Nocobase App Plugin Notification Agent Skill

Notification development

Inspect the application's registered plugins and effective notification configuration before changing integration code. Missing required input blocks an actual send; use the recipient and Channel scope already authorized in the conversation and ask only for missing information.

• Read Notification concepts for package ownership and delivery status semantics.
• For plugin registration, configuration, migrations, or log APIs, read Integration and configuration. Configure a Channel name mapped to one flat configuration with type (provider remains a compatibility alias).
• For sending or typed consumers, read Sending notifications. Resolve notificationServiceToken; construct complete messages keyed by Channel name and use native recipient addresses. Validate the intended external effect before sending.
• For failures and retries, read Delivery diagnostics. Preserve Notification, Delivery, Attempt, and retry-audit history; distinguish accepted submission from final delivery.
• For custom transports, read Channel type extensions. Register classes implementing ChannelInstance with registerChannelType through notificationExtensionRegistryToken and retain the queue/lease/retry lifecycle. Use deprecated registerChannel() / registerProvider() only when maintaining legacy compatibility code or its tests; official implementations and examples use the class API.
• Verify changed packages and consumers with lint, typecheck, tests, and build. Cover atomic validation, independent delivery, recipient rules, and retries bound to original identities.

For delivery diagnostics, exercise the normal business notification flow or use a server-side script resolving notificationServiceToken with complete message input. Use an authorized recipient and inspect the returned notification ID in the logs. Credentials stay on the server.

High-impact actions and rollback

For bulk sends and live configuration changes, establish the intended recipients, Channels, and external effect from the user's authorization. An unknown result may already have reached its recipient; confirm the external effect before creating a new logical send.

Rollback source/configuration through the application's normal deployment process. A submitted notification cannot be recalled by this plugin. Preserve its history and report the observed status. Keep message bodies, recipient snapshots, credentials, and Webhook URLs out of logs and reports.

Sensitive messages

Use notificationService.sendTransient({ channel, message }) for a message containing a one-time credential. It validates and prepares the message with the configured channel and submits it once with the provider timeout, without creating notification rows, jobs, retry state, or status events. The result is one provider outcome per recipient; raw provider diagnostics are replaced with generic errors while retaining an allowlisted category and submission status for credential-free troubleshooting. There is no durable idempotency or automatic retry, and a timeout is submission_unknown. The caller owns safe recovery, rate limits, and any credential-free audit. The external mail provider and recipient still receive the message.