@paperclipai/server 2026.707.0-canary.9 → 2026.707.0

package/dist/agent-auth-jwt.d.ts

@@ -8,6 +8,7 @@ export interface LocalAgentJwtClaims {
     exp: number;
     iss?: string;
     aud?: string;
+    instance_id?: string;
     jti?: string;
 }
 export declare function createLocalAgentJwt(agentId: string, companyId: string, adapterType: string, runId: string, responsibleUserId?: string | null): string | null;

package/dist/agent-auth-jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-auth-jwt.d.ts","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAyED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,iBA8BlC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAwE7E"}
+{"version":3,"file":"agent-auth-jwt.d.ts","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA6FD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,iBAgClC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAwF7E"}

package/dist/agent-auth-jwt.js

@@ -1,4 +1,5 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
+import { resolvePaperclipInstanceId } from "./home-paths.js";
 const JWT_ALGORITHM = "HS256";
 function parseNumber(value, fallback) {
     const parsed = Number(value);
@@ -21,23 +22,43 @@ function jwtConfig() {
         ttlSeconds: parseNumber(process.env.PAPERCLIP_AGENT_JWT_TTL_SECONDS, 60 * 60),
         issuer: process.env.PAPERCLIP_AGENT_JWT_ISSUER ?? "paperclip",
         audience: process.env.PAPERCLIP_AGENT_JWT_AUDIENCE ?? "paperclip-api",
+        // The control-plane instance this process belongs to. The live plane runs as
+        // "default"; every worktree/fork instance gets a distinct id (its worktree
+        // name) even though it deliberately shares PAPERCLIP_AGENT_JWT_SECRET with
+        // the source instance. Folding this into the signing-key derivation is what
+        // prevents a fork-minted token from authenticating against the live plane.
+        instanceId: resolvePaperclipInstanceId(),
         disableLegacyFallback: parseBooleanEnv(process.env.PAPERCLIP_AGENT_JWT_DISABLE_LEGACY_FALLBACK),
     };
 }
 /**
- * Derive a per-company signing key from the master JWT secret and a companyId.
+ * Derive a per-instance, per-company signing key from the master JWT secret,
+ * the control-plane instanceId, and a companyId.
  *
- * In a multi-tenant deployment this ensures that a JWT signed for company A
- * cannot be reused to authenticate as an agent in company B, even if the raw
- * token leaks. The instance-wide master secret is never used to sign new
- * tokens — it is retained only as a verification fallback so that tokens
- * issued before this change continue to validate.
+ * Two isolation properties fall out of this derivation:
+ *  - Per-company: a JWT signed for company A cannot be reused to authenticate
+ *    as an agent in company B, even if the raw token leaks.
+ *  - Per-instance: a JWT minted by a worktree/fork control-plane instance
+ *    cannot authenticate against the live plane, even though forks
+ *    deliberately share the same master secret (it is copied into worktree
+ *    envs by provisioning). The live plane derives its key from its own
+ *    instanceId ("default"), so a fork token — signed under the fork's
+ *    instanceId — never matches. See PAP-12896 for the incident this closes.
+ *
+ * The instance-wide master secret is never used to sign new tokens — it is
+ * retained only as a verification fallback so that tokens issued before this
+ * change continue to validate. NOTE: that legacy fallback is instance-agnostic
+ * (it signs with the raw shared secret), so complete cryptographic instance
+ * isolation additionally requires disabling it once outstanding legacy tokens
+ * have expired (set PAPERCLIP_AGENT_JWT_DISABLE_LEGACY_FALLBACK=true). Normal
+ * fork-minted run tokens are already rejected without that step because they
+ * are signed with the derived key, not the raw master secret.
  *
  * The derivation domain-separates with the `jwt:` prefix so the same master
  * secret can safely be reused for other HMAC purposes without key reuse.
  */
-function deriveCompanySigningKey(masterSecret, companyId) {
-    return createHmac("sha256", masterSecret).update(`jwt:${companyId}`).digest("hex");
+function deriveCompanySigningKey(masterSecret, companyId, instanceId) {
+    return createHmac("sha256", masterSecret).update(`jwt:${instanceId}:${companyId}`).digest("hex");
 }
 function base64UrlEncode(value) {
     return Buffer.from(value, "utf8").toString("base64url");
@@ -79,15 +100,17 @@ export function createLocalAgentJwt(agentId, companyId, adapterType, runId, resp
         exp: now + config.ttlSeconds,
         iss: config.issuer,
         aud: config.audience,
+        instance_id: config.instanceId,
     };
     const header = {
         alg: JWT_ALGORITHM,
         typ: "JWT",
     };
     const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
-    // Sign with the per-company derived key so a leaked token cannot be reused
-    // across tenants.
-    const signingKey = deriveCompanySigningKey(config.secret, companyId);
+    // Sign with the per-instance, per-company derived key so a leaked token
+    // cannot be reused across tenants and a fork-minted token cannot authenticate
+    // against a different control-plane instance.
+    const signingKey = deriveCompanySigningKey(config.secret, companyId, config.instanceId);
     const signature = signPayload(signingKey, signingInput);
     return `${signingInput}.${signature}`;
 }
@@ -111,18 +134,24 @@ export function verifyLocalAgentJwt(token) {
     if (!claimedCompanyId)
         return null;
     const signingInput = `${headerB64}.${claimsB64}`;
-    // Try the per-company derived key first (current tokens). Fall back to the
-    // raw master secret so tokens issued before per-company derivation existed
-    // continue to verify — this preserves backward compatibility for any
-    // outstanding tokens (TTL bounds the legacy window naturally).
+    // Try the per-instance, per-company derived key first (current tokens),
+    // deriving under THIS control plane's own instanceId. A token minted by a
+    // worktree/fork instance was signed under a different instanceId, so it will
+    // not match here — that is the boundary that keeps fork tokens out of the
+    // live plane (PAP-12896/PAP-12899). Fall back to the raw master secret so
+    // tokens issued before per-company derivation existed continue to verify —
+    // this preserves backward compatibility for any outstanding tokens (TTL
+    // bounds the legacy window naturally).
     //
     // Operators should set `PAPERCLIP_AGENT_JWT_DISABLE_LEGACY_FALLBACK=true`
     // approximately one JWT TTL (~1h by default, see PAPERCLIP_AGENT_JWT_TTL_SECONDS)
     // after deploying per-company signing. Once set, the master-secret fallback
-    // is disabled and only tokens validating under the per-company derived key
-    // are accepted — closing the window in which a leaked master secret could
-    // be used to forge tokens with arbitrary future `exp` values for any tenant.
-    const perCompanyKey = deriveCompanySigningKey(config.secret, claimedCompanyId);
+    // is disabled and only tokens validating under the per-instance/per-company
+    // derived key are accepted — closing the window in which a leaked master
+    // secret could be used to forge tokens with arbitrary future `exp` values for
+    // any tenant, and completing cryptographic isolation between control-plane
+    // instances (the raw-secret fallback is instance-agnostic).
+    const perCompanyKey = deriveCompanySigningKey(config.secret, claimedCompanyId, config.instanceId);
     const perCompanySig = signPayload(perCompanyKey, signingInput);
     let signatureOk = safeCompare(signature, perCompanySig);
     if (!signatureOk && !config.disableLegacyFallback) {
@@ -153,6 +182,15 @@ export function verifyLocalAgentJwt(token) {
         return null;
     if (audience && audience !== config.audience)
         return null;
+    // Enforce the minting instance when the claim is present. The instance-scoped
+    // signing key above is the real cryptographic boundary; this claim check is
+    // defense-in-depth that yields a clean, cheap rejection (and, once legacy
+    // tokens have aged out, guards the master-secret fallback path too). Legacy
+    // tokens minted before this claim existed omit it and are still accepted, so
+    // enforcement is conditional — matching how iss/aud are handled above.
+    const instanceClaim = typeof claims.instance_id === "string" ? claims.instance_id : undefined;
+    if (instanceClaim && instanceClaim !== config.instanceId)
+        return null;
     return {
         sub,
         company_id: companyId,
@@ -163,6 +201,7 @@ export function verifyLocalAgentJwt(token) {
         exp,
         ...(issuer ? { iss: issuer } : {}),
         ...(audience ? { aud: audience } : {}),
+        ...(instanceClaim ? { instance_id: instanceClaim } : {}),
         jti: typeof claims.jti === "string" ? claims.jti : undefined,
     };
 }

package/dist/agent-auth-jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-auth-jwt.js","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoB1D,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B,SAAS,WAAW,CAAC,KAAyB,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC;AACpG,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACL,MAAM;QACN,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC;QAC7E,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,WAAW;QAC7D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,eAAe;QACrE,qBAAqB,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC;KAChG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,YAAoB,EAAE,SAAiB;IACtE,OAAO,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,YAAoB;IACvD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,SAAiB,EACjB,WAAmB,EACnB,KAAa,EACb,iBAAiC;IAEjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,OAAO;QACZ,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI;QACtD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU;QAC5B,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,QAAQ;KACrB,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7G,2EAA2E;IAC3E,kBAAkB;IAClB,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAExD,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,+DAA+D;IAC/D,EAAE;IACF,0EAA0E;IAC1E,kFAAkF;IAClF,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACvE,CAAC,CAAC,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnF,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1D,OAAO;QACL,GAAG;QACH,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG;QACH,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agent-auth-jwt.js","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAqB7D,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B,SAAS,WAAW,CAAC,KAAyB,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC;AACpG,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACL,MAAM;QACN,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC;QAC7E,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,WAAW;QAC7D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,eAAe;QACrE,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,UAAU,EAAE,0BAA0B,EAAE;QACxC,qBAAqB,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC;KAChG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,uBAAuB,CAAC,YAAoB,EAAE,SAAiB,EAAE,UAAkB;IAC1F,OAAO,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,YAAoB;IACvD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,SAAiB,EACjB,WAAmB,EACnB,KAAa,EACb,iBAAiC;IAEjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,OAAO;QACZ,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI;QACtD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU;QAC5B,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,QAAQ;QACpB,WAAW,EAAE,MAAM,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7G,wEAAwE;IACxE,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAExD,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,0EAA0E;IAC1E,kFAAkF;IAClF,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACvE,CAAC,CAAC,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnF,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1D,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,aAAa,IAAI,aAAa,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,OAAO;QACL,GAAG;QACH,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG;QACH,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAyFzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CA6/B1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA0FzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CAygC1D"}

package/dist/index.js

@@ -18,7 +18,7 @@ import { loadConfig } from "./config.js";
 import { logger } from "./middleware/logger.js";
 import { setupEnvironmentCustomImageTerminalWebSocketServer } from "./realtime/environment-custom-image-terminal-ws.js";
 import { setupLiveEventsWebSocketServer } from "./realtime/live-events-ws.js";
-import { feedbackService, backfillPrincipalAccessCompatibility, bootstrapExecutionPolicyFromEnv, environmentCustomImageService, heartbeatService, instanceSettingsService, reconcileCloudUpstreamRunsOnStartup, reconcileCodexLocalManagedHomesOnStartup, reconcilePersistedRuntimeServicesOnStartup, routineService, } from "./services/index.js";
+import { feedbackService, backfillPrincipalAccessCompatibility, bootstrapExecutionPolicyFromEnv, environmentCustomImageService, heartbeatService, instanceSettingsService, reconcileCloudUpstreamRunsOnStartup, reconcileCodexLocalManagedHomesOnStartup, reconcilePersistedRuntimeServicesOnStartup, resolveHeartbeatSchedulingSuppression, routineService, } from "./services/index.js";
 import { parseAdapterRegistryEnv, reconcileAdapterAvailability, } from "./services/adapter-registry-bootstrap.js";
 import { createFeedbackTraceShareClientFromConfig } from "./services/feedback-share-client.js";
 import { buildRuntimeApiCandidateUrls, choosePrimaryRuntimeApiUrl } from "./runtime-api.js";
@@ -628,77 +628,85 @@ export async function startServer() {
         const heartbeat = heartbeatService(db, { pluginWorkerManager });
         const environmentCustomImages = environmentCustomImageService(db, { pluginWorkerManager });
         const routines = routineService(db, { pluginWorkerManager });
+        const heartbeatSchedulingSuppression = resolveHeartbeatSchedulingSuppression();
         // Reap orphaned runs before timer ticks start so wakeups cannot coalesce
         // into a dead "running" row during startup recovery.
-        await (async () => {
-            for (let attempt = 1; attempt <= 2; attempt++) {
-                try {
-                    const result = await heartbeat.reapOrphanedRuns();
-                    logger.info({ reaped: result.reaped, runIds: result.runIds }, "startup reap of orphaned heartbeat runs complete");
-                    break;
-                }
-                catch (err) {
-                    if (attempt < 2) {
-                        logger.warn({ err, attempt }, "startup reap failed, retrying");
+        if (heartbeatSchedulingSuppression.suppressed) {
+            logger.warn({ reason: heartbeatSchedulingSuppression.reason }, "heartbeat scheduling suppressed for this runtime instance");
+        }
+        else {
+            await (async () => {
+                for (let attempt = 1; attempt <= 2; attempt++) {
+                    try {
+                        const result = await heartbeat.reapOrphanedRuns();
+                        logger.info({ reaped: result.reaped, runIds: result.runIds }, "startup reap of orphaned heartbeat runs complete");
+                        break;
                     }
-                    else {
-                        logger.error({ err }, "startup reap of orphaned heartbeat runs failed after retry — periodic reaper will serve as degraded backstop");
+                    catch (err) {
+                        if (attempt < 2) {
+                            logger.warn({ err, attempt }, "startup reap failed, retrying");
+                        }
+                        else {
+                            logger.error({ err }, "startup reap of orphaned heartbeat runs failed after retry — periodic reaper will serve as degraded backstop");
+                        }
                     }
                 }
-            }
-            const promotion = await heartbeat.promoteDueScheduledRetries();
-            await heartbeat.resumeQueuedRuns();
-            const reconciled = await heartbeat.reconcileStrandedAssignedIssues();
-            if (promotion.promoted > 0 ||
-                reconciled.assignmentDispatched > 0 ||
-                reconciled.dispatchRequeued > 0 ||
-                reconciled.continuationRequeued > 0 ||
-                reconciled.successfulRunHandoffEscalated > 0 ||
-                reconciled.escalated > 0) {
-                logger.warn({ promotedScheduledRetries: promotion.promoted, promotedScheduledRetryRunIds: promotion.runIds, ...reconciled }, "startup heartbeat recovery changed assigned issue state");
-            }
-            const issueGraphReconciled = await heartbeat.reconcileIssueGraphLiveness();
-            if (issueGraphReconciled.escalationsCreated > 0 || issueGraphReconciled.dependencyWakesHealed > 0) {
-                logger.warn({ ...issueGraphReconciled }, "startup issue-graph liveness reconciliation changed issue graph state");
-            }
-            const taskWatchdogsReconciled = await heartbeat.reconcileTaskWatchdogs();
-            if (taskWatchdogsReconciled.triggered > 0) {
-                logger.warn({ ...taskWatchdogsReconciled }, "startup task-watchdog reconciliation triggered watchdog work");
-            }
-            const scanned = await heartbeat.scanSilentActiveRuns();
-            if (scanned.created > 0 || scanned.escalated > 0) {
-                logger.warn({ ...scanned }, "startup active-run output watchdog created review work");
-            }
-            const swept = await heartbeat.sweepStaleIssueLocks();
-            if (swept.cleared > 0) {
-                logger.warn({ ...swept }, "startup stale-lock sweeper cleared issue locks");
-            }
-            const reviewed = await heartbeat.reconcileProductivityReviews();
-            if (reviewed.created > 0 || reviewed.updated > 0 || reviewed.failed > 0) {
-                logger.warn({ ...reviewed }, "startup productivity reconciliation created or updated review work");
-            }
-            const setupCleanup = await environmentCustomImages.cleanupExpiredSetupSessions();
-            if (setupCleanup.timedOut > 0 || setupCleanup.failed > 0) {
-                logger.warn({ ...setupCleanup }, "startup environment customImage setup cleanup changed sessions");
-            }
-        })().catch((err) => {
-            logger.error({ err }, "startup heartbeat recovery failed");
-        });
+                const promotion = await heartbeat.promoteDueScheduledRetries();
+                await heartbeat.resumeQueuedRuns();
+                const reconciled = await heartbeat.reconcileStrandedAssignedIssues();
+                if (promotion.promoted > 0 ||
+                    reconciled.assignmentDispatched > 0 ||
+                    reconciled.dispatchRequeued > 0 ||
+                    reconciled.continuationRequeued > 0 ||
+                    reconciled.successfulRunHandoffEscalated > 0 ||
+                    reconciled.escalated > 0) {
+                    logger.warn({ promotedScheduledRetries: promotion.promoted, promotedScheduledRetryRunIds: promotion.runIds, ...reconciled }, "startup heartbeat recovery changed assigned issue state");
+                }
+                const issueGraphReconciled = await heartbeat.reconcileIssueGraphLiveness();
+                if (issueGraphReconciled.escalationsCreated > 0 || issueGraphReconciled.dependencyWakesHealed > 0) {
+                    logger.warn({ ...issueGraphReconciled }, "startup issue-graph liveness reconciliation changed issue graph state");
+                }
+                const taskWatchdogsReconciled = await heartbeat.reconcileTaskWatchdogs();
+                if (taskWatchdogsReconciled.triggered > 0) {
+                    logger.warn({ ...taskWatchdogsReconciled }, "startup task-watchdog reconciliation triggered watchdog work");
+                }
+                const scanned = await heartbeat.scanSilentActiveRuns();
+                if (scanned.created > 0 || scanned.escalated > 0) {
+                    logger.warn({ ...scanned }, "startup active-run output watchdog created review work");
+                }
+                const swept = await heartbeat.sweepStaleIssueLocks();
+                if (swept.cleared > 0) {
+                    logger.warn({ ...swept }, "startup stale-lock sweeper cleared issue locks");
+                }
+                const reviewed = await heartbeat.reconcileProductivityReviews();
+                if (reviewed.created > 0 || reviewed.updated > 0 || reviewed.failed > 0) {
+                    logger.warn({ ...reviewed }, "startup productivity reconciliation created or updated review work");
+                }
+            })().catch((err) => {
+                logger.error({ err }, "startup heartbeat recovery failed");
+            });
+        }
+        const setupCleanup = await environmentCustomImages.cleanupExpiredSetupSessions();
+        if (setupCleanup.timedOut > 0 || setupCleanup.failed > 0) {
+            logger.warn({ ...setupCleanup }, "startup environment customImage setup cleanup changed sessions");
+        }
         setInterval(() => {
             const sweptRuntimeStatuses = heartbeat.sweepExpiredRuntimeStatuses();
             if (sweptRuntimeStatuses > 0) {
                 logger.info({ swept: sweptRuntimeStatuses }, "heartbeat runtime-status sweeper cleared expired entries");
             }
-            void heartbeat
-                .tickTimers(new Date())
-                .then((result) => {
-                if (result.enqueued > 0) {
-                    logger.info({ ...result }, "heartbeat timer tick enqueued runs");
-                }
-            })
-                .catch((err) => {
-                logger.error({ err }, "heartbeat timer tick failed");
-            });
+            if (!resolveHeartbeatSchedulingSuppression().suppressed) {
+                void heartbeat
+                    .tickTimers(new Date())
+                    .then((result) => {
+                    if (result.enqueued > 0) {
+                        logger.info({ ...result }, "heartbeat timer tick enqueued runs");
+                    }
+                })
+                    .catch((err) => {
+                    logger.error({ err }, "heartbeat timer tick failed");
+                });
+            }
             void routines
                 .tickScheduledTriggers(new Date())
                 .then((result) => {
@@ -719,56 +727,58 @@ export async function startServer() {
                 .catch((err) => {
                 logger.error({ err }, "environment customImage setup cleanup failed");
             });
-            // Periodically reap orphaned runs (5-min staleness threshold) and make sure
-            // persisted queued work is still being driven forward.
-            void heartbeat
-                .reapOrphanedRuns({ staleThresholdMs: 5 * 60 * 1000 })
-                .then(() => heartbeat.promoteDueScheduledRetries())
-                .then(async (promotion) => {
-                await heartbeat.resumeQueuedRuns();
-                const reconciled = await heartbeat.reconcileStrandedAssignedIssues();
-                if (promotion.promoted > 0 ||
-                    reconciled.assignmentDispatched > 0 ||
-                    reconciled.dispatchRequeued > 0 ||
-                    reconciled.continuationRequeued > 0 ||
-                    reconciled.successfulRunHandoffEscalated > 0 ||
-                    reconciled.escalated > 0) {
-                    logger.warn({ promotedScheduledRetries: promotion.promoted, promotedScheduledRetryRunIds: promotion.runIds, ...reconciled }, "periodic heartbeat recovery changed assigned issue state");
-                }
-            })
-                .then(async () => {
-                const reconciled = await heartbeat.reconcileIssueGraphLiveness();
-                if (reconciled.escalationsCreated > 0 || reconciled.dependencyWakesHealed > 0) {
-                    logger.warn({ ...reconciled }, "periodic issue-graph liveness reconciliation changed issue graph state");
-                }
-            })
-                .then(async () => {
-                const reconciled = await heartbeat.reconcileTaskWatchdogs();
-                if (reconciled.triggered > 0) {
-                    logger.warn({ ...reconciled }, "periodic task-watchdog reconciliation triggered watchdog work");
-                }
-            })
-                .then(async () => {
-                const scanned = await heartbeat.scanSilentActiveRuns();
-                if (scanned.created > 0 || scanned.escalated > 0) {
-                    logger.warn({ ...scanned }, "periodic active-run output watchdog created review work");
-                }
-            })
-                .then(async () => {
-                const swept = await heartbeat.sweepStaleIssueLocks();
-                if (swept.cleared > 0) {
-                    logger.warn({ ...swept }, "periodic stale-lock sweeper cleared issue locks");
-                }
-            })
-                .then(async () => {
-                const reviewed = await heartbeat.reconcileProductivityReviews();
-                if (reviewed.created > 0 || reviewed.updated > 0 || reviewed.failed > 0) {
-                    logger.warn({ ...reviewed }, "periodic productivity reconciliation created or updated review work");
-                }
-            })
-                .catch((err) => {
-                logger.error({ err }, "periodic heartbeat recovery failed");
-            });
+            if (!resolveHeartbeatSchedulingSuppression().suppressed) {
+                // Periodically reap orphaned runs (5-min staleness threshold) and make sure
+                // persisted queued work is still being driven forward.
+                void heartbeat
+                    .reapOrphanedRuns({ staleThresholdMs: 5 * 60 * 1000 })
+                    .then(() => heartbeat.promoteDueScheduledRetries())
+                    .then(async (promotion) => {
+                    await heartbeat.resumeQueuedRuns();
+                    const reconciled = await heartbeat.reconcileStrandedAssignedIssues();
+                    if (promotion.promoted > 0 ||
+                        reconciled.assignmentDispatched > 0 ||
+                        reconciled.dispatchRequeued > 0 ||
+                        reconciled.continuationRequeued > 0 ||
+                        reconciled.successfulRunHandoffEscalated > 0 ||
+                        reconciled.escalated > 0) {
+                        logger.warn({ promotedScheduledRetries: promotion.promoted, promotedScheduledRetryRunIds: promotion.runIds, ...reconciled }, "periodic heartbeat recovery changed assigned issue state");
+                    }
+                })
+                    .then(async () => {
+                    const reconciled = await heartbeat.reconcileIssueGraphLiveness();
+                    if (reconciled.escalationsCreated > 0 || reconciled.dependencyWakesHealed > 0) {
+                        logger.warn({ ...reconciled }, "periodic issue-graph liveness reconciliation changed issue graph state");
+                    }
+                })
+                    .then(async () => {
+                    const reconciled = await heartbeat.reconcileTaskWatchdogs();
+                    if (reconciled.triggered > 0) {
+                        logger.warn({ ...reconciled }, "periodic task-watchdog reconciliation triggered watchdog work");
+                    }
+                })
+                    .then(async () => {
+                    const scanned = await heartbeat.scanSilentActiveRuns();
+                    if (scanned.created > 0 || scanned.escalated > 0) {
+                        logger.warn({ ...scanned }, "periodic active-run output watchdog created review work");
+                    }
+                })
+                    .then(async () => {
+                    const swept = await heartbeat.sweepStaleIssueLocks();
+                    if (swept.cleared > 0) {
+                        logger.warn({ ...swept }, "periodic stale-lock sweeper cleared issue locks");
+                    }
+                })
+                    .then(async () => {
+                    const reviewed = await heartbeat.reconcileProductivityReviews();
+                    if (reviewed.created > 0 || reviewed.updated > 0 || reviewed.failed > 0) {
+                        logger.warn({ ...reviewed }, "periodic productivity reconciliation created or updated review work");
+                    }
+                })
+                    .catch((err) => {
+                    logger.error({ err }, "periodic heartbeat recovery failed");
+                });
+            }
         }, config.heartbeatSchedulerIntervalMs);
     }
     if (config.databaseBackupEnabled) {