@tickernelz/paperclip-pro-server 2026.1017.0 → 2026.1017.1

package/dist/routes/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AA6FvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAiEhF,OAAO,EACL,wBAAwB,EAWxB,KAAK,sBAAsB,EAE3B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAK5B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EACV,cAAc,EAUf,MAAM,kCAAkC,CAAC;AAuQ1C,wBAAgB,WAAW,CACzB,EAAE,EAAE,EAAE,EACN,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,2BAA2B,GAAG,2BAA2B,CAAC,CAAC;IACrG,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,6EAA6E;IAC7E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACvE;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE;QAChB,OAAO,EAAE,6BAA6B,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;QAC/B,yEAAyE;QACzE,KAAK,CAAC,EAAE,sBAAsB,CAAC;QAC/B;;;WAGG;QACH,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;KAC7C,CAAC;CACE,8CA0iOP"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AA6FvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAiEhF,OAAO,EACL,wBAAwB,EAWxB,KAAK,sBAAsB,EAE3B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAK5B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EACV,cAAc,EAUf,MAAM,kCAAkC,CAAC;AAuQ1C,wBAAgB,WAAW,CACzB,EAAE,EAAE,EAAE,EACN,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,2BAA2B,GAAG,2BAA2B,CAAC,CAAC;IACrG,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,6EAA6E;IAC7E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACvE;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE;QAChB,OAAO,EAAE,6BAA6B,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;QAC/B,yEAAyE;QACzE,KAAK,CAAC,EAAE,sBAAsB,CAAC;QAC/B;;;WAGG;QACH,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;KAC7C,CAAC;CACE,8CA2jOP"}

package/dist/routes/agents.js

@@ -52,7 +52,7 @@ import { normalizeAgentFallbackModelsConfig } from "../services/model-fallback.j
 import { ONBOARDING_FIRST_TASK_SKILL_KEY, PAPERCLIP_CORE_SKILL_KEYS } from "../services/company-skills.js";
 import { createRunSecretRedactionRegistry } from "../services/run-secret-redaction.js";
 import { assertNoAgentAuthorityEscalation } from "../services/agent-authority-escalation.js";
-import { assertAuthenticated, assertBoard, assertBoardOrAgentAuthority, assertCompanyAccess, assertInstanceAdmin, buildActorSecretContext, getAccessibleResource, getActorInfo, hasCompanyAccess } from "./authz.js";
+import { assertAuthenticated, assertBoard, assertBoardOrAgentAuthority, assertCompanyAccess, assertInstanceAdmin, buildActorSecretContext, getAccessibleResource, getActorInfo, hasCompanyAccess, isCompanyOwnerAgentActor } from "./authz.js";
 import { toCompactIssue } from "./issues.js";
 import { runAdapterLoginStartSpine } from "./adapter-login-route-spine.js";
 import { isLoginCommandSupportedAdapterType } from "../services/login-command.js";
@@ -1496,8 +1496,20 @@ export function agentRoutes(db, options = {}) {
             return AGENT_DEFAULT_MAX_CONCURRENT_RUNS;
         return Math.max(AGENT_MIN_MAX_CONCURRENT_RUNS, Math.min(AGENT_MAX_MAX_CONCURRENT_RUNS, Math.floor(configured)));
     }
+    function withStoredMaxConcurrentRuns(nextRuntimeConfig, previousRuntimeConfig) {
+        const nextHeartbeat = asRecord(nextRuntimeConfig.heartbeat);
+        if (nextHeartbeat && hasOwn(nextHeartbeat, "maxConcurrentRuns"))
+            return nextRuntimeConfig;
+        const storedHeartbeat = asRecord(asRecord(previousRuntimeConfig)?.heartbeat);
+        if (!storedHeartbeat || !hasOwn(storedHeartbeat, "maxConcurrentRuns"))
+            return nextRuntimeConfig;
+        return {
+            ...nextRuntimeConfig,
+            heartbeat: { ...(nextHeartbeat ?? {}), maxConcurrentRuns: storedHeartbeat.maxConcurrentRuns },
+        };
+    }
     async function assertAgentKeepsMaxConcurrentRuns(req, target, nextRuntimeConfig, previousRuntimeConfig, surface) {
-        if (req.actor.type !== "agent")
+        if (req.actor.type !== "agent" || isCompanyOwnerAgentActor(req))
             return;
         const currentValue = effectiveMaxConcurrentRuns(previousRuntimeConfig);
         const requestedValue = effectiveMaxConcurrentRuns(nextRuntimeConfig);
@@ -2005,7 +2017,7 @@ export function agentRoutes(db, options = {}) {
         throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
     }
     function assertNoAgentInstructionsConfigMutation(req, adapterConfig, path = "adapterConfig") {
-        if (req.actor.type !== "agent" || !adapterConfig)
+        if (req.actor.type !== "agent" || !adapterConfig || isCompanyOwnerAgentActor(req))
             return;
         const changedSensitiveKeys = KNOWN_INSTRUCTIONS_BUNDLE_KEYS
             .filter((key) => adapterConfig[key] !== undefined)
@@ -2023,13 +2035,13 @@ export function agentRoutes(db, options = {}) {
         return KNOWN_INSTRUCTIONS_BUNDLE_KEYS.some((key) => adapterConfig[key] !== undefined);
     }
     function assertNoAgentAdapterConfigMutation(req, adapterConfig, path = "adapterConfig") {
-        if (req.actor.type === "agent" && ["dotAttachmentAccess", "dotWorkspaceAccess", "dotBindingId"].some(key => hasOwn(adapterConfig, key)))
+        if (req.actor.type === "agent" && !isCompanyOwnerAgentActor(req) && ["dotAttachmentAccess", "dotWorkspaceAccess", "dotBindingId"].some(key => hasOwn(adapterConfig, key)))
             throw forbidden("Only an operator can configure Dot attachment access, workspace access, or pairing.");
         assertNoAgentInstructionsConfigMutation(req, adapterConfig, path);
         assertNoAgentHostWorkspaceCommandMutation(req, collectAgentAdapterWorkspaceCommandPaths(adapterConfig, path));
     }
     function assertNoAgentProcessAdapterMutation(req, adapterType, mutatesConfiguration) {
-        if (req.actor.type !== "agent" || adapterType !== "process" || !mutatesConfiguration)
+        if (req.actor.type !== "agent" || adapterType !== "process" || !mutatesConfiguration || isCompanyOwnerAgentActor(req))
             return;
         throw forbidden("Agent keys cannot configure host-executed process adapters.");
     }
@@ -2068,7 +2080,7 @@ export function agentRoutes(db, options = {}) {
             (allowPlainCredentials && POOL_AUTH_OVERRIDE_ENV_KEYS.includes(key) && asEnvBindingString(value) !== null));
     }
     function assertNoAgentLocalAdapterHostCommandMutation(req, adapterType, adapterConfig, allowPlainCredentials = false) {
-        if (req.actor.type !== "agent" || !adapterType.endsWith("_local"))
+        if (req.actor.type !== "agent" || !adapterType.endsWith("_local") || isCompanyOwnerAgentActor(req))
             return;
         const changedKeys = LOCAL_ADAPTER_HOST_COMMAND_KEYS.filter((key) => adapterConfig[key] !== undefined &&
             (key !== "env" || !containsOnlyLocalAdapterCredentialRefs(adapterType, adapterConfig.env, allowPlainCredentials)));
@@ -3798,7 +3810,7 @@ export function agentRoutes(db, options = {}) {
                 res.status(403).json({ error: "Forbidden" });
                 return;
             }
-            if (actorAgent.role !== "ceo") {
+            if (!isCompanyOwnerAgentActor(req)) {
                 res.status(403).json({ error: "Only CEO can manage permissions" });
                 return;
             }
@@ -3840,7 +3852,7 @@ export function agentRoutes(db, options = {}) {
         res.json(await buildAgentDetail(agent));
     });
     router.patch("/agents/:id/instructions-path", validate(updateAgentInstructionsPathSchema), async (req, res) => {
-        if (req.actor.type !== "board") {
+        if (req.actor.type !== "board" && !isCompanyOwnerAgentActor(req)) {
             throw forbidden("Only board-authenticated callers can manage instructions path or bundle configuration");
         }
         const id = req.params.id;
@@ -4407,6 +4419,9 @@ export function agentRoutes(db, options = {}) {
             }
             assertProviderTraceSettingTransition(req, runtimeConfig, existing.runtimeConfig);
             requestedRuntimeConfig = req.actor.source === "mcp_oauth" ? { ...existing.runtimeConfig, ...runtimeConfig } : runtimeConfig;
+            if (req.actor.type === "agent" && !isCompanyOwnerAgentActor(req)) {
+                requestedRuntimeConfig = withStoredMaxConcurrentRuns(requestedRuntimeConfig, existing.runtimeConfig);
+            }
             await assertAgentKeepsMaxConcurrentRuns(req, existing, requestedRuntimeConfig, existing.runtimeConfig, "agent.patch");
         }
         const touchesAdapterConfiguration = hasOwn(patchData, "adapterType") ||
@@ -4848,7 +4863,7 @@ export function agentRoutes(db, options = {}) {
         const agent = await getAccessibleResource(req, res, svc.getById(id), "Agent not found");
         if (!agent)
             return;
-        if (req.actor.type === "agent") {
+        if (req.actor.type === "agent" && !isCompanyOwnerAgentActor(req)) {
             if (req.actor.agentId !== id) {
                 res.status(403).json({ error: "Agent can only invoke itself" });
                 return;
@@ -5095,7 +5110,7 @@ export function agentRoutes(db, options = {}) {
         const agent = await getAccessibleResource(req, res, svc.getById(id), "Agent not found");
         if (!agent)
             return;
-        if (req.actor.type === "agent") {
+        if (req.actor.type === "agent" && !isCompanyOwnerAgentActor(req)) {
             if (req.actor.agentId !== id) {
                 res.status(403).json({ error: "Agent can only invoke itself" });
                 return;