@penclipai/server 2026.704.0 → 2026.714.0-canary.0

package/dist/routes/agents.js

@@ -3,12 +3,12 @@ import { generateKeyPairSync, randomUUID } from "node:crypto";
 import path from "node:path";
 import { agents as agentsTable, companies, heartbeatRuns, issues as issuesTable, projects as projectsTable } from "@penclipai/db";
 import { and, desc, eq, inArray, not, sql } from "drizzle-orm";
-import { agentSkillSyncSchema, agentMineInboxQuerySchema, AGENT_DEFAULT_MAX_CONCURRENT_RUNS, createAgentKeySchema, createAgentHireSchema, createAgentSchema, deriveAgentUrlKey, isUuidLike, normalizeIssueIdentifier, resetAgentSessionSchema, testAdapterEnvironmentSchema, upsertAgentInstructionsFileSchema, updateAgentInstructionsBundleSchema, updateAgentPermissionsSchema, updateAgentInstructionsPathSchema, wakeAgentSchema, updateAgentSchema, supportedEnvironmentDriversForAdapter, LOW_TRUST_REVIEW_PRESET, } from "@penclipai/shared";
+import { agentSkillSyncSchema, agentMineInboxQuerySchema, ADAPTER_AGNOSTIC_KEYS, AGENT_DEFAULT_MAX_CONCURRENT_RUNS, createAgentKeySchema, createAgentHireSchema, createAgentSchema, deriveAgentUrlKey, isUuidLike, normalizeIssueIdentifier, resetAgentSessionSchema, testAdapterEnvironmentSchema, upsertAgentInstructionsFileSchema, updateAgentInstructionsBundleSchema, updateAgentPermissionsSchema, updateAgentInstructionsPathSchema, wakeAgentSchema, updateAgentSchema, supportedEnvironmentDriversForAdapter, LOW_TRUST_REVIEW_PRESET, } from "@penclipai/shared";
 import { resolvePaperclipInstanceRootForAdapter, readPaperclipSkillSyncPreference, writePaperclipSkillSyncPreference, } from "@penclipai/adapter-utils/server-utils";
 import { trackAgentCreated } from "@penclipai/shared/telemetry";
 import { validate } from "../middleware/validate.js";
-import { agentService, agentInstructionsService, accessService, approvalService, companySkillService, budgetService, heartbeatService, ISSUE_LIST_DEFAULT_LIMIT, issueApprovalService, issueRecoveryActionService, issueService, logActivity, syncInstructionsBundleConfigFromFilePath, workspaceOperationService, } from "../services/index.js";
-import { conflict, forbidden, notFound, unprocessable } from "../errors.js";
+import { agentService, agentInstructionsService, accessService, approvalService, builtInAgentService, companySkillService, budgetService, heartbeatService, ISSUE_LIST_DEFAULT_LIMIT, issueApprovalService, issueRecoveryActionService, issueService, logActivity, syncInstructionsBundleConfigFromFilePath, workspaceOperationService, } from "../services/index.js";
+import { conflict, forbidden, HttpError, notFound, unprocessable } from "../errors.js";
 import { assertBoard, assertCompanyAccess, assertInstanceAdmin, getActorInfo } from "./authz.js";
 import { assertNoAgentHostWorkspaceCommandMutation, collectAgentAdapterWorkspaceCommandPaths, } from "./workspace-command-authz.js";
 import { environmentService } from "../services/environments.js";
@@ -16,15 +16,15 @@ import { resolveEnvironmentExecutionTarget } from "../services/environment-execu
 import { environmentRuntimeService } from "../services/environment-runtime.js";
 import { skillVersionSelectionMap } from "../services/runtime-skill-selections.js";
 import { secretService } from "../services/secrets.js";
+import { authorizationDeniedDetails } from "../services/authorization.js";
 import { detectAdapterModel, findActiveServerAdapter, findServerAdapter, listAdapterModels, listAdapterModelProfiles, refreshAdapterModels, requireServerAdapter, } from "../adapters/index.js";
 import { redactEventPayload } from "../redaction.js";
 import { redactCurrentUserValue } from "../log-redaction.js";
 import { resolveExplicitRequestUiLocale } from "../ui-locale.js";
 import { getBundledPaperclipSkillIdentity } from "../services/bundled-paperclip-skills.js";
 import { renderOrgChartSvg, renderOrgChartPng, ORG_CHART_STYLES } from "./org-chart-svg.js";
-import { instanceSettingsService } from "../services/instance-settings.js";
+import { instanceSettingsService, isTruthyRuntimeEnvValue, resolveWorktreeRunExecutionActivationState, } from "../services/instance-settings.js";
 import { runClaudeLogin } from "@penclipai/adapter-claude-local/server";
-import { DEFAULT_ACPX_LOCAL_AGENT, DEFAULT_ACPX_LOCAL_MODE, DEFAULT_ACPX_LOCAL_NON_INTERACTIVE_PERMISSIONS, DEFAULT_ACPX_LOCAL_PERMISSION_MODE, } from "@penclipai/adapter-acpx-local";
 import { DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX } from "@penclipai/adapter-codex-local";
 import { DEFAULT_CURSOR_LOCAL_MODEL } from "@penclipai/adapter-cursor-local";
 import { DEFAULT_GEMINI_LOCAL_MODEL } from "@penclipai/adapter-gemini-local";
@@ -37,6 +37,7 @@ import { recoveryService } from "../services/recovery/service.js";
 import { resolveCoreTrustPreset } from "../services/trust-preset-resolver.js";
 import { readObject } from "../lib/objects.js";
 import { listInvalidOrgChainDescendantIds } from "../services/agent-invokability.js";
+import { AGENT_PROFILE_CHANGE_CONSENT_FIELDS, agentInstructionsChangeTargetKey, agentProfileChangeTargetKey, changeConsentGateService, touchesAgentProfileChangeConsentFields, } from "../services/change-consent-gate.js";
 const RUN_LOG_DEFAULT_LIMIT_BYTES = 256_000;
 const RUN_LOG_MAX_LIMIT_BYTES = 1024 * 1024;
 function readRunLogLimitBytes(value) {
@@ -65,7 +66,6 @@ export function agentRoutes(db, options = {}) {
     // Legacy hardcoded maps — used as fallback when adapter module does not
     // declare capability flags explicitly.
     const DEFAULT_INSTRUCTIONS_PATH_KEYS = {
-        acpx_local: "instructionsFilePath",
         claude_local: "instructionsFilePath",
         codex_local: "instructionsFilePath",
         droid_local: "instructionsFilePath",
@@ -101,6 +101,7 @@ export function agentRoutes(db, options = {}) {
         "instructionsFilePath",
         "agentsMdPath",
     ];
+    const KNOWN_INSTRUCTIONS_BUNDLE_KEY_SET = new Set(KNOWN_INSTRUCTIONS_BUNDLE_KEYS);
     const router = Router();
     const svc = agentService(db);
     const access = accessService(db);
@@ -260,11 +261,26 @@ export function agentRoutes(db, options = {}) {
         // run id to heartbeat_runs.id, and we don't want to manufacture a fake
         // run row. Cleanup goes through the driver's `releaseRunLease` directly
         // (by lease record), since the batch helper queries by heartbeatRunId.
+        //
+        // Sandbox tests boot a fresh throwaway sandbox (never resume a retained
+        // agent lease) and archive it on release instead of deleting it, so the
+        // operator can inspect the exact sandbox from the provider dashboard while
+        // provider-side expiry reaps it later.
+        const testEnvironment = environment.driver === "sandbox"
+            ? {
+                ...environment,
+                config: {
+                    ...(environment.config ?? {}),
+                    reuseLease: false,
+                    archiveOnRelease: true,
+                },
+            }
+            : environment;
         let leaseRecord;
         try {
             leaseRecord = await environmentRuntime.acquireRunLease({
                 companyId: input.companyId,
-                environment,
+                environment: testEnvironment,
                 issueId: null,
                 heartbeatRunId: null,
                 persistedExecutionWorkspace: null,
@@ -296,7 +312,7 @@ export function agentRoutes(db, options = {}) {
             try {
                 if (driver) {
                     await driver.releaseRunLease({
-                        environment,
+                        environment: testEnvironment,
                         lease: leaseRecord.lease,
                         status,
                     });
@@ -314,7 +330,7 @@ export function agentRoutes(db, options = {}) {
         let realizedCwd = null;
         try {
             const realized = await environmentRuntime.realizeWorkspace({
-                environment,
+                environment: testEnvironment,
                 lease: leaseRecord.lease,
                 // No host workspace to copy for a Test invocation; sandbox/plugin
                 // realize implementations use the lease metadata's remoteCwd to
@@ -353,9 +369,9 @@ export function agentRoutes(db, options = {}) {
                 companyId: input.companyId,
                 adapterType: input.adapterType,
                 environment: {
-                    id: environment.id,
-                    driver: environment.driver,
-                    config: environment.config ?? null,
+                    id: testEnvironment.id,
+                    driver: testEnvironment.driver,
+                    config: testEnvironment.config ?? null,
                 },
                 leaseId: leaseRecord.lease.id,
                 leaseMetadata: leaseMetadataForTarget,
@@ -398,9 +414,64 @@ export function agentRoutes(db, options = {}) {
             executionTarget: target,
             environmentName: environment.name,
             fallbackChecks: [],
+            sandboxIdentityCheck: buildSandboxIdentityCheck({
+                environmentName: environment.name,
+                lease: leaseRecord.lease,
+            }),
             release: releaseLease,
         };
     }
+    function readMetadataString(metadata, keys) {
+        for (const key of keys) {
+            const value = metadata[key];
+            if (typeof value === "string" && value.trim().length > 0)
+                return value.trim();
+        }
+        return null;
+    }
+    function buildSandboxIdentityCheck(input) {
+        const metadata = input.lease.metadata ?? {};
+        const provider = input.lease.provider ?? readMetadataString(metadata, ["provider"]);
+        const sandboxId = readMetadataString(metadata, ["sandboxId", "sandboxID", "sandbox_id", "id"]);
+        const sandboxName = readMetadataString(metadata, ["sandboxName", "sandbox_name", "name"]);
+        const snapshotRef = readMetadataString(metadata, [
+            "snapshot",
+            "snapshotId",
+            "snapshotID",
+            "snapshotRef",
+            "snapshot_ref",
+            "templateRef",
+            "template_ref",
+            "templateId",
+            "templateID",
+            "image",
+            "imageId",
+            "imageID",
+            "imageRef",
+            "image_ref",
+        ]);
+        const templateKind = readMetadataString(metadata, [
+            "templateKind",
+            "template_kind",
+            "templateRefKind",
+            "template_ref_kind",
+        ]);
+        const detailParts = [
+            `paperclipLeaseId=${input.lease.id}`,
+            input.lease.providerLeaseId ? `providerLeaseId=${input.lease.providerLeaseId}` : null,
+            provider ? `provider=${provider}` : null,
+            sandboxId ? `sandboxId=${sandboxId}` : null,
+            sandboxName ? `sandboxName=${sandboxName}` : null,
+            snapshotRef ? `${templateKind ? `${templateKind}Ref` : "snapshotOrTemplateRef"}=${snapshotRef}` : null,
+        ].filter((part) => Boolean(part));
+        return {
+            code: "sandbox_test_identity",
+            level: "info",
+            message: `Sandbox test identity for "${input.environmentName}".`,
+            detail: detailParts.join("; "),
+            hint: "Use these provider-neutral IDs when comparing model-test output with provider logs or refreshed sandbox snapshots.",
+        };
+    }
     async function getCurrentUserRedactionOptions() {
         return {
             enabled: (await instanceSettings.getGeneral()).censorUsernameInLogs,
@@ -539,7 +610,7 @@ export function agentRoutes(db, options = {}) {
             resource: { type: "company", companyId },
         });
         if (!decision.allowed) {
-            throw forbidden(decision.explanation);
+            throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
         }
         if (req.actor.type !== "agent")
             return null;
@@ -559,33 +630,29 @@ export function agentRoutes(db, options = {}) {
         });
         if (decision.allowed)
             return;
-        throw forbidden(decision.explanation);
+        throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
     }
     async function assertCanReadConfigurations(req, companyId) {
         // Reading agent configurations, skills, and config revisions is a
         // read-only operation available to any board (human) member of the
         // company. Responses go through `redactAgentConfiguration` so secrets
         // are never exposed. Mutations and environment probes still gate on
-        // agents:create via assertCanCreateAgentsForCompany / assertCanUpdateAgent.
+        // agents:create or agents:configure via the mutating route helpers.
         //
-        // For AGENT actors we keep the previous, stricter gate: an agent must
-        // either have an explicit `agents:create` grant or the legacy
-        // `canCreateAgents` permission on its own record. Agents are
-        // non-human principals — they should not be able to introspect peer
-        // agents' configurations just by virtue of being in the same company.
+        // For AGENT actors we keep a stricter gate: an agent must have either
+        // agents:configure or agents:suggest-changes before it can inspect peer
+        // agent configuration for a proposed diff.
         assertCompanyAccess(req, companyId);
         if (req.actor.type === "agent") {
-            if (!req.actor.agentId)
-                throw forbidden("Agent authentication required");
-            const actorAgent = await svc.getById(req.actor.agentId);
-            if (!actorAgent || actorAgent.companyId !== companyId) {
-                throw forbidden("Agent key cannot access another company");
-            }
-            const allowedByGrant = await access.hasPermission(companyId, "agent", actorAgent.id, "agents:create");
-            if (!allowedByGrant && !canCreateAgents(actorAgent)) {
-                throw forbidden("Missing permission: can create agents");
+            const decision = await access.decide({
+                actor: req.actor,
+                action: "agent_config:read",
+                resource: { type: "company", companyId },
+            });
+            if (!decision.allowed) {
+                throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
             }
-            return actorAgent;
+            return req.actor.agentId ? await svc.getById(req.actor.agentId) : null;
         }
         return null;
     }
@@ -603,10 +670,9 @@ export function agentRoutes(db, options = {}) {
     }
     async function actorCanReadConfigurationsForCompany(req, companyId) {
         // Mirrors assertCanReadConfigurations but returns a boolean instead of
-        // throwing. Board actors only need company access; agent actors must
-        // still pass the agents:create gate (explicit grant or canCreateAgents
-        // on their own record) so peer agents cannot snoop each others'
-        // configurations.
+        // throwing. Board actors only need company access; agent actors must pass
+        // the agent configuration read grant ladder so peer agents cannot snoop
+        // each others' configurations.
         try {
             assertCompanyAccess(req, companyId);
         }
@@ -615,13 +681,12 @@ export function agentRoutes(db, options = {}) {
         }
         if (req.actor.type === "board")
             return true;
-        if (!req.actor.agentId)
-            return false;
-        const actorAgent = await svc.getById(req.actor.agentId);
-        if (!actorAgent || actorAgent.companyId !== companyId)
-            return false;
-        const allowedByGrant = await access.hasPermission(companyId, "agent", actorAgent.id, "agents:create");
-        return allowedByGrant || canCreateAgents(actorAgent);
+        const decision = await access.decide({
+            actor: req.actor,
+            action: "agent_config:read",
+            resource: { type: "company", companyId },
+        });
+        return decision.allowed;
     }
     async function buildSkippedWakeupResponse(agent, payload) {
         const issueId = typeof payload?.issueId === "string" && payload.issueId.trim() ? payload.issueId : null;
@@ -690,7 +755,7 @@ export function agentRoutes(db, options = {}) {
         });
         if (decision.allowed)
             return;
-        throw forbidden(decision.explanation);
+        throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
     }
     async function assertCanReadAgent(req, targetAgent) {
         assertCompanyAccess(req, targetAgent.companyId);
@@ -704,6 +769,14 @@ export function agentRoutes(db, options = {}) {
         if (!actorAgent || actorAgent.companyId !== targetAgent.companyId) {
             throw forbidden("Agent key cannot access another company");
         }
+        const decision = await access.decide({
+            actor: req.actor,
+            action: "agent_config:read",
+            resource: { type: "agent", companyId: targetAgent.companyId, agentId: targetAgent.id },
+        });
+        if (decision.allowed)
+            return;
+        throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
     }
     function assertKnownAdapterType(type) {
         const adapterType = typeof type === "string" ? type.trim() : "";
@@ -984,21 +1057,6 @@ export function agentRoutes(db, options = {}) {
     }
     function applyCreateDefaultsByAdapterType(adapterType, adapterConfig) {
         const next = { ...adapterConfig };
-        if (adapterType === "acpx_local") {
-            if (!asNonEmptyString(next.agent)) {
-                next.agent = DEFAULT_ACPX_LOCAL_AGENT;
-            }
-            if (!asNonEmptyString(next.mode)) {
-                next.mode = DEFAULT_ACPX_LOCAL_MODE;
-            }
-            if (!asNonEmptyString(next.permissionMode)) {
-                next.permissionMode = DEFAULT_ACPX_LOCAL_PERMISSION_MODE;
-            }
-            if (!asNonEmptyString(next.nonInteractivePermissions)) {
-                next.nonInteractivePermissions = DEFAULT_ACPX_LOCAL_NON_INTERACTIVE_PERMISSIONS;
-            }
-            return ensureGatewayDeviceKey(adapterType, next);
-        }
         if (adapterType === "codex_local") {
             const hasBypassFlag = typeof next.dangerouslyBypassApprovalsAndSandbox === "boolean" ||
                 typeof next.dangerouslyBypassSandbox === "boolean";
@@ -1062,7 +1120,9 @@ export function agentRoutes(db, options = {}) {
             delete nextAdapterConfig.bootstrapPromptTemplate;
             if (!hadLegacyPrompt)
                 return agent;
-            const updated = await svc.update(agent.id, { adapterConfig: nextAdapterConfig });
+            const updated = await svc.update(agent.id, { adapterConfig: nextAdapterConfig }, {
+                allowPendingApprovalConfigUpdate: true,
+            });
             return updated ?? { ...agent, adapterConfig: nextAdapterConfig };
         }
         const files = input?.files
@@ -1071,7 +1131,9 @@ export function agentRoutes(db, options = {}) {
         const nextAdapterConfig = { ...materialized.adapterConfig };
         delete nextAdapterConfig.promptTemplate;
         delete nextAdapterConfig.bootstrapPromptTemplate;
-        const updated = await svc.update(agent.id, { adapterConfig: nextAdapterConfig });
+        const updated = await svc.update(agent.id, { adapterConfig: nextAdapterConfig }, {
+            allowPendingApprovalConfigUpdate: true,
+        });
         return updated ?? { ...agent, adapterConfig: nextAdapterConfig };
     }
     function assertNoNewAgentLegacyPromptTemplate(adapterType, adapterConfig) {
@@ -1082,12 +1144,51 @@ export function agentRoutes(db, options = {}) {
             throw unprocessable("New agents must use instructionsBundle/AGENTS.md instead of adapterConfig.promptTemplate or bootstrapPromptTemplate");
         }
     }
-    async function assertCanManageInstructionsPath(req, targetAgent) {
+    async function assertCanApplyProtectedAgentChange(req, targetAgent, targetKeys) {
         assertCompanyAccess(req, targetAgent.companyId);
-        if (req.actor.type !== "board") {
-            throw forbidden("Only board-authenticated callers can manage instructions path or bundle configuration");
+        const changeScope = { requiresChangeGrant: true };
+        const decision = await access.decide({
+            actor: req.actor,
+            action: "agent_config:update",
+            resource: { type: "agent", companyId: targetAgent.companyId, agentId: targetAgent.id },
+            scope: changeScope,
+        });
+        if (decision.allowed) {
+            return;
+        }
+        if (decision.reason === "deny_missing_consent" && req.actor.type === "agent" && targetKeys.length > 0) {
+            try {
+                await changeConsentGateService(db).assertConsented({
+                    companyId: targetAgent.companyId,
+                    actorAgentId: req.actor.agentId,
+                    actorRunId: req.actor.runId ?? null,
+                    targetKeys,
+                });
+            }
+            catch (err) {
+                if (err instanceof HttpError && err.status === 403) {
+                    throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
+                }
+                throw err;
+            }
+            const consentedDecision = await access.decide({
+                actor: req.actor,
+                action: "agent_config:update",
+                resource: { type: "agent", companyId: targetAgent.companyId, agentId: targetAgent.id },
+                scope: { ...changeScope, consentedChange: true },
+            });
+            if (consentedDecision.allowed) {
+                return;
+            }
+            throw forbidden(consentedDecision.explanation, authorizationDeniedDetails(consentedDecision));
         }
-        await assertBoardCanManageAgentsForCompany(req, targetAgent.companyId);
+        throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
+    }
+    async function assertCanManageInstructionsPath(req, targetAgent) {
+        await assertCanApplyProtectedAgentChange(req, targetAgent, [agentInstructionsChangeTargetKey(targetAgent.id)]);
+    }
+    async function assertCanApplyAgentProfileChange(req, targetAgent) {
+        await assertCanApplyProtectedAgentChange(req, targetAgent, [agentProfileChangeTargetKey(targetAgent.id)]);
     }
     function assertNoAgentInstructionsConfigMutation(req, adapterConfig, path = "adapterConfig") {
         if (req.actor.type !== "agent" || !adapterConfig)
@@ -1175,7 +1276,7 @@ export function agentRoutes(db, options = {}) {
             paperclipRuntimeSkills: runtimeSkillEntries,
         };
     }
-    async function resolveDesiredSkillAssignment(companyId, adapterType, adapterConfig, requestedDesiredSkills) {
+    async function resolveDesiredSkillAssignment(companyId, adapterType, adapterConfig, requestedDesiredSkills, options = {}) {
         if (!requestedDesiredSkills) {
             return {
                 adapterConfig,
@@ -1184,18 +1285,22 @@ export function agentRoutes(db, options = {}) {
                 runtimeSkillEntries: null,
             };
         }
-        const resolvedRequestedSkillEntries = await companySkills.resolveRequestedSkillEntries(companyId, requestedDesiredSkills);
+        const { resolved: resolvedRequestedSkillEntries, unresolved: unresolvedDesiredSkillKeys } = await companySkills.resolveRequestedSkillEntries(companyId, requestedDesiredSkills, {
+            tolerateUnknownReferences: options.tolerateUnknownDesiredSkills,
+        });
+        // Runtime materialization + version selection only ever consider skills that
+        // actually resolve to the company library; stale keys can't be materialized.
         const runtimeSkillEntries = await companySkills.listRuntimeSkillEntries(companyId, {
             materializeMissing: shouldMaterializeRuntimeSkillsForAdapter(adapterType),
             versionSelections: skillVersionSelectionMap(resolvedRequestedSkillEntries),
         });
-        const requiredSkills = runtimeSkillEntries
-            .filter((entry) => entry.required)
-            .map((entry) => entry.key);
+        const resolvedDesiredSkillEntries = resolvedRequestedSkillEntries.filter((entry, index, entries) => entries.findIndex((candidate) => candidate.key === entry.key) === index);
+        // Preserve stale/unresolvable keys in the persisted desired set so they stay
+        // visible (and explicitly removable) instead of vanishing on the next save.
         const desiredSkillEntries = [
-            ...requiredSkills.map((key) => ({ key, versionId: null })),
-            ...resolvedRequestedSkillEntries,
-        ].filter((entry, index, entries) => entries.findIndex((candidate) => desiredSkillEntryIdentity(candidate) === desiredSkillEntryIdentity(entry)) === index);
+            ...resolvedDesiredSkillEntries,
+            ...unresolvedDesiredSkillKeys.map((key) => ({ key, versionId: null })),
+        ];
         const desiredSkills = desiredSkillEntries.map((entry) => entry.key);
         return {
             adapterConfig: writePaperclipSkillSyncPreference(adapterConfig, desiredSkillEntries),
@@ -1324,7 +1429,7 @@ export function agentRoutes(db, options = {}) {
             : null;
         const normalizedAdapterConfig = await secretsSvc.normalizeAdapterConfigForPersistence(companyId, inputAdapterConfig, { strictMode: strictSecretsMode, adapterType: type });
         const { config: runtimeAdapterConfig } = await secretsSvc.resolveAdapterConfigForRuntime(companyId, normalizedAdapterConfig, undefined, { adapterType: type });
-        const { executionTarget, environmentName, fallbackChecks, release } = await resolveAdapterTestExecutionContext({
+        const { executionTarget, environmentName, fallbackChecks, sandboxIdentityCheck, release } = await resolveAdapterTestExecutionContext({
             companyId,
             adapterType: type,
             environmentId: requestedEnvironmentId,
@@ -1360,7 +1465,10 @@ export function agentRoutes(db, options = {}) {
             });
             if (result.status === "fail")
                 releaseStatus = "failed";
-            res.json(result);
+            res.json({
+                ...result,
+                checks: sandboxIdentityCheck ? [sandboxIdentityCheck, ...result.checks] : result.checks,
+            });
         }
         catch (err) {
             releaseStatus = "failed";
@@ -1385,7 +1493,7 @@ export function agentRoutes(db, options = {}) {
             res.json(buildUnsupportedSkillSnapshot(agent.adapterType, desiredSkillEntries));
             return;
         }
-        const { config: runtimeConfig } = await secretsSvc.resolveAdapterConfigForRuntime(agent.companyId, agent.adapterConfig);
+        const { config: runtimeConfig } = await secretsSvc.resolveAdapterConfigForRuntime(agent.companyId, agent.adapterConfig, undefined, { adapterType: agent.adapterType, skipUserSecrets: true });
         const runtimeSkillConfig = await buildRuntimeSkillConfig(agent.companyId, agent.adapterType, runtimeConfig, { materializeMissing: false });
         const snapshot = await adapter.listSkills({
             agentId: agent.id,
@@ -1404,7 +1512,11 @@ export function agentRoutes(db, options = {}) {
         }
         await assertCanUpdateAgent(req, agent);
         const requestedSkills = normalizeDesiredSkillSelections(req.body.desiredSkills);
-        const { adapterConfig: nextAdapterConfig, desiredSkills, desiredSkillEntries, runtimeSkillEntries, } = await resolveDesiredSkillAssignment(agent.companyId, agent.adapterType, agent.adapterConfig, requestedSkills);
+        const { adapterConfig: nextAdapterConfig, desiredSkills, desiredSkillEntries, runtimeSkillEntries, } = await resolveDesiredSkillAssignment(agent.companyId, agent.adapterType, agent.adapterConfig, requestedSkills, 
+        // Toggling a resolvable skill must not fail just because the agent
+        // already carries stale desired keys (e.g. a skill removed from the
+        // library). Preserve those keys so they remain visible/removable.
+        { tolerateUnknownDesiredSkills: true });
         if (!desiredSkills || !desiredSkillEntries || !runtimeSkillEntries) {
             throw unprocessable("Skill sync requires desiredSkills.");
         }
@@ -1423,7 +1535,7 @@ export function agentRoutes(db, options = {}) {
             return;
         }
         const adapter = findActiveServerAdapter(updated.adapterType);
-        const { config: runtimeConfig } = await secretsSvc.resolveAdapterConfigForRuntime(updated.companyId, updated.adapterConfig);
+        const { config: runtimeConfig } = await secretsSvc.resolveAdapterConfigForRuntime(updated.companyId, updated.adapterConfig, undefined, { adapterType: updated.adapterType, skipUserSecrets: true });
         const runtimeSkillConfig = {
             ...runtimeConfig,
             paperclipRuntimeSkills: runtimeSkillEntries,
@@ -1619,12 +1731,21 @@ export function agentRoutes(db, options = {}) {
             includeRoutineExecutions: true,
             limit: ISSUE_LIST_DEFAULT_LIMIT,
         });
-        const issueIds = rows.map((issue) => issue.id);
+        const worktreeActivation = await resolveWorktreeRunExecutionActivationState({
+            getExperimental: () => instanceSettingsService(db).getExperimental(),
+        });
+        const isWorktreeRuntime = isTruthyRuntimeEnvValue(process.env.PAPERCLIP_IN_WORKTREE);
+        const eligibleRows = !isWorktreeRuntime
+            ? rows
+            : worktreeActivation.armed
+                ? rows.filter((issue) => new Date(issue.createdAt) >= new Date(worktreeActivation.cutoff))
+                : [];
+        const issueIds = eligibleRows.map((issue) => issue.id);
         const [dependencyReadiness, recoveryActionByIssue] = await Promise.all([
             issuesSvc.listDependencyReadiness(req.actor.companyId, issueIds),
             recoveryActionsSvc.listActiveForIssues(req.actor.companyId, issueIds),
         ]);
-        res.json(rows.map((issue) => ({
+        res.json(eligibleRows.map((issue) => ({
             id: issue.id,
             identifier: issue.identifier,
             title: issue.title,
@@ -2004,6 +2125,7 @@ export function agentRoutes(db, options = {}) {
             trackAgentCreated(telemetryClient, { agentRole: agent.role, agentId: agent.id });
         }
         await applyDefaultAgentTaskAssignGrant(companyId, agent.id, req.actor.type === "board" ? (req.actor.userId ?? null) : null);
+        await builtInAgentService(db).ensureCompanyDefaultAgentGrants(companyId);
         if (agent.budgetMonthlyCents > 0) {
             await budgets.upsertPolicy(companyId, {
                 scopeType: "agent",
@@ -2264,7 +2386,7 @@ export function agentRoutes(db, options = {}) {
             res.status(404).json({ error: "Agent not found" });
             return;
         }
-        await assertCanUpdateAgent(req, existing);
+        assertCompanyAccess(req, existing.companyId);
         if (hasOwn(req.body, "permissions")) {
             res.status(422).json({ error: "Use /api/agents/:id/permissions for permission changes" });
             return;
@@ -2319,11 +2441,9 @@ export function agentRoutes(db, options = {}) {
                 // Preserve adapter-agnostic keys (env, cwd, etc.) from the existing config
                 // when the adapter type changes. Without this, a PATCH that includes
                 // adapterConfig but omits these keys would silently drop them.
-                const ADAPTER_AGNOSTIC_KEYS = [
-                    "env", "cwd", "timeoutSec", "graceSec",
-                    "promptTemplate", "bootstrapPromptTemplate",
-                ];
                 for (const key of ADAPTER_AGNOSTIC_KEYS) {
+                    if (KNOWN_INSTRUCTIONS_BUNDLE_KEY_SET.has(key))
+                        continue;
                     if (rawEffectiveAdapterConfig[key] === undefined && existingAdapterConfig[key] !== undefined) {
                         rawEffectiveAdapterConfig = { ...rawEffectiveAdapterConfig, [key]: existingAdapterConfig[key] };
                     }
@@ -2350,6 +2470,14 @@ export function agentRoutes(db, options = {}) {
                 allowedSandboxProviders: allowedSandboxProvidersForAgent(requestedAdapterType),
             });
         }
+        const touchesProfileFields = touchesAgentProfileChangeConsentFields(patchData);
+        const profileOnlyChange = touchesProfileFields && Object.keys(patchData).every((key) => AGENT_PROFILE_CHANGE_CONSENT_FIELDS.includes(key));
+        if (profileOnlyChange) {
+            await assertCanApplyAgentProfileChange(req, existing);
+        }
+        else {
+            await assertCanUpdateAgent(req, existing);
+        }
         const actor = getActorInfo(req);
         const agent = await svc.update(id, patchData, {
             recordRevision: {
@@ -2602,7 +2730,9 @@ export function agentRoutes(db, options = {}) {
         if (!agent) {
             return;
         }
-        const key = await svc.createApiKey(id, req.body.name, req.body.scope);
+        const key = await svc.createApiKey(id, req.body.name, req.body.scope, {
+            responsibleUserId: req.actor.userId ?? null,
+        });
         await logActivity(db, {
             companyId: agent.companyId,
             actorType: "user",
@@ -2610,7 +2740,12 @@ export function agentRoutes(db, options = {}) {
             action: "agent.key_created",
             entityType: "agent",
             entityId: agent.id,
-            details: { keyId: key.id, name: key.name, scope: key.scope },
+            details: {
+                keyId: key.id,
+                name: key.name,
+                scope: key.scope,
+                responsibleUserId: key.responsibleUserId,
+            },
         });
         res.status(201).json(key);
     });
@@ -2692,7 +2827,7 @@ export function agentRoutes(db, options = {}) {
             actorType: actor.actorType,
             actorId: actor.actorId,
             agentId: actor.agentId,
-            runId: actor.runId,
+            runId: run.id,
             action: "heartbeat.invoked",
             entityType: "heartbeat_run",
             entityId: run.id,
@@ -2775,7 +2910,7 @@ export function agentRoutes(db, options = {}) {
             actorType: actor.actorType,
             actorId: actor.actorId,
             agentId: actor.agentId,
-            runId: actor.runId,
+            runId: run.id,
             action: "heartbeat.invoked",
             entityType: "heartbeat_run",
             entityId: run.id,