fix(plugins): deliver agent runtime events only to the owning plugin (#19170)

server/src/services/plugin-lifecycle-delivery.ts

@@ -1,6 +1,6 @@
 import { projectInstanceSecretService } from "./project-instance-secrets.js";
 import { and, asc, eq, inArray, isNull, or, sql } from "drizzle-orm";
-import { companies, pluginCompanySettings, pluginConfig, plugins, projects, type Db } from "@paperclipai/db";
+import { agents, companies, pluginCompanySettings, pluginConfig, plugins, projects, type Db } from "@paperclipai/db";
 import { logger } from "../middleware/logger.js";
 import { pluginLifecycleInbox } from "./plugin-lifecycle-inbox.js";
 import { DELIVERY_QUEUES } from "./delivery-work-notifications.js";
@@ -112,6 +112,16 @@ export function registerPluginLifecycleDelivery(
                     continue;
                   }
                 }
+                if (event.resourceType === "agent_runtime" && enabled.manifest.capabilities.includes("agents.lifecycle.manage")) {
+                  stage = "ownership";
+                  const [agent] = await db.select({ requiredPluginIds: agents.lifecycleRequiredPluginIds }).from(agents)
+                    .where(and(eq(agents.id, event.resourceId), eq(agents.companyId, companyId)));
+                  if (agent && !agent.requiredPluginIds?.includes(plugin.id)) {
+                    await inbox.acknowledge(companyId, event.id);
+                    wake();
+                    continue;
+                  }
+                }
                 stage = "credentials";
                 const credentials = event.resourceType === "project" && enabled.manifest.capabilities.includes("projects.instance-secrets")
                   ? await projectInstanceSecretService(db, plugin.id).prepare(event) : undefined;