` 的要求）。
+
+### 2.4 相关但独立的工作
+
+- **tokenizer / usage metadata 透传**：runner 目前用 chars/4 启发式估 token，
+  对 CJK 偏低 3-4 倍，压缩触发系统性偏晚。Host 应在模型响应或
+  `ctx.runtime.metadata` 透传 provider usage（prompt/completion tokens）与
+  model context window（LiteLLM model-info 工作）。该项不阻塞 checkpoint
+  落地，但决定压缩触发的准确性。
+
+## 3. 实施拆分
+
+| 项 | 归属 | 依赖 |
+| --- | --- | --- |
+| steering queue、事件认领、基础审计 | LangBot Host（dispatch / binding 层） | 已落地，含队列上限与未消费 dropped 终态 |
+| steering pull API + capability 位 | PROTOCOL_V1 + SDK proxy | 已落地 |
+| turn 边界拉取与注入 | langbot-local-agent | 已落地 |
+| local-agent 对 state API 的 checkpoint 读写 | langbot-local-agent | 已落地 |
+| checkpoint key / 内容 / 失效约定 | PROTOCOL_V1 + local-agent README | 已落地 |
+| LLM 压缩摘要生成 | langbot-local-agent | 已落地（`invoke_llm`，失败回退确定性摘要） |
+| usage / context-window metadata 透传 | LangBot Host（model 层） | LiteLLM model-info |
+
+剩余工作应优先补 usage / context-window metadata。streaming delivery 衔接依赖
+`ctx.delivery` 编辑/追加语义，不建议在协议能力缺失时硬编码。
+
+## 4. 开放问题
+
+- streaming delivery 下 steering 注入后，前序 turn 已流出的内容与新 turn
+  输出在 IM 消息编辑面的衔接（涉及 `ctx.delivery` 能力，待 delivery 演进定）。
+- checkpoint 是否需要 Host 侧主动失效通知（如会话清空时删除对应 state key）。
+  当前实现靠 runner 读取时校验并回退，功能不阻塞。

docs/agent-runner-pluginization/SECURITY_HARDENING.md

@@ -0,0 +1,111 @@
+# Agent Runner Security Hardening
+
+本文档记录 agent-runner 插件化进入生产发布前需要补齐的安全与稳定加固项。
+
+## 状态
+
+**当前结论：暂不塞进本阶段 agent-runner plugin 协议闭环。**
+
+本阶段目标是验证 LangBot 可以通过统一的 `run(event, binding)` 协议接入 `local-agent` 与外部 harness runner（当前官方路径为 LiteLLM Agent Platform runner），并能传递事件、上下文、资源句柄、状态和结果流。
+
+安全发布级 hardening 是后续 release gate，不应阻塞当前协议闭环，但必须作为进入生产默认启用前的验收条件。
+
+> **硬规则**：能执行代码 / 访问工作目录的外部 harness runner（Claude Code、Codex、Kimi Code 等）不得在生产环境默认启用或隐式开启。self-host stdio / 容器内部署可以作为管理员显式 opt-in，并在配置或 UI 中标明 operator-owned execution risk；只有生产默认启用、托管云 runner 或 LangBot 承诺提供受管执行环境时，才要求完成本文 full Release Gate。
+
+## Multica 对比结论
+
+对照 Multica 当前 daemon / runtime 模型，可以采用类似边界：
+
+- Multica 的 agent 不运行在 Multica server 上，而是由用户机器上的 daemon 调用本机已安装的 AI coding tool；runtime 不是 server，也不是 container。
+- 标准任务由 daemon 在 workspace root 下创建 per-task environment；但 `local_directory` 场景会直接在用户指定目录原地操作，只做绝对路径、路径清理、系统根目录 / home 黑名单、symlink realpath、读写能力和同路径串行锁校验。
+- 子进程通过 `exec.CommandContext`、timeout、cwd 和 env 运行；custom args 只过滤 protocol-critical flags，custom env 只阻止覆盖 daemon 内部变量和关键路径变量。它没有尝试阻止外部 CLI 读取该 OS 用户本来能访问的所有宿主路径。
+- MCP / secret 的约束更具体：Claude 走 `--mcp-config` + strict config；Codex 把 managed MCP 写入 per-task `$CODEX_HOME/config.toml`，避免 secret 出现在 argv / 日志；agent token 优先使用 task-scoped token。
+- Skill 安全边界也明确留给用户和目标工具：第三方 skill 不由 Multica 签名、审计或沙箱化。
+- provider-native sandbox 是 opportunistic guardrail，不是统一安全承诺。例如 Codex 在部分平台可写 managed sandbox config，但平台限制下也可能退回更宽松模式；Claude daemon mode 也会使用自动授权 / bypass 类能力以保证无人值守执行。
+
+因此，LangBot 不应把“完整约束外部 harness 的宿主文件 / 进程 / CPU / 内存 / native tool 能力”作为当前协议闭环或 self-host opt-in 的前置条件。当前阶段应承认外部 harness 是 operator-owned execution，并把 LangBot 可控的最小护栏补齐。
+
+## 启用级别
+
+| 场景 | 当前策略 | LangBot 必须负责 | 不作为当前阶段目标 |
+| --- | --- | --- | --- |
+| self-host stdio 外部 harness | 管理员显式 opt-in，默认关闭。 | 风险提示、runner/binding 权限摘要、Host 资源授权、Host 生成路径约束、env / secret 过滤、MCP scoped projection、timeout / cancel / output bound、state / audit。 | 阻止该 CLI 访问同一 OS 用户本来可访问的任意宿主文件、进程或全局 CLI 配置。 |
+| 容器内部署外部 harness | operator 通过容器镜像、挂载、环境变量和网络策略承担执行边界。 | 不假设 privileged container；只投影授权资源；文档提示最小挂载和最小 env；沿用 self-host 最小护栏。 | 在容器内再实现一套完整 VM / cgroup / seccomp 策略。 |
+| managed/cloud/default external harness | 只有完成 full Release Gate 后才能默认启用。 | 受管 workspace、容器/VM/process isolation、CPU / memory / disk / network / output quotas、完整 lifecycle cleanup、first-class audit 和 admin control。 | 无。 |
+
+## 责任边界
+
+### LangBot Host 负责
+
+- 资源授权：决定某个 `run_id` / binding 可以访问哪些模型、RAG、MCP、skill、artifact、history、state。
+- 资源投影：只把授权后的资源句柄、配置片段或上下文文件传给 runner。
+- 路径策略：限制 Host 生成的 workspace / context file / artifact 的允许路径和清理策略；对管理员显式指定的本地工作目录做规范化、黑名单和风险提示。
+- Secret 策略：过滤环境变量、配置、日志和 transcript 中的 secret。
+- 运行约束：配置超时、轮次、并发、配额、输出大小和取消路径。
+- 审计记录：记录事件、绑定、资源授权、runner 调用、外部 harness session id、关键错误和结果摘要。
+
+### Runner Plugin 负责
+
+- 遵守 LangBot 下发的 Agent/runner config、授权资源和运行约束。
+- 将 LangBot 资源投影成目标 runner 可消费的形式，例如 context 文件、MCP 配置、环境变量或 CLI 参数。
+- 遵守 PROTOCOL_V1 §13 的插件实例边界；需要跨轮次保存的外部 session id / working directory 等状态应写入 host-owned state。
+- 对外部进程做最小必要封装，包括命令参数构造、超时、取消、输出解析和错误映射。
+
+### 外部 Harness 负责
+
+Claude Code、Codex、Kimi Code 等外部 harness 可以继续使用自身的权限模型、工具 allow / deny 规则、MCP 加载策略、session/resume 机制和沙箱能力。
+
+但外部 harness 不是 LangBot 的唯一安全边界。LangBot 仍必须在 Host 可控范围内完成资源授权、路径限制、secret 过滤和审计记录；stdio / 容器内显式启用时，外部 harness 对宿主 OS 的最终访问能力由 operator 的 CLI、账户、容器和挂载策略承担。
+
+## 当前 MVP 可接受边界
+
+当前阶段可以接受以下前提：
+
+- 由可信管理员配置 runner binding，并显式启用外部 harness 风险模式。
+- 工作目录和 context 输出目录为显式配置或 host 生成路径。
+- 外部 runner 应尽量使用保守权限，例如 plan / no-write 模式或禁用高风险工具；具体 provider-native 高风险模式只能作为管理员显式 opt-in 的 dev / smoke path。
+- 通过 timeout、max turns、输出长度和进程取消降低失控风险。
+- 通过 host-owned state 保存 `external.session_id`、`external.working_directory` 等 resume 所需指针。
+
+这些前提足够做本地 E2E 与协议验收，不等同于生产发布完成。
+
+## Admin Opt-in Minimum Guardrails
+
+外部 harness 如果只作为 self-host stdio / 容器内部署的管理员显式 opt-in，本阶段不要求完成 full OS sandbox，但至少需要：
+
+- 默认关闭外部 harness binding；启用时显示 runner 权限、工作目录、MCP / skill 投影和危险权限提示。
+- Host 生成的 workspace / context / artifact 路径必须在 allowlist root 内；管理员显式工作目录必须做 absolute path、`realpath`、系统根目录 / home 黑名单、`..` 逃逸和 symlink 检查。
+- 子进程环境使用 allowlist 或强 denylist，禁止覆盖 LangBot 内部变量、token、workspace root、runner state root、`PATH` / `HOME` 等关键变量；日志、错误、transcript 和 artifact metadata 必须 redaction。
+- MCP 配置必须是 scoped projection；secret 不应出现在 argv 或普通日志；LangBot MCP bridge 只暴露当前 run 授权的 tool surface。
+- Skill 投影必须来自 Host 已授权资源；记录来源、版本 / hash 或摘要；投影目录在 run / workspace 生命周期内可清理。
+- CLI 参数需要过滤 protocol-critical flags；高风险 permission mode 必须是显式配置或显式 MVP 标记，不能作为用户不可见的安全承诺。
+- 子进程必须支持 timeout、cancel、进程组清理和输出上限；CPU / memory / container hard quota 仅对 managed/cloud/default external harness 强制。
+- state / workspace / artifact 至少要有 owner scope、session id 记录、cleanup path 和 audit-lite 事件。
+- 测试覆盖 path escape、env / secret 泄漏、MCP deny、timeout、cancel、resume、cleanup 和 audit 字段完整性。
+
+## Release Gate Checklist
+
+下表是进入“生产默认启用 / managed external harness / LangBot 承诺提供受管执行环境”前的 full gate。状态快照必须与 [STATUS.md](./STATUS.md) 的日期同步更新；“已补”只代表 self-host stdio / 容器内管理员显式 opt-in 的最小护栏，不代表 managed/default runner 已具备完整生产隔离。
+
+| 项目 | 状态 | 当前已补 | 仍缺口 / 发布前要求 |
+| --- | --- | --- | --- |
+| Path isolation | Partial | ArtifactStore 对 file artifact 使用 `realpath` + root containment 复核；Host 侧 run/session 生命周期和 resource authorization 已建立。 | LiteLLM Agent Platform 所在机器的 workspace、挂载、CLI 可访问路径和 cleanup 由部署侧承担；Host 生成 workspace / context / artifact root 还缺统一 allowlist、mount 策略、TTL cleanup 和 orphan cleanup。 |
+| Permission boundary | Partial | Host 已有 manifest permissions 与 binding resource policy 交集、run-scoped authorization snapshot、`ctx.context.available_apis`、proxy action `caller_plugin_identity` 校验；LiteLLM gateway 回访 LangBot 资产时必须携带 `run_id` 并接受 Host 校验。 | 外部 harness 的 native 文件 / 进程 / tool 能力仍属于 operator-owned execution；manifest permissions 只约束 LangBot 持有资源，生产默认或 managed runner 需要容器/VM/OS 级隔离、tool allow/deny 和可审计审批。 |
+| Secret handling | Partial | LangBot 持有的资源访问不直接投影 secret 给 harness；LiteLLM gateway 使用 bearer token 保护入口，真实 LangBot 资产请求回到 Host action 校验。 | 仍缺 Host 全链路统一 redaction policy、transcript / artifact metadata / admin UI 脱敏规则、secret 来源与轮换策略、跨 runner 的配置脱敏审计；LiteLLM 部署侧的 provider token、CLI auth 和日志脱敏另行负责。 |
+| MCP policy | Partial | LiteLLM runner 暴露稳定 HTTP MCP gateway，只提供 history page、knowledge retrieve、authorized tool call 等最小工具面；错误或过期 `run_id` 会被 Host 拒绝。 | 缺 Host / Admin 级外部 MCP server allowlist、scoped token 生命周期、tool allow / deny 策略、危险工具审批和 MCP 调用审计；后续如 LiteLLM 原生支持 run-scoped MCP session，应改为平台级传递 run scope。 |
+| Skill access policy | Partial | Host resource builder 会按 runner capability 和 resource policy 暴露 skill-backed scoped tool；当前 code-agent runner 不再接受用户手写 `skills-json`，避免 runner binding 任意投影 skill；skill tool 路径和可见性已有部分单测。 | 缺 code-agent harness 的发布级 skill 来源验证、版本 / hash 记录、projection cleanup 和审计；如后续需要 harness-native skill 文件，也必须由 Host / sandbox 生成受限 tool surface，不能绕过 SDK runtime 访问 LangBot 资源。 |
+| Process isolation | Partial | Host runtime deadline 和 runner timeout 已有；LiteLLM runner 对 HTTP 调用设置 timeout 并把服务错误映射为受控失败。 | 外部 harness 子进程、取消、输出上限、CPU / 内存 / 文件 / 容器 hard quota、网络策略、长期 workspace GC 和平台级 cancel/audit 由 LiteLLM 部署侧或后续 managed/cloud/default external harness gate 负责。 |
+| State lifecycle | Partial | PersistentStateStore 有 runner / binding / scope 隔离、JSON size limit、state get / set / list / delete；LiteLLM runner 会写回外部 session id，避免把具体 provider 的内部路径当成 Host resume 事实。 | 缺 session / workspace / artifact TTL、过期清理、迁移策略、orphan cleanup 和 lifecycle audit；managed/default runner 需要 Host first-class workspace 生命周期。 |
+| Audit first-class | Partial | EventLog、Transcript、ArtifactStore、PersistentStateStore 已能记录主链路事实；proxy 校验失败会写 warning。 | 资源授权快照、外部命令、MCP tool 决策、secret redaction、cleanup、resume / workspace 生命周期还不是一等 audit surface。 |
+| UI / Admin control | Missing | 当前 Pipeline runner 配置能选择插件 runner。 | 缺管理员可见的 runner 权限摘要、风险提示、生产禁用 / 启用入口、resource binding 管理、MCP / skill / workspace 策略 UI。 |
+| Test matrix | Partial | 已有 run authorization、caller identity、artifact、state、history / event pull API、LiteLLM HTTP session、run_id prompt 注入、gateway MCP 回访、错误 run_id 拒绝、skill visibility 等单测；runner 仓库 `pytest` / `ruff` 应保持通过。 | 仍缺 Host UI smoke、真实 LiteLLM Agent Platform harness E2E、生产禁用入口、MCP deny / dangerous tool 审计、workspace cleanup / audit 完整性矩阵；CPU / memory / container quota 测试属于 managed/cloud/default full gate。 |
+
+## 非当前范围
+
+以下内容不属于本阶段协议闭环：
+
+- 完整异步队列与 issue-centric 产品模型。
+- 复杂 workflow engine。
+- 具体 CLI provider 直连适配器全量接入。
+- EBA 分支的完整迁移由外部 EBA 分支联调；本阶段只复用其需要的 AgentRunner Host 底座。
+- 发布级安全 hardening 的完整实现。

docs/agent-runner-pluginization/STATUS.md

@@ -0,0 +1,49 @@
+# AgentRunner Pluginization Status
+
+本文档是 `docs/agent-runner-pluginization/` 的状态事实源。协议 schema 仍以 [PROTOCOL_V1.md](./PROTOCOL_V1.md) 为准；测试步骤以 [AGENT_RUNNER_QA_GUIDE.md](./AGENT_RUNNER_QA_GUIDE.md) 为准；安全发布门槛以 [SECURITY_HARDENING.md](./SECURITY_HARDENING.md) 为准。
+
+状态快照日期：2026-06-12。
+
+## 实现状态
+
+| 领域 | 状态 | 说明 |
+| --- | --- | --- |
+| SDK manifest schema | Done | `AgentRunnerManifest` 包含 typed `capabilities` / `permissions`；未知 capability / permission key 禁止进入 typed model。 |
+| Runner discovery | Done | Runtime 返回 typed manifest；Host registry 校验单个 runner，失败 warning + skip，不影响其它 runner。 |
+| Host resource authorization | Done | `ctx.resources` 和 `ctx.context.available_apis` 由 manifest permissions 与 binding policy / run scope 求交后生成。 |
+| Run authorization snapshot | Done | active run session 冻结 run-scoped resources 与 available APIs；runtime handler 按 snapshot 校验 pull API。 |
+| Result payload validation | Done | Wire 保持 `{type, data}`；Host 对投递/副作用类 payload 严格校验，tool-call telemetry 宽松，未知 type 忽略并 warning。 |
+| Old built-in runners | Done | 旧 `src/langbot/pkg/provider/runners/*` 与 `RequestRunner` 路径已从本分支删除。 |
+| Official runner manifests | Done | `local-agent`、LiteLLM Agent Platform、外部服务 runner 已重新声明真实生效的 LangBot resource permissions。 |
+| Runtime Control Plane v2 | Future | 第一阶段设计为 Host-owned Run Ledger；runtime registry / heartbeat / daemon claim 是后续可选阶段。 |
+| Full release security gate | Future | self-host / container opt-in 可继续；managed/default external harness 需完成 SECURITY_HARDENING full gate。 |
+| Steering control path | Done | claim 异常不再逃逸 consumer loop；queue 有上限；未 pull 的 claimed 输入在 run 结束时写 `steering.dropped` 审计终态。 |
+| SDK v1 contract closure | Done | SDK 提供 `AgentAPIError` / `AgentAPIException`、typed `SteeringPullResult`、未知 result type 宽容解析、result `sequence` 注入与取消传播。 |
+
+## Spec 与实现已知差距
+
+- `action.requested` 仍只作为 telemetry / reserved surface；platform action executor 不在本分支执行。
+- EventGateway / EventRouter 完整实现由外部 EBA 分支联调；本分支只提供 event-first host envelope / binding / run 入口。
+- State 与 storage 的长期类型边界仍可继续收窄；当前合同只要求 JSON-safe state 与受控 storage API。
+- Artifact 读取路径已检查 `expires_at`，EventLog / Transcript / Artifact 已提供显式 cleanup primitive；长期 retention 默认值、TTL 调度接入和大 payload 去重仍是运维收尾项，应在 Runtime Control Plane Phase 1 前补齐。
+- External harness 的 native shell / filesystem / CLI / MCP 权限不受 manifest permissions 约束；manifest permissions 只约束 LangBot 持有的资源访问。
+- Managed/cloud/default external harness 的 OS/process/network quota、workspace GC、完整 audit/admin control 仍是发布门槛，不是 Protocol v1 已完成能力。
+
+## Runner 验收状态
+
+| Runner | 状态 | 最近证据 |
+| --- | --- | --- |
+| `plugin:langbot/local-agent/default` | Unit-pass; UI smoke pending | 2026-06-10 本地 pytest / ruff 通过；WebUI smoke 由人工统一执行。 |
+| `plugin:langbot/litellm-agent-platform-agent/default` | Unit-pass; E2E pending | 通过 runner 仓库单测覆盖 HTTP session、run_id prompt 注入和 LangBot MCP gateway；真实 harness E2E 取决于 LiteLLM Agent Platform 部署和 provider 登录态。 |
+| Dify / n8n / Coze / DashScope / Langflow / Tbox / DeerFlow / WeKnora | Unit-pass; credential smoke optional | 2026-06-13 plugin layout / parser tests 通过；真实服务凭据 smoke 非每轮必跑。 |
+
+## 历史高价值记录
+
+历史报告已合并为本状态页和 QA 指南，不再保留单独进度文档。后续若需要追溯，优先查看 `langbot-skills/reports/` 下的原始执行报告。
+
+截至 2026-05-29，已有本地 smoke 证明：
+
+- `local-agent` 可以通过 Pipeline Debug Chat 走插件化 `AgentRunOrchestrator` 主链路。
+- 外部 harness runner 可以通过同一条 `run(event, binding)` 路径执行；当前官方实现已收敛到 LiteLLM Agent Platform runner，具体 Claude Code / Codex CLI provider 不再由本仓库直接维护。
+
+这些记录只证明本地协议闭环可用，不代表发布级 security hardening 已完成。

docs/event-based-agents/00-overview.md

@@ -1,200 +0,0 @@
-# Event Based Agents 架构设计总览
-
-## 1. 背景与动机
-
-### 当前架构的局限性
-
-LangBot 当前的平台适配器架构围绕**消息事件**单一场景设计：
-
-- **事件层面**：只监听 `FriendMessage`（私聊消息）和 `GroupMessage`（群消息）两种事件
-- **API 层面**：只暴露 `send_message` 和 `reply_message` 两个平台 API
-- **处理层面**：所有消息统一进入 Pipeline 流水线处理，无法为不同事件类型配置不同处理逻辑
-- **适配器结构**：每个适配器是单个 Python 文件（200-800 行），随着功能增加难以维护
-
-这导致以下问题：
-
-1. **无法处理非消息事件**：新成员入群、好友请求、消息撤回、消息编辑等大部分平台都支持的事件被完全忽略
-2. **平台能力未充分利用**：编辑消息、撤回消息、获取群成员列表、管理群组等 API 无法使用
-3. **插件能力受限**：插件只能监听消息事件、只能发送/回复消息，无法实现更丰富的交互
-4. **处理逻辑不灵活**：所有消息走同一条 Pipeline，无法为入群欢迎、好友自动通过等场景配置独立的处理流程
-
-### 设计目标
-
-Event Based Agents（EBA）架构旨在将 LangBot 从"消息处理平台"升级为"事件驱动的智能代理平台"：
-
-- **丰富事件**：支持消息、群组、好友、Bot 状态等多种事件类型
-- **丰富 API**：支持消息编辑/撤回、群组管理、用户信息查询等通用 API，以及适配器特有 API 的透传调用
-- **灵活编排**：用户可在 WebUI 上为每个 Bot 的每种事件类型配置不同的处理器
-- **可扩展**：适配器可声明自己支持的事件和 API，平台特有能力通过标准机制暴露
-- **向后兼容**：现有插件无需修改即可在新架构下运行
-
-## 2. 架构对比
-
-### 现有架构
-
-```
-消息平台 (Telegram/Discord/...)
-    │
-    ▼
-平台适配器 (单文件, 只处理消息)
-    │ FriendMessage / GroupMessage
-    ▼
-RuntimeBot (注册 on_friend_message / on_group_message 回调)
-    │
-    ▼
-MessageAggregator (消息聚合)
-    │
-    ▼
-QueryPool → Controller → Pipeline (固定阶段链)
-    │                         │
-    │                         ▼
-    │                    RequestRunner (local-agent / dify / n8n / ...)
-    │
-    ▼
-adapter.reply_message() / adapter.send_message()
-```
-
-关键代码路径：
-- 适配器基类：`langbot-plugin-sdk/.../abstract/platform/adapter.py` — `AbstractMessagePlatformAdapter`
-- 事件定义：`langbot-plugin-sdk/.../builtin/platform/events.py` — 仅 `FriendMessage` / `GroupMessage`
-- Bot 管理：`LangBot/src/langbot/pkg/platform/botmgr.py` — `RuntimeBot` 只注册两个消息回调
-- 流水线控制：`LangBot/src/langbot/pkg/pipeline/controller.py` — 从 QueryPool 消费并执行 Pipeline
-
-### 新架构（Event Based Agents）
-
-```
-消息平台 (Telegram/Discord/...)
-    │
-    ▼
-平台适配器 (独立目录, 监听所有事件, 实现丰富 API)
-    │ MessageReceived / MemberJoined / FriendRequest / ...
-    ▼
-EventBus (统一事件总线)
-    │
-    ▼
-EventRouter (事件路由引擎, 读取 Bot 的 event_handlers 配置)
-    │
-    ├─→ PipelineHandler   — 现有流水线（完整 Stage 链）
-    ├─→ AgentHandler      — 直接调用 RequestRunner（轻量 AI 处理）
-    ├─→ WebhookHandler    — POST 到外部服务（Dify/n8n webhook 等）
-    └─→ PluginHandler     — 分发给插件 EventListener
-    │
-    ▼
-统一平台 API
-  send / reply / edit / delete / getGroupInfo / getUserInfo / callPlatformApi / ...
-```
-
-## 3. 核心概念
-
-### 3.1 统一事件体系
-
-所有平台事件统一为命名空间式的事件类型：
-
-| 命名空间 | 事件 | 说明 |
-|----------|------|------|
-| `message.*` | `message.received`, `message.edited`, `message.deleted`, `message.reaction` | 消息相关 |
-| `feedback.*` | `feedback.received` | 用户对 Bot 回复的点赞、点踩、取消反馈等评价事件 |
-| `group.*` | `group.member_joined`, `group.member_left`, `group.member_banned`, `group.info_updated` | 群组相关 |
-| `friend.*` | `friend.request_received`, `friend.added`, `friend.removed` | 好友相关 |
-| `bot.*` | `bot.invited_to_group`, `bot.removed_from_group`, `bot.muted`, `bot.unmuted` | Bot 状态 |
-| `platform.*` | `platform.{adapter}.{action}` | 适配器特有事件 |
-
-详见 [01-event-system.md](./01-event-system.md)。
-
-### 3.2 统一平台 API
-
-扩展适配器基类，提供通用 API + 透传机制：
-
-| 类别 | API | 必需/可选 |
-|------|-----|----------|
-| 消息 | `send_message`, `reply_message`, `edit_message`, `delete_message`, `forward_message` | send/reply 必需，其余可选 |
-| 群组 | `get_group_info`, `get_group_member_list`, `get_group_member_info`, `mute_member`, `kick_member` | 全部可选 |
-| 用户 | `get_user_info`, `get_friend_list` | 全部可选 |
-| 媒体 | `upload_file`, `get_file_url` | 全部可选 |
-| 透传 | `call_platform_api(action, params)` | 可选 |
-
-详见 [02-platform-api.md](./02-platform-api.md)。
-
-### 3.3 适配器新结构
-
-每个适配器从单文件迁移到独立目录：
-
-```
-pkg/platform/adapters/
-├── _base/                    # 基类和通用定义
-│   ├── adapter.py
-│   ├── events.py
-│   ├── entities.py
-│   └── api.py
-├── telegram/
-│   ├── __init__.py
-│   ├── adapter.py            # 主适配器类
-│   ├── event_converter.py    # 事件转换（多种事件类型）
-│   ├── message_converter.py  # 消息链转换
-│   ├── api_impl.py           # 通用 API 实现
-│   ├── platform_api.py       # 平台特有 API
-│   ├── types.py              # 平台特有类型
-│   └── manifest.yaml
-├── discord/
-│   └── ...
-```
-
-详见 [03-adapter-structure.md](./03-adapter-structure.md)。
-
-### 3.4 事件处理器（Event Handler）
-
-> **2026-06 方向修订**：四种处理器的分类法已演进为「事件 → Agent」统一编排——所有编排目标（流水线、RequestRunner、webhook、工作流）收编为 Agent 抽象，插件 EventListener 保留为观察者角色。详见 [07-agent-orchestration.md](./07-agent-orchestration.md)。本节保留原设计供对照。
-
-四种处理器类型，用户在 WebUI 的 Bot 管理页面配置：
-
-| 类型 | 说明 | 适用场景 |
-|------|------|----------|
-| **pipeline** | 现有流水线机制，完整的多 Stage 处理链（PreProcessor → MessageProcessor → PostProcessor 等） | 复杂消息处理，需要完整的预处理/后处理流程 |
-| **agent** | 直接调用 RequestRunner（local-agent / dify / n8n / coze / dashscope / langflow / tbox），从 Pipeline 中解耦 | 轻量级 AI 处理、直接对接外部 LLMOps 平台处理各类事件 |
-| **webhook** | 将事件 POST 到外部 URL，根据响应执行动作 | 对接自建服务、Dify/n8n 的 Webhook 触发器、自定义后端 |
-| **plugin** | 分发给插件 EventListener 处理 | 插件自定义逻辑 |
-
-配置存储在 Bot 表的 `event_handlers` JSON 字段中，通过 WebUI 编排面板管理。
-
-详见 [04-event-routing.md](./04-event-routing.md)。
-
-### 3.5 插件 SDK 改造
-
-- 新事件类型全部暴露给插件
-- 新 API 全部通过 `LangBotAPIProxy` 暴露
-- 兼容层保证现有插件零修改运行
-
-详见 [05-plugin-sdk.md](./05-plugin-sdk.md)。
-
-## 4. 关键设计决策
-
-| # | 决策点 | 选择 | 理由 |
-|---|--------|------|------|
-| 1 | 事件处理器配置粒度 | 每个 Bot 独立配置 | Bot 是用户操作的核心单元，不同 Bot 可能对接不同业务场景 |
-| 2 | 适配器特有 API | 统一抽象 + `call_platform_api` 透传 | 通用 API 覆盖大部分场景，透传机制保证灵活性，避免每个适配器导出独立的类型化 API 包 |
-| 3 | 向后兼容策略 | 兼容层适配 | 保留旧事件类型和 API 作为新系统的 alias/wrapper，现有插件无需修改 |
-| 4 | 处理器配置存储 | Bot 表新增 `event_handlers` JSON 字段 | 简单直接，避免新增关联表；替代现有 `use_pipeline_uuid` |
-| 5 | Agent 处理器定位 | 从 Pipeline 中解耦 RequestRunner | 不是所有事件都需要完整 Pipeline Stage 链；Agent 处理器提供轻量级 AI 处理路径，支持所有现有 Runner |
-| 6 | 事件命名方式 | 命名空间式（`message.received`） | 清晰的分类层级，便于通配匹配（`message.*`），与 WebUI 配置天然对应 |
-
-## 5. 文档索引
-
-| 文档 | 内容 |
-|------|------|
-| [01-event-system.md](./01-event-system.md) | 统一事件体系：事件分类、定义、生命周期 |
-| [02-platform-api.md](./02-platform-api.md) | 统一平台 API：通用 API、透传 API、实体定义 |
-| [03-adapter-structure.md](./03-adapter-structure.md) | 适配器新结构：目录布局、基类、注册机制 |
-| [04-event-routing.md](./04-event-routing.md) | 事件路由与编排：路由引擎、处理器类型、WebUI 数据模型 |
-| [05-plugin-sdk.md](./05-plugin-sdk.md) | 插件 SDK 改造：新事件/API、兼容层 |
-| [06-migration-plan.md](./06-migration-plan.md) | 分阶段迁移计划 |
-| [07-agent-orchestration.md](./07-agent-orchestration.md) | **产品最终形态（2026-06 修订）**：Agent 统一编排、SDK Agent 组件契约、发布火车 |
-
-## 6. 涉及的代码仓库
-
-| 仓库 | 改动范围 |
-|------|----------|
-| **langbot-plugin-sdk** | 事件定义、实体模型、API 接口、适配器基类、通信协议扩展 |
-| **LangBot**（后端） | 适配器实现、事件路由引擎、Bot 实体扩展、数据库迁移、RequestRunner 解耦 |
-| **LangBot**（前端） | Bot 事件处理器编排面板 |
-| **langbot-wiki** | 新架构文档、插件开发指南更新、适配器开发指南 |
-| **langbot-plugin-demo** | 示例更新（使用新事件和 API） |

docs/event-based-agents/01-event-system.md

@@ -1,561 +0,0 @@
-# 统一事件体系
-
-## 1. 设计原则
-
-- **命名空间分类**：事件类型采用 `{namespace}.{action}` 格式，如 `message.received`
-- **通用优先**：大部分平台都支持的事件抽象为通用事件，定义统一的字段格式
-- **平台特有事件标准化**：各适配器的独有事件通过 `PlatformSpecificEvent` 承载，保留原始数据
-- **向后兼容**：现有 `FriendMessage` / `GroupMessage` 通过兼容层映射到新的 `message.received` 事件
-
-## 2. 事件基类层次
-
-```
-Event (事件基类)
-├── MessageEvent (消息相关事件)
-│   ├── MessageReceivedEvent       # message.received
-│   ├── MessageEditedEvent         # message.edited
-│   ├── MessageDeletedEvent        # message.deleted
-│   └── MessageReactionEvent       # message.reaction
-├── FeedbackEvent (用户反馈事件)
-│   └── FeedbackReceivedEvent      # feedback.received
-├── GroupEvent (群组相关事件)
-│   ├── MemberJoinedEvent          # group.member_joined
-│   ├── MemberLeftEvent            # group.member_left
-│   ├── MemberBannedEvent          # group.member_banned
-│   ├── MemberUnbannedEvent        # group.member_unbanned
-│   └── GroupInfoUpdatedEvent      # group.info_updated
-├── FriendEvent (好友相关事件)
-│   ├── FriendRequestReceivedEvent # friend.request_received
-│   ├── FriendAddedEvent           # friend.added
-│   └── FriendRemovedEvent         # friend.removed
-├── BotEvent (Bot 状态事件)
-│   ├── BotInvitedToGroupEvent     # bot.invited_to_group
-│   ├── BotRemovedFromGroupEvent   # bot.removed_from_group
-│   ├── BotMutedEvent              # bot.muted
-│   └── BotUnmutedEvent            # bot.unmuted
-└── PlatformSpecificEvent          # platform.{adapter}.{action}
-```
-
-## 3. 通用事件定义
-
-### 3.1 事件基类
-
-```python
-class Event(pydantic.BaseModel):
-    """事件基类"""
-
-    type: str
-    """事件类型标识，如 'message.received'"""
-
-    timestamp: float
-    """事件发生的时间戳"""
-
-    bot_uuid: str
-    """接收到此事件的 Bot UUID"""
-
-    adapter_name: str
-    """产生此事件的适配器名称"""
-
-    source_platform_object: typing.Optional[typing.Any] = None
-    """原始平台事件对象，供适配器内部使用"""
-```
-
-### 3.2 消息事件
-
-#### MessageReceivedEvent (`message.received`)
-
-收到新消息。这是最核心的事件，替代现有的 `FriendMessage` / `GroupMessage`。
-
-```python
-class MessageReceivedEvent(Event):
-    """收到新消息"""
-
-    type: str = "message.received"
-
-    message_id: typing.Union[int, str]
-    """消息 ID"""
-
-    message_chain: MessageChain
-    """消息内容"""
-
-    sender: User
-    """发送者"""
-
-    chat_type: ChatType  # "private" | "group"
-    """会话类型"""
-
-    chat_id: typing.Union[int, str]
-    """会话 ID（私聊为对方用户 ID，群聊为群 ID）"""
-
-    group: typing.Optional[Group] = None
-    """群信息（仅群聊时存在）"""
-```
-
-与现有类型的映射关系：
-- `chat_type == "private"` → 等价于现有 `FriendMessage`
-- `chat_type == "group"` → 等价于现有 `GroupMessage`
-
-`ChatType` 枚举：
-
-```python
-class ChatType(str, Enum):
-    PRIVATE = "private"
-    GROUP = "group"
-```
-
-#### MessageEditedEvent (`message.edited`)
-
-消息被编辑。
-
-```python
-class MessageEditedEvent(Event):
-    """消息被编辑"""
-
-    type: str = "message.edited"
-
-    message_id: typing.Union[int, str]
-    """被编辑的消息 ID"""
-
-    new_content: MessageChain
-    """编辑后的新内容"""
-
-    editor: User
-    """编辑者"""
-
-    chat_type: ChatType
-    chat_id: typing.Union[int, str]
-    group: typing.Optional[Group] = None
-```
-
-#### MessageDeletedEvent (`message.deleted`)
-
-消息被删除/撤回。
-
-```python
-class MessageDeletedEvent(Event):
-    """消息被删除/撤回"""
-
-    type: str = "message.deleted"
-
-    message_id: typing.Union[int, str]
-    """被删除的消息 ID"""
-
-    operator: typing.Optional[User] = None
-    """操作者（可能是发送者自己撤回，也可能是管理员删除）"""
-
-    chat_type: ChatType
-    chat_id: typing.Union[int, str]
-    group: typing.Optional[Group] = None
-```
-
-#### MessageReactionEvent (`message.reaction`)
-
-消息收到表情回应。
-
-```python
-class MessageReactionEvent(Event):
-    """消息收到表情回应"""
-
-    type: str = "message.reaction"
-
-    message_id: typing.Union[int, str]
-    """被回应的消息 ID"""
-
-    user: User
-    """回应者"""
-
-    reaction: str
-    """回应的表情标识（emoji 或平台特定表情 ID）"""
-
-    is_add: bool
-    """True 为添加回应，False 为移除回应"""
-
-    chat_type: ChatType
-    chat_id: typing.Union[int, str]
-    group: typing.Optional[Group] = None
-```
-
-### 3.3 用户反馈事件
-
-#### FeedbackReceivedEvent (`feedback.received`)
-
-用户对 Bot 回复提交反馈。该事件用于承载平台提供的点赞、点踩、取消反馈以及点踩原因等评价信息；典型来源包括企业微信 AI Bot 的 `feedback_event`、飞书卡片按钮回调、Web Embed 的反馈入口等。
-
-```python
-class FeedbackReceivedEvent(Event):
-    """收到用户反馈"""
-
-    type: str = "feedback.received"
-
-    feedback_id: str
-    """平台侧反馈 ID，用于幂等记录或取消反馈"""
-
-    feedback_type: int
-    """1 = like, 2 = dislike, 3 = cancel/remove feedback"""
-
-    feedback_content: typing.Optional[str] = None
-    """用户填写的自由文本反馈"""
-
-    inaccurate_reasons: typing.Optional[list[str]] = None
-    """点踩时平台提供的预设不准确原因"""
-
-    user_id: typing.Optional[str] = None
-    """提交反馈的用户 ID"""
-
-    session_id: typing.Optional[str] = None
-    """会话 ID，例如 person_xxx 或 group_xxx"""
-
-    message_id: typing.Optional[str] = None
-    """被评价的 Bot 回复消息 ID"""
-
-    stream_id: typing.Optional[str] = None
-    """流式回复 ID，用于关联 streaming response"""
-```
-
-设计约定：
-
-- `feedback_id` 是幂等键；同一个 `feedback_id` 的后续事件应更新已有记录。
-- `feedback_type == 3` 表示用户取消/移除反馈，处理器可删除对应记录或标记为取消。
-- 如果平台只能给出原始回调 payload，差异字段保留在 `source_platform_object` 或 `PlatformSpecificEvent.data` 中；通用字段仍优先映射到 `FeedbackReceivedEvent`。
-- 该事件保留向后兼容映射：EBA 事件可转换为旧的 `FeedbackEvent`，字段语义保持一致。
-
-### 3.4 群组事件
-
-#### MemberJoinedEvent (`group.member_joined`)
-
-新成员加入群组。
-
-```python
-class MemberJoinedEvent(Event):
-    """新成员加入群组"""
-
-    type: str = "group.member_joined"
-
-    group: Group
-    """群组"""
-
-    member: User
-    """加入的成员"""
-
-    inviter: typing.Optional[User] = None
-    """邀请者（如有）"""
-
-    join_type: typing.Optional[str] = None
-    """加入方式：'invite' / 'request' / 'direct' / None"""
-```
-
-#### MemberLeftEvent (`group.member_left`)
-
-成员离开群组。
-
-```python
-class MemberLeftEvent(Event):
-    """成员离开群组"""
-
-    type: str = "group.member_left"
-
-    group: Group
-    member: User
-
-    is_kicked: bool = False
-    """是否被踢出"""
-
-    operator: typing.Optional[User] = None
-    """操作者（踢出时为管理员）"""
-```
-
-#### MemberBannedEvent (`group.member_banned`)
-
-成员被禁言。
-
-```python
-class MemberBannedEvent(Event):
-    """成员被禁言"""
-
-    type: str = "group.member_banned"
-
-    group: Group
-    member: User
-    operator: typing.Optional[User] = None
-    duration: typing.Optional[int] = None
-    """禁言时长（秒），None 表示永久"""
-```
-
-#### MemberUnbannedEvent (`group.member_unbanned`)
-
-成员被解除禁言。
-
-```python
-class MemberUnbannedEvent(Event):
-    """成员被解除禁言"""
-
-    type: str = "group.member_unbanned"
-
-    group: Group
-    member: User
-    operator: typing.Optional[User] = None
-```
-
-#### GroupInfoUpdatedEvent (`group.info_updated`)
-
-群组信息被修改。
-
-```python
-class GroupInfoUpdatedEvent(Event):
-    """群组信息被修改"""
-
-    type: str = "group.info_updated"
-
-    group: Group
-    """更新后的群组信息"""
-
-    operator: typing.Optional[User] = None
-    """操作者"""
-
-    changed_fields: list[str] = []
-    """发生变更的字段名列表，如 ['name', 'description']"""
-```
-
-### 3.5 好友事件
-
-#### FriendRequestReceivedEvent (`friend.request_received`)
-
-收到好友请求。
-
-```python
-class FriendRequestReceivedEvent(Event):
-    """收到好友请求"""
-
-    type: str = "friend.request_received"
-
-    request_id: typing.Union[int, str]
-    """请求 ID，用于后续 approve/reject 操作"""
-
-    user: User
-    """请求者"""
-
-    message: typing.Optional[str] = None
-    """验证消息"""
-```
-
-#### FriendAddedEvent (`friend.added`)
-
-成功添加好友。
-
-```python
-class FriendAddedEvent(Event):
-    """成功添加好友"""
-
-    type: str = "friend.added"
-
-    user: User
-    """新好友"""
-```
-
-#### FriendRemovedEvent (`friend.removed`)
-
-好友被移除。
-
-```python
-class FriendRemovedEvent(Event):
-    """好友被移除"""
-
-    type: str = "friend.removed"
-
-    user: User
-    """被移除的好友"""
-```
-
-### 3.6 Bot 状态事件
-
-#### BotInvitedToGroupEvent (`bot.invited_to_group`)
-
-Bot 被邀请加入群组。
-
-```python
-class BotInvitedToGroupEvent(Event):
-    """Bot 被邀请加入群组"""
-
-    type: str = "bot.invited_to_group"
-
-    group: Group
-    inviter: typing.Optional[User] = None
-
-    request_id: typing.Optional[typing.Union[int, str]] = None
-    """邀请请求 ID，某些平台需要 Bot 确认才加入"""
-```
-
-#### BotRemovedFromGroupEvent (`bot.removed_from_group`)
-
-Bot 被移出群组。
-
-```python
-class BotRemovedFromGroupEvent(Event):
-    """Bot 被移出群组"""
-
-    type: str = "bot.removed_from_group"
-
-    group: Group
-    operator: typing.Optional[User] = None
-```
-
-#### BotMutedEvent / BotUnmutedEvent (`bot.muted` / `bot.unmuted`)
-
-Bot 被禁言/解除禁言。
-
-```python
-class BotMutedEvent(Event):
-    """Bot 被禁言"""
-
-    type: str = "bot.muted"
-
-    group: Group
-    operator: typing.Optional[User] = None
-    duration: typing.Optional[int] = None
-
-
-class BotUnmutedEvent(Event):
-    """Bot 被解除禁言"""
-
-    type: str = "bot.unmuted"
-
-    group: Group
-    operator: typing.Optional[User] = None
-```
-
-### 3.7 平台特有事件
-
-对于无法抽象为通用事件的平台特有事件，使用统一的 `PlatformSpecificEvent` 承载：
-
-```python
-class PlatformSpecificEvent(Event):
-    """平台特有事件
-
-    适配器无法映射到通用事件类型时，使用此类型承载。
-    插件可以通过 adapter_name + action 来识别和处理。
-    """
-
-    type: str = "platform.specific"
-
-    action: str
-    """平台特有的事件动作标识，如 'channel_created', 'pin_message'"""
-
-    data: dict = {}
-    """事件数据，结构由具体适配器定义"""
-```
-
-事件类型字符串格式为 `platform.{adapter_name}.{action}`，例如：
-- `platform.telegram.chat_member_updated` — Telegram 的群成员信息更新
-- `platform.discord.channel_created` — Discord 的频道创建
-- `platform.discord.voice_state_update` — Discord 的语音状态变更
-- `platform.slack.app_home_opened` — Slack 的 App Home 打开
-
-## 4. 各平台事件支持矩阵
-
-下表标注各通用事件在主要平台上的支持情况：
-
-| 事件 | Telegram | Discord | OneBot(QQ) | 飞书 | 钉钉 | Slack | 微信 | LINE | KOOK |
-|------|----------|---------|-----------|------|------|-------|------|------|------|
-| `message.received` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-| `message.edited` | Y | Y | N | Y | N | Y | N | N | Y |
-| `message.deleted` | Y | Y | Y | Y | N | Y | Y | N | Y |
-| `message.reaction` | Y | Y | Y | Y | Y | Y | N | N | Y |
-| `feedback.received` | N | N | N | Y | N | N | Y | N | N |
-| `group.member_joined` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-| `group.member_left` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-| `group.member_banned` | Y | Y | Y | N | N | N | N | N | N |
-| `group.info_updated` | Y | Y | Y | Y | Y | Y | N | N | Y |
-| `friend.request_received` | N | Y | Y | N | N | N | Y | Y | Y |
-| `friend.added` | N | Y | Y | N | N | N | Y | Y | N |
-| `bot.invited_to_group` | Y | Y | Y | Y | Y | Y | Y | N | Y |
-| `bot.removed_from_group` | Y | Y | Y | Y | N | N | Y | N | Y |
-| `bot.muted` | Y | N | Y | N | N | N | N | N | N |
-| `bot.unmuted` | Y | N | Y | N | N | N | N | N | N |
-| `platform.specific` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-
-> 注：此表为初步评估，具体以各平台 SDK/API 文档为准，实施时逐个确认。
-
-## 5. 事件生命周期
-
-```
-1. 平台 SDK 回调触发
-      │
-2. 适配器 EventConverter.target2yiri(raw_event)
-      │  将平台原生事件转换为统一 Event 对象
-      │  无法映射的事件 → PlatformSpecificEvent
-      │
-3. 适配器回调注册的 listener(event, adapter)
-      │
-4. RuntimeBot 接收事件
-      │
-5. EventBus 分发
-      │
-6. EventRouter 查询 Bot 的 event_handlers 配置
-      │  匹配事件类型 → 找到对应的 Handler
-      │  支持通配符：'message.*' 匹配所有消息事件
-      │  未匹配到 → 走默认 Handler（plugin，保持向后兼容）
-      │
-7. Handler 处理事件
-      │  PipelineHandler → 进入 Pipeline 流水线
-      │  AgentHandler    → 调用 RequestRunner
-      │  WebhookHandler  → POST 到外部 URL
-      │  PluginHandler   → 分发给插件 EventListener
-      │
-8. Handler 执行完毕，可能通过 API 执行响应动作
-      （发消息、编辑消息、踢人、同意好友请求等）
-```
-
-## 6. 与现有事件类型的兼容映射
-
-为保证现有插件不受影响，建立以下映射关系：
-
-| 新事件 | 条件 | 旧事件 |
-|--------|------|--------|
-| `MessageReceivedEvent` (chat_type=private) | — | `FriendMessage` |
-| `MessageReceivedEvent` (chat_type=group) | — | `GroupMessage` |
-
-在插件 SDK 层面：
-
-| 新事件 | 旧插件事件 |
-|--------|-----------|
-| `MessageReceivedEvent` (chat_type=private, 非命令) | `PersonNormalMessageReceived` |
-| `MessageReceivedEvent` (chat_type=group, 非命令) | `GroupNormalMessageReceived` |
-| `MessageReceivedEvent` (chat_type=private, 命令) | `PersonCommandSent` |
-| `MessageReceivedEvent` (chat_type=group, 命令) | `GroupCommandSent` |
-| `MessageReceivedEvent` (处理完毕后) | `NormalMessageResponded` |
-
-兼容层在事件分发给插件 EventListener 时自动生成旧格式事件，确保监听旧事件类型的插件仍能正常工作。
-
-## 7. 事件类型注册表
-
-适配器在 manifest.yaml 中声明自己支持的事件类型：
-
-```yaml
-kind: MessagePlatformAdapter
-metadata:
-  name: telegram
-spec:
-  supported_events:
-    - message.received
-    - message.edited
-    - message.deleted
-    - message.reaction
-    - feedback.received
-    - group.member_joined
-    - group.member_left
-    - group.member_banned
-    - group.info_updated
-    - bot.invited_to_group
-    - bot.removed_from_group
-    - bot.muted
-    - bot.unmuted
-    - platform.specific
-  platform_specific_events:
-    - chat_member_updated
-    - chat_join_request
-```
-
-这份声明用于：
-1. WebUI 在配置事件处理器时，只显示当前 Bot 的适配器支持的事件类型
-2. EventRouter 在路由时校验事件类型有效性
-3. 文档自动生成

docs/event-based-agents/02-platform-api.md

@@ -1,546 +0,0 @@
-# 统一平台 API 与实体定义
-
-## 1. 设计原则
-
-- **通用 API 抽象**：大部分平台都支持的操作（发消息、获取群信息等）定义为通用 API 方法
-- **required / optional 标记**：每个 API 标记为必需或可选，适配器未实现可选 API 时抛出 `NotSupportedError`
-- **透传机制**：适配器特有的操作通过 `call_platform_api(action, params)` 统一入口透传调用
-- **能力声明**：适配器在 manifest 中声明自己支持的 API 列表，供 WebUI 和插件查询
-- **实体统一**：通用实体（User、Group 等）在 SDK 层面统一定义，适配器负责转换
-
-## 2. 通用实体定义
-
-### 2.1 现有实体回顾
-
-当前 SDK 已有以下实体（`langbot_plugin/api/entities/builtin/platform/entities.py`）：
-
-```python
-Entity(id)
-├── Friend(id, nickname, remark)
-├── Group(id, name, permission)
-└── GroupMember(id, member_name, permission, group, special_title)
-```
-
-### 2.2 新实体设计
-
-扩展实体体系，保持向后兼容：
-
-```python
-class User(pydantic.BaseModel):
-    """用户实体（统一表示）"""
-
-    id: typing.Union[int, str]
-    """用户 ID"""
-
-    nickname: str = ""
-    """昵称"""
-
-    avatar_url: typing.Optional[str] = None
-    """头像 URL"""
-
-    is_bot: bool = False
-    """是否为 Bot"""
-
-    # 以下为可选的扩展信息，不同平台可能部分为空
-    username: typing.Optional[str] = None
-    """用户名（如 Telegram 的 @username）"""
-
-    remark: typing.Optional[str] = None
-    """备注名"""
-
-
-class Group(pydantic.BaseModel):
-    """群组实体"""
-
-    id: typing.Union[int, str]
-    """群组 ID"""
-
-    name: str = ""
-    """群组名称"""
-
-    description: typing.Optional[str] = None
-    """群组描述"""
-
-    member_count: typing.Optional[int] = None
-    """成员数量"""
-
-    avatar_url: typing.Optional[str] = None
-    """群组头像 URL"""
-
-    owner_id: typing.Optional[typing.Union[int, str]] = None
-    """群主 ID"""
-
-
-class GroupMember(pydantic.BaseModel):
-    """群成员实体"""
-
-    user: User
-    """用户信息"""
-
-    group_id: typing.Union[int, str]
-    """所属群组 ID"""
-
-    role: MemberRole
-    """群内角色"""
-
-    display_name: typing.Optional[str] = None
-    """群内显示名"""
-
-    joined_at: typing.Optional[float] = None
-    """加入群组的时间戳"""
-
-    title: typing.Optional[str] = None
-    """群头衔/特殊称号"""
-
-
-class MemberRole(str, Enum):
-    """群成员角色"""
-    OWNER = "owner"
-    ADMIN = "admin"
-    MEMBER = "member"
-```
-
-### 2.3 与现有实体的兼容映射
-
-| 新实体 | 旧实体 | 映射方式 |
-|--------|--------|----------|
-| `User` | `Friend` | `User(id=friend.id, nickname=friend.nickname, remark=friend.remark)` |
-| `Group` | `Group`（旧） | `Group(id=old.id, name=old.name)` + `permission` 字段弃用 |
-| `GroupMember` | `GroupMember`（旧） | `GroupMember(user=User(...), role=..., display_name=old.member_name)` |
-| `MemberRole` | `Permission` | `OWNER↔Owner`, `ADMIN↔Administrator`, `MEMBER↔Member` |
-
-旧实体类保留，标记为 `@deprecated`，内部通过转换方法桥接到新实体。
-
-## 3. 通用 API 定义
-
-### 3.1 API 方法一览
-
-#### 消息 API
-
-| 方法 | 必需/可选 | 说明 |
-|------|----------|------|
-| `send_message(target_type, target_id, message)` | **必需** | 主动发送消息 |
-| `reply_message(event, message, quote_origin)` | **必需** | 回复一个消息事件 |
-| `edit_message(chat_type, chat_id, message_id, new_content)` | 可选 | 编辑已发送的消息 |
-| `delete_message(chat_type, chat_id, message_id)` | 可选 | 删除/撤回消息 |
-| `forward_message(from_chat, message_id, to_chat_type, to_chat_id)` | 可选 | 转发消息到另一个会话 |
-| `get_message(chat_type, chat_id, message_id)` | 可选 | 获取指定消息的内容 |
-
-#### 群组 API
-
-| 方法 | 必需/可选 | 说明 |
-|------|----------|------|
-| `get_group_info(group_id)` | 可选 | 获取群组信息 |
-| `get_group_list()` | 可选 | 获取 Bot 加入的群组列表 |
-| `get_group_member_list(group_id)` | 可选 | 获取群成员列表 |
-| `get_group_member_info(group_id, user_id)` | 可选 | 获取指定群成员信息 |
-| `set_group_name(group_id, name)` | 可选 | 修改群名称 |
-| `mute_member(group_id, user_id, duration)` | 可选 | 禁言群成员 |
-| `unmute_member(group_id, user_id)` | 可选 | 解除禁言 |
-| `kick_member(group_id, user_id)` | 可选 | 踢出群成员 |
-| `leave_group(group_id)` | 可选 | Bot 退出群组 |
-
-#### 用户 API
-
-| 方法 | 必需/可选 | 说明 |
-|------|----------|------|
-| `get_user_info(user_id)` | 可选 | 获取用户信息 |
-| `get_friend_list()` | 可选 | 获取好友列表 |
-| `approve_friend_request(request_id, approve, remark)` | 可选 | 处理好友请求 |
-| `approve_group_invite(request_id, approve)` | 可选 | 处理入群邀请 |
-
-#### 媒体 API
-
-| 方法 | 必需/可选 | 说明 |
-|------|----------|------|
-| `upload_file(file_data, filename)` | 可选 | 上传文件，返回可引用的文件 ID 或 URL |
-| `get_file_url(file_id)` | 可选 | 获取文件下载 URL |
-
-#### 透传 API
-
-| 方法 | 必需/可选 | 说明 |
-|------|----------|------|
-| `call_platform_api(action, params)` | 可选 | 调用适配器特有 API |
-
-### 3.2 API 方法签名详解
-
-```python
-class AbstractPlatformAdapter(pydantic.BaseModel, metaclass=abc.ABCMeta):
-    """平台适配器基类（新版）"""
-
-    # ======== 必需方法 ========
-
-    @abc.abstractmethod
-    async def send_message(
-        self,
-        target_type: str,          # "private" | "group"
-        target_id: typing.Union[int, str],
-        message: MessageChain,
-    ) -> MessageResult:
-        """主动发送消息
-
-        Returns:
-            MessageResult: 包含 message_id 等发送结果
-        """
-        ...
-
-    @abc.abstractmethod
-    async def reply_message(
-        self,
-        event: MessageReceivedEvent,
-        message: MessageChain,
-        quote_origin: bool = False,
-    ) -> MessageResult:
-        """回复一个消息事件"""
-        ...
-
-    # ======== 可选消息方法 ========
-
-    async def edit_message(
-        self,
-        chat_type: str,
-        chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-        new_content: MessageChain,
-    ) -> None:
-        """编辑已发送的消息"""
-        raise NotSupportedError("edit_message")
-
-    async def delete_message(
-        self,
-        chat_type: str,
-        chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-    ) -> None:
-        """删除/撤回消息"""
-        raise NotSupportedError("delete_message")
-
-    async def forward_message(
-        self,
-        from_chat_type: str,
-        from_chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-        to_chat_type: str,
-        to_chat_id: typing.Union[int, str],
-    ) -> MessageResult:
-        """转发消息"""
-        raise NotSupportedError("forward_message")
-
-    async def get_message(
-        self,
-        chat_type: str,
-        chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-    ) -> MessageReceivedEvent:
-        """获取指定消息"""
-        raise NotSupportedError("get_message")
-
-    # ======== 可选群组方法 ========
-
-    async def get_group_info(
-        self,
-        group_id: typing.Union[int, str],
-    ) -> Group:
-        """获取群组信息"""
-        raise NotSupportedError("get_group_info")
-
-    async def get_group_list(self) -> list[Group]:
-        """获取 Bot 加入的群组列表"""
-        raise NotSupportedError("get_group_list")
-
-    async def get_group_member_list(
-        self,
-        group_id: typing.Union[int, str],
-    ) -> list[GroupMember]:
-        """获取群成员列表"""
-        raise NotSupportedError("get_group_member_list")
-
-    async def get_group_member_info(
-        self,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-    ) -> GroupMember:
-        """获取指定群成员信息"""
-        raise NotSupportedError("get_group_member_info")
-
-    async def set_group_name(
-        self,
-        group_id: typing.Union[int, str],
-        name: str,
-    ) -> None:
-        """修改群名称"""
-        raise NotSupportedError("set_group_name")
-
-    async def mute_member(
-        self,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-        duration: int = 0,
-    ) -> None:
-        """禁言群成员，duration 为秒数，0 表示永久"""
-        raise NotSupportedError("mute_member")
-
-    async def unmute_member(
-        self,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-    ) -> None:
-        """解除禁言"""
-        raise NotSupportedError("unmute_member")
-
-    async def kick_member(
-        self,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-    ) -> None:
-        """踢出群成员"""
-        raise NotSupportedError("kick_member")
-
-    async def leave_group(
-        self,
-        group_id: typing.Union[int, str],
-    ) -> None:
-        """Bot 退出群组"""
-        raise NotSupportedError("leave_group")
-
-    # ======== 可选用户方法 ========
-
-    async def get_user_info(
-        self,
-        user_id: typing.Union[int, str],
-    ) -> User:
-        """获取用户信息"""
-        raise NotSupportedError("get_user_info")
-
-    async def get_friend_list(self) -> list[User]:
-        """获取好友列表"""
-        raise NotSupportedError("get_friend_list")
-
-    async def approve_friend_request(
-        self,
-        request_id: typing.Union[int, str],
-        approve: bool = True,
-        remark: typing.Optional[str] = None,
-    ) -> None:
-        """处理好友请求"""
-        raise NotSupportedError("approve_friend_request")
-
-    async def approve_group_invite(
-        self,
-        request_id: typing.Union[int, str],
-        approve: bool = True,
-    ) -> None:
-        """处理入群邀请"""
-        raise NotSupportedError("approve_group_invite")
-
-    # ======== 可选媒体方法 ========
-
-    async def upload_file(
-        self,
-        file_data: bytes,
-        filename: str,
-    ) -> str:
-        """上传文件，返回文件 ID 或 URL"""
-        raise NotSupportedError("upload_file")
-
-    async def get_file_url(
-        self,
-        file_id: str,
-    ) -> str:
-        """获取文件下载 URL"""
-        raise NotSupportedError("get_file_url")
-
-    # ======== 透传 API ========
-
-    async def call_platform_api(
-        self,
-        action: str,
-        params: dict = {},
-    ) -> dict:
-        """调用适配器特有 API
-
-        Args:
-            action: 平台特有的 API 动作标识
-            params: 参数字典
-
-        Returns:
-            dict: 返回结果
-
-        Examples:
-            # Telegram: pin 消息
-            await adapter.call_platform_api("pin_message", {
-                "chat_id": 123456,
-                "message_id": 789
-            })
-
-            # Discord: 创建频道
-            await adapter.call_platform_api("create_channel", {
-                "guild_id": "...",
-                "name": "new-channel",
-                "type": "text"
-            })
-        """
-        raise NotSupportedError("call_platform_api")
-
-    # ======== 流式输出（保留现有机制） ========
-
-    async def reply_message_chunk(
-        self,
-        event: MessageReceivedEvent,
-        bot_message: dict,
-        message: MessageChain,
-        quote_origin: bool = False,
-        is_final: bool = False,
-    ):
-        """流式回复消息"""
-        raise NotSupportedError("reply_message_chunk")
-
-    async def is_stream_output_supported(self) -> bool:
-        """是否支持流式输出"""
-        return False
-
-    # ======== 生命周期方法（保留现有） ========
-
-    @abc.abstractmethod
-    async def run_async(self):
-        """启动适配器"""
-        ...
-
-    @abc.abstractmethod
-    async def kill(self) -> bool:
-        """停止适配器"""
-        ...
-
-    @abc.abstractmethod
-    def register_listener(self, event_type, callback):
-        """注册事件监听器"""
-        ...
-
-    @abc.abstractmethod
-    def unregister_listener(self, event_type, callback):
-        """注销事件监听器"""
-        ...
-```
-
-### 3.3 返回值类型
-
-```python
-class MessageResult(pydantic.BaseModel):
-    """消息发送结果"""
-
-    message_id: typing.Optional[typing.Union[int, str]] = None
-    """发送成功后的消息 ID"""
-
-    raw: typing.Optional[dict] = None
-    """平台原始返回数据"""
-
-
-class NotSupportedError(Exception):
-    """适配器未实现此 API"""
-
-    def __init__(self, api_name: str):
-        self.api_name = api_name
-        super().__init__(f"API not supported by this adapter: {api_name}")
-```
-
-## 4. API 能力声明
-
-适配器在 manifest.yaml 中声明支持的 API：
-
-```yaml
-kind: MessagePlatformAdapter
-metadata:
-  name: telegram
-spec:
-  supported_apis:
-    required:
-      - send_message
-      - reply_message
-    optional:
-      - edit_message
-      - delete_message
-      - get_group_info
-      - get_group_member_list
-      - get_user_info
-      - upload_file
-      - get_file_url
-      - call_platform_api
-  platform_specific_apis:
-    - action: pin_message
-      description: "Pin a message in a chat"
-      params_schema:
-        chat_id: { type: "string", required: true }
-        message_id: { type: "string", required: true }
-    - action: unpin_message
-      description: "Unpin a message"
-      params_schema:
-        chat_id: { type: "string", required: true }
-        message_id: { type: "string", required: true }
-```
-
-用途：
-1. **WebUI**：在配置界面展示当前 Bot 可用的 API 能力
-2. **插件**：插件可查询某个 Bot 是否支持特定 API，据此决定行为
-3. **文档**：自动生成各适配器的 API 支持矩阵
-
-## 5. 各平台 API 支持矩阵
-
-| API | Telegram | Discord | OneBot(QQ) | 飞书 | 钉钉 | Slack | 微信 | LINE | KOOK |
-|-----|----------|---------|-----------|------|------|-------|------|------|------|
-| `send_message` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-| `reply_message` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-| `edit_message` | Y | Y | N | Y | N | Y | N | N | Y |
-| `delete_message` | Y | Y | Y | Y | N | Y | Y | N | Y |
-| `forward_message` | Y | N | Y | Y | N | N | Y | N | N |
-| `get_group_info` | Y | Y | Y | Y | Y | Y | N | Y | Y |
-| `get_group_member_list` | Y | Y | Y | Y | Y | Y | N | Y | Y |
-| `get_user_info` | Y | Y | Y | Y | Y | Y | N | Y | Y |
-| `get_friend_list` | N | Y | Y | N | N | N | Y | N | N |
-| `mute_member` | Y | Y | Y | N | N | N | N | N | N |
-| `kick_member` | Y | Y | Y | N | N | N | N | N | Y |
-| `upload_file` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-| `call_platform_api` | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-
-> 注：此表为初步评估，具体以各平台 SDK/API 文档为准。
-
-## 6. MessageChain 扩展
-
-### 6.1 保留的通用组件
-
-以下 MessageComponent 类型保持不变，继续作为通用消息元素：
-
-- `Source` — 消息元信息
-- `Plain` — 纯文本
-- `Quote` — 引用回复
-- `At` / `AtAll` — @提及
-- `Image` — 图片
-- `Voice` — 语音
-- `File` — 文件
-- `Forward` — 合并转发
-- `Face` — 表情
-- `Unknown` — 未知类型
-
-### 6.2 平台特有组件处理
-
-当前 MessageChain 中存在大量微信特有的组件类型（`WeChatMiniPrograms`, `WeChatEmoji`, `WeChatLink` 等）。在新架构下：
-
-- 这些类型**继续保留**在 SDK 中以保持兼容
-- 新增的平台特有消息组件统一使用 `PlatformComponent` 基类：
-
-```python
-class PlatformComponent(MessageComponent):
-    """平台特有的消息组件"""
-
-    type: str = "Platform"
-
-    platform: str
-    """平台标识"""
-
-    component_type: str
-    """组件类型"""
-
-    data: dict = {}
-    """组件数据"""
-```
-
-适配器在转换消息链时，对于无法映射到通用组件的平台特有内容，使用 `PlatformComponent` 承载。

docs/event-based-agents/03-adapter-structure.md

@@ -1,483 +0,0 @@
-# 适配器新目录结构
-
-## 1. 设计目标
-
-- **模块化**：每个适配器从单文件拆分到独立目录，各模块职责清晰
-- **可维护**：随着事件和 API 的增加，代码量会显著增长，目录结构有助于管理复杂度
-- **一致性**：所有适配器遵循相同的目录布局和文件命名约定
-- **兼容现有发现机制**：保持 YAML manifest + ComponentDiscoveryEngine 的注册体系
-
-## 2. 新目录布局
-
-### 2.1 整体结构
-
-```
-pkg/platform/
-├── __init__.py
-├── botmgr.py                  # PlatformManager + RuntimeBot（重构）
-├── event_bus.py               # EventBus（新增）
-├── event_router.py            # EventRouter（新增）
-├── logger.py                  # EventLogger（保留）
-├── webhook_pusher.py          # WebhookPusher（重构为 WebhookHandler）
-│
-├── adapters/                  # 适配器（新目录）
-│   ├── __init__.py
-│   │
-│   ├── telegram/
-│   │   ├── __init__.py
-│   │   ├── adapter.py         # TelegramAdapter 主类
-│   │   ├── event_converter.py # 平台事件 → 统一事件
-│   │   ├── message_converter.py # MessageChain 互转
-│   │   ├── api_impl.py        # 通用 API 实现
-│   │   ├── platform_api.py    # call_platform_api 的动作映射
-│   │   ├── types.py           # 平台特有类型定义
-│   │   └── manifest.yaml      # 适配器清单
-│   │
-│   ├── discord/
-│   │   ├── __init__.py
-│   │   ├── adapter.py
-│   │   ├── event_converter.py
-│   │   ├── message_converter.py
-│   │   ├── api_impl.py
-│   │   ├── platform_api.py
-│   │   ├── types.py
-│   │   ├── voice.py           # Discord 语音连接管理（特有）
-│   │   └── manifest.yaml
-│   │
-│   ├── aiocqhttp/             # OneBot v11 (QQ)
-│   │   └── ...
-│   ├── qqofficial/
-│   │   └── ...
-│   ├── lark/                  # 飞书
-│   │   └── ...
-│   ├── dingtalk/
-│   │   └── ...
-│   ├── slack/
-│   │   └── ...
-│   ├── wechatpad/
-│   │   └── ...
-│   ├── officialaccount/       # 微信公众号
-│   │   └── ...
-│   ├── wecom/                 # 企业微信
-│   │   └── ...
-│   ├── wecombot/
-│   │   └── ...
-│   ├── wecomcs/
-│   │   └── ...
-│   ├── kook/
-│   │   └── ...
-│   ├── line/
-│   │   └── ...
-│   ├── satori/
-│   │   └── ...
-│   ├── websocket/             # 内置 WebSocket 适配器
-│   │   ├── __init__.py
-│   │   ├── adapter.py
-│   │   ├── manager.py         # WebSocket 连接管理
-│   │   └── manifest.yaml
-│   │
-│   └── legacy/                # 旧版适配器（保留一段时间后移除）
-│       ├── gewechat/
-│       ├── nakuru/
-│       └── qqbotpy/
-│
-└── handlers/                  # 事件处理器实现（新增）
-    ├── __init__.py
-    ├── base.py                # AbstractEventHandler 基类
-    ├── pipeline_handler.py    # PipelineHandler
-    ├── agent_handler.py       # AgentHandler
-    ├── webhook_handler.py     # WebhookHandler
-    └── plugin_handler.py      # PluginHandler
-```
-
-### 2.2 适配器目录内各文件职责
-
-以 Telegram 为例：
-
-| 文件 | 职责 | 关键类/函数 |
-|------|------|------------|
-| `adapter.py` | 主入口，继承 `AbstractPlatformAdapter`，组装其他模块 | `TelegramAdapter` |
-| `event_converter.py` | 将 Telegram 原生事件转换为统一事件类型 | `TelegramEventConverter` — 支持 Message/Edit/Delete/Reaction/MemberJoin 等所有事件 |
-| `message_converter.py` | `MessageChain` 与 Telegram 消息格式互转 | `TelegramMessageConverter.yiri2target()` / `target2yiri()` |
-| `api_impl.py` | 实现通用 API 方法（edit_message, delete_message, get_group_info 等） | 各 API 方法的 Telegram 实现 |
-| `platform_api.py` | 实现 `call_platform_api` 的动作分发表 | `PLATFORM_API_MAP = {"pin_message": ..., "unpin_message": ...}` |
-| `types.py` | 平台特有的类型定义 | Telegram 特有的枚举、配置结构等 |
-| `manifest.yaml` | 适配器清单：名称、配置 schema、支持的事件和 API 列表 | — |
-
-## 3. 新基类设计
-
-### 3.1 AbstractPlatformAdapter
-
-新基类继承自现有 `AbstractMessagePlatformAdapter` 并扩展，位于 `langbot-plugin-sdk` 中：
-
-```python
-# langbot_plugin/api/definition/abstract/platform/adapter.py
-
-class AbstractPlatformAdapter(pydantic.BaseModel, metaclass=abc.ABCMeta):
-    """平台适配器基类（EBA 版本）
-
-    相比旧版 AbstractMessagePlatformAdapter：
-    - 新增通用 API 方法（edit_message, delete_message, get_group_info 等）
-    - 新增透传 API（call_platform_api）
-    - 新增能力声明（get_supported_events, get_supported_apis）
-    - 事件监听器支持所有事件类型，不仅限于消息事件
-    """
-
-    bot_account_id: str = ""
-    config: dict
-    logger: AbstractEventLogger = pydantic.Field(exclude=True)
-
-    class Config:
-        arbitrary_types_allowed = True
-
-    # ---- 能力声明 ----
-
-    def get_supported_events(self) -> list[str]:
-        """返回此适配器支持的事件类型列表
-
-        默认实现从 manifest.yaml 读取。
-        适配器也可以 override 此方法动态声明。
-        """
-        return ["message.received"]
-
-    def get_supported_apis(self) -> list[str]:
-        """返回此适配器支持的 API 列表
-
-        默认实现从 manifest.yaml 读取。
-        """
-        return ["send_message", "reply_message"]
-
-    # ---- 必需方法（抽象） ----
-
-    @abc.abstractmethod
-    async def send_message(self, target_type, target_id, message) -> MessageResult:
-        ...
-
-    @abc.abstractmethod
-    async def reply_message(self, event, message, quote_origin=False) -> MessageResult:
-        ...
-
-    @abc.abstractmethod
-    async def run_async(self):
-        ...
-
-    @abc.abstractmethod
-    async def kill(self) -> bool:
-        ...
-
-    @abc.abstractmethod
-    def register_listener(self, event_type, callback):
-        ...
-
-    @abc.abstractmethod
-    def unregister_listener(self, event_type, callback):
-        ...
-
-    # ---- 可选方法（默认抛 NotSupportedError） ----
-    # edit_message, delete_message, forward_message,
-    # get_group_info, get_group_member_list, ...
-    # call_platform_api, ...
-    # （完整签名见 02-platform-api.md）
-
-    # ---- 流式输出（保留） ----
-
-    async def reply_message_chunk(self, event, bot_message, message,
-                                   quote_origin=False, is_final=False):
-        raise NotSupportedError("reply_message_chunk")
-
-    async def is_stream_output_supported(self) -> bool:
-        return False
-
-    # ---- 消息卡片（保留） ----
-
-    async def create_message_card(self, message_id, event) -> bool:
-        return False
-
-    async def is_muted(self, group_id) -> bool:
-        return False
-```
-
-### 3.2 AbstractMessagePlatformAdapter 兼容
-
-旧的 `AbstractMessagePlatformAdapter` 保留为 `AbstractPlatformAdapter` 的类型别名：
-
-```python
-# 向后兼容
-AbstractMessagePlatformAdapter = AbstractPlatformAdapter
-```
-
-现有适配器代码中的 `AbstractMessagePlatformAdapter` 引用不需要立即修改。
-
-### 3.3 EventConverter 新设计
-
-现有 `AbstractEventConverter` 只有 `target2yiri` 和 `yiri2target` 两个静态方法，且只处理消息事件。
-
-新设计支持多种事件类型：
-
-```python
-class AbstractEventConverter:
-    """事件转换器基类（EBA 版本）
-
-    适配器需要实现此转换器，将平台原生事件转换为统一事件。
-    """
-
-    @staticmethod
-    def target2yiri(raw_event: typing.Any) -> typing.Optional[Event]:
-        """将平台原生事件转换为统一事件
-
-        Args:
-            raw_event: 平台 SDK 回调传入的原始事件对象
-
-        Returns:
-            统一 Event 对象，如果无法转换或不需要处理则返回 None
-        """
-        raise NotImplementedError
-
-    @staticmethod
-    def yiri2target(event: Event) -> typing.Any:
-        """将统一事件转换为平台原生事件（一般不需要）"""
-        raise NotImplementedError
-```
-
-具体适配器的 EventConverter 实现会是一个分发式的结构：
-
-```python
-class TelegramEventConverter(AbstractEventConverter):
-    """Telegram 事件转换器"""
-
-    @staticmethod
-    def target2yiri(update: telegram.Update) -> typing.Optional[Event]:
-        # 消息事件
-        if update.message:
-            return TelegramEventConverter._convert_message(update)
-        # 消息编辑
-        if update.edited_message:
-            return TelegramEventConverter._convert_edited_message(update)
-        # 成员变动
-        if update.chat_member:
-            return TelegramEventConverter._convert_chat_member(update)
-        # 回调查询（按钮点击等）
-        if update.callback_query:
-            return TelegramEventConverter._convert_callback_query(update)
-        # 其他 → PlatformSpecificEvent
-        return TelegramEventConverter._convert_platform_specific(update)
-
-    @staticmethod
-    def _convert_message(update) -> MessageReceivedEvent:
-        ...
-
-    @staticmethod
-    def _convert_edited_message(update) -> MessageEditedEvent:
-        ...
-
-    @staticmethod
-    def _convert_chat_member(update) -> typing.Union[
-        MemberJoinedEvent, MemberLeftEvent, ...
-    ]:
-        ...
-
-    @staticmethod
-    def _convert_platform_specific(update) -> PlatformSpecificEvent:
-        ...
-```
-
-## 4. Manifest 文件格式扩展
-
-现有 manifest.yaml 只声明 `kind`, `metadata`, `spec.config`, `execution`。
-
-新增 `spec.supported_events` 和 `spec.supported_apis`：
-
-```yaml
-apiVersion: v1
-kind: MessagePlatformAdapter
-
-metadata:
-  name: telegram
-  label:
-    en_US: Telegram
-    zh_Hans: Telegram
-  icon: telegram.svg
-  description:
-    en_US: Telegram Bot adapter
-    zh_Hans: Telegram Bot 适配器
-
-spec:
-  config:
-    # 现有配置 schema（保持不变）
-    - key: token
-      label: { en_US: "Bot Token", zh_Hans: "Bot Token" }
-      type: string
-      required: true
-      sensitive: true
-    # ...
-
-  supported_events:
-    - message.received
-    - message.edited
-    - message.deleted
-    - message.reaction
-    - feedback.received
-    - group.member_joined
-    - group.member_left
-    - group.member_banned
-    - group.info_updated
-    - bot.invited_to_group
-    - bot.removed_from_group
-    - bot.muted
-    - bot.unmuted
-    - platform.specific
-
-  supported_apis:
-    required:
-      - send_message
-      - reply_message
-    optional:
-      - edit_message
-      - delete_message
-      - get_group_info
-      - get_group_member_list
-      - get_group_member_info
-      - get_user_info
-      - upload_file
-      - get_file_url
-      - call_platform_api
-
-  platform_specific_apis:
-    - action: pin_message
-      description: { en_US: "Pin a message", zh_Hans: "置顶消息" }
-    - action: unpin_message
-      description: { en_US: "Unpin a message", zh_Hans: "取消置顶" }
-    - action: get_chat_administrators
-      description: { en_US: "Get chat admins", zh_Hans: "获取群管理员列表" }
-
-execution:
-  python:
-    path: pkg/platform/adapters/telegram/adapter.py
-    attr: TelegramAdapter
-```
-
-## 5. 适配器注册与发现
-
-### 5.1 Blueprint 更新
-
-`templates/components.yaml` 中更新扫描路径：
-
-```yaml
-kind: Blueprint
-spec:
-  components:
-    MessagePlatformAdapter:
-      fromDirs:
-        - path: pkg/platform/adapters/     # 新路径
-```
-
-`ComponentDiscoveryEngine` 的递归扫描逻辑不变——它会扫描所有子目录中的 `.yaml` 文件。因此每个适配器目录下的 `manifest.yaml` 会被自动发现。
-
-### 5.2 PlatformManager 适配
-
-`PlatformManager.initialize()` 的核心逻辑基本不变：
-
-```python
-async def initialize(self):
-    # 1. 发现适配器组件（自动扫描新目录结构）
-    self.adapter_components = self.ap.discover.get_components_by_kind('MessagePlatformAdapter')
-
-    # 2. 动态导入适配器类
-    for component in self.adapter_components:
-        self.adapter_dict[component.metadata.name] = component.get_python_component_class()
-
-    # 3. 从数据库加载 Bot 并实例化适配器（不变）
-    await self.load_bots_from_db()
-```
-
-变更点：
-- `execution.python.path` 从 `pkg/platform/sources/telegram.py` 变为 `pkg/platform/adapters/telegram/adapter.py`
-- `get_python_component_class()` 正常工作，因为它按路径动态导入
-
-## 6. RuntimeBot 重构
-
-### 6.1 现有问题
-
-当前 `RuntimeBot.initialize()` 硬编码注册了两个回调：
-
-```python
-# 现有代码
-self.adapter.register_listener(platform_events.FriendMessage, on_friend_message)
-self.adapter.register_listener(platform_events.GroupMessage, on_group_message)
-```
-
-### 6.2 新设计
-
-`RuntimeBot` 改为注册一个通用的事件回调：
-
-```python
-class RuntimeBot:
-    async def initialize(self):
-        # 注册通用事件回调，接收所有事件类型
-        self.adapter.register_listener(Event, self._on_event)
-
-    async def _on_event(
-        self,
-        event: Event,
-        adapter: AbstractPlatformAdapter,
-    ):
-        """统一事件入口"""
-
-        # 1. 设置事件的 bot_uuid 和 adapter_name
-        event.bot_uuid = self.bot_entity.uuid
-        event.adapter_name = self.bot_entity.adapter
-
-        # 2. 日志记录
-        await self._log_event(event)
-
-        # 3. 提交给 EventBus
-        await self.ap.event_bus.emit(event, adapter)
-```
-
-适配器侧的 `register_listener` 实现也需调整：
-- 当 `event_type` 为 `Event`（基类）时，注册为"接收所有事件"的通配回调
-- 适配器在收到平台原生事件时，通过 `EventConverter.target2yiri()` 转换后，调用所有匹配的回调
-
-## 7. 从现有单文件适配器迁移
-
-### 7.1 迁移模式
-
-以 Telegram 为例，从 `sources/telegram.py`（445 行）拆分：
-
-| 原代码位置 | → 新文件 |
-|-----------|----------|
-| `TelegramMessageConverter` 类 | `telegram/message_converter.py` |
-| `TelegramEventConverter` 类 | `telegram/event_converter.py`（扩展，支持更多事件） |
-| `TelegramAdapter.__init__` / `run_async` / `kill` / `register_listener` | `telegram/adapter.py` |
-| `TelegramAdapter.send_message` / `reply_message` / `reply_message_chunk` | `telegram/adapter.py`（消息方法保留在主类）+ `telegram/api_impl.py`（新增 API） |
-| 新增代码 | `telegram/api_impl.py`（edit_message, delete_message, get_group_info 等） |
-| 新增代码 | `telegram/platform_api.py`（pin_message, unpin_message 等的映射） |
-| `telegram.yaml` | `telegram/manifest.yaml`（扩展 supported_events/apis） |
-
-### 7.2 迁移顺序建议
-
-1. **Telegram** — 功能最完整的适配器之一，适合作为模板
-2. **Discord** — 第二个迁移，验证模式的通用性
-3. **AioCQHTTP (OneBot)** — 国内最常用，确保兼容
-4. **其他适配器** — 按使用频率排序
-
-### 7.3 渐进式迁移
-
-不需要一次性迁移所有适配器。可以采用渐进策略：
-
-1. 先在 `adapters/` 下建立新适配器
-2. `Blueprint` 同时扫描 `sources/` 和 `adapters/` 两个目录
-3. 旧适配器在 `sources/` 中继续工作
-4. 逐个迁移到新结构
-5. 全部迁移完成后移除 `sources/` 目录
-
-```yaml
-# 过渡期的 Blueprint
-kind: Blueprint
-spec:
-  components:
-    MessagePlatformAdapter:
-      fromDirs:
-        - path: pkg/platform/sources/      # 旧路径（尚未迁移的适配器）
-        - path: pkg/platform/adapters/      # 新路径（已迁移的适配器）
-```

docs/event-based-agents/04-event-routing.md

@@ -1,745 +0,0 @@
-# 事件路由与编排
-
-> **2026-06 方向修订**：本文档的四种 handler_type（pipeline / agent / webhook / plugin）分类法已被「事件 → Agent」统一编排取代，收编映射与新数据模型见 [07-agent-orchestration.md](./07-agent-orchestration.md)。本文档中的事件匹配规则（§4）、`use_pipeline_uuid` 迁移策略（§6）、WebUI 交互骨架（§7）与 webhook 请求/响应格式（§5.4）仍然有效，将在 Agent 模型下沿用。
-
-## 1. 概述
-
-事件路由是 EBA 架构的核心机制：事件从适配器产生后，经由 EventBus 进入 EventRouter，由 EventRouter 根据 Bot 的配置将事件分发到对应的处理器（Handler）。
-
-**配置方式**：用户在 WebUI 的 Bot 管理页面通过可视化编排面板管理事件处理器配置，配置数据存储在数据库的 Bot 表 `event_handlers` JSON 字段中。
-
-## 2. 数据模型
-
-### 2.1 Bot 实体扩展
-
-在 `bots` 表新增 `event_handlers` 字段：
-
-```python
-class Bot(Base):
-    __tablename__ = "bots"
-
-    uuid: str               # 主键
-    name: str
-    description: str
-    adapter: str
-    adapter_config: dict    # JSON
-    enable: bool
-
-    # 新增
-    event_handlers: list    # JSON — 事件处理器配置列表
-
-    # 保留（过渡期后弃用）
-    use_pipeline_name: str  # deprecated
-    use_pipeline_uuid: str  # deprecated
-
-    created_at: datetime
-    updated_at: datetime
-```
-
-### 2.2 EventHandler 配置结构
-
-`event_handlers` 字段存储一个 JSON 数组，每个元素定义一条事件路由规则：
-
-```python
-class EventHandlerConfig(pydantic.BaseModel):
-    """单条事件处理器配置"""
-
-    event_type: str
-    """匹配的事件类型
-
-    支持精确匹配和通配符：
-    - "message.received"       — 精确匹配
-    - "message.*"              — 匹配 message 命名空间下所有事件
-    - "group.*"                — 匹配 group 命名空间下所有事件
-    - "*"                      — 匹配所有事件（兜底）
-    """
-
-    handler_type: str
-    """处理器类型: "pipeline" | "agent" | "webhook" | "plugin" """
-
-    handler_config: dict = {}
-    """处理器的具体配置，结构取决于 handler_type"""
-
-    enabled: bool = True
-    """是否启用此规则"""
-
-    priority: int = 0
-    """优先级，数字越大越先匹配（同一事件类型有多条规则时）"""
-
-    description: str = ""
-    """规则描述（供 WebUI 显示）"""
-```
-
-### 2.3 各 Handler 类型的 handler_config 结构
-
-#### pipeline
-
-```json
-{
-    "handler_type": "pipeline",
-    "handler_config": {
-        "pipeline_uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    }
-}
-```
-
-将事件作为消息事件传入现有 Pipeline 流水线。仅适用于 `message.received` 事件。
-
-#### agent
-
-```json
-{
-    "handler_type": "agent",
-    "handler_config": {
-        "runner": "local-agent",
-        "runner_config": {
-            "model_uuid": "...",
-            "prompt": "你是一个群组助理，请处理以下事件：{event_summary}",
-            "tools_enabled": true
-        }
-    }
-}
-```
-
-```json
-{
-    "handler_type": "agent",
-    "handler_config": {
-        "runner": "dify-service-api",
-        "runner_config": {
-            "base_url": "https://api.dify.ai/v1",
-            "api_key": "...",
-            "app_type": "agent"
-        }
-    }
-}
-```
-
-直接调用 RequestRunner 处理事件。可用的 runner 包括：
-- `local-agent` — 内置 LLM Agent
-- `dify-service-api` — Dify 平台
-- `n8n-service-api` — n8n 工作流
-- `coze-api` — Coze (扣子)
-- `dashscope-app-api` — 阿里百炼
-- `langflow-api` — Langflow
-- `tbox-app-api` — 蚂蚁 Tbox
-
-Agent 处理器不经过 Pipeline 的多 Stage 流程，而是直接构建上下文并调用 Runner。适用于所有事件类型。
-
-**Agent Handler 与 Pipeline 的关系**：
-- Pipeline 是完整的多 Stage 处理链（PreProcessor → MessageProcessor(内含Runner) → PostProcessor → ...），适合复杂消息处理
-- Agent Handler 是轻量级的，直接调用 Runner，跳过 PreProcessor/PostProcessor 等阶段
-- Pipeline 内部的 AI Stage 仍然使用 Runner，所以 Runner 本身被两种 Handler 共享
-- 用户可以根据场景选择：消息处理用 Pipeline（更多控制），其他事件用 Agent（更直接）
-
-#### webhook
-
-```json
-{
-    "handler_type": "webhook",
-    "handler_config": {
-        "url": "https://example.com/webhook/langbot-events",
-        "method": "POST",
-        "headers": {
-            "Authorization": "Bearer xxx"
-        },
-        "timeout": 30,
-        "retry_count": 3,
-        "retry_interval": 5,
-        "response_actions": true
-    }
-}
-```
-
-将事件序列化为 JSON POST 到外部 URL。支持的特性：
-- **认证**：通过 headers 配置（Bearer Token、API Key 等）
-- **重试**：配置重试次数和间隔
-- **响应动作**：如果 `response_actions` 为 true，解析响应 JSON 中的 `actions` 字段并执行（如发送消息、同意好友请求等）
-
-Webhook 请求体格式：
-
-```json
-{
-    "event": {
-        "type": "group.member_joined",
-        "timestamp": 1700000000.0,
-        "bot_uuid": "...",
-        "adapter_name": "telegram",
-        "group": { "id": "...", "name": "..." },
-        "member": { "id": "...", "nickname": "..." }
-    },
-    "bot": {
-        "uuid": "...",
-        "name": "...",
-        "adapter": "telegram"
-    }
-}
-```
-
-响应体格式（当 `response_actions` 为 true 时）：
-
-```json
-{
-    "actions": [
-        {
-            "type": "send_message",
-            "params": {
-                "target_type": "group",
-                "target_id": "123456",
-                "message": [{ "type": "Plain", "text": "欢迎新成员！" }]
-            }
-        },
-        {
-            "type": "call_platform_api",
-            "params": {
-                "action": "pin_message",
-                "params": { "chat_id": "123456", "message_id": "789" }
-            }
-        }
-    ]
-}
-```
-
-#### plugin
-
-```json
-{
-    "handler_type": "plugin",
-    "handler_config": {
-        "plugin_filter": []
-    }
-}
-```
-
-将事件分发给插件的 EventListener 处理。
-
-- `plugin_filter`：可选的插件名过滤列表，为空表示分发给所有插件
-- 沿用现有的插件事件分发机制（按优先级遍历插件，支持 `prevent_postorder`）
-
-### 2.4 完整配置示例
-
-一个 Bot 的 `event_handlers` 配置示例：
-
-```json
-[
-    {
-        "event_type": "message.received",
-        "handler_type": "pipeline",
-        "handler_config": {
-            "pipeline_uuid": "default-pipeline-uuid"
-        },
-        "enabled": true,
-        "priority": 10,
-        "description": "消息事件使用默认流水线处理"
-    },
-    {
-        "event_type": "group.member_joined",
-        "handler_type": "agent",
-        "handler_config": {
-            "runner": "local-agent",
-            "runner_config": {
-                "model_uuid": "gpt-4o-mini",
-                "prompt": "有新成员 {member_name} 加入了群组 {group_name}，请生成一条欢迎消息。"
-            }
-        },
-        "enabled": true,
-        "priority": 0,
-        "description": "新成员入群时用 AI 生成欢迎消息"
-    },
-    {
-        "event_type": "friend.request_received",
-        "handler_type": "webhook",
-        "handler_config": {
-            "url": "https://my-server.com/api/friend-request",
-            "response_actions": true
-        },
-        "enabled": true,
-        "priority": 0,
-        "description": "好友请求转发到自建服务处理"
-    },
-    {
-        "event_type": "*",
-        "handler_type": "plugin",
-        "handler_config": {},
-        "enabled": true,
-        "priority": -100,
-        "description": "所有事件兜底发给插件处理"
-    }
-]
-```
-
-## 3. EventBus 设计
-
-EventBus 是事件的中转站，接收来自各个 RuntimeBot 的事件，交由 EventRouter 处理。
-
-```python
-class EventBus:
-    """事件总线"""
-
-    def __init__(self, ap: Application):
-        self.ap = ap
-        self.event_router = EventRouter(ap)
-
-    async def emit(
-        self,
-        event: Event,
-        adapter: AbstractPlatformAdapter,
-    ):
-        """接收并分发事件
-
-        Args:
-            event: 统一事件对象
-            adapter: 产生此事件的适配器实例
-        """
-        # 1. 全局事件日志
-        self.ap.logger.debug(
-            f"EventBus: {event.type} from bot {event.bot_uuid}"
-        )
-
-        # 2. 交由 EventRouter 路由处理
-        await self.event_router.route(event, adapter)
-```
-
-## 4. EventRouter 设计
-
-EventRouter 是事件路由引擎，根据 Bot 的 `event_handlers` 配置决定事件的处理方式。
-
-```python
-class EventRouter:
-    """事件路由引擎"""
-
-    def __init__(self, ap: Application):
-        self.ap = ap
-        self.handlers: dict[str, AbstractEventHandler] = {
-            "pipeline": PipelineHandler(ap),
-            "agent": AgentHandler(ap),
-            "webhook": WebhookHandler(ap),
-            "plugin": PluginHandler(ap),
-        }
-
-    async def route(
-        self,
-        event: Event,
-        adapter: AbstractPlatformAdapter,
-    ):
-        """路由事件到对应处理器"""
-
-        # 1. 获取 Bot 配置
-        bot = await self.ap.platform_mgr.get_bot_by_uuid(event.bot_uuid)
-        if not bot:
-            return
-
-        # 2. 获取事件处理器配置
-        event_handlers = bot.bot_entity.event_handlers or []
-
-        # 3. 匹配规则（按 priority 降序排列）
-        matched_handlers = self._match_handlers(event.type, event_handlers)
-
-        if not matched_handlers:
-            # 未匹配到任何规则 → 默认交给插件处理（向后兼容）
-            await self.handlers["plugin"].handle(event, adapter, {})
-            return
-
-        # 4. 执行第一个匹配的 Handler
-        #    （未来可扩展为多个 Handler 串行/并行执行）
-        handler_config = matched_handlers[0]
-        handler = self.handlers.get(handler_config.handler_type)
-
-        if handler:
-            await handler.handle(event, adapter, handler_config.handler_config)
-        else:
-            self.ap.logger.warning(
-                f"Unknown handler type: {handler_config.handler_type}"
-            )
-
-    def _match_handlers(
-        self,
-        event_type: str,
-        handlers: list[EventHandlerConfig],
-    ) -> list[EventHandlerConfig]:
-        """匹配事件类型到处理器配置
-
-        匹配规则：
-        1. 精确匹配：event_type == handler.event_type
-        2. 命名空间通配：handler.event_type 为 "message.*" 时匹配所有 "message.xxx"
-        3. 全局通配：handler.event_type 为 "*" 时匹配所有事件
-        4. 按 priority 降序排列
-        5. 只返回 enabled=True 的规则
-        """
-        matched = []
-        for handler in handlers:
-            if not handler.enabled:
-                continue
-            if self._event_type_matches(event_type, handler.event_type):
-                matched.append(handler)
-
-        matched.sort(key=lambda h: h.priority, reverse=True)
-        return matched
-
-    @staticmethod
-    def _event_type_matches(event_type: str, pattern: str) -> bool:
-        """判断事件类型是否匹配模式"""
-        if pattern == "*":
-            return True
-        if pattern == event_type:
-            return True
-        if pattern.endswith(".*"):
-            namespace = pattern[:-2]
-            return event_type.startswith(namespace + ".")
-        return False
-```
-
-## 5. 事件处理器（Handler）实现
-
-### 5.1 Handler 基类
-
-```python
-class AbstractEventHandler(abc.ABC):
-    """事件处理器基类"""
-
-    def __init__(self, ap: Application):
-        self.ap = ap
-
-    @abc.abstractmethod
-    async def handle(
-        self,
-        event: Event,
-        adapter: AbstractPlatformAdapter,
-        config: dict,
-    ) -> None:
-        """处理事件
-
-        Args:
-            event: 统一事件对象
-            adapter: 适配器实例（用于调用平台 API 发送响应）
-            config: handler_config 配置
-        """
-        ...
-```
-
-### 5.2 PipelineHandler
-
-将消息事件注入现有 Pipeline 流水线处理。
-
-```python
-class PipelineHandler(AbstractEventHandler):
-    """Pipeline 处理器 — 将事件送入现有 Pipeline 流水线"""
-
-    async def handle(self, event, adapter, config):
-        pipeline_uuid = config.get("pipeline_uuid")
-
-        if not isinstance(event, MessageReceivedEvent):
-            self.ap.logger.warning(
-                f"PipelineHandler only supports MessageReceivedEvent, "
-                f"got {event.type}"
-            )
-            return
-
-        # 将 MessageReceivedEvent 转换为现有的 Query 并投入 QueryPool
-        # 复用现有的 MessageAggregator + QueryPool + Pipeline 机制
-        launcher_type = (
-            LauncherTypes.PERSON
-            if event.chat_type == ChatType.PRIVATE
-            else LauncherTypes.GROUP
-        )
-
-        await self.ap.msg_aggregator.add_message(
-            bot_uuid=event.bot_uuid,
-            launcher_type=launcher_type,
-            launcher_id=event.chat_id,
-            sender_id=event.sender.id,
-            message_event=event.to_legacy_event(),  # 转换为 FriendMessage/GroupMessage
-            message_chain=event.message_chain,
-            adapter=adapter,
-            pipeline_uuid=pipeline_uuid,
-        )
-```
-
-### 5.3 AgentHandler
-
-直接调用 RequestRunner 处理事件，不经过 Pipeline Stage 链。
-
-```python
-class AgentHandler(AbstractEventHandler):
-    """Agent 处理器 — 直接调用 RequestRunner 处理事件"""
-
-    async def handle(self, event, adapter, config):
-        runner_name = config.get("runner", "local-agent")
-        runner_config = config.get("runner_config", {})
-
-        # 1. 查找 Runner 类
-        runner_cls = None
-        for r in preregistered_runners:
-            if r.name == runner_name:
-                runner_cls = r
-                break
-
-        if not runner_cls:
-            self.ap.logger.error(f"Runner not found: {runner_name}")
-            return
-
-        # 2. 构建事件上下文（将事件信息整理为 Runner 可处理的格式）
-        event_context = self._build_event_context(event, runner_config)
-
-        # 3. 实例化并调用 Runner
-        runner = runner_cls(self.ap, self._build_runner_pipeline_config(config))
-
-        response_messages = []
-        async for result in runner.run(event_context):
-            response_messages.append(result)
-
-        # 4. 发送响应（如果 Runner 产生了回复）
-        if response_messages and isinstance(event, MessageReceivedEvent):
-            # 将 Runner 输出转换为 MessageChain 并回复
-            reply_chain = self._build_reply_chain(response_messages)
-            await adapter.reply_message(event, reply_chain)
-
-    def _build_event_context(self, event, runner_config):
-        """将事件构建为 Runner 可处理的上下文
-
-        对于消息事件，直接使用消息内容。
-        对于其他事件，根据 runner_config 中的 prompt 模板生成描述文本。
-        """
-        ...
-
-    def _build_runner_pipeline_config(self, config):
-        """将 handler_config 转换为 Runner 需要的 pipeline_config 格式"""
-        ...
-```
-
-### 5.4 WebhookHandler
-
-将事件 POST 到外部 URL。
-
-```python
-class WebhookHandler(AbstractEventHandler):
-    """Webhook 处理器 — 将事件 POST 到外部 URL"""
-
-    async def handle(self, event, adapter, config):
-        url = config.get("url")
-        method = config.get("method", "POST")
-        headers = config.get("headers", {})
-        timeout = config.get("timeout", 30)
-        retry_count = config.get("retry_count", 3)
-        response_actions = config.get("response_actions", False)
-
-        # 1. 构建请求体
-        bot = await self.ap.platform_mgr.get_bot_by_uuid(event.bot_uuid)
-        payload = {
-            "event": event.model_dump(),
-            "bot": {
-                "uuid": bot.bot_entity.uuid,
-                "name": bot.bot_entity.name,
-                "adapter": bot.bot_entity.adapter,
-            }
-        }
-
-        # 2. 发送请求（带重试）
-        response = await self._send_with_retry(
-            url, method, headers, payload, timeout, retry_count
-        )
-
-        # 3. 处理响应动作
-        if response_actions and response:
-            await self._execute_response_actions(
-                response, adapter, event
-            )
-
-    async def _execute_response_actions(self, response, adapter, event):
-        """执行响应中的动作列表"""
-        actions = response.get("actions", [])
-        for action in actions:
-            action_type = action.get("type")
-            params = action.get("params", {})
-
-            if action_type == "send_message":
-                chain = MessageChain.model_validate(params.get("message", []))
-                await adapter.send_message(
-                    params["target_type"],
-                    params["target_id"],
-                    chain,
-                )
-            elif action_type == "reply":
-                chain = MessageChain.model_validate(params.get("message", []))
-                await adapter.reply_message(event, chain)
-            elif action_type == "call_platform_api":
-                await adapter.call_platform_api(
-                    params["action"],
-                    params.get("params", {}),
-                )
-            elif action_type == "approve_friend_request":
-                await adapter.approve_friend_request(
-                    params["request_id"],
-                    params.get("approve", True),
-                )
-            # ... 更多动作类型
-```
-
-### 5.5 PluginHandler
-
-将事件分发给插件的 EventListener。
-
-```python
-class PluginHandler(AbstractEventHandler):
-    """Plugin 处理器 — 分发给插件 EventListener"""
-
-    async def handle(self, event, adapter, config):
-        plugin_filter = config.get("plugin_filter", [])
-
-        # 复用现有的插件事件分发机制
-        # 通过 plugin_connector 将事件发送给 Plugin Runtime
-        await self.ap.plugin_connector.emit_event(
-            event=event,
-            adapter=adapter,
-            plugin_filter=plugin_filter,
-        )
-```
-
-## 6. use_pipeline_uuid 迁移
-
-### 6.1 自动迁移
-
-数据库迁移脚本将现有的 `use_pipeline_uuid` 自动转换为 `event_handlers`：
-
-```python
-# 迁移逻辑
-for bot in all_bots:
-    if bot.use_pipeline_uuid and not bot.event_handlers:
-        bot.event_handlers = [
-            {
-                "event_type": "message.received",
-                "handler_type": "pipeline",
-                "handler_config": {
-                    "pipeline_uuid": bot.use_pipeline_uuid
-                },
-                "enabled": True,
-                "priority": 10,
-                "description": "Auto-migrated from use_pipeline_uuid"
-            },
-            {
-                "event_type": "*",
-                "handler_type": "plugin",
-                "handler_config": {},
-                "enabled": True,
-                "priority": -100,
-                "description": "Default plugin handler"
-            }
-        ]
-```
-
-### 6.2 过渡期兼容
-
-在过渡期内，如果 `event_handlers` 为空且 `use_pipeline_uuid` 非空，EventRouter 自动回退到旧行为：
-
-```python
-# EventRouter.route() 中的兼容逻辑
-if not event_handlers and bot.bot_entity.use_pipeline_uuid:
-    # 回退：消息事件走 Pipeline，其他事件走 Plugin
-    if isinstance(event, MessageReceivedEvent):
-        await self.handlers["pipeline"].handle(
-            event, adapter,
-            {"pipeline_uuid": bot.bot_entity.use_pipeline_uuid}
-        )
-    else:
-        await self.handlers["plugin"].handle(event, adapter, {})
-    return
-```
-
-## 7. WebUI 编排面板数据模型
-
-### 7.1 交互设计概要
-
-在 WebUI 的 Bot 管理页面，新增"事件处理器"标签页（或区域），呈现为一个**规则列表**：
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│  事件处理器                                       [+ 添加规则]  │
-├─────────────────────────────────────────────────────────────┤
-│                                                             │
-│  ┌─ 规则 1 ─────────────────────────────────── [启用] [删除] ─┐ │
-│  │  事件类型: [message.received    ▾]                         │ │
-│  │  处理器:   [Pipeline           ▾]                         │ │
-│  │  Pipeline: [默认流水线          ▾]                         │ │
-│  │  优先级:   [10]                                           │ │
-│  │  描述:     消息事件使用默认流水线处理                         │ │
-│  └──────────────────────────────────────────────────────────┘ │
-│                                                             │
-│  ┌─ 规则 2 ─────────────────────────────────── [启用] [删除] ─┐ │
-│  │  事件类型: [group.member_joined ▾]                         │ │
-│  │  处理器:   [Agent              ▾]                         │ │
-│  │  Runner:   [local-agent        ▾]                         │ │
-│  │  模型:     [gpt-4o-mini        ▾]                         │ │
-│  │  Prompt:   [有新成员加入...]                                │ │
-│  │  优先级:   [0]                                            │ │
-│  └──────────────────────────────────────────────────────────┘ │
-│                                                             │
-│  ┌─ 规则 3 (兜底) ──────────────────────────── [启用] [删除] ─┐ │
-│  │  事件类型: [*                   ▾]                         │ │
-│  │  处理器:   [Plugin             ▾]                         │ │
-│  │  优先级:   [-100]                                         │ │
-│  └──────────────────────────────────────────────────────────┘ │
-│                                                             │
-└─────────────────────────────────────────────────────────────┘
-```
-
-### 7.2 前端数据结构
-
-```typescript
-interface EventHandlerRule {
-  event_type: string;       // 下拉选择，选项从适配器 manifest 的 supported_events 获取
-  handler_type: string;     // "pipeline" | "agent" | "webhook" | "plugin"
-  handler_config: Record<string, any>;  // 根据 handler_type 动态渲染不同的配置表单
-  enabled: boolean;
-  priority: number;
-  description: string;
-}
-
-// Bot 编辑接口扩展
-interface BotConfig {
-  uuid: string;
-  name: string;
-  adapter: string;
-  adapter_config: Record<string, any>;
-  enable: boolean;
-  event_handlers: EventHandlerRule[];  // 新增
-}
-```
-
-### 7.3 事件类型下拉选项
-
-从 Bot 关联的适配器 manifest 中获取 `supported_events`，加上通配符选项：
-
-```
-- message.received
-- message.edited
-- message.deleted
-- message.reaction
-- feedback.received
-- group.member_joined
-- group.member_left
-- group.member_banned
-- group.info_updated
-- friend.request_received
-- friend.added
-- bot.invited_to_group
-- bot.removed_from_group
-- bot.muted
-- bot.unmuted
-- platform.specific
-─────────────────
-- message.*          (所有消息事件)
-- feedback.*         (所有反馈事件)
-- group.*            (所有群组事件)
-- friend.*           (所有好友事件)
-- bot.*              (所有 Bot 事件)
-- *                  (所有事件)
-```
-
-### 7.4 HTTP API
-
-```
-GET    /api/v1/bots/{uuid}/event-handlers         获取 Bot 的事件处理器配置
-PUT    /api/v1/bots/{uuid}/event-handlers         更新 Bot 的事件处理器配置
-GET    /api/v1/adapters/{name}/supported-events    获取适配器支持的事件类型
-GET    /api/v1/adapters/{name}/supported-apis      获取适配器支持的 API
-```

docs/event-based-agents/05-plugin-sdk.md

@@ -1,738 +0,0 @@
-# 插件 SDK 改造
-
-## 1. 概述
-
-插件 SDK 需要配合 EBA 架构进行以下改造：
-
-1. **新事件类型**：将所有通用事件暴露给插件
-2. **新 API**：将新增的平台 API 通过 `LangBotAPIProxy` 暴露给插件
-3. **兼容层**：保证现有插件零修改运行
-4. **通信协议扩展**：新增 action 枚举支持新 API
-
-## 2. 新事件类型暴露
-
-### 2.1 插件事件模型扩展
-
-当前插件 SDK 的事件模型（`api/entities/events.py`）只有消息相关事件。需要新增所有通用事件的插件级包装：
-
-```python
-# api/entities/events.py — 新增事件
-
-# ---- 消息事件（扩展） ----
-
-class MessageEditedReceived(BaseEventModel):
-    """消息被编辑事件"""
-    launcher_type: str
-    launcher_id: typing.Union[int, str]
-    message_id: typing.Union[int, str]
-    editor_id: typing.Union[int, str]
-    new_content: MessageChain
-    chat_type: str  # "private" | "group"
-
-class MessageDeletedReceived(BaseEventModel):
-    """消息被删除/撤回事件"""
-    launcher_type: str
-    launcher_id: typing.Union[int, str]
-    message_id: typing.Union[int, str]
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-    chat_type: str
-
-class MessageReactionReceived(BaseEventModel):
-    """消息表情回应事件"""
-    launcher_type: str
-    launcher_id: typing.Union[int, str]
-    message_id: typing.Union[int, str]
-    user_id: typing.Union[int, str]
-    reaction: str
-    is_add: bool
-
-# ---- 用户反馈事件 ----
-
-class FeedbackReceived(BaseEventModel):
-    """用户对 Bot 回复提交反馈"""
-    feedback_id: str
-    feedback_type: int  # 1=like, 2=dislike, 3=cancel/remove feedback
-    feedback_content: typing.Optional[str] = None
-    inaccurate_reasons: typing.Optional[list[str]] = None
-    user_id: typing.Optional[str] = None
-    session_id: typing.Optional[str] = None
-    message_id: typing.Optional[str] = None
-    stream_id: typing.Optional[str] = None
-
-# ---- 群组事件 ----
-
-class GroupMemberJoined(BaseEventModel):
-    """新成员加入群组"""
-    group_id: typing.Union[int, str]
-    group_name: str
-    member_id: typing.Union[int, str]
-    member_name: str
-    inviter_id: typing.Optional[typing.Union[int, str]] = None
-    join_type: typing.Optional[str] = None
-
-class GroupMemberLeft(BaseEventModel):
-    """成员离开群组"""
-    group_id: typing.Union[int, str]
-    group_name: str
-    member_id: typing.Union[int, str]
-    member_name: str
-    is_kicked: bool = False
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-
-class GroupMemberBanned(BaseEventModel):
-    """成员被禁言"""
-    group_id: typing.Union[int, str]
-    member_id: typing.Union[int, str]
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-    duration: typing.Optional[int] = None
-
-class GroupMemberUnbanned(BaseEventModel):
-    """成员被解除禁言"""
-    group_id: typing.Union[int, str]
-    member_id: typing.Union[int, str]
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-
-class GroupInfoUpdated(BaseEventModel):
-    """群组信息被修改"""
-    group_id: typing.Union[int, str]
-    group_name: str
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-    changed_fields: list[str] = []
-
-# ---- 好友事件 ----
-
-class FriendRequestReceived(BaseEventModel):
-    """收到好友请求"""
-    request_id: typing.Union[int, str]
-    user_id: typing.Union[int, str]
-    user_name: str
-    message: typing.Optional[str] = None
-
-class FriendAdded(BaseEventModel):
-    """成功添加好友"""
-    user_id: typing.Union[int, str]
-    user_name: str
-
-class FriendRemoved(BaseEventModel):
-    """好友被移除"""
-    user_id: typing.Union[int, str]
-    user_name: str
-
-# ---- Bot 状态事件 ----
-
-class BotInvitedToGroup(BaseEventModel):
-    """Bot 被邀请加入群组"""
-    group_id: typing.Union[int, str]
-    group_name: str
-    inviter_id: typing.Optional[typing.Union[int, str]] = None
-    request_id: typing.Optional[typing.Union[int, str]] = None
-
-class BotRemovedFromGroup(BaseEventModel):
-    """Bot 被移出群组"""
-    group_id: typing.Union[int, str]
-    group_name: str
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-
-class BotMuted(BaseEventModel):
-    """Bot 被禁言"""
-    group_id: typing.Union[int, str]
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-    duration: typing.Optional[int] = None
-
-class BotUnmuted(BaseEventModel):
-    """Bot 被解除禁言"""
-    group_id: typing.Union[int, str]
-    operator_id: typing.Optional[typing.Union[int, str]] = None
-
-# ---- 平台特有事件 ----
-
-class PlatformSpecificEventReceived(BaseEventModel):
-    """平台特有事件"""
-    adapter_name: str
-    action: str
-    data: dict = {}
-```
-
-### 2.2 EventListener 注册方式
-
-插件的 EventListener 继续使用 `@self.handler(EventType)` 装饰器注册，只是可以注册的事件类型大幅增加：
-
-```python
-class MyEventListener(EventListener):
-    def __init__(self, host):
-        super().__init__(host)
-
-        # 现有方式（继续工作）
-        @self.handler(PersonNormalMessageReceived)
-        async def on_person_message(ctx: EventContext):
-            ...
-
-        # 新事件类型
-        @self.handler(GroupMemberJoined)
-        async def on_member_joined(ctx: EventContext):
-            group_name = ctx.event.group_name
-            member_name = ctx.event.member_name
-            await ctx.reply(MessageChain([
-                Plain(f"欢迎 {member_name} 加入 {group_name}！")
-            ]))
-
-        @self.handler(FriendRequestReceived)
-        async def on_friend_request(ctx: EventContext):
-            # 自动通过好友请求
-            await ctx.approve_friend_request(
-                ctx.event.request_id, approve=True
-            )
-
-        @self.handler(FeedbackReceived)
-        async def on_feedback(ctx: EventContext):
-            if ctx.event.feedback_type == 2:
-                await self.log_warning(
-                    f"用户点踩了回复: {ctx.event.feedback_content or ''}"
-                )
-
-        @self.handler(PlatformSpecificEventReceived)
-        async def on_platform_event(ctx: EventContext):
-            if ctx.event.adapter_name == "telegram" and ctx.event.action == "chat_join_request":
-                ...
-```
-
-## 3. 新 API 暴露
-
-### 3.1 LangBotAPIProxy 扩展
-
-在 `LangBotAPIProxy` 中新增以下方法，插件通过 `self.xxx()` 调用（在 BasePlugin 中继承）：
-
-```python
-class LangBotAPIProxy:
-    # ---- 现有方法（保留） ----
-    # get_langbot_version, get_bots, get_bot_info,
-    # send_message, invoke_llm, get/set/delete_plugin_storage, ...
-
-    # ---- 新增消息 API ----
-
-    async def edit_message(
-        self,
-        bot_uuid: str,
-        chat_type: str,
-        chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-        new_content: MessageChain,
-    ) -> None:
-        """编辑已发送的消息"""
-        ...
-
-    async def delete_message(
-        self,
-        bot_uuid: str,
-        chat_type: str,
-        chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-    ) -> None:
-        """删除/撤回消息"""
-        ...
-
-    async def forward_message(
-        self,
-        bot_uuid: str,
-        from_chat_type: str,
-        from_chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-        to_chat_type: str,
-        to_chat_id: typing.Union[int, str],
-    ) -> dict:
-        """转发消息"""
-        ...
-
-    async def get_message(
-        self,
-        bot_uuid: str,
-        chat_type: str,
-        chat_id: typing.Union[int, str],
-        message_id: typing.Union[int, str],
-    ) -> dict:
-        """获取指定消息"""
-        ...
-
-    # ---- 新增群组 API ----
-
-    async def get_group_info(
-        self,
-        bot_uuid: str,
-        group_id: typing.Union[int, str],
-    ) -> dict:
-        """获取群组信息"""
-        ...
-
-    async def get_group_list(
-        self,
-        bot_uuid: str,
-    ) -> list[dict]:
-        """获取 Bot 加入的群组列表"""
-        ...
-
-    async def get_group_member_list(
-        self,
-        bot_uuid: str,
-        group_id: typing.Union[int, str],
-    ) -> list[dict]:
-        """获取群成员列表"""
-        ...
-
-    async def get_group_member_info(
-        self,
-        bot_uuid: str,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-    ) -> dict:
-        """获取指定群成员信息"""
-        ...
-
-    async def mute_member(
-        self,
-        bot_uuid: str,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-        duration: int = 0,
-    ) -> None:
-        """禁言群成员"""
-        ...
-
-    async def unmute_member(
-        self,
-        bot_uuid: str,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-    ) -> None:
-        """解除禁言"""
-        ...
-
-    async def kick_member(
-        self,
-        bot_uuid: str,
-        group_id: typing.Union[int, str],
-        user_id: typing.Union[int, str],
-    ) -> None:
-        """踢出群成员"""
-        ...
-
-    # ---- 新增用户 API ----
-
-    async def get_user_info(
-        self,
-        bot_uuid: str,
-        user_id: typing.Union[int, str],
-    ) -> dict:
-        """获取用户信息"""
-        ...
-
-    async def get_friend_list(
-        self,
-        bot_uuid: str,
-    ) -> list[dict]:
-        """获取好友列表"""
-        ...
-
-    async def approve_friend_request(
-        self,
-        bot_uuid: str,
-        request_id: typing.Union[int, str],
-        approve: bool = True,
-        remark: typing.Optional[str] = None,
-    ) -> None:
-        """处理好友请求"""
-        ...
-
-    async def approve_group_invite(
-        self,
-        bot_uuid: str,
-        request_id: typing.Union[int, str],
-        approve: bool = True,
-    ) -> None:
-        """处理入群邀请"""
-        ...
-
-    # ---- 新增透传 API ----
-
-    async def call_platform_api(
-        self,
-        bot_uuid: str,
-        action: str,
-        params: dict = {},
-    ) -> dict:
-        """调用适配器特有 API
-
-        Examples:
-            # Telegram: pin 消息
-            result = await self.call_platform_api(
-                bot_uuid, "pin_message",
-                {"chat_id": 123456, "message_id": 789}
-            )
-
-            # Discord: 创建频道
-            result = await self.call_platform_api(
-                bot_uuid, "create_channel",
-                {"guild_id": "...", "name": "new-channel"}
-            )
-        """
-        ...
-
-    # ---- 新增能力查询 API ----
-
-    async def get_supported_events(
-        self,
-        bot_uuid: str,
-    ) -> list[str]:
-        """获取指定 Bot 的适配器支持的事件类型"""
-        ...
-
-    async def get_supported_apis(
-        self,
-        bot_uuid: str,
-    ) -> list[str]:
-        """获取指定 Bot 的适配器支持的 API"""
-        ...
-```
-
-### 3.2 QueryBasedAPIProxy 扩展
-
-在事件处理上下文中（EventContext），通过 `QueryBasedAPIProxy` 新增便捷方法：
-
-```python
-class QueryBasedAPIProxy:
-    # ---- 现有方法（保留） ----
-    # reply, get_bot_uuid, set_query_var, get_query_var,
-    # create_new_conversation, ...
-
-    # ---- 新增便捷方法 ----
-
-    async def edit_message(
-        self,
-        message_id: typing.Union[int, str],
-        new_content: MessageChain,
-    ) -> None:
-        """在当前会话中编辑消息（自动使用当前 bot_uuid 和 chat 信息）"""
-        ...
-
-    async def delete_message(
-        self,
-        message_id: typing.Union[int, str],
-    ) -> None:
-        """在当前会话中删除消息"""
-        ...
-
-    async def approve_friend_request(
-        self,
-        request_id: typing.Union[int, str],
-        approve: bool = True,
-        remark: typing.Optional[str] = None,
-    ) -> None:
-        """处理好友请求（上下文中自动获取 bot_uuid）"""
-        ...
-
-    async def approve_group_invite(
-        self,
-        request_id: typing.Union[int, str],
-        approve: bool = True,
-    ) -> None:
-        """处理入群邀请"""
-        ...
-
-    async def get_group_info(self) -> dict:
-        """获取当前群组信息（仅群聊事件中可用）"""
-        ...
-
-    async def get_group_member_list(self) -> list[dict]:
-        """获取当前群组成员列表（仅群聊事件中可用）"""
-        ...
-
-    async def call_platform_api(
-        self,
-        action: str,
-        params: dict = {},
-    ) -> dict:
-        """调用平台特有 API（自动使用当前 bot_uuid）"""
-        ...
-```
-
-## 4. 兼容层设计
-
-### 4.1 事件兼容层
-
-当 PluginHandler 将新的 `MessageReceivedEvent` 分发给插件时，需要同时生成旧格式事件：
-
-```python
-class PluginEventCompatLayer:
-    """插件事件兼容层
-
-    将新的统一事件转换为旧的插件事件格式，
-    确保监听旧事件类型的插件仍能正常工作。
-    """
-
-    @staticmethod
-    def convert_to_legacy_events(
-        event: Event,
-    ) -> list[BaseEventModel]:
-        """将统一事件转换为旧插件事件列表
-
-        一个统一事件可能生成多个旧插件事件。
-        例如 MessageReceivedEvent 会同时生成：
-        - PersonMessageReceived / GroupMessageReceived（总是生成）
-        - PersonNormalMessageReceived / GroupNormalMessageReceived（非命令时）
-        - PersonCommandSent / GroupCommandSent（命令时）
-        """
-        legacy_events = []
-
-        if isinstance(event, MessageReceivedEvent):
-            if event.chat_type == ChatType.PRIVATE:
-                legacy_events.append(
-                    PersonMessageReceived(
-                        launcher_type="person",
-                        launcher_id=event.chat_id,
-                        sender_id=event.sender.id,
-                        message_event=event.to_legacy_friend_message(),
-                        message_chain=event.message_chain,
-                    )
-                )
-                # 命令检测后还会生成 PersonNormalMessageReceived
-                # 或 PersonCommandSent，在 Pipeline 阶段处理
-            elif event.chat_type == ChatType.GROUP:
-                legacy_events.append(
-                    GroupMessageReceived(
-                        launcher_type="group",
-                        launcher_id=event.chat_id,
-                        sender_id=event.sender.id,
-                        message_event=event.to_legacy_group_message(),
-                        message_chain=event.message_chain,
-                    )
-                )
-
-        # 新事件类型没有旧的对应物，不生成兼容事件
-        # 只有监听了新事件类型的插件才会收到
-
-        return legacy_events
-```
-
-### 4.2 分发流程
-
-```
-统一事件 (MessageReceivedEvent)
-    │
-    ├─→ 转换为旧格式 (PersonMessageReceived / GroupMessageReceived)
-    │   └─→ 分发给监听旧事件类型的插件 EventListener
-    │
-    └─→ 直接分发为新格式 (MessageReceivedEvent → 对应的插件事件)
-        └─→ 分发给监听新事件类型的插件 EventListener
-```
-
-插件 Runtime 在分发事件时检查每个 EventListener 注册的事件类型：
-- 如果注册的是旧类型（`PersonMessageReceived` 等），发送兼容层生成的旧格式事件
-- 如果注册的是新类型（`GroupMemberJoined` 等），发送新格式事件
-- 两者可以共存，同一个插件可以同时监听新旧类型
-
-### 4.3 API 兼容层
-
-现有插件使用的 API 不受影响：
-
-| 现有 API | 新架构行为 |
-|---------|----------|
-| `self.send_message(bot_uuid, target_type, target_id, message_chain)` | 不变，直接调用适配器的 `send_message` |
-| `ctx.reply(message_chain, quote_origin)` | 不变，在 MessageReceivedEvent 上下文中调用适配器的 `reply_message` |
-| `self.get_bots()` | 不变 |
-| `self.get_bot_info(bot_uuid)` | 不变 |
-
-新 API 只是额外新增的方法，不影响现有方法。
-
-## 5. 通信协议扩展
-
-### 5.1 新增 Action 枚举
-
-在 `entities/io/actions/enums.py` 中新增 action：
-
-```python
-class PluginToRuntimeAction(str, Enum):
-    # ---- 现有 actions（保留） ----
-    REGISTER_PLUGIN = "register_plugin"
-    REPLY = "reply"
-    SEND_MESSAGE = "send_message"
-    # ...
-
-    # ---- 新增消息 API ----
-    EDIT_MESSAGE = "edit_message"
-    DELETE_MESSAGE = "delete_message"
-    FORWARD_MESSAGE = "forward_message"
-    GET_MESSAGE = "get_message"
-
-    # ---- 新增群组 API ----
-    GET_GROUP_INFO = "get_group_info"
-    GET_GROUP_LIST = "get_group_list"
-    GET_GROUP_MEMBER_LIST = "get_group_member_list"
-    GET_GROUP_MEMBER_INFO = "get_group_member_info"
-    MUTE_MEMBER = "mute_member"
-    UNMUTE_MEMBER = "unmute_member"
-    KICK_MEMBER = "kick_member"
-
-    # ---- 新增用户 API ----
-    GET_USER_INFO = "get_user_info"
-    GET_FRIEND_LIST = "get_friend_list"
-    APPROVE_FRIEND_REQUEST = "approve_friend_request"
-    APPROVE_GROUP_INVITE = "approve_group_invite"
-
-    # ---- 新增透传 API ----
-    CALL_PLATFORM_API = "call_platform_api"
-
-    # ---- 新增能力查询 ----
-    GET_SUPPORTED_EVENTS = "get_supported_events"
-    GET_SUPPORTED_APIS = "get_supported_apis"
-
-
-class RuntimeToPluginAction(str, Enum):
-    # ---- 现有 actions（保留） ----
-    EMIT_EVENT = "emit_event"
-    # ...
-    # EMIT_EVENT 的 data 结构扩展以支持新事件类型
-```
-
-### 5.2 新增 Action 的请求/响应格式
-
-以 `EDIT_MESSAGE` 为例：
-
-```json
-// 请求 (Plugin → Runtime)
-{
-    "action": "edit_message",
-    "seq_id": 12345,
-    "data": {
-        "bot_uuid": "...",
-        "chat_type": "group",
-        "chat_id": "123456",
-        "message_id": "789",
-        "new_content": [
-            { "type": "Plain", "text": "edited message" }
-        ]
-    }
-}
-
-// 响应 (Runtime → Plugin)
-{
-    "seq_id": 12345,
-    "code": 0,
-    "message": "ok",
-    "data": {}
-}
-```
-
-以 `GET_GROUP_MEMBER_LIST` 为例：
-
-```json
-// 请求
-{
-    "action": "get_group_member_list",
-    "seq_id": 12346,
-    "data": {
-        "bot_uuid": "...",
-        "group_id": "123456"
-    }
-}
-
-// 响应
-{
-    "seq_id": 12346,
-    "code": 0,
-    "message": "ok",
-    "data": {
-        "members": [
-            {
-                "user": { "id": "111", "nickname": "Alice" },
-                "group_id": "123456",
-                "role": "admin",
-                "display_name": "管理员Alice"
-            },
-            ...
-        ]
-    }
-}
-```
-
-以 `CALL_PLATFORM_API` 为例：
-
-```json
-// 请求
-{
-    "action": "call_platform_api",
-    "seq_id": 12347,
-    "data": {
-        "bot_uuid": "...",
-        "action": "pin_message",
-        "params": {
-            "chat_id": "123456",
-            "message_id": "789"
-        }
-    }
-}
-
-// 响应
-{
-    "seq_id": 12347,
-    "code": 0,
-    "message": "ok",
-    "data": {
-        "result": { ... }
-    }
-}
-```
-
-### 5.3 LangBot 侧 Handler 实现
-
-在 `ControlConnectionHandler`（LangBot → Runtime 侧）和 `PluginConnectionHandler`（Runtime → Plugin 侧）中新增对应的 action 处理逻辑：
-
-```python
-# PluginConnectionHandler 中新增
-async def _handle_edit_message(self, data):
-    bot_uuid = data["bot_uuid"]
-    bot = await self.ap.platform_mgr.get_bot_by_uuid(bot_uuid)
-    await bot.adapter.edit_message(
-        chat_type=data["chat_type"],
-        chat_id=data["chat_id"],
-        message_id=data["message_id"],
-        new_content=MessageChain.model_validate(data["new_content"]),
-    )
-    return {}
-
-async def _handle_call_platform_api(self, data):
-    bot_uuid = data["bot_uuid"]
-    bot = await self.ap.platform_mgr.get_bot_by_uuid(bot_uuid)
-    result = await bot.adapter.call_platform_api(
-        action=data["action"],
-        params=data.get("params", {}),
-    )
-    return {"result": result}
-```
-
-## 6. 插件开发者迁移指南
-
-### 6.1 无需迁移（零修改运行）
-
-以下场景的现有插件**不需要任何修改**：
-
-- 使用 `PersonNormalMessageReceived` / `GroupNormalMessageReceived` 监听消息
-- 使用 `PersonCommandSent` / `GroupCommandSent` 处理命令
-- 使用 `ctx.reply()` 回复消息
-- 使用 `self.send_message()` 主动发消息
-- 使用 LLM / 存储 / RAG 等现有 API
-
-### 6.2 推荐迁移（获得新能力）
-
-如果插件希望利用新功能，可以：
-
-1. **监听新事件类型**：在 EventListener 中注册新事件类型的 handler
-2. **使用新 API**：调用 `self.edit_message()`, `self.get_group_info()` 等
-3. **使用透传 API**：调用 `self.call_platform_api()` 使用平台特有功能
-
-### 6.3 SDK 版本号
-
-新功能通过提升 SDK minor 版本发布：
-
-- 现有版本：`langbot-plugin-sdk >= x.y.z`
-- 新版本：`langbot-plugin-sdk >= x.(y+1).0`
-
-插件的 `manifest.yaml` 中的 `min_sdk_version` 决定是否能使用新 API。使用旧 SDK 版本的插件在新 LangBot 上正常运行（兼容层保证），只是无法调用新 API。

docs/event-based-agents/06-migration-plan.md

@@ -1,431 +0,0 @@
-# 分阶段迁移计划
-
-> **2026-06 方向修订**：Phase 3 的「四种 Handler 框架」与 Phase 5 的编排面板形态，按 [07-agent-orchestration.md](./07-agent-orchestration.md) 调整为「事件 → Agent」统一编排（EventRouter + Agent 实体 + 绑定模型 + SDK Agent 组件契约）。阶段划分、依赖关系与验收标准仍然适用，按 Agent 模型重新解读即可；发布节奏见 07 §5「发布火车」。
-
-## 1. 概述
-
-EBA 架构涉及 langbot-plugin-sdk、LangBot 后端、LangBot 前端、文档和示例插件等多个仓库的改动。为降低风险、保证系统稳定性，采用分阶段渐进式迁移策略。
-
-### 1.1 阶段总览
-
-| 阶段 | 名称 | 范围 | 依赖 |
-|------|------|------|------|
-| Phase 1 | SDK 实体层 | langbot-plugin-sdk | 无 |
-| Phase 2 | 适配器重构 | LangBot 后端 | Phase 1 |
-| Phase 3 | 核心系统 | LangBot 后端 | Phase 2 |
-| Phase 4 | 插件 SDK 集成 | langbot-plugin-sdk + LangBot | Phase 3 |
-| Phase 5 | WebUI 编排面板 | LangBot 前端 | Phase 3 |
-| Phase 6 | 文档与示例 | langbot-wiki + langbot-plugin-demo | Phase 4, 5 |
-
-### 1.2 核心原则
-
-- **每个阶段结束后系统可运行**：任何阶段完成后，现有功能不受影响
-- **向后兼容贯穿全程**：旧接口在整个迁移期间保持可用
-- **先 SDK 后实现**：先定义好接口和模型，再做具体实现
-- **先核心适配器后边缘**：优先迁移用户量大的适配器
-
----
-
-## 2. Phase 1：SDK 实体层
-
-**目标**：在 langbot-plugin-sdk 中定义新的事件体系、通用实体、API 接口和适配器基类。
-
-**仓库**：`langbot-plugin-sdk`
-
-### 2.1 任务清单
-
-| # | 任务 | 文件/模块 | 说明 |
-|---|------|----------|------|
-| 1.1 | 定义通用事件基类层次 | `api/entities/builtin/platform/events.py` | 新增 `MessageReceivedEvent`, `MessageEditedEvent`, `GroupMemberJoinedEvent` 等，保留现有 `FriendMessage`/`GroupMessage` |
-| 1.2 | 定义平台特有事件基类 | `api/entities/builtin/platform/events.py` | 新增 `PlatformSpecificEvent` |
-| 1.3 | 扩展通用实体 | `api/entities/builtin/platform/entities.py` | 新增 `User`（统一 Friend/GroupMember 的基础）、`Channel` 等，保留现有实体 |
-| 1.4 | 清理消息组件 | `api/entities/builtin/platform/message.py` | 将 `WeChatMiniPrograms` 等 WeChat 特有组件标记为 platform-specific，不再作为通用组件 |
-| 1.5 | 定义新适配器基类 | `api/definition/abstract/platform/adapter.py` | 新增 `AbstractPlatformAdapter`（继承现有 `AbstractMessagePlatformAdapter` 并扩展通用 API 方法），保留旧基类 |
-| 1.6 | 定义 API 能力声明 | `api/definition/abstract/platform/capabilities.py`（新文件） | `AdapterCapabilities` 数据类，声明适配器支持的事件和 API |
-| 1.7 | 定义 `NotSupportedError` | `api/entities/builtin/platform/errors.py`（新文件） | 可选 API 未实现时抛出的异常 |
-
-### 2.2 关键设计约束
-
-- 所有新增定义以**新增文件或新增类**的方式引入，**不修改**现有类的字段和方法签名
-- 现有 `AbstractMessagePlatformAdapter` 保留不动，新基类 `AbstractPlatformAdapter` 继承它
-- 新事件类与旧事件类并存，通过 `event_type` 字段（命名空间字符串）区分
-
-### 2.3 验收标准
-
-- [ ] 所有新增类可正常 import 且通过类型检查
-- [ ] 现有 `FriendMessage`, `GroupMessage`, `AbstractMessagePlatformAdapter` 等类行为不变
-- [ ] 新增单元测试覆盖事件序列化/反序列化、实体构造
-- [ ] SDK 版本号 minor bump（如 `0.x.0` → `0.x+1.0`）
-
----
-
-## 3. Phase 2：适配器重构
-
-**目标**：将现有单文件适配器迁移到独立目录结构，实现新事件监听和通用 API。
-
-**仓库**：`LangBot`（后端）
-
-### 3.1 适配器迁移优先级
-
-根据用户量和代表性，建议按以下顺序迁移：
-
-| 优先级 | 适配器 | 理由 |
-|--------|--------|------|
-| P0 | **Telegram** | 用户量大，API 最完善，适合作为参考实现 |
-| P0 | **Discord** | 国际用户主要平台，事件类型丰富 |
-| P1 | **aiocqhttp**（OneBot v11） | 国内 QQ 用户主要适配器 |
-| P1 | **Satori** | 通用协议适配器，覆盖多个平台 |
-| P2 | **Lark** / **DingTalk** / **Slack** | 企业平台，用户量中等 |
-| P2 | **qqofficial** / **WeChat 系列** | 国内用户 |
-| P3 | **Kook** / **LINE** / **WeCom 系列** | 用户量较小 |
-| P3 | **WebSocket** | 内置适配器，相对简单 |
-| P4 | **legacy/*** | 遗留适配器，按需决定是否迁移或废弃 |
-
-### 3.2 单个适配器迁移步骤（以 Telegram 为例）
-
-| # | 任务 | 说明 |
-|---|------|------|
-| 2.1 | 创建目录结构 | `pkg/platform/adapters/telegram/` 下创建 `__init__.py`, `adapter.py`, `event_converter.py`, `message_converter.py`, `api_impl.py`, `types.py`, `manifest.yaml` |
-| 2.2 | 迁移消息转换器 | 将 `TelegramMessageConverter` 从 `sources/telegram.py` 搬到 `adapters/telegram/message_converter.py`，逻辑不变 |
-| 2.3 | 重写事件转换器 | 新的 `TelegramEventConverter` 支持将 Telegram Update 转换为所有通用事件类型（不只是消息），不支持的事件转为 `PlatformSpecificEvent` |
-| 2.4 | 实现通用 API | 在 `api_impl.py` 中实现 `edit_message`, `delete_message`, `get_group_info` 等 Telegram 支持的通用 API |
-| 2.5 | 实现透传 API | 在 `adapter.py` 中实现 `call_platform_api`，将 action 映射到 Telegram Bot API 调用 |
-| 2.6 | 声明能力 | 在 `manifest.yaml` 或适配器类中声明支持的事件和 API 列表 |
-| 2.7 | 新建 Adapter 主类 | `TelegramAdapter` 继承 `AbstractPlatformAdapter`（新基类），委托各模块实现 |
-| 2.8 | 更新 manifest.yaml | 更新 `execution.python.path` 指向新位置 |
-| 2.9 | 验证 | 确保新适配器通过现有消息收发流程的测试 |
-
-### 3.3 基础设施任务
-
-| # | 任务 | 说明 |
-|---|------|------|
-| 2.A | 创建 `adapters/_base/` | 将 SDK 中新基类的运行时辅助代码放在此处（如事件分发辅助函数） |
-| 2.B | 更新 ComponentDiscovery | 使 `discover_blueprint` 支持扫描 `adapters/` 子目录中的 YAML |
-| 2.C | 更新 `templates/components.yaml` | 将 `fromDirs` 从 `pkg/platform/sources/` 改为 `pkg/platform/adapters/`（过渡期两个都扫描） |
-| 2.D | 保留旧 sources/ | 过渡期不删除旧文件，通过 manifest 的 `deprecated: true` 标记 |
-
-### 3.4 验收标准
-
-- [ ] 已迁移的适配器在新目录结构下正常启动和收发消息
-- [ ] 新事件（如 `message.edited`）在支持的平台上正确触发
-- [ ] 通用 API（如 `edit_message`）在支持的平台上正确执行
-- [ ] 未迁移的适配器（仍在 `sources/`）继续正常工作
-- [ ] ComponentDiscovery 同时扫描新旧目录
-
----
-
-## 4. Phase 3：核心系统
-
-**目标**：实现 EventBus、EventRouter 和事件处理器框架，将事件从适配器分发到不同的处理器。
-
-**仓库**：`LangBot`（后端）
-
-### 4.1 任务清单
-
-| # | 任务 | 文件/模块 | 说明 |
-|---|------|----------|------|
-| 3.1 | 实现 EventBus | `pkg/platform/event_bus.py`（新文件） | 事件总线：接收适配器事件，进行日志记录，分发给 EventRouter |
-| 3.2 | 实现 EventRouter | `pkg/platform/event_router.py`（新文件） | 事件路由引擎：读取 Bot 的 `event_handlers` 配置，匹配事件类型，分发到对应 Handler |
-| 3.3 | 实现 PipelineHandler | `pkg/platform/handlers/pipeline_handler.py` | 将 `message.received` 事件转为现有 Query，进入 Pipeline 流水线 |
-| 3.4 | 实现 AgentHandler | `pkg/platform/handlers/agent_handler.py` | 直接调用 RequestRunner 处理事件，不经过 Pipeline 多 Stage 流程 |
-| 3.5 | 实现 WebhookHandler | `pkg/platform/handlers/webhook_handler.py` | 将事件 POST 到外部 URL，解析响应执行动作（重构现有 WebhookPusher） |
-| 3.6 | 实现 PluginHandler | `pkg/platform/handlers/plugin_handler.py` | 将事件分发给插件 EventListener（复用现有 plugin_connector 机制） |
-| 3.7 | Bot 实体扩展 | `pkg/entity/persistence/bot.py` | 新增 `event_handlers` JSON 字段 |
-| 3.8 | 数据库迁移 | `pkg/persistence/migrations/` | 新增迁移脚本：添加 `event_handlers` 列，将现有 `use_pipeline_uuid` 数据迁移为 `event_handlers` 格式 |
-| 3.9 | 重构 RuntimeBot | `pkg/platform/botmgr.py` | 将 `initialize()` 中硬编码的 `on_friend_message`/`on_group_message` 回调替换为通过 EventBus 分发所有事件 |
-| 3.10 | 重构 MessageAggregator | `pkg/pipeline/aggregator.py` | 从 RuntimeBot 解耦，作为 PipelineHandler 的内部机制（只对 `message.received` 事件生效） |
-| 3.11 | Agent Handler 中 RequestRunner 解耦 | `pkg/provider/runner.py` + handlers | RequestRunner 需要能独立于 Pipeline Stage 运行，为 Agent Handler 提供轻量调用路径 |
-| 3.12 | HTTP API 扩展 | `pkg/api/http/controller/` | 新增/更新 Bot API 端点以支持 `event_handlers` 的 CRUD |
-
-### 4.2 数据迁移策略
-
-现有 Bot 表有 `use_pipeline_uuid` 字段，需要自动迁移为 `event_handlers`：
-
-```python
-# 迁移逻辑伪代码
-for bot in all_bots:
-    if bot.use_pipeline_uuid:
-        bot.event_handlers = [
-            {
-                "event_type": "message.received",
-                "handler_type": "pipeline",
-                "handler_config": {
-                    "pipeline_uuid": bot.use_pipeline_uuid
-                }
-            }
-        ]
-    else:
-        bot.event_handlers = []
-```
-
-### 4.3 RuntimeBot 重构要点
-
-当前 `RuntimeBot.initialize()` 硬编码注册两个回调：
-
-```python
-# 现有代码 (botmgr.py)
-self.adapter.register_listener(FriendMessage, on_friend_message)
-self.adapter.register_listener(GroupMessage, on_group_message)
-```
-
-重构后改为注册通用事件回调：
-
-```python
-# 新代码
-async def on_event(event: Event, adapter: AbstractPlatformAdapter):
-    await self.event_bus.emit(
-        bot_uuid=self.bot_entity.uuid,
-        event=event,
-        adapter=adapter,
-    )
-
-# 注册所有事件类型的统一回调
-self.adapter.register_listener(Event, on_event)
-```
-
-EventBus 接收事件后，调用 EventRouter 按配置分发。
-
-### 4.4 事件处理器执行流程
-
-```
-EventBus.emit(bot_uuid, event, adapter)
-    │
-    ▼
-EventRouter.route(bot_uuid, event)
-    │ 查询 bot.event_handlers 配置
-    │ 匹配 event_type（精确匹配 > 通配符 *）
-    ▼
-匹配到的 Handler(s)
-    │
-    ├── PipelineHandler.handle(event, adapter)
-    │   │ 仅支持 message.received
-    │   │ 构造 Query → MessageAggregator → QueryPool → Pipeline
-    │   └── 沿用现有完整流水线机制
-    │
-    ├── AgentHandler.handle(event, adapter)
-    │   │ 根据 handler_config 选择 RequestRunner
-    │   │ 直接调用 runner.run() 处理事件
-    │   └── 将结果通过 adapter API 回复
-    │
-    ├── WebhookHandler.handle(event, adapter)
-    │   │ 序列化事件为 JSON
-    │   │ POST 到 handler_config.url
-    │   └── 解析响应，执行动作（回复消息、调用 API 等）
-    │
-    └── PluginHandler.handle(event, adapter)
-        │ 通过 plugin_connector 分发给插件
-        └── 插件 EventListener 处理
-```
-
-### 4.5 验收标准
-
-- [ ] `message.received` 事件通过 PipelineHandler 正确进入现有 Pipeline（与旧行为一致）
-- [ ] 新增事件（如 `group.member_joined`）能通过 PluginHandler 分发给插件
-- [ ] AgentHandler 能直接调用 RequestRunner（至少 `local-agent`）处理事件并回复
-- [ ] WebhookHandler 能将事件 POST 到外部 URL
-- [ ] 数据库迁移正确执行，`use_pipeline_uuid` 数据迁移到 `event_handlers`
-- [ ] 现有 Bot 在不修改配置的情况下行为不变（自动迁移保证）
-
----
-
-## 5. Phase 4：插件 SDK 集成
-
-**目标**：将新事件和 API 通过插件 SDK 暴露给插件开发者，同时实现兼容层。
-
-**仓库**：`langbot-plugin-sdk` + `LangBot`
-
-### 5.1 任务清单
-
-| # | 任务 | 说明 |
-|---|------|------|
-| 4.1 | 新增插件事件包装 | 在 `api/entities/events.py` 中为每个通用事件新增插件级事件类（如 `MessageEditedReceived`, `MemberJoinedReceived`） |
-| 4.2 | 兼容层实现 | `PersonMessageReceived` / `GroupMessageReceived` 由新的 `MessageReceivedEvent` 自动生成，旧事件作为新事件的 alias |
-| 4.3 | 新 API 暴露 | 在 `LangBotAPIProxy` 中新增方法：`edit_message`, `delete_message`, `get_group_info`, `get_user_info`, `call_platform_api` 等 |
-| 4.4 | 通信协议扩展 | 在 `entities/io/actions/enums.py` 中新增 action 枚举（如 `EDIT_MESSAGE`, `DELETE_MESSAGE`, `GET_GROUP_INFO`, `CALL_PLATFORM_API`） |
-| 4.5 | Runtime Handler 扩展 | 在 PluginConnectionHandler / ControlConnectionHandler 中添加新 action 的处理逻辑 |
-| 4.6 | EventListener 扩展 | 确保 `@handler()` 装饰器支持注册新事件类型 |
-| 4.7 | QueryBasedAPI 扩展 | 在 `QueryBasedAPIProxy` 中新增事件上下文相关的 API（如 `get_event_source_adapter`） |
-
-### 5.2 兼容层详细设计
-
-```
-新事件系统                         旧事件系统（兼容层）
-─────────────                    ─────────────────
-MessageReceivedEvent             ┌→ PersonMessageReceived (chat_type == "private")
-  (chat_type: "private"|"group") ┤
-                                 └→ GroupMessageReceived  (chat_type == "group")
-```
-
-**实现方式**：在 RuntimeEventDispatcher 中，当分发 `MessageReceivedEvent` 给插件时，同时生成对应的旧事件类实例。插件可以用新事件类或旧事件类注册 handler，都能收到。
-
-### 5.3 验收标准
-
-- [ ] 现有插件（使用旧事件和 API）无需修改即可运行
-- [ ] 新插件可以使用新事件类型（如 `MemberJoinedReceived`）注册 handler
-- [ ] 新 API（如 `edit_message`）可通过 `self.edit_message()` 或 `event_context.edit_message()` 调用
-- [ ] 透传 API `call_platform_api` 可正常调用适配器特有功能
-- [ ] 所有新 action 的通信协议正确工作（stdio / WebSocket）
-
----
-
-## 6. Phase 5：WebUI 编排面板
-
-**目标**：在 WebUI 的 Bot 管理页面实现事件处理器的可视化编排。
-
-**仓库**：`LangBot`（前端 `web/`）
-
-### 6.1 任务清单
-
-| # | 任务 | 说明 |
-|---|------|------|
-| 5.1 | Bot 编辑页面扩展 | 在 Bot 编辑页面新增「事件处理」面板 |
-| 5.2 | 事件处理器列表组件 | 可视化展示当前 Bot 的 `event_handlers` 列表，支持增删改排序 |
-| 5.3 | 事件类型选择器 | 下拉选择事件类型（命名空间分组展示），支持通配符 `*` |
-| 5.4 | Handler 类型选择与配置 | 选择 handler 类型后展示对应的配置表单（Pipeline 选择器、Runner 选择器、Webhook URL 等） |
-| 5.5 | Pipeline Handler 配置 | 复用现有的 Pipeline 选择 UI（从现有 `use_pipeline_uuid` 选择器迁移） |
-| 5.6 | Agent Handler 配置 | Runner 选择器（local-agent / dify / n8n / coze 等）+ Runner 参数配置表单 |
-| 5.7 | Webhook Handler 配置 | URL 输入、认证方式选择、Header 配置 |
-| 5.8 | Plugin Handler 配置 | 通常无需额外配置，分发给所有匹配的插件 EventListener |
-| 5.9 | HTTP API 对接 | 前端调用后端 API 保存/读取 `event_handlers` 配置 |
-| 5.10 | 迁移提示 | 对于从旧版本升级的用户，如果检测到 `use_pipeline_uuid` 已自动迁移，展示提示说明 |
-
-### 6.2 UI 交互设计概要
-
-```
-┌─ Bot 编辑页面 ─────────────────────────────────────┐
-│                                                     │
-│  基本信息  │  适配器配置  │  ★ 事件处理  │           │
-│                                                     │
-│  ┌─ 事件处理器列表 ────────────────────────────┐    │
-│  │                                              │    │
-│  │  ① message.received → Pipeline: "主流水线"   │    │
-│  │     [编辑] [删除]                            │    │
-│  │                                              │    │
-│  │  ② group.member_joined → Agent: local-agent  │    │
-│  │     [编辑] [删除]                            │    │
-│  │                                              │    │
-│  │  ③ * (默认) → Plugin                         │    │
-│  │     [编辑] [删除]                            │    │
-│  │                                              │    │
-│  │  [+ 添加事件处理器]                           │    │
-│  │                                              │    │
-│  └──────────────────────────────────────────────┘    │
-│                                                     │
-│                              [保存]  [取消]          │
-└─────────────────────────────────────────────────────┘
-```
-
-### 6.3 验收标准
-
-- [ ] 用户可以在 WebUI 上为 Bot 添加/编辑/删除事件处理器
-- [ ] 四种 Handler 类型均有对应的配置表单
-- [ ] 配置保存后正确写入数据库 `event_handlers` 字段
-- [ ] 旧版本升级后，自动迁移的配置在 UI 上正确展示
-- [ ] Pipeline Handler 的行为与旧的 `use_pipeline_uuid` 完全一致
-
----
-
-## 7. Phase 6：文档与示例
-
-**目标**：更新所有面向开发者的文档和示例。
-
-**仓库**：`langbot-wiki`, `langbot-plugin-demo`
-
-### 7.1 任务清单
-
-| # | 任务 | 仓库 | 说明 |
-|---|------|------|------|
-| 6.1 | EBA 架构概览文档 | langbot-wiki | 面向用户的新架构说明 |
-| 6.2 | 适配器开发指南更新 | langbot-wiki | 如何开发一个新的适配器（新目录结构、新基类、事件转换等） |
-| 6.3 | 插件开发指南更新 | langbot-wiki | 新事件类型、新 API 的使用说明 |
-| 6.4 | 插件迁移指南 | langbot-wiki | 现有插件如何迁移到新事件/API（如果需要使用新能力） |
-| 6.5 | 事件处理器配置指南 | langbot-wiki | WebUI 上如何配置事件处理器 |
-| 6.6 | 示例插件更新 | langbot-plugin-demo | HelloPlugin 增加新事件监听示例、新 API 调用示例 |
-| 6.7 | 新示例插件 | langbot-plugin-demo | 新建一个示例展示非消息事件处理（如入群欢迎） |
-
----
-
-## 8. 风险评估与缓解
-
-### 8.1 技术风险
-
-| 风险 | 影响 | 概率 | 缓解措施 |
-|------|------|------|----------|
-| 适配器迁移中断现有功能 | 高 | 中 | 新旧目录并存，ComponentDiscovery 同时扫描两个目录，逐个适配器迁移验证 |
-| 事件模型不兼容导致插件崩溃 | 高 | 低 | 兼容层保证旧事件类型继续工作，新增类不修改旧类 |
-| 数据库迁移失败 | 高 | 低 | 迁移脚本做前置校验，`use_pipeline_uuid` 在过渡期保留不删除 |
-| RequestRunner 解耦破坏 Pipeline | 高 | 中 | Agent Handler 调用 Runner 的路径独立于 Pipeline，不修改现有 Pipeline Stage 中的 Runner 调用逻辑 |
-| 性能回退（EventBus 额外开销） | 中 | 低 | EventBus 在进程内同步分发，无额外序列化/网络开销 |
-| 各平台事件差异大难以统一 | 中 | 中 | 通用事件只抽象最大公约数字段，差异部分保留在 `source_platform_object`；不支持的事件走 `PlatformSpecificEvent` |
-
-### 8.2 兼容性风险
-
-| 风险 | 缓解措施 |
-|------|----------|
-| 现有插件使用旧事件类 | 兼容层自动将新事件转为旧事件分发，两种事件类都能注册 handler |
-| 现有插件调用 `reply()` / `send_message()` | 这两个 API 保持不变，只是底层实现可能微调 |
-| 第三方基于 `AbstractMessagePlatformAdapter` 开发的适配器 | 旧基类保留，新基类继承旧基类，第三方适配器无需立即迁移 |
-| 用户自定义 Pipeline 配置 | Pipeline 机制完整保留，PipelineHandler 只是入口变了（从 RuntimeBot 硬编码变为 EventRouter 配置） |
-
-### 8.3 回滚策略
-
-每个 Phase 独立可回滚：
-
-- **Phase 1**（SDK 新增类）：删除新增文件，回退 SDK 版本号
-- **Phase 2**（适配器目录）：恢复 `components.yaml` 的 `fromDirs` 指向旧目录，旧 sources/ 未删除
-- **Phase 3**（核心系统）：回退数据库迁移，恢复 RuntimeBot 旧的硬编码回调
-- **Phase 4**（插件集成）：回退 SDK 版本，插件使用旧版 SDK
-- **Phase 5**（WebUI）：前端回退，Bot 编辑页面隐藏事件处理面板
-
----
-
-## 9. 里程碑与时间线建议
-
-| 里程碑 | 阶段 | 预期产出 |
-|--------|------|----------|
-| M1 | Phase 1 完成 | SDK 新版本发布，包含新事件/实体/基类定义 |
-| M2 | Phase 2 首批适配器（Telegram + Discord） | 两个参考实现，验证目录结构和事件/API 体系 |
-| M3 | Phase 3 核心系统 | EventBus + EventRouter + 四种 Handler 可用 |
-| M4 | Phase 2 剩余适配器 | 所有活跃适配器迁移完成 |
-| M5 | Phase 4 插件集成 | 新 SDK 发布，插件可使用新事件和 API |
-| M6 | Phase 5 WebUI | 事件处理器编排面板上线 |
-| M7 | Phase 6 文档 | 开发者文档和示例更新完毕 |
-
-建议 M1-M3 作为第一个大版本发布（如 v5.0），M4-M7 在后续小版本迭代中完成。
-
----
-
-## 10. 开发指引
-
-### 10.1 分支策略
-
-建议在主仓库创建 `feature/eba` 长期特性分支，各 Phase 在子分支上开发后合入特性分支：
-
-```
-main
-  └── feature/eba
-        ├── feature/eba-sdk-entities      (Phase 1)
-        ├── feature/eba-adapter-telegram   (Phase 2)
-        ├── feature/eba-adapter-discord    (Phase 2)
-        ├── feature/eba-core-system        (Phase 3)
-        ├── feature/eba-plugin-sdk         (Phase 4)
-        └── feature/eba-webui              (Phase 5)
-```
-
-### 10.2 测试策略
-
-| 层次 | 测试内容 | 工具 |
-|------|----------|------|
-| 单元测试 | 事件序列化/反序列化、实体构造、API 调用 mock | pytest |
-| 集成测试 | EventBus → EventRouter → Handler 全链路 | pytest + asyncio |
-| 适配器测试 | 各适配器的事件转换、消息转换、API 调用 | pytest + mock SDK |
-| 端到端测试 | 从模拟平台事件到完整处理流程 | staging 环境 |
-| 插件兼容性测试 | 旧插件在新系统下的行为 | langbot-plugin-demo |
-
-### 10.3 代码审查关注点
-
-- 新增代码是否影响现有行为
-- 兼容层是否正确映射所有旧事件/API 场景
-- 数据库迁移是否可逆
-- 新 API 的错误处理（`NotSupportedError`）是否一致
-- 事件模型的序列化在 stdio/WebSocket 通信中是否正确

docs/event-based-agents/07-agent-orchestration.md

@@ -1,187 +0,0 @@
-# Agent 统一编排（产品最终形态）
-
-> **状态**：方向修订稿（2026-06-12），供「适配器改造 / Agent 插件化 / 工作流引擎」三条工作线评审。
->
-> 本文档修订 [00-overview.md](./00-overview.md) §3.4 与 [04-event-routing.md](./04-event-routing.md) 中"四种 Handler"的编排模型：**所有编排目标统一收编为 Agent 抽象**。事件路由的匹配机制、数据迁移策略、WebUI 交互骨架等内容仍以 04 为准，仅 handler 分类法被本文档取代。
-
-## 1. 产品最终形态
-
-**适配器接收各种事件 → 用户编排处理逻辑 → Agent 统一抽象**，实现从 0 代码到低代码再到全代码的全层面支持：
-
-```
-消息平台 (Telegram / Discord / 企微 / ...)
-  │ 各类平台事件
-  ▼
-平台适配器（EBA 新结构，已迁移 12 个）
-  │ EBAEvent (message.* / group.* / friend.* / bot.* / feedback.* / platform.*)
-  ▼
-EventRouter（事件 → Agent 绑定）
-  ├─→ 选中的 Agent（响应者，单一仲裁）
-  │     ├─ 内置：pipeline-wrapper（旧流水线收编）/ local-agent
-  │     ├─ 插件：SDK Agent 组件（全代码）
-  │     ├─ 低代码：工作流定义的 Agent（内部工作流引擎）
-  │     └─ 外部：dify / n8n / coze / dashscope / webhook（RequestRunner 体系收编）
-  │
-  └─→ 插件 EventListener（观察者，N 个广播，可 prevent_default）
-```
-
-| 编写方式 | Agent 形态 | 代码化程度 |
-|----------|-----------|-----------|
-| WebUI 配置模型 + 提示词 + 工具 | 内置 local-agent | 0 代码 |
-| 沿用现有流水线 | pipeline-wrapper 内置 Agent | 0 代码（兼容） |
-| 市场安装 | Agent 插件（市场分发） | 0 代码（使用者视角） |
-| 可视化工作流 | 工作流引擎定义的 Agent | 低代码 |
-| 对接外部平台 | dify / n8n / coze / webhook 外部 Agent | 集成 |
-| SDK 编写 | Agent 插件组件 | 全代码 |
-
-### 1.1 三条并行工作线与汇合点
-
-| 工作线 | 范围 | 在本架构中的位置 |
-|--------|------|------------------|
-| 适配器改造（refactor/eba，本分支） | 事件体系、适配器结构、平台 API、EventRouter | 事件的**生产侧** + 路由层 |
-| Agent 插件化 | Agent 抽象、Agent 组件类型、市场分发 | 事件的**消费侧**统一抽象 |
-| 工作流引擎 | 内部低代码工作流 | Agent 的一种**编写方式** |
-
-**汇合点是 SDK 的 Agent 组件契约（§4）与 event→agent 绑定模型（§3）**。这两个接口冻结后，三条线可彼此 mock 独立推进。契约由本分支（EBA）牵头起草，三线评审后在 langbot-plugin-sdk 落地（发布通道：0.5.0aX pre-release 已打通）。
-
-## 2. 从四种 Handler 到 Agent 统一抽象
-
-### 2.1 演进理由
-
-04 文档中的 pipeline / agent / webhook / plugin 四种 handler_type，本质上都是"对事件作出响应的逻辑"，差别只在编写和部署方式。为四种类型分别设计配置表单、执行语义和扩展机制，等于把同一个概念做四遍。统一为 Agent 后：
-
-- **产品**：用户只学一个概念——"给 Bot 的事件绑 Agent"；
-- **工程**：路由层退化为很薄的 event → agent 分发，所有扩展集中到 Agent 抽象；
-- **生态**：Agent 成为市场上可分发、可复用的一等公民。
-
-### 2.2 收编映射
-
-| 原 handler_type（04 文档） | 收编后 |
-|---------------------------|--------|
-| `pipeline` | 内置 `pipeline-wrapper` Agent：实例配置为 `pipeline_uuid`，进程内直接复用 MessageAggregator → QueryPool → Pipeline 机制 |
-| `agent`（RequestRunner） | 现有 Runner 体系（local-agent / dify / n8n / coze / dashscope / langflow / tbox）整体收编为内置 Agent 家族——Runner 本来就是"Agent 抽象"的前身 |
-| `webhook` | 外部 Agent 的一种：事件 POST 出去、响应解析为动作（保留 04 §5.4 的请求/响应格式） |
-| `plugin`（EventListener 分发） | **不收编**——角色不同，见 §2.3 |
-
-### 2.3 响应者与观察者的角色切分
-
-事件的消费方有两种角色，不应混为一谈：
-
-- **响应者（Agent）**：路由选中**一个**，负责对事件作出回应（回复消息、执行动作）。多条绑定匹配同一事件时按 priority 仲裁，只取最高者。
-- **观察者（插件 EventListener）**：**广播**给所有注册插件，做旁路逻辑（日志、审计、风控、统计）。沿用现有机制不变，包括 `prevent_default()`——观察者可拦截本次事件，使 Agent 不被调用（与现有"插件拦截流水线"行为完全兼容）。
-
-执行顺序：事件到达 → 先广播观察者（按插件优先级）→ 若未被 prevent_default → 分发给选中的 Agent。
-
-## 3. 数据模型：event → agent 绑定
-
-### 3.1 Agent 实体化（推荐）
-
-Agent 作为一等实体（独立表），用户先创建/安装 Agent，再在 Bot 上把事件绑定到 Agent。好处：跨 Bot 复用、市场分发、独立的配置页面。
-
-```python
-class Agent(Base):
-    """Agent 实例：一个具体配置过的、可被事件绑定的响应者"""
-    uuid: str                # 主键
-    name: str
-    kind: str                # "builtin" | "plugin"
-    component_ref: str       # 内置: "pipeline-wrapper" / "local-agent" / "dify" / "webhook" / ...
-                             # 插件: "<plugin_author>/<plugin_name>/<agent_component_name>"
-    config: dict             # JSON — 实例配置（pipeline_uuid / 模型与提示词 / 外部平台凭据 / 工作流 id ...）
-    # 多租户预留：归属主体字段（tenant/workspace），首版可空
-```
-
-Bot 上的绑定配置（替代 04 §2.2 的 EventHandlerConfig，沿用其匹配语义）：
-
-```python
-class EventBinding(pydantic.BaseModel):
-    event_type: str          # 精确 / "message.*" / "*"，匹配规则同 04 §4
-    agent_uuid: str          # 绑定的 Agent 实例
-    enabled: bool = True
-    priority: int = 0        # 多条匹配时取最高者（单一仲裁）
-    description: str = ''
-```
-
-`use_pipeline_uuid` 自动迁移：为每个被引用的 pipeline 生成一个 `pipeline-wrapper` Agent 实例，并写入 `{"event_type": "message.received", "agent_uuid": <wrapper>}` 绑定。观察者广播不需要配置（始终发生），04 中"兜底 plugin 规则"不再需要。
-
-## 4. SDK Agent 组件契约（草案）
-
-Agent 成为插件系统的第七种组件（现有：Command / Tool / EventListener / KnowledgeEngine / Parser / Page）。
-
-### 4.1 Manifest
-
-```yaml
-apiVersion: v1
-kind: Agent
-metadata:
-  name: group-assistant
-  label: { en_US: Group Assistant, zh_Hans: 群助理 }
-spec:
-  handled_events:            # 声明可处理的事件类型；绑定 UI 据此过滤
-    - message.received
-    - group.member_joined
-  config:                    # 实例化配置 schema，复用现有组件配置体系
-    - name: model
-      type: llm-model-selector
-    - name: persona
-      type: prompt-editor
-execution:
-  python: { path: agent.py, attr: GroupAssistant }
-```
-
-### 4.2 运行时接口
-
-```python
-class Agent(BaseComponent):
-    async def handle(self, ctx: AgentContext) -> typing.AsyncGenerator[AgentChunk, None]:
-        """处理一次事件，流式产出回复与动作。每次事件调用一次。"""
-        ...
-
-class AgentContext:
-    event: EBAEvent              # 触发事件（统一事件体系）
-    bot: BotHandle               # 来源 Bot 信息
-    session: SessionHandle       # 会话句柄：历史消息、会话变量（LangBot 侧管理，Agent 保持无状态）
-    config: dict                 # 该 Agent 实例的配置
-
-    # 能力面（经 runtime RPC 回 LangBot 执行）：
-    async def reply(self, chain: MessageChain, quote: bool = False): ...
-    async def send_message(self, target_type: str, target_id: str, chain: MessageChain): ...
-    async def call_platform_api(self, action: str, params: dict) -> dict: ...
-    async def invoke_llm(self, model_uuid: str, messages: list, funcs: list = None) -> dict: ...
-    # + 工具调用 / KB 检索 / 插件存储（沿用 LangBotAPIProxy 既有方法）
-
-class AgentChunk:
-    delta_message: MessageChain | None = None   # 增量回复（流式）
-    actions: list[dict] | None = None           # 平台动作（同 webhook response_actions 格式）
-    final: bool = False
-```
-
-**流式**：复用 SDK 通信协议既有的 `chunk_status: continue/end` 机制，`handle()` 的每次 yield 对应一个 chunk。
-**内置与插件同构**：内置 Agent（pipeline-wrapper、local-agent、各外部平台）在 LangBot 进程内实现同一接口注册，不过 RPC；插件 Agent 经 plugin runtime 分发。对路由层二者不可区分。
-
-### 4.3 执行语义与可靠性
-
-| 关注点 | 约定 |
-|--------|------|
-| 仲裁 | 单响应者：priority 最高的匹配绑定生效，其余忽略 |
-| 性能 | 内置 Agent 进程内零额外开销；插件 Agent 每事件过一次 RPC 边界，消息场景需设延迟预算（评审项：目标 P95 附加延迟） |
-| 会话状态 | 归 LangBot 侧（SessionHandle），插件 Agent 原则上无状态，崩溃重启不丢会话 |
-| 降级 | Agent 调用失败/超时：可配置 fallback（回错误提示，或指定备用 Agent）；pipeline-wrapper 作为进程内兜底与性能对照组 |
-| 多租户预留 | AgentContext / SessionHandle / 存储接口显式携带归属主体标识，禁止新增全局单例状态——为后续轻量 SaaS 多租户铺路 |
-
-## 5. 发布火车
-
-| 版本 | 内容 | 备注 |
-|------|------|------|
-| 4.11（可选） | 现状成果：12 个 EBA 适配器、插件全事件订阅、`call_platform_api` | 对用户不可见的管道工程 + 插件新能力，不动产品概念 |
-| **5.0** | 产品形态首发：EventRouter + event→agent 绑定 + WebUI 编排 + 数据迁移 + 内置 Agent（pipeline-wrapper、local-agent、外部平台家族）+ SDK Agent 组件契约（可标 experimental） | 资格线不依赖其他两线交付；配 SDK 0.5.0 正式版；走 beta 周期；deprecation（旧 sources 适配器、legacy/*、use_pipeline_uuid）集中在此窗口处理 |
-| 5.x | 工作流 Agent（工作流引擎线挂入）、Agent 市场生态、剩余适配器（satori 等）、Agent 插件化收尾 | 验证开放注册机制 |
-| 多租户 | 独立评估：仅数据隔离 → 5.x 部署选项；伴随权限/计费/产品定位变化 → 6.0 | 前置条件是 §4.3 的归属主体预留已落实 |
-
-## 6. 开放问题（评审清单）
-
-1. **webhook 的最终定位**：作为外部 Agent（响应者，现方案）之外，是否还需要"纯通知观察者"形态（现 WebhookPusher 的角色）？
-2. **多 Agent 协作**：单一仲裁之外，是否需要"串联/并联多个 Agent"的场景？（建议 5.0 不做，留给工作流引擎表达）
-3. **工作流引擎的宿主**：核心内置，还是自身也作为一个插件交付（解释工作流定义的 Agent 插件）？
-4. **插件 Agent 的延迟预算**：消息主链路过 RPC 的 P95 目标值与压测方案。
-5. **Pipeline 的长期命运**：pipeline-wrapper 兼容期多长，Stage 体系是否在 6.0 退役或被工作流引擎吸收。
-6. **SDK 1.0 时机**：Agent 契约稳定后是否随 LangBot 5.x 给插件生态一个 API 稳定承诺。

docs/event-based-agents/adapters/00-index.md

@@ -1,41 +0,0 @@
-# EBA Adapter Migration Records
-
-This directory records adapter-level migration details for the Event-Based Agents architecture. Each adapter document should be kept close to the implementation and must answer four questions:
-
-1. What changed in the adapter structure.
-2. Which configuration fields are required.
-3. Which events and APIs are supported.
-4. What has been verified end to end.
-
-## Adapter Documents
-
-General acceptance checklist: [EBA Adapter Acceptance Checklist](./acceptance-checklist.md)
-
-Current acceptance report: [EBA Adapter Acceptance Report](./acceptance-report.md)
-
-| Adapter | Status | Document |
-|---------|--------|----------|
-| Telegram | Migrated; partial plugin E2E, real UI inbound image/file verified | [Telegram](./telegram.md) |
-| Discord | Migrated; partial plugin E2E, media-inbound gaps remain | [Discord](./discord.md) |
-| OneBot v11 / aiocqhttp | Migrated; Matcha UI plus protocol-level multi-component coverage | [OneBot v11 / aiocqhttp](./aiocqhttp.md) |
-| DingTalk | Migrated; partial plugin E2E, real UI inbound image/file verified; group gap remains | [DingTalk](./dingtalk.md) |
-| Lark / Feishu | Migrated; partial live text E2E, media-inbound gap remains | [Lark / Feishu](./lark.md) |
-| WeCom | Migrated; private text plugin E2E verified, media/group gaps remain | [WeCom](./wecom.md) |
-| WeComBot | Migrated; private text and outbound/API plugin E2E verified, feedback/group gaps remain | [WeComBot](./wecombot.md) |
-| Official Account | Migrated; private text plugin E2E verified, proactive outbound not supported | [Official Account](./officialaccount.md) |
-| QQ Official API | Migrated; WebSocket inbound reached LangBot, model config blocked reply | [QQ Official API](./qqofficial.md) |
-| Slack | Migrated; private text and outbound/API plugin E2E verified | [Slack](./slack.md) |
-| WeCom Customer Service | Migrated; customer-side UI text plugin E2E verified, inbound media and platform-API live coverage pending | [WeCom Customer Service](./wecomcs.md) |
-| Kook | Migrated; unit/mocked converter and API coverage only, live acceptance pending | [Kook](./kook.md) |
-
-## Documentation Checklist
-
-When migrating a new adapter, add one document here with:
-
-- Configuration table matching the adapter manifest.
-- Supported event list.
-- Supported common API list.
-- Supported `call_platform_api` action list.
-- Known unsupported APIs and the reason.
-- Live test notes, including platform, channel type, destructive operations, and residual risks.
-- A clear distinction between real UI inbound media, protocol-level injected inbound media, and bot outbound media.

docs/event-based-agents/adapters/acceptance-checklist.md

@@ -1,208 +0,0 @@
-# EBA Adapter Acceptance Checklist
-
-This checklist is the architecture-level acceptance standard for every Event-Based Agents platform adapter. It is not platform-specific. Adapter migration is not complete until the adapter has a written result against this checklist.
-
-## Evidence Levels
-
-Use these evidence levels consistently in adapter records:
-
-| Level | Meaning | Can Mark Complete |
-|-------|---------|-------------------|
-| `plugin-e2e-ui` | Real SDK plugin running through standalone runtime, LangBot core, the migrated adapter, and a real platform/simulator UI action. | Yes |
-| `plugin-e2e-protocol` | Real SDK plugin running through standalone runtime, LangBot core, and the migrated adapter from a protocol-boundary event injection, such as a OneBot reverse WebSocket event. | Partial; must not be claimed as UI coverage |
-| `plugin-e2e-outbound` | Real SDK plugin calls an API and the bot output is visible in the real platform/simulator UI. | Yes for send/API coverage only |
-| `adapter-live` | Direct adapter probe connected to a real or simulator platform endpoint, bypassing plugin runtime. | No, auxiliary only |
-| `unit` | Unit/API-shape tests with mocked platform SDK objects or mocked APIs. | No, auxiliary only |
-| `not-supported` | Platform protocol or SDK has no equivalent capability. Must include reason and source. | Yes, as explicitly unsupported |
-| `blocked` | Intended capability could not be verified because of credentials, permissions, endpoint gaps, or simulator gaps. | No |
-
-The primary acceptance path must be `plugin-e2e-ui` for inbound UI-triggered behavior and `plugin-e2e-outbound` for bot send/API behavior. `adapter-live`, `plugin-e2e-protocol`, and `unit` tests are useful, but they must be labelled precisely.
-
-## Required Architecture Path
-
-Every adapter must prove this full path:
-
-```text
-Real platform / simulator UI
-  -> platform SDK native event
-  -> adapter event converter
-  -> unified EBA event/entity/message types
-  -> LangBot core event dispatch
-  -> standalone SDK runtime
-  -> real test plugin listener
-  -> plugin calls platform APIs through SDK
-  -> LangBot core API dispatch
-  -> adapter API implementation
-  -> real platform / simulator UI
-```
-
-The test plugin must record JSONL evidence containing:
-
-- event class and `event.type`
-- `bot_uuid` and `adapter_name` as received by the plugin
-- adapter name
-- chat type and chat ID
-- sender/user/group IDs with secrets redacted
-- message component list for received messages
-- API action name, input summary, result or error
-- raw unsupported/blocked reason when an item is skipped
-
-## Required Message Receive Tests
-
-For every adapter, inbound message conversion must be tested through `plugin-e2e-ui` for each component the platform can receive. If a protocol-level injection is used, label it `plugin-e2e-protocol`; it proves the adapter/core/plugin path, but it does not prove that the user-facing platform UI can send that component. If the platform UI/simulator cannot create a component, record it as `blocked` with the endpoint limitation.
-
-| Component | Required Receive Assertion |
-|-----------|----------------------------|
-| `Source` | Message ID and timestamp are present and stable enough for reply/get/delete APIs. |
-| `Plain` | Text is preserved exactly, including spaces and multi-line content. |
-| `At` | Mentioned user ID is converted to common `At.target`. |
-| `AtAll` | Broadcast mention is converted to common `AtAll`, if platform supports it. |
-| `Image` | Image ID, URL, path, or base64 is represented without leaking platform-native segment shape. |
-| `Voice` | Voice/audio component is represented as `Voice` when the platform exposes it. |
-| `File` | File name, ID/URL, and size are represented as `File` when available. |
-| `Quote` | Reply/quote source ID and origin content are represented when the platform exposes it. |
-| `Face` | Native emoji/sticker/dice/rps-like components are represented as `Face` or documented as platform-specific. |
-| `Forward` | Merged/forwarded messages are represented as `Forward` when the platform exposes structured content. |
-| `Unknown` | Unsupported native segments become `Unknown` or `PlatformSpecificEvent` data, not crashes. |
-| Mixed chain | A message containing multiple component types preserves order. |
-
-The plugin must subscribe to `MessageReceivedEvent` and assert that `message_chain` contains common `langbot_plugin.api.entities.builtin.platform.message` components, not platform-native SDK objects.
-
-## Required Message Send Tests
-
-For every adapter, outbound message conversion must be tested through `plugin-e2e-outbound` by having the plugin call SDK platform APIs and verifying the platform UI/simulator receives the expected message.
-
-| Component | Required Send Assertion |
-|-----------|-------------------------|
-| `Plain` | Text appears exactly on the platform. |
-| `At` | User mention renders as a mention or platform equivalent. |
-| `AtAll` | Broadcast mention renders or is explicitly unsupported. |
-| `Image` | URL, path, or base64 image sends and renders/downloads correctly. |
-| `Voice` | Voice/audio sends when supported. |
-| `File` | File sends with name and content/link when supported. |
-| `Quote` | Quoted reply points to the original message when supported. |
-| `Face` | Native emoji/sticker/dice/rps sends or is explicitly unsupported. |
-| `Forward` | Forward/merged-forward sends when supported; otherwise fallback behavior is documented. |
-| Mixed chain | A mixed chain preserves component order as closely as the platform allows. |
-
-If a platform supports a component only in one direction, the adapter record must say so explicitly.
-
-## Required Event Tests
-
-The plugin must subscribe to every event declared in `manifest.yaml -> spec.supported_events` and record one of `plugin-e2e-ui`, `plugin-e2e-protocol`, `not-supported`, or `blocked`.
-
-| Event | Required Assertion |
-|-------|--------------------|
-| `message.received` | Real message reaches plugin as `MessageReceivedEvent`. |
-| `message.edited` | Edited message reaches plugin with message ID and new content, if declared. |
-| `message.deleted` | Deleted/recalled message reaches plugin with message ID and operator when available, if declared. |
-| `message.reaction` | Reaction add/remove reaches plugin with message ID, user, reaction, and direction, if declared. |
-| `feedback.received` | Feedback payload reaches plugin with feedback type and message/session IDs, if declared. |
-| `group.member_joined` | Join event reaches plugin with group and member. |
-| `group.member_left` | Leave/kick event reaches plugin with group, member, and kick flag. |
-| `group.member_banned` | Mute/ban event reaches plugin with group, member, operator, and duration. |
-| `group.info_updated` | Group metadata update reaches plugin with changed fields, if declared. |
-| `friend.request_received` | Friend request reaches plugin with request ID and message. |
-| `friend.added` | Friend-added event reaches plugin. |
-| `friend.removed` | Friend-removed event reaches plugin, if declared. |
-| `bot.invited_to_group` | Bot invite/join request reaches plugin with group and inviter/request ID. |
-| `bot.removed_from_group` | Bot removal reaches plugin with group and operator when available. |
-| `bot.muted` | Bot mute reaches plugin with duration. |
-| `bot.unmuted` | Bot unmute reaches plugin. |
-| `platform.specific` | At least one unmapped native event is delivered as structured platform-specific data, if declared. |
-
-Do not declare an event in the manifest unless there is an implementation path and an acceptance entry.
-
-## Required Common API Tests
-
-The plugin must call every common API declared in `manifest.yaml -> spec.supported_apis.required` and `optional`. Each call must be recorded with input summary and result.
-
-| API | Required Assertion |
-|-----|--------------------|
-| `send_message` | Plugin sends to private and group/channel targets where supported. |
-| `reply_message` | Plugin replies to the triggering message, with quoted mode tested when supported. |
-| `edit_message` | Plugin edits a bot-sent message, if declared. |
-| `delete_message` | Plugin deletes/recalls a bot-sent message, if declared and permissions allow. |
-| `forward_message` | Plugin forwards or emulates forwarding a real message, if declared. |
-| `get_message` | Plugin retrieves a real message and receives common `MessageReceivedEvent` shape. |
-| `get_group_info` | Plugin receives `UserGroup` with ID/name/count where available. |
-| `get_group_list` | Plugin receives joined groups/channels list where supported. |
-| `get_group_member_list` | Plugin receives list of `UserGroupMember` where supported. |
-| `get_group_member_info` | Plugin receives one member with role/display name where available. |
-| `set_group_name` | Plugin changes and restores a disposable group name, if declared. |
-| `mute_member` | Plugin mutes a disposable target, if declared. |
-| `unmute_member` | Plugin unmutes the same target, if declared. |
-| `kick_member` | Plugin kicks a disposable target only in destructive test mode, if declared. |
-| `leave_group` | Plugin leaves only in destructive test mode and only at the end, if declared. |
-| `get_user_info` | Plugin receives common `User` shape. |
-| `get_friend_list` | Plugin receives friend/contact list where supported. |
-| `approve_friend_request` | Plugin accepts/rejects a disposable friend request, if declared. |
-| `approve_group_invite` | Plugin accepts/rejects a disposable group invite, if declared. |
-| `upload_file` | Plugin uploads a real small file, if declared. |
-| `get_file_url` | Plugin resolves a real file ID to a URL, if declared. |
-| `call_platform_api` | Plugin calls every declared platform-specific action with safe parameters. |
-
-Destructive APIs must be opt-in and documented with the exact target used.
-
-The SDK must expose a plugin-side platform API escape hatch for adapter-specific actions. The acceptance plugin should call it from the same EBA event handler that received the real platform event, so the evidence proves both directions of the path:
-
-```text
-plugin -> SDK call_platform_api -> LangBot core -> adapter call_platform_api -> platform SDK/API
-```
-
-The result must be serialized into JSON-safe values before it is returned to the plugin runtime.
-
-## Platform-Specific API Tests
-
-Every action listed in `manifest.yaml -> spec.platform_specific_apis` must have one acceptance entry:
-
-- `plugin-e2e-ui` or `plugin-e2e-outbound`: called by the plugin against the live/simulator endpoint.
-- `plugin-e2e-protocol`: called by the plugin after a protocol-boundary injected event; useful for endpoint-specific simulators but must be labelled.
-- `not-supported`: removed from manifest or explained if the platform SDK exposes it but this adapter intentionally does not.
-- `blocked`: endpoint did not implement it, permissions missing, or safe fixture unavailable.
-
-Do not leave a platform-specific API in the manifest without a corresponding test record.
-
-## Required Compatibility Tests
-
-Each migrated adapter must also prove:
-
-- Manifest supported events match `adapter.get_supported_events()`.
-- Manifest supported APIs match `adapter.get_supported_apis()`.
-- Manifest platform-specific actions match `PLATFORM_API_MAP`.
-- Legacy `FriendMessage` / `GroupMessage` listeners still work when the core registers them.
-- EBA listener dispatch prefers the most specific event class, then `EBAEvent`, then base `Event`.
-- Self-message filtering prevents bot echo loops without dropping edit/delete/moderation events needed for API tests.
-- `source_platform_object` is present for reply/debug but not required by plugins for common behavior.
-
-## Required Documentation Per Adapter
-
-Each adapter document must include:
-
-- adapter directory and manifest name
-- config table
-- supported event table with evidence level per event
-- supported common API table with evidence level per API
-- platform-specific API table with evidence level per action
-- receive component table with evidence level per component
-- send component table with evidence level per component
-- exact test date
-- exact platform endpoint or simulator used
-- standalone runtime command
-- plugin path/name used for testing
-- evidence JSONL path
-- destructive operations performed or explicitly skipped
-- blocked items and reasons
-
-## Acceptance Rule
-
-An adapter can be marked migrated only when:
-
-1. All declared events have `plugin-e2e-ui`, justified `plugin-e2e-protocol`, or `not-supported` evidence.
-2. All declared APIs have `plugin-e2e-outbound` or `not-supported` evidence.
-3. All platform-supported receive components have `plugin-e2e-ui` evidence; protocol-only receive coverage keeps the status partial.
-4. All platform-supported send components have `plugin-e2e-outbound` evidence.
-5. Unit tests cover conversion and API-shape boundaries.
-6. The adapter document lists every blocked or skipped item honestly.
-
-If any declared capability is only covered by `adapter-live` or `unit`, the adapter status must remain partial.

docs/event-based-agents/adapters/acceptance-report.md

@@ -1,171 +0,0 @@
-# EBA Adapter Acceptance Report
-
-Date: May 10, 2026
-
-Scope:
-
-- `telegram-eba`
-- `discord-eba`
-- `aiocqhttp-eba`
-- `dingtalk-eba`
-- `lark-eba`
-- `wecom-eba`
-- `wecombot-eba`
-- `wecomcs-eba`
-- `officialaccount-eba`
-- `qqofficial-eba`
-- `slack-eba`
-
-This report follows `acceptance-checklist.md`. Evidence levels are intentionally strict:
-
-- `plugin-e2e-ui`: real platform or simulator UI event reached LangBot, standalone runtime, and `EBAEventProbe`.
-- `plugin-e2e-protocol`: real adapter endpoint event reached LangBot, standalone runtime, and `EBAEventProbe`, but the event was injected at the platform protocol boundary rather than sent through the UI.
-- `plugin-e2e-outbound`: the plugin called SDK APIs and the resulting bot message was visible on the platform.
-- `unit`: mocked converter/API coverage only.
-- `blocked`: not completed, either because the platform/simulator/client could not trigger it or because a safe disposable fixture was unavailable.
-- `not-supported`: the platform has no equivalent capability.
-
-## Summary
-
-| Adapter | Status | Honest acceptance summary |
-|---------|--------|---------------------------|
-| Telegram | Partial EBA acceptance | Real Telegram UI covered private text, group mention text, bot invite, inbound private image/file, outbound component sweep, safe SDK APIs, and safe Telegram platform APIs. Real UI inbound voice/quote was not completed in the latest plugin run. |
-| Discord | Partial EBA acceptance | Real Discord UI covered group text, outbound image/file/quote/mention components, safe SDK APIs, and safe Discord platform APIs. Real UI inbound attachment/image/file/reply/mention was not completed. A later UI retry was blocked because the Discord client kept the send button disabled. |
-| OneBot v11 / aiocqhttp | Partial EBA acceptance | Matcha UI covered real group text and outbound supported components/APIs. Multi-component inbound `Source/Plain/At/Face/Image/Voice/File/Quote` was verified through the real OneBot reverse WebSocket adapter endpoint, but not through Matcha UI upload/send. Matcha blocks file-send and merged-forward APIs. |
-| DingTalk | Partial EBA acceptance | Real DingTalk UI covered private text, emoji-as-text inbound, private inbound image/file, outbound image/file/quote/mention fallback components, safe SDK APIs, and safe DingTalk platform APIs. Real UI inbound voice/quote and group trigger were not completed. |
-| Lark / Feishu | Partial EBA acceptance | EBA adapter structure, self-built/store app config, WebSocket/Webhook mode handling, converters, common APIs, platform APIs, and unit tests are in place. One real LangBot organization WebSocket private text event reached `EBAEventProbe`; outbound component sweep was visible in Feishu. Latest real UI image/file sends did not reach local plugin evidence, so media receive remains blocked. |
-| WeCom | Partial EBA acceptance | Regular WeCom application-message adapter is split into the EBA directory with manifest, converters, API mixin, platform API map, and unit tests. Private text reached `EBAEventProbe` through standalone runtime and the real WeCom client; safe plugin APIs passed. Real inbound media and broader event coverage remain pending. |
-| WeComBot | Partial EBA acceptance | WeCom AI Bot is split into the EBA directory with WebSocket long connection mode and optional webhook mode, EBA message/feedback/platform-specific conversion, cache-backed common APIs, platform API map, unit tests, and a direct live probe. Private text, outbound component sweep, safe common APIs, and all declared WeComBot platform APIs reached `EBAEventProbe`; group, real inbound media, and feedback callback evidence remain pending. |
-| WeCom Customer Service | Partial EBA acceptance | WeCom Customer Service is split into the EBA directory with manifest, converters, API mixin, platform API map, unit tests, docs, and a direct live probe scaffold. Real WeChat customer-side UI text reached `EBAEventProbe`; plugin outbound text/image and safe cache-backed common APIs passed. Inbound media and platform-specific API live coverage remain pending; later fallback text sends were blocked by WeCom `95001 send msg count limit`. |
-| Official Account | Partial EBA acceptance | WeChat Official Account is split into the EBA directory with manifest, converters, cache-backed safe APIs, platform API map, unit tests, and a direct live probe scaffold. Real WeChat Official Account UI private text reached `EBAEventProbe`; safe cache-backed common APIs and declared platform APIs passed. Proactive outbound `send_message` is not supported because replies must be tied to inbound webhook windows; inbound image/voice live UI evidence remains pending. |
-| QQ Official API | Partial EBA acceptance | QQ Official API is split into the EBA directory with manifest, converters, cache-backed safe APIs, platform API map, unit tests, docs, and a direct live probe scaffold. A real WebSocket-mode QQ Official bot reached the LangBot pipeline on `dev.rockchin.top`; reply/outbound evidence is blocked by the test model provider returning `model_not_found` for `deepseek-v3`. |
-| Slack | Partial EBA acceptance | Slack is split into the EBA directory with manifest, converters, cache-backed safe APIs, platform API map, unit tests, docs, and a direct live probe scaffold. Real Slack private text reached `EBAEventProbe`; safe common APIs, outbound component fallback sweep, and declared Slack platform APIs passed. Channel mention and real inbound media evidence remain pending. |
-
-Telegram and DingTalk now have real user-side UI image/file upload evidence in plugin JSONL. Discord and aiocqhttp do not yet have real UI inbound image/file evidence.
-
-## Evidence Files
-
-| Adapter | Endpoint | Evidence |
-|---------|----------|----------|
-| Telegram private | Telegram Lite, `@rockchinq_bot` private chat | `data/temp/telegram-plugin-e2e-rerun.jsonl` |
-| Telegram private media | Telegram Lite, `@rockchinq_bot` private chat | `data/temp/telegram-plugin-e2e-media-ui.jsonl` |
-| Telegram group | Telegram Lite, `Rock'sBotGroup` | `data/temp/telegram-plugin-e2e-group.jsonl` |
-| Discord | Discord client, LangBot server, `#debugging` | `data/temp/discord-plugin-e2e-20260510-final.jsonl` |
-| aiocqhttp UI | local Matcha, group `test group` | `data/temp/aiocqhttp-plugin-e2e-20260510-multiformat.jsonl` |
-| aiocqhttp protocol | OneBot reverse WebSocket endpoint `127.0.0.1:2280/ws` | `data/temp/aiocqhttp-plugin-e2e-20260510-multiformat.jsonl` |
-| DingTalk | DingTalk Mac, `LangBot Team` org private chat | `data/temp/dingtalk-plugin-e2e-20260510-rerun.jsonl` |
-| DingTalk private media | DingTalk Mac, `LangBot Team` org private chat | `data/temp/dingtalk-plugin-e2e-media-ui.jsonl` |
-| Lark / Feishu unit | local mocked Feishu SDK/client paths | `tests/unit_tests/platform/test_lark_eba_adapter.py` |
-| Lark / Feishu partial live | Feishu Mac, LangBot organization `LangBotDev` private chat | `data/temp/lark-plugin-e2e-ws.jsonl` |
-| WeCom Customer Service | WeChat customer-side UI, `客服消息 -> 浪波智能客服` on `dev.rockchin.top` | `/home/wgc/LangBotxg/LangBotEbaTest/data/temp/wecomcs_eba_plugin_probe.jsonl` |
-| Official Account | WeChat desktop client, subscribed Official Account on `dev.rockchin.top` | `/home/wgc/LangBotxg/LangBotEbaTest/data/temp/officialaccount_eba_plugin_probe.jsonl` |
-| QQ Official API unit | local mocked QQ Official client paths | `tests/unit_tests/platform/test_qqofficial_eba_adapter.py` |
-| Slack unit | local mocked Slack client paths | `tests/unit_tests/platform/test_slack_eba_adapter.py` |
-| Slack private | Slack workspace private DM on `dev.rockchin.top` | `/home/wgc/LangBotxg/LangBotEbaTest/data/temp/slack_eba_plugin_probe.jsonl` |
-
-All plugin runs used SDK standalone runtime ports `5400/5401`, LangBot `--standalone-runtime`, and the real plugin at `langbot-plugin-demo/EBAEventProbe`.
-
-## Unified Shape Verification
-
-All four adapters deliver common SDK entities to plugins before LangBot core/plugin logic handles the event.
-
-| Requirement | Telegram | Discord | aiocqhttp | DingTalk | Lark / Feishu |
-|-------------|----------|---------|-----------|----------|---------------|
-| `bot_uuid` filled | plugin-e2e | plugin-e2e | plugin-e2e | plugin-e2e | live plugin-e2e pending |
-| `adapter_name` filled | `telegram` | `discord` | `aiocqhttp` | `dingtalk` | `lark-eba` in current unit/code; older live text evidence recorded `lark` before the naming fix |
-| common `MessageChain` delivered | `Plain`, group `At + Plain`, private `Image`, private `File` | `Source + Plain` | UI `Source + Plain`; protocol `Source + Plain + At + Face + Image + Voice + File + Quote + Plain` | `Source + Plain`, private `Source + Image`, private `Source + File` | live private `Source + Plain`; unit `Source + Plain + At/Image/File`; latest live image/file blocked |
-| common user/group entities | plugin-e2e | plugin-e2e | plugin-e2e | plugin-e2e private user; group not completed | live private user; unit private/group |
-| raw native object isolation | raw data stays in `source_platform_object` | raw data stays in `source_platform_object` | raw data stays in `source_platform_object` | raw data stays in `source_platform_object` | raw data stays in `source_platform_object` |
-
-## Message Receive Components
-
-| Component | Telegram | Discord | aiocqhttp | DingTalk | Lark / Feishu |
-|-----------|----------|---------|-----------|----------|---------------|
-| `Source` | design gap: event has message id but chain omits `Source` | plugin-e2e-ui | plugin-e2e-ui/protocol | plugin-e2e-ui | plugin-e2e-ui private text |
-| `Plain` | plugin-e2e-ui private/group | plugin-e2e-ui | plugin-e2e-ui/protocol | plugin-e2e-ui | plugin-e2e-ui private text |
-| `At` | plugin-e2e-ui group mention | unit; real UI mention not completed in latest run | plugin-e2e-protocol; unit | unit; group trigger not completed | unit; group trigger not completed |
-| `AtAll` | not-supported | unit only | unit only | unit/send fallback only | unit only |
-| `Image` | plugin-e2e-ui private | converter/unit; real UI attachment not completed | plugin-e2e-protocol, not Matcha UI | plugin-e2e-ui private | unit; real UI image sent but not observed in plugin evidence |
-| `Voice` | converter/unit; real UI inbound not completed | not-supported as native voice; audio is attachment/file | plugin-e2e-protocol, not Matcha UI | converter/unit; real UI inbound not completed | unit; real UI inbound not completed |
-| `File` | plugin-e2e-ui private | converter/unit; real UI attachment not completed | plugin-e2e-protocol, not Matcha UI | plugin-e2e-ui private | unit; real UI file sent but not observed in plugin evidence |
-| `Quote` | converter/unit; real UI reply not completed | unit; real UI reply not completed | plugin-e2e-protocol | converter/unit; real UI quote not completed | unit/API-backed quote lookup; real UI quote not completed |
-| `Face` | not-supported as common `Face` | not-supported as common `Face` | plugin-e2e-protocol | UI emoji becomes `Plain` (`[smile]` text), not `Face` | not-supported as common `Face` |
-| `Forward` | not-supported inbound | not-supported inbound | unit; Matcha forward UI/action blocked | not-supported inbound | not-supported inbound |
-| Mixed chain | group `At + Plain`; media tested as separate messages | not completed inbound | plugin-e2e-protocol | media tested as separate messages; mixed inbound not completed | unit only |
-
-## Message Send Components
-
-| Component | Telegram | Discord | aiocqhttp | DingTalk | Lark / Feishu |
-|-----------|----------|---------|-----------|----------|---------------|
-| `Plain` | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound |
-| `At` | plugin-e2e-outbound equivalent | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound fallback/equivalent | plugin-e2e-outbound |
-| `AtAll` | plugin-e2e-outbound fallback | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound fallback | unit; group live not completed |
-| `Image` | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound |
-| `Voice` | not-supported in current send converter | not-supported as native voice | converter path; not completed against Matcha UI | fallback as file/text depending DingTalk media support | converter path; live not completed |
-| `File` | plugin-e2e-outbound | plugin-e2e-outbound | blocked by Matcha endpoint error | plugin-e2e-outbound | plugin-e2e-outbound |
-| `Quote` | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound fallback | plugin-e2e-outbound fallback |
-| `Face` | not-supported | not-supported | plugin-e2e-outbound attempted in mixed chain | fallback text | not-supported |
-| `Forward` | flattened fallback | flattened fallback | blocked by Matcha unsupported action | flattened fallback | plugin-e2e-outbound flattened fallback |
-| Mixed chain | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound except blocked file/forward | plugin-e2e-outbound | plugin-e2e-outbound |
-
-## Event Acceptance
-
-| Event category | Telegram | Discord | aiocqhttp | DingTalk |
-|----------------|----------|---------|-----------|----------|
-| `message.received` | plugin-e2e-ui | plugin-e2e-ui | plugin-e2e-ui and plugin-e2e-protocol | plugin-e2e-ui private |
-| `message.edited` | implemented/unit, not plugin-e2e-ui | historical/direct only, not latest plugin-e2e | unit | not declared |
-| `message.deleted` | implemented/unit, not plugin-e2e-ui | historical/direct only, not latest plugin-e2e | unit | not declared |
-| `message.reaction` | implemented/unit, not plugin-e2e-ui | historical/direct only, not latest plugin-e2e | not-supported in standard OneBot message path | not declared |
-| member join/left/ban | implemented/unit or blocked without disposable users | blocked without disposable users | unit; Matcha fixture unavailable | not declared |
-| bot invited/removed | invite plugin-e2e-ui for Telegram; removal blocked | invite historical/plugin-series; removal blocked | unit; Matcha fixture unavailable | not declared |
-| requests/friend events | not applicable | not applicable | unit; Matcha fixture unavailable | not declared |
-| `platform.specific` | implemented; not latest plugin-e2e | not latest plugin-e2e | adapter lifecycle observed; plugin focus was message path | declared for fallback; not reproduced in UI run |
-
-## Common API Acceptance
-
-| API area | Telegram | Discord | aiocqhttp | DingTalk |
-|----------|----------|---------|-----------|----------|
-| send/reply | plugin-e2e-outbound | plugin-e2e-outbound | plugin-e2e-outbound, with Matcha file/forward gaps | plugin-e2e-outbound |
-| edit/delete | historical/direct or unit; destructive/current UI not repeated | historical/direct; destructive/current UI not repeated | unit/destructive blocked | not declared or blocked |
-| message lookup | not-supported | not-supported | plugin-e2e | inbound cache-backed where available; limited live coverage |
-| group info/member info | plugin-e2e safe subset | plugin-e2e safe subset | plugin-e2e safe subset | private path only; group not completed |
-| user/friend info | plugin-e2e where platform allows | plugin-e2e where platform allows | plugin-e2e | plugin-e2e private user |
-| moderation/leave | blocked without disposable safe targets | blocked without disposable safe targets | blocked without disposable safe targets | blocked/not declared |
-| `get_file_url` | implemented; latest inbound `File` carried downloadable file data in plugin evidence | URL passthrough for attachments; inbound attachment not completed | not portable/endpoint-dependent | implemented through DingTalk media API; latest inbound `File` carried a platform file URL |
-| `call_platform_api` | plugin-e2e safe actions | plugin-e2e safe actions | plugin-e2e safe actions, Matcha gaps documented | plugin-e2e safe `check_access_token` |
-
-## Platform-Specific API Acceptance
-
-| Adapter | plugin-e2e verified | Blocked or not reproduced |
-|---------|---------------------|---------------------------|
-| Telegram | safe chat/admin/member count/chat-action actions | mutating actions and callback-only actions were not repeated |
-| Discord | safe channel/guild/role/typing actions | mutating pin/reaction/invite actions were not repeated in the latest plugin run; inbound attachment paths not completed |
-| aiocqhttp | safe OneBot actions such as status/version/can-send checks | `get_group_honor_info` unsupported by Matcha; admin/card/title/ban/record/file/forward require better endpoint fixtures |
-| DingTalk | `check_access_token`; real inbound file produced a file URL in the common `File` component | separate media-download replay APIs and group actions need a working follow-up fixture |
-
-## SDK API Acceptance
-
-`EBAEventProbe` exercised the standalone runtime path for:
-
-- bot discovery and bot info lookup
-- send message
-- component sweep where enabled
-- platform API sweep where enabled
-- plugin storage
-- workspace storage
-- plugin/command/tool/knowledge-base list APIs
-
-The probe logs set `ok=true` when the sweep completed with only expected unsupported/blocked items. Individual call details are stored in the JSONL evidence files.
-
-## Residual Risks And Required Follow-Up
-
-- Discord still requires real UI inbound image/file upload evidence before it can be called media-complete.
-- aiocqhttp has rich inbound component evidence only at the OneBot reverse WebSocket boundary; Matcha UI did not provide image/file upload coverage.
-- DingTalk group trigger remains unclosed; current evidence is private chat only.
-- Lark / Feishu requires a clean follow-up live pass: the latest LangBot organization WebSocket run connected, but UI-sent text/image/file after the loop-scheduling fix did not append plugin events.
-- Discord UI retry on May 10, 2026 was blocked by the client keeping the send button disabled even after text was entered.
-- Destructive moderation and leave APIs are intentionally blocked until disposable users/groups are available.
-
-## Conclusion
-
-The EBA conversion path is implemented and partially proven for the migrated adapters. Telegram and DingTalk now have real UI private-chat image/file inbound evidence. Discord, aiocqhttp, and Lark / Feishu still have explicit UI-level media gaps, so the overall adapter set remains partial acceptance rather than production-complete media acceptance.

docs/event-based-agents/adapters/aiocqhttp.md

@@ -1,162 +0,0 @@
-# OneBot v11 / aiocqhttp EBA Adapter
-
-## Status
-
-OneBot v11 has been migrated to the EBA adapter directory:
-
-```text
-src/langbot/pkg/platform/adapters/aiocqhttp/
-├── adapter.py
-├── api_impl.py
-├── event_converter.py
-├── manifest.yaml
-├── message_converter.py
-├── platform_api.py
-├── types.py
-└── onebot.svg
-```
-
-The EBA adapter is registered as `aiocqhttp-eba`. The legacy adapter remains at `src/langbot/pkg/platform/sources/aiocqhttp.py`.
-
-## Configuration
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `host` | Yes | `0.0.0.0` | Host for the reverse WebSocket server that the OneBot endpoint connects to. |
-| `port` | Yes | `2280` | Reverse WebSocket listen port. |
-| `access-token` | No | `""` | OneBot access token, if the endpoint is configured to use one. |
-
-## Events
-
-The adapter declares these EBA events:
-
-- `message.received`
-- `message.deleted`
-- `group.member_joined`
-- `group.member_left`
-- `group.member_banned`
-- `friend.request_received`
-- `friend.added`
-- `bot.invited_to_group`
-- `bot.removed_from_group`
-- `bot.muted`
-- `bot.unmuted`
-- `platform.specific`
-
-`platform.specific` is used for OneBot notice/request/meta events that do not yet have a common EBA event type, such as group admin changes, group file uploads, pokes, honor changes, and group join requests from non-bot users.
-
-## Common APIs
-
-| API | Status | Notes |
-|-----|--------|-------|
-| `send_message` | Supported | Supports private and group text, mentions, images, voice, files, faces, and flattened forwards. Group merged forwards are sent through OneBot forward APIs when possible. |
-| `reply_message` | Supported | Uses the original OneBot event and can prepend a reply segment. |
-| `edit_message` | Not supported | OneBot v11 has no standard message edit action. |
-| `delete_message` | Supported | Uses `delete_msg`; permission depends on endpoint and group role. |
-| `forward_message` | Supported | Emulates forward by fetching the source message with `get_msg` and sending its content to the target chat. |
-| `get_message` | Supported | Uses `get_msg` and converts the response into `MessageReceivedEvent`. |
-| `get_group_info` | Supported | Uses `get_group_info`. |
-| `get_group_list` | Supported | Uses `get_group_list`. |
-| `get_group_member_list` | Supported | Uses `get_group_member_list`. |
-| `get_group_member_info` | Supported | Uses `get_group_member_info`. |
-| `set_group_name` | Supported | Uses `set_group_name`; may be unsupported by mock endpoints. |
-| `get_user_info` | Supported | Uses `get_stranger_info`. |
-| `get_friend_list` | Supported | Uses `get_friend_list`. |
-| `approve_friend_request` | Supported | Uses `set_friend_add_request`. |
-| `approve_group_invite` | Supported | Uses `set_group_add_request` with `sub_type=invite`. |
-| `upload_file` | Not supported | OneBot v11 has endpoint-specific file upload extensions but no portable standalone upload action. |
-| `get_file_url` | Not supported | OneBot v11 file URL resolution is endpoint-specific. Use `call_platform_api("get_image")`, `get_record`, or endpoint extensions when available. |
-| `mute_member` | Supported | Uses `set_group_ban`. |
-| `unmute_member` | Supported | Uses `set_group_ban` with duration `0`. |
-| `kick_member` | Supported | Destructive; test only with disposable members. |
-| `leave_group` | Supported | Destructive; should run last in live tests. |
-| `call_platform_api` | Supported | See below. |
-
-## Platform-Specific APIs
-
-`call_platform_api(action, params)` supports:
-
-- `get_login_info`
-- `get_status`
-- `get_version_info`
-- `get_group_honor_info`
-- `set_group_card`
-- `set_group_special_title`
-- `set_group_admin`
-- `set_group_whole_ban`
-- `send_group_forward_msg`
-- `get_forward_msg`
-- `get_record`
-- `get_image`
-- `can_send_image`
-- `can_send_record`
-
-## Message Conversion Notes
-
-Incoming OneBot segments are converted into common `MessageChain` components before LangBot core/plugin dispatch:
-
-- `text` -> `Plain`
-- `at` -> `At` / `AtAll`
-- `image` -> `Image` or `Face` for OneBot emoji-package images
-- `record` -> `Voice`
-- `file` -> `File`
-- `reply` -> `Quote`
-- `face`, `rps`, `dice` -> `Face`
-- unsupported segments -> `Unknown`
-
-Outgoing `MessageChain` components are converted back into `aiocqhttp.Message` segments. Base64 media strings are normalized to OneBot `base64://...` format.
-
-## Live Test Record
-
-The direct live probe is:
-
-```bash
-PYTHONPATH=/Users/qinjunyan/code/projects/langbot/langbot-plugin-sdk/src \
-uv run python tests/e2e/live_aiocqhttp_eba_probe.py --host 127.0.0.1 --port 2280
-```
-
-It starts the reverse WebSocket adapter directly, records observed EBA events to `data/temp/aiocqhttp_eba_live_probe.jsonl`, waits for a real Matcha or OneBot message, then tries reply/send/get/delete/group/user/platform API calls as far as the endpoint supports them.
-
-Verified on May 10, 2026 with local Matcha connected to `ws://127.0.0.1:2280/ws`:
-
-- Real inbound group message converted to `MessageReceivedEvent`.
-- Real lifecycle connection converted to `PlatformSpecificEvent`.
-- Real reply API succeeded and rendered a quoted bot reply in Matcha.
-- Real proactive send API succeeded and rendered a bot group message in Matcha.
-- Real outgoing component sweep succeeded for text, `At`, `AtAll`, `Face`, and base64 `Image`.
-- Real `get_message`, `get_group_info`, `get_login_info`, `get_status`, `get_version_info`, `can_send_image`, and `can_send_record` calls succeeded against Matcha.
-- Unit conversion and API-shape tests passed for `Plain`, `At`, `AtAll`, `Image`, `Voice`, `File`, `Quote`, `Face`, `rps`, `dice`, `Forward`, `Unknown`, private/group message events, delete notices, group join/leave/ban notices, bot mute notices, friend requests, group invites, friend added notices, dispatch specificity, send, reply, delete, forward, get message, group APIs, user APIs, request approval APIs, moderation APIs, leave group, unsupported file APIs, and all declared `call_platform_api` actions.
-
-Skipped or residual live-test items:
-
-- `edit_message`: not implemented because OneBot v11 has no standard edit action.
-- `upload_file` and `get_file_url`: not implemented as common APIs because portable OneBot v11 file upload/download URL semantics are endpoint-specific.
-- `kick_member` and `leave_group`: destructive; run only with explicit `--destructive` and disposable Matcha/OneBot state.
-- `group.info_updated`, message reactions, and message edits are not declared because OneBot v11 does not provide standard equivalents for them.
-- Matcha returned `ActionFailed` for outgoing `File` segment rendering and did not support merged-forward actions in this run. The adapter keeps the conversion/API implementations because they are valid OneBot/NapCat-style capabilities, but the Matcha live probe records them as skipped.
-- Matcha returned an empty `get_group_member_list` for the test group, so `get_group_member_info`, mute/unmute, kick, and leave were covered by unit/API-shape tests only in this run.
-
-## Standalone Runtime Plugin E2E Record
-
-Verified on May 10, 2026 with `EBAEventProbe`, SDK standalone runtime, LangBot `--standalone-runtime`, local Matcha, and group `测试群`.
-
-Evidence:
-
-- Plugin JSONL: `data/temp/aiocqhttp-plugin-e2e-20260510-multiformat.jsonl`
-
-Observed and verified:
-
-- A real Matcha group message reached the plugin as `MessageReceived` with `bot_uuid=eba-aiocqhttp-matcha`, `adapter_name=aiocqhttp`, common `Source`/`Plain` message components, common sender, and common group identifiers.
-- A protocol-level OneBot reverse WebSocket event reached the plugin as `MessageReceived` with a mixed common chain: `Source`, `Plain`, `At`, `Face`, `Image`, `Voice`, `File`, `Quote`, and trailing `Plain`. This proves the real adapter + LangBot + standalone runtime + plugin path for mixed inbound OneBot payloads, but it was not sent through Matcha UI.
-- SDK API calls succeeded: `get_langbot_version`, `get_bots`, `get_bot_info`, `send_message`, plugin storage, workspace storage, `list_plugins_manifest`, `list_commands`, `list_tools`, and `list_knowledge_bases`.
-- Outbound component sweep succeeded for plain text plus `At`/`Face`, `AtAll`, base64 `Image`, and quoted reply.
-- Common APIs succeeded through the plugin path: `get_message`, `get_user_info`, `get_friend_list`, `get_group_info`, `get_group_list`, `get_group_member_list`, and `get_group_member_info`.
-- Safe OneBot platform APIs succeeded through `call_platform_api`: `get_login_info`, `get_status`, `get_version_info`, `can_send_image`, and `can_send_record`.
-
-Documented Matcha limits in this E2E run:
-
-- Matcha UI did not provide a completed image/file upload/send path for inbound media. The rich inbound media evidence is `plugin-e2e-protocol`, not UI-level media upload evidence.
-- Outbound `File` failed in Matcha even after the adapter emitted an official `file` segment shape.
-- Outbound `Forward` failed because Matcha returned unsupported action for merged-forward.
-- `get_group_honor_info` failed because Matcha returned unsupported action.
-- Destructive/admin APIs such as mute, unmute, kick, leave, group rename, card/title/admin/whole-ban changes, and request approvals were not run without disposable fixtures.

docs/event-based-agents/adapters/dingtalk.md

@@ -1,114 +0,0 @@
-# DingTalk EBA Adapter Migration Record
-
-Status: migrated with partial plugin E2E evidence.
-
-Adapter directory: `src/langbot/pkg/platform/adapters/dingtalk/`
-
-## What Changed
-
-The DingTalk adapter now has an Event-Based Agents adapter package with:
-
-- `manifest.yaml` for adapter metadata, configuration, events, common APIs, and platform-specific APIs.
-- `adapter.py` for DingTalk client startup, native callback handling, legacy compatibility, and EBA dispatch.
-- `event_converter.py` for native DingTalk events to common EBA events.
-- `message_converter.py` for DingTalk message payloads to/from common `MessageChain` components.
-- `api_impl.py` for common EBA API implementations.
-- `platform_api.py` for DingTalk-specific `call_platform_api` actions.
-
-The legacy DingTalk HTTP client now returns successful JSON response bodies from proactive send methods and raises with response details on non-200 responses.
-
-## Configuration
-
-| Field | Required | Notes |
-|-------|----------|-------|
-| `client-id` | yes | DingTalk robot/client identifier. |
-| `client-secret` | yes | DingTalk client secret. |
-| `robot-code` | yes | Robot code used for send APIs. |
-| `robot-name` | no | Used for bot mention/self filtering and display. |
-| `encrypt-key` | no | DingTalk callback encryption key when configured. |
-| `verification-token` | no | DingTalk callback verification token when configured. |
-
-## Supported Events
-
-| Event | Support | Evidence |
-|-------|---------|----------|
-| `message.received` | implemented | `plugin-e2e-ui` private text and emoji-as-text. |
-| `platform.specific` | implemented | Not reproduced in the latest UI run. |
-
-## Receive Components
-
-| Component | Support | Evidence |
-|-----------|---------|----------|
-| `Source` | supported | `plugin-e2e-ui` private message. |
-| `Plain` | supported | `plugin-e2e-ui` private text. DingTalk emoji currently arrives as plain text such as `[smile]`. |
-| `At` | converter path | Group trigger was not completed in the latest run. |
-| `AtAll` | fallback/send-side only | Not completed inbound. |
-| `Image` | supported | Real DingTalk Mac private-chat image upload reached the plugin as common `Image`. |
-| `Voice` | converter path | Real UI inbound voice was not completed. |
-| `File` | supported | Real DingTalk Mac private-chat file upload reached the plugin as common `File`. |
-| `Quote` | converter path | Real UI inbound quote was not completed. |
-| `Face` | not native common mapping | DingTalk emoji was observed as `Plain`, not `Face`. |
-| `Forward` | not-supported inbound | DingTalk does not expose a portable structured forward event in this adapter. |
-
-## Send Components
-
-| Component | Support | Evidence |
-|-----------|---------|----------|
-| `Plain` | supported | `plugin-e2e-outbound`. |
-| `At` | supported or text fallback | `plugin-e2e-outbound`. |
-| `AtAll` | fallback | `plugin-e2e-outbound`. |
-| `Image` | supported | `plugin-e2e-outbound`. |
-| `File` | supported | `plugin-e2e-outbound`. |
-| `Quote` | fallback | `plugin-e2e-outbound`. |
-| `Face` | fallback | `plugin-e2e-outbound` as text fallback. |
-| `Forward` | flattened fallback | `plugin-e2e-outbound`. |
-| `Voice` | fallback/endpoint-dependent | Not separately verified as a native DingTalk voice send. |
-
-## Common APIs
-
-| API | Support | Notes |
-|-----|---------|-------|
-| `send_message` | supported | Verified through `EBAEventProbe`. |
-| `reply_message` | supported | Verified through quoted/fallback send path. |
-| `get_message` | cache-backed | Requires the message to have been observed by this adapter process. |
-| `get_group_info` | cache-backed/API-backed where available | Group path not completed in latest UI run. |
-| `get_group_list` | supported where DingTalk API allows | Limited live coverage. |
-| `get_group_member_info` | supported where DingTalk API allows | Limited live coverage. |
-| `get_user_info` | supported | Private sender path verified. |
-| `get_friend_list` | limited | DingTalk does not expose a portable friend-list equivalent. |
-| `get_file_url` | supported with media/file identifiers | Real inbound file yielded a platform file URL in the converted `File` component. |
-| `call_platform_api` | supported | Safe action `check_access_token` verified. |
-
-## Platform-Specific APIs
-
-| Action | Support | Evidence |
-|--------|---------|----------|
-| `check_access_token` | supported | `plugin-e2e`. |
-| `refresh_access_token` | supported | Implemented; not separately reproduced in the latest plugin run. |
-| `get_file_url` | supported | Real inbound file yielded a platform file URL in the converted `File` component. |
-| `get_audio_base64` | supported | Needs real inbound audio/media ID. |
-| `download_image_base64` | supported | Real inbound image reached the plugin as `Image`; separate image-download API replay was not completed. |
-
-## End-to-End Evidence
-
-Evidence files:
-
-- Text/API/component JSONL: `data/temp/dingtalk-plugin-e2e-20260510-rerun.jsonl`
-- Real UI inbound media JSONL: `data/temp/dingtalk-plugin-e2e-media-ui.jsonl`
-
-Verified:
-
-- DingTalk Mac private chat in the `LangBot Team` organization produced `MessageReceived` through LangBot standalone runtime and `EBAEventProbe`.
-- The common chain was `Source + Plain` for normal text.
-- DingTalk emoji was received as `Source + Plain`, not common `Face`.
-- Real DingTalk Mac private-chat image upload was received as `Source + Image`.
-- Real DingTalk Mac private-chat file upload was received as `Source + File`.
-- The plugin sent outbound text, mention/fallback, image, quote/fallback, file, and forward/fallback messages visible in DingTalk.
-- The plugin called safe SDK and DingTalk platform APIs.
-
-Not completed:
-
-- Real UI inbound voice.
-- Real UI inbound quote.
-- Group trigger with a real robot mention.
-- Destructive or organization-mutating APIs.

docs/event-based-agents/adapters/discord.md

@@ -1,147 +0,0 @@
-# Discord EBA Adapter
-
-## Status
-
-Discord has been migrated from the legacy source adapter:
-
-```text
-src/langbot/pkg/platform/sources/discord.py
-src/langbot/pkg/platform/sources/discord.yaml
-```
-
-EBA adapter directory:
-
-```text
-src/langbot/pkg/platform/adapters/discord/
-├── adapter.py
-├── api_impl.py
-├── event_converter.py
-├── manifest.yaml
-├── message_converter.py
-├── platform_api.py
-├── types.py
-└── voice.py
-```
-
-The adapter is registered as `discord-eba`.
-
-## Configuration
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `client_id` | Yes | `""` | Discord application client ID. |
-| `token` | Yes | `""` | Discord bot token. |
-
-The bot needs gateway permissions and intents for the target test server. Message Content intent is required for message bodies, Server Members intent is required for member APIs/events, and reaction events require the Reactions intent and channel permissions.
-
-## Events
-
-Discord declares these EBA events:
-
-- `message.received`
-- `message.edited`
-- `message.deleted`
-- `message.reaction`
-- `group.member_joined`
-- `group.member_left`
-- `group.member_banned`
-- `bot.invited_to_group`
-- `bot.removed_from_group`
-- `platform.specific`
-
-Discord-specific events that do not map cleanly to common events should be surfaced as `platform.specific`.
-
-## Common APIs
-
-| API | Status | Notes |
-|-----|-----------------|-------|
-| `send_message` | Supported | Supports text, image, file, and mixed message chains through Discord messages and attachments. |
-| `reply_message` | Supported | Uses Discord message references when replying to a received EBA message event. |
-| `edit_message` | Supported | Bot can edit its own messages. File edits are implemented by clearing old attachments and sending replacement files when needed. |
-| `delete_message` | Supported | Requires message management permissions for non-bot messages. |
-| `forward_message` | Emulated | Discord has no native forward API; the adapter copies content and attachments. |
-| `get_group_info` | Supported | Maps Discord guild metadata to EBA group info. |
-| `get_group_member_list` | Supported | Requires member cache or the Server Members intent/fetch permission. |
-| `get_group_member_info` | Supported | Maps Discord roles/permissions into EBA member roles. |
-| `get_user_info` | Supported | Uses Discord user fetch/cache. |
-| `upload_file` | Not supported | Discord uploads files as message attachments; standalone upload raises `NotSupportedError`. |
-| `get_file_url` | Supported | Discord attachment URLs are already downloadable URLs, so the adapter returns the input URL. |
-| `mute_member` | Supported where possible | Uses Discord timeout API and requires guild moderation permission. |
-| `unmute_member` | Supported where possible | Clears timeout and requires guild moderation permission. |
-| `kick_member` | Supported | Destructive; test only with a disposable account/bot. |
-| `leave_group` | Supported | Bot leaves a guild; destructive and should run last. |
-| `call_platform_api` | Supported | Discord-specific actions live here. |
-
-## Platform-Specific APIs
-
-`call_platform_api(action, params)` supports:
-
-- `get_channel`
-- `get_guild`
-- `get_guild_channels`
-- `get_guild_roles`
-- `create_invite`
-- `pin_message`
-- `unpin_message`
-- `add_reaction`
-- `remove_reaction`
-- `typing`
-
-Voice helpers are intentionally kept Discord-specific:
-
-- `join_voice_channel`
-- `leave_voice_channel`
-- `get_voice_connection_status`
-- `list_active_voice_connections`
-- `get_voice_channel_info`
-
-## Live Test Record
-
-The live probe is:
-
-```bash
-uv run python tests/e2e/live_discord_eba_probe.py --help
-```
-
-Verified on May 7, 2026 with a newly created Discord application/bot named `LangBot EBA Test 0507`, the LangBot Discord server, and the `#🐞-debugging` channel:
-
-- SDK standalone runtime started with WebSocket control/debug ports, and the `EBAEventProbe` plugin connected through `lbp run`.
-- Plugin runtime received real Discord events through LangBot: `BotInvitedToGroup`, `MessageReceived`, `MessageReactionReceived` add/remove, `MessageEdited`, and `MessageDeleted`.
-- Plugin runtime API calls succeeded through the standalone runtime: `get_langbot_version`, `get_bots`, `get_bot_info`, `send_message`, plugin storage APIs, workspace storage APIs, `list_plugins_manifest`, `list_commands`, `list_tools`, and `list_knowledge_bases`.
-- Direct live adapter probe observed `message.received`, `message.edited`, `message.deleted`, and `bot.removed_from_group`.
-- Message APIs verified: send, reply, edit, delete, forward, text/image/file mixed message chains.
-- User and guild APIs verified: `get_user_info`, `get_group_info`, `get_group_member_list`, `get_group_member_info`.
-- Platform-specific APIs verified: `get_channel`, `get_guild`, `get_guild_channels`, `get_guild_roles`, `create_invite`, `typing`, `pin_message`, `unpin_message`, `add_reaction`, `remove_reaction`.
-- Unsupported API behavior verified: `upload_file` raises `NotSupportedError`.
-- Destructive API verified at the end: `leave_group`, which emitted `bot.removed_from_group`.
-
-Not verified in the shared LangBot server live run: `mute_member`, `unmute_member`, and `kick_member`, because the run did not use a disposable target member. They are implemented through Discord timeout/kick APIs and should only be exercised against a disposable account or bot.
-
-The test fixed one real test-fixture issue: `EBAEventProbe` previously assumed `get_bots()` returned UUID strings. The current standalone runtime returns bot dictionaries, so the probe now selects an enabled bot dictionary and passes its `uuid` to `get_bot_info` and `send_message`. The probe also now subscribes to `MessageDeleted`.
-
-## Standalone Runtime Plugin E2E Record
-
-Verified again on May 10, 2026 with SDK standalone runtime, LangBot `--standalone-runtime`, Discord web client, the LangBot server, and `#🐞-debugging`.
-
-Evidence:
-
-- Main plugin JSONL: `data/temp/discord-plugin-e2e-20260510-final.jsonl`
-- LangBot runtime log: `data/temp/discord-langbot-e2e-20260510-rerun.log`
-
-Observed and verified:
-
-- A newly invited Discord bot connected to the LangBot server and received a real web-client message in `#🐞-debugging`.
-- `MessageReceived` reached the plugin with `bot_uuid=eba-discord-live`, `adapter_name=discord`, common `Source`/`Plain` message components, common `User`, and common `UserGroup` for the guild.
-- SDK API calls succeeded: `get_langbot_version`, `get_bots`, `get_bot_info`, `send_message`, plugin storage, workspace storage, `list_plugins_manifest`, `list_commands`, `list_tools`, and `list_knowledge_bases`.
-- Outbound component sweep succeeded: plain text plus user mention, `AtAll`/`@everyone`, base64 image, quoted reply, file attachment, and flattened forward fallback.
-- Common APIs succeeded: `get_user_info`, `get_group_info`, `get_group_member_list`, and `get_group_member_info`.
-- Discord platform APIs succeeded through `call_platform_api`: `get_channel`, `typing`, `get_guild`, `get_guild_channels`, and `get_guild_roles`.
-
-Documented limits in this E2E run:
-
-- Real Discord UI inbound attachment/image/file, reply/quote, and fresh mention-chain messages were not completed in the plugin E2E evidence. Outbound image/file attachments from the bot do not prove inbound attachment conversion.
-- A later May 10 UI retry could write text into the Discord message box, but the client kept the send button disabled and did not send the message, so it produced no new plugin evidence.
-- `get_message`, `get_friend_list`, and `get_group_list` are not supported by this Discord adapter.
-- Destructive moderation and guild-leave APIs were not repeated against the shared LangBot server.
-- Native Discord voice is not represented as common `Voice`; audio-like payloads are treated as file attachments.
-- `create_invite`, pin/unpin, and reaction mutation were covered by prior direct live probes but were not repeated by the final plugin run to avoid extra shared-server side effects.

docs/event-based-agents/adapters/kook.md

@@ -1,108 +0,0 @@
-# KOOK EBA Adapter
-
-## Status
-
-KOOK has been migrated to the EBA adapter directory:
-
-```text
-src/langbot/pkg/platform/adapters/kook/
-├── adapter.py
-├── api_impl.py
-├── event_converter.py
-├── manifest.yaml
-├── message_converter.py
-├── platform_api.py
-└── types.py
-```
-
-The adapter is registered as `kook-eba`.
-
-## Configuration
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `token` | Yes | `""` | KOOK bot token. |
-| `enable-stream-reply` | Yes | `false` | Reserved for shared platform configuration compatibility. |
-
-## Events
-
-| Event | Evidence | Notes |
-|-------|----------|-------|
-| `message.received` | `plugin-e2e-ui` | Real KOOK UI channel message reached `EBAEventProbe` as `MessageReceivedEvent`. |
-| `platform.specific` | `plugin-e2e-ui` | KOOK gateway event without a common EBA mapping reached `EBAEventProbe` as `PlatformSpecificEventReceived`. |
-
-## Common APIs
-
-| API | Evidence | Notes |
-|-----|----------|-------|
-| `send_message` | `plugin-e2e-outbound` | Probe plugin sent channel messages through SDK `send_message`; KOOK returned message IDs. |
-| `reply_message` | `unit` | Supports `reply_msg_id` and optional quoted replies when the source message ID is available. |
-| `get_message` | `plugin-e2e-outbound` | Probe plugin fetched the cached triggering message. |
-| `get_group_info` | `plugin-e2e-outbound` | Probe plugin received cached KOOK channel info. |
-| `get_group_list` | `plugin-e2e-outbound` | Probe plugin received cached channel/group entities observed by the adapter. |
-| `get_group_member_info` | `plugin-e2e-outbound` | Probe plugin received cached sender info as a group member. |
-| `get_user_info` | `plugin-e2e-outbound` | Probe plugin received cached sender user info. |
-| `get_friend_list` | `plugin-e2e-outbound` | Probe plugin received cached users. |
-| `upload_file` | `unit` | Uses KOOK `asset/create` and returns URL/ID. |
-| `get_file_url` | `unit` | KOOK media IDs are URL-like in the adapter path; returns the ID unchanged. |
-| `delete_message` | `unit` | Calls KOOK delete endpoints. Live permission verification is still required. |
-| `forward_message` | `plugin-e2e-outbound` | Probe plugin sent flattened forward content through SDK `send_message`. |
-| `call_platform_api` | `plugin-e2e-outbound` | Probe plugin called safe KOOK platform-specific APIs through SDK `call_platform_api`. |
-
-## Platform-Specific APIs
-
-| Action | Evidence | Notes |
-|--------|----------|-------|
-| `get_current_user` | `plugin-e2e-outbound` | Probe plugin called `user/me`. |
-| `get_user` | `plugin-e2e-outbound` | Probe plugin called `user/view` for the triggering sender. |
-| `get_channel` | `plugin-e2e-outbound` | Probe plugin called `channel/view` for the triggering channel. |
-| `get_guild` | `plugin-e2e-outbound` | Probe plugin called `guild/view`; gateway URLs redact token query values. |
-| `get_gateway` | `plugin-e2e-outbound` | Probe plugin called `gateway/index`; returned token query values are redacted. |
-| `send_direct_message` | `unit` | Calls `direct-message/create`. |
-
-## Components
-
-| Component | Receive Evidence | Send Evidence | Notes |
-|-----------|------------------|---------------|-------|
-| `Source` | `plugin-e2e-ui` | N/A | KOOK message ID and timestamp are preserved. |
-| `Plain` | `plugin-e2e-ui` | `plugin-e2e-outbound` | Text and KMarkdown are represented as plain common text. |
-| `At` | `plugin-e2e-ui` | `plugin-e2e-outbound` | KOOK `(met)<id>(met)` mentions map to common `At`. |
-| `AtAll` | `unit` | `plugin-e2e-outbound` | KOOK `(met)all(met)` maps to common `AtAll`; real inbound UI AtAll was not tested. |
-| `Image` | `unit` | `unit` | URL/image ID based path only; live rendering still needs verification. |
-| `Voice` | `unit` | `unit` | URL based path only; live rendering still needs verification. |
-| `File` | `unit` | `unit` | URL based path only; upload API is exposed separately. |
-| `Forward` | `unit` | `unit` | Outbound forwards are flattened; inbound structured forwards are not exposed by current legacy implementation. |
-| `Unknown` | `unit` | N/A | Unsupported KOOK message types become `Unknown` or `PlatformSpecificEvent`. |
-
-## Acceptance Record
-
-Test date: June 4, 2026.
-
-Plugin E2E verified on June 4, 2026 with `EBAEventProbe`, SDK standalone runtime, KOOK WebSocket adapter, and a real KOOK channel UI message.
-
-Evidence:
-
-- JSONL: `data/temp/kook_eba_plugin_probe.jsonl`
-- Plugin log: `data/logs/eba-probe-kook.log`
-
-Observed and verified:
-
-- A real KOOK UI channel message reached the plugin as `MessageReceived` with `bot_uuid=7ab5b065-6e4e-4def-95f0-3c265366e26f`, `adapter_name=kook`, common sender/group/chat fields, and common `MessageChain` components.
-- KOOK gateway-specific event reached the plugin as `PlatformSpecificEventReceived`.
-- Probe plugin called SDK `send_message`; KOOK returned message IDs for text, At, AtAll, image URL/base64 fallback path, quote fallback, file fallback, and flattened forward cases.
-- Probe plugin called common API methods through the SDK path: `get_message`, `get_user_info`, `get_friend_list`, `get_group_info`, `get_group_list`, and `get_group_member_info`.
-- Probe plugin called safe KOOK platform-specific APIs through SDK `call_platform_api`: `get_current_user`, `get_user`, `get_channel`, `get_gateway`, and `get_guild`.
-
-Run:
-
-```bash
-uv run pytest tests/unit_tests/platform/test_kook_eba_adapter.py
-git diff --check
-```
-
-Blocked or partial items:
-
-- `plugin-e2e-ui` inbound coverage for image, file, voice, AtAll, quote, and forward.
-- `plugin-e2e-outbound` visual verification in KOOK UI for image/file/voice rendering. KOOK returned message IDs, but UI inspection was not performed in this run.
-- `reply_message` and `delete_message` live permission verification.
-- Destructive or permission-sensitive APIs were not declared beyond delete; KOOK mute/kick/leave remain explicit `NotSupportedError` paths until a safe fixture is available.

docs/event-based-agents/adapters/lark.md

@@ -1,135 +0,0 @@
-# Lark / Feishu EBA Adapter Migration Record
-
-Status: migrated with unit coverage and partial live plugin E2E. WebSocket text reached the standalone runtime once in the LangBot organization test app, but the latest real UI image/file inbound attempts did not reach the local adapter log, so media receive is not release-complete yet.
-
-Adapter directory: `src/langbot/pkg/platform/adapters/lark/`
-
-## What Changed
-
-The Lark/Feishu adapter now has an Event-Based Agents adapter package with:
-
-- `manifest.yaml` for adapter metadata, configuration, events, common APIs, platform-specific APIs, app type, and communication mode.
-- `adapter.py` for self-built/store app token handling, WebSocket long connection startup, Webhook callback handling, card feedback, streaming-card replies, and EBA dispatch.
-- `event_converter.py` for native Feishu events to common EBA events.
-- `message_converter.py` for Feishu text/post/image/file/audio payloads to/from common `MessageChain` components.
-- `api_impl.py` for common EBA API implementations.
-- `platform_api.py` for Feishu-specific `call_platform_api` actions.
-
-The legacy `lark` adapter remains available while the EBA adapter is registered separately as `lark-eba`.
-
-## Configuration
-
-| Field | Required | Notes |
-|-------|----------|-------|
-| `app_id` | yes | Feishu/Lark application App ID. |
-| `app_secret` | yes | Feishu/Lark application App Secret. |
-| `bot_name` | yes | Must match the bot name so group mentions can be recognized. |
-| `enable-webhook` | yes | `false` uses WebSocket long connection; `true` uses Request URL/Webhook callbacks. |
-| `webhook_url` | no | Generated callback URL for Webhook mode. |
-| `encrypt-key` | no | Webhook decrypt key when event encryption is enabled. |
-| `enable-stream-reply` | yes | Enables streaming replies through an updating Feishu card. |
-| `app_type` | no | `self` for self-built apps; `isv` for store apps. |
-| `bot_added_welcome` | no | Optional group welcome message sent after bot-added events. |
-
-## Application And Communication Modes
-
-| Mode | Support | Implementation |
-|------|---------|----------------|
-| Self-built application | implemented | Uses standard app credentials and tenant token behavior from the Feishu SDK client. |
-| Store application | implemented | Builds an ISV client, requests app tickets, and resolves app/tenant access tokens with per-tenant caching. |
-| WebSocket long connection | implemented | Registers `im.message.receive_v1` and card-action callbacks through `lark_oapi.ws.Client`. |
-| Webhook Request URL | implemented | Handles URL verification, encrypted payloads, message events, app-ticket events, bot-added events, and card-action feedback. |
-
-## Supported Events
-
-| Event | Support | Evidence |
-|-------|---------|----------|
-| `message.received` | implemented | Unit coverage for private and group native events to common EBA events. |
-| `bot.invited_to_group` | implemented | Webhook bot-added event maps to common bot invite event and optional welcome send. |
-| `platform.specific` | implemented | Unknown callback events are preserved as `platform.specific`. |
-| `FeedbackEvent` | compatibility event | Card button feedback is still dispatched through the existing SDK `FeedbackEvent` type. |
-
-## Receive Components
-
-| Component | Support | Evidence |
-|-----------|---------|----------|
-| `Source` | supported | Unit coverage; live private text evidence. |
-| `Plain` | supported | Text and post payloads convert to common text; live private text evidence. |
-| `At` | supported | Feishu mentions map to common `At` with user ID and display name. |
-| `AtAll` | supported | `user_id=all` maps to common `AtAll`. |
-| `Image` | supported | Image payloads download through message resource API and map to common `Image`; real UI image send attempted, but not observed in local plugin evidence yet. |
-| `Voice` | supported | Audio payloads download through message resource API and map to common `Voice`. |
-| `File` | supported | File payloads download through message resource API and map to common `File`; real UI file send attempted, but not observed in local plugin evidence yet. |
-| `Quote` | supported | Parent/thread reply lookup maps quoted content into common `Quote`. |
-| `Face` | not native common mapping | Feishu emoji/stickers are not exposed as a portable common `Face` component here. |
-| `Forward` | not-supported inbound | Feishu does not expose a portable structured forward event in this adapter. |
-
-## Send Components
-
-| Component | Support | Evidence |
-|-----------|---------|----------|
-| `Plain` | supported | Unit coverage; sends Feishu `text`. |
-| `At` | supported | Unit coverage; sends Feishu `post` at element. |
-| `AtAll` | supported | Unit coverage; sends Feishu `post` at-all element. |
-| `Image` | supported | Uploads image resource and sends Feishu `image`. |
-| `Voice` | supported | Uploads OPUS/audio resource and sends Feishu `audio`. |
-| `File` | supported | Uploads file resource and sends Feishu `file`. |
-| `Quote` | supported/fallback | Sends quote marker plus origin content. |
-| `Face` | not-supported | No portable send mapping. |
-| `Forward` | flattened fallback | Flattens forward nodes into text/media messages. |
-
-## Common APIs
-
-| API | Support | Notes |
-|-----|---------|-------|
-| `send_message` | supported | Supports private/open_id and group/chat_id targets; live plugin outbound component sweep produced visible Feishu messages. |
-| `reply_message` | supported | Replies to the source Feishu message; fixed to recover the native Feishu message ID from legacy-wrapped source events. |
-| `get_message` | cache-backed/API-backed | Returns cached inbound event where possible and converts uncached Feishu message API items into common `MessageReceivedEvent`. |
-| `get_group_info` | supported | Uses cached group or Feishu chat metadata. |
-| `get_group_member_info` | limited | Uses cached user data when available. |
-| `get_user_info` | limited | Uses cached user data when available. |
-| `get_file_url` | limited | Returns `file://` paths from downloaded inbound resources; remote Feishu resource download uses platform-specific API params. |
-| `call_platform_api` | supported | See below. |
-
-## Platform-Specific APIs
-
-| Action | Support | Evidence |
-|--------|---------|----------|
-| `check_tenant_access_token` | supported | Unit coverage. |
-| `refresh_app_access_token` | supported | Store-app token path implemented. |
-| `refresh_tenant_access_token` | supported | Store-app tenant token path implemented. |
-| `get_chat` | supported | Feishu chat metadata API wrapper. |
-| `get_message` | supported | Feishu message API wrapper with JSON-safe return values for plugin calls. |
-| `get_message_resource` | supported | Feishu message resource download wrapper. |
-
-## End-to-End Evidence
-
-Current code-level evidence:
-
-- `tests/unit_tests/platform/test_lark_eba_adapter.py`
-- `PYTHONPATH=../langbot-plugin-sdk/src uv run pytest tests/unit_tests/platform/test_lark_eba_adapter.py -q`
-
-Live evidence collected on May 11, 2026:
-
-- Standalone runtime: `uv run lbp rt --ws-control-port 5400 --ws-debug-port 5401 --skip-deps-check`
-- LangBot: `uv run main.py --standalone-runtime --debug`
-- Plugin: `LangBot__EBAEventProbe`
-- Feishu org/app: LangBot organization, `LangBotDev` private chat.
-- Observed plugin JSONL: one private `MessageReceived` event with `Source + Plain`; plugin API probe then exercised bot discovery, bot info, `send_message`, outbound component sweep, storage/list APIs, and safe platform API calls.
-- Real UI sends attempted after the fixes: private text, local file, and image/video image upload. These appeared in the Feishu client but did not append new `EBAEventProbe` records in the local JSONL during this run.
-- Fixes from live testing: reply path now extracts the native Feishu `message_id` from legacy-wrapped source events; WebSocket callbacks are scheduled onto the adapter event loop instead of assuming the SDK callback has a running asyncio loop; platform API results are converted to JSON-safe values.
-
-Live E2E items still required before marking release-complete:
-
-- WebSocket self-built app in LangBot organization: repeat private text after callback-loop fix, plus private image/file/audio and group mention message received by `EBAEventProbe`.
-- Webhook self-built app in LangBot organization: URL verification plus text/image/file message received by `EBAEventProbe`.
-- Store app token path: at least token acquisition/tenant-token safe API through `call_platform_api`; full message E2E if a LangBot organization store-app fixture is available.
-- Outbound component sweep: text, mention, at-all, image, file, voice where Feishu accepts the fixture, quote/fallback, and forward/fallback.
-- Safe platform API sweep: token check, chat metadata, message lookup, and message resource download using real inbound IDs.
-
-## Known Limits
-
-- Store-app live E2E requires a real ISV app ticket/tenant installation fixture.
-- Current LangBot organization WebSocket run connected successfully but did not deliver the latest UI-sent image/file attempts to local plugin evidence; this blocks release-complete media acceptance.
-- Feishu native emoji/sticker semantics are not represented as common `Face`.
-- Destructive org or chat mutations are not declared in this adapter.

docs/event-based-agents/adapters/officialaccount.md

@@ -1,101 +0,0 @@
-# OfficialAccount EBA Adapter
-
-Adapter directory: `src/langbot/pkg/platform/adapters/officialaccount/`
-
-Manifest name: `officialaccount-eba`
-
-Status: partial migration. Unit/API-shape coverage is present, and private text `plugin-e2e-ui` plus safe API evidence has been verified against the `dev.rockchin.top` Official Account fixture. Proactive outbound `send_message` remains not supported by this adapter because WeChat Official Account replies must be tied to inbound webhook windows.
-
-## Config
-
-| Field | Required | Notes |
-| --- | --- | --- |
-| `webhook_url` | no | Generated by LangBot and copied into the Official Account callback settings. |
-| `token` | yes | WeChat callback token. |
-| `EncodingAESKey` | yes | WeChat message encryption key. |
-| `AppID` | yes | Official Account app ID. |
-| `AppSecret` | yes | Official Account app secret. |
-| `Mode` | yes | `drop` waits for an in-callback reply; `passive` returns the loading text first and queues the answer for the user's next message. |
-| `LoadingMessage` | no | Only used by `passive` mode. |
-| `api_base_url` | no | Optional API base URL for proxy deployments. |
-
-## Events
-
-| Event | Evidence | Notes |
-| --- | --- | --- |
-| `message.received` | plugin-e2e-ui, unit | Text UI message verified through WeChat Official Account on `dev.rockchin.top`; image and voice webhook payloads are covered by unit tests. |
-| `platform.specific` | unit | Subscribe/menu/etc. native events are emitted as structured `PlatformSpecificEvent`. |
-
-## Common APIs
-
-| API | Evidence | Notes |
-| --- | --- | --- |
-| `reply_message` | unit | Queues/passively returns text through the inbound webhook source event. |
-| `get_message` | plugin-e2e-ui, unit | Cached inbound message retrieved by `EBAEventProbe` platform API sweep. |
-| `get_user_info` | plugin-e2e-ui, unit | Cached inbound sender retrieved by `EBAEventProbe` platform API sweep. |
-| `get_friend_list` | plugin-e2e-ui, unit | Cached inbound sender list retrieved by `EBAEventProbe` platform API sweep. |
-| `call_platform_api` | plugin-e2e-ui, unit | Safe diagnostic actions verified through `get_mode` and `get_cached_response_status`. |
-| `send_message` | not-supported | Official Account customer-service proactive messaging is not implemented by the existing SDK adapter; only webhook reply is supported here. |
-
-## Platform APIs
-
-| Action | Evidence | Notes |
-| --- | --- | --- |
-| `get_mode` | plugin-e2e-ui, unit | Returned `{"mode": "drop", "longer_response": false}` in live probe. |
-| `get_cached_response_status` | plugin-e2e-ui, unit | Returned `{"pending": false}` in live probe. |
-
-## Components
-
-| Receive Component | Evidence | Notes |
-| --- | --- | --- |
-| `Source` | plugin-e2e-ui, unit | Uses `MsgId` and `CreateTime`; live UI text message included `Source`. |
-| `Plain` | plugin-e2e-ui, unit | Live UI text message mapped to `Plain`. |
-| `Image` | unit | `PicUrl` and `MediaId` map to common `Image`. |
-| `Voice` | unit | `MediaId` maps to common `Voice`. |
-| `Unknown` | unit | Unsupported message/event types do not crash. |
-| `At`, `AtAll`, `File`, `Quote`, `Face`, `Forward`, mixed chain | not-supported | WeChat Official Account inbound webhook payloads used by the current SDK do not expose these as common structured components. |
-
-| Send Component | Evidence | Notes |
-| --- | --- | --- |
-| `Plain` | unit | Sent as webhook reply text. |
-| `Image`, `Voice`, `File`, `Quote`, `At`, `AtAll`, `Face`, `Forward`, mixed chain | not-supported | Existing SDK reply path is text XML only; non-text components degrade to readable placeholders in tests and are not declared as supported outbound components. |
-
-## Verification Record
-
-Test date: 2026-05-28
-
-Endpoint/simulator: `dev.rockchin.top` with WeChat desktop client and a real subscribed Official Account conversation. The running EBA test stack used SDK standalone runtime ports `5400/5401`, LangBot from `/home/wgc/LangBotxg/LangBotEbaTest`, and `EBAEventProbe`.
-
-Verified UI message: `EBA officialaccount single probe 2026-05-28 16:53`
-
-Observed event/API evidence:
-
-- `MessageReceived`: `bot_uuid=d7c46880-a9f8-431a-9172-5d3e0d663dbc`, `adapter_name=officialaccount-eba`, `chat_type=private`, `chat_id=ovH9L7OW6hNpWZWvp_NMmypVh26w`, `message_chain=[Source, Plain]`.
-- Common safe APIs through probe platform sweep: `get_message`, `get_user_info`, `get_friend_list`.
-- Platform APIs through `call_platform_api`: `get_mode`, `get_cached_response_status`.
-- `send_message` and outbound component sweep returned explicit `NotSupportedError: send_message:official_account_requires_inbound_webhook_reply`, as expected for this adapter.
-
-Standalone runtime command:
-
-```bash
-cd langbot-plugin-sdk
-uv run python -m langbot_plugin.cli.__init__ rt --debug-only --ws-control-port 5400 --ws-debug-port 5401 --skip-deps-check
-```
-
-Probe plugin: `data/plugins/LangBot__EBAEventProbe` when live credentials are available.
-
-Adapter live probe:
-
-```bash
-uv run python -m py_compile tests/e2e/live_officialaccount_eba_probe.py
-OFFICIALACCOUNT_TOKEN=... OFFICIALACCOUNT_ENCODING_AES_KEY=... OFFICIALACCOUNT_APP_SECRET=... OFFICIALACCOUNT_APP_ID=... uv run python tests/e2e/live_officialaccount_eba_probe.py
-```
-
-Evidence JSONL path: `/home/wgc/LangBotxg/LangBotEbaTest/data/temp/officialaccount_eba_plugin_probe.jsonl` for plugin E2E, or `data/temp/officialaccount_eba_probe.jsonl` for direct adapter live probe.
-
-Destructive operations: none.
-
-Blocked items:
-
-- `plugin-e2e-outbound`: proactive `send_message` is not supported for this adapter; Official Account responses must be produced through the inbound webhook reply window.
-- Inbound image and voice live UI evidence remains pending; webhook conversion is covered by unit tests.

docs/event-based-agents/adapters/qqofficial.md

@@ -1,114 +0,0 @@
-# QQOfficial EBA Adapter
-
-Adapter directory: `src/langbot/pkg/platform/adapters/qqofficial/`
-
-Manifest name: `qqofficial-eba`
-
-Status: partial migration. The EBA adapter structure, manifest, converters, cache-backed safe APIs, platform API map, unit tests, and direct live probe scaffold are in place. A real QQ Official WebSocket bot on `dev.rockchin.top` received an inbound user message and drove LangBot into the normal pipeline path; the response path was blocked by the test environment model service returning `model_not_found` for `deepseek-v3`.
-
-## Config
-
-| Field | Required | Notes |
-| --- | --- | --- |
-| `appid` | yes | QQ Official app ID. |
-| `secret` | yes | QQ Official app secret. |
-| `token` | yes | QQ Official callback token. |
-| `enable-webhook` | yes | Uses LangBot unified webhook when true; otherwise uses the QQ WebSocket gateway. |
-| `enable-stream-reply` | yes | Enables C2C streaming replies when supported by the QQ Official endpoint. |
-| `webhook_url` | no | Generated by LangBot and copied into the QQ Official callback settings in webhook mode. |
-
-## Events
-
-| Event | Evidence | Notes |
-| --- | --- | --- |
-| `message.received` | adapter-live, unit | `C2C_MESSAGE_CREATE`, `DIRECT_MESSAGE_CREATE`, `GROUP_AT_MESSAGE_CREATE`, and `AT_MESSAGE_CREATE` map to common `MessageReceivedEvent`. A real WebSocket-mode QQ Official bot reached the LangBot pipeline on `dev.rockchin.top`; plugin JSONL evidence remains pending. |
-| `platform.specific` | unit, blocked | Unmapped gateway events are emitted as structured `PlatformSpecificEvent`; live evidence is pending. |
-
-## Common APIs
-
-| API | Evidence | Notes |
-| --- | --- | --- |
-| `send_message` | unit, blocked | Sends private C2C, group, and text-only channel messages through the existing QQ Official client. Live outbound UI verification is pending because the test pipeline failed before producing a bot response. |
-| `reply_message` | unit, blocked | Replies using the source `QQOfficialEvent` message ID when available. Live reply was blocked by the test environment model service returning `model_not_found`. |
-| `get_message` | unit | Returns cached inbound `MessageReceivedEvent`. |
-| `get_user_info` | unit | Returns cached inbound sender. |
-| `get_friend_list` | unit | Returns cached private senders. |
-| `get_group_info` | unit | Returns cached group/channel metadata from inbound events. |
-| `get_group_member_info` | unit | Returns cached group sender as a common member. |
-| `get_group_member_list` | unit | Returns cached group members observed by the adapter. |
-| `call_platform_api` | unit, blocked | Safe diagnostic actions are implemented; live calls are pending credentials. |
-
-## Platform APIs
-
-| Action | Evidence | Notes |
-| --- | --- | --- |
-| `check_access_token` | unit, blocked | Calls the existing client token check. |
-| `refresh_access_token` | unit, blocked | Forces token refresh. |
-| `get_gateway_url` | unit, blocked | Fetches the WebSocket gateway URL. |
-| `get_mode` | unit | Returns webhook and stream-reply mode. |
-
-## Components
-
-| Receive Component | Evidence | Notes |
-| --- | --- | --- |
-| `Source` | unit | Uses QQ message/event IDs and timestamp. |
-| `Plain` | unit | Preserves text content. |
-| `At` | unit | Group and channel mention events insert an adapter bot mention marker. |
-| `Image` | unit | QQ image attachment URL is converted to common `Image`; falls back to URL if download fails. |
-| `Unknown` | unit | Unsupported/empty native payloads become `Unknown`. |
-| `Voice`, `File`, `Quote`, `Face`, `Forward`, mixed chain | blocked | Current native parser only exposes text and image attachments; live endpoint behavior still needs verification. |
-
-| Send Component | Evidence | Notes |
-| --- | --- | --- |
-| `Plain` | unit, blocked | Sends through private, group, or channel text APIs. |
-| `At`, `AtAll` | unit, blocked | Converted to readable mention text. |
-| `Image` | unit, blocked | Sends through the QQ Official rich media upload/send path for C2C and group targets. |
-| `Voice` | unit, blocked | Sends through the QQ Official rich media upload/send path for C2C and group targets. |
-| `File` | unit, blocked | Sends through the QQ Official rich media upload/send path for C2C and group targets. |
-| `Quote`, `Forward`, mixed chain | unit, blocked | Flattened to ordered send payloads where possible. |
-| `Face` | not-supported | No common QQ Official face mapping is implemented. |
-
-## Verification Record
-
-Test date: 2026-06-02
-
-Endpoint/simulator: `dev.rockchin.top` with a real QQ Official WebSocket bot (`qqofficial-eba`, bot UUID `80a5560b-52b1-40e7-b7d6-4a2341eb4780`) and LangBot running from `/home/wgc/LangBotxg/LangBotEbaTest`.
-
-Observed evidence:
-
-- The QQ Official WebSocket bot was enabled with `enable-webhook=false`.
-- A real user message reached LangBot and entered the standard pipeline path.
-- The response path stopped at the model layer with `model_not_found` for `deepseek-v3`; this is a model/provider configuration issue, not an adapter conversion failure.
-- `qq-webhook.langbot.dev` was temporarily routed through Caddy to `127.0.0.1:5301` for webhook checks, but the observed EBA bot used WebSocket mode.
-
-Standalone runtime command:
-
-```bash
-cd langbot-plugin-sdk
-uv run python -m langbot_plugin.cli.__init__ rt --debug-only --ws-control-port 5400 --ws-debug-port 5401 --skip-deps-check
-```
-
-Probe plugin: `data/plugins/LangBot__EBAEventProbe` when live credentials are available.
-
-Adapter live probe:
-
-```bash
-uv run python -m py_compile tests/e2e/live_qqofficial_eba_probe.py
-QQOFFICIAL_APPID=... QQOFFICIAL_SECRET=... QQOFFICIAL_TOKEN=... uv run python tests/e2e/live_qqofficial_eba_probe.py
-```
-
-Webhook-mode probe:
-
-```bash
-QQOFFICIAL_APPID=... QQOFFICIAL_SECRET=... QQOFFICIAL_TOKEN=... uv run python tests/e2e/live_qqofficial_eba_probe.py --webhook --host 0.0.0.0 --port 5312
-```
-
-Evidence JSONL path: `data/temp/qqofficial_eba_probe.jsonl` for direct adapter live probe; plugin E2E evidence should use `data/temp/qqofficial_eba_plugin_probe.jsonl`.
-
-Destructive operations: none implemented.
-
-Blocked items:
-
-- `plugin-e2e-ui`: standalone probe plugin JSONL evidence is still pending; the observed live run reached LangBot core/pipeline but was not recorded by the EBA probe plugin.
-- `plugin-e2e-outbound`: waiting for visible QQ client verification of plugin `send_message`/`reply_message` output after a working model/provider is configured.
-- Inbound non-text media and platform lifecycle events require endpoint evidence before they can be marked complete.

docs/event-based-agents/adapters/slack.md

@@ -1,84 +0,0 @@
-# Slack EBA Adapter
-
-## Structure
-
-Slack is migrated into `src/langbot/pkg/platform/adapters/slack/` with the standard EBA adapter layout:
-
-- `adapter.py` owns lifecycle, listener dispatch, unified webhook handling, outbound send/reply, and event caches.
-- `event_converter.py` maps Slack `im` and `app_mention` channel events to `message.received`.
-- `message_converter.py` maps common `MessageChain` components to Slack text fallback and maps inbound Slack text/image payloads back to EBA components.
-- `api_impl.py` provides cache-backed common read APIs.
-- `platform_api.py` declares safe Slack-specific API actions.
-- `manifest.yaml` declares `slack-eba`.
-
-The legacy `src/langbot/pkg/platform/sources/slack.py` adapter is kept unchanged.
-
-## Configuration
-
-| Field | Required | Notes |
-|-------|----------|-------|
-| `webhook_url` | No | Generated by LangBot. Paste it into Slack Event Subscriptions. |
-| `bot_token` | Yes | Slack bot token, usually `xoxb-...`. |
-| `signing_secret` | Yes | Slack app signing secret. |
-
-## Events
-
-| Event | Notes |
-|-------|-------|
-| `message.received` | Emitted for private `im` messages and channel `app_mention` events. Channel messages are mapped to group chats. |
-| `platform.specific` | Reserved for Slack event types that are not converted into common message events. |
-
-## Common APIs
-
-Required:
-
-- `send_message`
-- `reply_message`
-
-Optional:
-
-- `get_message`
-- `get_user_info`
-- `get_friend_list`
-- `get_group_info`
-- `get_group_list`
-- `get_group_member_list`
-- `get_group_member_info`
-- `call_platform_api`
-
-Cache-backed APIs are only available after the relevant inbound event has been observed.
-
-## Platform APIs
-
-| Action | Notes |
-|--------|-------|
-| `get_mode` | Returns webhook mode and configured bot account id. |
-| `auth_test` | Calls Slack `auth.test` with the configured bot token. |
-
-## Known Limits
-
-- Slack file/image outbound is currently represented as text fallback because the existing Slack SDK wrapper only exposes `chat_postMessage`.
-- Inbound channel coverage follows the legacy adapter behavior: only `app_mention` events are treated as group messages.
-- Real live testing requires a public callback URL configured in Slack Event Subscriptions.
-
-## Verification
-
-Local mocked unit coverage validates manifest parity, event conversion, legacy listener compatibility, cache-backed APIs, send/reply routing, and declared platform APIs.
-
-Plugin E2E evidence was captured on June 2, 2026 against `dev.rockchin.top` with Slack private DM input and `EBAEventProbe` through the standalone runtime.
-
-Evidence file: `/home/wgc/LangBotxg/LangBotEbaTest/data/temp/slack_eba_plugin_probe.jsonl`.
-
-Observed:
-
-- Real Slack private text produced `MessageReceived` with `adapter_name=slack-eba`, `Source + Plain`, private chat type, and filled `bot_uuid`.
-- Safe common APIs passed: `get_message`, `get_user_info`, `get_friend_list`.
-- Outbound component fallback sweep passed through `send_message`: plain/at/face, image, quote, file, and forward.
-- Declared Slack platform APIs passed: `get_mode`, `auth_test`.
-
-Still pending:
-
-- Channel `app_mention` plugin E2E.
-- Real inbound Slack file/image UI evidence.
-
-Live probe scaffold: `tests/e2e/live_slack_eba_probe.py`.

docs/event-based-agents/adapters/telegram.md

@@ -1,139 +0,0 @@
-# Telegram EBA Adapter
-
-## Status
-
-Telegram has been migrated to the EBA adapter directory:
-
-```text
-src/langbot/pkg/platform/adapters/telegram/
-├── adapter.py
-├── api_impl.py
-├── event_converter.py
-├── manifest.yaml
-├── message_converter.py
-├── platform_api.py
-└── types.py
-```
-
-The adapter is registered as `telegram-eba`.
-
-## Configuration
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `token` | Yes | `""` | Telegram Bot API token from BotFather. |
-| `markdown_card` | No | `true` | Whether to render Markdown card style replies. |
-| `enable-stream-reply` | Yes | `false` | Whether to use Telegram streaming reply mode. |
-
-## Events
-
-Telegram declares these EBA events:
-
-- `message.received`
-- `message.edited`
-- `message.reaction`
-- `group.member_joined`
-- `group.member_left`
-- `group.member_banned`
-- `bot.invited_to_group`
-- `bot.removed_from_group`
-- `bot.muted`
-- `bot.unmuted`
-- `platform.specific`
-
-`platform.specific` is currently used for Telegram-only callback and chat-member update payloads that do not yet have a more specific common event type.
-
-## Common APIs
-
-| API | Status | Notes |
-|-----|--------|-------|
-| `send_message` | Supported | Supports text, image, file, and mixed message chains. |
-| `reply_message` | Supported | Supports quoted replies through the original message event. |
-| `edit_message` | Supported | Uses Telegram message editing APIs. |
-| `delete_message` | Supported | Deletes messages where bot permissions allow it. |
-| `forward_message` | Supported | Forwards a message between Telegram chats. |
-| `get_group_info` | Supported | Uses Telegram chat metadata. |
-| `get_group_member_list` | Supported | Telegram only exposes administrators through the Bot API; this returns the available member set. |
-| `get_group_member_info` | Supported | Maps Telegram member status to EBA member roles. |
-| `get_user_info` | Supported | Uses Telegram `get_chat` for user chat metadata. |
-| `upload_file` | Not supported | Telegram has no standalone upload endpoint; files are uploaded as part of messages. The adapter raises `NotSupportedError`. |
-| `get_file_url` | Supported | Returns the Bot API file URL. Test output redacts the bot token. |
-| `mute_member` | Supported | Requires a supergroup and bot moderation permission. |
-| `unmute_member` | Supported | Uses current `telegram.ChatPermissions` fields. |
-| `kick_member` | Supported | Destructive; should only be run against disposable users/bots in tests. |
-| `leave_group` | Supported | Destructive; should run at the end of a live test. |
-| `call_platform_api` | Supported | See below. |
-
-## Platform-Specific APIs
-
-`call_platform_api(action, params)` supports:
-
-- `pin_message`
-- `unpin_message`
-- `unpin_all_messages`
-- `get_chat_administrators`
-- `set_chat_title`
-- `set_chat_description`
-- `get_chat_member_count`
-- `send_chat_action`
-- `create_chat_invite_link`
-- `answer_callback_query`
-
-## Live Test Record
-
-The live probe is:
-
-```bash
-uv run python tests/e2e/live_telegram_eba_probe.py --help
-```
-
-It supports private chat tests, group/supergroup tests, moderation tests, destructive tests, and a callback-only mode.
-
-Verified on May 7, 2026:
-
-- Private chat message APIs: send, reply, edit, delete, forward.
-- Private chat media APIs: image/file sending and `get_file_url`.
-- User API: `get_user_info`.
-- Supergroup APIs: group info, member list, member info, administrators, member count, invite link.
-- Supergroup mutation APIs: pin, unpin, unpin all, set title, restore title, set description, restore description.
-- Moderation APIs: mute and unmute against a non-owner target bot.
-- Destructive APIs: kick a disposable target bot, then make the test bot leave the test group.
-- Event conversion observed for `message.received`, `group.member_banned`, `group.member_left`, `bot.removed_from_group`, and Telegram-specific chat-member updates.
-
-The test fixed one real compatibility issue: `unmute_member` previously used Telegram's removed `can_send_media_messages` permission field. It now uses the split media permission fields required by current `python-telegram-bot`.
-
-## Standalone Runtime Plugin E2E Record
-
-Verified on May 10, 2026 with `EBAEventProbe`, SDK standalone runtime, Telegram Lite, `@rockchinq_bot`, and `Rock'sBotGroup`.
-
-Evidence:
-
-- Private chat JSONL: `data/temp/telegram-plugin-e2e-rerun.jsonl`
-- Group chat JSONL: `data/temp/telegram-plugin-e2e-group.jsonl`
-- Private media JSONL: `data/temp/telegram-plugin-e2e-media-ui.jsonl`
-
-Observed and verified:
-
-- `MessageReceived` reached the plugin with `bot_uuid=eba-telegram-live`, `adapter_name=telegram`, common sender/chat fields, and common `MessageChain` content.
-- `BotInvitedToGroup` reached the plugin after adding the bot to `Rock'sBotGroup`.
-- SDK API calls succeeded: `get_langbot_version`, `get_bots`, `get_bot_info`, `send_message`, plugin storage, workspace storage, `list_plugins_manifest`, `list_commands`, `list_tools`, and `list_knowledge_bases`.
-- Outbound component sweep succeeded in private and group chats: plain text, mention text/equivalent, base64 image, quoted reply, file/document, and flattened forward fallback. Group mode also covered `AtAll` fallback behavior.
-- Real Telegram Lite private-chat inbound media was verified through the plugin path: a sent document arrived as common `File`, and a sent photo arrived as common `Image`.
-- Telegram platform API sweep succeeded for safe group actions: `get_chat_administrators`, `get_chat_member_count`, and `send_chat_action`.
-- Common group/user APIs succeeded in group mode: `get_user_info`, `get_group_info`, `get_group_member_list`, and `get_group_member_info`.
-
-Documented limits in this E2E run:
-
-- Real Telegram UI inbound voice, sticker/emoji-as-common-component, and reply/quote messages were not completed in the plugin E2E evidence.
-- `get_message`, `get_friend_list`, and `get_group_list` are not supported by this Telegram adapter.
-- Mutating/destructive Telegram-specific actions such as pin/unpin, title/description changes, invite-link creation, moderation, kick, and leave were not repeated in the plugin run. They remain opt-in live-probe cases.
-- Telegram does not expose a portable common `Face` component for native sticker/emoji semantics in the current adapter.
-
-## Notes for Future Adapters
-
-Telegram is the reference implementation for:
-
-- Keeping platform-specific actions behind `call_platform_api`.
-- Treating unsupported common APIs as explicit `NotSupportedError`.
-- Marking destructive live test operations behind CLI flags.
-- Redacting access tokens from live probe output.

docs/event-based-agents/adapters/wecom.md

@@ -1,130 +0,0 @@
-# WeCom EBA Adapter
-
-## Status
-
-WeCom application messages now have an EBA adapter directory:
-
-```text
-src/langbot/pkg/platform/adapters/wecom/
-├── adapter.py
-├── api_impl.py
-├── event_converter.py
-├── manifest.yaml
-├── message_converter.py
-├── platform_api.py
-└── types.py
-```
-
-The adapter is registered as `wecom-eba`.
-
-This record covers the regular WeCom application-message adapter. WeCom AI Bot (`wecombot-eba`) uses a different protocol flow and is documented separately in `wecombot.md`. WeCom Customer Service (`wecomcs`) remains a separate follow-up migration.
-
-## Configuration
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `webhook_url` | No | `""` | Unified webhook URL copied into the WeCom application callback settings. |
-| `corpid` | Yes | `""` | WeCom corporate ID. |
-| `secret` | Yes | `""` | WeCom application secret. |
-| `token` | Yes | `""` | WeCom callback token. |
-| `EncodingAESKey` | Yes | `""` | WeCom callback encryption key. |
-| `contacts_secret` | No | `""` | Contacts secret for contact-list based helper APIs. |
-| `api_base_url` | No | `https://qyapi.weixin.qq.com/cgi-bin` | WeCom API base URL, overrideable for proxy/private-network deployments. |
-
-## Events
-
-WeCom declares these EBA events:
-
-- `message.received`
-- `platform.specific`
-
-`message.received` currently covers text and image application callbacks. Other WeCom callback types are surfaced as `platform.specific` so plugins can inspect the raw structured payload without crashing the common message path.
-
-## Common APIs
-
-| API | Status | Notes |
-|-----|--------|-------|
-| `send_message` | Supported | Private/person target only. `target_id` must be `user_id|agent_id`. Supports text, image, voice, file, flattened forward, and quote fallback. |
-| `reply_message` | Supported | Replies to the original WeCom sender and application agent from `source_platform_object`. |
-| `get_message` | Supported from cache | Returns cached inbound `MessageReceivedEvent` by message ID. |
-| `get_user_info` | Supported | Uses cached event users first, then WeCom `user/get`. |
-| `get_friend_list` | Partial | Returns users seen by this adapter instance. Full contacts listing is not declared as common coverage. |
-| `call_platform_api` | Supported | See below. |
-| `edit_message` | Not supported | WeCom application messages do not expose a general edit endpoint for sent messages. |
-| `delete_message` | Not supported | WeCom application messages do not expose a general delete endpoint for sent messages. |
-| `get_group_info` / member APIs | Not supported | Regular WeCom application callbacks handled here are private user messages, not group-chat bot messages. |
-| `upload_file` / `get_file_url` | Not supported as common APIs | WeCom media upload is used internally while sending image/voice/file components; no portable standalone common file URL is exposed. |
-
-## Platform-Specific APIs
-
-`call_platform_api(action, params)` supports:
-
-- `check_access_token`
-- `refresh_access_token`
-- `get_user_info`
-- `send_to_all`
-
-`send_to_all` requires a configured `contacts_secret` with suitable contact visibility and should be treated as a broad-send operation in live testing.
-
-## Unit Verification
-
-Covered by:
-
-```bash
-uv run pytest tests/unit_tests/platform/test_wecom_eba_adapter.py
-```
-
-The unit tests cover:
-
-- Manifest events/APIs/platform actions match adapter declarations.
-- Outbound component conversion for text, image, voice, file, quote fallback, and byte-safe text splitting.
-- Text callback conversion to `MessageReceivedEvent`.
-- Legacy `FriendMessage` compatibility.
-- EBA listener dispatch and inbound message/user cache.
-- `send_message`, `reply_message`, and safe platform API dispatch against a mocked WeCom client.
-
-## Standalone Runtime Plugin E2E Record
-
-Verified on May 27, 2026 with `EBAEventProbe`, SDK standalone runtime, LangBot core, and a real WeCom desktop client against the server test environment.
-
-```bash
-cd langbot-plugin-sdk
-uv run python -m langbot_plugin.cli.__init__ rt --debug-only --ws-control-port 5400 --ws-debug-port 5401 --skip-deps-check
-
-cd LangBot
-uv run main.py --standalone-runtime
-
-cd data/plugins/LangBot__EBAEventProbe
-EBA_PROBE_API=1 EBA_PROBE_COMPONENT_SWEEP=1 EBA_PROBE_PLATFORM_API=1 \
-uv --project /absolute/path/to/langbot-plugin-sdk run python -m langbot_plugin.cli.__init__ run
-```
-
-Evidence:
-
-- JSONL: `data/temp/wecom_eba_plugin_probe.jsonl`
-- Bot: `wecom-eba`
-- Client: real WeCom desktop client
-- Environment: `dev.rockchin.top` test server
-
-Observed and verified:
-
-- A real private WeCom user message reached the plugin as `MessageReceived` with `adapter_name=wecom-eba`, common sender/chat fields, and `Source + Plain`.
-- SDK API calls succeeded through the standalone runtime, including `get_langbot_version`, `get_bots`, `get_bot_info`, `send_message`, plugin/workspace storage, and manifest/list APIs.
-- Safe adapter API checks succeeded through the plugin path for cached message/user data and declared safe platform API actions.
-
-Still required for stricter acceptance:
-
-- Send a private image and confirm common `Image` reaches the plugin.
-- Have the plugin call `send_message` and `reply_message` for text and one media component, then verify the WeCom client receives the bot output.
-- Exercise `send_to_all` only with a disposable visible-contact scope.
-- Trigger one non-text/image callback, if available, and confirm it becomes `PlatformSpecificEventReceived`.
-
-## Current Acceptance
-
-Current status is **partial EBA acceptance**.
-
-Blocked items:
-
-- Real inbound image/voice/file evidence was not completed in this run.
-- Inbound voice/file callback parsing is not present in the legacy `WecomClient.get_message()` path, so the EBA adapter does not claim those receive components yet.
-- Group/member/moderation APIs do not apply to this regular WeCom application-message adapter.

docs/event-based-agents/adapters/wecombot.md

@@ -1,148 +0,0 @@
-# WeComBot EBA Adapter
-
-## Status
-
-WeCom AI Bot now has an EBA adapter directory:
-
-```text
-src/langbot/pkg/platform/adapters/wecombot/
-├── adapter.py
-├── api_impl.py
-├── event_converter.py
-├── manifest.yaml
-├── message_converter.py
-├── platform_api.py
-└── types.py
-```
-
-The adapter is registered as `wecombot-eba`.
-
-This is separate from regular WeCom internal applications (`wecom-eba`). WeComBot supports WebSocket long connection mode, which does not require a webhook URL. Webhook mode remains available when `enable-webhook=true`.
-
-## Configuration
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `BotId` | Yes for WebSocket mode | `""` | WeCom AI Bot ID. |
-| `robot_name` | Yes | `""` | Bot display name used to strip bot mentions from incoming group text. |
-| `enable-webhook` | Yes | `false` | `false` uses WebSocket long connection mode; `true` uses webhook callback mode. |
-| `webhook_url` | No | `""` | Unified webhook URL, only needed when webhook mode is enabled. |
-| `Secret` | Yes for WebSocket mode | `""` | WeCom AI Bot secret for long connection mode. |
-| `Corpid` | Yes for webhook mode | `""` | WeCom corporate ID for webhook callback mode. |
-| `Token` | Yes for webhook mode | `""` | WeCom callback token. |
-| `EncodingAESKey` | Yes for webhook mode; optional for WebSocket media decrypt | `""` | Message encryption/decryption key. |
-| `enable-stream-reply` | No | `true` | Enables WeComBot streaming replies. |
-
-## Events
-
-WeComBot declares these EBA events:
-
-- `message.received`
-- `feedback.received`
-- `platform.specific`
-
-`message.received` covers private and group messages from the WeComBot SDK. `feedback.received` covers WeComBot like/dislike feedback callbacks. Native SDK events without a common EBA equivalent are emitted as `platform.specific`.
-
-## Common APIs
-
-| API | Status | Notes |
-|-----|--------|-------|
-| `send_message` | Supported in WebSocket mode | Sends proactive markdown/text to a person or group chat ID. Webhook mode raises `NotSupportedError` because the platform callback flow has no proactive send path here. |
-| `reply_message` | Supported | Replies through native `req_id` in WebSocket mode or stream finalization/cache in webhook mode. |
-| `get_message` | Supported from cache | Returns cached inbound `MessageReceivedEvent` by message ID. |
-| `get_user_info` | Supported from cache | WeComBot events carry user info; no full user lookup endpoint is declared. |
-| `get_friend_list` | Partial | Returns users observed by this adapter instance. |
-| `get_group_info` | Supported from cache | Returns groups observed from inbound group messages. |
-| `get_group_member_info` | Supported from cache | Returns observed sender/group-member pairs. |
-| `get_group_member_list` | Partial | Returns observed members for the cached group only. |
-| `call_platform_api` | Supported | See below. |
-| `edit_message` / `delete_message` / `forward_message` | Not supported | WeComBot does not expose portable common APIs for these operations in the current SDK wrapper. |
-| `upload_file` / `get_file_url` | Not supported as common APIs | Media is represented inside messages; no portable standalone file upload/URL API is declared. |
-| moderation / leave APIs | Not supported | WeComBot does not expose equivalent common moderation operations through this adapter. |
-
-## Platform-Specific APIs
-
-`call_platform_api(action, params)` supports:
-
-- `is_websocket_mode`
-- `get_stream_session_status`
-- `send_markdown`
-
-`send_markdown` is only available in WebSocket mode.
-
-## Unit Verification
-
-Covered by:
-
-```bash
-PYTHONPATH=/Users/wangqiang/code/python/langbot-plugin-sdk/src uv run pytest tests/unit_tests/platform/test_wecombot_eba_adapter.py
-```
-
-The unit tests cover:
-
-- Manifest events/APIs/platform actions match adapter declarations.
-- Outbound common components flatten to WeComBot markdown/text.
-- Private and group native events become `MessageReceivedEvent`.
-- Inbound image, file, voice, and quote components map to common `MessageChain`.
-- Legacy `FriendMessage`/`GroupMessage` compatibility.
-- EBA listener dispatch, message/user/group/member cache, reply, send, streaming chunk, feedback, and platform API calls.
-
-## Live Probe
-
-The direct adapter probe is:
-
-```bash
-PYTHONPATH=/absolute/path/to/langbot-plugin-sdk/src uv run python tests/e2e/live_wecombot_eba_probe.py --help
-```
-
-Default mode is WebSocket long connection and requires:
-
-- `WECOMBOT_BOT_ID`
-- `WECOMBOT_SECRET`
-- `WECOMBOT_ROBOT_NAME`
-- optional `WECOMBOT_ENCODING_AES_KEY`
-
-Webhook mode uses `--webhook` and requires:
-
-- `WECOMBOT_TOKEN`
-- `WECOMBOT_ENCODING_AES_KEY`
-- `WECOMBOT_CORPID`
-
-The probe writes JSONL evidence to `data/temp/wecombot_eba_live_probe.jsonl`, waits for a real WeComBot message, records common EBA event fields and message components, then runs safe cached/common/platform API checks.
-
-## Standalone Runtime Plugin E2E Record
-
-Verified on May 27, 2026 with `EBAEventProbe`, SDK standalone runtime, LangBot core, and the real WeCom desktop client in a WeCom AI Bot private chat.
-
-Evidence:
-
-- JSONL: `data/temp/wecombot_eba_plugin_probe.jsonl`
-- Bot UUID: `9f5d4125-7b6d-4c98-8ca2-111111111111`
-- Adapter: `wecombot-eba`
-- Client: real WeCom desktop client, private `LangBot` BOT chat
-- Mode: WebSocket long connection (`enable-webhook=false`)
-
-Observed and verified:
-
-- A real user-side message reached the plugin as `MessageReceived` with `adapter_name=wecombot-eba`, common sender/chat fields, and `Source + Plain`.
-- SDK API calls succeeded through the standalone runtime: `get_langbot_version`, `get_bots`, `get_bot_info`, `send_message`, plugin/workspace storage, manifest/list APIs, and safe cached common platform APIs.
-- Outbound component sweep was visible in the WeCom client and returned `errcode=0`: plain/mention/face fallback, base64 image marker, quote fallback, file marker, and flattened forward fallback.
-- Declared WeComBot platform APIs succeeded through `plugin.call_platform_api`: `is_websocket_mode`, `get_stream_session_status`, and `send_markdown`.
-- The `send_markdown` platform API produced visible bot output in the WeCom client.
-
-Not completed:
-
-- Clicking the visible WeCom AI feedback button did not produce a `FeedbackReceived` JSONL entry in this run, so `feedback.received` remains unverified at plugin E2E level.
-- Group chat inbound and group cache/member coverage still need a real group-side trigger.
-- Real inbound image/file/voice from the WeCom client was not exercised.
-
-## Current Acceptance
-
-Current status is **partial EBA acceptance**.
-
-Blocked or limited items:
-
-- `feedback.received` is implemented and unit-covered, but real plugin E2E feedback evidence was not observed from the desktop client click.
-- Outbound image/voice/file are flattened as textual markers because the WeComBot SDK reply/proactive path used here is markdown/text oriented.
-- Group member APIs are cache-backed and only know members observed in received messages.
-- Destructive or moderation APIs are not declared because the current WeComBot protocol surface does not provide safe common equivalents.

docs/event-based-agents/adapters/wecomcs.md

@@ -1,161 +0,0 @@
-# WeCom Customer Service EBA Adapter
-
-## Status
-
-WeCom Customer Service now has an EBA adapter directory:
-
-```text
-src/langbot/pkg/platform/adapters/wecomcs/
-├── adapter.py
-├── api_impl.py
-├── event_converter.py
-├── manifest.yaml
-├── message_converter.py
-├── platform_api.py
-└── types.py
-```
-
-The adapter is registered as `wecomcs-eba`. It is separate from regular WeCom application messages (`wecom-eba`) and WeCom AI Bot (`wecombot-eba`).
-
-## Configuration
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `webhook_url` | No | `""` | Unified webhook URL copied into the WeCom Customer Service callback settings. |
-| `corpid` | Yes | `""` | WeCom corporate ID. |
-| `secret` | Yes | `""` | Customer Service secret used for access tokens. |
-| `token` | Yes | `""` | Customer Service callback token. |
-| `EncodingAESKey` | Yes | `""` | Customer Service callback encryption key. |
-| `api_base_url` | No | `https://qyapi.weixin.qq.com/cgi-bin` | WeCom API base URL, overrideable for proxy/private-network deployments. |
-
-## Events
-
-| Event | Status | Notes |
-|-------|--------|-------|
-| `message.received` | Plugin E2E UI covered for text | Text, image, file, and voice payloads convert to common EBA message components in unit tests. Real WeChat customer-side UI text reached `EBAEventProbe` on May 27, 2026. |
-| `platform.specific` | Unit covered | Non-message or unknown Customer Service payloads become structured `PlatformSpecificEvent` records. |
-
-## Common APIs
-
-| API | Status | Notes |
-|-----|--------|-------|
-| `send_message` | Plugin E2E outbound covered | Private/person target only. `target_id` must be `external_userid|open_kfid`. Text and image are implemented; voice/file are explicitly unsupported. |
-| `reply_message` | Plugin E2E partial | Replies through Customer Service `kf/send_msg` using the original `source_platform_object`. The pipeline reply path reached the send API, but the dev account later hit WeCom `95001 send msg count limit`. |
-| `get_message` | Plugin E2E covered from cache | Returns cached inbound `MessageReceivedEvent` by message ID. |
-| `get_user_info` | Plugin E2E covered | Uses cached event users first, then Customer Service `customer/batchget`. |
-| `get_friend_list` | Plugin E2E covered, partial | Returns customer users seen by this adapter instance. |
-| `call_platform_api` | Unit covered | See platform-specific APIs below. |
-| `edit_message` / `delete_message` | Not supported | WeCom Customer Service does not expose a general edit/delete endpoint for bot-sent messages in this adapter. |
-| Group/member/moderation APIs | Not supported | Customer Service conversations handled here are private customer sessions, not group chats. |
-| `upload_file` / `get_file_url` | Not supported | Media upload is used internally for outbound image; no portable file URL common API is exposed. |
-
-## Platform-Specific APIs
-
-| Action | Status | Notes |
-|--------|--------|-------|
-| `check_access_token` | Unit covered | Checks whether the current access token is present. |
-| `refresh_access_token` | Unit covered | Refreshes the Customer Service access token. |
-| `get_customer_info` | Unit covered | Calls Customer Service customer lookup by `external_userid`. |
-
-## Message Components
-
-Receive:
-
-| Component | Status | Notes |
-|-----------|--------|-------|
-| `Source` | Unit covered | Uses Customer Service `msgid` and `send_time`. |
-| `Plain` | Unit covered | Text payload content is preserved. |
-| `Image` | Unit covered | Uses the base64 data URL produced by the existing SDK image download path. |
-| `Voice` | Unit covered | Maps exposed voice media ID to common `Voice.voice_id`; live UI evidence pending. |
-| `File` | Unit covered | Maps exposed file media ID/name/size to common `File`; live UI evidence pending. |
-| `Quote`, `At`, `AtAll`, `Face`, `Forward` | Not supported inbound | The current Customer Service SDK event model does not expose these as structured inbound fields. |
-| `Unknown` | Unit covered | Unsupported message types become `Unknown` in message conversion or `platform.specific` at event level. |
-
-Send:
-
-| Component | Status | Notes |
-|-----------|--------|-------|
-| `Plain` | Plugin E2E outbound covered | Sends through `kf/send_msg` text. |
-| `Image` | Plugin E2E outbound covered | Uploads media as WeCom image media and sends through `kf/send_msg` image. |
-| `Quote`, `At`, `AtAll`, `Forward` | Unit covered fallback, live partially blocked | Flattened to text where possible. In the May 27 sweep, later text sends hit WeCom `95001 send msg count limit` after the successful text/image sends. |
-| `Voice`, `File`, `Face` | Not supported | The adapter raises `NotSupportedError`; no tested Customer Service send path is implemented. |
-
-## Unit Verification
-
-Covered by:
-
-```bash
-PYTHONPATH=/Users/wangqiang/code/python/langbot-plugin-sdk/src uv run pytest tests/unit_tests/platform/test_wecomcs_eba_adapter.py
-```
-
-Result on May 27, 2026: `10 passed`.
-
-The local `PYTHONPATH` is required in this workspace because the installed SDK package in the LangBot venv does not contain the newer `langbot_plugin.api.entities.builtin.platform.errors` module; the existing EBA adapter tests need the same SDK override.
-
-## Live Probe
-
-Auxiliary direct adapter probe:
-
-```bash
-PYTHONPATH=/path/to/langbot-plugin-sdk/src uv run python -m py_compile tests/e2e/live_wecomcs_eba_probe.py
-
-WECOMCS_CORPID=... \
-WECOMCS_SECRET=... \
-WECOMCS_TOKEN=... \
-WECOMCS_ENCODING_AES_KEY=... \
-PYTHONPATH=/path/to/langbot-plugin-sdk/src \
-uv run python tests/e2e/live_wecomcs_eba_probe.py \
-  --path /wecomcs/callback \
-  --log data/temp/wecomcs_eba_live_probe.jsonl
-```
-
-This probe is diagnostic only. Final EBA acceptance still requires the standalone SDK runtime plus `EBAEventProbe` plugin path.
-
-## Standalone Runtime Plugin E2E Record
-
-Completed partial plugin E2E on May 27, 2026 against `dev.rockchin.top` and the WeChat customer-side UI entry `微信 -> 客服消息 -> 浪波智能客服`.
-
-Evidence:
-
-- Server JSONL: `/home/wgc/LangBotxg/LangBotEbaTest/data/temp/wecomcs_eba_plugin_probe.jsonl`
-- Trigger text: `EBA wecomcs dedupe probe 2026-05-27`
-- `bot_uuid`: `cc810d2c-91f3-4f92-8f27-e1bf9f7b6cb4`
-- `adapter_name`: `wecomcs-eba`
-- Observed common event: `MessageReceived`, `event.type=message.received`
-- Observed message chain: `Source + Plain`
-- Observed chat: `chat_type=private`, `chat_id=external_userid|open_kfid`
-- Observed sender: customer `User` with nickname/avatar from Customer Service lookup
-- Plugin API probe: `send_message`, `get_message`, `get_user_info`, `get_friend_list`, plugin/workspace storage, and manifest/list APIs succeeded
-- Component sweep: outbound `Plain` and `Image` succeeded; `Face` and `File` returned explicit `NotSupportedError`; later quote/forward fallback sends were blocked by WeCom `95001 send msg count limit`
-
-Command shape used:
-
-```bash
-cd langbot-plugin-sdk
-uv run python -m langbot_plugin.cli.__init__ rt --debug-only --ws-control-port 5400 --ws-debug-port 5401 --skip-deps-check
-
-cd LangBot
-PYTHONPATH=/absolute/path/to/langbot-plugin-sdk/src uv run main.py --standalone-runtime
-
-cd data/plugins/LangBot__EBAEventProbe
-DEBUG_RUNTIME_WS_URL=ws://127.0.0.1:5401/plugin/ws \
-EBA_PROBE_LOG=/absolute/path/to/LangBot/data/temp/wecomcs_eba_plugin_probe.jsonl \
-EBA_PROBE_API=1 \
-EBA_PROBE_COMPONENT_SWEEP=1 \
-EBA_PROBE_PLATFORM_API=1 \
-uv --project /absolute/path/to/langbot-plugin-sdk run python -m langbot_plugin.cli.__init__ run
-```
-
-Required real UI trigger: send a Customer Service message from the WeCom/WeChat customer-side UI to the configured `dev.rockchin.top` Customer Service account.
-
-## Current Acceptance
-
-Current status is **partial EBA acceptance**.
-
-Blocked or pending items:
-
-- Inbound UI media (`Image`, `Voice`, `File`) was not sent from the real WeChat customer UI during this run, so receive-side media remains unit-covered only.
-- Pipeline auto-reply reached `kf/send_msg`, but the test account hit WeCom `95001 send msg count limit` after successful plugin outbound text/image sends. This is recorded as an account/platform rate-limit block, not a conversion or API-shape failure.
-- The current `EBAEventProbe` run did not call the adapter-specific `call_platform_api` actions (`check_access_token`, `refresh_access_token`, `get_customer_info`); the platform API map remains unit-covered.
-- Inbound voice/file depends on whether the real Customer Service callback plus `sync_msg` endpoint returns those fields in the shape the local SDK models.
-- Group, member, edit, delete, moderation, and standalone file URL APIs are intentionally not declared because this Customer Service protocol path does not provide tested common equivalents.

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "langbot"
-version = "4.10.1"
+version = "4.10.2"
 description = "Production-grade platform for building agentic IM bots"
 readme = "README.md"
 license-files = ["LICENSE"]
@@ -70,7 +70,7 @@ dependencies = [
     "chromadb>=1.0.0,<2.0.0",
     "qdrant-client (>=1.15.1,<2.0.0)",
     "pyseekdb==1.1.0.post3",
-    "langbot-plugin==0.5.0a2",
+    "langbot-plugin==0.4.4",
     "asyncpg>=0.30.0",
     "line-bot-sdk>=3.19.0",
     "matrix-nio>=0.25.2",
@@ -79,6 +79,7 @@ dependencies = [
     "pymilvus>=2.6.4",
     "pgvector>=0.4.1",
     "botocore>=1.42.39",
+    "litellm>=1.0.0",
 ]
 keywords = [
     "bot",
@@ -118,7 +119,7 @@ requires = ["setuptools>=61.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools]
-package-data = { "langbot" = ["templates/**", "pkg/provider/modelmgr/requesters/*", "pkg/platform/sources/*", "pkg/platform/adapters/**", "web/dist/**", "pkg/persistence/alembic/**"] }
+package-data = { "langbot" = ["templates/**", "pkg/provider/modelmgr/requesters/*", "pkg/platform/sources/*", "web/dist/**", "pkg/persistence/alembic/**"] }
 
 [dependency-groups]
 dev = [

src/langbot/__init__.py

@@ -1,3 +1,3 @@
 """LangBot - Production-grade platform for building agentic IM bots"""
 
-__version__ = '4.10.1'
+__version__ = '4.10.2'

src/langbot/libs/dingtalk_api/api.py

@@ -438,13 +438,8 @@ class DingTalkClient:
         try:
             async with httpx.AsyncClient() as client:
                 response = await client.post(url, headers=headers, json=data)
-                try:
-                    body = response.json()
-                except Exception:
-                    body = {'text': response.text}
                 if response.status_code == 200:
-                    return body
+                    return
-                raise Exception(f'Error: {response.status_code}, {body}')
         except Exception:
             await self.logger.error(f'failed to send proactive massage to person: {traceback.format_exc()}')
             raise Exception(f'failed to send proactive massage to person: {traceback.format_exc()}')
@@ -469,13 +464,8 @@ class DingTalkClient:
         try:
             async with httpx.AsyncClient() as client:
                 response = await client.post(url, headers=headers, json=data)
-                try:
-                    body = response.json()
-                except Exception:
-                    body = {'text': response.text}
                 if response.status_code == 200:
-                    return body
+                    return
-                raise Exception(f'Error: {response.status_code}, {body}')
         except Exception:
             await self.logger.error(f'failed to send proactive massage to group: {traceback.format_exc()}')
             raise Exception(f'failed to send proactive massage to group: {traceback.format_exc()}')

src/langbot/libs/official_account_api/api.py

@@ -93,30 +93,15 @@ class OAClient:
                 raise Exception('msg_signature不在请求体中')
 
             if req.method == 'GET':
-                if msg_signature:
+                # 校验签名
-                    wxcpt = WXBizMsgCrypt(self.token, self.aes, self.appid)
-                    ret, reply_echo = wxcpt.VerifyURL(msg_signature, timestamp, nonce, echostr)
-                    if ret == 0:
-                        return reply_echo
-                    await self.logger.error(
-                        'OfficialAccount encrypted URL verification failed: '
-                        f'ret={ret}, timestamp_present={bool(timestamp)}, nonce_present={bool(nonce)}, '
-                        f'echostr_present={bool(echostr)}'
-                    )
-
-                # Plaintext callback verification.
                 check_str = ''.join(sorted([self.token, timestamp, nonce]))
                 check_signature = hashlib.sha1(check_str.encode('utf-8')).hexdigest()
 
                 if check_signature == signature:
                     return echostr  # 验证成功返回echostr
                 else:
-                    await self.logger.error(
+                    await self.logger.error('拒绝请求')
-                        'OfficialAccount plaintext URL verification failed: '
+                    raise Exception('拒绝请求')
-                        f'signature_present={bool(signature)}, timestamp_present={bool(timestamp)}, '
-                        f'nonce_present={bool(nonce)}, echostr_present={bool(echostr)}'
-                    )
-                    return 'signature verification failed', 403
             elif req.method == 'POST':
                 encryt_msg = await req.data
                 wxcpt = WXBizMsgCrypt(self.token, self.aes, self.appid)
@@ -294,27 +279,9 @@ class OAClientForLongerResponse:
                 raise Exception('msg_signature不在请求体中')
 
             if req.method == 'GET':
-                if msg_signature:
-                    wxcpt = WXBizMsgCrypt(self.token, self.aes, self.appid)
-                    ret, reply_echo = wxcpt.VerifyURL(msg_signature, timestamp, nonce, echostr)
-                    if ret == 0:
-                        return reply_echo
-                    await self.logger.error(
-                        'OfficialAccount encrypted URL verification failed: '
-                        f'ret={ret}, timestamp_present={bool(timestamp)}, nonce_present={bool(nonce)}, '
-                        f'echostr_present={bool(echostr)}'
-                    )
-
                 check_str = ''.join(sorted([self.token, timestamp, nonce]))
                 check_signature = hashlib.sha1(check_str.encode('utf-8')).hexdigest()
-                if check_signature == signature:
+                return echostr if check_signature == signature else '拒绝请求'
-                    return echostr
-                await self.logger.error(
-                    'OfficialAccount plaintext URL verification failed: '
-                    f'signature_present={bool(signature)}, timestamp_present={bool(timestamp)}, '
-                    f'nonce_present={bool(nonce)}, echostr_present={bool(echostr)}'
-                )
-                return 'signature verification failed', 403
 
             elif req.method == 'POST':
                 encryt_msg = await req.data

src/langbot/libs/wecom_ai_bot_api/api.py

@@ -1,5 +1,3 @@
-from __future__ import annotations
-
 import asyncio
 import base64
 import json
@@ -9,7 +7,7 @@ import uuid
 import xml.etree.ElementTree as ET
 from dataclasses import dataclass, field
 import re
-from typing import TYPE_CHECKING, Any, Callable, Optional, Tuple
+from typing import Any, Callable, Optional, Tuple
 from urllib.parse import unquote
 
 import httpx
@@ -18,9 +16,7 @@ from quart import Quart, request, Response, jsonify
 
 from langbot.libs.wecom_ai_bot_api import wecombotevent
 from langbot.libs.wecom_ai_bot_api.WXBizMsgCrypt3 import WXBizMsgCrypt
-
+from langbot.pkg.platform.logger import EventLogger
-if TYPE_CHECKING:
-    from langbot.pkg.platform.logger import EventLogger
 
 
 @dataclass

src/langbot/libs/wecom_ai_bot_api/ws_client.py

@@ -15,15 +15,13 @@ import json
 import secrets
 import time
 import traceback
-from typing import TYPE_CHECKING, Any, Callable, Optional
+from typing import Any, Callable, Optional
 
 import aiohttp
 
 from langbot.libs.wecom_ai_bot_api import wecombotevent
 from langbot.libs.wecom_ai_bot_api.api import parse_wecom_bot_message, StreamSession
-
+from langbot.pkg.platform.logger import EventLogger
-if TYPE_CHECKING:
-    from langbot.pkg.platform.logger import EventLogger
 
 DEFAULT_WS_URL = 'wss://openws.work.weixin.qq.com'
 

src/langbot/libs/wecom_customer_service_api/api.py

@@ -207,33 +207,7 @@ class WecomCSClient:
                 return await self.send_text_msg(open_kfid, external_userid, msgid, content)
             if data['errcode'] != 0:
                 await self.logger.error(f'发送消息失败：{data}')
-                raise Exception(f'Failed to send message: {data}')
+                raise Exception('Failed to send message')
-            return data
-
-    async def send_image_msg(self, open_kfid: str, external_userid: str, msgid: str, media_id: str):
-        if not await self.check_access_token():
-            self.access_token = await self.get_access_token(self.secret)
-
-        url = f'{self.base_url}/kf/send_msg?access_token={self.access_token}'
-        payload = {
-            'touser': external_userid,
-            'open_kfid': open_kfid,
-            'msgid': msgid,
-            'msgtype': 'image',
-            'image': {
-                'media_id': media_id,
-            },
-        }
-
-        async with httpx.AsyncClient() as client:
-            response = await client.post(url, json=payload)
-            data = response.json()
-            if data['errcode'] == 40014 or data['errcode'] == 42001:
-                self.access_token = await self.get_access_token(self.secret)
-                return await self.send_image_msg(open_kfid, external_userid, msgid, media_id)
-            if data['errcode'] != 0:
-                await self.logger.error(f'发送图片消息失败：{data}')
-                raise Exception('Failed to send image message')
             return data
 
     async def handle_callback_request(self):
@@ -348,7 +322,7 @@ class WecomCSClient:
         if not await self.check_access_token():
             self.access_token = await self.get_access_token(self.secret)
 
-        url = self.base_url + '/media/upload?access_token=' + self.access_token + '&type=image'
+        url = self.base_url + '/media/upload?access_token=' + self.access_token + '&type=file'
         file_bytes = None
         file_name = 'uploaded_file.txt'
 
@@ -394,7 +368,7 @@ class WecomCSClient:
                 self.access_token = await self.get_access_token(self.secret)
                 media_id = await self.upload_to_work(image)
             if data.get('errcode', 0) != 0:
-                raise Exception(f'failed to upload image: {data}')
+                raise Exception('failed to upload file')
 
             media_id = data.get('media_id')
             return media_id

src/langbot/pkg/agent/__init__.py

@@ -0,0 +1,37 @@
+"""Agent runner subsystem for LangBot."""
+from __future__ import annotations
+
+from .runner.descriptor import AgentRunnerDescriptor
+from .runner.id import parse_runner_id, format_runner_id, RunnerIdParts, is_plugin_runner_id
+from .runner.errors import (
+    AgentRunnerError,
+    RunnerNotFoundError,
+    RunnerNotAuthorizedError,
+    RunnerProtocolError,
+    RunnerExecutionError,
+)
+from .runner.registry import AgentRunnerRegistry
+from .runner.context_builder import AgentRunContextBuilder
+from .runner.resource_builder import AgentResourceBuilder
+from .runner.result_normalizer import AgentResultNormalizer
+from .runner.orchestrator import AgentRunOrchestrator
+from .runner.config_migration import ConfigMigration
+
+__all__ = [
+    'AgentRunnerDescriptor',
+    'parse_runner_id',
+    'format_runner_id',
+    'is_plugin_runner_id',
+    'RunnerIdParts',
+    'AgentRunnerError',
+    'RunnerNotFoundError',
+    'RunnerNotAuthorizedError',
+    'RunnerProtocolError',
+    'RunnerExecutionError',
+    'AgentRunnerRegistry',
+    'AgentRunContextBuilder',
+    'AgentResourceBuilder',
+    'AgentResultNormalizer',
+    'AgentRunOrchestrator',
+    'ConfigMigration',
+]

src/langbot/pkg/agent/runner/__init__.py

@@ -0,0 +1,66 @@
+"""Agent runner modules."""
+
+from __future__ import annotations
+
+from .descriptor import AgentRunnerDescriptor
+from .id import parse_runner_id, format_runner_id, RunnerIdParts
+from .errors import (
+    AgentRunnerError,
+    RunnerNotFoundError,
+    RunnerNotAuthorizedError,
+    RunnerProtocolError,
+    RunnerExecutionError,
+)
+from .registry import AgentRunnerRegistry
+from .context_builder import AgentRunContextBuilder
+from .resource_builder import AgentResourceBuilder
+from .result_normalizer import AgentResultNormalizer
+from .orchestrator import AgentRunOrchestrator
+from .config_migration import ConfigMigration
+from .default_config import AgentRunnerDefaultConfigService
+from .binding_resolver import AgentBindingResolver, AgentBindingResolutionError
+from .session_registry import (
+    AgentRunSessionRegistry,
+    AgentRunSession,
+    RunAuthorizationSnapshot,
+    get_session_registry,
+)
+from .run_ledger_store import RunLedgerStore
+from .events import (
+    MESSAGE_RECEIVED,
+    MESSAGE_RECALLED,
+    GROUP_MEMBER_JOINED,
+    FRIEND_REQUEST_RECEIVED,
+    RESERVED_EVENT_TYPES,
+)
+
+__all__ = [
+    'AgentRunnerDescriptor',
+    'parse_runner_id',
+    'format_runner_id',
+    'RunnerIdParts',
+    'AgentRunnerError',
+    'RunnerNotFoundError',
+    'RunnerNotAuthorizedError',
+    'RunnerProtocolError',
+    'RunnerExecutionError',
+    'AgentRunnerRegistry',
+    'AgentRunContextBuilder',
+    'AgentResourceBuilder',
+    'AgentResultNormalizer',
+    'AgentRunOrchestrator',
+    'ConfigMigration',
+    'AgentRunnerDefaultConfigService',
+    'AgentBindingResolver',
+    'AgentBindingResolutionError',
+    'AgentRunSessionRegistry',
+    'AgentRunSession',
+    'RunAuthorizationSnapshot',
+    'get_session_registry',
+    'RunLedgerStore',
+    'MESSAGE_RECEIVED',
+    'MESSAGE_RECALLED',
+    'GROUP_MEMBER_JOINED',
+    'FRIEND_REQUEST_RECEIVED',
+    'RESERVED_EVENT_TYPES',
+]

src/langbot/pkg/agent/runner/artifact_store.py

@@ -0,0 +1,535 @@
+"""Artifact store for managing Host-owned artifacts."""
+from __future__ import annotations
+
+import json
+import datetime
+import typing
+import uuid
+import base64
+import os
+
+import aiofiles
+import sqlalchemy
+from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession
+from sqlalchemy.orm import sessionmaker
+
+from ...entity.persistence.artifact import AgentArtifact
+from ...entity.persistence.bstorage import BinaryStorage
+
+_FILE_ARTIFACT_METADATA_KEY = '_langbot_file_artifact'
+_ARTIFACT_THREAD_METADATA_KEY = '_langbot_thread_id'
+UTC = datetime.timezone.utc
+
+
+def _utc_now() -> datetime.datetime:
+    return datetime.datetime.now(UTC)
+
+
+def _as_utc(value: datetime.datetime) -> datetime.datetime:
+    if value.tzinfo is None:
+        return value.replace(tzinfo=UTC)
+    return value.astimezone(UTC)
+
+
+def _datetime_to_epoch(value: datetime.datetime | None) -> int | None:
+    if value is None:
+        return None
+    return int(_as_utc(value).timestamp())
+
+
+class ArtifactStore:
+    """Store for AgentArtifact records.
+
+    Handles artifact metadata registration and content retrieval.
+    Actual blob storage is delegated to BinaryStorage or external storage.
+
+    All methods are async and use the provided database engine.
+    """
+
+    engine: AsyncEngine
+
+    # Hard limits
+    MAX_INLINE_READ_BYTES = 1024 * 1024  # 1MB max for inline base64
+    MAX_RANGE_READ_BYTES = 10 * 1024 * 1024  # 10MB max for range reads
+
+    def __init__(self, engine: AsyncEngine):
+        self.engine = engine
+        self._session_factory = sessionmaker(
+            engine, class_=AsyncSession, expire_on_commit=False
+        )
+
+    async def register_file_artifact(
+        self,
+        *,
+        artifact_id: str | None,
+        host_path: str,
+        host_root: str,
+        artifact_type: str = 'file',
+        source: str = 'tool',
+        mime_type: str | None = None,
+        name: str | None = None,
+        size_bytes: int | None = None,
+        sha256: str | None = None,
+        conversation_id: str | None = None,
+        run_id: str | None = None,
+        runner_id: str | None = None,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        expires_at: datetime.datetime | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> str:
+        """Register a Host-owned artifact backed by a bounded local file path.
+
+        The public metadata intentionally excludes the real host path. Reads go
+        through read_artifact(), which revalidates the path against host_root.
+        """
+        real_path, real_root = self._validate_file_artifact_path(host_path, host_root)
+        if not os.path.isfile(real_path):
+            raise ValueError('file artifact path must point to a file')
+
+        public_metadata = dict(metadata or {})
+        public_metadata[_FILE_ARTIFACT_METADATA_KEY] = {
+            'path': real_path,
+            'root': real_root,
+        }
+
+        if size_bytes is None:
+            size_bytes = os.path.getsize(real_path)
+
+        return await self.register_artifact(
+            artifact_id=artifact_id,
+            artifact_type=artifact_type,
+            source=source,
+            storage_key=f'file:{uuid.uuid4().hex}',
+            storage_type='file',
+            mime_type=mime_type,
+            name=name or os.path.basename(real_path),
+            size_bytes=size_bytes,
+            sha256=sha256,
+            conversation_id=conversation_id,
+            run_id=run_id,
+            runner_id=runner_id,
+            bot_id=bot_id,
+            workspace_id=workspace_id,
+            thread_id=thread_id,
+            expires_at=expires_at,
+            metadata=public_metadata,
+            content=None,
+        )
+
+    async def register_artifact(
+        self,
+        artifact_id: str | None,
+        artifact_type: str,
+        source: str,
+        storage_key: str | None = None,
+        storage_type: str = 'binary_storage',
+        mime_type: str | None = None,
+        name: str | None = None,
+        size_bytes: int | None = None,
+        sha256: str | None = None,
+        conversation_id: str | None = None,
+        run_id: str | None = None,
+        runner_id: str | None = None,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        expires_at: datetime.datetime | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+        content: bytes | None = None,
+    ) -> str:
+        """Register a new artifact.
+
+        If content is provided and storage_key is None, stores content
+        in BinaryStorage automatically.
+
+        Args:
+            artifact_id: Unique artifact ID (generated if None)
+            artifact_type: Type of artifact (image, file, voice, tool_result, etc.)
+            source: Source of artifact (platform, runner, tool, system)
+            storage_key: Key in BinaryStorage or external reference
+            storage_type: Storage type (binary_storage, file, url)
+            mime_type: MIME type
+            name: Original file name
+            size_bytes: Size in bytes
+            sha256: SHA256 hash
+            conversation_id: Conversation ID
+            run_id: Run ID that created this
+            runner_id: Runner ID that created this
+            bot_id: Bot UUID
+            workspace_id: Workspace ID
+            thread_id: Thread ID stored as Host-only metadata
+            expires_at: Expiration time
+            metadata: Additional metadata
+            content: Optional content to store in BinaryStorage
+
+        Returns:
+            The artifact_id
+        """
+        if artifact_id is None:
+            artifact_id = str(uuid.uuid4())
+
+        metadata_payload = dict(metadata or {})
+        if thread_id is not None:
+            metadata_payload[_ARTIFACT_THREAD_METADATA_KEY] = thread_id
+
+        # If content provided, store in BinaryStorage
+        if content is not None and storage_key is None:
+            storage_key = f"artifact:{artifact_id}"
+            storage_type = 'binary_storage'
+            if size_bytes is None:
+                size_bytes = len(content)
+
+        async with self._session_factory() as session:
+            # Store content in BinaryStorage if provided
+            if content is not None:
+                binary_storage = BinaryStorage(
+                    unique_key=f'artifact:{artifact_id}',
+                    key=storage_key,
+                    owner_type='artifact',
+                    owner='host',
+                    value=content,
+                )
+                session.add(binary_storage)
+
+            # Store artifact metadata
+            artifact = AgentArtifact(
+                artifact_id=artifact_id,
+                artifact_type=artifact_type,
+                mime_type=mime_type,
+                name=name,
+                size_bytes=size_bytes,
+                sha256=sha256,
+                source=source,
+                storage_key=storage_key,
+                storage_type=storage_type,
+                conversation_id=conversation_id,
+                run_id=run_id,
+                runner_id=runner_id,
+                bot_id=bot_id,
+                workspace_id=workspace_id,
+                created_at=_utc_now(),
+                expires_at=expires_at,
+                metadata_json=json.dumps(metadata_payload) if metadata_payload else None,
+            )
+            session.add(artifact)
+            await session.commit()
+
+        return artifact_id
+
+    async def get_metadata(
+        self,
+        artifact_id: str,
+    ) -> dict[str, typing.Any] | None:
+        """Get artifact metadata (public fields only, no internal storage info).
+
+        Args:
+            artifact_id: Artifact ID
+
+        Returns:
+            Artifact metadata dict compatible with SDK ArtifactMetadata, or None if not found
+        """
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(AgentArtifact).where(
+                    AgentArtifact.artifact_id == artifact_id
+                )
+            )
+            row = result.scalars().first()
+            if row is None:
+                return None
+            if self._is_expired(row):
+                return None
+            return self._row_to_public_dict(row)
+
+    async def get_authorization_metadata(
+        self,
+        artifact_id: str,
+    ) -> dict[str, typing.Any] | None:
+        """Get artifact metadata with Host-only scope fields for authorization."""
+        row = await self._get_internal_record(artifact_id)
+        if row is None:
+            return None
+        metadata = self._row_to_public_dict(row)
+        metadata.update({
+            'bot_id': row.bot_id,
+            'workspace_id': row.workspace_id,
+            'thread_id': self._load_metadata(row.metadata_json).get(_ARTIFACT_THREAD_METADATA_KEY),
+        })
+        return metadata
+
+    async def _get_internal_record(
+        self,
+        artifact_id: str,
+    ) -> AgentArtifact | None:
+        """Get full artifact record including internal fields.
+
+        Used internally by read_artifact to access storage_key/storage_type.
+
+        Args:
+            artifact_id: Artifact ID
+
+        Returns:
+            AgentArtifact ORM instance, or None if not found
+        """
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(AgentArtifact).where(
+                    AgentArtifact.artifact_id == artifact_id
+                )
+            )
+            record = result.scalars().first()
+            if record is not None and self._is_expired(record):
+                return None
+            return record
+
+    async def read_artifact(
+        self,
+        artifact_id: str,
+        offset: int = 0,
+        limit: int | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Read artifact content.
+
+        For small artifacts, returns content_base64 directly.
+        For large artifacts, returns file_key for chunked transfer.
+
+        Args:
+            artifact_id: Artifact ID
+            offset: Byte offset to start reading from (must be >= 0)
+            limit: Maximum bytes to read (must be > 0 if provided)
+
+        Returns:
+            ArtifactReadResult dict, or None if not found
+
+        Raises:
+            ValueError: If offset < 0 or limit <= 0
+        """
+        # Validate offset and limit
+        if offset < 0:
+            raise ValueError("offset must be >= 0")
+
+        if limit is not None and limit <= 0:
+            raise ValueError("limit must be > 0")
+
+        # Get internal record (includes storage_key/storage_type)
+        record = await self._get_internal_record(artifact_id)
+        if record is None:
+            return None
+
+        storage_type = record.storage_type or 'binary_storage'
+        storage_key = record.storage_key
+        size_bytes = record.size_bytes or 0
+
+        # Cap limit at hard limit
+        if limit is None:
+            limit = self.MAX_INLINE_READ_BYTES
+        limit = min(limit, self.MAX_RANGE_READ_BYTES)
+
+        # For binary_storage, read content
+        if storage_type == 'binary_storage' and storage_key:
+            content = await self._read_binary_storage(storage_key)
+            if content is None:
+                return None
+
+            # Apply offset and limit
+            if offset > 0:
+                content = content[offset:]
+            if limit and len(content) > limit:
+                content = content[:limit]
+                has_more = True
+            else:
+                has_more = False
+
+            return {
+                'artifact_id': artifact_id,
+                'mime_type': record.mime_type,
+                'size_bytes': size_bytes,
+                'offset': offset,
+                'length': len(content),
+                'content_base64': base64.b64encode(content).decode('utf-8'),
+                'file_key': None,
+                'has_more': has_more,
+            }
+
+        if storage_type == 'file':
+            return await self._read_file_storage(record, artifact_id, offset, limit)
+
+        # For other storage types, return storage reference
+        # (caller can use file_key for chunked transfer)
+        return {
+            'artifact_id': artifact_id,
+            'mime_type': record.mime_type,
+            'size_bytes': size_bytes,
+            'offset': offset,
+            'length': None,
+            'content_base64': None,
+            'file_key': storage_key,
+            'has_more': False,
+        }
+
+    async def cleanup_expired_artifacts(
+        self,
+        *,
+        now: datetime.datetime | None = None,
+    ) -> int:
+        """Delete expired artifact metadata and Host-owned binary blobs.
+
+        Returns the number of artifact metadata rows removed. External/file
+        storage references are only dereferenced from LangBot metadata; their
+        backing lifecycle remains owned by the storage provider.
+        """
+        if now is None:
+            now = _utc_now()
+
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(AgentArtifact).where(
+                    AgentArtifact.expires_at.is_not(None),
+                    AgentArtifact.expires_at <= now,
+                )
+            )
+            expired = result.scalars().all()
+            if not expired:
+                return 0
+
+            binary_storage_keys = [
+                artifact.storage_key
+                for artifact in expired
+                if artifact.storage_type == 'binary_storage' and artifact.storage_key
+            ]
+            if binary_storage_keys:
+                await session.execute(
+                    sqlalchemy.delete(BinaryStorage).where(
+                        BinaryStorage.unique_key.in_(binary_storage_keys)
+                    )
+                )
+
+            await session.execute(
+                sqlalchemy.delete(AgentArtifact).where(
+                    AgentArtifact.id.in_([artifact.id for artifact in expired])
+                )
+            )
+            await session.commit()
+            return len(expired)
+
+    async def _read_binary_storage(self, key: str) -> bytes | None:
+        """Read content from BinaryStorage.
+
+        Uses unique_key for isolation to prevent cross-artifact access.
+
+        Args:
+            key: The unique_key used when storing the artifact
+
+        Returns:
+            Content bytes, or None if not found
+        """
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(BinaryStorage).where(BinaryStorage.unique_key == key)
+            )
+            row = result.scalars().first()
+            if row is None:
+                return None
+            return row.value
+
+    async def _read_file_storage(
+        self,
+        record: AgentArtifact,
+        artifact_id: str,
+        offset: int,
+        limit: int,
+    ) -> dict[str, typing.Any] | None:
+        metadata = self._load_metadata(record.metadata_json)
+        file_info = metadata.get(_FILE_ARTIFACT_METADATA_KEY)
+        if not isinstance(file_info, dict):
+            return None
+
+        host_path = file_info.get('path')
+        host_root = file_info.get('root')
+        if not isinstance(host_path, str) or not isinstance(host_root, str):
+            return None
+
+        real_path, _ = self._validate_file_artifact_path(host_path, host_root)
+        if not os.path.isfile(real_path):
+            return None
+
+        file_size = os.path.getsize(real_path)
+        if offset >= file_size:
+            content = b''
+        else:
+            async with aiofiles.open(real_path, 'rb') as f:
+                await f.seek(offset)
+                content = await f.read(limit)
+
+        return {
+            'artifact_id': artifact_id,
+            'mime_type': record.mime_type,
+            'size_bytes': file_size,
+            'offset': offset,
+            'length': len(content),
+            'content_base64': base64.b64encode(content).decode('utf-8'),
+            'file_key': None,
+            'has_more': offset + len(content) < file_size,
+        }
+
+    @staticmethod
+    def _validate_file_artifact_path(host_path: str, host_root: str) -> tuple[str, str]:
+        real_path = os.path.realpath(host_path)
+        real_root = os.path.realpath(host_root)
+        if not real_root:
+            raise ValueError('file artifact root is required')
+        if not (real_path == real_root or real_path.startswith(real_root + os.sep)):
+            raise ValueError('file artifact path escapes allowed root')
+        return real_path, real_root
+
+    @staticmethod
+    def _load_metadata(metadata_json: str | None) -> dict[str, typing.Any]:
+        if not metadata_json:
+            return {}
+        try:
+            metadata = json.loads(metadata_json)
+        except Exception:
+            return {}
+        return metadata if isinstance(metadata, dict) else {}
+
+    @staticmethod
+    def _public_metadata(metadata_json: str | None) -> dict[str, typing.Any]:
+        metadata = ArtifactStore._load_metadata(metadata_json)
+        metadata.pop(_FILE_ARTIFACT_METADATA_KEY, None)
+        metadata.pop(_ARTIFACT_THREAD_METADATA_KEY, None)
+        return metadata
+
+    @staticmethod
+    def _is_expired(
+        row: AgentArtifact,
+        now: datetime.datetime | None = None,
+    ) -> bool:
+        if row.expires_at is None:
+            return False
+        if now is None:
+            now = _utc_now()
+        return _as_utc(row.expires_at) <= _as_utc(now)
+
+    def _row_to_public_dict(self, row: AgentArtifact) -> dict[str, typing.Any]:
+        """Convert an AgentArtifact row to public dict.
+
+        Returns only fields that match SDK ArtifactMetadata entity.
+        Host-only fields (bot_id, workspace_id, storage_key, storage_type) are excluded.
+        """
+        return {
+            'artifact_id': row.artifact_id,
+            'artifact_type': row.artifact_type,
+            'mime_type': row.mime_type,
+            'name': row.name,
+            'size_bytes': row.size_bytes,
+            'sha256': row.sha256,
+            'source': row.source,
+            'conversation_id': row.conversation_id,
+            'run_id': row.run_id,
+            'runner_id': row.runner_id,
+            'created_at': _datetime_to_epoch(row.created_at),
+            'expires_at': _datetime_to_epoch(row.expires_at),
+            'metadata': self._public_metadata(row.metadata_json),
+        }

src/langbot/pkg/agent/runner/binding_resolver.py

@@ -0,0 +1,70 @@
+"""Resolve host events to one effective Agent binding."""
+
+from __future__ import annotations
+
+from .host_models import AgentConfig, AgentBinding, AgentEventEnvelope, BindingScope
+
+
+class AgentBindingResolutionError(Exception):
+    """Raised when an event cannot resolve to exactly one Agent binding."""
+
+
+class AgentBindingResolver:
+    """Resolve an event to a single AgentBinding.
+
+    The target product model is one bot / IM channel -> one Agent. Fan-out,
+    observer agents, or multi-runner arbitration require separate delivery and
+    state semantics and are intentionally not hidden in this resolver.
+    """
+
+    def resolve_one(
+        self,
+        event: AgentEventEnvelope,
+        agents: list[AgentConfig],
+    ) -> AgentBinding:
+        """Resolve exactly one enabled Agent for the event.
+
+        Callers that source agents from bot/workspace/global configuration must
+        pre-filter candidates to the event scope before calling this resolver.
+        The current AgentConfig model represents one already-selected product
+        Agent and does not carry enough scope metadata to make that decision
+        safely here.
+        """
+        matches = [
+            agent
+            for agent in agents
+            if agent.enabled and event.event_type in agent.event_types
+        ]
+
+        if not matches:
+            raise AgentBindingResolutionError(
+                f'No Agent binding matches event_type={event.event_type}'
+            )
+
+        if len(matches) > 1:
+            agent_ids = ', '.join(agent.agent_id or '<anonymous>' for agent in matches)
+            raise AgentBindingResolutionError(
+                f'Multiple Agent bindings match event_type={event.event_type}: {agent_ids}'
+            )
+
+        return self._to_binding(matches[0])
+
+    def _to_binding(self, agent: AgentConfig) -> AgentBinding:
+        """Project product-level Agent config into the run-time binding model."""
+        scope = BindingScope(
+            scope_type='agent',
+            scope_id=agent.agent_id,
+        )
+
+        return AgentBinding(
+            binding_id=f"agent_{agent.agent_id or 'default'}_{agent.runner_id}",
+            scope=scope,
+            event_types=list(agent.event_types),
+            runner_id=agent.runner_id,
+            runner_config=agent.runner_config,
+            resource_policy=agent.resource_policy,
+            state_policy=agent.state_policy,
+            delivery_policy=agent.delivery_policy,
+            enabled=agent.enabled,
+            agent_id=agent.agent_id,
+        )

src/langbot/pkg/agent/runner/config_migration.py

@@ -0,0 +1,171 @@
+"""Helpers for the current AgentRunner config shape."""
+
+from __future__ import annotations
+
+import typing
+
+
+LEGACY_RUNNER_ID_MAP: dict[str, str] = {
+    'local-agent': 'plugin:langbot/local-agent/default',
+    'dify-service-api': 'plugin:langbot/dify-agent/default',
+    'n8n-service-api': 'plugin:langbot/n8n-agent/default',
+    'coze-api': 'plugin:langbot/coze-agent/default',
+    'dashscope-app-api': 'plugin:langbot/dashscope-agent/default',
+    'deerflow-api': 'plugin:langbot/deerflow-agent/default',
+    'langflow-api': 'plugin:langbot/langflow-agent/default',
+    'tbox-app-api': 'plugin:langbot/tbox-agent/default',
+    'weknora-api': 'plugin:langbot/weknora-agent/default',
+}
+
+
+class ConfigMigration:
+    """Configuration helper for agent runner IDs.
+
+    Responsibilities:
+    - Resolve runner ID from ai.runner.id
+    - Migrate legacy ai.runner.runner + ai.<runner-name> blocks
+    - Extract current Agent/runner config from ai.runner_config
+    - Keep the current config container shape stable on save
+    """
+
+    @staticmethod
+    def resolve_runner_id(pipeline_config: dict[str, typing.Any]) -> str | None:
+        """Resolve runner ID from current configuration.
+
+        Args:
+            pipeline_config: Current configuration container
+
+        Returns:
+            Runner ID string, or None if not configured
+        """
+        ai_config = pipeline_config.get('ai', {})
+        runner_config = ai_config.get('runner', {})
+
+        runner_id = runner_config.get('id')
+        if runner_id:
+            return runner_id
+
+        legacy_runner = runner_config.get('runner')
+        if isinstance(legacy_runner, str):
+            return LEGACY_RUNNER_ID_MAP.get(legacy_runner)
+
+        return None
+
+    @staticmethod
+    def resolve_runner_config(
+        pipeline_config: dict[str, typing.Any],
+        runner_id: str,
+    ) -> dict[str, typing.Any]:
+        """Resolve Agent/runner configuration from the current container.
+
+        Args:
+            pipeline_config: Current configuration container
+            runner_id: Resolved runner ID
+
+        Returns:
+            Runner configuration dict (empty if not found)
+        """
+        ai_config = pipeline_config.get('ai', {})
+
+        runner_configs = ai_config.get('runner_config', {})
+        if runner_id in runner_configs:
+            return runner_configs[runner_id]
+
+        legacy_runner = ConfigMigration._legacy_runner_name_for_id(runner_id)
+        if legacy_runner and isinstance(ai_config.get(legacy_runner), dict):
+            return ConfigMigration._normalize_legacy_runner_config(
+                legacy_runner,
+                ai_config[legacy_runner],
+            )
+
+        return {}
+
+    @staticmethod
+    def get_expire_time(pipeline_config: dict[str, typing.Any]) -> int:
+        """Get conversation expire time from configuration.
+
+        Args:
+            pipeline_config: Current configuration container
+
+        Returns:
+            Expire time in seconds (0 means no expiry)
+        """
+        ai_config = pipeline_config.get('ai', {})
+        runner_config = ai_config.get('runner', {})
+        return runner_config.get('expire-time', 0)
+
+    @staticmethod
+    def migrate_pipeline_config(pipeline_config: dict[str, typing.Any]) -> dict[str, typing.Any]:
+        """Normalize the current config container before saving.
+
+        Args:
+            pipeline_config: Original configuration
+
+        Returns:
+            Configuration with explicit ai.runner and ai.runner_config containers
+        """
+        new_config = dict(pipeline_config)
+        if 'ai' not in new_config:
+            return new_config
+
+        ai_config = dict(new_config.get('ai', {}))
+
+        runner_config = dict(ai_config.get('runner', {}))
+        runner_configs = dict(ai_config.get('runner_config', {}))
+
+        legacy_runner = runner_config.get('runner')
+        mapped_runner_id = None
+        if isinstance(legacy_runner, str):
+            mapped_runner_id = LEGACY_RUNNER_ID_MAP.get(legacy_runner)
+
+        if mapped_runner_id and not runner_config.get('id'):
+            runner_config = {
+                key: value
+                for key, value in runner_config.items()
+                if key != 'runner'
+            }
+            runner_config['id'] = mapped_runner_id
+
+        if mapped_runner_id and mapped_runner_id not in runner_configs:
+            legacy_config = ai_config.get(legacy_runner)
+            if isinstance(legacy_config, dict):
+                runner_configs[mapped_runner_id] = ConfigMigration._normalize_legacy_runner_config(
+                    legacy_runner,
+                    legacy_config,
+                )
+
+        ai_config['runner'] = runner_config
+        ai_config['runner_config'] = runner_configs
+        if mapped_runner_id and legacy_runner in ai_config:
+            ai_config.pop(legacy_runner, None)
+        new_config['ai'] = ai_config
+
+        return new_config
+
+    @staticmethod
+    def _legacy_runner_name_for_id(runner_id: str) -> str | None:
+        for legacy_runner, mapped_runner_id in LEGACY_RUNNER_ID_MAP.items():
+            if mapped_runner_id == runner_id:
+                return legacy_runner
+        return None
+
+    @staticmethod
+    def _normalize_legacy_runner_config(
+        legacy_runner: str,
+        legacy_config: dict[str, typing.Any],
+    ) -> dict[str, typing.Any]:
+        """Normalize legacy runner config blocks to current plugin schema quirks."""
+        normalized = dict(legacy_config)
+
+        if legacy_runner == 'local-agent':
+            model = normalized.get('model')
+            if isinstance(model, str):
+                normalized['model'] = {
+                    'primary': model,
+                    'fallbacks': [],
+                }
+            knowledge_base = normalized.pop('knowledge-base', None)
+            if 'knowledge-bases' not in normalized and isinstance(knowledge_base, str):
+                normalized['knowledge-bases'] = [] if knowledge_base in {'', '__none__', '__none'} else [knowledge_base]
+
+        return normalized

src/langbot/pkg/agent/runner/config_schema.py

@@ -0,0 +1,243 @@
+"""Helpers for interpreting AgentRunner DynamicForm configuration."""
+from __future__ import annotations
+
+import typing
+
+from .descriptor import AgentRunnerDescriptor
+
+
+FORM_ITEM_TYPE_ALIASES = {
+    'select-llm-model': 'llm-model-selector',
+    'select-knowledge-bases': 'knowledge-base-multi-selector',
+}
+LLM_MODEL_SELECTOR_TYPES = {'model-fallback-selector', 'llm-model-selector'}
+KB_SELECTOR_TYPES = {'knowledge-base-multi-selector'}
+PROMPT_EDITOR_TYPES = {'prompt-editor'}
+FILE_SELECTOR_TYPES = {'file', 'array[file]'}
+NONE_SENTINELS = {'', '__none__', '__none'}
+
+
+def normalize_schema_item_type(item_type: typing.Any) -> typing.Any:
+    """Normalize legacy/frontend DynamicForm aliases to protocol field types."""
+    if not isinstance(item_type, str):
+        return item_type
+    return FORM_ITEM_TYPE_ALIASES.get(item_type, item_type)
+
+
+def iter_schema_items(
+    descriptor: AgentRunnerDescriptor | None,
+    field_types: set[str],
+) -> typing.Iterator[dict[str, typing.Any]]:
+    """Yield descriptor config schema items whose type is in field_types."""
+    if descriptor is None:
+        return
+    for item in descriptor.config_schema or []:
+        if not isinstance(item, dict):
+            continue
+        if normalize_schema_item_type(item.get('type')) in field_types:
+            yield item
+
+
+def uses_host_models(descriptor: AgentRunnerDescriptor | None) -> bool:
+    """Return whether LangBot should resolve model resources for this runner."""
+    return any(True for _ in iter_schema_items(descriptor, LLM_MODEL_SELECTOR_TYPES))
+
+
+def uses_host_tools(descriptor: AgentRunnerDescriptor | None) -> bool:
+    """Return whether LangBot should expose tool resources to this runner."""
+    return descriptor is not None and descriptor.supports_tool_calling()
+
+
+def uses_host_knowledge_bases(descriptor: AgentRunnerDescriptor | None) -> bool:
+    """Return whether LangBot should expose knowledge-base resources to this runner."""
+    return descriptor is not None and descriptor.supports_knowledge_retrieval()
+
+
+def supports_skill_authoring(descriptor: AgentRunnerDescriptor | None) -> bool:
+    """Return whether the runner wants Host skill-authoring tools."""
+    if descriptor is None:
+        return False
+    return descriptor.capabilities.skill_authoring
+
+
+def extract_prompt_config(
+    descriptor: AgentRunnerDescriptor | None,
+    runner_config: dict[str, typing.Any],
+    default_prompt: list[dict[str, typing.Any]],
+) -> list[dict[str, typing.Any]]:
+    """Extract the prompt-editor value selected by the runner schema."""
+    for item in iter_schema_items(descriptor, PROMPT_EDITOR_TYPES):
+        field_name = item.get('name')
+        if field_name and field_name in runner_config:
+            configured_prompt = runner_config[field_name]
+            if isinstance(configured_prompt, list):
+                return configured_prompt
+        default_value = item.get('default')
+        if isinstance(default_value, list):
+            return default_value
+    return default_prompt
+
+
+def extract_model_selection(
+    descriptor: AgentRunnerDescriptor | None,
+    runner_config: dict[str, typing.Any],
+) -> tuple[str, list[str]]:
+    """Extract primary/fallback LLM selections from schema-defined fields."""
+    primary_uuid = ''
+    fallback_uuids: list[str] = []
+
+    for item in iter_schema_items(descriptor, LLM_MODEL_SELECTOR_TYPES):
+        field_name = item.get('name')
+        if not field_name:
+            continue
+
+        value = runner_config.get(field_name, item.get('default'))
+        item_type = normalize_schema_item_type(item.get('type'))
+        if item_type == 'model-fallback-selector':
+            if isinstance(value, str):
+                primary_uuid = value
+            elif isinstance(value, dict):
+                primary_uuid = value.get('primary') or ''
+                fallbacks = value.get('fallbacks', [])
+                if isinstance(fallbacks, list):
+                    fallback_uuids = [fallback for fallback in fallbacks if isinstance(fallback, str)]
+            break
+
+        if item_type == 'llm-model-selector' and isinstance(value, str):
+            primary_uuid = value
+            break
+
+    return primary_uuid, fallback_uuids
+
+
+def extract_knowledge_base_uuids(
+    descriptor: AgentRunnerDescriptor | None,
+    runner_config: dict[str, typing.Any],
+) -> list[str]:
+    """Extract configured knowledge-base UUIDs from schema-defined fields."""
+    if not uses_host_knowledge_bases(descriptor):
+        return []
+
+    kb_uuids: list[str] = []
+    for item in iter_schema_items(descriptor, KB_SELECTOR_TYPES):
+        field_name = item.get('name')
+        if not field_name:
+            continue
+        value = runner_config.get(field_name, item.get('default', []))
+        if isinstance(value, list):
+            kb_uuids.extend(
+                kb_uuid for kb_uuid in value if isinstance(kb_uuid, str) and kb_uuid not in NONE_SENTINELS
+            )
+
+    return list(dict.fromkeys(kb_uuids))
+
+
+def extract_config_file_resources(
+    descriptor: AgentRunnerDescriptor | None,
+    runner_config: dict[str, typing.Any],
+) -> list[dict[str, typing.Any]]:
+    """Extract uploaded config file resources from schema-defined file fields."""
+    files: list[dict[str, typing.Any]] = []
+
+    def append_file(value: typing.Any) -> None:
+        if not isinstance(value, dict):
+            return
+        file_key = value.get('file_key') or value.get('file_id')
+        if not isinstance(file_key, str) or file_key in NONE_SENTINELS:
+            return
+        files.append({
+            'file_id': file_key,
+            'file_name': value.get('file_name') or value.get('name'),
+            'mime_type': value.get('mime_type') or value.get('mimetype'),
+            'source': 'config',
+        })
+
+    for item in iter_schema_items(descriptor, FILE_SELECTOR_TYPES):
+        field_name = item.get('name')
+        if not field_name:
+            continue
+        value = runner_config.get(field_name, item.get('default'))
+        item_type = normalize_schema_item_type(item.get('type'))
+        if item_type == 'file':
+            append_file(value)
+        elif isinstance(value, list):
+            for entry in value:
+                append_file(entry)
+
+    deduped: dict[str, dict[str, typing.Any]] = {}
+    for file_resource in files:
+        deduped.setdefault(file_resource['file_id'], file_resource)
+    return list(deduped.values())
+
+
+def iter_config_model_refs(
+    descriptor: AgentRunnerDescriptor,
+    runner_config: dict[str, typing.Any],
+) -> typing.Iterator[tuple[str, str]]:
+    """Yield model references declared by schema-defined model selector fields."""
+    for item in descriptor.config_schema or []:
+        if not isinstance(item, dict):
+            continue
+
+        field_name = item.get('name')
+        field_type = normalize_schema_item_type(item.get('type'))
+        if not field_name or field_name not in runner_config:
+            continue
+
+        value = runner_config.get(field_name)
+        if field_type == 'model-fallback-selector':
+            if isinstance(value, str) and value not in NONE_SENTINELS:
+                yield 'llm', value
+            elif isinstance(value, dict):
+                primary = value.get('primary')
+                if isinstance(primary, str) and primary not in NONE_SENTINELS:
+                    yield 'llm', primary
+                fallbacks = value.get('fallbacks', [])
+                if isinstance(fallbacks, list):
+                    for fallback_uuid in fallbacks:
+                        if isinstance(fallback_uuid, str) and fallback_uuid not in NONE_SENTINELS:
+                            yield 'llm', fallback_uuid
+        elif field_type == 'llm-model-selector':
+            if isinstance(value, str) and value not in NONE_SENTINELS:
+                yield 'llm', value
+        elif field_type == 'rerank-model-selector':
+            if isinstance(value, str) and value not in NONE_SENTINELS:
+                yield 'rerank', value
+
+
+def set_empty_llm_model_selection(
+    descriptor: AgentRunnerDescriptor,
+    runner_config: dict[str, typing.Any],
+    model_uuid: str,
+) -> bool:
+    """Set the first empty schema-defined LLM selector to model_uuid."""
+    for item in iter_schema_items(descriptor, LLM_MODEL_SELECTOR_TYPES):
+        field_name = item.get('name')
+        field_type = normalize_schema_item_type(item.get('type'))
+        if not field_name:
+            continue
+
+        value = runner_config.get(field_name, item.get('default'))
+        if field_type == 'model-fallback-selector':
+            if isinstance(value, dict):
+                primary = value.get('primary') or ''
+                if primary not in NONE_SENTINELS:
+                    return False
+                fallbacks = value.get('fallbacks', [])
+                runner_config[field_name] = {
+                    'primary': model_uuid,
+                    'fallbacks': fallbacks if isinstance(fallbacks, list) else [],
+                }
+                return True
+            if isinstance(value, str) and value not in NONE_SENTINELS:
+                return False
+            runner_config[field_name] = {'primary': model_uuid, 'fallbacks': []}
+            return True
+
+        if field_type == 'llm-model-selector':
+            if isinstance(value, str) and value not in NONE_SENTINELS:
+                return False
+            runner_config[field_name] = model_uuid
+            return True
+
+    return False

src/langbot/pkg/agent/runner/context_builder.py

@@ -0,0 +1,506 @@
+"""Agent run context builder for provisioning AgentRunContext envelopes."""
+
+from __future__ import annotations
+
+import uuid
+import time
+import typing
+
+from ...core import app
+from .descriptor import AgentRunnerDescriptor
+from .persistent_state_store import get_persistent_state_store
+from .host_models import AgentEventEnvelope, AgentBinding
+
+
+DEFAULT_RUNNER_TIMEOUT_SECONDS = 300
+
+
+# Internal models for the agent runner context protocol.
+
+
+class AgentTrigger(typing.TypedDict):
+    """Agent trigger information."""
+
+    type: str
+    source: str
+    timestamp: int | None
+
+
+class ConversationContext(typing.TypedDict):
+    """Conversation context."""
+
+    conversation_id: str | None
+    thread_id: str | None
+    launcher_type: str | None
+    launcher_id: str | None
+    sender_id: str | None
+    bot_id: str | None
+    workspace_id: str | None
+    session_id: str | None
+
+
+class AgentInput(typing.TypedDict):
+    """Agent input."""
+
+    text: str | None
+    contents: list[dict[str, typing.Any]]
+    attachments: list[dict[str, typing.Any]]
+
+
+class AgentRunState(typing.TypedDict):
+    """Agent run state with 4 scopes."""
+
+    conversation: dict[str, typing.Any]
+    actor: dict[str, typing.Any]
+    subject: dict[str, typing.Any]
+    runner: dict[str, typing.Any]
+
+
+# Resource payload models matching langbot-plugin-sdk/resources.py.
+
+
+class ModelResource(typing.TypedDict):
+    """Model resource payload."""
+
+    model_id: str
+    model_type: str | None
+    provider: str | None
+    operations: list[str]
+
+
+class ToolResource(typing.TypedDict):
+    """Tool resource payload."""
+
+    tool_name: str
+    tool_type: str | None
+    description: str | None
+    operations: list[str]
+
+
+class KnowledgeBaseResource(typing.TypedDict):
+    """Knowledge base resource payload."""
+
+    kb_id: str
+    kb_name: str | None
+    kb_type: str | None
+    operations: list[str]
+
+
+class SkillResource(typing.TypedDict):
+    """Skill resource payload."""
+
+    skill_name: str
+    display_name: str | None
+    description: str | None
+
+
+class FileResource(typing.TypedDict):
+    """File resource payload."""
+
+    file_id: str
+    file_name: str | None
+    mime_type: str | None
+    source: str | None
+    operations: list[str]
+
+
+class StorageResource(typing.TypedDict):
+    """Storage resource payload."""
+
+    plugin_storage: bool
+    workspace_storage: bool
+
+
+class AgentResources(typing.TypedDict):
+    """Agent resources payload."""
+
+    models: list[ModelResource]
+    tools: list[ToolResource]
+    knowledge_bases: list[KnowledgeBaseResource]
+    skills: list[SkillResource]
+    files: list[FileResource]
+    storage: StorageResource
+    platform_capabilities: dict[str, typing.Any]
+
+
+class AgentRuntimeContext(typing.TypedDict):
+    """Agent runtime context."""
+
+    langbot_version: str | None
+    trace_id: str | None
+    deadline_at: float | None
+    metadata: dict[str, typing.Any]
+
+
+class AgentRunContextPayload(typing.TypedDict):
+    """AgentRunContext payload passed to an agent runner.
+
+    Protocol v1 structure - matches SDK AgentRunContext.
+
+    Note: The 'config' field contains the current Agent/runner config
+    from ai.runner_config[runner_id] while the current Query entry remains
+    a temporary configuration container. It is not plugin instance config.
+    """
+
+    run_id: str
+    trigger: AgentTrigger
+    conversation: ConversationContext | None
+    event: dict[str, typing.Any]  # REQUIRED for Protocol v1
+    actor: dict[str, typing.Any] | None
+    subject: dict[str, typing.Any] | None
+    input: AgentInput
+    delivery: dict[str, typing.Any]  # REQUIRED for Protocol v1
+    resources: AgentResources
+    context: dict[str, typing.Any]  # ContextAccess - REQUIRED for Protocol v1
+    state: AgentRunState
+    runtime: AgentRuntimeContext
+    config: dict[str, typing.Any]  # Agent/runner config from ai.runner_config[runner_id]
+    adapter: dict[str, typing.Any] | None  # Entry adapter context
+    metadata: dict[str, typing.Any]  # Additional metadata
+
+
+class AgentRunContextBuilder:
+    """Builder for provisioning AgentRunContext.
+
+    Responsibilities:
+    - Generate new run_id (UUID, not query id)
+    - Set trigger type based on event source
+    - Build conversation context from event
+    - Build input from event
+    - Build state snapshot from PersistentStateStore
+    - Build runtime context with host info, trace_id, deadline
+    - Set config from current Agent/runner configuration.
+
+    Query adaptation belongs to QueryEntryAdapter, not this builder.
+    """
+
+    ap: app.Application
+
+    def __init__(self, ap: app.Application):
+        self.ap = ap
+
+    @staticmethod
+    def _positive_int(value: typing.Any) -> int | None:
+        if isinstance(value, bool):
+            return None
+        if isinstance(value, int) and value > 0:
+            return value
+        if isinstance(value, str) and value.isdigit():
+            parsed_value = int(value)
+            if parsed_value > 0:
+                return parsed_value
+        return None
+
+    @staticmethod
+    def _is_llm_model_resource(model_resource: ModelResource) -> bool:
+        operations = model_resource.get('operations')
+        if isinstance(operations, list) and operations:
+            return bool({'invoke', 'stream'} & {str(operation) for operation in operations})
+        return model_resource.get('model_type') != 'rerank'
+
+    async def _build_model_context_window_tokens(self, resources: AgentResources) -> int | None:
+        model_mgr = getattr(self.ap, 'model_mgr', None)
+        if model_mgr is None:
+            return None
+
+        for model_resource in resources.get('models', []):
+            if not self._is_llm_model_resource(model_resource):
+                continue
+
+            model_uuid = model_resource.get('model_id')
+            if not isinstance(model_uuid, str) or not model_uuid:
+                continue
+
+            try:
+                model = await model_mgr.get_model_by_uuid(model_uuid)
+            except Exception as exc:
+                logger = getattr(self.ap, 'logger', None)
+                if logger is not None:
+                    logger.debug(f'Failed to resolve model context window for {model_uuid}: {exc}')
+                continue
+
+            model_entity = getattr(model, 'model_entity', None)
+            context_length = self._positive_int(getattr(model_entity, 'context_length', None))
+            return context_length
+
+        return None
+
+    async def build_context_from_event(
+        self,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+        resources: AgentResources,
+    ) -> AgentRunContextPayload:
+        """Build AgentRunContext from event-first envelope.
+
+        This is the main entry point for Protocol v1.
+        Does NOT inline full history by default.
+
+        Args:
+            event: Event envelope
+            binding: Agent binding
+            descriptor: Runner descriptor
+            resources: Built resources
+
+        Returns:
+            AgentRunContextPayload for the runner
+        """
+        # Generate new run_id
+        run_id = str(uuid.uuid4())
+
+        # Build trigger from event
+        trigger: AgentTrigger = {
+            'type': event.event_type,
+            'source': event.source,
+            'timestamp': event.event_time or int(time.time()),
+        }
+
+        # Build conversation context from event
+        conversation: ConversationContext | None = None
+        if event.conversation_id:
+            conversation = {
+                'session_id': None,
+                'conversation_id': event.conversation_id,
+                'thread_id': event.thread_id,
+                'launcher_type': None,  # Will be filled from actor/subject if needed
+                'launcher_id': None,
+                'sender_id': event.actor.actor_id if event.actor else None,
+                'bot_id': event.bot_id,
+                'workspace_id': event.workspace_id,
+            }
+
+        # Build event context (Protocol v1 event-first)
+        event_context = {
+            'event_id': event.event_id,
+            'event_type': event.event_type,
+            'event_time': event.event_time,
+            'source': event.source,
+            'source_event_type': event.source_event_type,
+            'raw_ref': event.raw_ref.model_dump(mode='json') if event.raw_ref else None,
+            'data': event.data,
+        }
+
+        # Build actor context
+        actor_context = None
+        if event.actor:
+            actor_context = {
+                'actor_type': event.actor.actor_type,
+                'actor_id': event.actor.actor_id,
+                'actor_name': event.actor.actor_name,
+            }
+
+        # Build subject context
+        subject_context = None
+        if event.subject:
+            subject_context = {
+                'subject_type': event.subject.subject_type,
+                'subject_id': event.subject.subject_id,
+                'data': event.subject.data,
+            }
+
+        # Build input from event
+        input: AgentInput = {
+            'text': event.input.text,
+            'contents': [c.model_dump(mode='json') if hasattr(c, 'model_dump') else c for c in event.input.contents],
+            'attachments': [
+                a.model_dump(mode='json') if hasattr(a, 'model_dump') else a for a in event.input.attachments
+            ],
+        }
+
+        # Build context access (no history inlined by default for Protocol v1)
+        # Populate with actual values from stores
+        context_access = await self._build_context_access(event, descriptor, binding)
+
+        # Build state snapshot from persistent state store (event-first Protocol v1)
+        persistent_state_store = get_persistent_state_store(self.ap.persistence_mgr.get_db_engine())
+        state: AgentRunState = await persistent_state_store.build_snapshot_from_event(event, binding, descriptor)
+
+        model_context_window_tokens = await self._build_model_context_window_tokens(resources)
+
+        # Build runtime context
+        runtime: AgentRuntimeContext = {
+            'langbot_version': self.ap.ver_mgr.get_current_version(),
+            'trace_id': run_id,
+            'deadline_at': self._build_deadline_from_binding(binding),
+            'metadata': {
+                'bot_id': event.bot_id,
+                'workspace_id': event.workspace_id,
+                'streaming_supported': event.delivery.supports_streaming,
+                'model_context_window_tokens': model_context_window_tokens,
+            },
+        }
+
+        # Build delivery context
+        delivery_context = {
+            'surface': event.delivery.surface,
+            'reply_target': event.delivery.reply_target,
+            'supports_streaming': event.delivery.supports_streaming,
+            'supports_edit': event.delivery.supports_edit,
+            'supports_reaction': event.delivery.supports_reaction,
+            'max_message_size': event.delivery.max_message_size,
+            'platform_capabilities': event.delivery.platform_capabilities,
+        }
+
+        # Build adapter context (empty for event-first)
+        adapter_context = {
+            'extra': {},
+        }
+
+        # Build full context - Protocol v1 structure
+        context: AgentRunContextPayload = {
+            'run_id': run_id,
+            'trigger': trigger,
+            'conversation': conversation,
+            'event': event_context,  # REQUIRED
+            'actor': actor_context,
+            'subject': subject_context,
+            'input': input,
+            'delivery': delivery_context,  # REQUIRED
+            'resources': resources,
+            'context': context_access,  # ContextAccess - REQUIRED
+            'state': state,
+            'runtime': runtime,
+            'config': binding.runner_config,
+            'adapter': adapter_context,
+            'metadata': {},  # Additional metadata
+        }
+
+        return context
+
+    def _build_deadline_from_binding(self, binding: AgentBinding) -> float | None:
+        """Build deadline timestamp from binding timeout config.
+
+        Args:
+            binding: Agent binding with runner_config
+
+        Returns:
+            Deadline timestamp or None
+        """
+        timeout = binding.runner_config.get('timeout', DEFAULT_RUNNER_TIMEOUT_SECONDS)
+        if timeout is None:
+            return None
+
+        try:
+            timeout_seconds = float(timeout)
+        except (TypeError, ValueError):
+            return None
+
+        if timeout_seconds <= 0:
+            return None
+
+        return time.time() + timeout_seconds
+
+    async def _build_context_access(
+        self,
+        event: AgentEventEnvelope,
+        descriptor: AgentRunnerDescriptor,
+        binding: AgentBinding | None = None,
+    ) -> dict[str, typing.Any]:
+        """Build ContextAccess with actual values from stores.
+
+        Args:
+            event: Event envelope
+            descriptor: Runner descriptor
+            binding: Agent binding (required for state_policy in event-first mode)
+
+        Returns:
+            ContextAccess dict
+        """
+        conversation_id = event.conversation_id
+        permissions = descriptor.permissions
+        history_perms = set(permissions.history)
+        event_perms = set(permissions.events)
+        artifact_perms = set(permissions.artifacts)
+        storage_perms = set(permissions.storage)
+
+        history_page_enabled = 'page' in history_perms and conversation_id is not None
+        history_search_enabled = 'search' in history_perms and conversation_id is not None
+        event_get_enabled = 'get' in event_perms
+        event_page_enabled = 'page' in event_perms and conversation_id is not None
+        artifact_metadata_enabled = 'metadata' in artifact_perms
+        artifact_read_enabled = 'read' in artifact_perms
+        steering_pull_enabled = (
+            bool(getattr(descriptor.capabilities, 'steering', False)) and conversation_id is not None
+        )
+        run_get_enabled = True
+        run_list_enabled = conversation_id is not None
+        run_events_page_enabled = True
+        run_cancel_enabled = True
+        run_append_result_enabled = False
+        run_finalize_enabled = False
+        run_claim_enabled = False
+        run_renew_claim_enabled = False
+        run_release_claim_enabled = False
+        runtime_register_enabled = False
+        runtime_heartbeat_enabled = False
+        runtime_list_enabled = False
+
+        # Determine state API availability based on binding state_policy.
+        state_enabled = False
+        storage_enabled = False
+        if binding is not None:
+            state_policy = binding.state_policy
+            if state_policy.enable_state and state_policy.state_scopes:
+                state_enabled = True
+
+            resource_policy = binding.resource_policy
+            storage_enabled = ('plugin' in storage_perms and resource_policy.allow_plugin_storage) or (
+                'workspace' in storage_perms and resource_policy.allow_workspace_storage
+            )
+
+        # Get latest cursor and has_history_before if conversation exists
+        latest_cursor = None
+        has_history_before = False
+
+        if conversation_id:
+            try:
+                from .transcript_store import TranscriptStore
+
+                store = TranscriptStore(self.ap.persistence_mgr.get_db_engine())
+
+                latest_cursor = await store.get_latest_cursor(conversation_id)
+                if latest_cursor:
+                    has_history_before = True
+            except Exception as e:
+                self.ap.logger.warning(f'Failed to get transcript cursor: {e}')
+
+        return {
+            'conversation_id': conversation_id,
+            'thread_id': event.thread_id,
+            'latest_cursor': latest_cursor,
+            'event_seq': None,  # Will be populated when EventLog is written
+            'transcript_seq': int(latest_cursor) if latest_cursor else None,
+            'has_history_before': has_history_before,
+            'inline_policy': {
+                'mode': 'current_event',
+                'delivered_count': 0,
+                'source_total_count': None,
+                'messages_complete': False,
+                'reason': 'current_event_only',
+            },
+            'available_apis': {
+                'prompt_get': False,
+                'history_page': history_page_enabled,
+                'history_search': history_search_enabled,
+                'event_get': event_get_enabled,
+                'event_page': event_page_enabled,
+                'artifact_metadata': artifact_metadata_enabled,
+                'artifact_read': artifact_read_enabled,
+                'state': state_enabled,
+                'storage': storage_enabled,
+                'steering_pull': steering_pull_enabled,
+                'run_get': run_get_enabled,
+                'run_list': run_list_enabled,
+                'run_events_page': run_events_page_enabled,
+                'run_cancel': run_cancel_enabled,
+                'run_append_result': run_append_result_enabled,
+                'run_finalize': run_finalize_enabled,
+                'run_claim': run_claim_enabled,
+                'run_renew_claim': run_renew_claim_enabled,
+                'run_release_claim': run_release_claim_enabled,
+                'runtime_register': runtime_register_enabled,
+                'runtime_heartbeat': runtime_heartbeat_enabled,
+                'runtime_list': runtime_list_enabled,
+            },
+        }

src/langbot/pkg/agent/runner/default_config.py

@@ -0,0 +1,72 @@
+"""Default AgentRunner binding configuration helpers."""
+
+from __future__ import annotations
+
+import sqlalchemy
+
+from ...core import app
+from ...entity.persistence import pipeline as persistence_pipeline
+from . import config_schema
+from .config_migration import ConfigMigration
+
+
+class AgentRunnerDefaultConfigService:
+    """Apply AgentRunner schema-defined defaults to host binding config."""
+
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def _get_runner_descriptor(self, runner_id: str):
+        registry = getattr(self.ap, 'agent_runner_registry', None)
+        if registry is None:
+            return None
+        try:
+            return await registry.get(runner_id, bound_plugins=None)
+        except Exception as e:
+            logger = getattr(self.ap, 'logger', None)
+            if logger:
+                logger.warning(f'Failed to load AgentRunner descriptor while setting default model: {e}')
+            return None
+
+    async def auto_set_default_pipeline_llm_model(self, model_uuid: str) -> bool:
+        """Set model_uuid into the default pipeline runner config when the selector is empty."""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
+                persistence_pipeline.LegacyPipeline.is_default == True
+            )
+        )
+        pipeline = result.first()
+        if pipeline is None:
+            return False
+
+        return await self.set_pipeline_llm_model_if_empty(pipeline, model_uuid)
+
+    async def set_pipeline_llm_model_if_empty(
+        self,
+        pipeline: persistence_pipeline.LegacyPipeline,
+        model_uuid: str,
+    ) -> bool:
+        """Set model_uuid into a pipeline's schema-defined LLM selector if it is empty."""
+        pipeline_config = pipeline.config
+        if not isinstance(pipeline_config, dict):
+            return False
+
+        runner_id = ConfigMigration.resolve_runner_id(pipeline_config)
+        if not runner_id:
+            return False
+
+        descriptor = await self._get_runner_descriptor(runner_id)
+        if descriptor is None:
+            return False
+
+        ai_config = pipeline_config.setdefault('ai', {})
+        runner_configs = ai_config.setdefault('runner_config', {})
+        runner_config = runner_configs.setdefault(runner_id, {})
+
+        if not config_schema.set_empty_llm_model_selection(descriptor, runner_config, model_uuid):
+            return False
+
+        await self.ap.pipeline_service.update_pipeline(pipeline.uuid, {'config': pipeline_config})
+        return True

src/langbot/pkg/agent/runner/descriptor.py

@@ -0,0 +1,82 @@
+"""Agent runner descriptor."""
+from __future__ import annotations
+
+import typing
+import pydantic
+
+from langbot_plugin.api.entities.builtin.agent_runner.manifest import (
+    AgentRunnerCapabilities,
+    AgentRunnerPermissions,
+)
+
+
+class AgentRunnerDescriptor(pydantic.BaseModel):
+    """Descriptor for an agent runner.
+
+    Represents the discovered metadata for a runner, including
+    its identity, capabilities, permissions, and configuration schema.
+    """
+
+    id: str
+    """Unique runner ID: plugin:author/plugin_name/runner_name"""
+
+    source: typing.Literal['plugin']
+    """Runner source type"""
+
+    label: dict[str, str]
+    """Display labels keyed by locale (e.g., en_US, zh_Hans)"""
+
+    description: dict[str, str] | None = None
+    """Optional description keyed by locale"""
+
+    plugin_author: str
+    """Plugin author from manifest"""
+
+    plugin_name: str
+    """Plugin name from manifest"""
+
+    runner_name: str
+    """AgentRunner component name from manifest"""
+
+    plugin_version: str | None = None
+    """Optional plugin version"""
+
+    config_schema: list[dict[str, typing.Any]] = pydantic.Field(default_factory=list)
+    """Configuration schema using DynamicForm format"""
+
+    capabilities: AgentRunnerCapabilities = pydantic.Field(
+        default_factory=AgentRunnerCapabilities
+    )
+    """Runner capabilities: streaming, tool_calling, knowledge_retrieval, etc."""
+
+    permissions: AgentRunnerPermissions = pydantic.Field(
+        default_factory=AgentRunnerPermissions
+    )
+    """Requested LangBot resource permissions."""
+
+    raw_manifest: dict[str, typing.Any] = pydantic.Field(default_factory=dict)
+    """Original manifest for reference"""
+
+    model_config = pydantic.ConfigDict(
+        extra='allow',
+    )
+
+    def get_plugin_id(self) -> str:
+        """Return plugin identifier as author/name."""
+        return f'{self.plugin_author}/{self.plugin_name}'
+
+    def supports_streaming(self) -> bool:
+        """Check if runner supports streaming output."""
+        return self.capabilities.streaming
+
+    def supports_tool_calling(self) -> bool:
+        """Check if runner supports tool calling."""
+        return self.capabilities.tool_calling
+
+    def supports_knowledge_retrieval(self) -> bool:
+        """Check if runner supports knowledge retrieval."""
+        return self.capabilities.knowledge_retrieval
+
+    def supports_steering(self) -> bool:
+        """Check if runner supports run steering/follow-up input."""
+        return bool(getattr(self.capabilities, 'steering', False))

src/langbot/pkg/agent/runner/errors.py

@@ -0,0 +1,37 @@
+"""Agent runner errors."""
+from __future__ import annotations
+
+
+class AgentRunnerError(Exception):
+    """Base error for agent runner operations."""
+    pass
+
+
+class RunnerNotFoundError(AgentRunnerError):
+    """Runner not found in registry."""
+    def __init__(self, runner_id: str):
+        self.runner_id = runner_id
+        super().__init__(f'Agent runner not found: {runner_id}')
+
+
+class RunnerNotAuthorizedError(AgentRunnerError):
+    """Runner not authorized for this binding."""
+    def __init__(self, runner_id: str, bound_plugins: list[str] | None):
+        self.runner_id = runner_id
+        self.bound_plugins = bound_plugins
+        super().__init__(f'Agent runner {runner_id} not authorized for bound_plugins={bound_plugins}')
+
+
+class RunnerProtocolError(AgentRunnerError):
+    """Runner protocol version mismatch or invalid manifest."""
+    def __init__(self, runner_id: str, message: str):
+        self.runner_id = runner_id
+        super().__init__(f'Agent runner protocol error for {runner_id}: {message}')
+
+
+class RunnerExecutionError(AgentRunnerError):
+    """Runner execution failed."""
+    def __init__(self, runner_id: str, message: str, retryable: bool = False):
+        self.runner_id = runner_id
+        self.retryable = retryable
+        super().__init__(f'Agent runner {runner_id} execution failed: {message}')

src/langbot/pkg/agent/runner/event_log_store.py

@@ -0,0 +1,315 @@
+"""EventLog store for writing and querying event records."""
+from __future__ import annotations
+
+import json
+import datetime
+import typing
+import uuid
+
+import sqlalchemy
+from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession
+from sqlalchemy.orm import sessionmaker
+
+from ...entity.persistence.event_log import EventLog
+
+
+UTC = datetime.timezone.utc
+
+
+def _utc_now() -> datetime.datetime:
+    return datetime.datetime.now(UTC)
+
+
+def _datetime_to_epoch(value: datetime.datetime | None) -> int | None:
+    if value is None:
+        return None
+    if value.tzinfo is None:
+        value = value.replace(tzinfo=UTC)
+    else:
+        value = value.astimezone(UTC)
+    return int(value.timestamp())
+
+
+class EventLogStore:
+    """Store for EventLog records.
+
+    Handles writing events to the event log and querying them.
+    All methods are async and use the provided database engine.
+    """
+
+    engine: AsyncEngine
+
+    # Hard limits
+    MAX_INPUT_SUMMARY_LENGTH = 1000
+
+    def __init__(self, engine: AsyncEngine):
+        self.engine = engine
+        self._session_factory = sessionmaker(
+            engine, class_=AsyncSession, expire_on_commit=False
+        )
+
+    async def append_event(
+        self,
+        event_id: str | None,
+        event_type: str,
+        source: str,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        conversation_id: str | None = None,
+        thread_id: str | None = None,
+        actor_type: str | None = None,
+        actor_id: str | None = None,
+        actor_name: str | None = None,
+        subject_type: str | None = None,
+        subject_id: str | None = None,
+        input_summary: str | None = None,
+        input_json: dict[str, typing.Any] | None = None,
+        raw_ref: str | None = None,
+        run_id: str | None = None,
+        runner_id: str | None = None,
+        event_time: datetime.datetime | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> str:
+        """Append an event to the event log.
+
+        Args:
+            event_id: Unique event ID (generated if None)
+            event_type: Event type
+            source: Event source
+            bot_id: Bot UUID
+            workspace_id: Workspace ID
+            conversation_id: Conversation ID
+            thread_id: Thread ID
+            actor_type: Actor type
+            actor_id: Actor ID
+            actor_name: Actor display name
+            subject_type: Subject type
+            subject_id: Subject ID
+            input_summary: Brief input summary
+            input_json: Full input JSON
+            raw_ref: Reference to raw event payload
+            run_id: Run ID processing this event
+            runner_id: Runner ID processing this event
+            event_time: When the event occurred
+            metadata: Additional metadata
+
+        Returns:
+            The event_id
+        """
+        if event_id is None:
+            event_id = str(uuid.uuid4())
+
+        # Truncate input summary if too long
+        if input_summary and len(input_summary) > self.MAX_INPUT_SUMMARY_LENGTH:
+            input_summary = input_summary[:self.MAX_INPUT_SUMMARY_LENGTH - 3] + "..."
+
+        async with self._session_factory() as session:
+            event = EventLog(
+                event_id=event_id,
+                event_type=event_type,
+                event_time=event_time,
+                source=source,
+                bot_id=bot_id,
+                workspace_id=workspace_id,
+                conversation_id=conversation_id,
+                thread_id=thread_id,
+                actor_type=actor_type,
+                actor_id=actor_id,
+                actor_name=actor_name,
+                subject_type=subject_type,
+                subject_id=subject_id,
+                input_summary=input_summary,
+                input_json=json.dumps(input_json) if input_json else None,
+                raw_ref=raw_ref,
+                run_id=run_id,
+                runner_id=runner_id,
+                metadata_json=json.dumps(metadata) if metadata else None,
+                created_at=_utc_now(),
+            )
+            session.add(event)
+            await session.commit()
+
+        return event_id
+
+    async def get_event(
+        self,
+        event_id: str,
+    ) -> dict[str, typing.Any] | None:
+        """Get a single event by ID.
+
+        Args:
+            event_id: Event ID
+
+        Returns:
+            Event record as dict, or None if not found
+        """
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(EventLog).where(EventLog.event_id == event_id)
+            )
+            row = result.scalars().first()
+            if row is None:
+                return None
+            return self._row_to_dict(row)
+
+    async def page_events(
+        self,
+        conversation_id: str | None = None,
+        event_types: list[str] | None = None,
+        before_seq: int | None = None,
+        limit: int = 50,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        strict_thread: bool = False,
+    ) -> tuple[list[dict[str, typing.Any]], int | None, bool]:
+        """Page through event records.
+
+        Args:
+            conversation_id: Filter by conversation ID
+            event_types: Filter by event types
+            before_seq: Get events before this sequence number
+            limit: Maximum items to return (capped at 100)
+            bot_id: Optional bot scope filter
+            workspace_id: Optional workspace scope filter
+            thread_id: Optional thread scope filter
+            strict_thread: When true, require thread_id equality including NULL
+
+        Returns:
+            Tuple of (items, next_seq, has_more)
+        """
+        limit = min(limit, 100)  # Hard cap
+
+        async with self._session_factory() as session:
+            query = sqlalchemy.select(EventLog)
+
+            if conversation_id is not None:
+                query = query.where(EventLog.conversation_id == conversation_id)
+            query = self._apply_scope_filters(query, bot_id, workspace_id, thread_id, strict_thread)
+
+            if event_types:
+                query = query.where(EventLog.event_type.in_(event_types))
+
+            if before_seq is not None:
+                query = query.where(EventLog.id < before_seq)
+
+            query = query.order_by(EventLog.id.desc()).limit(limit + 1)
+
+            result = await session.execute(query)
+            rows = result.scalars().all()
+
+            items = [self._row_to_dict(row) for row in rows[:limit]]
+            has_more = len(rows) > limit
+            next_seq = items[-1]['id'] if items and has_more else None
+
+            return items, next_seq, has_more
+
+    async def get_latest_cursor(
+        self,
+        conversation_id: str,
+    ) -> str | None:
+        """Get the latest cursor for a conversation.
+
+        Args:
+            conversation_id: Conversation ID
+
+        Returns:
+            Cursor string (seq number), or None if no events
+        """
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(EventLog.id)
+                .where(EventLog.conversation_id == conversation_id)
+                .order_by(EventLog.id.desc())
+                .limit(1)
+            )
+            row = result.scalars().first()
+            if row is None:
+                return None
+            return str(row)
+
+    async def has_events_before(
+        self,
+        conversation_id: str,
+        seq: int,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        strict_thread: bool = False,
+    ) -> bool:
+        """Check if there are events before a sequence number.
+
+        Args:
+            conversation_id: Conversation ID
+            seq: Sequence number
+
+        Returns:
+            True if there are events before
+        """
+        async with self._session_factory() as session:
+            query = (
+                sqlalchemy.select(sqlalchemy.func.count())
+                .select_from(EventLog)
+                .where(EventLog.conversation_id == conversation_id, EventLog.id < seq)
+            )
+            query = self._apply_scope_filters(query, bot_id, workspace_id, thread_id, strict_thread)
+            result = await session.execute(query)
+            count = result.scalar()
+            return count > 0
+
+    def _apply_scope_filters(
+        self,
+        query: typing.Any,
+        bot_id: str | None,
+        workspace_id: str | None,
+        thread_id: str | None,
+        strict_thread: bool,
+    ) -> typing.Any:
+        if bot_id is not None:
+            query = query.where(EventLog.bot_id == bot_id)
+        if workspace_id is not None:
+            query = query.where(EventLog.workspace_id == workspace_id)
+        if strict_thread:
+            if thread_id is None:
+                query = query.where(EventLog.thread_id.is_(None))
+            else:
+                query = query.where(EventLog.thread_id == thread_id)
+        return query
+
+    async def cleanup_events_older_than(
+        self,
+        before: datetime.datetime,
+    ) -> int:
+        """Delete EventLog rows created before the supplied timestamp."""
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.delete(EventLog).where(EventLog.created_at < before)
+            )
+            await session.commit()
+            return result.rowcount or 0
+
+    def _row_to_dict(self, row: EventLog) -> dict[str, typing.Any]:
+        """Convert an EventLog row to dict."""
+        return {
+            'id': row.id,
+            'event_id': row.event_id,
+            'event_type': row.event_type,
+            'event_time': _datetime_to_epoch(row.event_time),
+            'source': row.source,
+            'bot_id': row.bot_id,
+            'workspace_id': row.workspace_id,
+            'conversation_id': row.conversation_id,
+            'thread_id': row.thread_id,
+            'actor_type': row.actor_type,
+            'actor_id': row.actor_id,
+            'actor_name': row.actor_name,
+            'subject_type': row.subject_type,
+            'subject_id': row.subject_id,
+            'input_summary': row.input_summary,
+            'input_json': json.loads(row.input_json) if row.input_json else None,
+            'raw_ref': row.raw_ref,
+            'run_id': row.run_id,
+            'runner_id': row.runner_id,
+            'created_at': _datetime_to_epoch(row.created_at),
+            'metadata': json.loads(row.metadata_json) if row.metadata_json else {},
+        }

src/langbot/pkg/agent/runner/events.py

@@ -0,0 +1,25 @@
+"""Canonical AgentRunner event names reserved for future EBA integration."""
+from __future__ import annotations
+
+
+MESSAGE_RECEIVED = 'message.received'
+"""A normal message entered the current Pipeline."""
+
+MESSAGE_RECALLED = 'message.recalled'
+"""A platform message was recalled or deleted."""
+
+GROUP_MEMBER_JOINED = 'group.member_joined'
+"""A new member joined a group/channel conversation."""
+
+FRIEND_REQUEST_RECEIVED = 'friend.request_received'
+"""A new friend/contact request was received."""
+
+
+RESERVED_EVENT_TYPES = frozenset(
+    {
+        MESSAGE_RECEIVED,
+        MESSAGE_RECALLED,
+        GROUP_MEMBER_JOINED,
+        FRIEND_REQUEST_RECEIVED,
+    }
+)

src/langbot/pkg/agent/runner/host_models.py

@@ -0,0 +1,210 @@
+"""Agent event envelope and binding models for LangBot Host.
+
+These are Host-internal models, not exposed to SDK.
+"""
+from __future__ import annotations
+
+import typing
+import pydantic
+
+from langbot_plugin.api.entities.builtin.agent_runner.event import (
+    ActorContext,
+    SubjectContext,
+    RawEventRef,
+)
+from langbot_plugin.api.entities.builtin.agent_runner.input import AgentInput
+from langbot_plugin.api.entities.builtin.agent_runner.delivery import DeliveryContext
+
+
+class AgentEventEnvelope(pydantic.BaseModel):
+    """Event envelope for LangBot Host event gateway.
+
+    This is the unified input model that replaces Query-first approach.
+    IM / WebUI / API / EventRouter all produce this envelope.
+    """
+
+    event_id: str
+    """Unique event identifier."""
+
+    event_type: str
+    """Event type (message.received, message.recalled, etc.)."""
+
+    event_time: int | None = None
+    """Event timestamp (epoch seconds)."""
+
+    source: str
+    """Event source (platform, webui, api, scheduler, system)."""
+
+    source_event_type: str | None = None
+    """Original source event type, when available."""
+
+    bot_id: str | None = None
+    """Bot UUID handling this event."""
+
+    workspace_id: str | None = None
+    """Workspace ID (for multi-tenant)."""
+
+    conversation_id: str | None = None
+    """Conversation ID."""
+
+    thread_id: str | None = None
+    """Thread ID (for platforms supporting threads)."""
+
+    actor: ActorContext | None = None
+    """Actor (who triggered the event)."""
+
+    subject: SubjectContext | None = None
+    """Subject (what the event is about)."""
+
+    input: AgentInput
+    """Event input."""
+
+    delivery: DeliveryContext
+    """Delivery context."""
+
+    raw_ref: RawEventRef | None = None
+    """Reference to raw event payload."""
+
+    data: dict[str, typing.Any] = pydantic.Field(default_factory=dict)
+    """Small structured event payload. Large payloads should be referenced via raw_ref/artifacts."""
+
+
+# Binding scope types
+class BindingScope(pydantic.BaseModel):
+    """Scope for agent binding."""
+
+    scope_type: typing.Literal["agent", "bot", "workspace", "global"] = "agent"
+    """Scope type."""
+
+    scope_id: str | None = None
+    """Scope identifier (agent_id, bot_uuid, etc.)."""
+
+
+class ResourcePolicy(pydantic.BaseModel):
+    """Resource policy for agent binding.
+
+    Controls what resources the runner can access.
+    """
+
+    allowed_model_uuids: list[str] | None = None
+    """Additional model UUID grants. None means no additional model grants."""
+
+    allowed_tool_names: list[str] | None = None
+    """Additional tool name grants. None means no additional tool grants."""
+
+    allowed_kb_uuids: list[str] | None = None
+    """Additional knowledge base UUID grants. None means no additional KB grants."""
+
+    allowed_skill_names: list[str] | None = None
+    """Allowed skill names. None means all currently visible skills are allowed."""
+
+    allow_plugin_storage: bool = True
+    """Whether plugin storage is allowed."""
+
+    allow_workspace_storage: bool = False
+    """Whether workspace storage is allowed."""
+
+
+class StatePolicy(pydantic.BaseModel):
+    """State policy for agent binding.
+
+    Controls state management behavior.
+    """
+
+    enable_state: bool = True
+    """Whether host-owned state is enabled."""
+
+    state_scopes: list[typing.Literal["conversation", "actor", "subject", "runner"]] = (
+        pydantic.Field(default_factory=lambda: ["conversation", "actor"])
+    )
+    """Enabled state scopes."""
+
+
+class DeliveryPolicy(pydantic.BaseModel):
+    """Delivery policy for agent binding.
+
+    Controls how results are delivered.
+    """
+
+    enable_streaming: bool = True
+    """Whether streaming output is enabled."""
+
+    enable_reply: bool = True
+    """Whether reply is enabled."""
+
+    max_message_size: int | None = None
+    """Maximum message size."""
+
+
+class AgentConfig(pydantic.BaseModel):
+    """Host-side Agent configuration.
+
+    Product-level Agent is the target replacement for Pipeline-owned agent
+    config. Current Pipeline entry paths can project their config into this
+    model during migration.
+    """
+
+    agent_id: str | None = None
+    """Host-side Agent/config identifier."""
+
+    runner_id: str
+    """Runner ID to invoke."""
+
+    runner_config: dict[str, typing.Any] = pydantic.Field(default_factory=dict)
+    """Agent/runner binding configuration."""
+
+    resource_policy: ResourcePolicy = pydantic.Field(default_factory=ResourcePolicy)
+    """Resource policy for this Agent."""
+
+    state_policy: StatePolicy = pydantic.Field(default_factory=StatePolicy)
+    """State policy for this Agent."""
+
+    delivery_policy: DeliveryPolicy = pydantic.Field(default_factory=DeliveryPolicy)
+    """Delivery policy for this Agent."""
+
+    event_types: list[str] = pydantic.Field(default_factory=lambda: ["message.received"])
+    """Event types this Agent handles."""
+
+    enabled: bool = True
+    """Whether this Agent can be selected by a binding resolver."""
+
+    metadata: dict[str, typing.Any] = pydantic.Field(default_factory=dict)
+    """Non-protocol diagnostic metadata, such as legacy config source."""
+
+
+class AgentBinding(pydantic.BaseModel):
+    """Binding configuration for mapping events to runners.
+
+    This is Host-internal model for event-to-runner binding.
+    It replaces the old Pipeline runner config role.
+    """
+
+    binding_id: str
+    """Unique binding identifier."""
+
+    scope: BindingScope = pydantic.Field(default_factory=BindingScope)
+    """Binding scope."""
+
+    event_types: list[str] = pydantic.Field(default_factory=lambda: ["message.received"])
+    """Event types this binding handles."""
+
+    runner_id: str
+    """Runner ID to invoke."""
+
+    runner_config: dict[str, typing.Any] = pydantic.Field(default_factory=dict)
+    """Current Agent/runner configuration."""
+
+    resource_policy: ResourcePolicy = pydantic.Field(default_factory=ResourcePolicy)
+    """Resource policy."""
+
+    state_policy: StatePolicy = pydantic.Field(default_factory=StatePolicy)
+    """State policy."""
+
+    delivery_policy: DeliveryPolicy = pydantic.Field(default_factory=DeliveryPolicy)
+    """Delivery policy."""
+
+    enabled: bool = True
+    """Whether binding is enabled."""
+
+    agent_id: str | None = None
+    """Host-side Agent/config identifier for this binding."""

src/langbot/pkg/agent/runner/id.py

@@ -0,0 +1,91 @@
+"""Agent runner ID parsing and formatting."""
+from __future__ import annotations
+
+import dataclasses
+
+
+@dataclasses.dataclass(frozen=True)
+class RunnerIdParts:
+    """Parsed runner ID components."""
+    source: str  # 'plugin' (future: 'builtin')
+    plugin_author: str
+    plugin_name: str
+    runner_name: str
+
+    def to_plugin_id(self) -> str:
+        """Return plugin identifier as author/name."""
+        return f'{self.plugin_author}/{self.plugin_name}'
+
+
+def parse_runner_id(runner_id: str) -> RunnerIdParts:
+    """Parse runner ID string into components.
+
+    Args:
+        runner_id: Runner ID in format 'plugin:author/plugin_name/runner_name'
+
+    Returns:
+        RunnerIdParts with parsed components
+
+    Raises:
+        ValueError: If runner_id format is invalid
+    """
+    if runner_id.startswith('plugin:'):
+        parts = runner_id[7:].split('/')
+        if len(parts) != 3:
+            raise ValueError(
+                f'Invalid plugin runner ID format: {runner_id}. '
+                f'Expected: plugin:author/plugin_name/runner_name'
+            )
+        plugin_author, plugin_name, runner_name = parts
+        if not plugin_author or not plugin_name or not runner_name:
+            raise ValueError(
+                f'Invalid plugin runner ID: {runner_id}. '
+                f'author, plugin_name, and runner_name must be non-empty'
+            )
+        return RunnerIdParts(
+            source='plugin',
+            plugin_author=plugin_author,
+            plugin_name=plugin_name,
+            runner_name=runner_name,
+        )
+    else:
+        # Only plugin runner IDs are valid at the protocol boundary.
+        raise ValueError(
+            f'Invalid runner ID format: {runner_id}. '
+            f'Expected: plugin:author/plugin_name/runner_name'
+        )
+
+
+def format_runner_id(
+    source: str,
+    plugin_author: str,
+    plugin_name: str,
+    runner_name: str,
+) -> str:
+    """Format runner ID from components.
+
+    Args:
+        source: Runner source ('plugin')
+        plugin_author: Plugin author
+        plugin_name: Plugin name
+        runner_name: Runner component name
+
+    Returns:
+        Runner ID string
+    """
+    if source == 'plugin':
+        return f'plugin:{plugin_author}/{plugin_name}/{runner_name}'
+    else:
+        raise ValueError(f'Invalid runner source: {source}')
+
+
+def is_plugin_runner_id(runner_id: str) -> bool:
+    """Check if runner ID is a plugin runner.
+
+    Args:
+        runner_id: Runner ID string
+
+    Returns:
+        True if runner ID starts with 'plugin:'
+    """
+    return runner_id.startswith('plugin:')

src/langbot/pkg/agent/runner/invoker.py

@@ -0,0 +1,131 @@
+"""Plugin-runtime invocation for AgentRunner executions."""
+
+from __future__ import annotations
+
+import asyncio
+import time
+import traceback
+import typing
+
+from langbot_plugin.entities.io.errors import ActionCallTimeoutError
+
+from ...core import app
+from .context_builder import AgentRunContextPayload
+from .descriptor import AgentRunnerDescriptor
+from .errors import RunnerExecutionError
+
+
+class AgentRunnerInvoker:
+    """Invoke an AgentRunner through the plugin runtime.
+
+    This keeps runtime transport, deadline enforcement, and transport error
+    mapping out of the orchestration state machine.
+    """
+
+    ap: app.Application
+
+    def __init__(self, ap: app.Application):
+        self.ap = ap
+
+    async def invoke(
+        self,
+        descriptor: AgentRunnerDescriptor,
+        context: AgentRunContextPayload,
+    ) -> typing.AsyncGenerator[dict[str, typing.Any], None]:
+        """Invoke the runner and yield raw result dictionaries."""
+        if not self.ap.plugin_connector.is_enable_plugin:
+            raise RunnerExecutionError(
+                descriptor.id,
+                'Plugin system is disabled',
+                retryable=False,
+            )
+
+        try:
+            gen = self.ap.plugin_connector.run_agent(
+                plugin_author=descriptor.plugin_author,
+                plugin_name=descriptor.plugin_name,
+                runner_name=descriptor.runner_name,
+                context=context,
+            )
+
+            while True:
+                try:
+                    result_dict = await self._next_with_deadline(gen, descriptor, context)
+                except StopAsyncIteration:
+                    break
+                yield result_dict
+
+        except asyncio.TimeoutError as e:
+            raise RunnerExecutionError(
+                descriptor.id,
+                'Runner timed out (code: runner.timeout)',
+                retryable=True,
+            ) from e
+        except ActionCallTimeoutError as e:
+            raise RunnerExecutionError(
+                descriptor.id,
+                f'{e} (code: runner.timeout)',
+                retryable=True,
+            ) from e
+        except RunnerExecutionError:
+            raise
+        except Exception as e:
+            self.ap.logger.error(
+                f'Runner {descriptor.id} unexpected error: {traceback.format_exc()}'
+            )
+            raise RunnerExecutionError(
+                descriptor.id,
+                str(e),
+                retryable=False,
+            )
+
+    async def _next_with_deadline(
+        self,
+        gen: typing.AsyncGenerator[dict[str, typing.Any], None],
+        descriptor: AgentRunnerDescriptor,
+        context: AgentRunContextPayload,
+    ) -> dict[str, typing.Any]:
+        """Read the next runner result while enforcing the run deadline."""
+        remaining = self._remaining_deadline_seconds(context)
+        if remaining is not None and remaining <= 0:
+            await self._close_generator(gen, descriptor)
+            raise asyncio.TimeoutError
+
+        try:
+            if remaining is None:
+                return await anext(gen)
+            return await asyncio.wait_for(anext(gen), timeout=remaining)
+        except StopAsyncIteration:
+            if self._is_deadline_exhausted(context):
+                raise asyncio.TimeoutError
+            raise
+        except asyncio.TimeoutError:
+            await self._close_generator(gen, descriptor)
+            raise
+
+    def _remaining_deadline_seconds(
+        self,
+        context: AgentRunContextPayload,
+    ) -> float | None:
+        runtime = context.get('runtime') or {}
+        deadline_at = runtime.get('deadline_at')
+        if deadline_at is None:
+            return None
+        try:
+            return float(deadline_at) - time.time()
+        except (TypeError, ValueError):
+            return None
+
+    def _is_deadline_exhausted(self, context: AgentRunContextPayload) -> bool:
+        remaining = self._remaining_deadline_seconds(context)
+        return remaining is not None and remaining <= 0
+
+    async def _close_generator(
+        self,
+        gen: typing.AsyncGenerator[dict[str, typing.Any], None],
+        descriptor: AgentRunnerDescriptor,
+    ) -> None:
+        try:
+            await gen.aclose()
+        except Exception as e:
+            self.ap.logger.warning(f'Failed to close timed-out runner {descriptor.id}: {e}')

src/langbot/pkg/agent/runner/orchestrator.py

@@ -0,0 +1,557 @@
+"""Agent run orchestrator for coordinating runner execution."""
+
+from __future__ import annotations
+
+import time
+import typing
+
+from langbot_plugin.api.entities.builtin.provider import message as provider_message
+from langbot_plugin.api.entities.builtin.pipeline import query as pipeline_query
+
+from ...core import app
+from .binding_resolver import AgentBindingResolver
+from .context_builder import AgentRunContextBuilder, AgentRunContextPayload
+from .descriptor import AgentRunnerDescriptor
+from .host_models import AgentBinding, AgentEventEnvelope
+from .invoker import AgentRunnerInvoker
+from .query_bridge import QueryRunBridge
+from .registry import AgentRunnerRegistry
+from .resource_builder import AgentResourceBuilder
+from .result_normalizer import AgentResultNormalizer
+from .run_journal import AgentRunJournal, MAX_ARTIFACT_INLINE_BYTES as _MAX_ARTIFACT_INLINE_BYTES
+from .session_registry import AgentRunSessionRegistry, get_session_registry
+from .state_scope import build_state_context
+from ...provider.tools.loaders import skill as skill_loader
+
+
+MAX_ARTIFACT_INLINE_BYTES = _MAX_ARTIFACT_INLINE_BYTES
+
+
+class AgentRunOrchestrator:
+    """Coordinate one AgentRunner execution.
+
+    The orchestrator keeps the run state machine readable and delegates
+    transport, Query bridging, and persistence side effects to narrower
+    collaborators.
+    """
+
+    ap: app.Application
+    registry: AgentRunnerRegistry
+    context_builder: AgentRunContextBuilder
+    resource_builder: AgentResourceBuilder
+    result_normalizer: AgentResultNormalizer
+    binding_resolver: AgentBindingResolver
+    query_bridge: QueryRunBridge
+    invoker: AgentRunnerInvoker
+    journal: AgentRunJournal
+    _session_registry: AgentRunSessionRegistry
+
+    def __init__(
+        self,
+        ap: app.Application,
+        registry: AgentRunnerRegistry,
+    ):
+        self.ap = ap
+        self.registry = registry
+        self.context_builder = AgentRunContextBuilder(ap)
+        self.resource_builder = AgentResourceBuilder(ap)
+        self.result_normalizer = AgentResultNormalizer(ap)
+        self.binding_resolver = AgentBindingResolver()
+        self.query_bridge = QueryRunBridge(self.binding_resolver)
+        self.invoker = AgentRunnerInvoker(ap)
+        self.journal = AgentRunJournal(ap)
+        self._session_registry = get_session_registry()
+
+    async def run(
+        self,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        bound_plugins: list[str] | None = None,
+        adapter_context: dict[str, typing.Any] | None = None,
+    ) -> typing.AsyncGenerator[provider_message.Message | provider_message.MessageChunk, None]:
+        """Run an AgentRunner from an event-first envelope."""
+        runner_id = binding.runner_id
+        descriptor = await self.registry.get(runner_id, bound_plugins)
+
+        resources = await self.resource_builder.build_resources_from_binding(
+            event=event,
+            binding=binding,
+            descriptor=descriptor,
+        )
+
+        context = await self.context_builder.build_context_from_event(
+            event=event,
+            binding=binding,
+            descriptor=descriptor,
+            resources=resources,
+        )
+
+        session_query_id = None
+        if adapter_context:
+            query = adapter_context.get('_query')
+            if query is not None:
+                skill_loader.restore_activated_skills_from_state(
+                    self.ap,
+                    query,
+                    context.get('state', {}),
+                )
+            session_query_id = adapter_context.get('query_id')
+            if query is not None or session_query_id is not None:
+                context['context']['available_apis']['prompt_get'] = True
+            if 'params' in adapter_context:
+                context['adapter']['extra']['params'] = adapter_context['params']
+
+        state_context = build_state_context(event, binding, descriptor)
+        run_id = context['run_id']
+        available_apis = context.get('context', {}).get('available_apis')
+        run_authorization = {
+            'runner_id': descriptor.id,
+            'binding_id': binding.binding_id,
+            'plugin_identity': descriptor.get_plugin_id(),
+            'resources': resources,
+            'available_apis': available_apis,
+            'conversation_id': event.conversation_id,
+            'bot_id': event.bot_id,
+            'workspace_id': event.workspace_id,
+            'thread_id': event.thread_id,
+            'state_policy': {
+                'enable_state': binding.state_policy.enable_state,
+                'state_scopes': list(binding.state_policy.state_scopes),
+            },
+            'state_context': state_context,
+        }
+
+        pending_artifact_refs: list[dict[str, typing.Any]] = []
+        seen_sequences: set[int] = set()
+        last_sequence = 0
+        assistant_transcript_written = False
+        terminal_status: str | None = None
+        terminal_reason: str | None = None
+        terminal_usage: dict[str, typing.Any] | None = None
+
+        try:
+            await self.journal.create_run(
+                event=event,
+                binding=binding,
+                descriptor=descriptor,
+                context=context,
+                authorization=run_authorization,
+            )
+            await self._session_registry.register(
+                run_id=run_id,
+                runner_id=descriptor.id,
+                query_id=session_query_id,
+                plugin_identity=descriptor.get_plugin_id(),
+                resources=resources,
+                available_apis=context.get('context', {}).get('available_apis'),
+                conversation_id=event.conversation_id,
+                bot_id=event.bot_id,
+                workspace_id=event.workspace_id,
+                thread_id=event.thread_id,
+                state_policy={
+                    'enable_state': binding.state_policy.enable_state,
+                    'state_scopes': list(binding.state_policy.state_scopes),
+                },
+                state_context=state_context,
+            )
+
+            event_log_id = await self.journal.write_event_log(
+                event=event,
+                binding=binding,
+                run_id=run_id,
+                runner_id=descriptor.id,
+            )
+            await self.journal.register_input_artifacts(
+                event=event,
+                run_id=run_id,
+                runner_id=descriptor.id,
+            )
+            if event.event_type == 'message.received' and event.conversation_id:
+                await self.journal.write_user_transcript(
+                    event=event,
+                    event_log_id=event_log_id,
+                )
+
+            async for result_dict in self.invoker.invoke(descriptor, context):
+                result_dict = dict(result_dict)
+                sequence = result_dict.get('sequence')
+                if sequence is not None:
+                    try:
+                        sequence_int = int(sequence)
+                    except (TypeError, ValueError):
+                        self.ap.logger.warning(f'Runner {descriptor.id} returned invalid result sequence: {sequence}')
+                        sequence_int = last_sequence + 1
+                        result_dict['sequence'] = sequence_int
+                    else:
+                        if sequence_int in seen_sequences:
+                            self.ap.logger.warning(
+                                f'Runner {descriptor.id} returned duplicate result sequence '
+                                f'{sequence_int} for run {run_id}; dropping duplicate'
+                            )
+                            continue
+                        if sequence_int <= 0:
+                            self.ap.logger.warning(
+                                f'Runner {descriptor.id} returned non-positive result sequence '
+                                f'{sequence_int} for run {run_id}'
+                            )
+                            sequence_int = last_sequence + 1
+                            result_dict['sequence'] = sequence_int
+                        elif last_sequence and sequence_int != last_sequence + 1:
+                            self.ap.logger.warning(
+                                f'Runner {descriptor.id} result sequence gap or out-of-order '
+                                f'for run {run_id}: previous={last_sequence}, current={sequence_int}'
+                            )
+                        seen_sequences.add(sequence_int)
+                        last_sequence = max(last_sequence, sequence_int)
+                else:
+                    sequence_int = last_sequence + 1
+                    result_dict['sequence'] = sequence_int
+                    seen_sequences.add(sequence_int)
+                    last_sequence = sequence_int
+
+                result_type = result_dict.get('type')
+                if result_type and not self.result_normalizer.validate_payload(
+                    result_type,
+                    result_dict.get('data', {}),
+                    descriptor,
+                ):
+                    continue
+
+                if result_type == 'artifact.created':
+                    artifact_ref = await self.journal.handle_artifact_created(
+                        result_dict=result_dict,
+                        event=event,
+                        run_id=run_id,
+                        runner_id=descriptor.id,
+                    )
+                    pending_artifact_refs.append(artifact_ref)
+                    await self.journal.append_run_result(
+                        result_dict=result_dict,
+                        run_id=run_id,
+                        sequence=sequence_int,
+                        artifact_refs=[artifact_ref],
+                    )
+                    await self.result_normalizer.normalize(result_dict, descriptor)
+                    continue
+
+                await self.journal.append_run_result(
+                    result_dict=result_dict,
+                    run_id=run_id,
+                    sequence=sequence_int,
+                )
+
+                if result_type == 'state.updated':
+                    await self.journal.handle_state_updated_event(
+                        result_dict,
+                        event,
+                        binding,
+                        descriptor,
+                        run_id=run_id,
+                    )
+                    await self.result_normalizer.normalize(result_dict, descriptor)
+                    continue
+
+                if result_type == 'run.completed':
+                    terminal_status = 'completed'
+                    terminal_reason = (
+                        result_dict.get('data', {}).get('finish_reason')
+                        if isinstance(result_dict.get('data'), dict)
+                        else None
+                    )
+                    usage = result_dict.get('usage')
+                    if isinstance(usage, dict):
+                        terminal_usage = usage
+                elif result_type == 'run.failed':
+                    terminal_status = 'failed'
+                    data = result_dict.get('data') if isinstance(result_dict.get('data'), dict) else {}
+                    terminal_reason = data.get('error') or data.get('code')
+                    usage = result_dict.get('usage')
+                    if isinstance(usage, dict):
+                        terminal_usage = usage
+
+                has_completed_message = result_type == 'message.completed' or (
+                    result_type == 'run.completed'
+                    and isinstance(result_dict.get('data'), dict)
+                    and bool(result_dict['data'].get('message'))
+                )
+                if has_completed_message and event.conversation_id and not assistant_transcript_written:
+                    merged_refs = self.journal.merge_artifact_refs(
+                        pending_artifact_refs,
+                        result_dict,
+                    )
+                    pending_artifact_refs.clear()
+
+                    await self.journal.write_assistant_transcript(
+                        result_dict=result_dict,
+                        event=event,
+                        run_id=run_id,
+                        runner_id=descriptor.id,
+                        artifact_refs=merged_refs if merged_refs else None,
+                    )
+                    assistant_transcript_written = True
+
+                result = await self.result_normalizer.normalize(result_dict, descriptor)
+                if result is not None:
+                    yield result
+
+                run_snapshot = await self.journal.get_run(run_id)
+                if run_snapshot and run_snapshot.get('cancel_requested_at') is not None:
+                    terminal_status = 'cancelled'
+                    terminal_reason = run_snapshot.get('status_reason') or 'cancel_requested'
+                    break
+            await self.journal.finalize_run(
+                run_id=run_id,
+                status=terminal_status or 'completed',
+                status_reason=terminal_reason,
+                usage=terminal_usage,
+            )
+        except Exception as exc:
+            failed_usage = terminal_usage
+            await self.journal.finalize_run(
+                run_id=run_id,
+                status='timeout' if self._is_deadline_exhausted(context) else 'failed',
+                status_reason=str(exc),
+                usage=failed_usage,
+            )
+            raise
+        finally:
+            session = await self._session_registry.unregister(run_id)
+            pending_steering = session.get('steering_queue', []) if session else []
+            if pending_steering:
+                try:
+                    await self.journal.write_steering_dropped_audits(
+                        pending_steering,
+                        run_id,
+                        descriptor.id,
+                    )
+                except Exception as exc:
+                    self.ap.logger.warning(
+                        f'Failed to write dropped steering audit for run {run_id}: {exc}',
+                        exc_info=True,
+                    )
+
+    async def run_from_query(
+        self,
+        query: pipeline_query.Query,
+    ) -> typing.AsyncGenerator[provider_message.Message | provider_message.MessageChunk, None]:
+        """Run an AgentRunner from the current Pipeline Query entry point."""
+        plan = self.query_bridge.build_plan(query)
+        adapter_context = dict(plan.adapter_context)
+        adapter_context['_query'] = query
+        async for result in self.run(
+            plan.event,
+            plan.binding,
+            bound_plugins=plan.bound_plugins,
+            adapter_context=adapter_context,
+        ):
+            yield result
+
+    def resolve_runner_id_for_telemetry(self, query: pipeline_query.Query) -> str | None:
+        """Resolve runner ID for telemetry/logging without full execution."""
+        return self.query_bridge.resolve_runner_id_for_telemetry(query)
+
+    async def try_claim_steering_from_query(
+        self,
+        query: pipeline_query.Query,
+    ) -> bool:
+        """Claim a query as steering input for an active run when possible."""
+        plan = self.query_bridge.build_plan(query)
+        event = plan.event
+        binding = plan.binding
+
+        if event.event_type != 'message.received' or not event.conversation_id:
+            return False
+
+        descriptor = await self.registry.get(binding.runner_id, plan.bound_plugins)
+        if not descriptor.supports_steering():
+            return False
+
+        target_run_id = await self._session_registry.find_steering_target(
+            conversation_id=event.conversation_id,
+            runner_id=descriptor.id,
+            bot_id=event.bot_id,
+            workspace_id=event.workspace_id,
+            thread_id=event.thread_id,
+        )
+        if target_run_id is None:
+            return False
+
+        steering_item = self._build_steering_item(event, target_run_id, descriptor.id)
+        if not await self._session_registry.enqueue_steering(target_run_id, steering_item):
+            return False
+
+        try:
+            event_log_id = await self.journal.write_event_log(
+                event=event,
+                binding=binding,
+                run_id=target_run_id,
+                runner_id=descriptor.id,
+                metadata={
+                    'steering': {
+                        'status': 'queued',
+                        'trigger_behavior': 'absorbed_into_active_run',
+                        'claimed_by_run_id': target_run_id,
+                        'claimed_runner_id': descriptor.id,
+                        'claimed_at': steering_item.get('claimed_at'),
+                    },
+                },
+            )
+            await self.journal.register_input_artifacts(
+                event=event,
+                run_id=target_run_id,
+                runner_id=descriptor.id,
+            )
+            await self.journal.write_user_transcript(event, event_log_id)
+        except Exception as exc:
+            self.ap.logger.warning(
+                f'Failed to persist steering event {event.event_id} for run {target_run_id}: {exc}',
+                exc_info=True,
+            )
+
+        self.ap.logger.info(f'Claimed event {event.event_id} as steering input for run {target_run_id}')
+        return True
+
+    def _build_steering_item(
+        self,
+        event: AgentEventEnvelope,
+        run_id: str,
+        runner_id: str,
+    ) -> dict[str, typing.Any]:
+        """Build the run-scoped steering item returned by the Host pull API."""
+        return {
+            'claimed_run_id': run_id,
+            'runner_id': runner_id,
+            'claimed_at': int(time.time()),
+            'event': {
+                'event_id': event.event_id,
+                'event_type': event.event_type,
+                'event_time': event.event_time,
+                'source': event.source,
+                'source_event_type': event.source_event_type,
+                'raw_ref': event.raw_ref.model_dump(mode='json') if event.raw_ref else None,
+                'data': event.data,
+            },
+            'conversation': {
+                'conversation_id': event.conversation_id,
+                'thread_id': event.thread_id,
+                'bot_id': event.bot_id,
+                'workspace_id': event.workspace_id,
+            },
+            'actor': event.actor.model_dump(mode='json') if event.actor else None,
+            'subject': event.subject.model_dump(mode='json') if event.subject else None,
+            'input': {
+                'text': event.input.text if event.input else None,
+                'contents': [
+                    c.model_dump(mode='json') if hasattr(c, 'model_dump') else c
+                    for c in (event.input.contents if event.input else [])
+                ],
+                'attachments': [
+                    a.model_dump(mode='json') if hasattr(a, 'model_dump') else a
+                    for a in (event.input.attachments if event.input else [])
+                ],
+            },
+        }
+
+    async def _invoke_runner(
+        self,
+        descriptor: AgentRunnerDescriptor,
+        context: AgentRunContextPayload,
+    ) -> typing.AsyncGenerator[dict[str, typing.Any], None]:
+        """Compatibility delegate for older tests and internal callers."""
+        async for result in self.invoker.invoke(descriptor, context):
+            yield result
+
+    async def _next_with_deadline(
+        self,
+        gen: typing.AsyncGenerator[dict[str, typing.Any], None],
+        descriptor: AgentRunnerDescriptor,
+        context: AgentRunContextPayload,
+    ) -> dict[str, typing.Any]:
+        return await self.invoker._next_with_deadline(gen, descriptor, context)
+
+    def _remaining_deadline_seconds(
+        self,
+        context: AgentRunContextPayload,
+    ) -> float | None:
+        return self.invoker._remaining_deadline_seconds(context)
+
+    def _is_deadline_exhausted(self, context: AgentRunContextPayload) -> bool:
+        return self.invoker._is_deadline_exhausted(context)
+
+    async def _close_generator(
+        self,
+        gen: typing.AsyncGenerator[dict[str, typing.Any], None],
+        descriptor: AgentRunnerDescriptor,
+    ) -> None:
+        await self.invoker._close_generator(gen, descriptor)
+
+    async def _handle_state_updated_event(
+        self,
+        result_dict: dict[str, typing.Any],
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+    ) -> None:
+        await self.journal.handle_state_updated_event(result_dict, event, binding, descriptor)
+
+    async def _write_event_log(
+        self,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        run_id: str,
+        runner_id: str,
+    ) -> str:
+        return await self.journal.write_event_log(event, binding, run_id, runner_id)
+
+    async def _register_input_artifacts(
+        self,
+        event: AgentEventEnvelope,
+        run_id: str,
+        runner_id: str,
+    ) -> None:
+        await self.journal.register_input_artifacts(event, run_id, runner_id)
+
+    def _decode_attachment_content(
+        self,
+        content: typing.Any,
+    ) -> tuple[bytes | None, str | None]:
+        return self.journal.decode_attachment_content(content)
+
+    async def _write_user_transcript(
+        self,
+        event: AgentEventEnvelope,
+        event_log_id: str,
+    ) -> None:
+        await self.journal.write_user_transcript(event, event_log_id)
+
+    async def _handle_artifact_created(
+        self,
+        result_dict: dict[str, typing.Any],
+        event: AgentEventEnvelope,
+        run_id: str,
+        runner_id: str,
+    ) -> dict[str, typing.Any]:
+        return await self.journal.handle_artifact_created(result_dict, event, run_id, runner_id)
+
+    def _merge_artifact_refs(
+        self,
+        pending_refs: list[dict[str, typing.Any]],
+        result_dict: dict[str, typing.Any],
+    ) -> list[dict[str, typing.Any]]:
+        return self.journal.merge_artifact_refs(pending_refs, result_dict)
+
+    async def _write_assistant_transcript(
+        self,
+        result_dict: dict[str, typing.Any],
+        event: AgentEventEnvelope,
+        run_id: str,
+        runner_id: str,
+        artifact_refs: list[dict[str, typing.Any]] | None = None,
+    ) -> None:
+        await self.journal.write_assistant_transcript(
+            result_dict=result_dict,
+            event=event,
+            run_id=run_id,
+            runner_id=runner_id,
+            artifact_refs=artifact_refs,
+        )

src/langbot/pkg/agent/runner/persistent_state_store.py

@@ -0,0 +1,435 @@
+"""Persistent state store for AgentRunner protocol state.
+
+This module provides a database-backed state store for event-first Protocol v1.
+"""
+from __future__ import annotations
+
+import typing
+import json
+import threading
+from datetime import datetime
+
+import sqlalchemy
+from sqlalchemy.ext.asyncio import AsyncEngine
+from sqlalchemy import select, delete, update
+from sqlalchemy.dialects.postgresql import insert as postgresql_insert
+from sqlalchemy.dialects.sqlite import insert as sqlite_insert
+from sqlalchemy.exc import IntegrityError
+
+from .descriptor import AgentRunnerDescriptor
+from .host_models import AgentEventEnvelope, AgentBinding
+from .state_scope import (
+    VALID_STATE_SCOPES,
+    build_state_scope_key,
+    get_binding_identity,
+    normalize_state_key,
+)
+from ...entity.persistence.agent_runner_state import AgentRunnerState
+
+
+# Maximum value_json size (256KB)
+MAX_VALUE_JSON_BYTES = 256 * 1024
+
+
+class PersistentStateStore:
+    """Database-backed state store for AgentRunner protocol state.
+
+    IMPORTANT: This is HOST-OWNED protocol state, NOT plugin instance state.
+
+    This store provides:
+    1. Persistent storage across runs via database
+    2. Scope isolation by runner_id + binding_identity + scope
+    3. Policy enforcement (enable_state, state_scopes)
+    4. JSON value validation and size limits
+
+    Used by:
+    - Event-first Protocol v1 (async methods)
+    - State API handlers (get/set/delete/list)
+    """
+
+    def __init__(self, db_engine: AsyncEngine):
+        self._db_engine = db_engine
+
+    def _get_scope_key(
+        self,
+        scope: str,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+    ) -> str | None:
+        """Get scope key for given scope."""
+        return build_state_scope_key(scope, event, binding, descriptor)
+
+    def _check_scope_enabled(self, scope: str, binding: AgentBinding) -> bool:
+        """Check if scope is enabled by binding's state_policy."""
+        state_policy = binding.state_policy
+        if not state_policy.enable_state:
+            return False
+        return scope in state_policy.state_scopes
+
+    def _validate_json_value(
+        self,
+        value: typing.Any,
+        logger: typing.Any = None,
+    ) -> tuple[str | None, str | None]:
+        """Validate and serialize value to JSON.
+
+        Returns:
+            Tuple of (json_string, error_message). If error_message is not None,
+            json_string will be None.
+        """
+        try:
+            json_str = json.dumps(value, ensure_ascii=False)
+        except (TypeError, ValueError) as e:
+            return None, f'Value is not JSON-serializable: {e}'
+
+        # Check size limit
+        json_bytes = len(json_str.encode('utf-8'))
+        if json_bytes > MAX_VALUE_JSON_BYTES:
+            return None, f'Value size {json_bytes} bytes exceeds limit {MAX_VALUE_JSON_BYTES} bytes'
+
+        return json_str, None
+
+    async def _upsert_state_row(
+        self,
+        conn: typing.Any,
+        values: dict[str, typing.Any],
+    ) -> None:
+        """Insert or update a state row by the logical scope/key identity."""
+        update_values = {
+            'value_json': values['value_json'],
+            'updated_at': values['updated_at'],
+        }
+        constraint_columns = ['scope_key', 'state_key']
+        dialect_name = self._db_engine.dialect.name
+
+        if dialect_name == 'sqlite':
+            stmt = sqlite_insert(AgentRunnerState).values(**values)
+            await conn.execute(
+                stmt.on_conflict_do_update(
+                    index_elements=constraint_columns,
+                    set_=update_values,
+                )
+            )
+            return
+
+        if dialect_name == 'postgresql':
+            stmt = postgresql_insert(AgentRunnerState).values(**values)
+            await conn.execute(
+                stmt.on_conflict_do_update(
+                    index_elements=constraint_columns,
+                    set_=update_values,
+                )
+            )
+            return
+
+        try:
+            await conn.execute(sqlalchemy.insert(AgentRunnerState).values(**values))
+        except IntegrityError:
+            await conn.execute(
+                update(AgentRunnerState)
+                .where(AgentRunnerState.scope_key == values['scope_key'])
+                .where(AgentRunnerState.state_key == values['state_key'])
+                .values(**update_values)
+            )
+
+    # ========== Async DB Operations ==========
+
+    async def build_snapshot_from_event(
+        self,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+    ) -> dict[str, dict[str, typing.Any]]:
+        """Build state snapshot for all scopes from event and binding.
+
+        Reads from database, respects state_policy.
+        """
+        state_policy = binding.state_policy
+
+        # If state is disabled, return all empty scopes
+        if not state_policy.enable_state:
+            return {
+                'conversation': {},
+                'actor': {},
+                'subject': {},
+                'runner': {},
+            }
+
+        snapshot: dict[str, dict[str, typing.Any]] = {
+            'conversation': {},
+            'actor': {},
+            'subject': {},
+            'runner': {},
+        }
+
+        async with self._db_engine.connect() as conn:
+            for scope in VALID_STATE_SCOPES:
+                if not self._check_scope_enabled(scope, binding):
+                    continue
+
+                scope_key = self._get_scope_key(scope, event, binding, descriptor)
+                if not scope_key:
+                    continue
+
+                # Query all state entries for this scope_key
+                result = await conn.execute(
+                    select(AgentRunnerState.state_key, AgentRunnerState.value_json)
+                    .where(AgentRunnerState.scope_key == scope_key)
+                )
+                rows = result.fetchall()
+
+                for row in rows:
+                    key = row.state_key
+                    value_json = row.value_json
+                    if value_json:
+                        try:
+                            snapshot[scope][key] = json.loads(value_json)
+                        except json.JSONDecodeError:
+                            pass  # Skip invalid JSON
+
+        # Seed external.conversation_id from event.conversation_id if not set
+        if self._check_scope_enabled('conversation', binding) and event.conversation_id:
+            if 'external.conversation_id' not in snapshot['conversation']:
+                snapshot['conversation']['external.conversation_id'] = event.conversation_id
+
+        return snapshot
+
+    async def apply_update_from_event(
+        self,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+        scope: str,
+        key: str,
+        value: typing.Any,
+        logger: typing.Any = None,
+    ) -> tuple[bool, str | None]:
+        """Apply a state update from event context.
+
+        Returns:
+            Tuple of (success, error_message). If success is False, error_message
+            contains the reason.
+        """
+        state_policy = binding.state_policy
+
+        # Check if state is disabled
+        if not state_policy.enable_state:
+            return False, 'State is disabled by binding policy'
+
+        # Validate scope
+        if scope not in VALID_STATE_SCOPES:
+            return False, f'Invalid scope: {scope}'
+
+        # Check if scope is enabled
+        if not self._check_scope_enabled(scope, binding):
+            return False, f'Scope "{scope}" not enabled by binding policy'
+
+        # Map accepted key aliases
+        key = normalize_state_key(key)
+
+        # Get scope key
+        scope_key = self._get_scope_key(scope, event, binding, descriptor)
+        if not scope_key:
+            return False, f'Missing identity for scope "{scope}"'
+
+        # Validate and serialize value
+        value_json, error = self._validate_json_value(value, logger)
+        if error:
+            return False, error
+
+        # Build context fields
+        binding_identity = get_binding_identity(binding)
+
+        now = datetime.utcnow()
+        async with self._db_engine.begin() as conn:
+            await self._upsert_state_row(
+                conn,
+                {
+                    'runner_id': descriptor.id,
+                    'binding_identity': binding_identity,
+                    'scope': scope,
+                    'scope_key': scope_key,
+                    'state_key': key,
+                    'value_json': value_json,
+                    'bot_id': event.bot_id,
+                    'workspace_id': event.workspace_id,
+                    'conversation_id': event.conversation_id,
+                    'thread_id': event.thread_id,
+                    'actor_type': event.actor.actor_type if event.actor else None,
+                    'actor_id': event.actor.actor_id if event.actor else None,
+                    'subject_type': event.subject.subject_type if event.subject else None,
+                    'subject_id': event.subject.subject_id if event.subject else None,
+                    'created_at': now,
+                    'updated_at': now,
+                },
+            )
+
+        return True, None
+
+    async def state_get(
+        self,
+        scope_key: str,
+        state_key: str,
+    ) -> typing.Any:
+        """Get a single state value by scope_key and state_key.
+
+        Used by State API handlers.
+        """
+        state_key = normalize_state_key(state_key)
+
+        async with self._db_engine.connect() as conn:
+            result = await conn.execute(
+                select(AgentRunnerState.value_json)
+                .where(AgentRunnerState.scope_key == scope_key)
+                .where(AgentRunnerState.state_key == state_key)
+            )
+            row = result.first()
+
+            if not row or not row.value_json:
+                return None
+
+            try:
+                return json.loads(row.value_json)
+            except json.JSONDecodeError:
+                return None
+
+    async def state_set(
+        self,
+        scope_key: str,
+        state_key: str,
+        value: typing.Any,
+        runner_id: str,
+        binding_identity: str,
+        scope: str,
+        context: dict[str, typing.Any] | None = None,
+        logger: typing.Any = None,
+    ) -> tuple[bool, str | None]:
+        """Set a state value.
+
+        Used by State API handlers.
+        Context contains optional fields like bot_id, conversation_id, etc.
+        """
+        state_key = normalize_state_key(state_key)
+
+        # Validate and serialize value
+        value_json, error = self._validate_json_value(value, logger)
+        if error:
+            return False, error
+
+        context = context or {}
+
+        now = datetime.utcnow()
+        async with self._db_engine.begin() as conn:
+            await self._upsert_state_row(
+                conn,
+                {
+                    'runner_id': runner_id,
+                    'binding_identity': binding_identity,
+                    'scope': scope,
+                    'scope_key': scope_key,
+                    'state_key': state_key,
+                    'value_json': value_json,
+                    'bot_id': context.get('bot_id'),
+                    'workspace_id': context.get('workspace_id'),
+                    'conversation_id': context.get('conversation_id'),
+                    'thread_id': context.get('thread_id'),
+                    'actor_type': context.get('actor_type'),
+                    'actor_id': context.get('actor_id'),
+                    'subject_type': context.get('subject_type'),
+                    'subject_id': context.get('subject_id'),
+                    'created_at': now,
+                    'updated_at': now,
+                },
+            )
+
+        return True, None
+
+    async def state_delete(
+        self,
+        scope_key: str,
+        state_key: str,
+    ) -> bool:
+        """Delete a state value.
+
+        Returns True if deleted, False if not found.
+        """
+        state_key = normalize_state_key(state_key)
+
+        async with self._db_engine.begin() as conn:
+            result = await conn.execute(
+                delete(AgentRunnerState)
+                .where(AgentRunnerState.scope_key == scope_key)
+                .where(AgentRunnerState.state_key == state_key)
+            )
+            return (result.rowcount or 0) > 0
+
+    async def state_list(
+        self,
+        scope_key: str,
+        prefix: str | None = None,
+        limit: int = 100,
+    ) -> tuple[list[str], bool]:
+        """List state keys in a scope.
+
+        Returns tuple of (keys, has_more).
+        """
+        # Enforce limit cap
+        limit = min(limit, 100)
+
+        async with self._db_engine.connect() as conn:
+            query = (
+                select(AgentRunnerState.state_key)
+                .where(AgentRunnerState.scope_key == scope_key)
+                .order_by(AgentRunnerState.state_key)
+                .limit(limit + 1)  # Fetch one extra to check has_more
+            )
+
+            if prefix:
+                prefix = normalize_state_key(prefix)
+                query = query.where(
+                    AgentRunnerState.state_key.like(f'{prefix}%')
+                )
+
+            result = await conn.execute(query)
+            rows = result.fetchall()
+
+            keys = [row.state_key for row in rows[:limit]]
+            has_more = len(rows) > limit
+
+            return keys, has_more
+
+    async def clear_all(self) -> None:
+        """Clear all state entries (for testing)."""
+        async with self._db_engine.begin() as conn:
+            await conn.execute(delete(AgentRunnerState))
+
+
+# Global singleton persistent state store
+_persistent_state_store: PersistentStateStore | None = None
+_persistent_state_store_lock = threading.Lock()
+
+
+def get_persistent_state_store(db_engine: AsyncEngine | None = None) -> PersistentStateStore:
+    """Get the global persistent state store singleton.
+
+    Args:
+        db_engine: Database engine (required on first call)
+
+    Returns:
+        PersistentStateStore singleton
+    """
+    global _persistent_state_store
+    with _persistent_state_store_lock:
+        if _persistent_state_store is None:
+            if db_engine is None:
+                raise RuntimeError("db_engine required for first call to get_persistent_state_store")
+            _persistent_state_store = PersistentStateStore(db_engine)
+        return _persistent_state_store
+
+
+def reset_persistent_state_store() -> None:
+    """Reset the global persistent state store (for testing)."""
+    global _persistent_state_store
+    with _persistent_state_store_lock:
+        _persistent_state_store = None

src/langbot/pkg/agent/runner/query_bridge.py

@@ -0,0 +1,56 @@
+"""Pipeline Query bridge for AgentRunner execution."""
+
+from __future__ import annotations
+
+import dataclasses
+import typing
+
+from langbot_plugin.api.entities.builtin.pipeline import query as pipeline_query
+
+from .binding_resolver import AgentBindingResolver
+from .config_migration import ConfigMigration
+from .errors import RunnerNotFoundError
+from .host_models import AgentBinding, AgentEventEnvelope
+from .query_entry_adapter import QueryEntryAdapter
+
+
+@dataclasses.dataclass(frozen=True)
+class QueryRunPlan:
+    """Projected event-first execution request for a Query-backed run."""
+
+    event: AgentEventEnvelope
+    binding: AgentBinding
+    bound_plugins: list[str] | None
+    adapter_context: dict[str, typing.Any]
+
+
+class QueryRunBridge:
+    """Project the current Pipeline Query entry point into Protocol v1 inputs."""
+
+    binding_resolver: AgentBindingResolver
+
+    def __init__(self, binding_resolver: AgentBindingResolver):
+        self.binding_resolver = binding_resolver
+
+    def build_plan(self, query: pipeline_query.Query) -> QueryRunPlan:
+        """Build an event-first run plan from a Pipeline Query."""
+        runner_id = ConfigMigration.resolve_runner_id(query.pipeline_config)
+        if not runner_id:
+            raise RunnerNotFoundError('no runner configured')
+
+        event = QueryEntryAdapter.query_to_event(query)
+        agent_config = QueryEntryAdapter.config_to_agent_config(query, runner_id)
+        binding = self.binding_resolver.resolve_one(event, [agent_config])
+        bound_plugins = query.variables.get('_pipeline_bound_plugins')
+        adapter_context = QueryEntryAdapter.build_adapter_context(query, binding)
+
+        return QueryRunPlan(
+            event=event,
+            binding=binding,
+            bound_plugins=bound_plugins,
+            adapter_context=adapter_context,
+        )
+
+    def resolve_runner_id_for_telemetry(self, query: pipeline_query.Query) -> str | None:
+        """Resolve runner ID for telemetry/logging without full execution."""
+        return ConfigMigration.resolve_runner_id(query.pipeline_config)

src/langbot/pkg/agent/runner/query_entry_adapter.py

@@ -0,0 +1,661 @@
+"""Query entry adapter for converting Query to event-first envelope.
+
+This adapter bridges the current Query entry point with the event-first
+Protocol v1 architecture without exposing Query internals to runners.
+"""
+from __future__ import annotations
+
+import hashlib
+import typing
+
+from langbot_plugin.api.entities.builtin.pipeline import query as pipeline_query
+from langbot_plugin.api.entities.builtin.platform import message as platform_message
+from langbot_plugin.api.entities.builtin.agent_runner.event import (
+    AgentEventContext,
+    ConversationContext,
+    ActorContext,
+    SubjectContext,
+    RawEventRef,
+)
+from langbot_plugin.api.entities.builtin.agent_runner.input import AgentInput
+from langbot_plugin.api.entities.builtin.agent_runner.delivery import DeliveryContext
+
+from .host_models import (
+    AgentConfig,
+    AgentEventEnvelope,
+    ResourcePolicy,
+    StatePolicy,
+    DeliveryPolicy,
+)
+from .config_migration import ConfigMigration
+from . import events as runner_events
+
+
+class QueryEntryAdapter:
+    """Adapter for converting Query to event-first envelope.
+
+    This adapter is responsible for:
+    - Converting Query to AgentEventEnvelope
+    - Projecting current Pipeline config to temporary AgentConfig
+    - Putting Query-only fields into adapter context
+    """
+
+    INTERNAL_PREFIX = '_'
+    SENSITIVE_PATTERNS = ('secret', 'token', 'key', 'password', 'credential', 'api_key', 'apikey')
+    PERMISSION_VARS = ('_pipeline_bound_plugins', '_authorized', '_permission')
+    EVENT_DATA_MAX_STRING_BYTES = 512
+
+    @classmethod
+    def query_to_event(
+        cls,
+        query: pipeline_query.Query,
+    ) -> AgentEventEnvelope:
+        """Convert Query to AgentEventEnvelope.
+
+        Args:
+            query: Current entry query
+
+        Returns:
+            AgentEventEnvelope for event-first processing
+        """
+        # Build event context
+        event = cls._build_event_context(query)
+
+        # Build conversation context
+        conversation = cls._build_conversation_context(query)
+
+        # Build actor context
+        actor = cls._build_actor_context(query)
+
+        # Build subject context
+        subject = cls._build_subject_context(query)
+
+        # Build input
+        input = cls._build_input(query)
+
+        # Build delivery context
+        delivery = cls._build_delivery_context(query)
+
+        # Build raw ref
+        raw_ref = cls._build_raw_ref(query)
+
+        return AgentEventEnvelope(
+            event_id=event.event_id or str(query.query_id),
+            event_type=event.event_type or runner_events.MESSAGE_RECEIVED,
+            event_time=event.event_time,
+            source="host_adapter",
+            source_event_type=event.source_event_type,
+            bot_id=query.bot_uuid,
+            workspace_id=None,  # Not available in Query
+            conversation_id=conversation.conversation_id,
+            thread_id=conversation.thread_id,
+            actor=actor,
+            subject=subject,
+            input=input,
+            delivery=delivery,
+            raw_ref=raw_ref,
+            data=event.data,
+        )
+
+    @classmethod
+    def config_to_agent_config(
+        cls,
+        query: pipeline_query.Query,
+        runner_id: str,
+    ) -> AgentConfig:
+        """Project the current Pipeline config container into target Agent config."""
+        pipeline_config = query.pipeline_config or {}
+        runner_config = ConfigMigration.resolve_runner_config(pipeline_config, runner_id)
+        agent_id = getattr(query, 'pipeline_uuid', None)
+
+        # Build resource policy from current config
+        resource_policy = ResourcePolicy(
+            allowed_model_uuids=cls._extract_allowed_models(query),
+            allowed_tool_names=cls._extract_allowed_tools(query),
+            allowed_kb_uuids=cls._extract_allowed_kbs(query),
+            allowed_skill_names=cls._extract_allowed_skills(query),
+        )
+
+        # Build state policy
+        state_policy = StatePolicy(
+            enable_state=True,
+            state_scopes=["conversation", "actor", "subject", "runner"],
+        )
+
+        # Build delivery policy
+        delivery_policy = DeliveryPolicy(
+            enable_streaming=True,
+            enable_reply=True,
+        )
+
+        return AgentConfig(
+            agent_id=agent_id,
+            runner_id=runner_id,
+            runner_config=runner_config,
+            resource_policy=resource_policy,
+            state_policy=state_policy,
+            delivery_policy=delivery_policy,
+            event_types=[runner_events.MESSAGE_RECEIVED],
+            enabled=True,
+            metadata={'source': 'pipeline_adapter'},
+        )
+
+    @classmethod
+    def build_adapter_context(
+        cls,
+        query: pipeline_query.Query,
+        binding: AgentBinding,
+    ) -> dict[str, typing.Any]:
+        """Build Query-derived fields for the current entry adapter."""
+        return {
+            'params': cls.build_params(query),
+            'query_id': getattr(query, 'query_id', None),
+        }
+
+    @classmethod
+    def build_params(cls, query: pipeline_query.Query) -> dict[str, typing.Any]:
+        """Build adapter params from Pipeline variables with host filtering."""
+        params: dict[str, typing.Any] = {}
+        variables = getattr(query, 'variables', None)
+        if not variables:
+            return params
+
+        for key, value in variables.items():
+            if key.startswith(cls.INTERNAL_PREFIX):
+                continue
+            key_lower = key.lower()
+            if any(pattern in key_lower for pattern in cls.SENSITIVE_PATTERNS):
+                continue
+            if any(key == perm_var or key.startswith(perm_var) for perm_var in cls.PERMISSION_VARS):
+                continue
+            if cls.is_json_serializable(value):
+                params[key] = value
+
+        return params
+
+    @classmethod
+    def is_json_serializable(cls, value: typing.Any) -> bool:
+        """Return whether a value can safely cross the adapter boundary as JSON."""
+        if value is None or isinstance(value, (str, int, float, bool)):
+            return True
+        if isinstance(value, (list, tuple)):
+            return all(cls.is_json_serializable(item) for item in value)
+        if isinstance(value, dict):
+            return all(
+                isinstance(k, str) and cls.is_json_serializable(v)
+                for k, v in value.items()
+            )
+        return False
+
+    # Private helper methods
+
+    @classmethod
+    def _build_event_context(
+        cls,
+        query: pipeline_query.Query,
+    ) -> AgentEventContext:
+        """Build AgentEventContext from Query."""
+        message_event = getattr(query, 'message_event', None)
+
+        event_data: dict[str, typing.Any] = {}
+        if message_event and hasattr(message_event, 'model_dump'):
+            try:
+                raw_event_data = message_event.model_dump(mode='json')
+            except TypeError:
+                raw_event_data = message_event.model_dump()
+            except Exception:
+                raw_event_data = {}
+            if isinstance(raw_event_data, dict):
+                event_data = cls._compact_event_data(raw_event_data)
+
+        source_event_type = None
+        if message_event:
+            source_event_type = getattr(message_event, 'type', None)
+
+        message_chain = getattr(query, 'message_chain', None)
+        message_id = getattr(message_chain, 'message_id', None)
+        if message_id == -1:
+            message_id = None
+
+        event_time = None
+        if message_event:
+            event_time = getattr(message_event, 'time', None)
+        if isinstance(event_time, (int, float)):
+            event_time = int(event_time)
+
+        source_event_id = str(message_id or query.query_id)
+        return AgentEventContext(
+            event_id=cls._build_scoped_event_id(query, source_event_id, event_time),
+            event_type=runner_events.MESSAGE_RECEIVED,
+            event_time=event_time,
+            source="host_adapter",
+            source_event_type=source_event_type,
+            data=event_data,
+        )
+
+    @classmethod
+    def _compact_event_data(
+        cls,
+        event_data: dict[str, typing.Any],
+    ) -> dict[str, typing.Any]:
+        """Keep only small scalar source-event metadata in event.data."""
+        compact: dict[str, typing.Any] = {}
+        for key, value in event_data.items():
+            if key == 'source_platform_object' or key.startswith('_'):
+                continue
+            if value is None or isinstance(value, (bool, int, float)):
+                compact[key] = value
+                continue
+            if isinstance(value, str):
+                if len(value.encode('utf-8')) <= cls.EVENT_DATA_MAX_STRING_BYTES:
+                    compact[key] = value
+                continue
+        return compact
+
+    @classmethod
+    def _build_scoped_event_id(
+        cls,
+        query: pipeline_query.Query,
+        source_event_id: str,
+        event_time: int | None,
+    ) -> str:
+        """Build a globally unique host event id from pipeline-local ids."""
+        launcher_type = getattr(query, 'launcher_type', None)
+        launcher_type_value = getattr(launcher_type, 'value', launcher_type) if launcher_type is not None else None
+        scope_parts = [
+            'host_adapter',
+            getattr(query, 'pipeline_uuid', None),
+            getattr(query, 'bot_uuid', None),
+            launcher_type_value,
+            getattr(query, 'launcher_id', None),
+            getattr(query, 'sender_id', None),
+            source_event_id,
+            event_time,
+        ]
+        scoped = '|'.join('' if part is None else str(part) for part in scope_parts)
+        digest = hashlib.sha256(scoped.encode('utf-8')).hexdigest()[:32]
+        return f'host:{digest}'
+
+    @classmethod
+    def _build_conversation_context(
+        cls,
+        query: pipeline_query.Query,
+    ) -> ConversationContext:
+        """Build ConversationContext from Query."""
+        # Handle launcher_type safely
+        launcher_type = getattr(query, 'launcher_type', None)
+        launcher_type_value = None
+        if launcher_type is not None:
+            launcher_type_value = getattr(launcher_type, 'value', launcher_type)
+
+        # Handle launcher_id
+        launcher_id = getattr(query, 'launcher_id', None)
+
+        # Build session_id from launcher info if available
+        session_id = None
+        if launcher_type_value and launcher_id:
+            session_id = f'{launcher_type_value}_{launcher_id}'
+
+        # Handle session and conversation_id
+        conversation_id = None
+        session = getattr(query, 'session', None)
+        if session:
+            conversation = getattr(session, 'using_conversation', None)
+            if conversation:
+                conversation_id = getattr(conversation, 'uuid', None)
+
+        if not conversation_id:
+            variables = getattr(query, 'variables', None) or {}
+            conversation_id = variables.get('conversation_id') or None
+
+        if not conversation_id:
+            conversation_id = session_id
+
+        # Handle sender_id
+        sender_id = getattr(query, 'sender_id', None)
+        if sender_id is not None:
+            sender_id = str(sender_id)
+
+        # Handle bot_uuid
+        bot_uuid = getattr(query, 'bot_uuid', None)
+
+        return ConversationContext(
+            conversation_id=str(conversation_id) if conversation_id is not None else None,
+            thread_id=None,
+            launcher_type=launcher_type_value,
+            launcher_id=launcher_id,
+            sender_id=sender_id,
+            bot_id=bot_uuid,
+            workspace_id=None,
+            session_id=session_id,
+        )
+
+    @classmethod
+    def _build_actor_context(
+        cls,
+        query: pipeline_query.Query,
+    ) -> ActorContext:
+        """Build ActorContext from Query."""
+        message_event = getattr(query, 'message_event', None)
+        sender = getattr(message_event, 'sender', None) if message_event else None
+        sender_id = getattr(query, 'sender_id', None)
+        actor_id = getattr(sender, 'id', None) if sender else None
+        if actor_id is None:
+            actor_id = sender_id
+        actor_name = sender.get_name() if sender and hasattr(sender, 'get_name') else None
+
+        return ActorContext(
+            actor_type="user",
+            actor_id=str(actor_id) if actor_id is not None else None,
+            actor_name=actor_name,
+            metadata={},
+        )
+
+    @classmethod
+    def _build_subject_context(
+        cls,
+        query: pipeline_query.Query,
+    ) -> SubjectContext:
+        """Build SubjectContext from Query."""
+        message_chain = getattr(query, 'message_chain', None)
+        message_id = getattr(message_chain, 'message_id', None) if message_chain else None
+        if message_id == -1:
+            message_id = None
+
+        query_id = getattr(query, 'query_id', None)
+
+        # Safely get launcher_type
+        launcher_type = getattr(query, 'launcher_type', None)
+        launcher_type_value = None
+        if launcher_type is not None:
+            launcher_type_value = getattr(launcher_type, 'value', launcher_type)
+
+        return SubjectContext(
+            subject_type="message",
+            subject_id=str(message_id or query_id or ''),
+            data={
+                "launcher_type": launcher_type_value,
+                "launcher_id": getattr(query, 'launcher_id', None),
+                "sender_id": str(getattr(query, 'sender_id', '')) if getattr(query, 'sender_id', None) else None,
+                "bot_uuid": getattr(query, 'bot_uuid', None),
+            },
+        )
+
+    @classmethod
+    def _build_input(
+        cls,
+        query: pipeline_query.Query,
+    ) -> AgentInput:
+        """Build AgentInput from Query."""
+        text = None
+        text_parts: list[str] = []
+        contents: list[dict[str, typing.Any]] = []
+
+        user_message = getattr(query, 'user_message', None)
+        if user_message:
+            content = getattr(user_message, 'content', None)
+            if isinstance(content, list):
+                for elem in content:
+                    elem_dict = None
+                    if hasattr(elem, 'model_dump'):
+                        elem_dict = elem.model_dump(mode='json')
+                    elif isinstance(elem, dict):
+                        elem_dict = elem
+
+                    if not isinstance(elem_dict, dict):
+                        continue
+
+                    contents.append(elem_dict)
+                    if elem_dict.get('type') == 'text':
+                        elem_text = elem_dict.get('text')
+                        if elem_text:
+                            text_parts.append(elem_text)
+            elif content is not None:
+                text = str(content)
+                contents.append({'type': 'text', 'text': text})
+
+        if not contents:
+            message_chain = getattr(query, 'message_chain', None) or []
+            for component in message_chain:
+                if isinstance(component, platform_message.Plain):
+                    component_text = getattr(component, 'text', '')
+                    if component_text:
+                        text_parts.append(component_text)
+                        contents.append({'type': 'text', 'text': component_text})
+                elif isinstance(component, platform_message.Image):
+                    image_base64 = getattr(component, 'base64', None)
+                    image_url = getattr(component, 'url', None)
+                    if image_base64:
+                        contents.append({'type': 'image_base64', 'image_base64': image_base64})
+                    elif image_url:
+                        contents.append({'type': 'image_url', 'image_url': {'url': image_url}})
+
+        if text_parts:
+            text = ''.join(text_parts)
+
+        attachments = cls._build_attachments(query, contents)
+
+        return AgentInput(
+            text=text,
+            contents=contents,
+            attachments=attachments,
+        )
+
+    @classmethod
+    def _build_attachments(
+        cls,
+        query: pipeline_query.Query,
+        contents: list[dict[str, typing.Any]],
+    ) -> list[dict[str, typing.Any]]:
+        """Extract attachments from query."""
+        import uuid
+
+        attachments: list[dict[str, typing.Any]] = []
+        seen_keys: dict[tuple[str, str, str], set[str]] = {}
+
+        def add_attachment(attachment: dict[str, typing.Any]) -> None:
+            key = cls._attachment_dedupe_key(attachment)
+            if key is not None:
+                source = str(attachment.get('source') or '')
+                sources = seen_keys.setdefault(key, set())
+                if source and sources and source not in sources:
+                    return
+                if source:
+                    sources.add(source)
+            attachments.append(attachment)
+
+        for elem in contents:
+            elem_type = elem.get('type')
+            artifact_id = str(uuid.uuid4())  # Generate unique ID
+
+            if elem_type == 'image_url':
+                image_url = elem.get('image_url') or {}
+                add_attachment({
+                    'artifact_id': artifact_id,
+                    'artifact_type': 'image',
+                    'source': 'url',
+                    'url': image_url.get('url') if isinstance(image_url, dict) else str(image_url),
+                })
+            elif elem_type == 'image_base64':
+                add_attachment({
+                    'artifact_id': artifact_id,
+                    'artifact_type': 'image',
+                    'source': 'base64',
+                    'content': elem.get('image_base64'),
+                })
+            elif elem_type == 'file_url':
+                add_attachment({
+                    'artifact_id': artifact_id,
+                    'artifact_type': 'file',
+                    'source': 'url',
+                    'url': elem.get('file_url'),
+                    'name': elem.get('file_name'),
+                })
+            elif elem_type == 'file_base64':
+                add_attachment({
+                    'artifact_id': artifact_id,
+                    'artifact_type': 'file',
+                    'source': 'base64',
+                    'content': elem.get('file_base64'),
+                    'name': elem.get('file_name'),
+                })
+
+        message_chain = getattr(query, 'message_chain', None)
+        if message_chain:
+            try:
+                message_components = iter(message_chain)
+            except TypeError:
+                message_components = iter(())
+
+            for component in message_components:
+                artifact_id = str(uuid.uuid4())  # Generate unique ID
+
+                if isinstance(component, platform_message.Image):
+                    image_id = component.image_id or None
+                    image_url = component.url or None
+                    image_base64 = component.base64 or None
+                    add_attachment({
+                        'artifact_id': artifact_id,
+                        'artifact_type': 'image',
+                        'source': 'message_chain',
+                        'id': image_id,
+                        'url': image_url,
+                        'content': image_base64,
+                    })
+                elif isinstance(component, platform_message.File):
+                    add_attachment({
+                        'artifact_id': artifact_id,
+                        'artifact_type': 'file',
+                        'source': 'message_chain',
+                        'id': component.id or None,
+                        'name': component.name or None,
+                        'url': component.url or None,
+                        'content': component.base64 or None,
+                    })
+                elif isinstance(component, platform_message.Voice):
+                    add_attachment({
+                        'artifact_id': artifact_id,
+                        'artifact_type': 'voice',
+                        'source': 'message_chain',
+                        'id': component.voice_id or None,
+                        'url': component.url or None,
+                        'content': component.base64 or None,
+                    })
+
+        return attachments
+
+    @classmethod
+    def _attachment_dedupe_key(
+        cls,
+        attachment: dict[str, typing.Any],
+    ) -> tuple[str, str, str] | None:
+        """Return a stable key for the same attachment across content sources."""
+        artifact_type = attachment.get('artifact_type')
+        if not artifact_type:
+            return None
+        for field in ('id', 'url', 'content'):
+            value = attachment.get(field)
+            if value:
+                if field == 'content':
+                    value = hashlib.sha256(str(value).encode('utf-8')).hexdigest()
+                return str(artifact_type), field, str(value)
+        return None
+
+    @classmethod
+    def _build_delivery_context(
+        cls,
+        query: pipeline_query.Query,
+    ) -> DeliveryContext:
+        """Build DeliveryContext from Query."""
+        message_chain = getattr(query, 'message_chain', None)
+        return DeliveryContext(
+            surface="platform",
+            reply_target={
+                "message_id": getattr(message_chain, 'message_id', None),
+            },
+            supports_streaming=True,
+            supports_edit=False,
+            supports_reaction=False,
+            platform_capabilities={},
+        )
+
+    @classmethod
+    def _build_raw_ref(
+        cls,
+        query: pipeline_query.Query,
+    ) -> RawEventRef | None:
+        """Build RawEventRef from Query."""
+        # For now, we don't store raw event payload
+        return None
+
+    @classmethod
+    def _extract_allowed_models(
+        cls,
+        query: pipeline_query.Query,
+    ) -> list[str] | None:
+        """Extract allowed model UUIDs from query."""
+        model_uuids: list[str] = []
+        model_uuid = getattr(query, 'use_llm_model_uuid', None)
+        if model_uuid:
+            model_uuids.append(model_uuid)
+
+        variables = getattr(query, 'variables', None) or {}
+        for fallback_uuid in variables.get('_fallback_model_uuids', []) or []:
+            if fallback_uuid and fallback_uuid not in model_uuids:
+                model_uuids.append(fallback_uuid)
+
+        return model_uuids or None
+
+    @classmethod
+    def _extract_allowed_tools(
+        cls,
+        query: pipeline_query.Query,
+    ) -> list[str] | None:
+        """Extract allowed tool names from query."""
+        use_funcs = getattr(query, 'use_funcs', None)
+        if not use_funcs:
+            return None
+        try:
+            tool_names = []
+            for func in use_funcs:
+                if isinstance(func, dict):
+                    name = func.get('name')
+                elif hasattr(func, 'name'):
+                    name = func.name
+                else:
+                    continue
+                if name:
+                    tool_names.append(name)
+            return tool_names if tool_names else None
+        except (TypeError, AttributeError):
+            return None
+
+    @classmethod
+    def _extract_allowed_kbs(
+        cls,
+        query: pipeline_query.Query,
+    ) -> list[str] | None:
+        """Extract allowed knowledge base UUIDs from query."""
+        variables = getattr(query, 'variables', None)
+        if not variables:
+            return None
+        kb_uuids = variables.get('_knowledge_base_uuids')
+        if kb_uuids:
+            return kb_uuids
+        return None
+
+    @classmethod
+    def _extract_allowed_skills(
+        cls,
+        query: pipeline_query.Query,
+    ) -> list[str] | None:
+        """Extract pipeline-visible skill names from query."""
+        variables = getattr(query, 'variables', None)
+        if not variables or '_pipeline_bound_skills' not in variables:
+            return None
+        bound_skills = variables.get('_pipeline_bound_skills')
+        if bound_skills is None:
+            return None
+        if not isinstance(bound_skills, list):
+            return []
+        return [str(skill_name) for skill_name in bound_skills if skill_name]

src/langbot/pkg/agent/runner/registry.py

@@ -0,0 +1,348 @@
+"""Agent runner registry for discovering and caching runner descriptors."""
+
+from __future__ import annotations
+
+import typing
+import asyncio
+
+import pydantic
+from langbot_plugin.api.entities.builtin.agent_runner.manifest import (
+    AgentRunnerManifest,
+)
+
+from ...core import app
+from .descriptor import AgentRunnerDescriptor
+from .id import parse_runner_id, format_runner_id
+from .errors import RunnerNotFoundError, RunnerNotAuthorizedError
+
+
+class AgentRunnerRegistry:
+    """Registry for discovering and managing agent runners.
+
+    Responsibilities:
+    - Discover runners from plugin runtime via LIST_AGENT_RUNNERS
+    - Validate runner manifests (kind, metadata, spec)
+    - Cache discovered runners for performance
+    - Filter runners by bound plugins
+    - Handle manifest errors gracefully (log warning, skip runner)
+    """
+
+    ap: app.Application
+
+    _cache: dict[str, AgentRunnerDescriptor] | None
+    """Cached runner descriptors keyed by runner ID"""
+
+    _cache_lock: asyncio.Lock
+    """Lock for cache refresh operations"""
+
+    def __init__(self, ap: app.Application):
+        self.ap = ap
+        self._cache = None
+        self._cache_lock = asyncio.Lock()
+
+    async def _discover_runners(self) -> dict[str, AgentRunnerDescriptor]:
+        """Discover runners from plugin runtime.
+
+        Always discovers ALL runners (no bound_plugins filter).
+        The cache should contain unfiltered discovery results.
+
+        Returns:
+            Dict of runner descriptors keyed by runner ID
+        """
+        if not self.ap.plugin_connector.is_enable_plugin:
+            return {}
+
+        runners: dict[str, AgentRunnerDescriptor] = {}
+
+        try:
+            # Always list all runners (bound_plugins=None)
+            plugin_runners = await self.ap.plugin_connector.list_agent_runners(None)
+
+            for runner_data in plugin_runners:
+                try:
+                    descriptor = self._validate_and_build_descriptor(runner_data)
+                    if descriptor is not None:
+                        runners[descriptor.id] = descriptor
+                except Exception as e:
+                    plugin_author = runner_data.get('plugin_author', 'unknown')
+                    plugin_name = runner_data.get('plugin_name', 'unknown')
+                    runner_name = runner_data.get('runner_name', 'unknown')
+                    self.ap.logger.warning(
+                        f'Invalid runner manifest for plugin:{plugin_author}/{plugin_name}/{runner_name}: {e}'
+                    )
+                    continue
+
+        except Exception as e:
+            self.ap.logger.warning(f'Failed to list agent runners from plugin runtime: {e}')
+            return {}
+
+        return runners
+
+    def _validate_and_build_descriptor(self, runner_data: dict[str, typing.Any]) -> AgentRunnerDescriptor | None:
+        """Validate runner manifest and build descriptor.
+
+        Args:
+            runner_data: Raw runner data from plugin runtime with fields:
+                - plugin_author, plugin_name, runner_name
+                - manifest (typed AgentRunnerManifest or legacy component manifest)
+                - capabilities, permissions, config (extracted from spec)
+
+        Returns:
+            AgentRunnerDescriptor if valid, None if invalid
+        """
+        plugin_author = runner_data.get('plugin_author', '')
+        plugin_name = runner_data.get('plugin_name', '')
+        runner_name = runner_data.get('runner_name', '')
+
+        if not plugin_author or not plugin_name or not runner_name:
+            return None
+
+        manifest = runner_data.get('manifest', {})
+        runner_id = format_runner_id(
+            source='plugin',
+            plugin_author=plugin_author,
+            plugin_name=plugin_name,
+            runner_name=runner_name,
+        )
+
+        is_typed_manifest = self._looks_like_typed_manifest(manifest)
+        if is_typed_manifest:
+            typed_manifest = AgentRunnerManifest.model_validate(manifest)
+        else:
+            typed_manifest = self._build_typed_manifest_from_legacy_data(
+                runner_id=runner_id,
+                runner_name=runner_name,
+                runner_data=runner_data,
+                manifest=manifest,
+            )
+
+        if runner_data.get('config'):
+            config_schema = runner_data['config']
+        elif not is_typed_manifest and isinstance(manifest.get('spec'), dict):
+            config_schema = manifest['spec'].get('config', [])
+        else:
+            config_schema = [
+                item.model_dump(mode='json') for item in typed_manifest.config_schema
+            ]
+
+        return AgentRunnerDescriptor(
+            id=runner_id,
+            source='plugin',
+            label=typed_manifest.label,
+            description=typed_manifest.description or runner_data.get('runner_description'),
+            plugin_author=plugin_author,
+            plugin_name=plugin_name,
+            runner_name=runner_name,
+            plugin_version=runner_data.get('plugin_version'),
+            config_schema=config_schema,
+            capabilities=typed_manifest.capabilities,
+            permissions=typed_manifest.permissions,
+            raw_manifest=manifest,
+        )
+
+    def _looks_like_typed_manifest(self, manifest: dict[str, typing.Any]) -> bool:
+        """Return whether manifest is the SDK typed AgentRunnerManifest shape."""
+        return (
+            isinstance(manifest, dict)
+            and 'id' in manifest
+            and 'name' in manifest
+            and 'label' in manifest
+        )
+
+    def _build_typed_manifest_from_legacy_data(
+        self,
+        *,
+        runner_id: str,
+        runner_name: str,
+        runner_data: dict[str, typing.Any],
+        manifest: dict[str, typing.Any],
+    ) -> AgentRunnerManifest:
+        """Validate legacy raw component manifest data as typed runner manifest."""
+
+        # Validate kind
+        kind = manifest.get('kind', '')
+        if kind != 'AgentRunner':
+            raise ValueError(f'Invalid AgentRunner kind: {kind or "<missing>"}')
+
+        # Validate metadata
+        metadata = manifest.get('metadata', {})
+        name = metadata.get('name', '')
+        if not name:
+            raise ValueError('Missing AgentRunner metadata.name')
+
+        # metadata.label must exist
+        label = metadata.get('label', {})
+        if not label:
+            label = {name: name}  # fallback
+
+        spec = manifest.get('spec', {})
+
+        # SDK now provides these directly extracted from spec. Fall back to
+        # manifest.spec for older runtimes/tests that return the raw manifest.
+        config_schema = runner_data.get('config') or spec.get('config', [])
+        capabilities = runner_data.get('capabilities') or spec.get('capabilities', {})
+        permissions = runner_data.get('permissions') or spec.get('permissions', {})
+
+        try:
+            return AgentRunnerManifest(
+                id=runner_id,
+                name=runner_name,
+                label=label,
+                description=metadata.get('description') or runner_data.get('runner_description'),
+                capabilities=capabilities,
+                permissions=permissions,
+                config_schema=config_schema,
+            )
+        except pydantic.ValidationError:
+            raise
+        except Exception as exc:
+            raise ValueError(f'Invalid AgentRunner manifest: {exc}') from exc
+
+    async def refresh(self) -> None:
+        """Refresh runner cache.
+
+        Always discovers ALL runners (no bound_plugins filter).
+        The cache contains unfiltered discovery results.
+        """
+        async with self._cache_lock:
+            self._cache = await self._discover_runners()
+
+    async def list_runners(
+        self,
+        bound_plugins: list[str] | None = None,
+        use_cache: bool = True,
+    ) -> list[AgentRunnerDescriptor]:
+        """List available runners.
+
+        Args:
+            bound_plugins: Optional filter for bound plugins (applied locally)
+            use_cache: Use cached data if available
+
+        Returns:
+            List of runner descriptors
+        """
+        if use_cache and self._cache is not None:
+            # Filter from cache
+            return self._filter_runners_by_bound_plugins(self._cache, bound_plugins)
+
+        # Discover fresh (always full list)
+        runners = await self._discover_runners()
+
+        # Update cache (full list, unfiltered)
+        async with self._cache_lock:
+            self._cache = runners
+
+        # Filter locally
+        return self._filter_runners_by_bound_plugins(runners, bound_plugins)
+
+    def _filter_runners_by_bound_plugins(
+        self,
+        runners: dict[str, AgentRunnerDescriptor],
+        bound_plugins: list[str] | None,
+    ) -> list[AgentRunnerDescriptor]:
+        """Filter runners by bound plugins.
+
+        Args:
+            runners: Dict of runner descriptors
+            bound_plugins: Optional filter (None means all plugins allowed)
+
+        Returns:
+            Filtered list of runner descriptors
+        """
+        if bound_plugins is None:
+            # All plugins allowed
+            return list(runners.values())
+
+        allowed_plugin_ids = set(bound_plugins)
+        filtered = []
+        for descriptor in runners.values():
+            plugin_id = descriptor.get_plugin_id()
+            if plugin_id in allowed_plugin_ids:
+                filtered.append(descriptor)
+
+        return filtered
+
+    async def get(
+        self,
+        runner_id: str,
+        bound_plugins: list[str] | None = None,
+    ) -> AgentRunnerDescriptor:
+        """Get a specific runner descriptor.
+
+        Args:
+            runner_id: Runner ID to lookup
+            bound_plugins: Optional bound plugins filter
+
+        Returns:
+            AgentRunnerDescriptor
+
+        Raises:
+            RunnerNotFoundError: If runner not found
+            RunnerNotAuthorizedError: If runner not in bound plugins
+        """
+        # Parse and validate runner ID format
+        try:
+            parse_runner_id(runner_id)
+        except ValueError as e:
+            raise RunnerNotFoundError(runner_id) from e
+
+        # Get from cache or discover (always full list)
+        if self._cache is None:
+            await self.refresh()
+
+        if self._cache is None:
+            raise RunnerNotFoundError(runner_id)
+
+        descriptor = self._cache.get(runner_id)
+        if descriptor is None:
+            raise RunnerNotFoundError(runner_id)
+
+        # Check authorization
+        if bound_plugins is not None:
+            plugin_id = descriptor.get_plugin_id()
+            if plugin_id not in bound_plugins:
+                raise RunnerNotAuthorizedError(runner_id, bound_plugins)
+
+        return descriptor
+
+    async def get_runner_metadata_for_pipeline(self) -> list[dict[str, typing.Any]]:
+        """Get runner metadata for pipeline configuration UI.
+
+        Returns runner options and their config schemas for the DynamicForm.
+        """
+        # Get all runners (no bound plugin filter for metadata listing)
+        runners = await self.list_runners(bound_plugins=None)
+
+        options = []
+        stages = []
+
+        for descriptor in runners:
+            config_schema = []
+            for index, config_item in enumerate(descriptor.config_schema):
+                item = dict(config_item)
+                if not item.get('id'):
+                    item_name = item.get('name') or str(index)
+                    item['id'] = f'{descriptor.id}.{item_name}'
+                config_schema.append(item)
+
+            # Add runner option
+            options.append(
+                {
+                    'name': descriptor.id,
+                    'label': descriptor.label,
+                    'description': descriptor.description,
+                }
+            )
+
+            # Add config schema as stage if not empty
+            if descriptor.config_schema:
+                stages.append(
+                    {
+                        'name': descriptor.id,
+                        'label': descriptor.label,
+                        'description': descriptor.description,
+                        'config': config_schema,
+                    }
+                )
+
+        return options, stages

src/langbot/pkg/agent/runner/resource_builder.py

@@ -0,0 +1,331 @@
+"""Agent resource builder for constructing authorized resources."""
+from __future__ import annotations
+
+import typing
+
+from ...core import app
+from .descriptor import AgentRunnerDescriptor
+from .context_builder import (
+    AgentResources,
+    ModelResource,
+    ToolResource,
+    KnowledgeBaseResource,
+    SkillResource,
+    FileResource,
+    StorageResource,
+)
+from . import config_schema
+from .host_models import AgentEventEnvelope, AgentBinding
+
+
+class AgentResourceBuilder:
+    """Builder for constructing run-scoped AgentResources with permission filtering.
+
+    Responsibilities:
+    - Apply manifest permissions intersected with binding resource policy
+    - Build models list from authorized models
+    - Build tools list from bound plugins/MCP servers
+    - Build knowledge_bases list from config
+    - Build storage and files access summary
+
+    Note: This only builds the resource declaration. The actual proxy actions
+    in handler.py must still validate against ctx.resources at runtime.
+
+    Resource field names match the plugin SDK payload:
+    - ModelResource: model_id, model_type, provider
+    - ToolResource: tool_name, tool_type, description
+    - KnowledgeBaseResource: kb_id, kb_name, kb_type
+    - SkillResource: skill_name, display_name, description
+    - StorageResource: plugin_storage, workspace_storage
+    """
+
+    ap: app.Application
+
+    def __init__(self, ap: app.Application):
+        self.ap = ap
+
+    async def build_resources_from_binding(
+        self,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+    ) -> AgentResources:
+        """Build AgentResources from event and binding.
+
+        This is the main entry point for Protocol v1.
+
+        Args:
+            event: Event envelope
+            binding: Agent binding with resource policy
+            descriptor: Runner descriptor with capabilities, permissions, and config schema
+
+        Returns:
+            AgentResources dict with filtered resource lists
+        """
+        resource_policy = binding.resource_policy
+        runner_config = binding.runner_config
+        manifest_perms = descriptor.permissions
+
+        # Build each resource category
+        models = await self._build_models_from_binding(
+            manifest_perms, resource_policy, descriptor, runner_config
+        )
+        tools = await self._build_tools_from_binding(
+            manifest_perms, resource_policy, descriptor
+        )
+        knowledge_bases = await self._build_knowledge_bases_from_binding(
+            manifest_perms, resource_policy, descriptor, runner_config
+        )
+        skills = self._build_skills_from_binding(
+            resource_policy, descriptor
+        )
+        storage = self._build_storage_from_binding(manifest_perms, binding)
+        files = self._build_files_from_binding(manifest_perms, descriptor, runner_config)
+
+        return {
+            'models': models,
+            'tools': tools,
+            'knowledge_bases': knowledge_bases,
+            'skills': skills,
+            'files': files,
+            'storage': storage,
+            'platform_capabilities': {},  # Reserved for EBA
+        }
+
+    async def _build_models_from_binding(
+        self,
+        manifest_perms: typing.Any,
+        resource_policy: typing.Any,
+        descriptor: AgentRunnerDescriptor,
+        runner_config: dict[str, typing.Any],
+    ) -> list[ModelResource]:
+        """Build models list from binding."""
+        models: list[ModelResource] = []
+        seen_model_ids: set[str] = set()
+
+        model_perms = set(manifest_perms.models)
+        include_llm = bool({'invoke', 'stream'} & model_perms)
+        include_rerank = 'rerank' in model_perms
+        llm_operations = [operation for operation in ('invoke', 'stream') if operation in model_perms]
+        if not include_llm and not include_rerank:
+            return models
+
+        # Get additional model UUID grants from resource policy.
+        allowed_uuids = resource_policy.allowed_model_uuids
+
+        # Add model resources from Agent/runner config schema
+        await self._append_config_declared_model_resources(
+            models=models,
+            seen_model_ids=seen_model_ids,
+            descriptor=descriptor,
+            runner_config=runner_config,
+            include_llm=include_llm,
+            include_rerank=include_rerank,
+            llm_operations=llm_operations,
+        )
+
+        # Add explicitly allowed models
+        if allowed_uuids and include_llm:
+            for model_uuid in allowed_uuids:
+                await self._append_llm_model_resource(models, seen_model_ids, model_uuid, llm_operations)
+
+        return models
+
+    async def _build_tools_from_binding(
+        self,
+        manifest_perms: typing.Any,
+        resource_policy: typing.Any,
+        descriptor: AgentRunnerDescriptor,
+    ) -> list[ToolResource]:
+        """Build tools list from binding."""
+        tools: list[ToolResource] = []
+        tool_perms = set(manifest_perms.tools)
+        if not ({'detail', 'call'} & tool_perms):
+            return tools
+
+        if not config_schema.uses_host_tools(descriptor):
+            return tools
+
+        # Get tool names from resource policy
+        allowed_names = resource_policy.allowed_tool_names
+        tool_operations = [operation for operation in ('detail', 'call') if operation in tool_perms]
+
+        if allowed_names:
+            for tool_name in allowed_names:
+                tools.append({
+                    'tool_name': tool_name,
+                    'tool_type': None,
+                    'description': None,
+                    'operations': tool_operations,
+                })
+
+        return tools
+
+    async def _build_knowledge_bases_from_binding(
+        self,
+        manifest_perms: typing.Any,
+        resource_policy: typing.Any,
+        descriptor: AgentRunnerDescriptor,
+        runner_config: dict[str, typing.Any],
+    ) -> list[KnowledgeBaseResource]:
+        """Build knowledge bases list from binding."""
+        kb_resources: list[KnowledgeBaseResource] = []
+        kb_perms = set(manifest_perms.knowledge_bases)
+        if not ({'list', 'retrieve'} & kb_perms):
+            return kb_resources
+        kb_operations = [operation for operation in ('list', 'retrieve') if operation in kb_perms]
+
+        if not config_schema.uses_host_knowledge_bases(descriptor):
+            return kb_resources
+
+        # Get KB UUID grants from schema-defined config fields.
+        kb_uuids = config_schema.extract_knowledge_base_uuids(descriptor, runner_config)
+
+        # Also include resource policy grants.
+        allowed_uuids = resource_policy.allowed_kb_uuids
+        if allowed_uuids:
+            kb_uuids = list(dict.fromkeys([*kb_uuids, *allowed_uuids]))
+
+        for kb_uuid in kb_uuids:
+            try:
+                kb = await self.ap.rag_mgr.get_knowledge_base_by_uuid(kb_uuid)
+                if kb:
+                    kb_resources.append({
+                        'kb_id': kb_uuid,
+                        'kb_name': kb.get_name(),
+                        'kb_type': kb.knowledge_base_entity.kb_type if hasattr(kb.knowledge_base_entity, 'kb_type') else None,
+                        'operations': kb_operations,
+                    })
+            except Exception as e:
+                self.ap.logger.warning(f'Failed to build knowledge base resource {kb_uuid}: {e}')
+
+        return kb_resources
+
+    def _build_skills_from_binding(
+        self,
+        resource_policy: typing.Any,
+        descriptor: AgentRunnerDescriptor,
+    ) -> list[SkillResource]:
+        """Build pipeline-visible skill resource facts."""
+        if not config_schema.supports_skill_authoring(descriptor):
+            return []
+
+        skill_mgr = getattr(self.ap, 'skill_mgr', None)
+        if skill_mgr is None:
+            return []
+
+        loaded_skills = getattr(skill_mgr, 'skills', {}) or {}
+        allowed_names = resource_policy.allowed_skill_names
+        if allowed_names is None:
+            names = sorted(loaded_skills.keys())
+        else:
+            names = sorted(name for name in allowed_names if name in loaded_skills)
+
+        skills: list[SkillResource] = []
+        for skill_name in names:
+            skill_data = loaded_skills.get(skill_name) or {}
+            skills.append({
+                'skill_name': skill_name,
+                'display_name': skill_data.get('display_name') or skill_data.get('name') or skill_name,
+                'description': skill_data.get('description') or None,
+            })
+        return skills
+
+    def _build_files_from_binding(
+        self,
+        manifest_perms: typing.Any,
+        descriptor: AgentRunnerDescriptor,
+        runner_config: dict[str, typing.Any],
+    ) -> list[FileResource]:
+        """Build config/knowledge file resources selected in runner config."""
+        file_perms = set(manifest_perms.files)
+        operations = [operation for operation in ('config', 'knowledge') if operation in file_perms]
+        if not operations:
+            return []
+
+        files: list[FileResource] = []
+        if 'config' in file_perms:
+            for file_resource in config_schema.extract_config_file_resources(descriptor, runner_config):
+                files.append({
+                    **file_resource,
+                    'operations': ['config'],
+                })
+        return files
+
+    def _build_storage_from_binding(
+        self,
+        manifest_perms: typing.Any,
+        binding: AgentBinding,
+    ) -> StorageResource:
+        """Build storage access summary from manifest and binding policy."""
+        resource_policy = binding.resource_policy
+        storage_perms = set(manifest_perms.storage)
+
+        return {
+            'plugin_storage': 'plugin' in storage_perms and resource_policy.allow_plugin_storage,
+            'workspace_storage': 'workspace' in storage_perms and resource_policy.allow_workspace_storage,
+        }
+
+    async def _append_config_declared_model_resources(
+        self,
+        models: list[ModelResource],
+        seen_model_ids: set[str],
+        descriptor: AgentRunnerDescriptor,
+        runner_config: dict[str, typing.Any],
+        include_llm: bool,
+        include_rerank: bool,
+        llm_operations: list[str],
+    ) -> None:
+        """Authorize model-like values selected through DynamicForm fields."""
+        for model_type, model_uuid in config_schema.iter_config_model_refs(descriptor, runner_config):
+            if model_type == 'llm' and include_llm:
+                await self._append_llm_model_resource(models, seen_model_ids, model_uuid, llm_operations)
+            elif model_type == 'rerank' and include_rerank:
+                await self._append_rerank_model_resource(models, seen_model_ids, model_uuid)
+
+    async def _append_llm_model_resource(
+        self,
+        models: list[ModelResource],
+        seen_model_ids: set[str],
+        model_uuid: str | None,
+        operations: list[str],
+    ) -> None:
+        """Append an LLM model resource if it exists and has not been added."""
+        if not model_uuid or model_uuid == '__none__' or model_uuid in seen_model_ids:
+            return
+
+        try:
+            model = await self.ap.model_mgr.get_model_by_uuid(model_uuid)
+            if model and model.model_entity:
+                models.append({
+                    'model_id': model_uuid,
+                    'model_type': getattr(model.model_entity, 'model_type', None),
+                    'provider': getattr(model.provider_entity, 'name', None) if hasattr(model, 'provider_entity') else None,
+                    'operations': operations,
+                })
+                seen_model_ids.add(model_uuid)
+        except Exception as e:
+            self.ap.logger.warning(f'Failed to build LLM model resource {model_uuid}: {e}')
+
+    async def _append_rerank_model_resource(
+        self,
+        models: list[ModelResource],
+        seen_model_ids: set[str],
+        model_uuid: str | None,
+    ) -> None:
+        """Append a rerank model resource if it exists and has not been added."""
+        if not model_uuid or model_uuid == '__none__' or model_uuid in seen_model_ids:
+            return
+
+        try:
+            model = await self.ap.model_mgr.get_rerank_model_by_uuid(model_uuid)
+            if model and model.model_entity:
+                models.append({
+                    'model_id': model_uuid,
+                    'model_type': getattr(model.model_entity, 'model_type', 'rerank') or 'rerank',
+                    'provider': getattr(model.provider_entity, 'name', None) if hasattr(model, 'provider_entity') else None,
+                    'operations': ['rerank'],
+                })
+                seen_model_ids.add(model_uuid)
+        except Exception as e:
+            self.ap.logger.warning(f'Failed to build rerank model resource {model_uuid}: {e}')

src/langbot/pkg/agent/runner/result_normalizer.py

@@ -0,0 +1,241 @@
+"""Agent result normalizer for converting AgentRunResult to Pipeline messages."""
+from __future__ import annotations
+
+import typing
+
+import pydantic
+from langbot_plugin.api.entities.builtin.agent_runner.result import (
+    ActionRequestedPayload,
+    ArtifactCreatedPayload,
+    MessageCompletedPayload,
+    MessageDeltaPayload,
+    RunCompletedPayload,
+    RunFailedPayload,
+    StateUpdatedPayload,
+)
+from langbot_plugin.api.entities.builtin.provider import message as provider_message
+
+from ...core import app
+from .descriptor import AgentRunnerDescriptor
+from .errors import RunnerExecutionError, RunnerProtocolError
+
+
+# Maximum size for a single result payload (prevent memory exhaustion)
+MAX_RESULT_SIZE_BYTES = 1024 * 1024  # 1 MB
+
+STRICT_RESULT_PAYLOADS: dict[str, type[pydantic.BaseModel]] = {
+    'message.delta': MessageDeltaPayload,
+    'message.completed': MessageCompletedPayload,
+    'state.updated': StateUpdatedPayload,
+    'artifact.created': ArtifactCreatedPayload,
+    'action.requested': ActionRequestedPayload,
+    'run.completed': RunCompletedPayload,
+    'run.failed': RunFailedPayload,
+}
+
+
+class AgentResultNormalizer:
+    """Normalizer for converting AgentRunResult to Pipeline messages.
+
+    Responsibilities:
+    - Accept only supported result types (message.delta, message.completed, etc.)
+    - Map message.delta -> MessageChunk
+    - Map message.completed -> Message
+    - Map run.completed (with message) -> Message
+    - Handle run.failed as controlled error
+    - Ignore unknown types with warning
+    - Validate result size
+    - Validate message schema
+
+    Accepted result types:
+    - message.delta
+    - message.completed
+    - tool.call.started
+    - tool.call.completed
+    - state.updated
+    - run.completed
+    - run.failed
+    - action.requested (log only, don't execute)
+    """
+
+    ap: app.Application
+
+    def __init__(self, ap: app.Application):
+        self.ap = ap
+
+    async def normalize(
+        self,
+        result_dict: dict[str, typing.Any],
+        descriptor: AgentRunnerDescriptor,
+    ) -> provider_message.Message | provider_message.MessageChunk | None:
+        """Normalize AgentRunResult to Message or MessageChunk.
+
+        Args:
+            result_dict: Raw result dict from plugin runtime
+            descriptor: Runner descriptor for error context
+
+        Returns:
+            Message, MessageChunk, or None (for non-message events)
+
+        Raises:
+            RunnerExecutionError: On run.failed
+            RunnerProtocolError: On invalid result format
+        """
+        # Validate result type
+        result_type = result_dict.get('type')
+        if not result_type:
+            raise RunnerProtocolError(descriptor.id, 'Missing result type')
+
+        # Validate result size
+        try:
+            import json
+            result_json = json.dumps(result_dict)
+            if len(result_json) > MAX_RESULT_SIZE_BYTES:
+                self.ap.logger.warning(
+                    f'Runner {descriptor.id} result too large ({len(result_json)} bytes), truncating'
+                )
+                # Truncate content if possible
+                data = result_dict.get('data', {})
+                if 'chunk' in data or 'message' in data:
+                    content = data.get('chunk', {}).get('content', '') or data.get('message', {}).get('content', '')
+                    if isinstance(content, str) and len(content) > 10000:
+                        # Keep reasonable length
+                        data['chunk'] = {'role': 'assistant', 'content': content[:10000] + '...[truncated]'}
+        except Exception as e:
+            self.ap.logger.warning(f'Failed to validate runner {descriptor.id} result size: {e}')
+
+        # Handle each result type
+        data = result_dict.get('data', {})
+
+        if not self.validate_payload(result_type, data, descriptor):
+            return None
+
+        if result_type == 'message.delta':
+            return self._normalize_message_delta(data, descriptor)
+
+        elif result_type == 'message.completed':
+            return self._normalize_message_completed(data, descriptor)
+
+        elif result_type == 'tool.call.started':
+            # Log only, don't yield to pipeline
+            self.ap.logger.debug(
+                f'Runner {descriptor.id} tool call started: {data.get("tool_name", "unknown")}'
+            )
+            return None
+
+        elif result_type == 'tool.call.completed':
+            # Log only, don't yield to pipeline
+            self.ap.logger.debug(
+                f'Runner {descriptor.id} tool call completed: {data.get("tool_name", "unknown")}'
+            )
+            return None
+
+        elif result_type == 'state.updated':
+            # Log for telemetry, don't yield to pipeline
+            # Orchestrator already handles the actual PersistentStateStore update.
+            scope = data.get('scope', 'unknown')
+            key = data.get('key', 'unknown')
+            value_repr = repr(data.get('value', '...'))[:100]  # Truncate for log
+            self.ap.logger.debug(
+                f'Runner {descriptor.id} state.updated logged: scope={scope}, key={key}, value={value_repr}'
+            )
+            return None
+
+        elif result_type == 'run.completed':
+            # May include final message
+            if 'message' in data:
+                return self._normalize_message_completed(data, descriptor)
+            # If no message, it's just completion signal
+            return None
+
+        elif result_type == 'run.failed':
+            error_msg = data.get('error', 'Unknown error')
+            error_code = data.get('code', 'unknown')
+            retryable = data.get('retryable', False)
+            raise RunnerExecutionError(
+                descriptor.id,
+                f'{error_msg} (code: {error_code})',
+                retryable=retryable,
+            )
+
+        elif result_type == 'action.requested':
+            # Reserved for EBA - log only, don't execute
+            self.ap.logger.info(
+                f'Runner {descriptor.id} requested action (not executed in current phase): '
+                f'{data.get("action", "unknown")}'
+            )
+            return None
+
+        elif result_type == 'artifact.created':
+            # Log for telemetry, consumed by orchestrator
+            artifact_id = data.get('artifact_id', 'unknown')
+            artifact_type = data.get('artifact_type', 'unknown')
+            self.ap.logger.debug(
+                f'Runner {descriptor.id} artifact.created logged: artifact_id={artifact_id}, type={artifact_type}'
+            )
+            return None
+
+        else:
+            # Unknown type - warn and ignore.
+            self.ap.logger.warning(
+                f'Runner {descriptor.id} returned unknown result type: {result_type}. '
+                f'Expected supported types (message.delta, message.completed, run.completed, run.failed, etc.)'
+            )
+            return None
+
+    def validate_payload(
+        self,
+        result_type: str,
+        data: typing.Any,
+        descriptor: AgentRunnerDescriptor,
+    ) -> bool:
+        """Validate typed payloads that affect Host state or delivery.
+
+        Tool-call telemetry stays intentionally loose so older runners can keep
+        emitting diagnostic fields. Unknown result types are handled by the
+        caller and are not validated here.
+        """
+        payload_model = STRICT_RESULT_PAYLOADS.get(result_type)
+        if payload_model is None:
+            return True
+
+        try:
+            payload_model.model_validate(data)
+            return True
+        except Exception as e:
+            self.ap.logger.warning(
+                f'Runner {descriptor.id} returned invalid {result_type} payload; dropping result: {e}'
+            )
+            return False
+
+    def _normalize_message_delta(
+        self,
+        data: dict[str, typing.Any],
+        descriptor: AgentRunnerDescriptor,
+    ) -> provider_message.MessageChunk:
+        """Normalize message.delta to MessageChunk."""
+        chunk_data = data.get('chunk', {})
+        if not chunk_data:
+            raise RunnerProtocolError(descriptor.id, 'message.delta missing chunk data')
+
+        try:
+            chunk = provider_message.MessageChunk.model_validate(chunk_data)
+            return chunk
+        except Exception as e:
+            raise RunnerProtocolError(descriptor.id, f'Invalid chunk schema: {e}')
+
+    def _normalize_message_completed(
+        self,
+        data: dict[str, typing.Any],
+        descriptor: AgentRunnerDescriptor,
+    ) -> provider_message.Message:
+        """Normalize message.completed to Message."""
+        message_data = data.get('message', {})
+        if not message_data:
+            raise RunnerProtocolError(descriptor.id, 'message.completed missing message data')
+
+        try:
+            msg = provider_message.Message.model_validate(message_data)
+            return msg
+        except Exception as e:
+            raise RunnerProtocolError(descriptor.id, f'Invalid message schema: {e}')

src/langbot/pkg/agent/runner/run_journal.py

@@ -0,0 +1,644 @@
+"""Run-side effects for AgentRunner executions."""
+
+from __future__ import annotations
+
+import typing
+
+from ...core import app
+from .descriptor import AgentRunnerDescriptor
+from .errors import RunnerProtocolError
+from .host_models import AgentBinding, AgentEventEnvelope
+from .persistent_state_store import PersistentStateStore, get_persistent_state_store
+from .run_ledger_store import RunLedgerStore
+
+
+# Maximum inline artifact content size (1MB)
+MAX_ARTIFACT_INLINE_BYTES = 1 * 1024 * 1024
+
+
+class AgentRunJournal:
+    """Persist run events, transcript records, artifacts, and state updates."""
+
+    ap: app.Application
+
+    _persistent_state_store: PersistentStateStore | None
+    _run_ledger_store: RunLedgerStore | None
+
+    def __init__(self, ap: app.Application):
+        self.ap = ap
+        self._persistent_state_store = None
+        self._run_ledger_store = None
+
+    def _get_run_ledger_store(self) -> RunLedgerStore:
+        if self._run_ledger_store is None:
+            self._run_ledger_store = RunLedgerStore(self.ap.persistence_mgr.get_db_engine())
+        return self._run_ledger_store
+
+    @staticmethod
+    def _to_plain_dict(value: typing.Any) -> dict[str, typing.Any]:
+        if hasattr(value, 'model_dump'):
+            value = value.model_dump(mode='json')
+        if isinstance(value, dict):
+            return dict(value)
+        return {}
+
+    @classmethod
+    def _sanitize_content_item(cls, value: typing.Any) -> typing.Any:
+        item = cls._to_plain_dict(value)
+        if not item:
+            return value
+        item_type = item.get('type')
+        if item_type == 'image_base64' and item.get('image_base64'):
+            item['image_base64'] = None
+            item['content_redacted'] = True
+        elif item_type == 'file_base64' and item.get('file_base64'):
+            item['file_base64'] = None
+            item['content_redacted'] = True
+        return item
+
+    @classmethod
+    def _sanitize_attachment_ref(cls, value: typing.Any) -> dict[str, typing.Any]:
+        item = cls._to_plain_dict(value)
+        if item.get('content'):
+            item['content'] = None
+            item['content_redacted'] = True
+        return item
+
+    @classmethod
+    def _sanitize_contents(cls, contents: typing.Iterable[typing.Any]) -> list[typing.Any]:
+        return [cls._sanitize_content_item(content) for content in contents]
+
+    @classmethod
+    def _sanitize_attachments(cls, attachments: typing.Iterable[typing.Any]) -> list[dict[str, typing.Any]]:
+        return [cls._sanitize_attachment_ref(attachment) for attachment in attachments]
+
+    async def create_run(
+        self,
+        *,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+        context: dict[str, typing.Any],
+        authorization: dict[str, typing.Any],
+    ) -> dict[str, typing.Any]:
+        """Create the Host-owned run ledger record."""
+        runtime = context.get('runtime') if isinstance(context, dict) else {}
+        return await self._get_run_ledger_store().create_run(
+            run_id=context['run_id'],
+            event_id=event.event_id,
+            binding_id=binding.binding_id,
+            runner_id=descriptor.id,
+            conversation_id=event.conversation_id,
+            thread_id=event.thread_id,
+            workspace_id=event.workspace_id,
+            bot_id=event.bot_id,
+            deadline_at=runtime.get('deadline_at') if isinstance(runtime, dict) else None,
+            authorization=authorization,
+            metadata={
+                'event_type': event.event_type,
+                'source': event.source,
+            },
+        )
+
+    async def append_run_result(
+        self,
+        *,
+        result_dict: dict[str, typing.Any],
+        run_id: str,
+        sequence: int,
+        source: str = 'runner',
+        artifact_refs: list[dict[str, typing.Any]] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> dict[str, typing.Any]:
+        """Persist one AgentRunResult in the run ledger."""
+        usage = result_dict.get('usage')
+        if hasattr(usage, 'model_dump'):
+            usage = usage.model_dump(mode='json')
+        return await self._get_run_ledger_store().append_event(
+            run_id=run_id,
+            sequence=sequence,
+            event_type=str(result_dict.get('type') or 'unknown'),
+            data=result_dict.get('data') if isinstance(result_dict.get('data'), dict) else {},
+            usage=usage if isinstance(usage, dict) else None,
+            source=source,
+            artifact_refs=artifact_refs,
+            metadata=metadata,
+        )
+
+    async def finalize_run(
+        self,
+        *,
+        run_id: str,
+        status: str,
+        status_reason: str | None = None,
+        usage: dict[str, typing.Any] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Finalize or update the Host-owned run ledger record."""
+        return await self._get_run_ledger_store().finalize_run(
+            run_id=run_id,
+            status=status,
+            status_reason=status_reason,
+            usage=usage,
+            metadata=metadata,
+        )
+
+    async def get_run(self, run_id: str) -> dict[str, typing.Any] | None:
+        """Return the persisted run ledger record."""
+        return await self._get_run_ledger_store().get_run(run_id)
+
+    async def handle_state_updated_event(
+        self,
+        result_dict: dict[str, typing.Any],
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        descriptor: AgentRunnerDescriptor,
+        run_id: str | None = None,
+    ) -> None:
+        """Handle state.updated result in event-first mode."""
+        data = result_dict.get('data', {})
+
+        result_run_id = result_dict.get('run_id')
+        if run_id and result_run_id and result_run_id != run_id:
+            raise RunnerProtocolError(
+                descriptor.id,
+                f'state.updated run_id mismatch: expected {run_id}, got {result_run_id}',
+            )
+
+        scope = data.get('scope')
+        if not scope:
+            raise RunnerProtocolError(
+                descriptor.id,
+                'state.updated missing required field: scope',
+            )
+
+        key = data.get('key')
+        value = data.get('value')
+
+        if not key:
+            raise RunnerProtocolError(
+                descriptor.id,
+                'state.updated missing required field: key',
+            )
+
+        if self._persistent_state_store is None:
+            self._persistent_state_store = get_persistent_state_store(self.ap.persistence_mgr.get_db_engine())
+
+        success, error = await self._persistent_state_store.apply_update_from_event(
+            event=event,
+            binding=binding,
+            descriptor=descriptor,
+            scope=scope,
+            key=key,
+            value=value,
+            logger=self.ap.logger,
+        )
+
+        if success:
+            self.ap.logger.debug(f'Runner {descriptor.id} state.updated (event mode): scope={scope}, key={key}')
+        elif error:
+            self.ap.logger.warning(f'Runner {descriptor.id} state.updated rejected: {error}')
+
+    async def write_event_log(
+        self,
+        event: AgentEventEnvelope,
+        binding: AgentBinding,
+        run_id: str,
+        runner_id: str,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> str:
+        """Write incoming event to EventLog."""
+        import datetime
+
+        from .event_log_store import EventLogStore
+
+        store = EventLogStore(self.ap.persistence_mgr.get_db_engine())
+
+        input_summary = None
+        input_json = None
+        if event.input:
+            if event.input.text:
+                input_summary = event.input.text[:1000]
+            input_json = {
+                'text': event.input.text,
+                'contents': self._sanitize_contents(event.input.contents),
+                'attachments': self._sanitize_attachments(event.input.attachments),
+            }
+
+        return await store.append_event(
+            event_id=event.event_id,
+            event_type=event.event_type,
+            source=event.source,
+            bot_id=event.bot_id,
+            workspace_id=event.workspace_id,
+            conversation_id=event.conversation_id,
+            thread_id=event.thread_id,
+            actor_type=event.actor.actor_type if event.actor else None,
+            actor_id=event.actor.actor_id if event.actor else None,
+            actor_name=event.actor.actor_name if event.actor else None,
+            subject_type=event.subject.subject_type if event.subject else None,
+            subject_id=event.subject.subject_id if event.subject else None,
+            input_summary=input_summary,
+            input_json=input_json,
+            run_id=run_id,
+            runner_id=runner_id,
+            event_time=(
+                datetime.datetime.fromtimestamp(event.event_time, datetime.timezone.utc) if event.event_time else None
+            ),
+            metadata=metadata,
+        )
+
+    async def register_input_artifacts(
+        self,
+        event: AgentEventEnvelope,
+        run_id: str,
+        runner_id: str,
+    ) -> None:
+        """Register current-event attachments referenced by AgentInput."""
+        if not event.input or not event.input.attachments:
+            return
+
+        from .artifact_store import ArtifactStore
+
+        store = ArtifactStore(self.ap.persistence_mgr.get_db_engine())
+
+        for attachment in event.input.attachments:
+            data = attachment.model_dump(mode='json') if hasattr(attachment, 'model_dump') else attachment
+            if not isinstance(data, dict):
+                continue
+
+            artifact_id = data.get('artifact_id')
+            artifact_type = data.get('artifact_type') or 'file'
+            if not artifact_id:
+                continue
+
+            content, parsed_mime_type = self.decode_attachment_content(data.get('content'))
+            url = data.get('url')
+            platform_ref_id = data.get('id')
+            storage_key = None
+            storage_type = 'metadata_only'
+            if content is None:
+                if url:
+                    storage_key = url
+                    storage_type = 'url'
+                elif platform_ref_id:
+                    storage_key = platform_ref_id
+                    storage_type = 'platform_ref'
+
+            metadata = {
+                'input_attachment': True,
+                'input_source': data.get('source') or 'platform',
+            }
+            if url:
+                metadata['url'] = url
+            if platform_ref_id:
+                metadata['platform_ref_id'] = platform_ref_id
+
+            try:
+                await store.register_artifact(
+                    artifact_id=artifact_id,
+                    artifact_type=artifact_type,
+                    source='platform',
+                    storage_key=storage_key,
+                    storage_type=storage_type,
+                    mime_type=data.get('mime_type') or parsed_mime_type,
+                    name=data.get('name'),
+                    size_bytes=data.get('size') or (len(content) if content is not None else None),
+                    conversation_id=event.conversation_id,
+                    run_id=run_id,
+                    runner_id=runner_id,
+                    bot_id=event.bot_id,
+                    workspace_id=event.workspace_id,
+                    thread_id=event.thread_id,
+                    metadata=metadata,
+                    content=content,
+                )
+            except Exception as e:
+                self.ap.logger.warning(f'Failed to register input artifact {artifact_id}: {e}')
+
+    def decode_attachment_content(
+        self,
+        content: typing.Any,
+    ) -> tuple[bytes | None, str | None]:
+        """Decode base64 attachment content, including data URLs."""
+        if not isinstance(content, str) or not content:
+            return None, None
+
+        import base64
+        import binascii
+
+        mime_type = None
+        payload = content
+        if content.startswith('data:') and ',' in content:
+            header, payload = content.split(',', 1)
+            if ';base64' in header:
+                mime_type = header[5:].split(';', 1)[0] or None
+
+        try:
+            return base64.b64decode(payload, validate=False), mime_type
+        except (binascii.Error, ValueError):
+            return None, mime_type
+
+    async def write_user_transcript(
+        self,
+        event: AgentEventEnvelope,
+        event_log_id: str,
+    ) -> None:
+        """Write user message to Transcript."""
+        from .transcript_store import TranscriptStore
+
+        store = TranscriptStore(self.ap.persistence_mgr.get_db_engine())
+
+        content = event.input.text if event.input else None
+        content_json = None
+        if event.input:
+            content_json = {
+                'role': 'user',
+                'content': self._sanitize_contents(event.input.contents) if event.input.contents else [],
+            }
+
+        artifact_refs = []
+        if event.input and event.input.attachments:
+            for a in event.input.attachments:
+                artifact_refs.append(self._sanitize_attachment_ref(a))
+
+        await store.append_transcript(
+            transcript_id=None,
+            event_id=event_log_id,
+            conversation_id=event.conversation_id,
+            role='user',
+            bot_id=event.bot_id,
+            workspace_id=event.workspace_id,
+            content=content,
+            content_json=content_json,
+            artifact_refs=artifact_refs if artifact_refs else None,
+            thread_id=event.thread_id,
+            item_type='message',
+            metadata={
+                'actor_type': event.actor.actor_type if event.actor else None,
+                'actor_id': event.actor.actor_id if event.actor else None,
+            },
+        )
+
+    async def handle_artifact_created(
+        self,
+        result_dict: dict[str, typing.Any],
+        event: AgentEventEnvelope,
+        run_id: str,
+        runner_id: str,
+    ) -> dict[str, typing.Any]:
+        """Handle artifact.created result, register artifact, and write EventLog."""
+        import base64
+        import uuid
+
+        from .artifact_store import ArtifactStore
+        from .event_log_store import EventLogStore
+
+        data = result_dict.get('data', {})
+
+        result_run_id = result_dict.get('run_id')
+        if result_run_id and result_run_id != run_id:
+            raise RunnerProtocolError(
+                runner_id,
+                f'artifact.created run_id mismatch: expected {run_id}, got {result_run_id}',
+            )
+
+        artifact_id = data.get('artifact_id') or str(uuid.uuid4())
+        artifact_type = data.get('artifact_type')
+        if not artifact_type:
+            raise RunnerProtocolError(
+                runner_id,
+                'artifact.created missing required field: artifact_type',
+            )
+
+        mime_type = data.get('mime_type')
+        name = data.get('name')
+        size_bytes = data.get('size_bytes')
+        sha256 = data.get('sha256')
+        metadata = data.get('metadata')
+        content_base64 = data.get('content_base64')
+
+        content: bytes | None = None
+        if content_base64:
+            try:
+                content = base64.b64decode(content_base64, validate=True)
+            except Exception as e:
+                raise RunnerProtocolError(
+                    runner_id,
+                    f'artifact.created invalid base64 content: {e}',
+                )
+
+            if len(content) > MAX_ARTIFACT_INLINE_BYTES:
+                raise RunnerProtocolError(
+                    runner_id,
+                    f'artifact.created content size {len(content)} bytes exceeds limit {MAX_ARTIFACT_INLINE_BYTES} bytes',
+                )
+
+        artifact_store = ArtifactStore(self.ap.persistence_mgr.get_db_engine())
+        try:
+            registered_id = await artifact_store.register_artifact(
+                artifact_id=artifact_id,
+                artifact_type=artifact_type,
+                source='runner',
+                mime_type=mime_type,
+                name=name,
+                size_bytes=size_bytes,
+                sha256=sha256,
+                conversation_id=event.conversation_id,
+                run_id=run_id,
+                runner_id=runner_id,
+                bot_id=event.bot_id,
+                workspace_id=event.workspace_id,
+                thread_id=event.thread_id,
+                metadata=metadata,
+                content=content,
+            )
+        except Exception as e:
+            raise RunnerProtocolError(
+                runner_id,
+                f'artifact.created failed to register artifact: {e}',
+            )
+
+        event_log_store = EventLogStore(self.ap.persistence_mgr.get_db_engine())
+        await event_log_store.append_event(
+            event_id=str(uuid.uuid4()),
+            event_type='artifact.created',
+            source='runner',
+            bot_id=event.bot_id,
+            workspace_id=event.workspace_id,
+            conversation_id=event.conversation_id,
+            thread_id=event.thread_id,
+            actor_type=event.actor.actor_type if event.actor else None,
+            actor_id=event.actor.actor_id if event.actor else None,
+            actor_name=event.actor.actor_name if event.actor else None,
+            input_summary=f'Artifact created: {artifact_type}',
+            input_json={
+                'artifact_id': registered_id,
+                'artifact_type': artifact_type,
+                'mime_type': mime_type,
+                'name': name,
+                'size_bytes': size_bytes,
+            },
+            run_id=run_id,
+            runner_id=runner_id,
+        )
+
+        return {
+            'artifact_id': registered_id,
+            'artifact_type': artifact_type,
+            'mime_type': mime_type,
+            'name': name,
+        }
+
+    def merge_artifact_refs(
+        self,
+        pending_refs: list[dict[str, typing.Any]],
+        result_dict: dict[str, typing.Any],
+    ) -> list[dict[str, typing.Any]]:
+        """Merge pending artifact refs with a message's own refs."""
+        merged = list(pending_refs)
+        seen_ids = {ref.get('artifact_id') for ref in pending_refs if ref.get('artifact_id')}
+
+        data = result_dict.get('data', {})
+        message = data.get('message', {})
+        message_refs = message.get('artifact_refs', [])
+
+        if isinstance(message_refs, list):
+            for ref in message_refs:
+                if isinstance(ref, dict):
+                    artifact_id = ref.get('artifact_id')
+                    if artifact_id and artifact_id not in seen_ids:
+                        merged.append(ref)
+                        seen_ids.add(artifact_id)
+
+        return merged
+
+    async def write_steering_dropped_audits(
+        self,
+        items: list[dict[str, typing.Any]],
+        run_id: str,
+        runner_id: str,
+        *,
+        reason: str = 'run_ended',
+    ) -> None:
+        """Write terminal audit events for steering items left unconsumed."""
+        if not items:
+            return
+
+        import datetime
+        import uuid
+
+        from .event_log_store import EventLogStore
+
+        store = EventLogStore(self.ap.persistence_mgr.get_db_engine())
+
+        for item in items:
+            event = item.get('event') if isinstance(item.get('event'), dict) else {}
+            input_data = item.get('input') if isinstance(item.get('input'), dict) else {}
+            conversation = item.get('conversation') if isinstance(item.get('conversation'), dict) else {}
+            actor = item.get('actor') if isinstance(item.get('actor'), dict) else {}
+            subject = item.get('subject') if isinstance(item.get('subject'), dict) else {}
+
+            text = input_data.get('text')
+            input_summary = text[:1000] if isinstance(text, str) and text else 'Unconsumed steering input dropped'
+            event_time = None
+            raw_event_time = event.get('event_time')
+            if raw_event_time:
+                try:
+                    event_time = datetime.datetime.fromtimestamp(
+                        raw_event_time,
+                        datetime.timezone.utc,
+                    )
+                except (TypeError, ValueError, OSError):
+                    event_time = None
+
+            await store.append_event(
+                event_id=str(uuid.uuid4()),
+                event_type='steering.dropped',
+                source='host',
+                bot_id=conversation.get('bot_id'),
+                workspace_id=conversation.get('workspace_id'),
+                conversation_id=conversation.get('conversation_id'),
+                thread_id=conversation.get('thread_id'),
+                actor_type=actor.get('actor_type'),
+                actor_id=actor.get('actor_id'),
+                actor_name=actor.get('actor_name'),
+                subject_type=subject.get('subject_type'),
+                subject_id=subject.get('subject_id'),
+                input_summary=input_summary,
+                input_json={
+                    'text': text,
+                    'contents': self._sanitize_contents(input_data.get('contents') or []),
+                    'attachments': self._sanitize_attachments(input_data.get('attachments') or []),
+                },
+                run_id=run_id,
+                runner_id=runner_id,
+                event_time=event_time,
+                metadata={
+                    'steering': {
+                        'status': 'dropped',
+                        'reason': reason,
+                        'original_event_id': event.get('event_id'),
+                        'claimed_run_id': item.get('claimed_run_id'),
+                        'claimed_runner_id': item.get('runner_id'),
+                        'claimed_at': item.get('claimed_at'),
+                    },
+                },
+            )
+
+    async def write_assistant_transcript(
+        self,
+        result_dict: dict[str, typing.Any],
+        event: AgentEventEnvelope,
+        run_id: str,
+        runner_id: str,
+        artifact_refs: list[dict[str, typing.Any]] | None = None,
+    ) -> None:
+        """Write assistant message to Transcript."""
+        import uuid
+
+        from .transcript_store import TranscriptStore
+
+        store = TranscriptStore(self.ap.persistence_mgr.get_db_engine())
+
+        data = result_dict.get('data', {})
+        message = data.get('message', {})
+
+        content = None
+        content_json = None
+
+        if isinstance(message.get('content'), str):
+            content = message['content']
+            content_json = message
+        elif isinstance(message.get('content'), list):
+            text_parts = []
+            for c in message['content']:
+                if isinstance(c, dict) and c.get('type') == 'text':
+                    text_parts.append(c.get('text', ''))
+            content = ' '.join(text_parts) if text_parts else None
+            content_json = {
+                **message,
+                'content': self._sanitize_contents(message['content']),
+            }
+
+        assistant_event_id = str(uuid.uuid4())
+
+        await store.append_transcript(
+            transcript_id=str(uuid.uuid4()),
+            event_id=assistant_event_id,
+            conversation_id=event.conversation_id,
+            role='assistant',
+            bot_id=event.bot_id,
+            workspace_id=event.workspace_id,
+            content=content,
+            content_json=content_json,
+            artifact_refs=artifact_refs,
+            thread_id=event.thread_id,
+            item_type='message',
+            run_id=run_id,
+            runner_id=runner_id,
+            metadata={
+                'run_id': run_id,
+                'runner_id': runner_id,
+            },
+        )

src/langbot/pkg/agent/runner/run_ledger_store.py

@@ -0,0 +1,691 @@
+"""Run ledger store for Host-owned AgentRun and AgentRunEvent records."""
+
+from __future__ import annotations
+
+import datetime
+import json
+import typing
+import uuid
+
+import sqlalchemy
+from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession
+from sqlalchemy.orm import sessionmaker
+
+from ...entity.persistence.agent_run import AgentRun, AgentRunEvent, AgentRuntime
+
+
+UTC = datetime.timezone.utc
+TERMINAL_STATUSES = {'completed', 'failed', 'cancelled', 'timeout'}
+
+
+def _utc_now() -> datetime.datetime:
+    return datetime.datetime.now(UTC)
+
+
+def _datetime_to_epoch(value: datetime.datetime | None) -> int | None:
+    if value is None:
+        return None
+    if value.tzinfo is None:
+        value = value.replace(tzinfo=UTC)
+    else:
+        value = value.astimezone(UTC)
+    return int(value.timestamp())
+
+
+def _epoch_to_datetime(value: typing.Any) -> datetime.datetime | None:
+    if value is None:
+        return None
+    try:
+        return datetime.datetime.fromtimestamp(float(value), UTC)
+    except (TypeError, ValueError, OSError):
+        return None
+
+
+def _json_dumps(value: typing.Any) -> str | None:
+    if value is None:
+        return None
+    return json.dumps(value)
+
+
+def _json_loads(value: str | None, default: typing.Any) -> typing.Any:
+    if not value:
+        return default
+    try:
+        return json.loads(value)
+    except (TypeError, ValueError):
+        return default
+
+
+class RunLedgerStore:
+    """Store for Host-owned run lifecycle and result event facts."""
+
+    engine: AsyncEngine
+
+    def __init__(self, engine: AsyncEngine):
+        self.engine = engine
+        self._session_factory = sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+    async def create_run(
+        self,
+        *,
+        run_id: str,
+        event_id: str | None,
+        binding_id: str | None,
+        runner_id: str,
+        conversation_id: str | None = None,
+        thread_id: str | None = None,
+        workspace_id: str | None = None,
+        bot_id: str | None = None,
+        agent_id: str | None = None,
+        deadline_at: int | float | None = None,
+        authorization: dict[str, typing.Any] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+        status: str = 'running',
+        queue_name: str | None = None,
+        priority: int = 0,
+        requested_runtime_id: str | None = None,
+    ) -> dict[str, typing.Any]:
+        """Create a run if it does not already exist."""
+        now = _utc_now()
+        async with self._session_factory() as session:
+            existing = await self._get_run_row(session, run_id)
+            if existing is not None:
+                return self._run_to_dict(existing)
+
+            run = AgentRun(
+                run_id=run_id,
+                event_id=event_id,
+                agent_id=agent_id,
+                binding_id=binding_id,
+                runner_id=runner_id,
+                conversation_id=conversation_id,
+                thread_id=thread_id,
+                workspace_id=workspace_id,
+                bot_id=bot_id,
+                status=status,
+                queue_name=queue_name,
+                priority=priority,
+                requested_runtime_id=requested_runtime_id,
+                created_at=now,
+                started_at=now if status == 'running' else None,
+                updated_at=now,
+                deadline_at=_epoch_to_datetime(deadline_at),
+                authorization_json=_json_dumps(authorization),
+                metadata_json=_json_dumps(metadata),
+            )
+            session.add(run)
+            await session.commit()
+            return self._run_to_dict(run)
+
+    async def claim_next_run(
+        self,
+        *,
+        runtime_id: str,
+        queue_name: str | None = None,
+        lease_seconds: int = 60,
+        runner_ids: list[str] | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Claim the next queued or expired-leased run for a runtime."""
+        now = _utc_now()
+        lease_expires_at = now + datetime.timedelta(seconds=max(int(lease_seconds), 1))
+        async with self._session_factory() as session:
+            query = sqlalchemy.select(AgentRun).where(
+                sqlalchemy.or_(
+                    AgentRun.status == 'queued',
+                    sqlalchemy.and_(
+                        AgentRun.status == 'claimed',
+                        AgentRun.claim_lease_expires_at.is_not(None),
+                        AgentRun.claim_lease_expires_at <= now,
+                    ),
+                ),
+                sqlalchemy.or_(
+                    AgentRun.requested_runtime_id.is_(None),
+                    AgentRun.requested_runtime_id == runtime_id,
+                ),
+            )
+            if queue_name is not None:
+                query = query.where(AgentRun.queue_name == queue_name)
+            if runner_ids:
+                query = query.where(AgentRun.runner_id.in_(runner_ids))
+
+            query = query.order_by(AgentRun.priority.desc(), AgentRun.id.asc()).limit(1).with_for_update(
+                skip_locked=True
+            )
+            result = await session.execute(query)
+            run = result.scalars().first()
+            if run is None:
+                return None
+
+            run.status = 'claimed'
+            run.claimed_by_runtime_id = runtime_id
+            run.claim_token = uuid.uuid4().hex
+            run.claim_lease_expires_at = lease_expires_at
+            run.dispatch_attempts = (run.dispatch_attempts or 0) + 1
+            run.last_claimed_at = now
+            run.updated_at = now
+            await session.commit()
+            return self._run_to_dict(run)
+
+    async def renew_claim(
+        self,
+        *,
+        run_id: str,
+        claim_token: str,
+        lease_seconds: int = 60,
+    ) -> dict[str, typing.Any] | None:
+        """Extend a current claim lease if the token still matches."""
+        now = _utc_now()
+        async with self._session_factory() as session:
+            run = await self._get_run_row(session, run_id)
+            if run is None or run.status != 'claimed' or run.claim_token != claim_token:
+                return None
+
+            run.claim_lease_expires_at = now + datetime.timedelta(seconds=max(int(lease_seconds), 1))
+            run.updated_at = now
+            await session.commit()
+            return self._run_to_dict(run)
+
+    async def release_claim(
+        self,
+        *,
+        run_id: str,
+        claim_token: str,
+        status: str = 'queued',
+        status_reason: str | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Release a current claim lease if the token still matches."""
+        now = _utc_now()
+        async with self._session_factory() as session:
+            run = await self._get_run_row(session, run_id)
+            if run is None or run.status != 'claimed' or run.claim_token != claim_token:
+                return None
+
+            run.status = status
+            run.status_reason = status_reason
+            run.claimed_by_runtime_id = None
+            run.claim_token = None
+            run.claim_lease_expires_at = None
+            run.updated_at = now
+            if status in TERMINAL_STATUSES:
+                run.finished_at = run.finished_at or now
+            await session.commit()
+            return self._run_to_dict(run)
+
+    async def release_expired_claims(
+        self,
+        *,
+        now: datetime.datetime | None = None,
+        status: str = 'queued',
+        status_reason: str = 'claim lease expired',
+        limit: int = 100,
+    ) -> list[dict[str, typing.Any]]:
+        """Release claimed runs whose claim lease has expired."""
+        current_time = now or _utc_now()
+        if current_time.tzinfo is None:
+            current_time = current_time.replace(tzinfo=UTC)
+        limit = min(max(int(limit), 1), 500)
+
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(AgentRun)
+                .where(
+                    AgentRun.status == 'claimed',
+                    AgentRun.claim_lease_expires_at.is_not(None),
+                    AgentRun.claim_lease_expires_at <= current_time,
+                )
+                .order_by(AgentRun.claim_lease_expires_at.asc(), AgentRun.id.asc())
+                .limit(limit)
+            )
+            runs = result.scalars().all()
+            for run in runs:
+                run.status = status
+                run.status_reason = status_reason
+                run.claimed_by_runtime_id = None
+                run.claim_token = None
+                run.claim_lease_expires_at = None
+                run.updated_at = current_time
+                if status in TERMINAL_STATUSES:
+                    run.finished_at = run.finished_at or current_time
+            await session.commit()
+            return [self._run_to_dict(run) for run in runs]
+
+    async def append_event(
+        self,
+        *,
+        run_id: str,
+        sequence: int,
+        event_type: str,
+        data: dict[str, typing.Any] | None = None,
+        usage: dict[str, typing.Any] | None = None,
+        source: str = 'runner',
+        artifact_refs: list[dict[str, typing.Any]] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> dict[str, typing.Any]:
+        """Append one run result event.
+
+        If the same run_id + sequence already exists, the existing row is
+        returned. This supports retrying append calls idempotently.
+        """
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(AgentRunEvent).where(
+                    AgentRunEvent.run_id == run_id,
+                    AgentRunEvent.sequence == sequence,
+                )
+            )
+            existing = result.scalars().first()
+            if existing is not None:
+                return self._event_to_dict(existing)
+
+            row = AgentRunEvent(
+                run_id=run_id,
+                sequence=sequence,
+                type=event_type,
+                data_json=_json_dumps(data or {}),
+                usage_json=_json_dumps(usage),
+                created_at=_utc_now(),
+                source=source,
+                artifact_refs_json=_json_dumps(artifact_refs or []),
+                metadata_json=_json_dumps(metadata),
+            )
+            session.add(row)
+            await session.commit()
+            return self._event_to_dict(row)
+
+    async def append_audit_event(
+        self,
+        *,
+        run_id: str,
+        event_type: str,
+        data: dict[str, typing.Any] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Append a Host-authored audit event after the current max sequence."""
+        async with self._session_factory() as session:
+            run = await self._get_run_row(session, run_id)
+            if run is None:
+                return None
+
+            result = await session.execute(
+                sqlalchemy.select(sqlalchemy.func.max(AgentRunEvent.sequence)).where(
+                    AgentRunEvent.run_id == run_id,
+                )
+            )
+            next_sequence = int(result.scalar_one_or_none() or 0) + 1
+            row = AgentRunEvent(
+                run_id=run_id,
+                sequence=next_sequence,
+                type=event_type,
+                data_json=_json_dumps(data or {}),
+                usage_json=None,
+                created_at=_utc_now(),
+                source='host',
+                artifact_refs_json=_json_dumps([]),
+                metadata_json=_json_dumps(metadata or {}),
+            )
+            session.add(row)
+            await session.commit()
+            return self._event_to_dict(row)
+
+    async def finalize_run(
+        self,
+        *,
+        run_id: str,
+        status: str,
+        status_reason: str | None = None,
+        usage: dict[str, typing.Any] | None = None,
+        cost: dict[str, typing.Any] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Update a run to a terminal or current status."""
+        now = _utc_now()
+        async with self._session_factory() as session:
+            run = await self._get_run_row(session, run_id)
+            if run is None:
+                return None
+
+            run.status = status
+            run.status_reason = status_reason
+            run.updated_at = now
+            if status in TERMINAL_STATUSES:
+                run.finished_at = run.finished_at or now
+            if usage is not None:
+                run.usage_json = _json_dumps(usage)
+            if cost is not None:
+                run.cost_json = _json_dumps(cost)
+            if metadata is not None:
+                existing_metadata = _json_loads(run.metadata_json, {})
+                if isinstance(existing_metadata, dict):
+                    existing_metadata.update(metadata)
+                    run.metadata_json = _json_dumps(existing_metadata)
+                else:
+                    run.metadata_json = _json_dumps(metadata)
+            await session.commit()
+            return self._run_to_dict(run)
+
+    async def request_cancel(
+        self,
+        *,
+        run_id: str,
+        status_reason: str | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Record a cancellation request."""
+        now = _utc_now()
+        async with self._session_factory() as session:
+            run = await self._get_run_row(session, run_id)
+            if run is None:
+                return None
+            run.cancel_requested_at = now
+            run.updated_at = now
+            run.status_reason = status_reason or run.status_reason
+            await session.commit()
+            return self._run_to_dict(run)
+
+    async def get_run(self, run_id: str) -> dict[str, typing.Any] | None:
+        """Get one run by run_id."""
+        async with self._session_factory() as session:
+            row = await self._get_run_row(session, run_id)
+            return self._run_to_dict(row) if row is not None else None
+
+    async def register_runtime(
+        self,
+        *,
+        runtime_id: str,
+        status: str = 'online',
+        display_name: str | None = None,
+        endpoint: str | None = None,
+        version: str | None = None,
+        capabilities: dict[str, typing.Any] | None = None,
+        labels: dict[str, typing.Any] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+        heartbeat_deadline_seconds: int = 60,
+    ) -> dict[str, typing.Any]:
+        """Create or update a runtime registry row and record a heartbeat."""
+        now = _utc_now()
+        async with self._session_factory() as session:
+            runtime = await self._get_runtime_row(session, runtime_id)
+            if runtime is None:
+                runtime = AgentRuntime(runtime_id=runtime_id, created_at=now)
+                session.add(runtime)
+
+            runtime.status = status
+            runtime.display_name = display_name
+            runtime.endpoint = endpoint
+            runtime.version = version
+            runtime.capabilities_json = _json_dumps(capabilities or {})
+            runtime.labels_json = _json_dumps(labels or {})
+            runtime.metadata_json = _json_dumps(metadata or {})
+            runtime.last_heartbeat_at = now
+            runtime.heartbeat_deadline_at = now + datetime.timedelta(seconds=max(int(heartbeat_deadline_seconds), 1))
+            runtime.updated_at = now
+            await session.commit()
+            return self._runtime_to_dict(runtime)
+
+    async def heartbeat_runtime(
+        self,
+        *,
+        runtime_id: str,
+        status: str = 'online',
+        heartbeat_deadline_seconds: int = 60,
+        capabilities: dict[str, typing.Any] | None = None,
+        labels: dict[str, typing.Any] | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> dict[str, typing.Any] | None:
+        """Refresh a runtime heartbeat."""
+        now = _utc_now()
+        async with self._session_factory() as session:
+            runtime = await self._get_runtime_row(session, runtime_id)
+            if runtime is None:
+                return None
+
+            runtime.status = status
+            runtime.last_heartbeat_at = now
+            runtime.heartbeat_deadline_at = now + datetime.timedelta(seconds=max(int(heartbeat_deadline_seconds), 1))
+            runtime.updated_at = now
+            if capabilities is not None:
+                runtime.capabilities_json = _json_dumps(capabilities)
+            if labels is not None:
+                runtime.labels_json = _json_dumps(labels)
+            if metadata is not None:
+                existing_metadata = _json_loads(runtime.metadata_json, {})
+                if isinstance(existing_metadata, dict):
+                    existing_metadata.update(metadata)
+                    runtime.metadata_json = _json_dumps(existing_metadata)
+                else:
+                    runtime.metadata_json = _json_dumps(metadata)
+            await session.commit()
+            return self._runtime_to_dict(runtime)
+
+    async def get_runtime(self, runtime_id: str) -> dict[str, typing.Any] | None:
+        """Get one runtime by runtime_id."""
+        async with self._session_factory() as session:
+            row = await self._get_runtime_row(session, runtime_id)
+            return self._runtime_to_dict(row) if row is not None else None
+
+    async def list_runtimes(
+        self,
+        *,
+        statuses: list[str] | None = None,
+        limit: int = 100,
+    ) -> list[dict[str, typing.Any]]:
+        """List runtime registry rows."""
+        limit = min(max(int(limit), 1), 500)
+        async with self._session_factory() as session:
+            query = sqlalchemy.select(AgentRuntime)
+            if statuses:
+                query = query.where(AgentRuntime.status.in_(statuses))
+            query = query.order_by(AgentRuntime.id.asc()).limit(limit)
+            result = await session.execute(query)
+            return [self._runtime_to_dict(row) for row in result.scalars().all()]
+
+    async def mark_stale_runtimes(
+        self,
+        *,
+        now: datetime.datetime | None = None,
+        stale_status: str = 'stale',
+        stale_after_seconds: int | float | None = None,
+    ) -> list[dict[str, typing.Any]]:
+        """Mark runtimes stale when their heartbeat deadline has passed."""
+        current_time = now or _utc_now()
+        if current_time.tzinfo is None:
+            current_time = current_time.replace(tzinfo=UTC)
+        stale_conditions: list[typing.Any] = [
+            sqlalchemy.and_(
+                AgentRuntime.heartbeat_deadline_at.is_not(None),
+                AgentRuntime.heartbeat_deadline_at < current_time,
+            )
+        ]
+        if stale_after_seconds is not None:
+            try:
+                stale_after_delta = datetime.timedelta(seconds=max(float(stale_after_seconds), 0))
+            except (TypeError, ValueError):
+                stale_after_delta = None
+            if stale_after_delta is not None:
+                stale_conditions.append(
+                    sqlalchemy.and_(
+                        AgentRuntime.last_heartbeat_at.is_not(None),
+                        AgentRuntime.last_heartbeat_at < current_time - stale_after_delta,
+                    )
+                )
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(AgentRuntime).where(
+                    sqlalchemy.or_(*stale_conditions),
+                    AgentRuntime.status != stale_status,
+                )
+            )
+            runtimes = result.scalars().all()
+            for runtime in runtimes:
+                runtime.status = stale_status
+                runtime.updated_at = current_time
+            await session.commit()
+            return [self._runtime_to_dict(runtime) for runtime in runtimes]
+
+    async def list_runs(
+        self,
+        *,
+        conversation_id: str | None = None,
+        statuses: list[str] | None = None,
+        before_id: int | None = None,
+        limit: int = 50,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        strict_thread: bool = False,
+    ) -> tuple[list[dict[str, typing.Any]], int | None, bool]:
+        """Page runs by scope."""
+        limit = min(max(int(limit), 1), 100)
+        async with self._session_factory() as session:
+            query = sqlalchemy.select(AgentRun)
+            if conversation_id is not None:
+                query = query.where(AgentRun.conversation_id == conversation_id)
+            if statuses:
+                query = query.where(AgentRun.status.in_(statuses))
+            if before_id is not None:
+                query = query.where(AgentRun.id < before_id)
+            query = self._apply_scope_filters(query, bot_id, workspace_id, thread_id, strict_thread)
+            query = query.order_by(AgentRun.id.desc()).limit(limit + 1)
+
+            result = await session.execute(query)
+            rows = result.scalars().all()
+            items = [self._run_to_dict(row) for row in rows[:limit]]
+            has_more = len(rows) > limit
+            next_cursor = items[-1]['id'] if items and has_more else None
+            return items, next_cursor, has_more
+
+    async def page_run_events(
+        self,
+        *,
+        run_id: str,
+        before_sequence: int | None = None,
+        after_sequence: int | None = None,
+        limit: int = 50,
+        direction: str = 'forward',
+    ) -> tuple[list[dict[str, typing.Any]], int | None, int | None, bool]:
+        """Page result events for one run."""
+        limit = min(max(int(limit), 1), 100)
+        direction = direction if direction in {'forward', 'backward'} else 'forward'
+        async with self._session_factory() as session:
+            query = sqlalchemy.select(AgentRunEvent).where(AgentRunEvent.run_id == run_id)
+            if before_sequence is not None:
+                query = query.where(AgentRunEvent.sequence < before_sequence)
+            if after_sequence is not None:
+                query = query.where(AgentRunEvent.sequence > after_sequence)
+
+            if direction == 'backward':
+                query = query.order_by(AgentRunEvent.sequence.desc())
+            else:
+                query = query.order_by(AgentRunEvent.sequence.asc())
+            query = query.limit(limit + 1)
+
+            result = await session.execute(query)
+            rows = result.scalars().all()
+            items = [self._event_to_dict(row) for row in rows[:limit]]
+            has_more = len(rows) > limit
+
+            if direction == 'backward':
+                next_cursor = items[-1]['sequence'] if items and has_more else None
+                prev_cursor = items[0]['sequence'] if items else None
+            else:
+                next_cursor = items[-1]['sequence'] if items and has_more else None
+                prev_cursor = items[0]['sequence'] if items else None
+            return items, next_cursor, prev_cursor, has_more
+
+    async def _get_run_row(
+        self,
+        session: AsyncSession,
+        run_id: str,
+    ) -> AgentRun | None:
+        result = await session.execute(sqlalchemy.select(AgentRun).where(AgentRun.run_id == run_id))
+        return result.scalars().first()
+
+    async def _get_runtime_row(
+        self,
+        session: AsyncSession,
+        runtime_id: str,
+    ) -> AgentRuntime | None:
+        result = await session.execute(sqlalchemy.select(AgentRuntime).where(AgentRuntime.runtime_id == runtime_id))
+        return result.scalars().first()
+
+    def _apply_scope_filters(
+        self,
+        query: typing.Any,
+        bot_id: str | None,
+        workspace_id: str | None,
+        thread_id: str | None,
+        strict_thread: bool,
+    ) -> typing.Any:
+        if bot_id is not None:
+            query = query.where(AgentRun.bot_id == bot_id)
+        if workspace_id is not None:
+            query = query.where(AgentRun.workspace_id == workspace_id)
+        if strict_thread:
+            if thread_id is None:
+                query = query.where(AgentRun.thread_id.is_(None))
+            else:
+                query = query.where(AgentRun.thread_id == thread_id)
+        return query
+
+    def _run_to_dict(self, row: AgentRun) -> dict[str, typing.Any]:
+        return {
+            'id': row.id,
+            'run_id': row.run_id,
+            'event_id': row.event_id,
+            'agent_id': row.agent_id,
+            'binding_id': row.binding_id,
+            'runner_id': row.runner_id,
+            'conversation_id': row.conversation_id,
+            'thread_id': row.thread_id,
+            'workspace_id': row.workspace_id,
+            'bot_id': row.bot_id,
+            'status': row.status,
+            'status_reason': row.status_reason,
+            'queue_name': row.queue_name,
+            'priority': row.priority,
+            'requested_runtime_id': row.requested_runtime_id,
+            'claimed_by_runtime_id': row.claimed_by_runtime_id,
+            'claim_token': row.claim_token,
+            'claim_lease_expires_at': _datetime_to_epoch(row.claim_lease_expires_at),
+            'dispatch_attempts': row.dispatch_attempts,
+            'last_claimed_at': _datetime_to_epoch(row.last_claimed_at),
+            'created_at': _datetime_to_epoch(row.created_at),
+            'started_at': _datetime_to_epoch(row.started_at),
+            'finished_at': _datetime_to_epoch(row.finished_at),
+            'updated_at': _datetime_to_epoch(row.updated_at),
+            'deadline_at': _datetime_to_epoch(row.deadline_at),
+            'cancel_requested_at': _datetime_to_epoch(row.cancel_requested_at),
+            'usage': _json_loads(row.usage_json, None),
+            'cost': _json_loads(row.cost_json, None),
+            'metadata': _json_loads(row.metadata_json, {}),
+        }
+
+    def _runtime_to_dict(self, row: AgentRuntime) -> dict[str, typing.Any]:
+        return {
+            'id': row.id,
+            'runtime_id': row.runtime_id,
+            'status': row.status,
+            'display_name': row.display_name,
+            'endpoint': row.endpoint,
+            'version': row.version,
+            'capabilities': _json_loads(row.capabilities_json, {}),
+            'labels': _json_loads(row.labels_json, {}),
+            'metadata': _json_loads(row.metadata_json, {}),
+            'last_heartbeat_at': _datetime_to_epoch(row.last_heartbeat_at),
+            'heartbeat_deadline_at': _datetime_to_epoch(row.heartbeat_deadline_at),
+            'created_at': _datetime_to_epoch(row.created_at),
+            'updated_at': _datetime_to_epoch(row.updated_at),
+        }
+
+    def _event_to_dict(self, row: AgentRunEvent) -> dict[str, typing.Any]:
+        return {
+            'id': row.id,
+            'run_id': row.run_id,
+            'sequence': row.sequence,
+            'type': row.type,
+            'data': _json_loads(row.data_json, {}),
+            'usage': _json_loads(row.usage_json, None),
+            'created_at': _datetime_to_epoch(row.created_at),
+            'source': row.source,
+            'artifact_refs': _json_loads(row.artifact_refs_json, []),
+            'metadata': _json_loads(row.metadata_json, {}),
+        }

src/langbot/pkg/agent/runner/session_registry.py

@@ -0,0 +1,431 @@
+"""Agent run session registry for proxy action permission validation."""
+from __future__ import annotations
+
+import asyncio
+import copy
+import typing
+import time
+import threading
+
+from .context_builder import AgentResources
+
+
+MAX_STEERING_QUEUE_ITEMS = 100
+
+DEFAULT_RESOURCE_OPERATIONS: dict[str, set[str]] = {
+    'model': {'invoke', 'stream', 'rerank'},
+    'tool': {'detail', 'call'},
+    'knowledge_base': {'list', 'retrieve'},
+    'file': {'config', 'knowledge'},
+    'skill': {'activate'},
+}
+
+
+class AgentRunSessionStatus(typing.TypedDict):
+    """Status tracking for agent run session."""
+    started_at: int
+    last_activity_at: int
+
+
+class RunAuthorizationSnapshot(typing.TypedDict):
+    """Frozen authorization data for one active run.
+
+    ResourceBuilder creates the authorized resource list once before runner
+    execution. Runtime proxy handlers must validate against this run-scoped
+    snapshot instead of recomputing resource policy.
+    """
+
+    resources: AgentResources
+    available_apis: dict[str, bool]
+    conversation_id: str | None
+    bot_id: str | None
+    workspace_id: str | None
+    thread_id: str | None
+    state_policy: dict[str, typing.Any]
+    state_context: dict[str, typing.Any]
+    authorized_ids: dict[str, set[str]]
+    authorized_operations: dict[str, dict[str, set[str]]]
+
+
+SteeringQueueItem = dict[str, typing.Any]
+
+
+class AgentRunSession(typing.TypedDict):
+    """Session for an active agent runner execution.
+
+    Stored in AgentRunSessionRegistry for proxy action permission validation.
+
+    Fields:
+        run_id: Unique run identifier (UUID from AgentRunContext)
+        runner_id: Runner descriptor ID (plugin:author/name/runner)
+        query_id: Host entry query ID, only present for query-based adapters
+        plugin_identity: Plugin identifier (author/name) of the runner
+        authorization: Run-scoped authorization snapshot; runtime auth truth
+        status: Session status tracking
+    """
+    run_id: str
+    runner_id: str
+    query_id: int | None
+    plugin_identity: str  # author/name
+    authorization: RunAuthorizationSnapshot
+    status: AgentRunSessionStatus
+    steering_queue: list[SteeringQueueItem]
+
+
+class AgentRunSessionRegistry:
+    """Registry for active agent run sessions.
+
+    Host-owned registry for tracking active AgentRunner executions.
+    Used by proxy actions in handler.py to validate resource access.
+
+    Key: run_id (UUID from AgentRunContext)
+    Value: AgentRunSession with authorized resources
+
+    Thread-safe via asyncio.Lock.
+    """
+
+    _sessions: dict[str, AgentRunSession]
+    _lock: asyncio.Lock
+
+    def __init__(self):
+        self._sessions = {}
+        self._lock = asyncio.Lock()
+
+    async def register(
+        self,
+        run_id: str,
+        runner_id: str,
+        query_id: int | None,
+        plugin_identity: str,
+        resources: AgentResources,
+        conversation_id: str | None = None,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        available_apis: dict[str, bool] | None = None,
+        state_policy: dict[str, typing.Any] | None = None,
+        state_context: dict[str, typing.Any] | None = None,
+    ) -> None:
+        """Register a new agent run session.
+
+        Args:
+            run_id: Unique run identifier
+            runner_id: Runner descriptor ID
+            query_id: Host entry query ID, only present for query-based adapters
+            plugin_identity: Plugin identifier (author/name)
+            resources: Authorized resources for this run
+            conversation_id: Conversation ID for history/event access
+            bot_id: Bot UUID for history/event access
+            workspace_id: Workspace ID for history/event access
+            thread_id: Thread ID for history/event access
+            available_apis: Run-scoped pull APIs exposed in AgentRunContext
+            state_policy: State policy from binding (enable_state, state_scopes)
+            state_context: Context for state API (scope_keys, binding_identity, etc.)
+        """
+        if not isinstance(plugin_identity, str) or not plugin_identity.strip():
+            raise ValueError('plugin_identity is required for agent run sessions')
+
+        now = int(time.time())
+
+        available_apis = copy.deepcopy(available_apis or {})
+
+        # Normalize state_policy to defaults if None
+        if state_policy is None:
+            state_policy = {'enable_state': True, 'state_scopes': ['conversation', 'actor']}
+
+        # Normalize state_context to empty dict if None
+        state_context = state_context or {}
+
+        resources_snapshot = copy.deepcopy(resources)
+        authorization: RunAuthorizationSnapshot = {
+            'resources': resources_snapshot,
+            'available_apis': available_apis,
+            'conversation_id': conversation_id,
+            'bot_id': bot_id,
+            'workspace_id': workspace_id,
+            'thread_id': thread_id,
+            'state_policy': copy.deepcopy(state_policy),
+            'state_context': copy.deepcopy(state_context),
+            'authorized_ids': self._build_authorized_ids(resources_snapshot),
+            'authorized_operations': self._build_authorized_operations(resources_snapshot),
+        }
+
+        session: AgentRunSession = {
+            'run_id': run_id,
+            'runner_id': runner_id,
+            'query_id': query_id,
+            'plugin_identity': plugin_identity,
+            'authorization': authorization,
+            'status': {
+                'started_at': now,
+                'last_activity_at': now,
+            },
+            'steering_queue': [],
+        }
+
+        async with self._lock:
+            self._sessions[run_id] = session
+
+    def _build_authorized_ids(self, resources: AgentResources) -> dict[str, set[str]]:
+        """Pre-compute authorized resource IDs for O(1) lookup."""
+        return {
+            'model': {m.get('model_id') for m in resources.get('models', [])},
+            'tool': {t.get('tool_name') for t in resources.get('tools', [])},
+            'knowledge_base': {kb.get('kb_id') for kb in resources.get('knowledge_bases', [])},
+            'skill': {s.get('skill_name') for s in resources.get('skills', [])},
+            'file': {f.get('file_id') for f in resources.get('files', [])},
+        }
+
+    def _build_authorized_operations(
+        self,
+        resources: AgentResources,
+    ) -> dict[str, dict[str, set[str]]]:
+        """Pre-compute resource operations for runtime action validation."""
+        return {
+            'model': {
+                m.get('model_id'): self._resource_operations('model', m)
+                for m in resources.get('models', [])
+                if m.get('model_id')
+            },
+            'tool': {
+                t.get('tool_name'): self._resource_operations('tool', t)
+                for t in resources.get('tools', [])
+                if t.get('tool_name')
+            },
+            'knowledge_base': {
+                kb.get('kb_id'): self._resource_operations('knowledge_base', kb)
+                for kb in resources.get('knowledge_bases', [])
+                if kb.get('kb_id')
+            },
+            'skill': {
+                s.get('skill_name'): self._resource_operations('skill', s)
+                for s in resources.get('skills', [])
+                if s.get('skill_name')
+            },
+            'file': {
+                f.get('file_id'): self._resource_operations('file', f)
+                for f in resources.get('files', [])
+                if f.get('file_id')
+            },
+        }
+
+    @staticmethod
+    def _resource_operations(resource_type: str, resource: dict[str, typing.Any]) -> set[str]:
+        """Return explicit operations or the compatibility default for old resources."""
+        operations = resource.get('operations')
+        if isinstance(operations, list) and operations:
+            return {str(operation) for operation in operations}
+        return set(DEFAULT_RESOURCE_OPERATIONS.get(resource_type, set()))
+
+    async def unregister(self, run_id: str) -> AgentRunSession | None:
+        """Unregister an agent run session.
+
+        Args:
+            run_id: Unique run identifier
+
+        Returns:
+            The removed session, if one existed. Callers can inspect any
+            pending in-memory queues before they are discarded.
+        """
+        async with self._lock:
+            return self._sessions.pop(run_id, None)
+
+    async def get(self, run_id: str) -> AgentRunSession | None:
+        """Get session by run_id.
+
+        Args:
+            run_id: Unique run identifier
+
+        Returns:
+            AgentRunSession if found, None otherwise
+        """
+        async with self._lock:
+            return self._sessions.get(run_id)
+
+    async def update_activity(self, run_id: str) -> None:
+        """Update last activity timestamp for session.
+
+        Args:
+            run_id: Unique run identifier
+        """
+        async with self._lock:
+            if run_id in self._sessions:
+                self._sessions[run_id]['status']['last_activity_at'] = int(time.time())
+
+    async def find_steering_target(
+        self,
+        *,
+        conversation_id: str,
+        runner_id: str,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+    ) -> str | None:
+        """Find the oldest active run that can accept steering for a conversation."""
+        async with self._lock:
+            candidates: list[tuple[int, str]] = []
+            for run_id, session in self._sessions.items():
+                authorization = session['authorization']
+                if session.get('runner_id') != runner_id:
+                    continue
+                if authorization.get('conversation_id') != conversation_id:
+                    continue
+                if authorization.get('bot_id') != bot_id:
+                    continue
+                if authorization.get('workspace_id') != workspace_id:
+                    continue
+                if authorization.get('thread_id') != thread_id:
+                    continue
+                if not authorization.get('available_apis', {}).get('steering_pull', False):
+                    continue
+                candidates.append((session['status'].get('started_at', 0), run_id))
+
+            if not candidates:
+                return None
+
+            candidates.sort(key=lambda item: item[0])
+            return candidates[0][1]
+
+    async def enqueue_steering(
+        self,
+        run_id: str,
+        item: SteeringQueueItem,
+    ) -> bool:
+        """Append one steering item to an active run queue."""
+        async with self._lock:
+            session = self._sessions.get(run_id)
+            if session is None:
+                return False
+            if len(session['steering_queue']) >= MAX_STEERING_QUEUE_ITEMS:
+                return False
+            session['steering_queue'].append(copy.deepcopy(item))
+            session['status']['last_activity_at'] = int(time.time())
+            return True
+
+    async def pull_steering(
+        self,
+        run_id: str,
+        *,
+        mode: str = 'all',
+        limit: int | None = None,
+    ) -> list[SteeringQueueItem]:
+        """Pop pending steering items from a run queue."""
+        async with self._lock:
+            session = self._sessions.get(run_id)
+            if session is None:
+                return []
+
+            queue = session['steering_queue']
+            if not queue:
+                return []
+
+            normalized_mode = str(mode or 'all').lower()
+            if normalized_mode in {'one', 'one-at-a-time', 'one_at_a_time'}:
+                count = 1
+            elif isinstance(limit, int) and limit > 0:
+                count = min(limit, len(queue))
+            else:
+                count = len(queue)
+
+            count = max(0, min(count, len(queue), 100))
+            items = [copy.deepcopy(item) for item in queue[:count]]
+            del queue[:count]
+            session['status']['last_activity_at'] = int(time.time())
+            return items
+
+    def is_resource_allowed(
+        self,
+        session: AgentRunSession,
+        resource_type: str,
+        resource_id: str,
+        operation: str | None = None,
+    ) -> bool:
+        """Check if resource access is allowed for this session.
+
+        Uses pre-computed authorized IDs for O(1) lookup.
+
+        Args:
+            session: AgentRunSession to check
+            resource_type: Resource type ('model', 'tool', 'knowledge_base', 'storage', 'file')
+            resource_id: Resource identifier (model_id, tool_name, kb_id, 'plugin'/'workspace', file_key)
+            operation: Optional operation to check within the authorized resource
+
+        Returns:
+            True if resource is authorized, False otherwise
+        """
+        authorization = session['authorization']
+        authorized_ids = authorization['authorized_ids']
+        resources = authorization['resources']
+
+        if resource_type in ('model', 'tool', 'knowledge_base', 'skill', 'file'):
+            if resource_id not in authorized_ids.get(resource_type, set()):
+                return False
+            if operation is None:
+                return True
+            operation_map = authorization.get('authorized_operations', {})
+            operations = operation_map.get(resource_type, {}).get(resource_id)
+            if not operations:
+                operations = DEFAULT_RESOURCE_OPERATIONS.get(resource_type, set())
+            return operation in operations
+
+        if resource_type == 'storage':
+            storage = resources.get('storage', {})
+            if resource_id == 'plugin':
+                return storage.get('plugin_storage', False)
+            elif resource_id == 'workspace':
+                return storage.get('workspace_storage', False)
+            return False
+
+        return False
+
+    async def list_active_runs(self) -> list[AgentRunSession]:
+        """List all active run sessions.
+
+        Returns:
+            List of active AgentRunSession dicts
+        """
+        async with self._lock:
+            return list(self._sessions.values())
+
+    async def cleanup_stale_sessions(self, max_age_seconds: int = 3600) -> int:
+        """Cleanup sessions that have been inactive for too long.
+
+        Args:
+            max_age_seconds: Maximum inactivity time in seconds (default 1 hour)
+
+        Returns:
+            Number of sessions cleaned up
+        """
+        now = int(time.time())
+        cleaned = 0
+
+        async with self._lock:
+            stale_run_ids = []
+            for run_id, session in self._sessions.items():
+                last_activity = session['status'].get('last_activity_at', 0)
+                if now - last_activity > max_age_seconds:
+                    stale_run_ids.append(run_id)
+
+            for run_id in stale_run_ids:
+                del self._sessions[run_id]
+                cleaned += 1
+
+        return cleaned
+
+
+# Global registry instance (singleton)
+_global_registry: AgentRunSessionRegistry | None = None
+_global_registry_lock = threading.Lock()
+
+
+def get_session_registry() -> AgentRunSessionRegistry:
+    """Get global session registry instance (thread-safe singleton).
+
+    Returns:
+        AgentRunSessionRegistry singleton
+    """
+    global _global_registry
+    with _global_registry_lock:
+        if _global_registry is None:
+            _global_registry = AgentRunSessionRegistry()
+        return _global_registry

src/langbot/pkg/agent/runner/state_scope.py

@@ -0,0 +1,136 @@
+"""State scope key helpers for AgentRunner host-owned state."""
+from __future__ import annotations
+
+import hashlib
+import json
+import typing
+
+from .descriptor import AgentRunnerDescriptor
+from .host_models import AgentBinding, AgentEventEnvelope
+
+
+VALID_STATE_SCOPES = ('conversation', 'actor', 'subject', 'runner')
+
+STATE_KEY_ALIASES = {
+    'conversation_id': 'external.conversation_id',
+}
+
+
+def normalize_state_key(key: str) -> str:
+    """Map accepted public aliases to protocol state keys."""
+    return STATE_KEY_ALIASES.get(key, key)
+
+
+def get_binding_identity(binding: AgentBinding) -> str:
+    """Return the stable binding identity used for state isolation."""
+    if binding.binding_id:
+        return binding.binding_id
+
+    scope = binding.scope
+    if scope.scope_type and scope.scope_id:
+        return f'{scope.scope_type}:{scope.scope_id}'
+
+    return 'unknown_binding'
+
+
+def _scope_hash(scope: str, parts: dict[str, typing.Any]) -> str:
+    """Encode state scope dimensions without separator ambiguity."""
+    payload = {
+        'version': 2,
+        'scope': scope,
+        **parts,
+    }
+    raw = json.dumps(payload, sort_keys=True, separators=(',', ':'), ensure_ascii=False)
+    return f'{scope}:v2:{hashlib.sha256(raw.encode("utf-8")).hexdigest()}'
+
+
+def _base_scope_parts(
+    event: AgentEventEnvelope,
+    binding: AgentBinding,
+    descriptor: AgentRunnerDescriptor,
+) -> dict[str, typing.Any]:
+    return {
+        'runner_id': descriptor.id,
+        'binding_identity': get_binding_identity(binding),
+        'bot_id': event.bot_id,
+        'workspace_id': event.workspace_id,
+    }
+
+
+def build_state_scope_key(
+    scope: str,
+    event: AgentEventEnvelope,
+    binding: AgentBinding,
+    descriptor: AgentRunnerDescriptor,
+) -> str | None:
+    """Build the storage key for one state scope.
+
+    Returns None when the event lacks the identity required by that scope.
+    """
+    base_parts = _base_scope_parts(event, binding, descriptor)
+
+    if scope == 'conversation':
+        if not event.conversation_id:
+            return None
+        return _scope_hash(scope, {
+            **base_parts,
+            'conversation_id': event.conversation_id,
+            'thread_id': event.thread_id,
+        })
+
+    if scope == 'actor':
+        if not event.actor or not event.actor.actor_id:
+            return None
+        return _scope_hash(scope, {
+            **base_parts,
+            'actor_type': event.actor.actor_type or 'user',
+            'actor_id': event.actor.actor_id,
+        })
+
+    if scope == 'subject':
+        if not event.subject or not event.subject.subject_id:
+            return None
+        return _scope_hash(scope, {
+            **base_parts,
+            'subject_type': event.subject.subject_type or 'unknown',
+            'subject_id': event.subject.subject_id,
+        })
+
+    if scope == 'runner':
+        return _scope_hash(scope, base_parts)
+
+    return None
+
+
+def build_state_scope_keys(
+    event: AgentEventEnvelope,
+    binding: AgentBinding,
+    descriptor: AgentRunnerDescriptor,
+) -> dict[str, str]:
+    """Build all available scope keys for an event/binding pair."""
+    scope_keys: dict[str, str] = {}
+    for scope in VALID_STATE_SCOPES:
+        scope_key = build_state_scope_key(scope, event, binding, descriptor)
+        if scope_key:
+            scope_keys[scope] = scope_key
+    return scope_keys
+
+
+def build_state_context(
+    event: AgentEventEnvelope,
+    binding: AgentBinding,
+    descriptor: AgentRunnerDescriptor,
+) -> dict[str, typing.Any]:
+    """Build the State API context stored in the run session."""
+    return {
+        'scope_keys': build_state_scope_keys(event, binding, descriptor),
+        'binding_identity': get_binding_identity(binding),
+        'bot_id': event.bot_id,
+        'workspace_id': event.workspace_id,
+        'conversation_id': event.conversation_id,
+        'thread_id': event.thread_id,
+        'actor_type': event.actor.actor_type if event.actor else None,
+        'actor_id': event.actor.actor_id if event.actor else None,
+        'subject_type': event.subject.subject_type if event.subject else None,
+        'subject_id': event.subject.subject_id if event.subject else None,
+    }

src/langbot/pkg/agent/runner/transcript_store.py

@@ -0,0 +1,426 @@
+"""Transcript store for writing and querying conversation history."""
+from __future__ import annotations
+
+import json
+import datetime
+import typing
+import uuid
+
+import sqlalchemy
+from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession
+from sqlalchemy.orm import sessionmaker
+
+from ...entity.persistence.transcript import Transcript
+from langbot_plugin.api.entities.builtin.provider import message as provider_message
+
+
+UTC = datetime.timezone.utc
+
+
+def _utc_now() -> datetime.datetime:
+    return datetime.datetime.now(UTC)
+
+
+def _datetime_to_epoch(value: datetime.datetime | None) -> int | None:
+    if value is None:
+        return None
+    if value.tzinfo is None:
+        value = value.replace(tzinfo=UTC)
+    else:
+        value = value.astimezone(UTC)
+    return int(value.timestamp())
+
+
+class TranscriptStore:
+    """Store for Transcript records.
+
+    Handles writing transcript items and querying them for history API.
+    All methods are async and use the provided database engine.
+    """
+
+    engine: AsyncEngine
+
+    # Hard limits
+    MAX_CONTENT_LENGTH = 4000
+    HARD_LIMIT = 100
+
+    def __init__(self, engine: AsyncEngine):
+        self.engine = engine
+        self._session_factory = sessionmaker(
+            engine, class_=AsyncSession, expire_on_commit=False
+        )
+
+    async def append_transcript(
+        self,
+        transcript_id: str | None,
+        event_id: str,
+        conversation_id: str,
+        role: str,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        content: str | None = None,
+        content_json: dict[str, typing.Any] | None = None,
+        artifact_refs: list[dict[str, typing.Any]] | None = None,
+        thread_id: str | None = None,
+        item_type: str = "message",
+        run_id: str | None = None,
+        runner_id: str | None = None,
+        metadata: dict[str, typing.Any] | None = None,
+    ) -> str:
+        """Append a transcript item.
+
+        Args:
+            transcript_id: Unique transcript ID (generated if None)
+            event_id: Source event ID
+            conversation_id: Conversation ID
+            role: Message role (user, assistant, system, tool)
+            bot_id: Bot UUID scope
+            workspace_id: Workspace scope
+            content: Text content
+            content_json: Full structured content
+            artifact_refs: Artifact references
+            thread_id: Thread ID
+            item_type: Item type
+            run_id: Run ID that generated this
+            runner_id: Runner ID that generated this
+            metadata: Additional metadata
+
+        Returns:
+            The transcript_id
+        """
+        if transcript_id is None:
+            transcript_id = str(uuid.uuid4())
+
+        # Truncate content if too long
+        if content and len(content) > self.MAX_CONTENT_LENGTH:
+            content = content[:self.MAX_CONTENT_LENGTH - 3] + "..."
+
+        async with self._session_factory() as session:
+            item = Transcript(
+                transcript_id=transcript_id,
+                event_id=event_id,
+                bot_id=bot_id,
+                workspace_id=workspace_id,
+                conversation_id=conversation_id,
+                thread_id=thread_id,
+                role=role,
+                item_type=item_type,
+                content=content,
+                content_json=json.dumps(content_json) if content_json else None,
+                artifact_refs_json=json.dumps(artifact_refs) if artifact_refs else None,
+                seq=0,
+                run_id=run_id,
+                runner_id=runner_id,
+                created_at=_utc_now(),
+                metadata_json=json.dumps(metadata) if metadata else None,
+            )
+            session.add(item)
+            await session.flush()
+            item.seq = item.id or await self._get_next_seq(conversation_id)
+            await session.commit()
+
+        return transcript_id
+
+    async def page_transcript(
+        self,
+        conversation_id: str,
+        before_seq: int | None = None,
+        after_seq: int | None = None,
+        limit: int = 50,
+        direction: str = "backward",
+        include_artifacts: bool = False,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        strict_thread: bool = False,
+    ) -> tuple[list[dict[str, typing.Any]], int | None, int | None, bool]:
+        """Page through transcript items.
+
+        Args:
+            conversation_id: Conversation ID
+            before_seq: Get items before this sequence (backward)
+            after_seq: Get items after this sequence (forward)
+            limit: Maximum items to return (capped at 100)
+            direction: 'backward' (older) or 'forward' (newer)
+            include_artifacts: Include artifact refs
+            bot_id: Optional bot scope filter
+            workspace_id: Optional workspace scope filter
+            thread_id: Optional thread scope filter
+            strict_thread: When true, require thread_id equality including NULL
+
+        Returns:
+            Tuple of (items, next_seq, prev_seq, has_more)
+        """
+        limit = min(limit, self.HARD_LIMIT)
+
+        async with self._session_factory() as session:
+            query = sqlalchemy.select(Transcript).where(
+                Transcript.conversation_id == conversation_id
+            )
+            query = self._apply_scope_filters(query, bot_id, workspace_id, thread_id, strict_thread)
+
+            if direction == "backward" and before_seq is not None:
+                query = query.where(Transcript.seq < before_seq)
+                query = query.order_by(Transcript.seq.desc())
+            elif direction == "forward" and after_seq is not None:
+                query = query.where(Transcript.seq > after_seq)
+                query = query.order_by(Transcript.seq.asc())
+            else:
+                # Default: most recent items first (backward from latest)
+                query = query.order_by(Transcript.seq.desc())
+
+            query = query.limit(limit + 1)
+
+            result = await session.execute(query)
+            rows = result.scalars().all()
+
+            items = [self._row_to_dict(row, include_artifacts) for row in rows[:limit]]
+            has_more = len(rows) > limit
+
+            # Calculate cursors
+            next_seq = None
+            prev_seq = None
+
+            if direction == "backward":
+                # Items are in descending order
+                if items:
+                    next_seq = items[-1].get('seq') if has_more else None
+                    prev_seq = items[0].get('seq')
+            else:
+                # Items are in ascending order
+                if items:
+                    next_seq = items[-1].get('seq') if has_more else None
+                    prev_seq = items[0].get('seq')
+
+            return items, next_seq, prev_seq, has_more
+
+    async def search_transcript(
+        self,
+        conversation_id: str,
+        query_text: str,
+        filters: dict[str, typing.Any] | None = None,
+        top_k: int = 10,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        strict_thread: bool = False,
+    ) -> list[dict[str, typing.Any]]:
+        """Search transcript items.
+
+        Basic implementation using LIKE filtering.
+
+        Args:
+            conversation_id: Conversation ID
+            query_text: Search query
+            filters: Optional filters
+            top_k: Maximum results
+            bot_id: Optional bot scope filter
+            workspace_id: Optional workspace scope filter
+            thread_id: Optional thread scope filter
+            strict_thread: When true, require thread_id equality including NULL
+
+        Returns:
+            List of matching items
+        """
+        async with self._session_factory() as session:
+            query = sqlalchemy.select(Transcript).where(
+                Transcript.conversation_id == conversation_id,
+                Transcript.content.ilike(f"%{query_text}%"),
+            )
+            query = self._apply_scope_filters(query, bot_id, workspace_id, thread_id, strict_thread)
+
+            # Apply additional filters
+            if filters:
+                if 'roles' in filters:
+                    query = query.where(Transcript.role.in_(filters['roles']))
+                if 'item_types' in filters:
+                    query = query.where(Transcript.item_type.in_(filters['item_types']))
+
+            query = query.order_by(Transcript.seq.desc()).limit(top_k)
+
+            result = await session.execute(query)
+            rows = result.scalars().all()
+
+            return [self._row_to_dict(row, include_artifacts=True) for row in rows]
+
+    async def get_latest_cursor(
+        self,
+        conversation_id: str,
+    ) -> str | None:
+        """Get the latest cursor for a conversation.
+
+        Args:
+            conversation_id: Conversation ID
+
+        Returns:
+            Cursor string (seq number), or None if no items
+        """
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(Transcript.seq)
+                .where(Transcript.conversation_id == conversation_id)
+                .order_by(Transcript.seq.desc())
+                .limit(1)
+            )
+            row = result.scalars().first()
+            if row is None:
+                return None
+            return str(row)
+
+    async def get_legacy_provider_messages(
+        self,
+        conversation_id: str,
+        limit: int = HARD_LIMIT,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        strict_thread: bool = False,
+    ) -> list[provider_message.Message]:
+        """Project Transcript rows into the legacy provider Message view.
+
+        AgentRunner history is canonical in Transcript. This view exists for
+        legacy Pipeline readers such as PromptPreProcessing that still expect
+        query.messages.
+        """
+        items, _, _, _ = await self.page_transcript(
+            conversation_id=conversation_id,
+            limit=limit,
+            direction="backward",
+            bot_id=bot_id,
+            workspace_id=workspace_id,
+            thread_id=thread_id,
+            strict_thread=strict_thread,
+        )
+
+        messages: list[provider_message.Message] = []
+        for item in reversed(items):
+            message = self._transcript_item_to_provider_message(item)
+            if message is not None:
+                messages.append(message)
+        return messages
+
+    async def has_history_before(
+        self,
+        conversation_id: str,
+        seq: int,
+        bot_id: str | None = None,
+        workspace_id: str | None = None,
+        thread_id: str | None = None,
+        strict_thread: bool = False,
+    ) -> bool:
+        """Check if there is history before a sequence number.
+
+        Args:
+            conversation_id: Conversation ID
+            seq: Sequence number
+
+        Returns:
+            True if there are items before
+        """
+        async with self._session_factory() as session:
+            query = (
+                sqlalchemy.select(sqlalchemy.func.count())
+                .select_from(Transcript)
+                .where(Transcript.conversation_id == conversation_id, Transcript.seq < seq)
+            )
+            query = self._apply_scope_filters(query, bot_id, workspace_id, thread_id, strict_thread)
+            result = await session.execute(query)
+            count = result.scalar()
+            return count > 0
+
+    def _apply_scope_filters(
+        self,
+        query: typing.Any,
+        bot_id: str | None,
+        workspace_id: str | None,
+        thread_id: str | None,
+        strict_thread: bool,
+    ) -> typing.Any:
+        if bot_id is not None:
+            query = query.where(Transcript.bot_id == bot_id)
+        if workspace_id is not None:
+            query = query.where(Transcript.workspace_id == workspace_id)
+        if strict_thread:
+            if thread_id is None:
+                query = query.where(Transcript.thread_id.is_(None))
+            else:
+                query = query.where(Transcript.thread_id == thread_id)
+        return query
+
+    async def cleanup_transcripts_older_than(
+        self,
+        before: datetime.datetime,
+    ) -> int:
+        """Delete Transcript rows created before the supplied timestamp."""
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.delete(Transcript).where(Transcript.created_at < before)
+            )
+            await session.commit()
+            return result.rowcount or 0
+
+    async def _get_next_seq(self, conversation_id: str) -> int:
+        """Fallback next sequence number for stores that cannot expose autoincrement IDs."""
+        async with self._session_factory() as session:
+            result = await session.execute(
+                sqlalchemy.select(sqlalchemy.func.max(Transcript.seq))
+                .where(Transcript.conversation_id == conversation_id)
+            )
+            max_seq = result.scalar()
+            return (max_seq or 0) + 1
+
+    def _row_to_dict(
+        self,
+        row: Transcript,
+        include_artifacts: bool = False,
+    ) -> dict[str, typing.Any]:
+        """Convert a Transcript row to dict."""
+        result = {
+            'transcript_id': row.transcript_id,
+            'event_id': row.event_id,
+            'bot_id': row.bot_id,
+            'workspace_id': row.workspace_id,
+            'conversation_id': row.conversation_id,
+            'thread_id': row.thread_id,
+            'role': row.role,
+            'item_type': row.item_type,
+            'content': row.content,
+            'content_json': json.loads(row.content_json) if row.content_json else None,
+            'seq': row.seq,
+            'cursor': str(row.seq),
+            'created_at': _datetime_to_epoch(row.created_at),
+            'metadata': json.loads(row.metadata_json) if row.metadata_json else {},
+        }
+
+        if include_artifacts and row.artifact_refs_json:
+            result['artifact_refs'] = json.loads(row.artifact_refs_json)
+        else:
+            result['artifact_refs'] = []
+
+        return result
+
+    def _transcript_item_to_provider_message(
+        self,
+        item: dict[str, typing.Any],
+    ) -> provider_message.Message | None:
+        """Convert one Transcript API item into a provider Message."""
+        if item.get('item_type') != 'message':
+            return None
+
+        role = item.get('role')
+        if role not in {'user', 'assistant'}:
+            return None
+
+        content_json = item.get('content_json')
+        if isinstance(content_json, dict):
+            message_data = dict(content_json)
+            message_data['role'] = role
+            try:
+                return provider_message.Message.model_validate(message_data)
+            except Exception:
+                pass
+
+        content = item.get('content')
+        if content is None:
+            return None
+        return provider_message.Message(role=role, content=content)

src/langbot/pkg/api/http/controller/groups/monitoring.py

@@ -46,6 +46,30 @@ class MonitoringRouterGroup(group.RouterGroup):
 
             return self.success(data=metrics)
 
+        @self.route('/token-statistics', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+        async def get_token_statistics() -> str:
+            """Get detailed token usage statistics (summary, per-model, timeseries)."""
+            bot_ids = quart.request.args.getlist('botId')
+            pipeline_ids = quart.request.args.getlist('pipelineId')
+            start_time_str = quart.request.args.get('startTime')
+            end_time_str = quart.request.args.get('endTime')
+            bucket = quart.request.args.get('bucket', 'hour')
+            if bucket not in ('hour', 'day'):
+                bucket = 'hour'
+
+            start_time = parse_iso_datetime(start_time_str)
+            end_time = parse_iso_datetime(end_time_str)
+
+            stats = await self.ap.monitoring_service.get_token_statistics(
+                bot_ids=bot_ids if bot_ids else None,
+                pipeline_ids=pipeline_ids if pipeline_ids else None,
+                start_time=start_time,
+                end_time=end_time,
+                bucket=bucket,
+            )
+
+            return self.success(data=stats)
+
         @self.route('/messages', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
         async def get_messages() -> str:
             """Get message logs"""

src/langbot/pkg/api/http/controller/groups/plugins.py

@@ -271,6 +271,20 @@ class PluginsRouterGroup(group.RouterGroup):
             readme = await self.ap.plugin_connector.get_plugin_readme(author, plugin_name, language=language)
             return self.success(data={'readme': readme})
 
+        @self.route(
+            '/<author>/<plugin_name>/logs',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+        )
+        async def _(author: str, plugin_name: str) -> quart.Response:
+            try:
+                limit = int(quart.request.args.get('limit', 200))
+            except (TypeError, ValueError):
+                limit = 200
+            level = quart.request.args.get('level') or None
+            logs = await self.ap.plugin_connector.get_plugin_logs(author, plugin_name, limit=limit, level=level)
+            return self.success(data={'logs': logs})
+
         @self.route(
             '/<author>/<plugin_name>/icon',
             methods=['GET'],

src/langbot/pkg/api/http/service/bot.py

@@ -5,7 +5,6 @@ import sqlalchemy
 import typing
 
 from ....core import app
-from ....discover import engine
 from ....entity.persistence import bot as persistence_bot
 from ....entity.persistence import pipeline as persistence_pipeline
 
@@ -18,24 +17,6 @@ class BotService:
     def __init__(self, ap: app.Application) -> None:
         self.ap = ap
 
-    def _get_adapter_component(self, adapter_name: str) -> engine.Component | None:
-        """Return the discovered platform adapter component for an adapter name."""
-        for component in self.ap.discover.get_components_by_kind('MessagePlatformAdapter'):
-            if component.metadata.name == adapter_name:
-                return component
-        return None
-
-    def _adapter_declares_webhook_url(self, adapter_name: str) -> bool:
-        """Whether the adapter manifest declares a generated webhook URL config item."""
-        component = self._get_adapter_component(adapter_name)
-        if component is None:
-            return False
-
-        for config_item in component.spec.get('config', []):
-            if config_item.get('type') == 'webhook-url':
-                return True
-        return False
-
     async def get_bots(self, include_secret: bool = True) -> list[dict]:
         """获取所有机器人"""
         result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(persistence_bot.Bot))
@@ -77,10 +58,17 @@ class BotService:
         if runtime_bot is not None:
             adapter_runtime_values['bot_account_id'] = runtime_bot.adapter.bot_account_id
 
-        # Webhook URL for adapters that declare a generated webhook config item.
+        # Webhook URL for unified webhook adapters (independent of bot running state)
-        # This is manifest-driven so EBA adapters do not need to be mirrored in a
+        if persistence_bot['adapter'] in [
-        # second hard-coded list.
+            'wecom',
-        if self._adapter_declares_webhook_url(persistence_bot['adapter']):
+            'wecombot',
+            'officialaccount',
+            'qqofficial',
+            'slack',
+            'wecomcs',
+            'LINE',
+            'lark',
+        ]:
             webhook_prefix = self.ap.instance_config.data['api'].get('webhook_prefix', 'http://127.0.0.1:5300')
             extra_webhook_prefix = self.ap.instance_config.data['api'].get('extra_webhook_prefix', '')
             webhook_url = f'/bots/{bot_uuid}'

src/langbot/pkg/api/http/service/model.py

@@ -7,7 +7,6 @@ from langbot_plugin.api.entities.builtin.provider import message as provider_mes
 
 from ....core import app
 from ....entity.persistence import model as persistence_model
-from ....entity.persistence import pipeline as persistence_pipeline
 from ....provider.modelmgr import requester as model_requester
 
 
@@ -34,6 +33,46 @@ def _runtime_model_data(model_uuid: str, model_data: dict) -> dict:
     return {**model_data, 'uuid': model_uuid}
 
 
+async def _validate_provider_supports(ap: app.Application, provider_uuid: str, model_type: str) -> None:
+    """Validate that the provider's requester declares support for ``model_type``.
+
+    ``model_type`` is one of the manifest ``support_type`` values:
+    'llm', 'text-embedding', 'rerank'. Raises ValueError when the requester
+    manifest does not list the requested type. This is a server-side guard so
+    a model cannot be attached to a provider that does not support it, even if
+    the frontend tab restriction is bypassed.
+    """
+    model_mgr = getattr(ap, 'model_mgr', None)
+    if model_mgr is None:
+        return
+
+    provider_dict = getattr(model_mgr, 'provider_dict', None)
+    if not provider_dict:
+        return
+    runtime_provider = provider_dict.get(provider_uuid)
+    if runtime_provider is None:
+        return
+
+    requester_name = getattr(getattr(runtime_provider, 'provider_entity', None), 'requester', None)
+    if not requester_name:
+        return
+
+    get_manifest = getattr(model_mgr, 'get_available_requester_manifest_by_name', None)
+    if not callable(get_manifest):
+        return
+    manifest = get_manifest(requester_name)
+    if manifest is None:
+        return
+
+    spec = getattr(manifest, 'spec', None) or {}
+    support_type = spec.get('support_type') if isinstance(spec, dict) else None
+    # When a manifest omits support_type, do not block (backward compatible).
+    if not support_type:
+        return
+    if model_type not in support_type:
+        raise ValueError(f'Provider requester "{requester_name}" does not support {model_type} models')
+
+
 class LLMModelsService:
     ap: app.Application
 
@@ -96,6 +135,8 @@ class LLMModelsService:
                 )
                 model_data['provider_uuid'] = provider_uuid
 
+        await _validate_provider_supports(self.ap, model_data['provider_uuid'], 'llm')
+
         await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_model.LLMModel).values(**model_data))
 
         runtime_provider = self.ap.model_mgr.provider_dict.get(model_data['provider_uuid'])
@@ -109,23 +150,9 @@ class LLMModelsService:
         self.ap.model_mgr.llm_models.append(runtime_llm_model)
 
         if auto_set_to_default_pipeline:
-            # set the default pipeline model to this model
+            default_config_service = getattr(self.ap, 'agent_runner_default_config_service', None)
-            result = await self.ap.persistence_mgr.execute_async(
+            if default_config_service is not None:
-                sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
+                await default_config_service.auto_set_default_pipeline_llm_model(model_data['uuid'])
-                    persistence_pipeline.LegacyPipeline.is_default == True
-                )
-            )
-            pipeline = result.first()
-            if pipeline is not None:
-                model_config = pipeline.config.get('ai', {}).get('local-agent', {}).get('model', {})
-                if not model_config.get('primary', ''):
-                    pipeline_config = pipeline.config
-                    pipeline_config['ai']['local-agent']['model'] = {
-                        'primary': model_data['uuid'],
-                        'fallbacks': [],
-                    }
-                    pipeline_data = {'config': pipeline_config}
-                    await self.ap.pipeline_service.update_pipeline(pipeline.uuid, pipeline_data)
 
         return model_data['uuid']
 
@@ -274,6 +301,8 @@ class EmbeddingModelsService:
                 )
                 model_data['provider_uuid'] = provider_uuid
 
+        await _validate_provider_supports(self.ap, model_data['provider_uuid'], 'text-embedding')
+
         await self.ap.persistence_mgr.execute_async(
             sqlalchemy.insert(persistence_model.EmbeddingModel).values(**model_data)
         )
@@ -434,6 +463,8 @@ class RerankModelsService:
                 )
                 model_data['provider_uuid'] = provider_uuid
 
+        await _validate_provider_supports(self.ap, model_data['provider_uuid'], 'rerank')
+
         await self.ap.persistence_mgr.execute_async(
             sqlalchemy.insert(persistence_model.RerankModel).values(**model_data)
         )

src/langbot/pkg/api/http/service/monitoring.py

@@ -472,6 +472,179 @@ class MonitoringService:
             'active_sessions': active_sessions,
         }
 
+    async def get_token_statistics(
+        self,
+        bot_ids: list[str] | None = None,
+        pipeline_ids: list[str] | None = None,
+        start_time: datetime.datetime | None = None,
+        end_time: datetime.datetime | None = None,
+        bucket: str = 'hour',
+    ) -> dict:
+        """Get detailed token usage statistics for production observability.
+
+        Returns:
+        - summary: aggregate token counters and call/latency stats over the window
+        - by_model: per-model token + call breakdown (sorted by total tokens desc)
+        - timeseries: token usage bucketed by `bucket` ('hour' or 'day')
+
+        Only successful LLM calls are counted toward token totals; error calls are
+        reported separately so a spike in failures is visible without polluting
+        token accounting.
+        """
+        LLMCall = persistence_monitoring.MonitoringLLMCall
+
+        conditions = []
+        if bot_ids:
+            conditions.append(LLMCall.bot_id.in_(bot_ids))
+        if pipeline_ids:
+            conditions.append(LLMCall.pipeline_id.in_(pipeline_ids))
+        if start_time:
+            conditions.append(LLMCall.timestamp >= start_time)
+        if end_time:
+            conditions.append(LLMCall.timestamp <= end_time)
+
+        def _apply(query):
+            if conditions:
+                query = query.where(sqlalchemy.and_(*conditions))
+            return query
+
+        # ---- Summary aggregates ----
+        summary_query = _apply(
+            sqlalchemy.select(
+                sqlalchemy.func.count(LLMCall.id),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.input_tokens), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.output_tokens), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.total_tokens), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.duration), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.cost), 0.0),
+                sqlalchemy.func.sum(sqlalchemy.case((LLMCall.status == 'success', 1), else_=0)),
+                sqlalchemy.func.sum(sqlalchemy.case((LLMCall.status == 'error', 1), else_=0)),
+                # Count of successful calls that nonetheless recorded zero tokens —
+                # a data-quality signal that usage reporting may be broken upstream.
+                sqlalchemy.func.sum(
+                    sqlalchemy.case(
+                        (sqlalchemy.and_(LLMCall.status == 'success', LLMCall.total_tokens == 0), 1),
+                        else_=0,
+                    )
+                ),
+            )
+        )
+        summary_result = await self.ap.persistence_mgr.execute_async(summary_query)
+        row = summary_result.first()
+        (
+            total_calls,
+            total_input_tokens,
+            total_output_tokens,
+            total_tokens,
+            total_duration,
+            total_cost,
+            success_calls,
+            error_calls,
+            zero_token_success_calls,
+        ) = row if row else (0, 0, 0, 0, 0, 0.0, 0, 0, 0)
+
+        total_calls = total_calls or 0
+        success_calls = success_calls or 0
+        error_calls = error_calls or 0
+        zero_token_success_calls = zero_token_success_calls or 0
+
+        summary = {
+            'total_calls': total_calls,
+            'success_calls': success_calls,
+            'error_calls': error_calls,
+            'total_input_tokens': int(total_input_tokens or 0),
+            'total_output_tokens': int(total_output_tokens or 0),
+            'total_tokens': int(total_tokens or 0),
+            'total_cost': round(float(total_cost or 0.0), 6),
+            'avg_tokens_per_call': int((total_tokens or 0) / total_calls) if total_calls > 0 else 0,
+            'avg_duration_ms': int((total_duration or 0) / total_calls) if total_calls > 0 else 0,
+            'avg_tokens_per_second': round((total_output_tokens or 0) / (total_duration / 1000), 2)
+            if total_duration and total_duration > 0
+            else 0,
+            'zero_token_success_calls': zero_token_success_calls,
+        }
+
+        # ---- Per-model breakdown ----
+        by_model_query = _apply(
+            sqlalchemy.select(
+                LLMCall.model_name,
+                sqlalchemy.func.count(LLMCall.id),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.input_tokens), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.output_tokens), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.total_tokens), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.duration), 0),
+                sqlalchemy.func.coalesce(sqlalchemy.func.sum(LLMCall.cost), 0.0),
+                sqlalchemy.func.sum(sqlalchemy.case((LLMCall.status == 'error', 1), else_=0)),
+            ).group_by(LLMCall.model_name)
+        )
+        by_model_result = await self.ap.persistence_mgr.execute_async(by_model_query)
+        by_model = []
+        for mrow in by_model_result.all():
+            (
+                model_name,
+                m_calls,
+                m_in,
+                m_out,
+                m_total,
+                m_duration,
+                m_cost,
+                m_errors,
+            ) = mrow
+            m_calls = m_calls or 0
+            by_model.append(
+                {
+                    'model_name': model_name,
+                    'calls': m_calls,
+                    'error_calls': m_errors or 0,
+                    'input_tokens': int(m_in or 0),
+                    'output_tokens': int(m_out or 0),
+                    'total_tokens': int(m_total or 0),
+                    'cost': round(float(m_cost or 0.0), 6),
+                    'avg_tokens_per_call': int((m_total or 0) / m_calls) if m_calls > 0 else 0,
+                    'avg_duration_ms': int((m_duration or 0) / m_calls) if m_calls > 0 else 0,
+                }
+            )
+        by_model.sort(key=lambda x: x['total_tokens'], reverse=True)
+
+        # ---- Time-bucketed series ----
+        # Use a DB-agnostic bucketing approach: fetch (timestamp, tokens) rows and
+        # aggregate in Python. The window is bounded by the time filter, so this is
+        # cheap for typical dashboard ranges (hours/days).
+        series_query = _apply(
+            sqlalchemy.select(
+                LLMCall.timestamp,
+                LLMCall.input_tokens,
+                LLMCall.output_tokens,
+                LLMCall.total_tokens,
+            ).order_by(LLMCall.timestamp.asc())
+        )
+        series_result = await self.ap.persistence_mgr.execute_async(series_query)
+
+        bucket_fmt = '%Y-%m-%d %H:00' if bucket == 'hour' else '%Y-%m-%d'
+        buckets: dict[str, dict] = {}
+        for srow in series_result.all():
+            ts, s_in, s_out, s_total = srow
+            if ts is None:
+                continue
+            key = ts.strftime(bucket_fmt)
+            b = buckets.setdefault(
+                key,
+                {'bucket': key, 'input_tokens': 0, 'output_tokens': 0, 'total_tokens': 0, 'calls': 0},
+            )
+            b['input_tokens'] += int(s_in or 0)
+            b['output_tokens'] += int(s_out or 0)
+            b['total_tokens'] += int(s_total or 0)
+            b['calls'] += 1
+
+        timeseries = [buckets[k] for k in sorted(buckets.keys())]
+
+        return {
+            'summary': summary,
+            'by_model': by_model,
+            'timeseries': timeseries,
+            'bucket': bucket,
+        }
+
     async def get_messages(
         self,
         bot_ids: list[str] | None = None,

src/langbot/pkg/api/http/service/pipeline.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import uuid
 import json
 import sqlalchemy
+import typing
 
 from ....core import app
 from ....entity.persistence import pipeline as persistence_pipeline
@@ -13,7 +14,6 @@ default_stage_order = [
     'BanSessionCheckStage',  # 封禁会话检查
     'PreContentFilterStage',  # 内容过滤前置阶段
     'PreProcessor',  # 预处理器
-    'ConversationMessageTruncator',  # 会话消息截断器
     'RequireRateLimitOccupancy',  # 请求速率限制占用
     'MessageProcessor',  # 处理器
     'ReleaseRateLimitOccupancy',  # 释放速率限制占用
@@ -30,11 +30,100 @@ class PipelineService:
     def __init__(self, ap: app.Application) -> None:
         self.ap = ap
 
+    def _get_default_values_from_schema(self, config_schema: list[dict[str, typing.Any]]) -> dict[str, typing.Any]:
+        """Build runner config defaults from a DynamicForm schema."""
+        defaults: dict[str, typing.Any] = {}
+        for item in config_schema:
+            name = item.get('name')
+            if not name:
+                continue
+            if 'default' in item:
+                defaults[name] = item['default']
+        return defaults
+
+    async def get_default_pipeline_config(self) -> dict[str, typing.Any]:
+        """Get the default pipeline config, rendering runner defaults from installed plugins."""
+        from ....utils import paths as path_utils
+
+        template_path = path_utils.get_resource_path('templates/default-pipeline-config.json')
+        with open(template_path, 'r', encoding='utf-8') as f:
+            config = json.load(f)
+
+        agent_runner_registry = getattr(self.ap, 'agent_runner_registry', None)
+        if agent_runner_registry is None:
+            return config
+
+        try:
+            runners = await agent_runner_registry.list_runners(bound_plugins=None)
+        except Exception as e:
+            logger = getattr(self.ap, 'logger', None)
+            if logger:
+                logger.warning(f'Failed to load plugin agent runners for default pipeline config: {e}')
+            return config
+
+        if not runners:
+            return config
+
+        selected_runner = runners[0]
+        ai_config = config.setdefault('ai', {})
+        runner_config = ai_config.setdefault('runner', {})
+        runner_config['id'] = selected_runner.id
+        runner_config.setdefault('expire-time', 0)
+
+        ai_config['runner_config'] = {
+            selected_runner.id: self._get_default_values_from_schema(selected_runner.config_schema),
+        }
+
+        return config
+
     async def get_pipeline_metadata(self) -> list[dict]:
+        """Get pipeline metadata with dynamically loaded plugin runners from registry"""
+        import copy
+
+        # Deep copy AI metadata to avoid modifying the original
+        ai_metadata = copy.deepcopy(self.ap.pipeline_config_meta_ai)
+
+        # Find the runner stage
+        runner_stage = None
+        for stage in ai_metadata.get('stages', []):
+            if stage.get('name') == 'runner':
+                runner_stage = stage
+                break
+
+        if runner_stage:
+            # Find the runner select config (now uses 'id' field)
+            for config_item in runner_stage.get('config', []):
+                if config_item.get('name') == 'id':
+                    # Get plugin agent runners from registry
+                    try:
+                        (
+                            runner_options,
+                            runner_stages,
+                        ) = await self.ap.agent_runner_registry.get_runner_metadata_for_pipeline()
+
+                        # Replace options entirely with registry options
+                        # Only installed/available runners should be shown
+                        config_item['options'] = runner_options
+
+                        # Use the registry order as the default order. If no runner is available, leave
+                        # the default unset so the UI can recommend installing an AgentRunner plugin.
+                        if runner_options and 'default' not in config_item:
+                            config_item['default'] = runner_options[0]['name']
+
+                        # Add corresponding stage configuration for each runner
+                        for stage_config in runner_stages:
+                            # Avoid duplicate stages
+                            existing_stage_names = {s.get('name') for s in ai_metadata.get('stages', [])}
+                            if stage_config['name'] not in existing_stage_names:
+                                ai_metadata['stages'].append(stage_config)
+
+                    except Exception as e:
+                        self.ap.logger.warning(f'Failed to load plugin agent runners from registry: {e}')
+
         return [
             self.ap.pipeline_config_meta_trigger,
             self.ap.pipeline_config_meta_safety,
-            self.ap.pipeline_config_meta_ai,
+            ai_metadata,
             self.ap.pipeline_config_meta_output,
         ]
 
@@ -74,8 +163,6 @@ class PipelineService:
         return self.ap.persistence_mgr.serialize_model(persistence_pipeline.LegacyPipeline, pipeline)
 
     async def create_pipeline(self, pipeline_data: dict, default: bool = False) -> str:
-        from ....utils import paths as path_utils
-
         # Check limitation
         limitation = self.ap.instance_config.data.get('system', {}).get('limitation', {})
         max_pipelines = limitation.get('max_pipelines', -1)
@@ -89,9 +176,7 @@ class PipelineService:
         pipeline_data['stages'] = default_stage_order.copy()
         pipeline_data['is_default'] = default
 
-        template_path = path_utils.get_resource_path('templates/default-pipeline-config.json')
+        pipeline_data['config'] = await self.get_default_pipeline_config()
-        with open(template_path, 'r', encoding='utf-8') as f:
-            pipeline_data['config'] = json.load(f)
 
         # Ensure extensions_preferences is set with enable_all_plugins and enable_all_mcp_servers=True by default
         if 'extensions_preferences' not in pipeline_data:
@@ -113,10 +198,16 @@ class PipelineService:
         return pipeline_data['uuid']
 
     async def update_pipeline(self, pipeline_uuid: str, pipeline_data: dict) -> None:
+        from ....agent.runner.config_migration import ConfigMigration
+
         pipeline_data = pipeline_data.copy()
         for protected_field in ('uuid', 'for_version', 'stages', 'is_default'):
             pipeline_data.pop(protected_field, None)
 
+        # Migrate config to new format before saving
+        if 'config' in pipeline_data:
+            pipeline_data['config'] = ConfigMigration.migrate_pipeline_config(pipeline_data['config'])
+
         await self.ap.persistence_mgr.execute_async(
             sqlalchemy.update(persistence_pipeline.LegacyPipeline)
             .where(persistence_pipeline.LegacyPipeline.uuid == pipeline_uuid)

src/langbot/pkg/api/http/service/user.py

@@ -82,7 +82,7 @@ class UserService:
         payload = {
             'user': user_email,
             'iss': 'LangBot-' + constants.edition,
-            'exp': datetime.datetime.now() + datetime.timedelta(seconds=jwt_expire),
+            'exp': datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(seconds=jwt_expire),
         }
 
         return jwt.encode(payload, jwt_secret, algorithm='HS256')

src/langbot/pkg/box/service.py

@@ -12,6 +12,7 @@ import pydantic
 
 from langbot_plugin.box.client import BoxRuntimeClient
 from .connector import BoxRuntimeConnector, _get_box_config
+from ..telemetry import features as telemetry_features
 from langbot_plugin.box.errors import BoxError, BoxValidationError
 from langbot_plugin.box.models import (
     BUILTIN_PROFILES,
@@ -218,6 +219,7 @@ class BoxService:
             f'query_id={query.query_id} '
             f'summary={json.dumps(self._summarize_result(result), ensure_ascii=False)}'
         )
+        telemetry_features.increment(query, 'sandbox', 'execs')
         return self._serialize_result(result)
 
     def resolve_box_session_id(self, query: pipeline_query.Query) -> str:
@@ -234,12 +236,18 @@ class BoxService:
         if forced_template:
             template = forced_template
         else:
-            template = (
+            template = '{launcher_type}_{launcher_id}'
-                (query.pipeline_config or {})
+            pipeline_config = query.pipeline_config or {}
-                .get('ai', {})
+            ai_config = pipeline_config.get('ai', {}) if isinstance(pipeline_config, dict) else {}
-                .get('local-agent', {})
+            runner_selector = ai_config.get('runner', {}) if isinstance(ai_config, dict) else {}
-                .get('box-session-id-template', '{launcher_type}_{launcher_id}')
+            runner_id = runner_selector.get('id') if isinstance(runner_selector, dict) else None
+            runner_configs = ai_config.get('runner_config', {}) if isinstance(ai_config, dict) else {}
+            runner_config = runner_configs.get(runner_id, {}) if isinstance(runner_configs, dict) else {}
+            configured_template = (
+                runner_config.get('box-session-id-template') if isinstance(runner_config, dict) else None
             )
+            if isinstance(configured_template, str) and configured_template:
+                template = configured_template
         variables = dict(query.variables or {})
         launcher_type = getattr(query, 'launcher_type', None)
         if hasattr(launcher_type, 'value'):
@@ -785,6 +793,7 @@ class BoxService:
     # ── Observability ─────────────────────────────────────────────────
 
     def _record_error(self, exc: Exception, query: pipeline_query.Query):
+        telemetry_features.increment(query, 'sandbox', 'errors')
         self._recent_errors.append(
             {
                 'timestamp': _dt.datetime.now(_UTC).isoformat(),
@@ -800,8 +809,8 @@ class BoxService:
     def get_system_guidance(self) -> str:
         """Return LLM system-prompt guidance for the exec tool.
 
-        All execution-specific prompt text is kept here so that callers
+        All execution-specific prompt text is kept here so that callers stay
-        (e.g. LocalAgentRunner) stay free of box domain knowledge.
+        free of box domain knowledge.
         """
         guidance = (
             'When the exec tool is available, use it for exact calculations, statistics, structured data parsing, '

src/langbot/pkg/box/workspace.py

@@ -146,13 +146,19 @@ def wrap_python_command_with_env(command: str, *, mount_path: str = '/workspace'
         _LB_PIP_CACHE_DIR="{mount_path}/.cache/pip"
 
         mkdir -p "$_LB_META_DIR" "$_LB_TMP_DIR" "$_LB_PIP_CACHE_DIR"
+        _LB_SYSTEM_PYTHON="$(command -v python3 || command -v python || true)"
+        if [ -z "$_LB_SYSTEM_PYTHON" ]; then
+          echo "python3 or python is required to prepare the workspace Python environment" >&2
+          exit 127
+        fi
+
         export TMPDIR="$_LB_TMP_DIR"
         export TEMP="$_LB_TMP_DIR"
         export TMP="$_LB_TMP_DIR"
         export PIP_CACHE_DIR="$_LB_PIP_CACHE_DIR"
 
         _lb_python_meta() {{
-          python - <<'PY'
+          "$_LB_SYSTEM_PYTHON" - <<'PY'
         import hashlib
         import json
         import os
@@ -201,15 +207,26 @@ def wrap_python_command_with_env(command: str, *, mount_path: str = '/workspace'
           _LB_LOCK_WAIT=0
           while ! mkdir "$_LB_LOCK_DIR" 2>/dev/null; do
             if [ "$_LB_LOCK_WAIT" -ge 120 ]; then
+              _LB_LOCK_OWNER="$(cat "$_LB_LOCK_DIR/pid" 2>/dev/null || true)"
+              if [ -n "$_LB_LOCK_OWNER" ] && kill -0 "$_LB_LOCK_OWNER" 2>/dev/null; then
+                echo "Timed out waiting for active Python environment lock: $_LB_LOCK_DIR" >&2
+                exit 1
+              fi
+              echo "Timed out waiting for Python environment lock, clearing stale lock: $_LB_LOCK_DIR" >&2
+              rm -rf "$_LB_LOCK_DIR" 2>/dev/null || true
+              if mkdir "$_LB_LOCK_DIR" 2>/dev/null; then
+                break
+              fi
               echo "Timed out waiting for Python environment lock: $_LB_LOCK_DIR" >&2
               exit 1
             fi
             sleep 1
             _LB_LOCK_WAIT=$((_LB_LOCK_WAIT + 1))
           done
+          printf '%s\\n' "$$" > "$_LB_LOCK_DIR/pid" 2>/dev/null || true
 
           _lb_cleanup_lock() {{
-            rmdir "$_LB_LOCK_DIR" >/dev/null 2>&1 || true
+            rm -rf "$_LB_LOCK_DIR" >/dev/null 2>&1 || true
           }}
           trap _lb_cleanup_lock EXIT INT TERM
 
@@ -225,7 +242,7 @@ def wrap_python_command_with_env(command: str, *, mount_path: str = '/workspace'
 
           if [ "$_LB_NEEDS_BOOTSTRAP" -eq 1 ]; then
             rm -rf "$_LB_VENV_DIR"
-            python -m venv "$_LB_VENV_DIR"
+            "$_LB_SYSTEM_PYTHON" -m venv "$_LB_VENV_DIR"
             . "$_LB_VENV_DIR/bin/activate"
             python -m pip install --upgrade pip setuptools wheel
             if [ -f "{mount_path}/requirements.txt" ]; then

src/langbot/pkg/core/app.py

@@ -4,6 +4,7 @@ import logging
 import asyncio
 import traceback
 import os
+from typing import TYPE_CHECKING
 
 from ..platform import botmgr as im_mgr
 from ..platform.webhook_pusher import WebhookPusher
@@ -46,6 +47,9 @@ from ..telemetry import telemetry as telemetry_module
 from ..survey import manager as survey_module
 from ..skill import manager as skill_mgr
 
+if TYPE_CHECKING:
+    from ..agent.runner import AgentRunnerRegistry, AgentRunOrchestrator, AgentRunnerDefaultConfigService
+
 
 class Application:
     """Runtime application object and context"""
@@ -165,6 +169,13 @@ class Application:
 
     maintenance_service: maintenance_service.MaintenanceService = None
 
+    # Agent runner subsystem
+    agent_runner_registry: AgentRunnerRegistry = None
+
+    agent_runner_default_config_service: AgentRunnerDefaultConfigService = None
+
+    agent_run_orchestrator: AgentRunOrchestrator = None
+
     def __init__(self):
         pass
 
@@ -200,6 +211,17 @@ class Application:
                 scopes=[core_entities.LifecycleControlScope.APPLICATION],
             )
 
+            # Telemetry instance heartbeat (startup + daily); respects
+            # space.disable_telemetry via TelemetryManager.send().
+            if self.telemetry is not None:
+                from ..telemetry import heartbeat as telemetry_heartbeat
+
+                self.task_mgr.create_task(
+                    telemetry_heartbeat.heartbeat_loop(self),
+                    name='telemetry-heartbeat',
+                    scopes=[core_entities.LifecycleControlScope.APPLICATION],
+                )
+
             # Start monitoring data cleanup task if enabled
             monitoring_cfg = self.instance_config.data.get('monitoring', {})
             auto_cleanup_cfg = monitoring_cfg.get('auto_cleanup', {})

src/langbot/pkg/core/boot.py

@@ -16,7 +16,6 @@ importutil.import_modules_in_pkg(stages)
 
 stage_order = [
     'LoadConfigStage',
-    'MigrationStage',
     'GenKeysStage',
     'SetupLoggerStage',
     'BuildAppStage',

src/langbot/pkg/core/bootutils/deps.py

@@ -42,6 +42,7 @@ required_deps = {
     'telegramify_markdown': 'telegramify-markdown',
     'slack_sdk': 'slack_sdk',
     'asyncpg': 'asyncpg',
+    'litellm': 'litellm',
 }
 
 

src/langbot/pkg/core/migration.py

@@ -1,45 +0,0 @@
-from __future__ import annotations
-
-import abc
-import typing
-
-from . import app
-
-
-preregistered_migrations: list[typing.Type[Migration]] = []
-"""Currently not supported for extension"""
-
-
-def migration_class(name: str, number: int):
-    """Register a migration"""
-
-    def decorator(cls: typing.Type[Migration]) -> typing.Type[Migration]:
-        cls.name = name
-        cls.number = number
-        preregistered_migrations.append(cls)
-        return cls
-
-    return decorator
-
-
-class Migration(abc.ABC):
-    """A version migration"""
-
-    name: str
-
-    number: int
-
-    ap: app.Application
-
-    def __init__(self, ap: app.Application):
-        self.ap = ap
-
-    @abc.abstractmethod
-    async def need_migrate(self) -> bool:
-        """Determine if the current environment needs to run this migration"""
-        pass
-
-    @abc.abstractmethod
-    async def run(self):
-        """Run migration"""
-        pass

src/langbot/pkg/core/migrations/m001_sensitive_word_migration.py

@@ -1,24 +0,0 @@
-from __future__ import annotations
-
-import os
-
-from .. import migration
-
-
-@migration.migration_class('sensitive-word-migration', 1)
-class SensitiveWordMigration(migration.Migration):
-    """敏感词迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return os.path.exists('data/config/sensitive-words.json') and not os.path.exists(
-            'data/metadata/sensitive-words.json'
-        )
-
-    async def run(self):
-        """执行迁移"""
-        # 移动文件
-        os.rename('data/config/sensitive-words.json', 'data/metadata/sensitive-words.json')
-
-        # 重新加载配置
-        await self.ap.sensitive_meta.load_config()

src/langbot/pkg/core/migrations/m002_openai_config_migration.py

@@ -1,44 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('openai-config-migration', 2)
-class OpenAIConfigMigration(migration.Migration):
-    """OpenAI配置迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'openai-config' in self.ap.provider_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-        old_openai_config = self.ap.provider_cfg.data['openai-config'].copy()
-
-        if 'keys' not in self.ap.provider_cfg.data:
-            self.ap.provider_cfg.data['keys'] = {}
-
-        if 'openai' not in self.ap.provider_cfg.data['keys']:
-            self.ap.provider_cfg.data['keys']['openai'] = []
-
-        self.ap.provider_cfg.data['keys']['openai'] = old_openai_config['api-keys']
-
-        self.ap.provider_cfg.data['model'] = old_openai_config['chat-completions-params']['model']
-
-        del old_openai_config['chat-completions-params']['model']
-
-        if 'requester' not in self.ap.provider_cfg.data:
-            self.ap.provider_cfg.data['requester'] = {}
-
-        if 'openai-chat-completions' not in self.ap.provider_cfg.data['requester']:
-            self.ap.provider_cfg.data['requester']['openai-chat-completions'] = {}
-
-        self.ap.provider_cfg.data['requester']['openai-chat-completions'] = {
-            'base-url': old_openai_config['base_url'],
-            'args': old_openai_config['chat-completions-params'],
-            'timeout': old_openai_config['request-timeout'],
-        }
-
-        del self.ap.provider_cfg.data['openai-config']
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m003_anthropic_requester_cfg_completion.py

@@ -1,29 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('anthropic-requester-config-completion', 3)
-class AnthropicRequesterConfigCompletionMigration(migration.Migration):
-    """OpenAI配置迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return (
-            'anthropic-messages' not in self.ap.provider_cfg.data['requester']
-            or 'anthropic' not in self.ap.provider_cfg.data['keys']
-        )
-
-    async def run(self):
-        """执行迁移"""
-        if 'anthropic-messages' not in self.ap.provider_cfg.data['requester']:
-            self.ap.provider_cfg.data['requester']['anthropic-messages'] = {
-                'base-url': 'https://api.anthropic.com',
-                'args': {'max_tokens': 1024},
-                'timeout': 120,
-            }
-
-        if 'anthropic' not in self.ap.provider_cfg.data['keys']:
-            self.ap.provider_cfg.data['keys']['anthropic'] = []
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m004_moonshot_cfg_completion.py

@@ -1,29 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('moonshot-config-completion', 4)
-class MoonshotConfigCompletionMigration(migration.Migration):
-    """OpenAI配置迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return (
-            'moonshot-chat-completions' not in self.ap.provider_cfg.data['requester']
-            or 'moonshot' not in self.ap.provider_cfg.data['keys']
-        )
-
-    async def run(self):
-        """执行迁移"""
-        if 'moonshot-chat-completions' not in self.ap.provider_cfg.data['requester']:
-            self.ap.provider_cfg.data['requester']['moonshot-chat-completions'] = {
-                'base-url': 'https://api.moonshot.cn/v1',
-                'args': {},
-                'timeout': 120,
-            }
-
-        if 'moonshot' not in self.ap.provider_cfg.data['keys']:
-            self.ap.provider_cfg.data['keys']['moonshot'] = []
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m005_deepseek_cfg_completion.py

@@ -1,29 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('deepseek-config-completion', 5)
-class DeepseekConfigCompletionMigration(migration.Migration):
-    """OpenAI配置迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return (
-            'deepseek-chat-completions' not in self.ap.provider_cfg.data['requester']
-            or 'deepseek' not in self.ap.provider_cfg.data['keys']
-        )
-
-    async def run(self):
-        """执行迁移"""
-        if 'deepseek-chat-completions' not in self.ap.provider_cfg.data['requester']:
-            self.ap.provider_cfg.data['requester']['deepseek-chat-completions'] = {
-                'base-url': 'https://api.deepseek.com',
-                'args': {},
-                'timeout': 120,
-            }
-
-        if 'deepseek' not in self.ap.provider_cfg.data['keys']:
-            self.ap.provider_cfg.data['keys']['deepseek'] = []
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m006_vision_config.py

@@ -1,19 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('vision-config', 6)
-class VisionConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'enable-vision' not in self.ap.provider_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-        if 'enable-vision' not in self.ap.provider_cfg.data:
-            self.ap.provider_cfg.data['enable-vision'] = False
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m007_qcg_center_url.py

@@ -1,20 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('qcg-center-url-config', 7)
-class QCGCenterURLConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'qcg-center-url' not in self.ap.system_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-
-        if 'qcg-center-url' not in self.ap.system_cfg.data:
-            self.ap.system_cfg.data['qcg-center-url'] = 'https://api.qchatgpt.rockchin.top/api/v2'
-
-        await self.ap.system_cfg.dump_config()

src/langbot/pkg/core/migrations/m008_ad_fixwin_config_migrate.py

@@ -1,25 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('ad-fixwin-cfg-migration', 8)
-class AdFixwinConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return isinstance(self.ap.pipeline_cfg.data['rate-limit']['fixwin']['default'], int)
-
-    async def run(self):
-        """执行迁移"""
-
-        for session_name in self.ap.pipeline_cfg.data['rate-limit']['fixwin']:
-            temp_dict = {
-                'window-size': 60,
-                'limit': self.ap.pipeline_cfg.data['rate-limit']['fixwin'][session_name],
-            }
-
-            self.ap.pipeline_cfg.data['rate-limit']['fixwin'][session_name] = temp_dict
-
-        await self.ap.pipeline_cfg.dump_config()

src/langbot/pkg/core/migrations/m009_msg_truncator_cfg.py

@@ -1,22 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('msg-truncator-cfg-migration', 9)
-class MsgTruncatorConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'msg-truncate' not in self.ap.pipeline_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-
-        self.ap.pipeline_cfg.data['msg-truncate'] = {
-            'method': 'round',
-            'round': {'max-round': 10},
-        }
-
-        await self.ap.pipeline_cfg.dump_config()

src/langbot/pkg/core/migrations/m010_ollama_requester_config.py

@@ -1,23 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('ollama-requester-config', 10)
-class MsgTruncatorConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'ollama-chat' not in self.ap.provider_cfg.data['requester']
-
-    async def run(self):
-        """执行迁移"""
-
-        self.ap.provider_cfg.data['requester']['ollama-chat'] = {
-            'base-url': 'http://127.0.0.1:11434',
-            'args': {},
-            'timeout': 600,
-        }
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m011_command_prefix_config.py

@@ -1,19 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('command-prefix-config', 11)
-class CommandPrefixConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'command-prefix' not in self.ap.command_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-
-        self.ap.command_cfg.data['command-prefix'] = ['!', '！']
-
-        await self.ap.command_cfg.dump_config()

src/langbot/pkg/core/migrations/m012_runner_config.py

@@ -1,19 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('runner-config', 12)
-class RunnerConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'runner' not in self.ap.provider_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-
-        self.ap.provider_cfg.data['runner'] = 'local-agent'
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m013_http_api_config.py

@@ -1,29 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('http-api-config', 13)
-class HttpApiConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'http-api' not in self.ap.system_cfg.data or 'persistence' not in self.ap.system_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-
-        self.ap.system_cfg.data['http-api'] = {
-            'enable': True,
-            'host': '0.0.0.0',
-            'port': 5300,
-            'jwt-expire': 604800,
-        }
-
-        self.ap.system_cfg.data['persistence'] = {
-            'sqlite': {'path': 'data/persistence.db'},
-            'use': 'sqlite',
-        }
-
-        await self.ap.system_cfg.dump_config()

src/langbot/pkg/core/migrations/m014_force_delay_config.py

@@ -1,22 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('force-delay-config', 14)
-class ForceDelayConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return isinstance(self.ap.platform_cfg.data['force-delay'], list)
-
-    async def run(self):
-        """执行迁移"""
-
-        self.ap.platform_cfg.data['force-delay'] = {
-            'min': self.ap.platform_cfg.data['force-delay'][0],
-            'max': self.ap.platform_cfg.data['force-delay'][1],
-        }
-
-        await self.ap.platform_cfg.dump_config()

src/langbot/pkg/core/migrations/m015_gitee_ai_config.py

@@ -1,27 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('gitee-ai-config', 15)
-class GiteeAIConfigMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return (
-            'gitee-ai-chat-completions' not in self.ap.provider_cfg.data['requester']
-            or 'gitee-ai' not in self.ap.provider_cfg.data['keys']
-        )
-
-    async def run(self):
-        """执行迁移"""
-        self.ap.provider_cfg.data['requester']['gitee-ai-chat-completions'] = {
-            'base-url': 'https://ai.gitee.com/v1',
-            'args': {},
-            'timeout': 120,
-        }
-
-        self.ap.provider_cfg.data['keys']['gitee-ai'] = ['XXXXX']
-
-        await self.ap.provider_cfg.dump_config()

src/langbot/pkg/core/migrations/m016_dify_service_api.py

@@ -1,23 +0,0 @@
-from __future__ import annotations
-
-from .. import migration
-
-
-@migration.migration_class('dify-service-api-config', 16)
-class DifyServiceAPICfgMigration(migration.Migration):
-    """迁移"""
-
-    async def need_migrate(self) -> bool:
-        """判断当前环境是否需要运行此迁移"""
-        return 'dify-service-api' not in self.ap.provider_cfg.data
-
-    async def run(self):
-        """执行迁移"""
-        self.ap.provider_cfg.data['dify-service-api'] = {
-            'base-url': 'https://api.dify.ai/v1',
-            'app-type': 'chat',
-            'chat': {'api-key': 'app-1234567890'},
-            'workflow': {'api-key': 'app-1234567890', 'output-key': 'summary'},
-        }
-
-        await self.ap.provider_cfg.dump_config()