@rudderhq/server 0.2.0-canary.9 → 0.2.1

package/dist/middleware/auth.js

@@ -9,12 +9,13 @@ function hashToken(token) {
 }
 export function actorMiddleware(db, opts) {
     const boardAuth = boardAuthService(db);
-    return async (req, _res, next) => {
+    return async (req, res, next) => {
         req.actor =
             opts.deploymentMode === "local_trusted"
                 ? { type: "board", userId: "local-board", isInstanceAdmin: true, source: "local_implicit" }
                 : { type: "none", source: "none" };
         const runIdHeader = req.header("x-rudder-run-id");
+        const agentContextHeader = req.header("x-rudder-agent-id")?.trim() || undefined;
         const authHeader = req.header("authorization");
         if (!authHeader?.toLowerCase().startsWith("bearer ")) {
             if (opts.deploymentMode === "authenticated" && opts.resolveSession) {
@@ -46,17 +47,23 @@ export function actorMiddleware(db, opts) {
                         runId: runIdHeader ?? undefined,
                         source: "session",
                     };
+                    if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                        return;
                     next();
                     return;
                 }
             }
             if (runIdHeader)
                 req.actor.runId = runIdHeader;
+            if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                return;
             next();
             return;
         }
         const token = authHeader.slice("bearer ".length).trim();
         if (!token) {
+            if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                return;
             next();
             return;
         }
@@ -74,6 +81,8 @@ export function actorMiddleware(db, opts) {
                     runId: runIdHeader || undefined,
                     source: "board_key",
                 };
+                if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                    return;
                 next();
                 return;
             }
@@ -87,6 +96,8 @@ export function actorMiddleware(db, opts) {
         if (!key) {
             const claims = verifyLocalAgentJwt(token);
             if (!claims) {
+                if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                    return;
                 next();
                 return;
             }
@@ -96,10 +107,14 @@ export function actorMiddleware(db, opts) {
                 .where(eq(agents.id, claims.sub))
                 .then((rows) => rows[0] ?? null);
             if (!agentRecord || agentRecord.orgId !== claims.org_id) {
+                if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                    return;
                 next();
                 return;
             }
             if (agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+                if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                    return;
                 next();
                 return;
             }
@@ -111,6 +126,8 @@ export function actorMiddleware(db, opts) {
                 runId: runIdHeader || claims.run_id || undefined,
                 source: "agent_jwt",
             };
+            if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                return;
             next();
             return;
         }
@@ -124,6 +141,8 @@ export function actorMiddleware(db, opts) {
             .where(eq(agents.id, key.agentId))
             .then((rows) => rows[0] ?? null);
         if (!agentRecord || agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+            if (rejectAgentContextMismatch(req, res, agentContextHeader))
+                return;
             next();
             return;
         }
@@ -135,9 +154,43 @@ export function actorMiddleware(db, opts) {
             runId: runIdHeader || undefined,
             source: "agent_key",
         };
+        if (rejectAgentContextMismatch(req, res, agentContextHeader))
+            return;
         next();
     };
 }
+function rejectAgentContextMismatch(req, res, expectedAgentId) {
+    if (!expectedAgentId || !isMutatingRequest(req))
+        return false;
+    if (req.actor.type !== "agent") {
+        res.status(401).json({
+            error: "Agent authentication required for agent-scoped CLI request",
+            code: "agent_auth_required",
+            details: {
+                expectedAgentId,
+                actorType: req.actor.type,
+                actorSource: req.actor.source,
+            },
+        });
+        return true;
+    }
+    if (req.actor.agentId !== expectedAgentId) {
+        res.status(403).json({
+            error: "Agent authentication does not match the CLI agent context",
+            code: "agent_context_mismatch",
+            details: {
+                expectedAgentId,
+                authenticatedAgentId: req.actor.agentId ?? null,
+            },
+        });
+        return true;
+    }
+    return false;
+}
+function isMutatingRequest(req) {
+    const method = req.method.toUpperCase();
+    return method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+}
 export function requireBoard(req) {
     return req.actor.type === "board";
 }

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAOD,MAAM,UAAU,eAAe,CAAC,EAAM,EAAE,IAA4B;IAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/B,GAAG,CAAC,KAAK;YACP,IAAI,CAAC,cAAc,KAAK,eAAe;gBACrC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBAC3F,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAElD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,IAAI,OAAO,GAAmC,IAAI,CAAC;gBACnD,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EACjD,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC/C,EAAE;6BACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;6BACpC,IAAI,CAAC,iBAAiB,CAAC;6BACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;6BAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;wBAClC,EAAE;6BACC,MAAM,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,KAAK,EAAE,CAAC;6BAChD,IAAI,CAAC,uBAAuB,CAAC;6BAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,aAAa,EAAE,MAAM,CAAC,EACjD,EAAE,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,EAC/C,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC7C,CACF;qBACJ,CAAC,CAAC;oBACH,GAAG,CAAC,KAAK,GAAG;wBACV,IAAI,EAAE,OAAO;wBACb,MAAM;wBACN,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;wBAC3C,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC;wBACjC,KAAK,EAAE,WAAW,IAAI,SAAS;wBAC/B,MAAM,EAAE,SAAS;qBAClB,CAAC;oBACF,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,WAAW;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,KAAK,GAAG;oBACV,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,KAAK,EAAE,QAAQ,CAAC,EAAE;oBAClB,KAAK,EAAE,WAAW,IAAI,SAAS;oBAC/B,MAAM,EAAE,WAAW;iBACpB,CAAC;gBACF,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,EAAE;iBACR,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;iBAChC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrF,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,GAAG,CAAC,KAAK,GAAG;gBACV,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,KAAK,EAAE,MAAM,CAAC,MAAM;gBACpB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS;gBAChD,MAAM,EAAE,WAAW;aACpB,CAAC;YACF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,EAAE;aACL,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACjC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACrG,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,GAAG,CAAC,KAAK,GAAG;YACV,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,KAAK,EAAE,WAAW,IAAI,SAAS;YAC/B,MAAM,EAAE,WAAW;SACpB,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AACpC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAOD,MAAM,UAAU,eAAe,CAAC,EAAM,EAAE,IAA4B;IAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,GAAG,CAAC,KAAK;YACP,IAAI,CAAC,cAAc,KAAK,eAAe;gBACrC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBAC3F,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAClD,MAAM,kBAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAEhF,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,IAAI,OAAO,GAAmC,IAAI,CAAC;gBACnD,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EACjD,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC/C,EAAE;6BACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;6BACpC,IAAI,CAAC,iBAAiB,CAAC;6BACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;6BAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;wBAClC,EAAE;6BACC,MAAM,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,KAAK,EAAE,CAAC;6BAChD,IAAI,CAAC,uBAAuB,CAAC;6BAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,aAAa,EAAE,MAAM,CAAC,EACjD,EAAE,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,EAC/C,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC7C,CACF;qBACJ,CAAC,CAAC;oBACH,GAAG,CAAC,KAAK,GAAG;wBACV,IAAI,EAAE,OAAO;wBACb,MAAM;wBACN,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;wBAC3C,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC;wBACjC,KAAK,EAAE,WAAW,IAAI,SAAS;wBAC/B,MAAM,EAAE,SAAS;qBAClB,CAAC;oBACF,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;wBAAE,OAAO;oBACrE,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,WAAW;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;YAC/C,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;gBAAE,OAAO;YACrE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;gBAAE,OAAO;YACrE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,KAAK,GAAG;oBACV,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,KAAK,EAAE,QAAQ,CAAC,EAAE;oBAClB,KAAK,EAAE,WAAW,IAAI,SAAS;oBAC/B,MAAM,EAAE,WAAW;iBACpB,CAAC;gBACF,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;oBAAE,OAAO;gBACrE,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;oBAAE,OAAO;gBACrE,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,EAAE;iBACR,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;iBAChC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxD,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;oBAAE,OAAO;gBACrE,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrF,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;oBAAE,OAAO;gBACrE,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,GAAG,CAAC,KAAK,GAAG;gBACV,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,KAAK,EAAE,MAAM,CAAC,MAAM;gBACpB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS;gBAChD,MAAM,EAAE,WAAW;aACpB,CAAC;YACF,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;gBAAE,OAAO;YACrE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,EAAE;aACL,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACjC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACrG,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;gBAAE,OAAO;YACrE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,GAAG,CAAC,KAAK,GAAG;YACV,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,KAAK,EAAE,WAAW,IAAI,SAAS;YAC/B,MAAM,EAAE,WAAW;SACpB,CAAC;QAEF,IAAI,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC;YAAE,OAAO;QACrE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAY,EAAE,GAAa,EAAE,eAAwB;IACvF,IAAI,CAAC,eAAe,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9D,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,4DAA4D;YACnE,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE;gBACP,eAAe;gBACf,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;gBACzB,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;aAC9B;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,2DAA2D;YAClE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE;gBACP,eAAe;gBACf,oBAAoB,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI;aAChD;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AACpC,CAAC"}

package/dist/onboarding-assets/ceo/HEARTBEAT.md

@@ -23,20 +23,23 @@ If `RUDDER_APPROVAL_ID` is set:
 - Review the approval and its linked issues with `rudder approval get "$RUDDER_APPROVAL_ID" --json` and `rudder approval issues "$RUDDER_APPROVAL_ID" --json`.
 - Close resolved issues or comment on what remains open.
 
-## 4. Get Assignments
+## 4. Get Inbox Work
 
 - `rudder agent inbox --json`
-- Prioritize: `in_progress` first, then `todo`. Skip `blocked` unless you can unblock it.
+- Inbox rows can be `relationship: "assignee"` or `relationship: "reviewer"`.
+- Prioritize reviewer `in_review` or `blocked` rows first, then assignee `in_progress`, then assignee `todo`. Skip assignee-only `blocked` work unless you can unblock it.
 - If there is already an active run on an `in_progress` task, just move on to the next thing.
-- If `RUDDER_TASK_ID` is set and assigned to you, prioritize that task.
+- If `RUDDER_TASK_ID` is set and assigned to you or names you as reviewer, prioritize that task.
 
 ## 5. Checkout and Work
 
 - Always checkout before working: `rudder issue checkout "<issue-id-or-identifier>" --json`.
 - Never retry a 409 -- that task belongs to someone else.
 - Use `rudder issue context "<issue-id-or-identifier>" --json` to load compact context.
-- Do the work. Use `rudder issue comment`, `rudder issue done`, or `rudder issue block` to communicate outcome.
+- Do the work. Use `rudder issue comment`, `rudder issue done`, or `rudder issue block` to communicate outcome. If a reviewed issue is blocked, write the blocker clearly enough for reviewer triage.
 - If `RUDDER_WAKE_REASON=issue_passive_followup`, treat the wake as close-out governance, not a fresh assignment: inspect state and leave a progress comment, completion, blocker, or explicit handoff.
+- If you are the reviewer, including for a `blocked` issue, record one structured decision with `rudder issue review --decision approve|request_changes|needs_followup|blocked --comment ...`. Use `blocked` only to confirm a human/external blocker, and name the next human action in the comment.
+- If `RUDDER_WAKE_REASON=issue_review_closeout_missing`, treat the wake as reviewer close-out governance and record one structured review decision.
 
 ## 6. Delegation
 
@@ -55,6 +58,7 @@ If `RUDDER_APPROVAL_ID` is set:
 ## 8. Exit
 
 - Comment on any in_progress work before exiting.
+- Reviewer work is not closed by a free-form accept/reject comment; use `rudder issue review`.
 - A successful `todo` or `in_progress` issue run without a close-out signal can trigger a same-agent passive follow-up.
 - If no assignments and no valid mention-handoff, exit cleanly.
 

package/dist/onboarding-assets/default/HEARTBEAT.md

@@ -18,19 +18,22 @@ Run this checklist on every heartbeat.
 
 If approval context is set, review linked issues and close/comment.
 
-## 4. Get Assignments
+## 4. Get Inbox Work
 
-- Check for assigned issues.
-- Prioritize: in_progress first, then todo.
+- Check `rudder agent inbox --json` for both assignee and reviewer rows.
+- Prioritize reviewer `in_review` or `blocked` rows first, then assignee `in_progress`, then assignee `todo`.
 
 ## 5. Checkout and Work
 
 - Always checkout before working.
 - Do the work. Update status and comment when done.
-- If `RUDDER_WAKE_REASON=issue_passive_followup`, inspect current issue state first, then leave a close-out signal: progress comment, done, blocked with reason, or explicit handoff.
+- If `RUDDER_WAKE_REASON=issue_passive_followup`, inspect current issue state first, then leave a close-out signal: progress comment, done, blocked with reason, or explicit handoff. If a reviewed issue is blocked, write the blocker clearly enough for reviewer triage.
+- If you are the reviewer, including for a `blocked` issue, record a structured review decision with `rudder issue review --decision approve|request_changes|needs_followup|blocked --comment ...`. Use `blocked` only to confirm a human/external blocker, and name the next human action in the comment.
+- If `RUDDER_WAKE_REASON=issue_review_closeout_missing`, inspect current state and record exactly one structured review decision.
 
 ## 6. Exit
 
 - Comment on in_progress work before exiting.
+- Reviewer work is not closed by a free-form accept/reject comment; use `rudder issue review`.
 - A successful `todo` or `in_progress` issue run without a close-out signal can trigger a same-agent passive follow-up.
 - Exit cleanly if no assignments.

package/dist/routes/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAwCvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmF1D,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,cAAc,8CA08E3D"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAyCvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmF1D,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,cAAc,8CA8iF3D"}

package/dist/routes/agents.js

@@ -5,7 +5,7 @@ import { generateKeyPairSync, randomUUID } from "node:crypto";
 import path from "node:path";
 import { agents as agentsTable, organizations, heartbeatRuns } from "@rudderhq/db";
 import { and, desc, eq, inArray, not, sql } from "drizzle-orm";
-import { agentSkillSyncSchema, createAgentKeySchema, createAgentHireSchema, createAgentSchema, deriveAgentUrlKey, isUuidLike, organizationSkillCreateSchema, resetAgentSessionSchema, testAgentRuntimeEnvironmentSchema, upsertAgentInstructionsFileSchema, updateAgentInstructionsBundleSchema, updateAgentPermissionsSchema, updateAgentInstructionsPathSchema, wakeAgentSchema, updateAgentSchema, } from "@rudderhq/shared";
+import { agentSkillSyncSchema, agentSkillEnableSchema, createAgentKeySchema, createAgentHireSchema, createAgentSchema, deriveAgentUrlKey, isUuidLike, organizationSkillCreateSchema, resetAgentSessionSchema, testAgentRuntimeEnvironmentSchema, upsertAgentInstructionsFileSchema, updateAgentInstructionsBundleSchema, updateAgentPermissionsSchema, updateAgentInstructionsPathSchema, wakeAgentSchema, updateAgentSchema, } from "@rudderhq/shared";
 import { validate } from "../middleware/validate.js";
 import { agentService, agentInstructionsService, accessService, approvalService, organizationSkillService, budgetService, heartbeatService, issueApprovalService, issueService, logActivity, secretService, syncInstructionsBundleConfigFromFilePath, workspaceOperationService, } from "../services/index.js";
 import { assetService } from "../services/assets.js";
@@ -761,6 +761,44 @@ export function agentRoutes(db, storage) {
         });
         res.json(snapshot);
     });
+    router.post("/agents/:id/skills/enable", validate(agentSkillEnableSchema), async (req, res) => {
+        const id = req.params.id;
+        const agent = await svc.getById(id);
+        if (!agent) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        await assertCanUpdateAgent(req, agent);
+        const requestedSkills = Array.from(new Set(req.body.skills
+            .map((value) => value.trim())
+            .filter(Boolean)));
+        const { config: runtimeConfig } = await secretsSvc.resolveAdapterConfigForRuntime(agent.orgId, agent.agentRuntimeConfig);
+        const currentDesiredSkills = await organizationSkills.getEnabledSkillKeysForAgent(agent.orgId, agent);
+        const { desiredSkills } = await resolveDesiredSkillAssignmentForAgent(agent, runtimeConfig, [...currentDesiredSkills, ...requestedSkills]);
+        const actor = getActorInfo(req);
+        await organizationSkills.addEnabledSkillKeysForAgent(agent.orgId, agent.id, desiredSkills);
+        const snapshot = await buildAgentSkillSnapshot(agent, runtimeConfig);
+        await logActivity(db, {
+            orgId: agent.orgId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            action: "agent.skills_enabled",
+            entityType: "agent",
+            entityId: agent.id,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            details: {
+                agentRuntimeType: agent.agentRuntimeType,
+                requestedSkills,
+                desiredSkills: snapshot.desiredSkills,
+                mode: snapshot.mode,
+                supported: snapshot.supported,
+                entryCount: snapshot.entries.length,
+                warningCount: snapshot.warnings.length,
+            },
+        });
+        res.json(snapshot);
+    });
     router.get("/orgs/:orgId/agents", async (req, res) => {
         const orgId = req.params.orgId;
         assertCompanyAccess(req, orgId);
@@ -889,14 +927,35 @@ export function agentRoutes(db, storage) {
             return;
         }
         const issuesSvc = issueService(db);
-        const rows = await issuesSvc.list(req.actor.orgId, {
+        const assigneeRows = await issuesSvc.list(req.actor.orgId, {
             assigneeAgentId: req.actor.agentId,
             status: "todo,in_progress,blocked",
         });
-        res.json(rows.map((issue) => ({
+        const reviewerRows = await issuesSvc.list(req.actor.orgId, {
+            reviewerAgentId: req.actor.agentId,
+            status: "in_review,blocked",
+            excludeReviewerConfirmedBlockedHandoff: true,
+        });
+        const rowsByIssueId = new Map();
+        for (const issue of assigneeRows) {
+            rowsByIssueId.set(issue.id, { issue, relationship: "assignee" });
+        }
+        for (const issue of reviewerRows) {
+            rowsByIssueId.set(issue.id, { issue, relationship: "reviewer" });
+        }
+        const rows = Array.from(rowsByIssueId.values()).sort((a, b) => {
+            const priorityRank = { critical: 0, high: 1, medium: 2, low: 3 };
+            const aPriority = priorityRank[a.issue.priority] ?? 9;
+            const bPriority = priorityRank[b.issue.priority] ?? 9;
+            if (aPriority !== bPriority)
+                return aPriority - bPriority;
+            return new Date(a.issue.updatedAt).getTime() - new Date(b.issue.updatedAt).getTime();
+        });
+        res.json(rows.map(({ issue, relationship }) => ({
             id: issue.id,
             identifier: issue.identifier,
             title: issue.title,
+            relationship,
             status: issue.status,
             priority: issue.priority,
             projectId: issue.projectId,
@@ -1118,10 +1177,26 @@ export function agentRoutes(db, storage) {
                 updatedAt: new Date(),
             });
             if (sourceIssueIds.length > 0) {
-                await issueApprovalsSvc.linkManyForApproval(approval.id, sourceIssueIds, {
+                const links = await issueApprovalsSvc.linkManyForApproval(approval.id, sourceIssueIds, {
                     agentId: actor.actorType === "agent" ? actor.actorId : null,
                     userId: actor.actorType === "user" ? actor.actorId : null,
                 });
+                for (const link of links) {
+                    await logActivity(db, {
+                        orgId,
+                        actorType: actor.actorType,
+                        actorId: actor.actorId,
+                        agentId: actor.agentId,
+                        runId: actor.runId,
+                        action: "issue.approval_linked",
+                        entityType: "issue",
+                        entityId: link.issueId,
+                        details: {
+                            approvalId: approval.id,
+                            linkCreatedAt: link.createdAt.toISOString(),
+                        },
+                    });
+                }
             }
         }
         await logActivity(db, {