nocobase/nocobase release-beta/2026-10-22.2

2026-10-22.2

on GitHub

Beta release 2026-10-22.2 published 14 packages.

@nocobase/agent-protocol@0.1.0-beta.13

Patch Changes

• ffe5494: Apply each application's online runner slots and tool limits from heartbeat replies without restarting. Count tasks and build jobs independently per application, wake capacity waits after changes, and keep existing leases during shrinkage. New registrations default to four slots and online registration settings take precedence over legacy client hints.

  Remove local slot configuration flags from register and start. Retain existing local values only for older servers until all connected applications support online capacity. The runner status JSON now reports effective capacity and its source under each apps entry instead of top-level slots and toolSlots. Runtime pages show reported capacity, pending synchronization, legacy compatibility and the last offline report.

@nocobase/agent-runner@0.1.0-beta.16

Minor Changes

• ffe5494: Apply each application's online runner slots and tool limits from heartbeat replies without restarting. Count tasks and build jobs independently per application, wake capacity waits after changes, and keep existing leases during shrinkage. New registrations default to four slots and online registration settings take precedence over legacy client hints.

  Remove local slot configuration flags from register and start. Retain existing local values only for older servers until all connected applications support online capacity. The runner status JSON now reports effective capacity and its source under each apps entry instead of top-level slots and toolSlots. Runtime pages show reported capacity, pending synchronization, legacy compatibility and the last offline report.

Patch Changes

• Updated dependencies [ffe5494]
  • @nocobase/agent-protocol@0.1.0-beta.13
  • @nocobase/app-cli-client@0.1.0-beta.14

@nocobase/app-cli@1.0.0-beta.27

Patch Changes

• 5b72947: Extract the Node.js that nocobase cli build packs inside its cache rather than the system temporary directory, so the build no longer fails with EXDEV where /tmp is a separate filesystem, such as on GitHub's ubuntu-26.04 runners.
• Updated dependencies [0c5c4ff]
  • @nocobase/app-server@3.0.0-beta.3

@nocobase/app-cli-client@0.1.0-beta.14

Patch Changes

• Updated dependencies [ffe5494]
  • @nocobase/agent-protocol@0.1.0-beta.13

@nocobase/app-client@4.0.0-beta.2

Patch Changes

• 0c5c4ff: Store language choices separately for each application's full mount path so applications on the same origin retain their own defaults and preferences. The previous shared choice is left untouched and no longer read; after upgrading, each application starts in its default language until the visitor chooses again. Update the screenshot tool to preset the application-specific language choice.

@nocobase/app-plugin-agent-sessions@1.0.0-beta.9

Minor Changes

• e98d0f7: Let hosts inspect session context tags and transfer draft text, selected references and context through the existing memory cache. Let hosts supply consistent panel header controls while retaining session commands, and show history beside mounted panel drafts with host-owned labels and actions. Align the standalone My Agent history with panel history, including a neutral new-session icon, search and status filters, plain empty rows and footer archive access. Allow applications to retain manual issue forms without AI intake tabs.

Patch Changes

• 700d037: Name the archived view on the My Agent page and show an archived placeholder instead of an unarchived session while it is open, keeping that session and any unsent draft for the return. Starting a new session from Archived exits the archived view in both list layouts. Remove the unused new-session title and subtitle translations.
• 5d4d4a1: Show detailed start failure messages and app-relative configuration actions supplied by the host application.
• Updated dependencies [0c5c4ff], [ffe5494]
  • @nocobase/app-server@3.0.0-beta.3
  • @nocobase/app-plugin-authentication@2.0.0-beta.13
  • @nocobase/agent-protocol@0.1.0-beta.13
  • @nocobase/app-client@4.0.0-beta.2
  • @nocobase/app-plugin-file@1.0.0-beta.26

@nocobase/app-plugin-agents@1.0.0-beta.19

Patch Changes

• c94a01c: Display model-provided OnlineAgent reasoning in live and saved conversations without exposing provider metadata or signatures. Keep reasoning separate from answer text, preserve manual expand/collapse choices during updates, and render each part safely in the shared chat and Examples application.

• ffe5494: Apply each application's online runner slots and tool limits from heartbeat replies without restarting. Count tasks and build jobs independently per application, wake capacity waits after changes, and keep existing leases during shrinkage. New registrations default to four slots and online registration settings take precedence over legacy client hints.

  Remove local slot configuration flags from register and start. Retain existing local values only for older servers until all connected applications support online capacity. The runner status JSON now reports effective capacity and its source under each apps entry instead of top-level slots and toolSlots. Runtime pages show reported capacity, pending synchronization, legacy compatibility and the last offline report.

• 5875cb9: Expose cancellation actors and a transactional stop request callback, and allow status events to refresh issue progress even when the issue already has the target status.

• Updated dependencies [0c5c4ff], [5b72947], [6e3d66e], [ffe5494]

  • @nocobase/app-server@3.0.0-beta.3
  • @nocobase/app-plugin-authentication@2.0.0-beta.13
  • @nocobase/app-cli@1.0.0-beta.27
  • @nocobase/app-plugin-authorization@1.0.0-beta.31
  • @nocobase/agent-protocol@0.1.0-beta.13
  • @nocobase/app-client@4.0.0-beta.2
  • @nocobase/app-plugin-file@1.0.0-beta.26
  • @nocobase/app-cli-client@0.1.0-beta.14

@nocobase/app-plugin-authentication@2.0.0-beta.13

Patch Changes

• 0c5c4ff: Isolate language sessions and all default authentication cookies by the complete public application mount path, including root and nested applications. Preserve port isolation and explicit cookie configuration. Fix template root-path configuration and share a cookie-name-safe path encoder.

  Visitors using default authentication cookie names must sign in again after upgrading. Old cookies and server records are neither migrated nor deleted; records expire normally, and rolling back can recognize old logins again. Explicit names and prefixes remain unchanged and must be unique across applications with overlapping paths.

  Existing applications must merge the updated server/config/session.ts and root-path handling in server/config/app.ts into their own source as well as upgrade dependencies; dependency updates alone do not replace copied template configuration. See the application cookie isolation guide in the upgrade Skill for the exact edits and verification steps.

• Updated dependencies [0c5c4ff]

  • @nocobase/app-server@3.0.0-beta.3
  • @nocobase/app-client@4.0.0-beta.2

@nocobase/app-plugin-authorization@1.0.0-beta.31

Patch Changes

• 6e3d66e: Clarify how application-owned permission workspaces map independently assignable business operations to actual UI controls, server enforcement and data scopes, including compatibility requirements when splitting existing actions. Align the settings guidance with checkbox-based draft editing.

  Allow applications to hide created-record range selectors while retaining registered policies, name related-record ranges per action, and localize filter field captions by collection in both templates.

• 6e3d66e: Present role permissions as compact ordered action tiles with checkboxes, descriptions and named data ranges while retaining the original category navigation. Keep the visible catalog in application-owned composition, require explicit settings opt-in plus a real configuration page and registered server action, omit the default System and tools category, preserve undisplayed grants, and update the permission Registry integration and agent guidance.

  Render page access using the application's actual menu hierarchy, with independent page checkboxes, disclosure-only structural groups, ancestor-aware filtering and preserved non-menu page grants.

  Use checkboxes consistently for page, business and settings permission drafts and the enabled-only filter, retaining separate scope selectors and explicit host Save.

  Refine menu permission trees with compact aligned rows, subtle hover and focus feedback, restrained group headings and fewer nested borders.

  Keep page-access trees limited to business pages. Group actual system-settings pages and operations under Configuration permissions, explain the boundary, and preserve existing grant identifiers and values.

  Remove the global default-data-scope shortcut from role editors; retain its dedicated Permission management tab.

  Keep multi-scope action tiles at stable widths, show default-rule explanations visibly, and let applications classify individual composite configuration actions by their actual pages while retaining native filter editing.

  Group default data scope controls under one heading per operation and reuse application-owned business captions across role and default-scope forms without rewriting stored rules.

• Updated dependencies [0c5c4ff]

  • @nocobase/app-server@3.0.0-beta.3
  • @nocobase/app-plugin-authentication@2.0.0-beta.13
  • @nocobase/app-client@4.0.0-beta.2

@nocobase/app-plugin-projects@0.1.0-beta.17

Minor Changes

• e98d0f7: Let hosts inspect session context tags and transfer draft text, selected references and context through the existing memory cache. Let hosts supply consistent panel header controls while retaining session commands, and show history beside mounted panel drafts with host-owned labels and actions. Align the standalone My Agent history with panel history, including a neutral new-session icon, search and status filters, plain empty rows and footer archive access. Allow applications to retain manual issue forms without AI intake tabs.

Patch Changes

• 5d4d4a1: Show detailed start failure messages and app-relative configuration actions supplied by the host application.
• 5875cb9: Expose cancellation actors and a transactional stop request callback, and allow status events to refresh issue progress even when the issue already has the target status.
• Updated dependencies [0c5c4ff], [6e3d66e]
  • @nocobase/app-server@3.0.0-beta.3
  • @nocobase/app-plugin-authentication@2.0.0-beta.13
  • @nocobase/app-plugin-authorization@1.0.0-beta.31
  • @nocobase/app-client@4.0.0-beta.2
  • @nocobase/app-plugin-file@1.0.0-beta.26

@nocobase/app-server@3.0.0-beta.3

Patch Changes

• 0c5c4ff: Isolate language sessions and all default authentication cookies by the complete public application mount path, including root and nested applications. Preserve port isolation and explicit cookie configuration. Fix template root-path configuration and share a cookie-name-safe path encoder.

  Visitors using default authentication cookie names must sign in again after upgrading. Old cookies and server records are neither migrated nor deleted; records expire normally, and rolling back can recognize old logins again. Explicit names and prefixes remain unchanged and must be unique across applications with overlapping paths.

  Existing applications must merge the updated server/config/session.ts and root-path handling in server/config/app.ts into their own source as well as upgrade dependencies; dependency updates alone do not replace copied template configuration. See the application cookie isolation guide in the upgrade Skill for the exact edits and verification steps.

@nocobase/app-skills@0.1.0-beta.46

Patch Changes

• 0c5c4ff: Isolate language sessions and all default authentication cookies by the complete public application mount path, including root and nested applications. Preserve port isolation and explicit cookie configuration. Fix template root-path configuration and share a cookie-name-safe path encoder.

  Visitors using default authentication cookie names must sign in again after upgrading. Old cookies and server records are neither migrated nor deleted; records expire normally, and rolling back can recognize old logins again. Explicit names and prefixes remain unchanged and must be unique across applications with overlapping paths.

  Existing applications must merge the updated server/config/session.ts and root-path handling in server/config/app.ts into their own source as well as upgrade dependencies; dependency updates alone do not replace copied template configuration. See the application cookie isolation guide in the upgrade Skill for the exact edits and verification steps.

• 6e3d66e: Clarify how application-owned permission workspaces map independently assignable business operations to actual UI controls, server enforcement and data scopes, including compatibility requirements when splitting existing actions. Align the settings guidance with checkbox-based draft editing.

  Allow applications to hide created-record range selectors while retaining registered policies, name related-record ranges per action, and localize filter field captions by collection in both templates.

• 6e3d66e: Present role permissions as compact ordered action tiles with checkboxes, descriptions and named data ranges while retaining the original category navigation. Keep the visible catalog in application-owned composition, require explicit settings opt-in plus a real configuration page and registered server action, omit the default System and tools category, preserve undisplayed grants, and update the permission Registry integration and agent guidance.

  Render page access using the application's actual menu hierarchy, with independent page checkboxes, disclosure-only structural groups, ancestor-aware filtering and preserved non-menu page grants.

  Use checkboxes consistently for page, business and settings permission drafts and the enabled-only filter, retaining separate scope selectors and explicit host Save.

  Refine menu permission trees with compact aligned rows, subtle hover and focus feedback, restrained group headings and fewer nested borders.

  Keep page-access trees limited to business pages. Group actual system-settings pages and operations under Configuration permissions, explain the boundary, and preserve existing grant identifiers and values.

  Remove the global default-data-scope shortcut from role editors; retain its dedicated Permission management tab.

  Keep multi-scope action tiles at stable widths, show default-rule explanations visibly, and let applications classify individual composite configuration actions by their actual pages while retaining native filter editing.

  Group default data scope controls under one heading per operation and reuse application-owned business captions across role and default-scope forms without rewriting stored rules.

• 0c5c4ff: Store language choices separately for each application's full mount path so applications on the same origin retain their own defaults and preferences. The previous shared choice is left untouched and no longer read; after upgrading, each application starts in its default language until the visitor chooses again. Update the screenshot tool to preset the application-specific language choice.

• 6e3d66e: Require a reviewable operation-to-permission map and independent UI/API authorization checks when building new applications.

@nocobase/app-template-default@1.0.0-beta.77

Patch Changes

• 0c5c4ff: Isolate language sessions and all default authentication cookies by the complete public application mount path, including root and nested applications. Preserve port isolation and explicit cookie configuration. Fix template root-path configuration and share a cookie-name-safe path encoder.

  Visitors using default authentication cookie names must sign in again after upgrading. Old cookies and server records are neither migrated nor deleted; records expire normally, and rolling back can recognize old logins again. Explicit names and prefixes remain unchanged and must be unique across applications with overlapping paths.

  Existing applications must merge the updated server/config/session.ts and root-path handling in server/config/app.ts into their own source as well as upgrade dependencies; dependency updates alone do not replace copied template configuration. See the application cookie isolation guide in the upgrade Skill for the exact edits and verification steps.

• 6e3d66e: Clarify how application-owned permission workspaces map independently assignable business operations to actual UI controls, server enforcement and data scopes, including compatibility requirements when splitting existing actions. Align the settings guidance with checkbox-based draft editing.

  Allow applications to hide created-record range selectors while retaining registered policies, name related-record ranges per action, and localize filter field captions by collection in both templates.

• 6e3d66e: Present role permissions as compact ordered action tiles with checkboxes, descriptions and named data ranges while retaining the original category navigation. Keep the visible catalog in application-owned composition, require explicit settings opt-in plus a real configuration page and registered server action, omit the default System and tools category, preserve undisplayed grants, and update the permission Registry integration and agent guidance.

  Render page access using the application's actual menu hierarchy, with independent page checkboxes, disclosure-only structural groups, ancestor-aware filtering and preserved non-menu page grants.

  Use checkboxes consistently for page, business and settings permission drafts and the enabled-only filter, retaining separate scope selectors and explicit host Save.

  Refine menu permission trees with compact aligned rows, subtle hover and focus feedback, restrained group headings and fewer nested borders.

  Keep page-access trees limited to business pages. Group actual system-settings pages and operations under Configuration permissions, explain the boundary, and preserve existing grant identifiers and values.

  Remove the global default-data-scope shortcut from role editors; retain its dedicated Permission management tab.

  Keep multi-scope action tiles at stable widths, show default-rule explanations visibly, and let applications classify individual composite configuration actions by their actual pages while retaining native filter editing.

  Group default data scope controls under one heading per operation and reuse application-owned business captions across role and default-scope forms without rewriting stored rules.

• Updated dependencies [c94a01c], [0c5c4ff], [5b72947], [6e3d66e], [ffe5494], [5875cb9]

  • @nocobase/app-plugin-agents@1.0.0-beta.19
  • @nocobase/app-server@3.0.0-beta.3
  • @nocobase/app-plugin-authentication@2.0.0-beta.13
  • @nocobase/app-cli@1.0.0-beta.27
  • @nocobase/app-plugin-authorization@1.0.0-beta.31

@nocobase/app-template-examples@1.0.0-beta.59

Patch Changes

• c94a01c: Display model-provided OnlineAgent reasoning in live and saved conversations without exposing provider metadata or signatures. Keep reasoning separate from answer text, preserve manual expand/collapse choices during updates, and render each part safely in the shared chat and Examples application.

• 0c5c4ff: Isolate language sessions and all default authentication cookies by the complete public application mount path, including root and nested applications. Preserve port isolation and explicit cookie configuration. Fix template root-path configuration and share a cookie-name-safe path encoder.

  Visitors using default authentication cookie names must sign in again after upgrading. Old cookies and server records are neither migrated nor deleted; records expire normally, and rolling back can recognize old logins again. Explicit names and prefixes remain unchanged and must be unique across applications with overlapping paths.

  Existing applications must merge the updated server/config/session.ts and root-path handling in server/config/app.ts into their own source as well as upgrade dependencies; dependency updates alone do not replace copied template configuration. See the application cookie isolation guide in the upgrade Skill for the exact edits and verification steps.

• 6e3d66e: Clarify how application-owned permission workspaces map independently assignable business operations to actual UI controls, server enforcement and data scopes, including compatibility requirements when splitting existing actions. Align the settings guidance with checkbox-based draft editing.

  Allow applications to hide created-record range selectors while retaining registered policies, name related-record ranges per action, and localize filter field captions by collection in both templates.

• 6e3d66e: Present role permissions as compact ordered action tiles with checkboxes, descriptions and named data ranges while retaining the original category navigation. Keep the visible catalog in application-owned composition, require explicit settings opt-in plus a real configuration page and registered server action, omit the default System and tools category, preserve undisplayed grants, and update the permission Registry integration and agent guidance.

  Render page access using the application's actual menu hierarchy, with independent page checkboxes, disclosure-only structural groups, ancestor-aware filtering and preserved non-menu page grants.

  Use checkboxes consistently for page, business and settings permission drafts and the enabled-only filter, retaining separate scope selectors and explicit host Save.

  Refine menu permission trees with compact aligned rows, subtle hover and focus feedback, restrained group headings and fewer nested borders.

  Keep page-access trees limited to business pages. Group actual system-settings pages and operations under Configuration permissions, explain the boundary, and preserve existing grant identifiers and values.

  Remove the global default-data-scope shortcut from role editors; retain its dedicated Permission management tab.

  Keep multi-scope action tiles at stable widths, show default-rule explanations visibly, and let applications classify individual composite configuration actions by their actual pages while retaining native filter editing.

  Group default data scope controls under one heading per operation and reuse application-owned business captions across role and default-scope forms without rewriting stored rules.

• Updated dependencies [c94a01c], [0c5c4ff], [5b72947], [6e3d66e], [ffe5494], [5875cb9]

  • @nocobase/app-plugin-agents@1.0.0-beta.19
  • @nocobase/app-server@3.0.0-beta.3
  • @nocobase/app-plugin-authentication@2.0.0-beta.13
  • @nocobase/app-cli@1.0.0-beta.27
  • @nocobase/app-plugin-authorization@1.0.0-beta.31