bopodev-api 0.1.25 → 0.1.27

package/README.md

@@ -0,0 +1,44 @@
+# `apps/api`
+
+Express API, websocket hub, and heartbeat scheduler runtime for Bopo.
+
+## Responsibilities
+
+- Serve HTTP routes for planning, execution, governance, observability, plugins, and templates.
+- Attach websocket hub on `/realtime` for company-scoped live updates.
+- Run heartbeat scheduler/queue worker based on `BOPO_SCHEDULER_ROLE`.
+
+## Runtime Entry Points
+
+- `src/server.ts` - startup, env loading, realtime bootstrap, scheduler ownership.
+- `src/app.ts` - middleware, route mounting, error handling.
+- `src/routes/*.ts` - route groups.
+- `src/worker/scheduler.ts` - periodic sweep orchestration.
+
+## Local Development
+
+From repository root (recommended):
+
+- `pnpm dev` or `pnpm start`
+
+From this package directly:
+
+- `pnpm --filter bopodev-api dev`
+- `pnpm --filter bopodev-api start`
+- `pnpm --filter bopodev-api db:init`
+- `pnpm --filter bopodev-api onboard:seed`
+- `pnpm --filter bopodev-api workspaces:backfill`
+
+Default port is `4020` (`API_PORT`/`PORT`).
+
+## Key Route Groups
+
+- `/auth`, `/attention`, `/companies`, `/projects`, `/issues`, `/goals`
+- `/agents`, `/governance`, `/heartbeats`, `/observability`
+- `/plugins`, `/templates`
+
+## Related Docs
+
+- `docs/developer/api-reference.md`
+- `docs/developer/configuration-reference.md`
+- `docs/operations/deployment.md`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bopodev-api",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "license": "MIT",
   "type": "module",
   "files": [
@@ -17,9 +17,9 @@
     "nanoid": "^5.1.5",
     "ws": "^8.19.0",
     "zod": "^4.1.5",
-    "bopodev-contracts": "0.1.25",
-    "bopodev-db": "0.1.25",
-    "bopodev-agent-sdk": "0.1.25"
+    "bopodev-contracts": "0.1.27",
+    "bopodev-agent-sdk": "0.1.27",
+    "bopodev-db": "0.1.27"
   },
   "devDependencies": {
     "@types/cors": "^2.8.19",

package/src/lib/run-artifact-paths.ts

@@ -0,0 +1,80 @@
+import { isAbsolute, resolve } from "node:path";
+import { isInsidePath, resolveCompanyWorkspaceRootPath } from "./instance-paths";
+
+/**
+ * Resolves a run-report artifact to an absolute path under the company workspace, or null if invalid.
+ * Shared by observability download and heartbeat artifact verification.
+ */
+export function resolveRunArtifactAbsolutePath(companyId: string, artifact: Record<string, unknown>) {
+  const companyWorkspaceRoot = resolveCompanyWorkspaceRootPath(companyId);
+  const absolutePathRaw = normalizeAbsoluteArtifactPath(
+    typeof artifact.absolutePath === "string" ? artifact.absolutePath.trim() : ""
+  );
+  const relativePathRaw = normalizeWorkspaceRelativeArtifactPath(
+    typeof artifact.relativePath === "string"
+      ? artifact.relativePath.trim()
+      : typeof artifact.path === "string"
+        ? artifact.path.trim()
+        : ""
+  );
+  const candidate = relativePathRaw
+    ? resolve(companyWorkspaceRoot, relativePathRaw)
+    : absolutePathRaw
+      ? absolutePathRaw
+      : "";
+  if (!candidate) {
+    return null;
+  }
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(companyWorkspaceRoot, candidate);
+  if (!isInsidePath(companyWorkspaceRoot, resolved)) {
+    return null;
+  }
+  return resolved;
+}
+
+function normalizeAbsoluteArtifactPath(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed || !isAbsolute(trimmed)) {
+    return "";
+  }
+  return resolve(trimmed);
+}
+
+function normalizeWorkspaceRelativeArtifactPath(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "";
+  }
+  const unixSeparated = trimmed.replace(/\\/g, "/");
+  if (isAbsolute(unixSeparated)) {
+    return "";
+  }
+  const parts: string[] = [];
+  for (const part of unixSeparated.split("/")) {
+    if (!part || part === ".") {
+      continue;
+    }
+    if (part === "..") {
+      if (parts.length > 0 && parts[parts.length - 1] !== "..") {
+        parts.pop();
+      } else {
+        parts.push(part);
+      }
+      continue;
+    }
+    parts.push(part);
+  }
+  const normalized = parts.join("/");
+  if (!normalized) {
+    return "";
+  }
+  const workspaceScopedMatch = normalized.match(/(?:^|\/)workspace\/([^/]+)\/(.+)$/);
+  if (!workspaceScopedMatch) {
+    return normalized;
+  }
+  const scopedRelativePath = workspaceScopedMatch[2];
+  if (!scopedRelativePath) {
+    return "";
+  }
+  return scopedRelativePath;
+}

package/src/pricing/anthropic.ts

@@ -0,0 +1,23 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const ANTHROPIC_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "claude-opus-4-6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4-6-1m", displayName: "Claude Sonnet 4.6 (1M context)", inputUsdPer1M: 6, outputUsdPer1M: 22.5 },
+  { modelId: "claude-opus-4-6-1m", displayName: "Claude Opus 4.6 (1M context)", inputUsdPer1M: 10, outputUsdPer1M: 37.5 },
+  { modelId: "claude-haiku-4-5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-sonnet-4-5-20250929", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-haiku-4-5-20251001", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-opus-4.6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-opus-4.5", displayName: "Claude Opus 4.5", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-opus-4.1", displayName: "Claude Opus 4.1", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-opus-4", displayName: "Claude Opus 4", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-sonnet-4.6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4.5", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4", displayName: "Claude Sonnet 4", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-3.7", displayName: "Claude Sonnet 3.7", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-haiku-4.5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-haiku-3.5", displayName: "Claude Haiku 3.5", inputUsdPer1M: 0.8, outputUsdPer1M: 4 },
+  { modelId: "claude-opus-3", displayName: "Claude Opus 3", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-haiku-3", displayName: "Claude Haiku 3", inputUsdPer1M: 0.25, outputUsdPer1M: 1.25 }
+];

package/src/pricing/gemini.ts

@@ -0,0 +1,11 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const GEMINI_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "gemini-3.1-flash-lite", displayName: "Gemini 3.1 Flash Lite", inputUsdPer1M: 0.25, outputUsdPer1M: 1.5 },
+  { modelId: "gemini-3-flash", displayName: "Gemini 3 Flash", inputUsdPer1M: 0.5, outputUsdPer1M: 3 },
+  { modelId: "gemini-3-pro", displayName: "Gemini 3 Pro", inputUsdPer1M: 2, outputUsdPer1M: 12 },
+  { modelId: "gemini-3-pro-200k", displayName: "Gemini 3 Pro (>200k context)", inputUsdPer1M: 4, outputUsdPer1M: 18 },
+  { modelId: "gemini-2.5-flash-lite", displayName: "Gemini 2.5 Flash Lite", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
+  { modelId: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", inputUsdPer1M: 0.3, outputUsdPer1M: 2.5 },
+  { modelId: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", inputUsdPer1M: 1.25, outputUsdPer1M: 10 }
+];

package/src/pricing/index.ts

@@ -0,0 +1,29 @@
+import type { CanonicalPricingProvider, ModelPricingCatalogRow } from "./types";
+import { OPENAI_MODEL_PRICING } from "./openai";
+import { ANTHROPIC_MODEL_PRICING } from "./anthropic";
+import { GEMINI_MODEL_PRICING } from "./gemini";
+import { OPENCODE_MODEL_PRICING } from "./opencode";
+
+const CATALOG_BY_PROVIDER: Record<CanonicalPricingProvider, ReadonlyMap<string, ModelPricingCatalogRow>> = {
+  openai_api: buildProviderCatalog(OPENAI_MODEL_PRICING),
+  anthropic_api: buildProviderCatalog(ANTHROPIC_MODEL_PRICING),
+  gemini_api: buildProviderCatalog(GEMINI_MODEL_PRICING),
+  opencode: buildProviderCatalog(OPENCODE_MODEL_PRICING)
+};
+
+export function getModelPricingCatalogRow(input: {
+  providerType: CanonicalPricingProvider;
+  modelId: string;
+}) {
+  return CATALOG_BY_PROVIDER[input.providerType].get(input.modelId.trim()) ?? null;
+}
+
+function buildProviderCatalog(rows: ModelPricingCatalogRow[]) {
+  const normalizedRows = rows.map((row) => ({
+    ...row,
+    modelId: row.modelId.trim()
+  }));
+  return new Map(normalizedRows.map((row) => [row.modelId, row]));
+}
+
+export * from "./types";

package/src/pricing/openai.ts

@@ -0,0 +1,47 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const OPENAI_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "gpt-5.2", displayName: "GPT-5.2", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1", displayName: "GPT-5.1", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5", displayName: "GPT-5", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-mini", displayName: "GPT-5 Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
+  { modelId: "gpt-5-nano", displayName: "GPT-5 Nano", inputUsdPer1M: 0.05, outputUsdPer1M: 0.4 },
+  { modelId: "gpt-5.3-chat-latest", displayName: "GPT-5.3 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.2-chat-latest", displayName: "GPT-5.2 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1-chat-latest", displayName: "GPT-5.1 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-chat-latest", displayName: "GPT-5 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.4", displayName: "GPT-5.4", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.3-codex", displayName: "GPT-5.3 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.3-codex-spark", displayName: "GPT-5.3 Codex Spark", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.2-codex", displayName: "GPT-5.2 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1-codex-max", displayName: "GPT-5.1 Codex Max", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.1-codex-mini", displayName: "GPT-5.1 Codex Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
+  { modelId: "gpt-5.1-codex", displayName: "GPT-5.1 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-codex", displayName: "GPT-5 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.2-pro", displayName: "GPT-5.2 Pro", inputUsdPer1M: 21, outputUsdPer1M: 168 },
+  { modelId: "gpt-5-pro", displayName: "GPT-5 Pro", inputUsdPer1M: 15, outputUsdPer1M: 120 },
+  { modelId: "gpt-4.1", displayName: "GPT-4.1", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "gpt-4.1-mini", displayName: "GPT-4.1 Mini", inputUsdPer1M: 0.4, outputUsdPer1M: 1.6 },
+  { modelId: "gpt-4.1-nano", displayName: "GPT-4.1 Nano", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
+  { modelId: "gpt-4o", displayName: "GPT-4o", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-4o-2024-05-13", displayName: "GPT-4o 2024-05-13", inputUsdPer1M: 5, outputUsdPer1M: 15 },
+  { modelId: "gpt-4o-mini", displayName: "GPT-4o Mini", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
+  { modelId: "gpt-realtime", displayName: "GPT Realtime", inputUsdPer1M: 4, outputUsdPer1M: 16 },
+  { modelId: "gpt-realtime-1.5", displayName: "GPT Realtime 1.5", inputUsdPer1M: 4, outputUsdPer1M: 16 },
+  { modelId: "gpt-realtime-mini", displayName: "GPT Realtime Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-4o-realtime-preview", displayName: "GPT-4o Realtime Preview", inputUsdPer1M: 5, outputUsdPer1M: 20 },
+  { modelId: "gpt-4o-mini-realtime-preview", displayName: "GPT-4o Mini Realtime Preview", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-audio", displayName: "GPT Audio", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-audio-1.5", displayName: "GPT Audio 1.5", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-audio-mini", displayName: "GPT Audio Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-4o-audio-preview", displayName: "GPT-4o Audio Preview", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-4o-mini-audio-preview", displayName: "GPT-4o Mini Audio Preview", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
+  { modelId: "o1", displayName: "o1", inputUsdPer1M: 15, outputUsdPer1M: 60 },
+  { modelId: "o1-pro", displayName: "o1-pro", inputUsdPer1M: 150, outputUsdPer1M: 600 },
+  { modelId: "o3-pro", displayName: "o3-pro", inputUsdPer1M: 20, outputUsdPer1M: 80 },
+  { modelId: "o3", displayName: "o3", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "o3-deep-research", displayName: "o3 Deep Research", inputUsdPer1M: 10, outputUsdPer1M: 40 },
+  { modelId: "o4-mini", displayName: "o4-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 },
+  { modelId: "o4-mini-deep-research", displayName: "o4-mini Deep Research", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "o3-mini", displayName: "o3-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 }
+];

package/src/pricing/opencode.ts

@@ -0,0 +1,5 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+// OpenCode runtime pricing is not publicly published in a stable token-price format.
+// Keep this catalog explicit and empty until canonical rates are available.
+export const OPENCODE_MODEL_PRICING: ModelPricingCatalogRow[] = [];

package/src/pricing/types.ts

@@ -0,0 +1,8 @@
+export type CanonicalPricingProvider = "openai_api" | "anthropic_api" | "gemini_api" | "opencode";
+
+export interface ModelPricingCatalogRow {
+  modelId: string;
+  displayName: string;
+  inputUsdPer1M: number;
+  outputUsdPer1M: number;
+}

package/src/routes/companies.ts

@@ -11,7 +11,6 @@ import { buildDefaultCeoBootstrapPrompt } from "../lib/ceo-bootstrap-prompt";
 import { resolveOpencodeRuntimeModel } from "../lib/opencode-model";
 import { resolveDefaultRuntimeCwdForCompany } from "../lib/workspace-policy";
 import { canAccessCompany, requireBoardRole, requirePermission } from "../middleware/request-actor";
-import { ensureCompanyModelPricingDefaults } from "../services/model-pricing";
 import { ensureCompanyBuiltinPluginDefaults } from "../services/plugin-runtime";
 import { ensureCompanyBuiltinTemplateDefaults } from "../services/template-catalog";
 
@@ -109,7 +108,6 @@ export function createCompaniesRouter(ctx: AppContext) {
     });
     await ensureCompanyBuiltinPluginDefaults(ctx.db, company.id);
     await ensureCompanyBuiltinTemplateDefaults(ctx.db, company.id);
-    await ensureCompanyModelPricingDefaults(ctx.db, company.id);
     return sendOk(res, company);
   });
 

package/src/routes/governance.ts

@@ -1,6 +1,7 @@
 import { Router } from "express";
 import { z } from "zod";
 import {
+  addIssueComment,
   appendAuditEvent,
   clearApprovalInboxDismissed,
   countPendingApprovalRequests,
@@ -209,6 +210,36 @@ export function createGovernanceRouter(ctx: AppContext) {
       if (approval.requestedByAgentId) {
         await publishOfficeOccupantForAgent(ctx.db, ctx.realtimeHub, req.companyId!, approval.requestedByAgentId);
       }
+      if (parsed.data.status === "approved" && resolution.action === "hire_agent" && resolution.execution.applied) {
+        const hireContext = parseHireApprovalCommentContext(approval.payloadJson);
+        if (hireContext.issueIds.length > 0) {
+          const commentBody = buildHireApprovalIssueComment(hireContext.roleLabel);
+          try {
+            for (const issueId of hireContext.issueIds) {
+              await addIssueComment(ctx.db, {
+                companyId: req.companyId!,
+                issueId,
+                body: commentBody,
+                authorType: auditActor.actorType === "agent" ? "agent" : "human",
+                authorId: auditActor.actorId
+              });
+            }
+          } catch (error) {
+            await appendAuditEvent(ctx.db, {
+              companyId: req.companyId!,
+              actorType: "system",
+              actorId: null,
+              eventType: "governance.hire_approval_comment_failed",
+              entityType: "approval_request",
+              entityId: approval.id,
+              payload: {
+                error: String(error),
+                issueIds: hireContext.issueIds
+              }
+            });
+          }
+        }
+      }
     }
 
     if (resolution.execution.entityType === "agent" && resolution.execution.entityId) {
@@ -231,11 +262,58 @@ function resolveAuditActor(actor: { type: "board" | "member" | "agent"; id: stri
   return { actorType: "human" as const, actorId: actor.id };
 }
 
-function parsePayload(payloadJson: string) {
+function parsePayload(payloadJson: string): Record<string, unknown> {
   try {
     const parsed = JSON.parse(payloadJson) as unknown;
-    return typeof parsed === "object" && parsed !== null ? parsed : {};
+    return typeof parsed === "object" && parsed !== null ? (parsed as Record<string, unknown>) : {};
   } catch {
     return {};
   }
 }
+
+function parseHireApprovalCommentContext(payloadJson: string) {
+  const payload = parsePayload(payloadJson);
+  const issueIds = normalizeSourceIssueIds(
+    typeof payload.sourceIssueId === "string" ? payload.sourceIssueId : undefined,
+    Array.isArray(payload.sourceIssueIds) ? payload.sourceIssueIds : undefined
+  );
+  const roleLabel = resolveHireRoleLabel(payload);
+  return { issueIds, roleLabel };
+}
+
+function normalizeSourceIssueIds(sourceIssueId?: string, sourceIssueIds?: unknown[]) {
+  const normalized = new Set<string>();
+  for (const entry of [sourceIssueId, ...(sourceIssueIds ?? [])]) {
+    if (typeof entry !== "string") {
+      continue;
+    }
+    const trimmed = entry.trim();
+    if (trimmed.length > 0) {
+      normalized.add(trimmed);
+    }
+  }
+  return Array.from(normalized);
+}
+
+function resolveHireRoleLabel(payload: Record<string, unknown>) {
+  const title = typeof payload.title === "string" ? payload.title.trim() : "";
+  if (title.length > 0) {
+    return title;
+  }
+  const role = typeof payload.role === "string" ? payload.role.trim() : "";
+  if (role.length > 0) {
+    return role;
+  }
+  const roleKey = typeof payload.roleKey === "string" ? payload.roleKey.trim() : "";
+  if (roleKey.length > 0) {
+    return roleKey.replace(/_/g, " ");
+  }
+  return null;
+}
+
+function buildHireApprovalIssueComment(roleLabel: string | null) {
+  if (roleLabel) {
+    return `Approved hiring of ${roleLabel}.`;
+  }
+  return "Approved hiring request.";
+}

package/src/routes/issues.ts

@@ -4,7 +4,7 @@ import { basename, extname, join, resolve } from "node:path";
 import { and, desc, eq, inArray } from "drizzle-orm";
 import multer from "multer";
 import { z } from "zod";
-import { IssueSchema } from "bopodev-contracts";
+import { IssueDetailSchema, IssueSchema } from "bopodev-contracts";
 import {
   addIssueAttachment,
   addIssueComment,
@@ -15,6 +15,7 @@ import {
   deleteIssueAttachment,
   deleteIssueComment,
   deleteIssue,
+  getIssue,
   heartbeatRuns,
   getIssueAttachment,
   issues,
@@ -190,6 +191,20 @@ export function createIssuesRouter(ctx: AppContext) {
     );
   });
 
+  router.get("/:issueId", async (req, res) => {
+    const issueId = req.params.issueId;
+    const issueRow = await getIssue(ctx.db, req.companyId!, issueId);
+    if (!issueRow) {
+      return sendError(res, "Issue not found.", 404);
+    }
+    const base = toIssueResponse(issueRow as unknown as Record<string, unknown>);
+    const attachmentRows = await listIssueAttachments(ctx.db, req.companyId!, issueId);
+    const attachments = attachmentRows.map((row) =>
+      toIssueAttachmentResponse(row as unknown as Record<string, unknown>, issueId)
+    );
+    return sendOkValidated(res, IssueDetailSchema, { ...base, attachments }, "issues.detail");
+  });
+
   router.post("/", async (req, res) => {
     requirePermission("issues:write")(req, res, () => {});
     if (res.headersSent) {

package/src/routes/observability.ts

@@ -1,5 +1,6 @@
 import { Router } from "express";
-import { z } from "zod";
+import { readFile, stat } from "node:fs/promises";
+import { basename, resolve } from "node:path";
 import {
   getHeartbeatRun,
   listCompanies,
@@ -9,14 +10,12 @@ import {
   listGoals,
   listHeartbeatRunMessages,
   listHeartbeatRuns,
-  listModelPricing,
-  listPluginRuns,
-  upsertModelPricing
+  listPluginRuns
 } from "bopodev-db";
 import type { AppContext } from "../context";
 import { sendError, sendOk } from "../http";
+import { resolveRunArtifactAbsolutePath } from "../lib/run-artifact-paths";
 import { requireCompanyScope } from "../middleware/company-scope";
-import { requirePermission } from "../middleware/request-actor";
 import { listAgentMemoryFiles, loadAgentMemoryContext, readAgentMemoryFile } from "../services/memory-file-service";
 
 export function createObservabilityRouter(ctx: AppContext) {
@@ -45,56 +44,6 @@ export function createObservabilityRouter(ctx: AppContext) {
     );
   });
 
-  const modelPricingUpdateSchema = z.object({
-    providerType: z.string().min(1),
-    modelId: z.string().min(1),
-    displayName: z.string().min(1).optional(),
-    inputUsdPer1M: z.number().min(0),
-    outputUsdPer1M: z.number().min(0),
-    currency: z.string().min(1).optional()
-  });
-
-  router.get("/models/pricing", async (req, res) => {
-    const rows = await listModelPricing(ctx.db, req.companyId!);
-    return sendOk(
-      res,
-      rows.map((row) => ({
-        companyId: row.companyId,
-        providerType: row.providerType,
-        modelId: row.modelId,
-        displayName: row.displayName,
-        inputUsdPer1M: typeof row.inputUsdPer1M === "number" ? row.inputUsdPer1M : Number(row.inputUsdPer1M ?? 0),
-        outputUsdPer1M: typeof row.outputUsdPer1M === "number" ? row.outputUsdPer1M : Number(row.outputUsdPer1M ?? 0),
-        currency: row.currency,
-        updatedAt: row.updatedAt?.toISOString?.() ?? null,
-        updatedBy: row.updatedBy ?? null
-      }))
-    );
-  });
-
-  router.put("/models/pricing", async (req, res) => {
-    requirePermission("observability:write")(req, res, () => {});
-    if (res.headersSent) {
-      return;
-    }
-    const parsed = modelPricingUpdateSchema.safeParse(req.body);
-    if (!parsed.success) {
-      return sendError(res, parsed.error.message, 422);
-    }
-    const payload = parsed.data;
-    await upsertModelPricing(ctx.db, {
-      companyId: req.companyId!,
-      providerType: payload.providerType,
-      modelId: payload.modelId,
-      displayName: payload.displayName ?? null,
-      inputUsdPer1M: payload.inputUsdPer1M.toFixed(6),
-      outputUsdPer1M: payload.outputUsdPer1M.toFixed(6),
-      currency: payload.currency ?? "USD",
-      updatedBy: req.actor?.id ?? null
-    });
-    return sendOk(res, { ok: true });
-  });
-
   router.get("/heartbeats", async (req, res) => {
     const companyId = req.companyId!;
     const rawLimit = Number(req.query.limit ?? 100);
@@ -113,10 +62,12 @@ export function createObservabilityRouter(ctx: AppContext) {
         .filter((run) => (agentFilter ? run.agentId === agentFilter : true))
         .map((run) => {
           const details = runDetailsByRunId.get(run.id);
-          const outcome = details?.outcome ?? null;
+          const report = toRecord(details?.report);
+          const outcome = details?.outcome ?? report?.outcome ?? null;
           return {
-            ...serializeRunRow(run, outcome),
-            outcome
+            ...serializeRunRow(run, details),
+            outcome,
+            report: report ?? null
           };
         })
     );
@@ -138,7 +89,7 @@ export function createObservabilityRouter(ctx: AppContext) {
     const trace = toRecord(details?.trace);
     const traceTranscript = Array.isArray(trace?.transcript) ? trace.transcript : [];
     return sendOk(res, {
-      run: serializeRunRow(run, details?.outcome ?? null),
+      run: serializeRunRow(run, details),
       details,
       transcript: {
         hasPersistedMessages: transcriptResult.items.length > 0,
@@ -148,6 +99,46 @@ export function createObservabilityRouter(ctx: AppContext) {
     });
   });
 
+  router.get("/heartbeats/:runId/artifacts/:artifactIndex/download", async (req, res) => {
+    const companyId = req.companyId!;
+    const runId = req.params.runId;
+    const rawArtifactIndex = Number(req.params.artifactIndex);
+    const artifactIndex = Number.isFinite(rawArtifactIndex) ? Math.floor(rawArtifactIndex) : NaN;
+    if (!Number.isInteger(artifactIndex) || artifactIndex < 0) {
+      return sendError(res, "Artifact index must be a non-negative integer.", 422);
+    }
+    const [run, auditRows] = await Promise.all([getHeartbeatRun(ctx.db, companyId, runId), listAuditEvents(ctx.db, companyId, 500)]);
+    if (!run) {
+      return sendError(res, "Run not found", 404);
+    }
+    const details = buildRunDetailsMap(auditRows).get(runId) ?? null;
+    const report = toRecord(details?.report);
+    const artifacts = Array.isArray(report?.artifacts)
+      ? report.artifacts.filter((entry) => typeof entry === "object" && entry !== null)
+      : [];
+    const artifact = (artifacts[artifactIndex] ?? null) as Record<string, unknown> | null;
+    if (!artifact) {
+      return sendError(res, "Artifact not found.", 404);
+    }
+    const resolvedPath = resolveRunArtifactAbsolutePath(companyId, artifact);
+    if (!resolvedPath) {
+      return sendError(res, "Artifact path is invalid.", 422);
+    }
+    let stats: Awaited<ReturnType<typeof stat>>;
+    try {
+      stats = await stat(resolvedPath);
+    } catch {
+      return sendError(res, "Artifact not found on disk.", 404);
+    }
+    if (!stats.isFile()) {
+      return sendError(res, "Artifact is not a file.", 422);
+    }
+    const buffer = await readFile(resolvedPath);
+    res.setHeader("content-type", "application/octet-stream");
+    res.setHeader("content-disposition", `inline; filename="${encodeURIComponent(basename(resolvedPath))}"`);
+    return res.send(buffer);
+  });
+
   router.get("/heartbeats/:runId/messages", async (req, res) => {
     const companyId = req.companyId!;
     const runId = req.params.runId;
@@ -369,14 +360,27 @@ function serializeRunRow(
   finishedAt: Date | null;
   message: string | null;
   },
-  outcome: unknown
+  details: Record<string, unknown> | null | undefined
 ) {
-  const runType = resolveRunType(run, outcome);
+  const runType = resolveRunType(run, details);
+  const report = toRecord(details?.report);
+  const publicStatusRaw = typeof report?.finalStatus === "string" ? report.finalStatus : null;
+  const publicStatus =
+    publicStatusRaw === "completed" || publicStatusRaw === "failed"
+      ? publicStatusRaw
+      : run.status === "started"
+        ? "started"
+        : run.status === "failed"
+          ? "failed"
+          : run.status === "completed"
+            ? "completed"
+            : "failed";
   return {
     id: run.id,
     companyId: run.companyId,
     agentId: run.agentId,
     status: run.status,
+    publicStatus,
     startedAt: run.startedAt.toISOString(),
     finishedAt: run.finishedAt?.toISOString() ?? null,
     message: run.message ?? null,
@@ -389,14 +393,25 @@ function resolveRunType(
     status: string;
     message: string | null;
   },
-  outcome: unknown
+  details: Record<string, unknown> | null | undefined
 ): "work" | "no_assigned_work" | "budget_skip" | "overlap_skip" | "other_skip" | "failed" | "running" {
   if (run.status === "started") {
     return "running";
   }
-  if (run.status === "failed") {
+  const report = toRecord(details?.report);
+  const completionReason = typeof report?.completionReason === "string" ? report.completionReason : null;
+  if (run.status === "failed" || completionReason === "runtime_error" || completionReason === "provider_unavailable") {
     return "failed";
   }
+  if (completionReason === "no_assigned_work") {
+    return "no_assigned_work";
+  }
+  if (completionReason === "budget_hard_stop") {
+    return "budget_skip";
+  }
+  if (completionReason === "overlap_in_progress") {
+    return "overlap_skip";
+  }
   const normalizedMessage = (run.message ?? "").toLowerCase();
   if (normalizedMessage.includes("already in progress")) {
     return "overlap_skip";
@@ -407,7 +422,7 @@ function resolveRunType(
   if (isNoAssignedWorkMessage(run.message)) {
     return "no_assigned_work";
   }
-  if (isNoAssignedWorkOutcome(outcome)) {
+  if (isNoAssignedWorkOutcome(details?.outcome)) {
     return "no_assigned_work";
   }
   if (run.status === "skipped") {