bopodev-api 0.1.12 → 0.1.13

package/src/routes/plugins.ts

@@ -0,0 +1,257 @@
+import { Router } from "express";
+import { z } from "zod";
+import { PluginManifestSchema } from "bopodev-contracts";
+import {
+  createApprovalRequest,
+  deletePluginById,
+  deletePluginConfig,
+  listCompanyPluginConfigs,
+  listCompanies,
+  listPluginRuns,
+  listPlugins,
+  updatePluginConfig
+} from "bopodev-db";
+import type { AppContext } from "../context";
+import { sendError, sendOk } from "../http";
+import { requireCompanyScope } from "../middleware/company-scope";
+import { deletePluginManifestFromFilesystem, writePluginManifestToFilesystem } from "../services/plugin-manifest-loader";
+import { registerPluginManifest } from "../services/plugin-runtime";
+
+const pluginConfigSchema = z.object({
+  enabled: z.boolean().optional(),
+  priority: z.number().int().min(0).max(1000).optional(),
+  config: z.record(z.string(), z.unknown()).default({}),
+  grantedCapabilities: z.array(z.string().min(1)).default([]),
+  requestApproval: z.boolean().default(true)
+});
+const pluginManifestCreateSchema = z.object({
+  manifestJson: z.string().min(2),
+  install: z.boolean().default(true)
+});
+
+const HIGH_RISK_CAPABILITIES = new Set(["network", "queue_publish", "issue_write", "write_memory"]);
+
+export function createPluginsRouter(ctx: AppContext) {
+  const router = Router();
+  router.use(requireCompanyScope);
+
+  router.get("/", async (req, res) => {
+    const [catalog, configs] = await Promise.all([listPlugins(ctx.db), listCompanyPluginConfigs(ctx.db, req.companyId!)]);
+    const configByPluginId = new Map(configs.map((row) => [row.pluginId, row]));
+    return sendOk(
+      res,
+      catalog.map((plugin) => {
+        const config = configByPluginId.get(plugin.id);
+        const manifest = safeParseJsonObject(plugin.manifestJson) as Record<string, unknown>;
+        return {
+          id: plugin.id,
+          name: plugin.name,
+          description: typeof manifest.description === "string" ? manifest.description : null,
+          promptTemplate:
+            typeof manifest.runtime === "object" &&
+            manifest.runtime !== null &&
+            typeof (manifest.runtime as Record<string, unknown>).promptTemplate === "string"
+              ? ((manifest.runtime as Record<string, unknown>).promptTemplate as string)
+              : null,
+          version: plugin.version,
+          kind: plugin.kind,
+          runtimeType: plugin.runtimeType,
+          runtimeEntrypoint: plugin.runtimeEntrypoint,
+          hooks: safeParseStringArray(plugin.hooksJson),
+          capabilities: safeParseStringArray(plugin.capabilitiesJson),
+          companyConfig: config
+            ? {
+                enabled: config.enabled,
+                priority: config.priority,
+                config: safeParseJsonObject(config.configJson),
+                grantedCapabilities: safeParseStringArray(config.grantedCapabilitiesJson)
+              }
+            : null
+        };
+      })
+    );
+  });
+
+  router.put("/:pluginId", async (req, res) => {
+    const parsed = pluginConfigSchema.safeParse(req.body);
+    if (!parsed.success) {
+      return sendError(res, parsed.error.message, 422);
+    }
+    const pluginId = req.params.pluginId;
+    const [catalog, companies] = await Promise.all([listPlugins(ctx.db), listCompanies(ctx.db)]);
+    const pluginExists = catalog.some((plugin) => plugin.id === pluginId);
+    if (!pluginExists) {
+      return sendError(res, `Plugin '${pluginId}' was not found. Restart API to refresh built-in plugins.`, 404);
+    }
+    const companyExists = companies.some((company) => company.id === req.companyId);
+    if (!companyExists) {
+      return sendError(res, `Company '${req.companyId}' does not exist.`, 404);
+    }
+    const riskyCaps = parsed.data.grantedCapabilities.filter((cap) => HIGH_RISK_CAPABILITIES.has(cap));
+    if (riskyCaps.length > 0 && parsed.data.requestApproval) {
+      const approvalId = await createApprovalRequest(ctx.db, {
+        companyId: req.companyId!,
+        requestedByAgentId: req.actor?.type === "agent" ? req.actor.id : null,
+        action: "grant_plugin_capabilities",
+        payload: {
+          pluginId,
+          enabled: parsed.data.enabled,
+          priority: parsed.data.priority,
+          grantedCapabilities: parsed.data.grantedCapabilities,
+          config: parsed.data.config
+        }
+      });
+      return sendOk(res, { approvalId, status: "pending" });
+    }
+    await updatePluginConfig(ctx.db, {
+      companyId: req.companyId!,
+      pluginId,
+      enabled: parsed.data.enabled,
+      priority: parsed.data.priority,
+      configJson: JSON.stringify(parsed.data.config),
+      grantedCapabilitiesJson: JSON.stringify(parsed.data.grantedCapabilities)
+    });
+    return sendOk(res, { ok: true });
+  });
+
+  router.post("/install-from-json", async (req, res) => {
+    const parsed = pluginManifestCreateSchema.safeParse(req.body);
+    if (!parsed.success) {
+      return sendError(res, parsed.error.message, 422);
+    }
+    let rawManifest: unknown;
+    try {
+      rawManifest = JSON.parse(parsed.data.manifestJson);
+    } catch {
+      return sendError(res, "manifestJson must be valid JSON.", 422);
+    }
+    const manifestParsed = PluginManifestSchema.safeParse(rawManifest);
+    if (!manifestParsed.success) {
+      return sendError(res, manifestParsed.error.message, 422);
+    }
+    const manifest = manifestParsed.data;
+    const [companies] = await Promise.all([listCompanies(ctx.db)]);
+    const companyExists = companies.some((company) => company.id === req.companyId);
+    if (!companyExists) {
+      return sendError(res, `Company '${req.companyId}' does not exist.`, 404);
+    }
+
+    const manifestPath = await writePluginManifestToFilesystem(manifest);
+    await registerPluginManifest(ctx.db, manifest);
+    if (parsed.data.install) {
+      await updatePluginConfig(ctx.db, {
+        companyId: req.companyId!,
+        pluginId: manifest.id,
+        enabled: false,
+        priority: 100,
+        configJson: "{}",
+        grantedCapabilitiesJson: "[]"
+      });
+    }
+    return sendOk(res, { ok: true, pluginId: manifest.id, manifestPath, installed: parsed.data.install });
+  });
+
+  router.post("/:pluginId/install", async (req, res) => {
+    const pluginId = req.params.pluginId;
+    const [catalog, companies] = await Promise.all([listPlugins(ctx.db), listCompanies(ctx.db)]);
+    const plugin = catalog.find((item) => item.id === pluginId);
+    if (!plugin) {
+      return sendError(res, `Plugin '${pluginId}' was not found. Restart API to refresh built-in plugins.`, 404);
+    }
+    const companyExists = companies.some((company) => company.id === req.companyId);
+    if (!companyExists) {
+      return sendError(res, `Company '${req.companyId}' does not exist.`, 404);
+    }
+    await updatePluginConfig(ctx.db, {
+      companyId: req.companyId!,
+      pluginId,
+      enabled: false,
+      priority: 100,
+      configJson: "{}",
+      grantedCapabilitiesJson: "[]"
+    });
+    return sendOk(res, { ok: true, pluginId, installed: true, enabled: false });
+  });
+
+  router.delete("/:pluginId/install", async (req, res) => {
+    const pluginId = req.params.pluginId;
+    const [catalog, companies] = await Promise.all([listPlugins(ctx.db), listCompanies(ctx.db)]);
+    const plugin = catalog.find((item) => item.id === pluginId);
+    if (!plugin) {
+      return sendError(res, `Plugin '${pluginId}' was not found.`, 404);
+    }
+    const companyExists = companies.some((company) => company.id === req.companyId);
+    if (!companyExists) {
+      return sendError(res, `Company '${req.companyId}' does not exist.`, 404);
+    }
+    await deletePluginConfig(ctx.db, {
+      companyId: req.companyId!,
+      pluginId
+    });
+    return sendOk(res, { ok: true, pluginId, installed: false });
+  });
+
+  router.delete("/:pluginId", async (req, res) => {
+    const pluginId = req.params.pluginId;
+    const [catalog, companies] = await Promise.all([listPlugins(ctx.db), listCompanies(ctx.db)]);
+    const plugin = catalog.find((item) => item.id === pluginId);
+    if (!plugin) {
+      return sendError(res, `Plugin '${pluginId}' was not found.`, 404);
+    }
+    if (plugin.runtimeEntrypoint.startsWith("builtin:")) {
+      return sendError(res, `Plugin '${pluginId}' is built-in and cannot be deleted.`, 400);
+    }
+    const companyExists = companies.some((company) => company.id === req.companyId);
+    if (!companyExists) {
+      return sendError(res, `Company '${req.companyId}' does not exist.`, 404);
+    }
+    await deletePluginManifestFromFilesystem(pluginId);
+    await deletePluginById(ctx.db, pluginId);
+    return sendOk(res, { ok: true, pluginId, deleted: true });
+  });
+
+  router.get("/runs", async (req, res) => {
+    const pluginId = typeof req.query.pluginId === "string" ? req.query.pluginId : undefined;
+    const runId = typeof req.query.runId === "string" ? req.query.runId : undefined;
+    const limit = typeof req.query.limit === "string" ? Number(req.query.limit) : undefined;
+    const rows = await listPluginRuns(ctx.db, {
+      companyId: req.companyId!,
+      pluginId,
+      runId,
+      limit
+    });
+    return sendOk(
+      res,
+      rows.map((row) => ({
+        ...row,
+        diagnostics: safeParseJsonObject(row.diagnosticsJson)
+      }))
+    );
+  });
+
+  return router;
+}
+
+function safeParseStringArray(value: string | null | undefined) {
+  if (!value) {
+    return [] as string[];
+  }
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    return Array.isArray(parsed) ? parsed.map((entry) => String(entry)) : [];
+  } catch {
+    return [];
+  }
+}
+
+function safeParseJsonObject(value: string | null | undefined) {
+  if (!value) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}

package/src/scripts/onboard-seed.ts

@@ -1,5 +1,6 @@
 import { pathToFileURL } from "node:url";
 import { mkdir } from "node:fs/promises";
+import { getAdapterModels } from "bopodev-agent-sdk";
 import {
   bootstrapDatabase,
   createAgent,
@@ -29,7 +30,7 @@ export interface OnboardSeedSummary {
 const DEFAULT_COMPANY_NAME_ENV = "BOPO_DEFAULT_COMPANY_NAME";
 const DEFAULT_COMPANY_ID_ENV = "BOPO_DEFAULT_COMPANY_ID";
 const DEFAULT_AGENT_PROVIDER_ENV = "BOPO_DEFAULT_AGENT_PROVIDER";
-type AgentProvider = "codex" | "claude_code" | "cursor" | "opencode" | "shell";
+type AgentProvider = "codex" | "claude_code" | "cursor" | "opencode" | "openai_api" | "anthropic_api" | "shell";
 const CEO_BOOTSTRAP_SUMMARY = "ceo bootstrap heartbeat";
 const STARTUP_PROJECT_NAME = "Leadership Setup";
 const CEO_STARTUP_TASK_TITLE = "Set up CEO operating files and hire founding engineer";
@@ -73,10 +74,15 @@ export async function ensureOnboardingSeed(input: {
     const resolvedCompanyName = companyRow.name;
     const defaultRuntimeCwd = await resolveDefaultRuntimeCwdForCompany(db, companyId);
     await mkdir(defaultRuntimeCwd, { recursive: true });
+    const seedRuntimeEnv = resolveSeedRuntimeEnv(agentProvider);
     const defaultRuntimeConfig = normalizeRuntimeConfig({
       defaultRuntimeCwd,
       runtimeConfig: {
-        runtimeEnv: resolveSeedRuntimeEnv(agentProvider)
+        runtimeEnv: seedRuntimeEnv,
+        runtimeModel: await resolveSeedRuntimeModel(agentProvider, {
+          defaultRuntimeCwd,
+          runtimeEnv: seedRuntimeEnv
+        })
       }
     });
     const agents = await listAgents(db, companyId);
@@ -177,16 +183,17 @@ async function ensureCeoStartupTask(
     "",
     "Stand up your leadership operating baseline before taking on additional delivery work.",
     "",
-    "1. Create the folder `agents/ceo/` in the repository workspace.",
+    `1. Create the folder \`agents/${input.ceoId}/\` in the repository workspace.`,
     "2. Author these files with your own voice and responsibilities:",
-    "   - `agents/ceo/AGENTS.md`",
-    "   - `agents/ceo/HEARTBEAT.md`",
-    "   - `agents/ceo/SOUL.md`",
-    "   - `agents/ceo/TOOLS.md`",
+    `   - \`agents/${input.ceoId}/AGENTS.md\``,
+    `   - \`agents/${input.ceoId}/HEARTBEAT.md\``,
+    `   - \`agents/${input.ceoId}/SOUL.md\``,
+    `   - \`agents/${input.ceoId}/TOOLS.md\``,
     "3. Save your operating-file reference on your own agent record via `PUT /agents/:agentId`.",
-    "   - Supported simple body: `{ \"bootstrapPrompt\": \"Primary operating reference: agents/ceo/AGENTS.md ...\" }`",
+    `   - Supported simple body: \`{ "bootstrapPrompt": "Primary operating reference: agents/${input.ceoId}/AGENTS.md ..." }\``,
     "   - If using `runtimeConfig`, only `runtimeConfig.bootstrapPrompt` is supported there.",
-    "   - Use a temp JSON file or heredoc with `curl --data @file`; do not hand-escape multiline JSON.",
+    "   - Prefer heredoc/stdin payloads (for example `curl --data-binary @- <<'JSON' ... JSON`) to avoid temp-file cleanup failures under runtime policy.",
+    `   - If you must use payload files, store them in \`agents/${input.ceoId}/tmp/\` (or OS temp via \`mktemp\`) and avoid chaining cleanup commands into critical task flow.`,
     "4. To inspect your own agent record, use `GET /agents` and filter by your agent id. Do not call `GET /agents/:agentId`.",
     "   - `GET /agents` uses envelope shape `{ \"ok\": true, \"data\": [...] }`; treat any other shape as failure.",
     "   - Deterministic filter: `jq -er --arg id \"$BOPODEV_AGENT_ID\" '.data | if type==\"array\" then . else error(\"invalid_agents_payload\") end | map(select((.id? // \"\") == $id))[0] | {id,name,role,bootstrapPrompt}'`",
@@ -248,14 +255,22 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
 }
 
 function parseAgentProvider(value: unknown): AgentProvider | null {
-  if (value === "codex" || value === "claude_code" || value === "cursor" || value === "opencode" || value === "shell") {
+  if (
+    value === "codex" ||
+    value === "claude_code" ||
+    value === "cursor" ||
+    value === "opencode" ||
+    value === "openai_api" ||
+    value === "anthropic_api" ||
+    value === "shell"
+  ) {
     return value;
   }
   return null;
 }
 
 function resolveSeedRuntimeEnv(agentProvider: AgentProvider): Record<string, string> {
-  if (agentProvider === "codex") {
+  if (agentProvider === "codex" || agentProvider === "openai_api") {
     const key = (process.env.BOPO_OPENAI_API_KEY ?? process.env.OPENAI_API_KEY)?.trim();
     if (!key) {
       return {};
@@ -264,7 +279,7 @@ function resolveSeedRuntimeEnv(agentProvider: AgentProvider): Record<string, str
       OPENAI_API_KEY: key
     };
   }
-  if (agentProvider === "claude_code") {
+  if (agentProvider === "claude_code" || agentProvider === "anthropic_api") {
     const key = (process.env.BOPO_ANTHROPIC_API_KEY ?? process.env.ANTHROPIC_API_KEY)?.trim();
     if (!key) {
       return {};
@@ -276,6 +291,36 @@ function resolveSeedRuntimeEnv(agentProvider: AgentProvider): Record<string, str
   return {};
 }
 
+async function resolveSeedRuntimeModel(
+  agentProvider: AgentProvider,
+  input: { defaultRuntimeCwd: string; runtimeEnv: Record<string, string> }
+): Promise<string | undefined> {
+  if (agentProvider !== "opencode") {
+    return undefined;
+  }
+  const configured =
+    process.env.BOPO_OPENCODE_MODEL?.trim() ||
+    process.env.OPENCODE_MODEL?.trim();
+  try {
+    const discovered = await getAdapterModels("opencode", {
+      command: process.env.BOPO_OPENCODE_COMMAND?.trim() || "opencode",
+      cwd: input.defaultRuntimeCwd,
+      env: input.runtimeEnv
+    });
+    if (configured && discovered.some((entry) => entry.id === configured)) {
+      return configured;
+    }
+    if (discovered.length > 0) {
+      return discovered[0]!.id;
+    }
+  } catch {
+    if (configured) {
+      return configured;
+    }
+  }
+  return configured;
+}
+
 function isBootstrapCeoRuntime(providerType: string, stateBlob: string | null) {
   if (providerType !== "shell") {
     return false;

package/src/server.ts

@@ -3,13 +3,15 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { sql } from "drizzle-orm";
 import { config as loadDotenv } from "dotenv";
-import { bootstrapDatabase } from "bopodev-db";
+import { bootstrapDatabase, listCompanies } from "bopodev-db";
 import { checkRuntimeCommandHealth } from "bopodev-agent-sdk";
 import type { RuntimeCommandHealth } from "bopodev-agent-sdk";
 import { createApp } from "./app";
 import { loadGovernanceRealtimeSnapshot } from "./realtime/governance";
 import { loadOfficeSpaceRealtimeSnapshot } from "./realtime/office-space";
+import { loadHeartbeatRunsRealtimeSnapshot } from "./realtime/heartbeat-runs";
 import { attachRealtimeHub } from "./realtime/hub";
+import { ensureBuiltinPluginsRegistered } from "./services/plugin-runtime";
 import { createHeartbeatScheduler } from "./worker/scheduler";
 
 loadApiEnv();
@@ -18,11 +20,21 @@ async function main() {
   const dbPath = process.env.BOPO_DB_PATH;
   const port = Number(process.env.PORT ?? 4020);
   const { db } = await bootstrapDatabase(dbPath);
+  const existingCompanies = await listCompanies(db);
+  await ensureBuiltinPluginsRegistered(
+    db,
+    existingCompanies.map((company) => company.id)
+  );
   const codexCommand = process.env.BOPO_CODEX_COMMAND ?? "codex";
+  const openCodeCommand = process.env.BOPO_OPENCODE_COMMAND ?? "opencode";
   const skipCodexPreflight = process.env.BOPO_SKIP_CODEX_PREFLIGHT === "1";
+  const skipOpenCodePreflight = process.env.BOPO_SKIP_OPENCODE_PREFLIGHT === "1";
   const codexHealthRequired =
     !skipCodexPreflight &&
     (process.env.BOPO_REQUIRE_CODEX_HEALTH === "1" || (await hasCodexAgentsConfigured(db)));
+  const openCodeHealthRequired =
+    !skipOpenCodePreflight &&
+    (process.env.BOPO_REQUIRE_OPENCODE_HEALTH === "1" || (await hasOpenCodeAgentsConfigured(db)));
   const getRuntimeHealth = async () => {
     const codex = codexHealthRequired
       ? await checkRuntimeCommandHealth(codexCommand, {
@@ -37,8 +49,22 @@ async function main() {
             ? "Skipped by configuration: BOPO_SKIP_CODEX_PREFLIGHT=1."
             : "Skipped: no Codex agents configured."
         };
+    const opencode = openCodeHealthRequired
+      ? await checkRuntimeCommandHealth(openCodeCommand, {
+          timeoutMs: 5_000
+        })
+      : {
+          command: openCodeCommand,
+          available: skipOpenCodePreflight ? false : true,
+          exitCode: null,
+          elapsedMs: 0,
+          error: skipOpenCodePreflight
+            ? "Skipped by configuration: BOPO_SKIP_OPENCODE_PREFLIGHT=1."
+            : "Skipped: no OpenCode agents configured."
+        };
     return {
-      codex
+      codex,
+      opencode
     };
   };
   if (codexHealthRequired) {
@@ -49,12 +75,21 @@ async function main() {
       emitCodexPreflightWarning(startupCodexHealth);
     }
   }
+  if (openCodeHealthRequired) {
+    const startupOpenCodeHealth = await checkRuntimeCommandHealth(openCodeCommand, {
+      timeoutMs: 5_000
+    });
+    if (!startupOpenCodeHealth.available) {
+      emitOpenCodePreflightWarning(startupOpenCodeHealth);
+    }
+  }
 
   const server = createServer();
   const realtimeHub = attachRealtimeHub(server, {
     bootstrapLoaders: {
       governance: (companyId) => loadGovernanceRealtimeSnapshot(db, companyId),
-      "office-space": (companyId) => loadOfficeSpaceRealtimeSnapshot(db, companyId)
+      "office-space": (companyId) => loadOfficeSpaceRealtimeSnapshot(db, companyId),
+      "heartbeat-runs": (companyId) => loadHeartbeatRunsRealtimeSnapshot(db, companyId)
     }
   });
   const app = createApp({ db, getRuntimeHealth, realtimeHub });
@@ -83,6 +118,16 @@ async function hasCodexAgentsConfigured(db: Awaited<ReturnType<typeof bootstrapD
   return (result.rows ?? []).length > 0;
 }
 
+async function hasOpenCodeAgentsConfigured(db: Awaited<ReturnType<typeof bootstrapDatabase>>["db"]) {
+  const result = await db.execute(sql`
+    SELECT id
+    FROM agents
+    WHERE provider_type = 'opencode'
+    LIMIT 1
+  `);
+  return (result.rows ?? []).length > 0;
+}
+
 async function resolveSchedulerCompanyId(
   db: Awaited<ReturnType<typeof bootstrapDatabase>>["db"],
   configuredCompanyId: string | null
@@ -125,6 +170,20 @@ function emitCodexPreflightWarning(health: RuntimeCommandHealth) {
   }
 }
 
+function emitOpenCodePreflightWarning(health: RuntimeCommandHealth) {
+  const red = process.stderr.isTTY ? "\x1b[31m" : "";
+  const yellow = process.stderr.isTTY ? "\x1b[33m" : "";
+  const reset = process.stderr.isTTY ? "\x1b[0m" : "";
+  const symbol = `${red}✖${reset}`;
+  process.stderr.write(
+    `${symbol} ${yellow}OpenCode preflight failed${reset}: command '${health.command}' is unavailable.\n`
+  );
+  process.stderr.write(`  Install OpenCode CLI or set BOPO_SKIP_OPENCODE_PREFLIGHT=1 for local dev.\n`);
+  if (process.env.BOPO_VERBOSE_STARTUP_WARNINGS === "1") {
+    process.stderr.write(`  Details: ${JSON.stringify(health)}\n`);
+  }
+}
+
 function loadApiEnv() {
   const sourceDir = dirname(fileURLToPath(import.meta.url));
   const repoRoot = resolve(sourceDir, "../../../");