@paperclipai/server 0.3.0 → 0.3.1-canary.0

package/dist/services/heartbeat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heartbeat.d.ts","sourceRoot":"","sources":["../../src/services/heartbeat.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAyD1C,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,WAAW,GAAG,YAAY,CAAC;IAC7D,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1D,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAOD,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,iBAAiB,GAAG,cAAc,GAAG,YAAY,CAAC;IAC1D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,KAAK,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAMF,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtD,iBAAiB,EAAE,uBAAuB,CAAC;CAC5C;;aAOsB,MAAM,GAAG,IAAI;EAuDnC;AAmCD,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,WAU5D;AAqMD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE;sBAsoDjB,MAAM,YAAY,MAAM,UAAU,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA1nD/B,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA6oDA,MAAM;;;;;;;;;;;;;;;;;;gCAmBL,MAAM;;;;;;;;;;;;;mCAWH,MAAM,SAAS;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;;;;;;;;;;;;;;;;;wBAmC3D,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAQH,MAAM,SAAS;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;sBAsBnE,MAAM,WACP,OAAO,GAAG,YAAY,GAAG,WAAW,GAAG,YAAY,oBAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,kBACzB,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,UAChD;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA/jB1C,MAAM,SAAQ,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAltB1B;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;uBAk0CzC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA2CO,MAAM;oCA6BN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe/C"}
+{"version":3,"file":"heartbeat.d.ts","sourceRoot":"","sources":["../../src/services/heartbeat.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAyG1C,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,WAAW,GAAG,YAAY,CAAC;IAC7D,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1D,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAOD,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,iBAAiB,GAAG,cAAc,GAAG,YAAY,CAAC;IAC1D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,KAAK,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAMF,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtD,iBAAiB,EAAE,uBAAuB,CAAC;CAC5C;;aAOsB,MAAM,GAAG,IAAI;EAuDnC;AAmCD,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,WAU5D;AAqMD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE;sBAgzDX,MAAM,YAAY,MAAM,UAAU,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAnyDrC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BAuzDA,MAAM;;;;;;;;;;;;;;;;;;gCAmBL,MAAM;;;;;;;;;;;;;mCAWH,MAAM,SAAS;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;;;;;;;;;;;;;;;;;wBAmC3D,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAQH,MAAM,SAAS;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;sBAuBnE,MAAM,WACP,OAAO,GAAG,YAAY,GAAG,WAAW,GAAG,YAAY,oBAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,kBACzB,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,UAChD;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAjkB1C,MAAM,SAAQ,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAx3B1B;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;uBA0+CzC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA2CO,MAAM;oCA6BN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe/C"}

package/dist/services/heartbeat.js

@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { and, asc, desc, eq, gt, inArray, sql } from "drizzle-orm";
-import { agents, agentRuntimeState, agentTaskSessions, agentWakeupRequests, heartbeatRunEvents, heartbeatRuns, costEvents, issues, projectWorkspaces, } from "@paperclipai/db";
+import { agents, agentRuntimeState, agentTaskSessions, agentWakeupRequests, heartbeatRunEvents, heartbeatRuns, issues, projects, projectWorkspaces, } from "@paperclipai/db";
 import { conflict, notFound } from "../errors.js";
 import { logger } from "../middleware/logger.js";
 import { publishLiveEvent } from "./live-events.js";
@@ -9,14 +9,50 @@ import { getRunLogStore } from "./run-log-store.js";
 import { getServerAdapter, runningProcesses } from "../adapters/index.js";
 import { createLocalAgentJwt } from "../agent-auth-jwt.js";
 import { parseObject, asBoolean, asNumber, appendWithCap, MAX_EXCERPT_BYTES } from "../adapters/utils.js";
+import { costService } from "./costs.js";
 import { secretService } from "./secrets.js";
 import { resolveDefaultAgentWorkspaceDir } from "../home-paths.js";
+import { summarizeHeartbeatRunResultJson } from "./heartbeat-run-summary.js";
+import { buildWorkspaceReadyComment, ensureRuntimeServicesForRun, persistAdapterManagedRuntimeServices, realizeExecutionWorkspace, releaseRuntimeServicesForRun, } from "./workspace-runtime.js";
+import { issueService } from "./issues.js";
+import { buildExecutionWorkspaceAdapterConfig, parseIssueExecutionWorkspaceSettings, parseProjectExecutionWorkspacePolicy, resolveExecutionWorkspaceMode, } from "./execution-workspace-policy.js";
+import { redactCurrentUserText, redactCurrentUserValue } from "../log-redaction.js";
 const MAX_LIVE_LOG_CHUNK_BYTES = 8 * 1024;
 const HEARTBEAT_MAX_CONCURRENT_RUNS_DEFAULT = 1;
 const HEARTBEAT_MAX_CONCURRENT_RUNS_MAX = 10;
 const DEFERRED_WAKE_CONTEXT_KEY = "_paperclipWakeContext";
 const startLocksByAgent = new Map();
 const REPO_ONLY_CWD_SENTINEL = "/__paperclip_repo_only__";
+const heartbeatRunListColumns = {
+    id: heartbeatRuns.id,
+    companyId: heartbeatRuns.companyId,
+    agentId: heartbeatRuns.agentId,
+    invocationSource: heartbeatRuns.invocationSource,
+    triggerDetail: heartbeatRuns.triggerDetail,
+    status: heartbeatRuns.status,
+    startedAt: heartbeatRuns.startedAt,
+    finishedAt: heartbeatRuns.finishedAt,
+    error: heartbeatRuns.error,
+    wakeupRequestId: heartbeatRuns.wakeupRequestId,
+    exitCode: heartbeatRuns.exitCode,
+    signal: heartbeatRuns.signal,
+    usageJson: heartbeatRuns.usageJson,
+    resultJson: heartbeatRuns.resultJson,
+    sessionIdBefore: heartbeatRuns.sessionIdBefore,
+    sessionIdAfter: heartbeatRuns.sessionIdAfter,
+    logStore: heartbeatRuns.logStore,
+    logRef: heartbeatRuns.logRef,
+    logBytes: heartbeatRuns.logBytes,
+    logSha256: heartbeatRuns.logSha256,
+    logCompressed: heartbeatRuns.logCompressed,
+    stdoutExcerpt: sql `NULL`.as("stdoutExcerpt"),
+    stderrExcerpt: sql `NULL`.as("stderrExcerpt"),
+    errorCode: heartbeatRuns.errorCode,
+    externalRunId: heartbeatRuns.externalRunId,
+    contextSnapshot: heartbeatRuns.contextSnapshot,
+    createdAt: heartbeatRuns.createdAt,
+    updatedAt: heartbeatRuns.updatedAt,
+};
 function appendExcerpt(prev, chunk) {
     return appendWithCap(prev, chunk, MAX_EXCERPT_BYTES);
 }
@@ -294,6 +330,7 @@ function resolveNextSessionState(input) {
 export function heartbeatService(db) {
     const runLogStore = getRunLogStore();
     const secretsSvc = secretService(db);
+    const issuesSvc = issueService(db);
     async function getAgent(agentId) {
         return db
             .select()
@@ -551,6 +588,8 @@ export function heartbeatService(db) {
             .where(eq(agentWakeupRequests.id, wakeupRequestId));
     }
     async function appendRunEvent(run, seq, event) {
+        const sanitizedMessage = event.message ? redactCurrentUserText(event.message) : event.message;
+        const sanitizedPayload = event.payload ? redactCurrentUserValue(event.payload) : event.payload;
         await db.insert(heartbeatRunEvents).values({
             companyId: run.companyId,
             runId: run.id,
@@ -560,8 +599,8 @@ export function heartbeatService(db) {
             stream: event.stream,
             level: event.level,
             color: event.color,
-            message: event.message,
-            payload: event.payload,
+            message: sanitizedMessage,
+            payload: sanitizedPayload,
         });
         publishLiveEvent({
             companyId: run.companyId,
@@ -574,8 +613,8 @@ export function heartbeatService(db) {
                 stream: event.stream ?? null,
                 level: event.level ?? null,
                 color: event.color ?? null,
-                message: event.message ?? null,
-                payload: event.payload ?? null,
+                message: sanitizedMessage ?? null,
+                payload: sanitizedPayload ?? null,
             },
         });
     }
@@ -739,8 +778,8 @@ export function heartbeatService(db) {
         })
             .where(eq(agentRuntimeState.agentId, agent.id));
         if (additionalCostCents > 0 || hasTokenUsage) {
-            await db.insert(costEvents).values({
-                companyId: agent.companyId,
+            const costs = costService(db);
+            await costs.createEvent(agent.companyId, {
                 agentId: agent.id,
                 provider: result.provider ?? "unknown",
                 model: result.model ?? "unknown",
@@ -750,15 +789,6 @@ export function heartbeatService(db) {
                 occurredAt: new Date(),
             });
         }
-        if (additionalCostCents > 0) {
-            await db
-                .update(agents)
-                .set({
-                spentMonthlyCents: sql `${agents.spentMonthlyCents} + ${additionalCostCents}`,
-                updatedAt: new Date(),
-            })
-                .where(eq(agents.id, agent.id));
-        }
     }
     async function startNextQueuedRunForAgent(agentId) {
         return withAgentStartLock(agentId, async () => {
@@ -832,8 +862,10 @@ export function heartbeatService(db) {
         const issueAssigneeConfig = issueId
             ? await db
                 .select({
+                projectId: issues.projectId,
                 assigneeAgentId: issues.assigneeAgentId,
                 assigneeAdapterOverrides: issues.assigneeAdapterOverrides,
+                executionWorkspaceSettings: issues.executionWorkspaceSettings,
             })
                 .from(issues)
                 .where(and(eq(issues.id, issueId), eq(issues.companyId, agent.companyId)))
@@ -842,6 +874,16 @@ export function heartbeatService(db) {
         const issueAssigneeOverrides = issueAssigneeConfig && issueAssigneeConfig.assigneeAgentId === agent.id
             ? parseIssueAssigneeAdapterOverrides(issueAssigneeConfig.assigneeAdapterOverrides)
             : null;
+        const issueExecutionWorkspaceSettings = parseIssueExecutionWorkspaceSettings(issueAssigneeConfig?.executionWorkspaceSettings);
+        const contextProjectId = readNonEmptyString(context.projectId);
+        const executionProjectId = issueAssigneeConfig?.projectId ?? contextProjectId;
+        const projectExecutionWorkspacePolicy = executionProjectId
+            ? await db
+                .select({ executionWorkspacePolicy: projects.executionWorkspacePolicy })
+                .from(projects)
+                .where(and(eq(projects.id, executionProjectId), eq(projects.companyId, agent.companyId)))
+                .then((rows) => parseProjectExecutionWorkspacePolicy(rows[0]?.executionWorkspacePolicy))
+            : null;
         const taskSession = taskKey
             ? await getTaskSession(agent.companyId, agent.id, agent.adapterType, taskKey)
             : null;
@@ -849,15 +891,64 @@ export function heartbeatService(db) {
         const sessionResetReason = describeSessionResetReason(context);
         const taskSessionForRun = resetTaskSession ? null : taskSession;
         const previousSessionParams = normalizeSessionParams(sessionCodec.deserialize(taskSessionForRun?.sessionParamsJson ?? null));
-        const resolvedWorkspace = await resolveWorkspaceForRun(agent, context, previousSessionParams, { useProjectWorkspace: issueAssigneeOverrides?.useProjectWorkspace ?? null });
+        const config = parseObject(agent.adapterConfig);
+        const executionWorkspaceMode = resolveExecutionWorkspaceMode({
+            projectPolicy: projectExecutionWorkspacePolicy,
+            issueSettings: issueExecutionWorkspaceSettings,
+            legacyUseProjectWorkspace: issueAssigneeOverrides?.useProjectWorkspace ?? null,
+        });
+        const resolvedWorkspace = await resolveWorkspaceForRun(agent, context, previousSessionParams, { useProjectWorkspace: executionWorkspaceMode !== "agent_default" });
+        const workspaceManagedConfig = buildExecutionWorkspaceAdapterConfig({
+            agentConfig: config,
+            projectPolicy: projectExecutionWorkspacePolicy,
+            issueSettings: issueExecutionWorkspaceSettings,
+            mode: executionWorkspaceMode,
+            legacyUseProjectWorkspace: issueAssigneeOverrides?.useProjectWorkspace ?? null,
+        });
+        const mergedConfig = issueAssigneeOverrides?.adapterConfig
+            ? { ...workspaceManagedConfig, ...issueAssigneeOverrides.adapterConfig }
+            : workspaceManagedConfig;
+        const { config: resolvedConfig, secretKeys } = await secretsSvc.resolveAdapterConfigForRuntime(agent.companyId, mergedConfig);
+        const issueRef = issueId
+            ? await db
+                .select({
+                id: issues.id,
+                identifier: issues.identifier,
+                title: issues.title,
+            })
+                .from(issues)
+                .where(and(eq(issues.id, issueId), eq(issues.companyId, agent.companyId)))
+                .then((rows) => rows[0] ?? null)
+            : null;
+        const executionWorkspace = await realizeExecutionWorkspace({
+            base: {
+                baseCwd: resolvedWorkspace.cwd,
+                source: resolvedWorkspace.source,
+                projectId: resolvedWorkspace.projectId,
+                workspaceId: resolvedWorkspace.workspaceId,
+                repoUrl: resolvedWorkspace.repoUrl,
+                repoRef: resolvedWorkspace.repoRef,
+            },
+            config: resolvedConfig,
+            issue: issueRef,
+            agent: {
+                id: agent.id,
+                name: agent.name,
+                companyId: agent.companyId,
+            },
+        });
         const runtimeSessionResolution = resolveRuntimeSessionParamsForWorkspace({
             agentId: agent.id,
             previousSessionParams,
-            resolvedWorkspace,
+            resolvedWorkspace: {
+                ...resolvedWorkspace,
+                cwd: executionWorkspace.cwd,
+            },
         });
         const runtimeSessionParams = runtimeSessionResolution.sessionParams;
         const runtimeWorkspaceWarnings = [
             ...resolvedWorkspace.warnings,
+            ...executionWorkspace.warnings,
             ...(runtimeSessionResolution.warning ? [runtimeSessionResolution.warning] : []),
             ...(resetTaskSession && sessionResetReason
                 ? [
@@ -868,16 +959,32 @@ export function heartbeatService(db) {
                 : []),
         ];
         context.paperclipWorkspace = {
-            cwd: resolvedWorkspace.cwd,
-            source: resolvedWorkspace.source,
-            projectId: resolvedWorkspace.projectId,
-            workspaceId: resolvedWorkspace.workspaceId,
-            repoUrl: resolvedWorkspace.repoUrl,
-            repoRef: resolvedWorkspace.repoRef,
+            cwd: executionWorkspace.cwd,
+            source: executionWorkspace.source,
+            mode: executionWorkspaceMode,
+            strategy: executionWorkspace.strategy,
+            projectId: executionWorkspace.projectId,
+            workspaceId: executionWorkspace.workspaceId,
+            repoUrl: executionWorkspace.repoUrl,
+            repoRef: executionWorkspace.repoRef,
+            branchName: executionWorkspace.branchName,
+            worktreePath: executionWorkspace.worktreePath,
         };
         context.paperclipWorkspaces = resolvedWorkspace.workspaceHints;
-        if (resolvedWorkspace.projectId && !readNonEmptyString(context.projectId)) {
-            context.projectId = resolvedWorkspace.projectId;
+        const runtimeServiceIntents = (() => {
+            const runtimeConfig = parseObject(resolvedConfig.workspaceRuntime);
+            return Array.isArray(runtimeConfig.services)
+                ? runtimeConfig.services.filter((value) => typeof value === "object" && value !== null)
+                : [];
+        })();
+        if (runtimeServiceIntents.length > 0) {
+            context.paperclipRuntimeServiceIntents = runtimeServiceIntents;
+        }
+        else {
+            delete context.paperclipRuntimeServiceIntents;
+        }
+        if (executionWorkspace.projectId && !readNonEmptyString(context.projectId)) {
+            context.projectId = executionWorkspace.projectId;
         }
         const runtimeSessionFallback = taskKey || resetTaskSession ? null : runtime.sessionId;
         const previousSessionDisplayId = truncateDisplayId(taskSessionForRun?.sessionDisplayId ??
@@ -901,6 +1008,7 @@ export function heartbeatService(db) {
                 .set({
                 startedAt,
                 sessionIdBefore: runtimeForAdapter.sessionDisplayId ?? runtimeForAdapter.sessionId,
+                contextSnapshot: context,
                 updatedAt: new Date(),
             })
                 .where(eq(heartbeatRuns.id, run.id))
@@ -946,40 +1054,76 @@ export function heartbeatService(db) {
             })
                 .where(eq(heartbeatRuns.id, runId));
             const onLog = async (stream, chunk) => {
+                const sanitizedChunk = redactCurrentUserText(chunk);
                 if (stream === "stdout")
-                    stdoutExcerpt = appendExcerpt(stdoutExcerpt, chunk);
+                    stdoutExcerpt = appendExcerpt(stdoutExcerpt, sanitizedChunk);
                 if (stream === "stderr")
-                    stderrExcerpt = appendExcerpt(stderrExcerpt, chunk);
+                    stderrExcerpt = appendExcerpt(stderrExcerpt, sanitizedChunk);
+                const ts = new Date().toISOString();
                 if (handle) {
                     await runLogStore.append(handle, {
                         stream,
-                        chunk,
-                        ts: new Date().toISOString(),
+                        chunk: sanitizedChunk,
+                        ts,
                     });
                 }
-                const payloadChunk = chunk.length > MAX_LIVE_LOG_CHUNK_BYTES
-                    ? chunk.slice(chunk.length - MAX_LIVE_LOG_CHUNK_BYTES)
-                    : chunk;
+                const payloadChunk = sanitizedChunk.length > MAX_LIVE_LOG_CHUNK_BYTES
+                    ? sanitizedChunk.slice(sanitizedChunk.length - MAX_LIVE_LOG_CHUNK_BYTES)
+                    : sanitizedChunk;
                 publishLiveEvent({
                     companyId: run.companyId,
                     type: "heartbeat.run.log",
                     payload: {
                         runId: run.id,
                         agentId: run.agentId,
+                        ts,
                         stream,
                         chunk: payloadChunk,
-                        truncated: payloadChunk.length !== chunk.length,
+                        truncated: payloadChunk.length !== sanitizedChunk.length,
                     },
                 });
             };
             for (const warning of runtimeWorkspaceWarnings) {
                 await onLog("stderr", `[paperclip] ${warning}\n`);
             }
-            const config = parseObject(agent.adapterConfig);
-            const mergedConfig = issueAssigneeOverrides?.adapterConfig
-                ? { ...config, ...issueAssigneeOverrides.adapterConfig }
-                : config;
-            const { config: resolvedConfig, secretKeys } = await secretsSvc.resolveAdapterConfigForRuntime(agent.companyId, mergedConfig);
+            const adapterEnv = Object.fromEntries(Object.entries(parseObject(resolvedConfig.env)).filter((entry) => typeof entry[0] === "string" && typeof entry[1] === "string"));
+            const runtimeServices = await ensureRuntimeServicesForRun({
+                db,
+                runId: run.id,
+                agent: {
+                    id: agent.id,
+                    name: agent.name,
+                    companyId: agent.companyId,
+                },
+                issue: issueRef,
+                workspace: executionWorkspace,
+                config: resolvedConfig,
+                adapterEnv,
+                onLog,
+            });
+            if (runtimeServices.length > 0) {
+                context.paperclipRuntimeServices = runtimeServices;
+                context.paperclipRuntimePrimaryUrl =
+                    runtimeServices.find((service) => readNonEmptyString(service.url))?.url ?? null;
+                await db
+                    .update(heartbeatRuns)
+                    .set({
+                    contextSnapshot: context,
+                    updatedAt: new Date(),
+                })
+                    .where(eq(heartbeatRuns.id, run.id));
+            }
+            if (issueId && (executionWorkspace.created || runtimeServices.some((service) => !service.reused))) {
+                try {
+                    await issuesSvc.addComment(issueId, buildWorkspaceReadyComment({
+                        workspace: executionWorkspace,
+                        runtimeServices,
+                    }), { agentId: agent.id });
+                }
+                catch (err) {
+                    await onLog("stderr", `[paperclip] Failed to post workspace-ready comment: ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+            }
             const onAdapterMeta = async (meta) => {
                 if (meta.env && secretKeys.size > 0) {
                     for (const key of secretKeys) {
@@ -1017,6 +1161,48 @@ export function heartbeatService(db) {
                 onMeta: onAdapterMeta,
                 authToken: authToken ?? undefined,
             });
+            const adapterManagedRuntimeServices = adapterResult.runtimeServices
+                ? await persistAdapterManagedRuntimeServices({
+                    db,
+                    adapterType: agent.adapterType,
+                    runId: run.id,
+                    agent: {
+                        id: agent.id,
+                        name: agent.name,
+                        companyId: agent.companyId,
+                    },
+                    issue: issueRef,
+                    workspace: executionWorkspace,
+                    reports: adapterResult.runtimeServices,
+                })
+                : [];
+            if (adapterManagedRuntimeServices.length > 0) {
+                const combinedRuntimeServices = [
+                    ...runtimeServices,
+                    ...adapterManagedRuntimeServices,
+                ];
+                context.paperclipRuntimeServices = combinedRuntimeServices;
+                context.paperclipRuntimePrimaryUrl =
+                    combinedRuntimeServices.find((service) => readNonEmptyString(service.url))?.url ?? null;
+                await db
+                    .update(heartbeatRuns)
+                    .set({
+                    contextSnapshot: context,
+                    updatedAt: new Date(),
+                })
+                    .where(eq(heartbeatRuns.id, run.id));
+                if (issueId) {
+                    try {
+                        await issuesSvc.addComment(issueId, buildWorkspaceReadyComment({
+                            workspace: executionWorkspace,
+                            runtimeServices: adapterManagedRuntimeServices,
+                        }), { agentId: agent.id });
+                    }
+                    catch (err) {
+                        await onLog("stderr", `[paperclip] Failed to post adapter-managed runtime comment: ${err instanceof Error ? err.message : String(err)}\n`);
+                    }
+                }
+            }
             const nextSessionState = resolveNextSessionState({
                 codec: sessionCodec,
                 adapterResult,
@@ -1060,7 +1246,7 @@ export function heartbeatService(db) {
                 finishedAt: new Date(),
                 error: outcome === "succeeded"
                     ? null
-                    : adapterResult.errorMessage ?? (outcome === "timed_out" ? "Timed out" : "Adapter failed"),
+                    : redactCurrentUserText(adapterResult.errorMessage ?? (outcome === "timed_out" ? "Timed out" : "Adapter failed")),
                 errorCode: outcome === "timed_out"
                     ? "timeout"
                     : outcome === "cancelled"
@@ -1125,7 +1311,7 @@ export function heartbeatService(db) {
             await finalizeAgentStatus(agent.id, outcome);
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : "Unknown adapter failure";
+            const message = redactCurrentUserText(err instanceof Error ? err.message : "Unknown adapter failure");
             logger.error({ err, runId }, "heartbeat execution failed");
             let logSummary = null;
             if (handle) {
@@ -1182,6 +1368,7 @@ export function heartbeatService(db) {
             await finalizeAgentStatus(agent.id, "failed");
         }
         finally {
+            await releaseRuntimeServicesForRun(run.id);
             await startNextQueuedRunForAgent(agent.id);
         }
     }
@@ -1678,18 +1865,19 @@ export function heartbeatService(db) {
         return newRun;
     }
     return {
-        list: (companyId, agentId, limit) => {
+        list: async (companyId, agentId, limit) => {
             const query = db
-                .select()
+                .select(heartbeatRunListColumns)
                 .from(heartbeatRuns)
                 .where(agentId
                 ? and(eq(heartbeatRuns.companyId, companyId), eq(heartbeatRuns.agentId, agentId))
                 : eq(heartbeatRuns.companyId, companyId))
                 .orderBy(desc(heartbeatRuns.createdAt));
-            if (limit) {
-                return query.limit(limit);
-            }
-            return query;
+            const rows = limit ? await query.limit(limit) : await query;
+            return rows.map((row) => ({
+                ...row,
+                resultJson: summarizeHeartbeatRunResultJson(row.resultJson),
+            }));
         },
         getRun,
         getRuntimeState: async (agentId) => {
@@ -1772,6 +1960,7 @@ export function heartbeatService(db) {
                 store: run.logStore,
                 logRef: run.logRef,
                 ...result,
+                content: redactCurrentUserText(result.content),
             };
         },
         invoke: async (agentId, source = "on_demand", contextSnapshot = {}, triggerDetail = "manual", actor) => enqueueWakeup(agentId, {