bopodev-api 0.1.26 → 0.1.27

package/README.md

@@ -0,0 +1,44 @@
+# `apps/api`
+
+Express API, websocket hub, and heartbeat scheduler runtime for Bopo.
+
+## Responsibilities
+
+- Serve HTTP routes for planning, execution, governance, observability, plugins, and templates.
+- Attach websocket hub on `/realtime` for company-scoped live updates.
+- Run heartbeat scheduler/queue worker based on `BOPO_SCHEDULER_ROLE`.
+
+## Runtime Entry Points
+
+- `src/server.ts` - startup, env loading, realtime bootstrap, scheduler ownership.
+- `src/app.ts` - middleware, route mounting, error handling.
+- `src/routes/*.ts` - route groups.
+- `src/worker/scheduler.ts` - periodic sweep orchestration.
+
+## Local Development
+
+From repository root (recommended):
+
+- `pnpm dev` or `pnpm start`
+
+From this package directly:
+
+- `pnpm --filter bopodev-api dev`
+- `pnpm --filter bopodev-api start`
+- `pnpm --filter bopodev-api db:init`
+- `pnpm --filter bopodev-api onboard:seed`
+- `pnpm --filter bopodev-api workspaces:backfill`
+
+Default port is `4020` (`API_PORT`/`PORT`).
+
+## Key Route Groups
+
+- `/auth`, `/attention`, `/companies`, `/projects`, `/issues`, `/goals`
+- `/agents`, `/governance`, `/heartbeats`, `/observability`
+- `/plugins`, `/templates`
+
+## Related Docs
+
+- `docs/developer/api-reference.md`
+- `docs/developer/configuration-reference.md`
+- `docs/operations/deployment.md`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bopodev-api",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "license": "MIT",
   "type": "module",
   "files": [
@@ -17,9 +17,9 @@
     "nanoid": "^5.1.5",
     "ws": "^8.19.0",
     "zod": "^4.1.5",
-    "bopodev-db": "0.1.26",
-    "bopodev-agent-sdk": "0.1.26",
-    "bopodev-contracts": "0.1.26"
+    "bopodev-contracts": "0.1.27",
+    "bopodev-agent-sdk": "0.1.27",
+    "bopodev-db": "0.1.27"
   },
   "devDependencies": {
     "@types/cors": "^2.8.19",

package/src/lib/run-artifact-paths.ts

@@ -0,0 +1,80 @@
+import { isAbsolute, resolve } from "node:path";
+import { isInsidePath, resolveCompanyWorkspaceRootPath } from "./instance-paths";
+
+/**
+ * Resolves a run-report artifact to an absolute path under the company workspace, or null if invalid.
+ * Shared by observability download and heartbeat artifact verification.
+ */
+export function resolveRunArtifactAbsolutePath(companyId: string, artifact: Record<string, unknown>) {
+  const companyWorkspaceRoot = resolveCompanyWorkspaceRootPath(companyId);
+  const absolutePathRaw = normalizeAbsoluteArtifactPath(
+    typeof artifact.absolutePath === "string" ? artifact.absolutePath.trim() : ""
+  );
+  const relativePathRaw = normalizeWorkspaceRelativeArtifactPath(
+    typeof artifact.relativePath === "string"
+      ? artifact.relativePath.trim()
+      : typeof artifact.path === "string"
+        ? artifact.path.trim()
+        : ""
+  );
+  const candidate = relativePathRaw
+    ? resolve(companyWorkspaceRoot, relativePathRaw)
+    : absolutePathRaw
+      ? absolutePathRaw
+      : "";
+  if (!candidate) {
+    return null;
+  }
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(companyWorkspaceRoot, candidate);
+  if (!isInsidePath(companyWorkspaceRoot, resolved)) {
+    return null;
+  }
+  return resolved;
+}
+
+function normalizeAbsoluteArtifactPath(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed || !isAbsolute(trimmed)) {
+    return "";
+  }
+  return resolve(trimmed);
+}
+
+function normalizeWorkspaceRelativeArtifactPath(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "";
+  }
+  const unixSeparated = trimmed.replace(/\\/g, "/");
+  if (isAbsolute(unixSeparated)) {
+    return "";
+  }
+  const parts: string[] = [];
+  for (const part of unixSeparated.split("/")) {
+    if (!part || part === ".") {
+      continue;
+    }
+    if (part === "..") {
+      if (parts.length > 0 && parts[parts.length - 1] !== "..") {
+        parts.pop();
+      } else {
+        parts.push(part);
+      }
+      continue;
+    }
+    parts.push(part);
+  }
+  const normalized = parts.join("/");
+  if (!normalized) {
+    return "";
+  }
+  const workspaceScopedMatch = normalized.match(/(?:^|\/)workspace\/([^/]+)\/(.+)$/);
+  if (!workspaceScopedMatch) {
+    return normalized;
+  }
+  const scopedRelativePath = workspaceScopedMatch[2];
+  if (!scopedRelativePath) {
+    return "";
+  }
+  return scopedRelativePath;
+}

package/src/pricing/anthropic.ts

@@ -0,0 +1,23 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const ANTHROPIC_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "claude-opus-4-6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4-6-1m", displayName: "Claude Sonnet 4.6 (1M context)", inputUsdPer1M: 6, outputUsdPer1M: 22.5 },
+  { modelId: "claude-opus-4-6-1m", displayName: "Claude Opus 4.6 (1M context)", inputUsdPer1M: 10, outputUsdPer1M: 37.5 },
+  { modelId: "claude-haiku-4-5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-sonnet-4-5-20250929", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-haiku-4-5-20251001", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-opus-4.6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-opus-4.5", displayName: "Claude Opus 4.5", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-opus-4.1", displayName: "Claude Opus 4.1", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-opus-4", displayName: "Claude Opus 4", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-sonnet-4.6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4.5", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4", displayName: "Claude Sonnet 4", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-3.7", displayName: "Claude Sonnet 3.7", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-haiku-4.5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-haiku-3.5", displayName: "Claude Haiku 3.5", inputUsdPer1M: 0.8, outputUsdPer1M: 4 },
+  { modelId: "claude-opus-3", displayName: "Claude Opus 3", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-haiku-3", displayName: "Claude Haiku 3", inputUsdPer1M: 0.25, outputUsdPer1M: 1.25 }
+];

package/src/pricing/gemini.ts

@@ -0,0 +1,11 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const GEMINI_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "gemini-3.1-flash-lite", displayName: "Gemini 3.1 Flash Lite", inputUsdPer1M: 0.25, outputUsdPer1M: 1.5 },
+  { modelId: "gemini-3-flash", displayName: "Gemini 3 Flash", inputUsdPer1M: 0.5, outputUsdPer1M: 3 },
+  { modelId: "gemini-3-pro", displayName: "Gemini 3 Pro", inputUsdPer1M: 2, outputUsdPer1M: 12 },
+  { modelId: "gemini-3-pro-200k", displayName: "Gemini 3 Pro (>200k context)", inputUsdPer1M: 4, outputUsdPer1M: 18 },
+  { modelId: "gemini-2.5-flash-lite", displayName: "Gemini 2.5 Flash Lite", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
+  { modelId: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", inputUsdPer1M: 0.3, outputUsdPer1M: 2.5 },
+  { modelId: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", inputUsdPer1M: 1.25, outputUsdPer1M: 10 }
+];

package/src/pricing/index.ts

@@ -0,0 +1,29 @@
+import type { CanonicalPricingProvider, ModelPricingCatalogRow } from "./types";
+import { OPENAI_MODEL_PRICING } from "./openai";
+import { ANTHROPIC_MODEL_PRICING } from "./anthropic";
+import { GEMINI_MODEL_PRICING } from "./gemini";
+import { OPENCODE_MODEL_PRICING } from "./opencode";
+
+const CATALOG_BY_PROVIDER: Record<CanonicalPricingProvider, ReadonlyMap<string, ModelPricingCatalogRow>> = {
+  openai_api: buildProviderCatalog(OPENAI_MODEL_PRICING),
+  anthropic_api: buildProviderCatalog(ANTHROPIC_MODEL_PRICING),
+  gemini_api: buildProviderCatalog(GEMINI_MODEL_PRICING),
+  opencode: buildProviderCatalog(OPENCODE_MODEL_PRICING)
+};
+
+export function getModelPricingCatalogRow(input: {
+  providerType: CanonicalPricingProvider;
+  modelId: string;
+}) {
+  return CATALOG_BY_PROVIDER[input.providerType].get(input.modelId.trim()) ?? null;
+}
+
+function buildProviderCatalog(rows: ModelPricingCatalogRow[]) {
+  const normalizedRows = rows.map((row) => ({
+    ...row,
+    modelId: row.modelId.trim()
+  }));
+  return new Map(normalizedRows.map((row) => [row.modelId, row]));
+}
+
+export * from "./types";

package/src/pricing/openai.ts

@@ -0,0 +1,47 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const OPENAI_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "gpt-5.2", displayName: "GPT-5.2", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1", displayName: "GPT-5.1", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5", displayName: "GPT-5", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-mini", displayName: "GPT-5 Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
+  { modelId: "gpt-5-nano", displayName: "GPT-5 Nano", inputUsdPer1M: 0.05, outputUsdPer1M: 0.4 },
+  { modelId: "gpt-5.3-chat-latest", displayName: "GPT-5.3 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.2-chat-latest", displayName: "GPT-5.2 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1-chat-latest", displayName: "GPT-5.1 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-chat-latest", displayName: "GPT-5 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.4", displayName: "GPT-5.4", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.3-codex", displayName: "GPT-5.3 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.3-codex-spark", displayName: "GPT-5.3 Codex Spark", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.2-codex", displayName: "GPT-5.2 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1-codex-max", displayName: "GPT-5.1 Codex Max", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.1-codex-mini", displayName: "GPT-5.1 Codex Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
+  { modelId: "gpt-5.1-codex", displayName: "GPT-5.1 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-codex", displayName: "GPT-5 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.2-pro", displayName: "GPT-5.2 Pro", inputUsdPer1M: 21, outputUsdPer1M: 168 },
+  { modelId: "gpt-5-pro", displayName: "GPT-5 Pro", inputUsdPer1M: 15, outputUsdPer1M: 120 },
+  { modelId: "gpt-4.1", displayName: "GPT-4.1", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "gpt-4.1-mini", displayName: "GPT-4.1 Mini", inputUsdPer1M: 0.4, outputUsdPer1M: 1.6 },
+  { modelId: "gpt-4.1-nano", displayName: "GPT-4.1 Nano", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
+  { modelId: "gpt-4o", displayName: "GPT-4o", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-4o-2024-05-13", displayName: "GPT-4o 2024-05-13", inputUsdPer1M: 5, outputUsdPer1M: 15 },
+  { modelId: "gpt-4o-mini", displayName: "GPT-4o Mini", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
+  { modelId: "gpt-realtime", displayName: "GPT Realtime", inputUsdPer1M: 4, outputUsdPer1M: 16 },
+  { modelId: "gpt-realtime-1.5", displayName: "GPT Realtime 1.5", inputUsdPer1M: 4, outputUsdPer1M: 16 },
+  { modelId: "gpt-realtime-mini", displayName: "GPT Realtime Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-4o-realtime-preview", displayName: "GPT-4o Realtime Preview", inputUsdPer1M: 5, outputUsdPer1M: 20 },
+  { modelId: "gpt-4o-mini-realtime-preview", displayName: "GPT-4o Mini Realtime Preview", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-audio", displayName: "GPT Audio", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-audio-1.5", displayName: "GPT Audio 1.5", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-audio-mini", displayName: "GPT Audio Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-4o-audio-preview", displayName: "GPT-4o Audio Preview", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-4o-mini-audio-preview", displayName: "GPT-4o Mini Audio Preview", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
+  { modelId: "o1", displayName: "o1", inputUsdPer1M: 15, outputUsdPer1M: 60 },
+  { modelId: "o1-pro", displayName: "o1-pro", inputUsdPer1M: 150, outputUsdPer1M: 600 },
+  { modelId: "o3-pro", displayName: "o3-pro", inputUsdPer1M: 20, outputUsdPer1M: 80 },
+  { modelId: "o3", displayName: "o3", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "o3-deep-research", displayName: "o3 Deep Research", inputUsdPer1M: 10, outputUsdPer1M: 40 },
+  { modelId: "o4-mini", displayName: "o4-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 },
+  { modelId: "o4-mini-deep-research", displayName: "o4-mini Deep Research", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "o3-mini", displayName: "o3-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 }
+];

package/src/pricing/opencode.ts

@@ -0,0 +1,5 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+// OpenCode runtime pricing is not publicly published in a stable token-price format.
+// Keep this catalog explicit and empty until canonical rates are available.
+export const OPENCODE_MODEL_PRICING: ModelPricingCatalogRow[] = [];

package/src/pricing/types.ts

@@ -0,0 +1,8 @@
+export type CanonicalPricingProvider = "openai_api" | "anthropic_api" | "gemini_api" | "opencode";
+
+export interface ModelPricingCatalogRow {
+  modelId: string;
+  displayName: string;
+  inputUsdPer1M: number;
+  outputUsdPer1M: number;
+}

package/src/routes/companies.ts

@@ -11,7 +11,6 @@ import { buildDefaultCeoBootstrapPrompt } from "../lib/ceo-bootstrap-prompt";
 import { resolveOpencodeRuntimeModel } from "../lib/opencode-model";
 import { resolveDefaultRuntimeCwdForCompany } from "../lib/workspace-policy";
 import { canAccessCompany, requireBoardRole, requirePermission } from "../middleware/request-actor";
-import { ensureCompanyModelPricingDefaults } from "../services/model-pricing";
 import { ensureCompanyBuiltinPluginDefaults } from "../services/plugin-runtime";
 import { ensureCompanyBuiltinTemplateDefaults } from "../services/template-catalog";
 
@@ -109,7 +108,6 @@ export function createCompaniesRouter(ctx: AppContext) {
     });
     await ensureCompanyBuiltinPluginDefaults(ctx.db, company.id);
     await ensureCompanyBuiltinTemplateDefaults(ctx.db, company.id);
-    await ensureCompanyModelPricingDefaults(ctx.db, company.id);
     return sendOk(res, company);
   });
 

package/src/routes/issues.ts

@@ -4,7 +4,7 @@ import { basename, extname, join, resolve } from "node:path";
 import { and, desc, eq, inArray } from "drizzle-orm";
 import multer from "multer";
 import { z } from "zod";
-import { IssueSchema } from "bopodev-contracts";
+import { IssueDetailSchema, IssueSchema } from "bopodev-contracts";
 import {
   addIssueAttachment,
   addIssueComment,
@@ -15,6 +15,7 @@ import {
   deleteIssueAttachment,
   deleteIssueComment,
   deleteIssue,
+  getIssue,
   heartbeatRuns,
   getIssueAttachment,
   issues,
@@ -190,6 +191,20 @@ export function createIssuesRouter(ctx: AppContext) {
     );
   });
 
+  router.get("/:issueId", async (req, res) => {
+    const issueId = req.params.issueId;
+    const issueRow = await getIssue(ctx.db, req.companyId!, issueId);
+    if (!issueRow) {
+      return sendError(res, "Issue not found.", 404);
+    }
+    const base = toIssueResponse(issueRow as unknown as Record<string, unknown>);
+    const attachmentRows = await listIssueAttachments(ctx.db, req.companyId!, issueId);
+    const attachments = attachmentRows.map((row) =>
+      toIssueAttachmentResponse(row as unknown as Record<string, unknown>, issueId)
+    );
+    return sendOkValidated(res, IssueDetailSchema, { ...base, attachments }, "issues.detail");
+  });
+
   router.post("/", async (req, res) => {
     requirePermission("issues:write")(req, res, () => {});
     if (res.headersSent) {

package/src/routes/observability.ts

@@ -1,7 +1,6 @@
 import { Router } from "express";
 import { readFile, stat } from "node:fs/promises";
-import { basename, isAbsolute, resolve } from "node:path";
-import { z } from "zod";
+import { basename, resolve } from "node:path";
 import {
   getHeartbeatRun,
   listCompanies,
@@ -11,15 +10,12 @@ import {
   listGoals,
   listHeartbeatRunMessages,
   listHeartbeatRuns,
-  listModelPricing,
-  listPluginRuns,
-  upsertModelPricing
+  listPluginRuns
 } from "bopodev-db";
 import type { AppContext } from "../context";
 import { sendError, sendOk } from "../http";
-import { isInsidePath, resolveCompanyWorkspaceRootPath } from "../lib/instance-paths";
+import { resolveRunArtifactAbsolutePath } from "../lib/run-artifact-paths";
 import { requireCompanyScope } from "../middleware/company-scope";
-import { requirePermission } from "../middleware/request-actor";
 import { listAgentMemoryFiles, loadAgentMemoryContext, readAgentMemoryFile } from "../services/memory-file-service";
 
 export function createObservabilityRouter(ctx: AppContext) {
@@ -48,56 +44,6 @@ export function createObservabilityRouter(ctx: AppContext) {
     );
   });
 
-  const modelPricingUpdateSchema = z.object({
-    providerType: z.string().min(1),
-    modelId: z.string().min(1),
-    displayName: z.string().min(1).optional(),
-    inputUsdPer1M: z.number().min(0),
-    outputUsdPer1M: z.number().min(0),
-    currency: z.string().min(1).optional()
-  });
-
-  router.get("/models/pricing", async (req, res) => {
-    const rows = await listModelPricing(ctx.db, req.companyId!);
-    return sendOk(
-      res,
-      rows.map((row) => ({
-        companyId: row.companyId,
-        providerType: row.providerType,
-        modelId: row.modelId,
-        displayName: row.displayName,
-        inputUsdPer1M: typeof row.inputUsdPer1M === "number" ? row.inputUsdPer1M : Number(row.inputUsdPer1M ?? 0),
-        outputUsdPer1M: typeof row.outputUsdPer1M === "number" ? row.outputUsdPer1M : Number(row.outputUsdPer1M ?? 0),
-        currency: row.currency,
-        updatedAt: row.updatedAt?.toISOString?.() ?? null,
-        updatedBy: row.updatedBy ?? null
-      }))
-    );
-  });
-
-  router.put("/models/pricing", async (req, res) => {
-    requirePermission("observability:write")(req, res, () => {});
-    if (res.headersSent) {
-      return;
-    }
-    const parsed = modelPricingUpdateSchema.safeParse(req.body);
-    if (!parsed.success) {
-      return sendError(res, parsed.error.message, 422);
-    }
-    const payload = parsed.data;
-    await upsertModelPricing(ctx.db, {
-      companyId: req.companyId!,
-      providerType: payload.providerType,
-      modelId: payload.modelId,
-      displayName: payload.displayName ?? null,
-      inputUsdPer1M: payload.inputUsdPer1M.toFixed(6),
-      outputUsdPer1M: payload.outputUsdPer1M.toFixed(6),
-      currency: payload.currency ?? "USD",
-      updatedBy: req.actor?.id ?? null
-    });
-    return sendOk(res, { ok: true });
-  });
-
   router.get("/heartbeats", async (req, res) => {
     const companyId = req.companyId!;
     const rawLimit = Number(req.query.limit ?? 100);
@@ -404,85 +350,6 @@ function toRecord(value: unknown) {
   return typeof value === "object" && value !== null ? (value as Record<string, unknown>) : null;
 }
 
-function resolveRunArtifactAbsolutePath(companyId: string, artifact: Record<string, unknown>) {
-  const companyWorkspaceRoot = resolveCompanyWorkspaceRootPath(companyId);
-  const absolutePathRaw = normalizeAbsoluteArtifactPath(
-    typeof artifact.absolutePath === "string" ? artifact.absolutePath.trim() : ""
-  );
-  const relativePathRaw = normalizeWorkspaceRelativeArtifactPath(
-    typeof artifact.relativePath === "string"
-      ? artifact.relativePath.trim()
-      : typeof artifact.path === "string"
-        ? artifact.path.trim()
-        : "",
-    companyId
-  );
-  const candidate = relativePathRaw
-    ? resolve(companyWorkspaceRoot, relativePathRaw)
-    : absolutePathRaw
-      ? absolutePathRaw
-      : "";
-  if (!candidate) {
-    return null;
-  }
-  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(companyWorkspaceRoot, candidate);
-  if (!isInsidePath(companyWorkspaceRoot, resolved)) {
-    return null;
-  }
-  return resolved;
-}
-
-function normalizeAbsoluteArtifactPath(value: string) {
-  const trimmed = value.trim();
-  if (!trimmed || !isAbsolute(trimmed)) {
-    return "";
-  }
-  return resolve(trimmed);
-}
-
-function normalizeWorkspaceRelativeArtifactPath(value: string, companyId: string) {
-  const trimmed = value.trim();
-  if (!trimmed) {
-    return "";
-  }
-  const unixSeparated = trimmed.replace(/\\/g, "/");
-  if (isAbsolute(unixSeparated)) {
-    return "";
-  }
-  const parts: string[] = [];
-  for (const part of unixSeparated.split("/")) {
-    if (!part || part === ".") {
-      continue;
-    }
-    if (part === "..") {
-      if (parts.length > 0 && parts[parts.length - 1] !== "..") {
-        parts.pop();
-      } else {
-        parts.push(part);
-      }
-      continue;
-    }
-    parts.push(part);
-  }
-  const normalized = parts.join("/");
-  if (!normalized) {
-    return "";
-  }
-  const workspaceScopedMatch = normalized.match(/(?:^|\/)workspace\/([^/]+)\/(.+)$/);
-  if (!workspaceScopedMatch) {
-    return normalized;
-  }
-  const scopedCompanyId = workspaceScopedMatch[1];
-  const scopedRelativePath = workspaceScopedMatch[2];
-  if (!scopedCompanyId || !scopedRelativePath) {
-    return "";
-  }
-  if (scopedCompanyId !== companyId) {
-    return "";
-  }
-  return scopedRelativePath;
-}
-
 function serializeRunRow(
   run: {
   id: string;

package/src/scripts/onboard-seed.ts

@@ -30,7 +30,6 @@ import {
 } from "../lib/instance-paths";
 import { buildDefaultCeoBootstrapPrompt } from "../lib/ceo-bootstrap-prompt";
 import { resolveDefaultRuntimeCwdForCompany } from "../lib/workspace-policy";
-import { ensureCompanyModelPricingDefaults } from "../services/model-pricing";
 import { applyTemplateManifest } from "../services/template-apply-service";
 import { ensureCompanyBuiltinTemplateDefaults } from "../services/template-catalog";
 
@@ -211,8 +210,6 @@ export async function ensureOnboardingSeed(input: {
       templateApplied = true;
       appliedTemplateId = template.id;
     }
-    await ensureCompanyModelPricingDefaults(db, companyId);
-
     return {
       companyId,
       companyName: resolvedCompanyName,
@@ -313,6 +310,7 @@ async function ensureCeoStartupTask(
     "Stand up your leadership operating baseline before taking on additional delivery work.",
     "",
     `1. Create your operating folder at \`${ceoOperatingFolder}/\`.`,
+    "   During heartbeats, prefer the absolute path in `$BOPODEV_AGENT_OPERATING_DIR` (set by the runtime) so files land under your agent folder even when the shell cwd is a project workspace.",
     "2. Author these files with your own voice and responsibilities:",
     `   - \`${ceoOperatingFolder}/AGENTS.md\``,
     `   - \`${ceoOperatingFolder}/HEARTBEAT.md\``,

package/src/server.ts

@@ -3,7 +3,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { sql } from "drizzle-orm";
 import { config as loadDotenv } from "dotenv";
-import { bootstrapDatabase, listCompanies } from "bopodev-db";
+import { bootstrapDatabase, listCompanies, resolveDefaultDbPath } from "bopodev-db";
 import { checkRuntimeCommandHealth } from "bopodev-agent-sdk";
 import type { RuntimeCommandHealth } from "bopodev-agent-sdk";
 import { createApp } from "./app";
@@ -33,7 +33,28 @@ async function main() {
   validateDeploymentConfiguration(deploymentMode, allowedOrigins, allowedHostnames, publicBaseUrl);
   const dbPath = normalizeOptionalDbPath(process.env.BOPO_DB_PATH);
   const port = Number(process.env.PORT ?? 4020);
-  const { db } = await bootstrapDatabase(dbPath);
+  const effectiveDbPath = dbPath ?? resolveDefaultDbPath();
+  let db: Awaited<ReturnType<typeof bootstrapDatabase>>["db"];
+  let dbClient: Awaited<ReturnType<typeof bootstrapDatabase>>["client"];
+  try {
+    const boot = await bootstrapDatabase(dbPath);
+    db = boot.db;
+    dbClient = boot.client;
+  } catch (error) {
+    if (isProbablyPgliteWasmAbort(error)) {
+      // eslint-disable-next-line no-console
+      console.error(
+        "[startup] PGlite (embedded Postgres) failed during database bootstrap. This is unrelated to Codex or heartbeat prompt settings."
+      );
+      // eslint-disable-next-line no-console
+      console.error(`[startup] Data path in use: ${effectiveDbPath}`);
+      // eslint-disable-next-line no-console
+      console.error(
+        "[startup] Recovery: stop all API/node processes using this DB, back up the path above, delete the file/dir, then restart (schema will be recreated). Or set BOPO_DB_PATH to a fresh path. See docs/operations/troubleshooting.md (PGlite)."
+      );
+    }
+    throw error;
+  }
   const existingCompanies = await listCompanies(db);
   await ensureBuiltinPluginsRegistered(
     db,
@@ -120,16 +141,69 @@ async function main() {
 
   const defaultCompanyId = process.env.BOPO_DEFAULT_COMPANY_ID;
   const schedulerCompanyId = await resolveSchedulerCompanyId(db, defaultCompanyId ?? null);
+  let stopScheduler: (() => void) | undefined;
   if (schedulerCompanyId && shouldStartScheduler()) {
-    createHeartbeatScheduler(db, schedulerCompanyId, realtimeHub);
+    stopScheduler = createHeartbeatScheduler(db, schedulerCompanyId, realtimeHub);
   } else if (schedulerCompanyId) {
     // eslint-disable-next-line no-console
     console.log("[startup] Scheduler disabled for this instance (BOPO_SCHEDULER_ROLE is follower/off).");
   }
+
+  let shutdownInFlight: Promise<void> | null = null;
+  function shutdown(signal: string) {
+    shutdownInFlight ??= (async () => {
+      // eslint-disable-next-line no-console
+      console.log(`[shutdown] ${signal} — closing realtime, HTTP server, and embedded DB…`);
+      stopScheduler?.();
+      try {
+        await realtimeHub.close();
+      } catch (closeError) {
+        // eslint-disable-next-line no-console
+        console.error("[shutdown] realtime hub close error", closeError);
+      }
+      await new Promise<void>((resolve, reject) => {
+        server.close((err) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve();
+        });
+      });
+      try {
+        await closePgliteClient(dbClient);
+      } catch (closeDbError) {
+        // eslint-disable-next-line no-console
+        console.error("[shutdown] PGlite close error", closeDbError);
+      }
+      // eslint-disable-next-line no-console
+      console.log("[shutdown] clean exit");
+      process.exit(0);
+    })().catch((error) => {
+      // eslint-disable-next-line no-console
+      console.error("[shutdown] failed", error);
+      process.exit(1);
+    });
+    return shutdownInFlight;
+  }
+
+  process.once("SIGINT", () => void shutdown("SIGINT"));
+  process.once("SIGTERM", () => void shutdown("SIGTERM"));
 }
 
 void main();
 
+async function closePgliteClient(client: unknown) {
+  if (!client || typeof client !== "object") {
+    return;
+  }
+  const closeFn = (client as { close?: unknown }).close;
+  if (typeof closeFn !== "function") {
+    return;
+  }
+  await (closeFn as () => Promise<void>)();
+}
+
 async function hasCodexAgentsConfigured(db: Awaited<ReturnType<typeof bootstrapDatabase>>["db"]) {
   const result = await db.execute(sql`
     SELECT id
@@ -262,3 +336,15 @@ function normalizeOptionalDbPath(value: string | undefined) {
   const normalized = value?.trim();
   return normalized && normalized.length > 0 ? normalized : undefined;
 }
+
+function isProbablyPgliteWasmAbort(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  const cause = error instanceof Error ? error.cause : undefined;
+  const causeMessage = cause instanceof Error ? cause.message : String(cause ?? "");
+  return (
+    message.includes("Aborted") ||
+    causeMessage.includes("Aborted") ||
+    message.includes("pglite") ||
+    causeMessage.includes("RuntimeError")
+  );
+}

package/src/services/attention-service.ts

@@ -17,6 +17,40 @@ import type { BoardAttentionItem } from "bopodev-contracts";
 
 type AttentionStateRow = Awaited<ReturnType<typeof listAttentionInboxStates>>[number];
 
+/** Keep in sync with `RESOLVED_APPROVAL_INBOX_WINDOW_DAYS` in governance routes (resolved history in Inbox). */
+const RESOLVED_APPROVAL_ATTENTION_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+
+type StoredApprovalRow = Awaited<ReturnType<typeof listApprovalRequests>>[number];
+
+function approvalIncludedInAttentionList(approval: Pick<StoredApprovalRow, "status" | "resolvedAt">): boolean {
+  if (approval.status === "pending") {
+    return true;
+  }
+  if (!approval.resolvedAt) {
+    return false;
+  }
+  return Date.now() - approval.resolvedAt.getTime() <= RESOLVED_APPROVAL_ATTENTION_WINDOW_MS;
+}
+
+function finalizeApprovalAttentionItem(item: BoardAttentionItem, approval: Pick<StoredApprovalRow, "status" | "resolvedAt" | "action">): BoardAttentionItem {
+  if (approval.status === "pending") {
+    return item;
+  }
+  const outcome =
+    approval.status === "approved" ? "Approved" : approval.status === "rejected" ? "Rejected" : "Overridden";
+  const title =
+    approval.action === "override_budget" ? `Budget hard-stop · ${outcome}` : `Approval · ${outcome}`;
+  const resolvedAtIso = approval.resolvedAt?.toISOString() ?? item.resolvedAt;
+  return {
+    ...item,
+    title,
+    state: "resolved",
+    resolvedAt: resolvedAtIso,
+    severity: "info",
+    sourceTimestamp: resolvedAtIso ?? item.sourceTimestamp
+  };
+}
+
 export async function listBoardAttentionItems(db: BopoDb, companyId: string, actorId: string): Promise<BoardAttentionItem[]> {
   const [approvals, blockedIssues, heartbeatRuns, stateRows, boardComments] = await Promise.all([
     listApprovalRequests(db, companyId),
@@ -42,7 +76,7 @@ export async function listBoardAttentionItems(db: BopoDb, companyId: string, act
   const items: BoardAttentionItem[] = [];
 
   for (const approval of approvals) {
-    if (approval.status !== "pending") {
+    if (!approvalIncludedInAttentionList(approval)) {
       continue;
     }
     const payload = parsePayload(approval.payloadJson);
@@ -55,25 +89,61 @@ export async function listBoardAttentionItems(db: BopoDb, companyId: string, act
       const usedBudget = asNumber(payload.usedBudgetUsd);
       const key = `budget:${approval.id}`;
       items.push(
+        finalizeApprovalAttentionItem(
+          withState(
+            {
+              key,
+              category: "budget_hard_stop",
+              severity: ageHours >= 12 ? "critical" : "warning",
+              requiredActor: "board",
+              title: "Budget hard-stop requires board decision",
+              contextSummary: projectId
+                ? `Project ${shortId(projectId)} is blocked by budget hard-stop.`
+                : agentId
+                  ? `Agent ${shortId(agentId)} is blocked by budget hard-stop.`
+                  : "Agent work is blocked by budget hard-stop.",
+              actionLabel: "Review budget override",
+              actionHref: "/governance",
+              impactSummary: "Heartbeat work stays paused until budget override is approved or rejected.",
+              evidence: {
+                approvalId: approval.id,
+                projectId: projectId ?? undefined,
+                agentId: agentId ?? undefined
+              },
+              sourceTimestamp: approval.createdAt.toISOString(),
+              state: "open",
+              seenAt: null,
+              acknowledgedAt: null,
+              dismissedAt: null,
+              resolvedAt: null
+            },
+            stateByKey.get(key),
+            `Budget utilization ${formatPercent(utilizationPct)} (${formatUsd(usedBudget)} / ${formatUsd(currentBudget)}).`
+          ),
+          approval
+        )
+      );
+      continue;
+    }
+
+    const key = `approval:${approval.id}`;
+    items.push(
+      finalizeApprovalAttentionItem(
         withState(
           {
             key,
-            category: "budget_hard_stop",
-            severity: ageHours >= 12 ? "critical" : "warning",
+            category: "approval_required",
+            severity: ageHours >= 24 ? "critical" : "warning",
             requiredActor: "board",
-            title: "Budget hard-stop requires board decision",
-            contextSummary: projectId
-              ? `Project ${shortId(projectId)} is blocked by budget hard-stop.`
-              : agentId
-                ? `Agent ${shortId(agentId)} is blocked by budget hard-stop.`
-                : "Agent work is blocked by budget hard-stop.",
-            actionLabel: "Review budget override",
+            title: "Approval required",
+            contextSummary: formatApprovalContext(approval.action, payload),
+            actionLabel: "Open approvals",
             actionHref: "/governance",
-            impactSummary: "Heartbeat work stays paused until budget override is approved or rejected.",
+            impactSummary: "Execution remains blocked until this governance decision is resolved.",
             evidence: {
               approvalId: approval.id,
-              projectId: projectId ?? undefined,
-              agentId: agentId ?? undefined
+              projectId: asString(payload.projectId) ?? undefined,
+              agentId: asString(payload.agentId) ?? undefined
             },
             sourceTimestamp: approval.createdAt.toISOString(),
             state: "open",
@@ -82,39 +152,9 @@ export async function listBoardAttentionItems(db: BopoDb, companyId: string, act
             dismissedAt: null,
             resolvedAt: null
           },
-          stateByKey.get(key),
-          `Budget utilization ${formatPercent(utilizationPct)} (${formatUsd(usedBudget)} / ${formatUsd(currentBudget)}).`
-        )
-      );
-      continue;
-    }
-
-    const key = `approval:${approval.id}`;
-    items.push(
-      withState(
-        {
-          key,
-          category: "approval_required",
-          severity: ageHours >= 24 ? "critical" : "warning",
-          requiredActor: "board",
-          title: "Approval required",
-          contextSummary: formatApprovalContext(approval.action, payload),
-          actionLabel: "Open approvals",
-          actionHref: "/governance",
-          impactSummary: "Execution remains blocked until this governance decision is resolved.",
-          evidence: {
-            approvalId: approval.id,
-            projectId: asString(payload.projectId) ?? undefined,
-            agentId: asString(payload.agentId) ?? undefined
-          },
-          sourceTimestamp: approval.createdAt.toISOString(),
-          state: "open",
-          seenAt: null,
-          acknowledgedAt: null,
-          dismissedAt: null,
-          resolvedAt: null
-        },
-        stateByKey.get(key)
+          stateByKey.get(key)
+        ),
+        approval
       )
     );
   }

package/src/services/governance-service.ts

@@ -777,6 +777,7 @@ function buildAgentStartupTaskBody(companyId: string, agentId: string) {
     `Create your operating baseline before starting feature delivery work.`,
     "",
     `1. Create your operating folder at \`${agentOperatingFolder}/\`.`,
+    "   During heartbeats, prefer the absolute path in `$BOPODEV_AGENT_OPERATING_DIR` (set by the runtime) so files land under your agent folder even when the shell cwd is a project workspace.",
     "2. Author these files with your own responsibilities and working style:",
     `   - \`${agentOperatingFolder}/AGENTS.md\``,
     `   - \`${agentOperatingFolder}/HEARTBEAT.md\``,

package/src/services/heartbeat-service.ts

@@ -1,9 +1,9 @@
-import { mkdir } from "node:fs/promises";
+import { mkdir, stat } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 import { resolveAdapter } from "bopodev-agent-sdk";
-import type { AgentState, HeartbeatContext } from "bopodev-agent-sdk";
+import type { AdapterExecutionResult, AgentState, HeartbeatContext } from "bopodev-agent-sdk";
 import {
   type AgentFinalRunOutput,
   ControlPlaneHeadersJsonSchema,
@@ -41,7 +41,13 @@ import {
   resolveCompanyWorkspaceRootPath,
   resolveProjectWorkspacePath
 } from "../lib/instance-paths";
-import { assertRuntimeCwdForCompany, getProjectWorkspaceContextMap, hasText, resolveAgentFallbackWorkspace } from "../lib/workspace-policy";
+import { resolveRunArtifactAbsolutePath } from "../lib/run-artifact-paths";
+import {
+  assertRuntimeCwdForCompany,
+  getProjectWorkspaceContextMap,
+  hasText,
+  resolveAgentFallbackWorkspace
+} from "../lib/workspace-policy";
 import type { RealtimeHub } from "../realtime/hub";
 import { createHeartbeatRunsRealtimeEvent } from "../realtime/heartbeat-runs";
 import { publishAttentionSnapshot } from "../realtime/attention";
@@ -892,6 +898,7 @@ export async function runHeartbeatForAgent(
       failClosed: false
     });
     const isCommentOrderWake = options?.wakeContext?.reason === "issue_comment_recipient";
+    const heartbeatIdlePolicy = resolveHeartbeatIdlePolicy();
     const workItems = isCommentOrderWake ? [] : await claimIssuesForAgent(db, companyId, agentId, runId);
     const wakeWorkItems = await loadWakeContextWorkItems(db, companyId, options?.wakeContext?.issueIds);
     const contextWorkItems = resolveExecutionWorkItems(workItems, wakeWorkItems, options?.wakeContext);
@@ -970,6 +977,7 @@ export async function runHeartbeatForAgent(
       contextWorkItems,
       mergedRuntime
     );
+    await mkdir(join(resolveAgentFallbackWorkspace(companyId, agent.id), "operating"), { recursive: true });
     state = {
       ...state,
       runtime: workspaceResolution.runtime
@@ -1005,6 +1013,10 @@ export async function runHeartbeatForAgent(
       ...context,
       memoryContext
     };
+    const isIdleNoWork = contextWorkItems.length === 0 && !isCommentOrderWake;
+    if (heartbeatIdlePolicy === "micro_prompt" && isIdleNoWork) {
+      context = { ...context, idleMicroPrompt: true };
+    }
     if (workspaceResolution.warnings.length > 0) {
       await appendAuditEvent(db, {
         companyId,
@@ -1170,19 +1182,34 @@ export async function runHeartbeatForAgent(
       };
     }
 
-    const execution = await executeAdapterWithWatchdog({
-      execute: (abortSignal) =>
-        adapter.execute({
-          ...context,
-          runtime: {
-            ...(context.runtime ?? {}),
-            abortSignal
+    const execution: AdapterExecutionResult =
+      heartbeatIdlePolicy === "skip_adapter" && isIdleNoWork
+        ? {
+            status: "ok",
+            summary:
+              "Idle heartbeat: no assigned work items; adapter not invoked (BOPO_HEARTBEAT_IDLE_POLICY=skip_adapter).",
+            tokenInput: 0,
+            tokenOutput: 0,
+            usdCost: 0,
+            usage: {
+              inputTokens: 0,
+              cachedInputTokens: 0,
+              outputTokens: 0
+            }
           }
-        }),
-      providerType: agent.providerType as HeartbeatProviderType,
-      runtime: workspaceResolution.runtime,
-      externalAbortSignal: activeRunAbort.signal
-    });
+        : await executeAdapterWithWatchdog({
+            execute: (abortSignal) =>
+              adapter.execute({
+                ...context,
+                runtime: {
+                  ...(context.runtime ?? {}),
+                  abortSignal
+                }
+              }),
+            providerType: agent.providerType as HeartbeatProviderType,
+            runtime: workspaceResolution.runtime,
+            externalAbortSignal: activeRunAbort.signal
+          });
     const usageLimitHint = execution.dispositionHint?.kind === "provider_usage_limited" ? execution.dispositionHint : null;
     if (usageLimitHint) {
       providerUsageLimitDisposition = {
@@ -1454,6 +1481,7 @@ export async function runHeartbeatForAgent(
       cost: runCost,
       runtimeCwd: workspaceResolution.runtime.cwd
     });
+    await verifyRunArtifactsOnDisk(companyId, runReport.artifacts);
     emitCanonicalResultEvent(runReport.resultSummary, runReport.finalStatus);
     const runListMessage = buildRunListMessageFromReport(runReport);
     await db
@@ -1823,6 +1851,7 @@ export async function runHeartbeatForAgent(
       errorType: classified.type,
       errorMessage: classified.message
     });
+    await verifyRunArtifactsOnDisk(companyId, runReport.artifacts);
     const runListMessage = buildRunListMessageFromReport(runReport);
     await db
       .update(heartbeatRuns)
@@ -2357,6 +2386,7 @@ async function buildHeartbeatContext(
       fileSizeBytes: number;
       relativePath: string;
       absolutePath: string;
+      downloadPath: string;
     }>
   >();
   for (const row of attachmentRows) {
@@ -2372,7 +2402,8 @@ async function buildHeartbeatContext(
       mimeType: row.mimeType,
       fileSizeBytes: row.fileSizeBytes,
       relativePath: row.relativePath,
-      absolutePath
+      absolutePath,
+      downloadPath: `/issues/${row.issueId}/attachments/${row.id}/download`
     });
     attachmentsByIssue.set(row.issueId, existing);
   }
@@ -2400,12 +2431,14 @@ async function buildHeartbeatContext(
     .filter((goal) => goal.status === "active" && goal.level === "agent")
     .map((goal) => goal.title);
   const isCommentOrderWake = input.wakeContext?.reason === "issue_comment_recipient";
+  const promptMode = resolveHeartbeatPromptMode();
 
   return {
     companyId,
     agentId: input.agentId,
     providerType: input.providerType,
     heartbeatRunId: input.heartbeatRunId,
+    promptMode,
     company: {
       name: company?.name ?? "Unknown company",
       mission: company?.mission ?? null
@@ -3054,6 +3087,26 @@ function buildRunArtifacts(input: {
   });
 }
 
+async function verifyRunArtifactsOnDisk(companyId: string, artifacts: RunArtifact[]) {
+  for (const artifact of artifacts) {
+    const resolved = resolveRunArtifactAbsolutePath(companyId, {
+      path: artifact.path,
+      relativePath: artifact.relativePath ?? undefined,
+      absolutePath: artifact.absolutePath ?? undefined
+    });
+    if (!resolved) {
+      artifact.verifiedOnDisk = false;
+      continue;
+    }
+    try {
+      const stats = await stat(resolved);
+      artifact.verifiedOnDisk = stats.isFile();
+    } catch {
+      artifact.verifiedOnDisk = false;
+    }
+  }
+}
+
 function toNormalizedWorkspaceRelativePath(inputPath: string | null | undefined) {
   const trimmed = inputPath?.trim();
   if (!trimmed) {
@@ -3094,11 +3147,9 @@ function normalizeAgentOperatingArtifactRelativePath(pathValue: string | null, c
     if (!parsed) {
       return null;
     }
-    const embeddedCompanyId = parsed[1]?.trim() || companyId;
     const agentId = parsed[2];
     const suffix = parsed[3] ?? "";
-    const effectiveCompanyId = embeddedCompanyId;
-    return `workspace/${effectiveCompanyId}/agents/${agentId}/operating${suffix}`;
+    return `workspace/${companyId}/agents/${agentId}/operating${suffix}`;
   }
   const directMatch = normalized.match(/^agents\/([^/]+)\/operating(\/.*)?$/);
   if (directMatch) {
@@ -3323,6 +3374,9 @@ function formatRunArtifactMarkdownLink(
   if (!label) {
     return "`artifact`";
   }
+  if (artifact.verifiedOnDisk === false) {
+    return `\`${label}\` (not found under company workspace at run completion)`;
+  }
   if (!href) {
     return `\`${label}\``;
   }
@@ -4291,6 +4345,24 @@ function clearResumeState(
   };
 }
 
+function resolveHeartbeatPromptMode(): "full" | "compact" {
+  const raw = process.env.BOPO_HEARTBEAT_PROMPT_MODE?.trim().toLowerCase();
+  return raw === "compact" ? "compact" : "full";
+}
+
+type HeartbeatIdlePolicy = "full" | "skip_adapter" | "micro_prompt";
+
+function resolveHeartbeatIdlePolicy(): HeartbeatIdlePolicy {
+  const raw = process.env.BOPO_HEARTBEAT_IDLE_POLICY?.trim().toLowerCase();
+  if (raw === "skip_adapter") {
+    return "skip_adapter";
+  }
+  if (raw === "micro_prompt") {
+    return "micro_prompt";
+  }
+  return "full";
+}
+
 function resolveControlPlaneEnv(runtimeEnv: Record<string, string>, suffix: string) {
   const next = runtimeEnv[`BOPODEV_${suffix}`];
   return hasText(next) ? (next as string) : "";
@@ -4307,8 +4379,13 @@ function buildHeartbeatRuntimeEnv(input: {
   canHireAgents: boolean;
   wakeContext?: HeartbeatWakeContext;
 }) {
+  const companyWorkspaceRoot = resolveCompanyWorkspaceRootPath(input.companyId);
+  const agentHome = resolveAgentFallbackWorkspace(input.companyId, input.agentId);
+  const agentOperatingDir = join(agentHome, "operating");
   const apiBaseUrl = resolveControlPlaneApiBaseUrl();
-  const actorPermissions = ["issues:write", ...(input.canHireAgents ? ["agents:write"] : [])].join(",");
+  // agents:write is required for PUT /agents/:self (bootstrapPrompt, runtimeConfig). Route handlers
+  // still forbid agents from updating other agents' rows and from POST /agents unless canHireAgents.
+  const actorPermissions = ["issues:write", "agents:write"].join(",");
   const actorHeaders = JSON.stringify({
     "x-company-id": input.companyId,
     "x-actor-type": "agent",
@@ -4322,7 +4399,12 @@ function buildHeartbeatRuntimeEnv(input: {
   return {
     BOPODEV_AGENT_ID: input.agentId,
     BOPODEV_COMPANY_ID: input.companyId,
+    BOPODEV_COMPANY_WORKSPACE_ROOT: companyWorkspaceRoot,
+    BOPODEV_AGENT_HOME: agentHome,
+    BOPODEV_AGENT_OPERATING_DIR: agentOperatingDir,
     BOPODEV_RUN_ID: input.heartbeatRunId,
+    BOPODEV_HEARTBEAT_PROMPT_MODE: resolveHeartbeatPromptMode(),
+    BOPODEV_HEARTBEAT_IDLE_POLICY: resolveHeartbeatIdlePolicy(),
     BOPODEV_FORCE_MANAGED_CODEX_HOME: "false",
     BOPODEV_API_BASE_URL: apiBaseUrl,
     BOPODEV_API_URL: apiBaseUrl,

package/src/services/model-pricing.ts

@@ -1,129 +1,6 @@
 import type { BopoDb } from "bopodev-db";
-import { getModelPricing, upsertModelPricing } from "bopodev-db";
-
-type SeedModelPricingRow = {
-  providerType: "openai_api" | "anthropic_api" | "gemini_api";
-  modelId: string;
-  displayName: string;
-  inputUsdPer1M: number;
-  outputUsdPer1M: number;
-};
-
-const OPENAI_MODEL_BASE_PRICES: Array<{
-  modelId: string;
-  displayName: string;
-  inputUsdPer1M: number;
-  outputUsdPer1M: number;
-}> = [
-  { modelId: "gpt-5.2", displayName: "GPT-5.2", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
-  { modelId: "gpt-5.1", displayName: "GPT-5.1", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
-  { modelId: "gpt-5", displayName: "GPT-5", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
-  { modelId: "gpt-5-mini", displayName: "GPT-5 Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
-  { modelId: "gpt-5-nano", displayName: "GPT-5 Nano", inputUsdPer1M: 0.05, outputUsdPer1M: 0.4 },
-  { modelId: "gpt-5.3-chat-latest", displayName: "GPT-5.3 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
-  { modelId: "gpt-5.2-chat-latest", displayName: "GPT-5.2 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
-  { modelId: "gpt-5.1-chat-latest", displayName: "GPT-5.1 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
-  { modelId: "gpt-5-chat-latest", displayName: "GPT-5 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
-  { modelId: "gpt-5.4", displayName: "GPT-5.4", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
-  { modelId: "gpt-5.3-codex", displayName: "GPT-5.3 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
-  { modelId: "gpt-5.3-codex-spark", displayName: "GPT-5.3 Codex Spark", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
-  { modelId: "gpt-5.2-codex", displayName: "GPT-5.2 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
-  { modelId: "gpt-5.1-codex-max", displayName: "GPT-5.1 Codex Max", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
-  { modelId: "gpt-5.1-codex-mini", displayName: "GPT-5.1 Codex Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
-  { modelId: "gpt-5.1-codex", displayName: "GPT-5.1 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
-  { modelId: "gpt-5-codex", displayName: "GPT-5 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
-  { modelId: "gpt-5.2-pro", displayName: "GPT-5.2 Pro", inputUsdPer1M: 21, outputUsdPer1M: 168 },
-  { modelId: "gpt-5-pro", displayName: "GPT-5 Pro", inputUsdPer1M: 15, outputUsdPer1M: 120 },
-  { modelId: "gpt-4.1", displayName: "GPT-4.1", inputUsdPer1M: 2, outputUsdPer1M: 8 },
-  { modelId: "gpt-4.1-mini", displayName: "GPT-4.1 Mini", inputUsdPer1M: 0.4, outputUsdPer1M: 1.6 },
-  { modelId: "gpt-4.1-nano", displayName: "GPT-4.1 Nano", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
-  { modelId: "gpt-4o", displayName: "GPT-4o", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
-  { modelId: "gpt-4o-2024-05-13", displayName: "GPT-4o 2024-05-13", inputUsdPer1M: 5, outputUsdPer1M: 15 },
-  { modelId: "gpt-4o-mini", displayName: "GPT-4o Mini", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
-  { modelId: "gpt-realtime", displayName: "GPT Realtime", inputUsdPer1M: 4, outputUsdPer1M: 16 },
-  { modelId: "gpt-realtime-1.5", displayName: "GPT Realtime 1.5", inputUsdPer1M: 4, outputUsdPer1M: 16 },
-  { modelId: "gpt-realtime-mini", displayName: "GPT Realtime Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
-  { modelId: "gpt-4o-realtime-preview", displayName: "GPT-4o Realtime Preview", inputUsdPer1M: 5, outputUsdPer1M: 20 },
-  { modelId: "gpt-4o-mini-realtime-preview", displayName: "GPT-4o Mini Realtime Preview", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
-  { modelId: "gpt-audio", displayName: "GPT Audio", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
-  { modelId: "gpt-audio-1.5", displayName: "GPT Audio 1.5", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
-  { modelId: "gpt-audio-mini", displayName: "GPT Audio Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
-  { modelId: "gpt-4o-audio-preview", displayName: "GPT-4o Audio Preview", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
-  { modelId: "gpt-4o-mini-audio-preview", displayName: "GPT-4o Mini Audio Preview", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
-  { modelId: "o1", displayName: "o1", inputUsdPer1M: 15, outputUsdPer1M: 60 },
-  { modelId: "o1-pro", displayName: "o1-pro", inputUsdPer1M: 150, outputUsdPer1M: 600 },
-  { modelId: "o3-pro", displayName: "o3-pro", inputUsdPer1M: 20, outputUsdPer1M: 80 },
-  { modelId: "o3", displayName: "o3", inputUsdPer1M: 2, outputUsdPer1M: 8 },
-  { modelId: "o3-deep-research", displayName: "o3 Deep Research", inputUsdPer1M: 10, outputUsdPer1M: 40 },
-  { modelId: "o4-mini", displayName: "o4-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 },
-  { modelId: "o4-mini-deep-research", displayName: "o4-mini Deep Research", inputUsdPer1M: 2, outputUsdPer1M: 8 },
-  { modelId: "o3-mini", displayName: "o3-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 }
-];
-
-const CLAUDE_MODEL_BASE_PRICES: Array<{
-  modelId: string;
-  displayName: string;
-  inputUsdPer1M: number;
-  outputUsdPer1M: number;
-}> = [
-  // Runtime ids currently used in provider model selectors.
-  { modelId: "claude-opus-4-6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
-  { modelId: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
-  { modelId: "claude-sonnet-4-6-1m", displayName: "Claude Sonnet 4.6 (1M context)", inputUsdPer1M: 6, outputUsdPer1M: 22.5 },
-  { modelId: "claude-opus-4-6-1m", displayName: "Claude Opus 4.6 (1M context)", inputUsdPer1M: 10, outputUsdPer1M: 37.5 },
-  { modelId: "claude-haiku-4-5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
-  // Legacy / alternate ids
-  { modelId: "claude-sonnet-4-5-20250929", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
-  { modelId: "claude-haiku-4-5-20251001", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
-  { modelId: "claude-opus-4.6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
-  { modelId: "claude-opus-4.5", displayName: "Claude Opus 4.5", inputUsdPer1M: 5, outputUsdPer1M: 25 },
-  { modelId: "claude-opus-4.1", displayName: "Claude Opus 4.1", inputUsdPer1M: 15, outputUsdPer1M: 75 },
-  { modelId: "claude-opus-4", displayName: "Claude Opus 4", inputUsdPer1M: 15, outputUsdPer1M: 75 },
-  { modelId: "claude-sonnet-4.6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
-  { modelId: "claude-sonnet-4.5", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
-  { modelId: "claude-sonnet-4", displayName: "Claude Sonnet 4", inputUsdPer1M: 3, outputUsdPer1M: 15 },
-  { modelId: "claude-sonnet-3.7", displayName: "Claude Sonnet 3.7", inputUsdPer1M: 3, outputUsdPer1M: 15 },
-  { modelId: "claude-haiku-4.5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
-  { modelId: "claude-haiku-3.5", displayName: "Claude Haiku 3.5", inputUsdPer1M: 0.8, outputUsdPer1M: 4 },
-  { modelId: "claude-opus-3", displayName: "Claude Opus 3", inputUsdPer1M: 15, outputUsdPer1M: 75 },
-  { modelId: "claude-haiku-3", displayName: "Claude Haiku 3", inputUsdPer1M: 0.25, outputUsdPer1M: 1.25 }
-];
-
-const GEMINI_MODEL_BASE_PRICES: Array<{
-  modelId: string;
-  displayName: string;
-  inputUsdPer1M: number;
-  outputUsdPer1M: number;
-}> = [
-  { modelId: "gemini-3.1-flash-lite", displayName: "Gemini 3.1 Flash Lite", inputUsdPer1M: 0.25, outputUsdPer1M: 1.5 },
-  { modelId: "gemini-3-flash", displayName: "Gemini 3 Flash", inputUsdPer1M: 0.5, outputUsdPer1M: 3 },
-  { modelId: "gemini-3-pro", displayName: "Gemini 3 Pro", inputUsdPer1M: 2, outputUsdPer1M: 12 },
-  { modelId: "gemini-3-pro-200k", displayName: "Gemini 3 Pro (>200k context)", inputUsdPer1M: 4, outputUsdPer1M: 18 },
-  { modelId: "gemini-2.5-flash-lite", displayName: "Gemini 2.5 Flash Lite", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
-  { modelId: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", inputUsdPer1M: 0.3, outputUsdPer1M: 2.5 },
-  { modelId: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", inputUsdPer1M: 1.25, outputUsdPer1M: 10 }
-];
-
-const DEFAULT_MODEL_PRICING_ROWS: SeedModelPricingRow[] = [
-  ...OPENAI_MODEL_BASE_PRICES.map((row) => ({ ...row, providerType: "openai_api" as const })),
-  ...CLAUDE_MODEL_BASE_PRICES.map((row) => ({ ...row, providerType: "anthropic_api" as const })),
-  ...GEMINI_MODEL_BASE_PRICES.map((row) => ({ ...row, providerType: "gemini_api" as const }))
-];
-
-export async function ensureCompanyModelPricingDefaults(db: BopoDb, companyId: string) {
-  for (const row of DEFAULT_MODEL_PRICING_ROWS) {
-    await upsertModelPricing(db, {
-      companyId,
-      providerType: row.providerType,
-      modelId: row.modelId,
-      displayName: row.displayName,
-      inputUsdPer1M: row.inputUsdPer1M.toFixed(6),
-      outputUsdPer1M: row.outputUsdPer1M.toFixed(6),
-      currency: "USD",
-      updatedBy: "system:onboarding-defaults"
-    });
-  }
-}
+import type { CanonicalPricingProvider } from "../pricing";
+import { getModelPricingCatalogRow } from "../pricing";
 
 export async function calculateModelPricedUsdCost(input: {
   db: BopoDb;
@@ -145,8 +22,7 @@ export async function calculateModelPricedUsdCost(input: {
       pricingModelId: normalizedModelId || null
     };
   }
-  const pricing = await getModelPricing(input.db, {
-    companyId: input.companyId,
+  const pricing = getModelPricingCatalogRow({
     providerType: canonicalPricingProviderType,
     modelId: normalizedModelId
   });
@@ -189,7 +65,7 @@ export async function calculateModelPricedUsdCost(input: {
   };
 }
 
-export function resolveCanonicalPricingProvider(providerType: string | null | undefined) {
+export function resolveCanonicalPricingProvider(providerType: string | null | undefined): CanonicalPricingProvider | null {
   const normalizedProvider = providerType?.trim() ?? "";
   if (!normalizedProvider) {
     return null;