@rudderhq/server 0.1.0-canary.2 → 0.1.0-canary.4

package/dist/bootstrap/register-api-routes.js

@@ -36,7 +36,7 @@ export function registerApiRoutes(db, opts, pluginRuntime) {
     }));
     api.use("/orgs", organizationRoutes(db, opts.storageService));
     api.use(organizationSkillRoutes(db));
-    api.use(agentRoutes(db));
+    api.use(agentRoutes(db, opts.storageService));
     api.use(assetRoutes(db, opts.storageService));
     api.use(projectRoutes(db));
     api.use(issueRoutes(db, opts.storageService));

package/dist/bootstrap/register-api-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-api-routes.js","sourceRoot":"","sources":["../../src/bootstrap/register-api-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAIxE,MAAM,UAAU,iBAAiB,CAC/B,EAAM,EACN,IAAsB,EACtB,aAAgC;IAEhC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CACL,SAAS,EACT,YAAY,CAAC,EAAE,EAAE;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,YAAY,CACV,EAAE,EACF,aAAa,CAAC,MAAM,EACpB,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,EACxE,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,EAC9C,EAAE,cAAc,EAAE,aAAa,CAAC,cAAc,EAAE,EAChD,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,CAC/C,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CACL,YAAY,CAAC,EAAE,EAAE;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CACH,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"register-api-routes.js","sourceRoot":"","sources":["../../src/bootstrap/register-api-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAIxE,MAAM,UAAU,iBAAiB,CAC/B,EAAM,EACN,IAAsB,EACtB,aAAgC;IAEhC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CACL,SAAS,EACT,YAAY,CAAC,EAAE,EAAE;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,YAAY,CACV,EAAE,EACF,aAAa,CAAC,MAAM,EACpB,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,EACxE,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,EAC9C,EAAE,cAAc,EAAE,aAAa,CAAC,cAAc,EAAE,EAChD,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,CAC/C,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CACL,YAAY,CAAC,EAAE,EAAE;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CACH,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/agents.d.ts

@@ -1,3 +1,4 @@
 import type { Db } from "@rudderhq/db";
-export declare function agentRoutes(db: Db): import("express-serve-static-core").Router;
+import type { StorageService } from "../storage/types.js";
+export declare function agentRoutes(db: Db, storage?: StorageService): import("express-serve-static-core").Router;
 //# sourceMappingURL=agents.d.ts.map

package/dist/routes/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AA4DvC,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,8CAy1EjC"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAwCvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmF1D,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,cAAc,8CA08E3D"}

package/dist/routes/agents.js

@@ -1,4 +1,6 @@
 import { Router } from "express";
+import multer from "multer";
+import sharp from "sharp";
 import { generateKeyPairSync, randomUUID } from "node:crypto";
 import path from "node:path";
 import { agents as agentsTable, organizations, heartbeatRuns } from "@rudderhq/db";
@@ -6,11 +8,13 @@ import { and, desc, eq, inArray, not, sql } from "drizzle-orm";
 import { agentSkillSyncSchema, createAgentKeySchema, createAgentHireSchema, createAgentSchema, deriveAgentUrlKey, isUuidLike, organizationSkillCreateSchema, resetAgentSessionSchema, testAgentRuntimeEnvironmentSchema, upsertAgentInstructionsFileSchema, updateAgentInstructionsBundleSchema, updateAgentPermissionsSchema, updateAgentInstructionsPathSchema, wakeAgentSchema, updateAgentSchema, } from "@rudderhq/shared";
 import { validate } from "../middleware/validate.js";
 import { agentService, agentInstructionsService, accessService, approvalService, organizationSkillService, budgetService, heartbeatService, issueApprovalService, issueService, logActivity, secretService, syncInstructionsBundleConfigFromFilePath, workspaceOperationService, } from "../services/index.js";
+import { assetService } from "../services/assets.js";
 import { conflict, forbidden, notFound, unprocessable } from "../errors.js";
 import { assertBoard, assertCompanyAccess, assertInstanceAdmin, getActorInfo } from "./authz.js";
 import { findServerAdapter, listAgentRuntimeModels } from "../agent-runtimes/index.js";
 import { redactEventPayload } from "../redaction.js";
 import { redactCurrentUserValue } from "../log-redaction.js";
+import { MAX_ATTACHMENT_BYTES } from "../attachment-types.js";
 import { renderOrgChartSvg, renderOrgChartPng, ORG_CHART_STYLES } from "./org-chart-svg.js";
 import { instanceSettingsService } from "../services/instance-settings.js";
 import { runClaudeLogin } from "@rudderhq/agent-runtime-claude-local/server";
@@ -19,7 +23,56 @@ import { DEFAULT_CURSOR_LOCAL_MODEL } from "@rudderhq/agent-runtime-cursor-local
 import { DEFAULT_GEMINI_LOCAL_MODEL } from "@rudderhq/agent-runtime-gemini-local";
 import { ensureOpenCodeModelConfiguredAndAvailable } from "@rudderhq/agent-runtime-opencode-local/server";
 import { loadDefaultAgentInstructionsBundle, resolveDefaultAgentInstructionsBundleRole, } from "../services/default-agent-instructions.js";
-export function agentRoutes(db) {
+const AGENT_AVATAR_CONTENT_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/jpg",
+    "image/webp",
+    "image/gif",
+]);
+const AGENT_AVATAR_SIZE_PX = 256;
+const AGENT_AVATAR_WEBP_QUALITY = 82;
+const AGENT_AVATAR_ASSET_RE = /^asset:([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/i;
+function extractAgentAvatarAssetId(icon) {
+    if (typeof icon !== "string")
+        return null;
+    const match = icon.trim().match(AGENT_AVATAR_ASSET_RE);
+    return match?.[1] ?? null;
+}
+async function runSingleFileUpload(upload, req, res) {
+    await new Promise((resolve, reject) => {
+        upload.single("file")(req, res, (err) => {
+            if (err)
+                reject(err);
+            else
+                resolve();
+        });
+    });
+}
+async function compressAgentAvatar(file) {
+    try {
+        const output = await sharp(file.buffer, {
+            animated: false,
+            limitInputPixels: 24_000_000,
+        })
+            .rotate()
+            .resize(AGENT_AVATAR_SIZE_PX, AGENT_AVATAR_SIZE_PX, {
+            fit: "cover",
+            position: "center",
+            withoutEnlargement: true,
+        })
+            .webp({ quality: AGENT_AVATAR_WEBP_QUALITY, effort: 4 })
+            .toBuffer();
+        if (output.length <= 0) {
+            throw new Error("empty avatar output");
+        }
+        return output;
+    }
+    catch {
+        throw unprocessable("Avatar image could not be processed");
+    }
+}
+export function agentRoutes(db, storage) {
     function stripPersistedSkillSyncConfig(config) {
         const next = { ...config };
         delete next.rudderSkillSync;
@@ -56,6 +109,7 @@ export function agentRoutes(db) {
     ];
     const router = Router();
     const svc = agentService(db);
+    const assets = assetService(db);
     const access = accessService(db);
     const approvalsSvc = approvalService(db);
     const budgets = budgetService(db);
@@ -67,6 +121,10 @@ export function agentRoutes(db) {
     const workspaceOperations = workspaceOperationService(db);
     const instanceSettings = instanceSettingsService(db);
     const strictSecretsMode = process.env.RUDDER_SECRETS_STRICT_MODE === "true";
+    const avatarUpload = multer({
+        storage: multer.memoryStorage(),
+        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
+    });
     async function persistReconciledInstructionsBundle(agent, result) {
         if (!result.changed)
             return agent;
@@ -177,6 +235,21 @@ export function agentRoutes(db) {
         const allowedByGrant = await access.hasPermission(orgId, "agent", actorAgent.id, "agents:create");
         return allowedByGrant || canCreateAgents(actorAgent);
     }
+    async function assertAgentAvatarAssetBelongsToOrg(orgId, icon) {
+        const assetId = extractAgentAvatarAssetId(icon);
+        if (!assetId)
+            return;
+        const asset = await assets.getById(assetId);
+        if (!asset) {
+            throw unprocessable("Avatar asset not found");
+        }
+        if (asset.orgId !== orgId) {
+            throw forbidden("Avatar asset belongs to another organization");
+        }
+        if (!asset.contentType.toLowerCase().startsWith("image/")) {
+            throw unprocessable("Avatar asset must be an image");
+        }
+    }
     async function assertCanUpdateAgent(req, targetAgent) {
         assertCompanyAccess(req, targetAgent.orgId);
         if (req.actor.type === "board")
@@ -983,6 +1056,7 @@ export function agentRoutes(db) {
             ...hireInput,
             agentRuntimeConfig: normalizedAdapterConfig,
         };
+        await assertAgentAvatarAssetBelongsToOrg(orgId, normalizedHireInput.icon);
         const organization = await db
             .select()
             .from(organizations)
@@ -1096,6 +1170,7 @@ export function agentRoutes(db) {
         const { config: runtimeAdapterConfig } = await secretsSvc.resolveAdapterConfigForRuntime(orgId, normalizedAdapterConfig);
         const desiredSkillAssignment = await resolveDesiredSkillAssignment(orgId, createInput.agentRuntimeType, runtimeAdapterConfig, Array.isArray(requestedDesiredSkills) ? requestedDesiredSkills : undefined);
         await assertAdapterConfigConstraints(orgId, createInput.agentRuntimeType, normalizedAdapterConfig);
+        await assertAgentAvatarAssetBelongsToOrg(orgId, createInput.icon);
         const createdAgent = await svc.create(orgId, {
             ...createInput,
             agentRuntimeConfig: normalizedAdapterConfig,
@@ -1176,6 +1251,85 @@ export function agentRoutes(db) {
         });
         res.json(await buildAgentDetail(agent));
     });
+    router.post("/agents/:id/avatar", async (req, res) => {
+        if (!storage) {
+            res.status(500).json({ error: "Storage service unavailable" });
+            return;
+        }
+        const id = req.params.id;
+        const existing = await svc.getById(id);
+        if (!existing) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        await assertCanUpdateAgent(req, existing);
+        try {
+            await runSingleFileUpload(avatarUpload, req, res);
+        }
+        catch (err) {
+            if (err instanceof multer.MulterError) {
+                if (err.code === "LIMIT_FILE_SIZE") {
+                    res.status(422).json({ error: `Image exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
+                    return;
+                }
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            throw err;
+        }
+        const file = req.file;
+        if (!file) {
+            res.status(400).json({ error: "Missing file field 'file'" });
+            return;
+        }
+        const inputContentType = (file.mimetype || "").toLowerCase();
+        if (!AGENT_AVATAR_CONTENT_TYPES.has(inputContentType)) {
+            res.status(422).json({ error: `Unsupported avatar image type: ${inputContentType || "unknown"}` });
+            return;
+        }
+        const compressed = await compressAgentAvatar(file);
+        const actor = getActorInfo(req);
+        const stored = await storage.putFile({
+            orgId: existing.orgId,
+            namespace: `assets/agents/${existing.id}/avatars`,
+            originalFilename: file.originalname || "avatar.webp",
+            contentType: "image/webp",
+            body: compressed,
+        });
+        const asset = await assets.create(existing.orgId, {
+            provider: stored.provider,
+            objectKey: stored.objectKey,
+            contentType: stored.contentType,
+            byteSize: stored.byteSize,
+            sha256: stored.sha256,
+            originalFilename: stored.originalFilename,
+            createdByAgentId: actor.agentId,
+            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+        });
+        const avatarIcon = `asset:${asset.id}`;
+        const agent = await svc.update(existing.id, { icon: avatarIcon });
+        if (!agent) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        await logActivity(db, {
+            orgId: agent.orgId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "agent.avatar_updated",
+            entityType: "agent",
+            entityId: agent.id,
+            details: {
+                assetId: asset.id,
+                contentType: asset.contentType,
+                byteSize: asset.byteSize,
+                originalFilename: asset.originalFilename,
+            },
+        });
+        res.status(201).json(agent);
+    });
     router.patch("/agents/:id/instructions-path", validate(updateAgentInstructionsPathSchema), async (req, res) => {
         const id = req.params.id;
         const existing = await svc.getInternalById(id);
@@ -1435,6 +1589,9 @@ export function agentRoutes(db) {
             const effectiveAdapterConfig = asRecord(patchData.agentRuntimeConfig) ?? {};
             await assertAdapterConfigConstraints(existing.orgId, requestedAdapterType, effectiveAdapterConfig);
         }
+        if (Object.prototype.hasOwnProperty.call(patchData, "icon")) {
+            await assertAgentAvatarAssetBelongsToOrg(existing.orgId, patchData.icon);
+        }
         const actor = getActorInfo(req);
         const agent = await svc.update(id, patchData, {
             recordRevision: {