bopodev-api 0.1.26 → 0.1.28

package/README.md

@@ -0,0 +1,44 @@
+# `apps/api`
+
+Express API, websocket hub, and heartbeat scheduler runtime for Bopo.
+
+## Responsibilities
+
+- Serve HTTP routes for planning, execution, governance, observability, plugins, and templates.
+- Attach websocket hub on `/realtime` for company-scoped live updates.
+- Run heartbeat scheduler/queue worker based on `BOPO_SCHEDULER_ROLE`.
+
+## Runtime Entry Points
+
+- `src/server.ts` - startup, env loading, realtime bootstrap, scheduler ownership.
+- `src/app.ts` - middleware, route mounting, error handling.
+- `src/routes/*.ts` - route groups.
+- `src/worker/scheduler.ts` - periodic sweep orchestration.
+
+## Local Development
+
+From repository root (recommended):
+
+- `pnpm dev` or `pnpm start`
+
+From this package directly:
+
+- `pnpm --filter bopodev-api dev`
+- `pnpm --filter bopodev-api start`
+- `pnpm --filter bopodev-api db:init`
+- `pnpm --filter bopodev-api onboard:seed`
+- `pnpm --filter bopodev-api workspaces:backfill`
+
+Default port is `4020` (`API_PORT`/`PORT`).
+
+## Key Route Groups
+
+- `/auth`, `/attention`, `/companies`, `/projects`, `/issues`, `/goals`
+- `/agents`, `/governance`, `/heartbeats`, `/observability`
+- `/plugins`, `/templates`
+
+## Related Docs
+
+- `docs/developer/api-reference.md`
+- `docs/developer/configuration-reference.md`
+- `docs/operations/deployment.md`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bopodev-api",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "license": "MIT",
   "type": "module",
   "files": [
@@ -17,9 +17,9 @@
     "nanoid": "^5.1.5",
     "ws": "^8.19.0",
     "zod": "^4.1.5",
-    "bopodev-db": "0.1.26",
-    "bopodev-agent-sdk": "0.1.26",
-    "bopodev-contracts": "0.1.26"
+    "bopodev-agent-sdk": "0.1.28",
+    "bopodev-db": "0.1.28",
+    "bopodev-contracts": "0.1.28"
   },
   "devDependencies": {
     "@types/cors": "^2.8.19",

package/src/app.ts

@@ -1,8 +1,7 @@
 import cors from "cors";
 import express from "express";
 import type { NextFunction, Request, Response } from "express";
-import { sql } from "drizzle-orm";
-import { RepositoryValidationError } from "bopodev-db";
+import { RepositoryValidationError, sql } from "bopodev-db";
 import { nanoid } from "nanoid";
 import type { AppContext } from "./context";
 import { createAgentsRouter } from "./routes/agents";

package/src/lib/drainable-work.ts

@@ -0,0 +1,36 @@
+export type DrainableWorkTracker = {
+  beginShutdown: () => void;
+  isShuttingDown: () => boolean;
+  track: <T>(promise: Promise<T>) => Promise<T>;
+  drain: () => Promise<void>;
+  resetForTests: () => void;
+};
+
+export function createDrainableWorkTracker(): DrainableWorkTracker {
+  let shuttingDown = false;
+  const pending = new Set<Promise<unknown>>();
+
+  return {
+    beginShutdown() {
+      shuttingDown = true;
+    },
+    isShuttingDown() {
+      return shuttingDown;
+    },
+    track<T>(promise: Promise<T>) {
+      let tracked: Promise<T>;
+      tracked = promise.finally(() => {
+        pending.delete(tracked);
+      });
+      pending.add(tracked);
+      return tracked;
+    },
+    async drain() {
+      await Promise.allSettled([...pending]);
+    },
+    resetForTests() {
+      shuttingDown = false;
+      pending.clear();
+    }
+  };
+}

package/src/lib/run-artifact-paths.ts

@@ -0,0 +1,80 @@
+import { isAbsolute, resolve } from "node:path";
+import { isInsidePath, resolveCompanyWorkspaceRootPath } from "./instance-paths";
+
+/**
+ * Resolves a run-report artifact to an absolute path under the company workspace, or null if invalid.
+ * Shared by observability download and heartbeat artifact verification.
+ */
+export function resolveRunArtifactAbsolutePath(companyId: string, artifact: Record<string, unknown>) {
+  const companyWorkspaceRoot = resolveCompanyWorkspaceRootPath(companyId);
+  const absolutePathRaw = normalizeAbsoluteArtifactPath(
+    typeof artifact.absolutePath === "string" ? artifact.absolutePath.trim() : ""
+  );
+  const relativePathRaw = normalizeWorkspaceRelativeArtifactPath(
+    typeof artifact.relativePath === "string"
+      ? artifact.relativePath.trim()
+      : typeof artifact.path === "string"
+        ? artifact.path.trim()
+        : ""
+  );
+  const candidate = relativePathRaw
+    ? resolve(companyWorkspaceRoot, relativePathRaw)
+    : absolutePathRaw
+      ? absolutePathRaw
+      : "";
+  if (!candidate) {
+    return null;
+  }
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(companyWorkspaceRoot, candidate);
+  if (!isInsidePath(companyWorkspaceRoot, resolved)) {
+    return null;
+  }
+  return resolved;
+}
+
+function normalizeAbsoluteArtifactPath(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed || !isAbsolute(trimmed)) {
+    return "";
+  }
+  return resolve(trimmed);
+}
+
+function normalizeWorkspaceRelativeArtifactPath(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "";
+  }
+  const unixSeparated = trimmed.replace(/\\/g, "/");
+  if (isAbsolute(unixSeparated)) {
+    return "";
+  }
+  const parts: string[] = [];
+  for (const part of unixSeparated.split("/")) {
+    if (!part || part === ".") {
+      continue;
+    }
+    if (part === "..") {
+      if (parts.length > 0 && parts[parts.length - 1] !== "..") {
+        parts.pop();
+      } else {
+        parts.push(part);
+      }
+      continue;
+    }
+    parts.push(part);
+  }
+  const normalized = parts.join("/");
+  if (!normalized) {
+    return "";
+  }
+  const workspaceScopedMatch = normalized.match(/(?:^|\/)workspace\/([^/]+)\/(.+)$/);
+  if (!workspaceScopedMatch) {
+    return normalized;
+  }
+  const scopedRelativePath = workspaceScopedMatch[2];
+  if (!scopedRelativePath) {
+    return "";
+  }
+  return scopedRelativePath;
+}

package/src/lib/workspace-policy.ts

@@ -1,6 +1,5 @@
-import { and, eq, inArray } from "drizzle-orm";
 import type { BopoDb } from "bopodev-db";
-import { projectWorkspaces, projects } from "bopodev-db";
+import { and, eq, inArray, projectWorkspaces, projects } from "bopodev-db";
 import {
   assertPathInsideCompanyWorkspaceRoot,
   isInsidePath,

package/src/pricing/anthropic.ts

@@ -0,0 +1,23 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const ANTHROPIC_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "claude-opus-4-6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4-6-1m", displayName: "Claude Sonnet 4.6 (1M context)", inputUsdPer1M: 6, outputUsdPer1M: 22.5 },
+  { modelId: "claude-opus-4-6-1m", displayName: "Claude Opus 4.6 (1M context)", inputUsdPer1M: 10, outputUsdPer1M: 37.5 },
+  { modelId: "claude-haiku-4-5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-sonnet-4-5-20250929", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-haiku-4-5-20251001", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-opus-4.6", displayName: "Claude Opus 4.6", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-opus-4.5", displayName: "Claude Opus 4.5", inputUsdPer1M: 5, outputUsdPer1M: 25 },
+  { modelId: "claude-opus-4.1", displayName: "Claude Opus 4.1", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-opus-4", displayName: "Claude Opus 4", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-sonnet-4.6", displayName: "Claude Sonnet 4.6", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4.5", displayName: "Claude Sonnet 4.5", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-4", displayName: "Claude Sonnet 4", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-sonnet-3.7", displayName: "Claude Sonnet 3.7", inputUsdPer1M: 3, outputUsdPer1M: 15 },
+  { modelId: "claude-haiku-4.5", displayName: "Claude Haiku 4.5", inputUsdPer1M: 1, outputUsdPer1M: 5 },
+  { modelId: "claude-haiku-3.5", displayName: "Claude Haiku 3.5", inputUsdPer1M: 0.8, outputUsdPer1M: 4 },
+  { modelId: "claude-opus-3", displayName: "Claude Opus 3", inputUsdPer1M: 15, outputUsdPer1M: 75 },
+  { modelId: "claude-haiku-3", displayName: "Claude Haiku 3", inputUsdPer1M: 0.25, outputUsdPer1M: 1.25 }
+];

package/src/pricing/gemini.ts

@@ -0,0 +1,11 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const GEMINI_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "gemini-3.1-flash-lite", displayName: "Gemini 3.1 Flash Lite", inputUsdPer1M: 0.25, outputUsdPer1M: 1.5 },
+  { modelId: "gemini-3-flash", displayName: "Gemini 3 Flash", inputUsdPer1M: 0.5, outputUsdPer1M: 3 },
+  { modelId: "gemini-3-pro", displayName: "Gemini 3 Pro", inputUsdPer1M: 2, outputUsdPer1M: 12 },
+  { modelId: "gemini-3-pro-200k", displayName: "Gemini 3 Pro (>200k context)", inputUsdPer1M: 4, outputUsdPer1M: 18 },
+  { modelId: "gemini-2.5-flash-lite", displayName: "Gemini 2.5 Flash Lite", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
+  { modelId: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", inputUsdPer1M: 0.3, outputUsdPer1M: 2.5 },
+  { modelId: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", inputUsdPer1M: 1.25, outputUsdPer1M: 10 }
+];

package/src/pricing/index.ts

@@ -0,0 +1,29 @@
+import type { CanonicalPricingProvider, ModelPricingCatalogRow } from "./types";
+import { OPENAI_MODEL_PRICING } from "./openai";
+import { ANTHROPIC_MODEL_PRICING } from "./anthropic";
+import { GEMINI_MODEL_PRICING } from "./gemini";
+import { OPENCODE_MODEL_PRICING } from "./opencode";
+
+const CATALOG_BY_PROVIDER: Record<CanonicalPricingProvider, ReadonlyMap<string, ModelPricingCatalogRow>> = {
+  openai_api: buildProviderCatalog(OPENAI_MODEL_PRICING),
+  anthropic_api: buildProviderCatalog(ANTHROPIC_MODEL_PRICING),
+  gemini_api: buildProviderCatalog(GEMINI_MODEL_PRICING),
+  opencode: buildProviderCatalog(OPENCODE_MODEL_PRICING)
+};
+
+export function getModelPricingCatalogRow(input: {
+  providerType: CanonicalPricingProvider;
+  modelId: string;
+}) {
+  return CATALOG_BY_PROVIDER[input.providerType].get(input.modelId.trim()) ?? null;
+}
+
+function buildProviderCatalog(rows: ModelPricingCatalogRow[]) {
+  const normalizedRows = rows.map((row) => ({
+    ...row,
+    modelId: row.modelId.trim()
+  }));
+  return new Map(normalizedRows.map((row) => [row.modelId, row]));
+}
+
+export * from "./types";

package/src/pricing/openai.ts

@@ -0,0 +1,47 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+export const OPENAI_MODEL_PRICING: ModelPricingCatalogRow[] = [
+  { modelId: "gpt-5.2", displayName: "GPT-5.2", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1", displayName: "GPT-5.1", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5", displayName: "GPT-5", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-mini", displayName: "GPT-5 Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
+  { modelId: "gpt-5-nano", displayName: "GPT-5 Nano", inputUsdPer1M: 0.05, outputUsdPer1M: 0.4 },
+  { modelId: "gpt-5.3-chat-latest", displayName: "GPT-5.3 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.2-chat-latest", displayName: "GPT-5.2 Chat Latest", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1-chat-latest", displayName: "GPT-5.1 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-chat-latest", displayName: "GPT-5 Chat Latest", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.4", displayName: "GPT-5.4", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.3-codex", displayName: "GPT-5.3 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.3-codex-spark", displayName: "GPT-5.3 Codex Spark", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.2-codex", displayName: "GPT-5.2 Codex", inputUsdPer1M: 1.75, outputUsdPer1M: 14 },
+  { modelId: "gpt-5.1-codex-max", displayName: "GPT-5.1 Codex Max", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.1-codex-mini", displayName: "GPT-5.1 Codex Mini", inputUsdPer1M: 0.25, outputUsdPer1M: 2 },
+  { modelId: "gpt-5.1-codex", displayName: "GPT-5.1 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5-codex", displayName: "GPT-5 Codex", inputUsdPer1M: 1.25, outputUsdPer1M: 10 },
+  { modelId: "gpt-5.2-pro", displayName: "GPT-5.2 Pro", inputUsdPer1M: 21, outputUsdPer1M: 168 },
+  { modelId: "gpt-5-pro", displayName: "GPT-5 Pro", inputUsdPer1M: 15, outputUsdPer1M: 120 },
+  { modelId: "gpt-4.1", displayName: "GPT-4.1", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "gpt-4.1-mini", displayName: "GPT-4.1 Mini", inputUsdPer1M: 0.4, outputUsdPer1M: 1.6 },
+  { modelId: "gpt-4.1-nano", displayName: "GPT-4.1 Nano", inputUsdPer1M: 0.1, outputUsdPer1M: 0.4 },
+  { modelId: "gpt-4o", displayName: "GPT-4o", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-4o-2024-05-13", displayName: "GPT-4o 2024-05-13", inputUsdPer1M: 5, outputUsdPer1M: 15 },
+  { modelId: "gpt-4o-mini", displayName: "GPT-4o Mini", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
+  { modelId: "gpt-realtime", displayName: "GPT Realtime", inputUsdPer1M: 4, outputUsdPer1M: 16 },
+  { modelId: "gpt-realtime-1.5", displayName: "GPT Realtime 1.5", inputUsdPer1M: 4, outputUsdPer1M: 16 },
+  { modelId: "gpt-realtime-mini", displayName: "GPT Realtime Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-4o-realtime-preview", displayName: "GPT-4o Realtime Preview", inputUsdPer1M: 5, outputUsdPer1M: 20 },
+  { modelId: "gpt-4o-mini-realtime-preview", displayName: "GPT-4o Mini Realtime Preview", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-audio", displayName: "GPT Audio", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-audio-1.5", displayName: "GPT Audio 1.5", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-audio-mini", displayName: "GPT Audio Mini", inputUsdPer1M: 0.6, outputUsdPer1M: 2.4 },
+  { modelId: "gpt-4o-audio-preview", displayName: "GPT-4o Audio Preview", inputUsdPer1M: 2.5, outputUsdPer1M: 10 },
+  { modelId: "gpt-4o-mini-audio-preview", displayName: "GPT-4o Mini Audio Preview", inputUsdPer1M: 0.15, outputUsdPer1M: 0.6 },
+  { modelId: "o1", displayName: "o1", inputUsdPer1M: 15, outputUsdPer1M: 60 },
+  { modelId: "o1-pro", displayName: "o1-pro", inputUsdPer1M: 150, outputUsdPer1M: 600 },
+  { modelId: "o3-pro", displayName: "o3-pro", inputUsdPer1M: 20, outputUsdPer1M: 80 },
+  { modelId: "o3", displayName: "o3", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "o3-deep-research", displayName: "o3 Deep Research", inputUsdPer1M: 10, outputUsdPer1M: 40 },
+  { modelId: "o4-mini", displayName: "o4-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 },
+  { modelId: "o4-mini-deep-research", displayName: "o4-mini Deep Research", inputUsdPer1M: 2, outputUsdPer1M: 8 },
+  { modelId: "o3-mini", displayName: "o3-mini", inputUsdPer1M: 1.1, outputUsdPer1M: 4.4 }
+];

package/src/pricing/opencode.ts

@@ -0,0 +1,5 @@
+import type { ModelPricingCatalogRow } from "./types";
+
+// OpenCode runtime pricing is not publicly published in a stable token-price format.
+// Keep this catalog explicit and empty until canonical rates are available.
+export const OPENCODE_MODEL_PRICING: ModelPricingCatalogRow[] = [];

package/src/pricing/types.ts

@@ -0,0 +1,8 @@
+export type CanonicalPricingProvider = "openai_api" | "anthropic_api" | "gemini_api" | "opencode";
+
+export interface ModelPricingCatalogRow {
+  modelId: string;
+  displayName: string;
+  inputUsdPer1M: number;
+  outputUsdPer1M: number;
+}

package/src/realtime/office-space.ts

@@ -1,9 +1,11 @@
-import { and, desc, eq } from "drizzle-orm";
 import type { OfficeOccupant, RealtimeEventEnvelope, RealtimeMessage } from "bopodev-contracts";
 import { AGENT_ROLE_LABELS, AgentRoleKeySchema } from "bopodev-contracts";
 import {
+  and,
   agents,
   approvalRequests,
+  desc,
+  eq,
   getApprovalRequest,
   heartbeatRuns,
   issues,

package/src/routes/companies.ts

@@ -11,7 +11,6 @@ import { buildDefaultCeoBootstrapPrompt } from "../lib/ceo-bootstrap-prompt";
 import { resolveOpencodeRuntimeModel } from "../lib/opencode-model";
 import { resolveDefaultRuntimeCwdForCompany } from "../lib/workspace-policy";
 import { canAccessCompany, requireBoardRole, requirePermission } from "../middleware/request-actor";
-import { ensureCompanyModelPricingDefaults } from "../services/model-pricing";
 import { ensureCompanyBuiltinPluginDefaults } from "../services/plugin-runtime";
 import { ensureCompanyBuiltinTemplateDefaults } from "../services/template-catalog";
 
@@ -109,7 +108,6 @@ export function createCompaniesRouter(ctx: AppContext) {
     });
     await ensureCompanyBuiltinPluginDefaults(ctx.db, company.id);
     await ensureCompanyBuiltinTemplateDefaults(ctx.db, company.id);
-    await ensureCompanyModelPricingDefaults(ctx.db, company.id);
     return sendOk(res, company);
   });
 

package/src/routes/heartbeats.ts

@@ -1,7 +1,6 @@
 import { Router } from "express";
 import { z } from "zod";
-import { and, eq } from "drizzle-orm";
-import { agents, heartbeatRuns, listHeartbeatQueueJobs } from "bopodev-db";
+import { agents, and, eq, heartbeatRuns, listHeartbeatQueueJobs } from "bopodev-db";
 import type { AppContext } from "../context";
 import { sendError, sendOk } from "../http";
 import { requireCompanyScope } from "../middleware/company-scope";

package/src/routes/issues.ts

@@ -1,22 +1,26 @@
 import { Router } from "express";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { basename, extname, join, resolve } from "node:path";
-import { and, desc, eq, inArray } from "drizzle-orm";
 import multer from "multer";
 import { z } from "zod";
-import { IssueSchema } from "bopodev-contracts";
+import { IssueDetailSchema, IssueSchema } from "bopodev-contracts";
 import {
   addIssueAttachment,
   addIssueComment,
   agents,
+  and,
   appendActivity,
   appendAuditEvent,
   createIssue,
   deleteIssueAttachment,
   deleteIssueComment,
   deleteIssue,
+  desc,
+  eq,
+  getIssue,
   heartbeatRuns,
   getIssueAttachment,
+  inArray,
   issues,
   listIssueAttachments,
   listIssueActivity,
@@ -190,6 +194,20 @@ export function createIssuesRouter(ctx: AppContext) {
     );
   });
 
+  router.get("/:issueId", async (req, res) => {
+    const issueId = req.params.issueId;
+    const issueRow = await getIssue(ctx.db, req.companyId!, issueId);
+    if (!issueRow) {
+      return sendError(res, "Issue not found.", 404);
+    }
+    const base = toIssueResponse(issueRow as unknown as Record<string, unknown>);
+    const attachmentRows = await listIssueAttachments(ctx.db, req.companyId!, issueId);
+    const attachments = attachmentRows.map((row) =>
+      toIssueAttachmentResponse(row as unknown as Record<string, unknown>, issueId)
+    );
+    return sendOkValidated(res, IssueDetailSchema, { ...base, attachments }, "issues.detail");
+  });
+
   router.post("/", async (req, res) => {
     requirePermission("issues:write")(req, res, () => {});
     if (res.headersSent) {

package/src/routes/observability.ts

@@ -1,7 +1,6 @@
 import { Router } from "express";
 import { readFile, stat } from "node:fs/promises";
-import { basename, isAbsolute, resolve } from "node:path";
-import { z } from "zod";
+import { basename, resolve } from "node:path";
 import {
   getHeartbeatRun,
   listCompanies,
@@ -11,15 +10,12 @@ import {
   listGoals,
   listHeartbeatRunMessages,
   listHeartbeatRuns,
-  listModelPricing,
-  listPluginRuns,
-  upsertModelPricing
+  listPluginRuns
 } from "bopodev-db";
 import type { AppContext } from "../context";
 import { sendError, sendOk } from "../http";
-import { isInsidePath, resolveCompanyWorkspaceRootPath } from "../lib/instance-paths";
+import { resolveRunArtifactAbsolutePath } from "../lib/run-artifact-paths";
 import { requireCompanyScope } from "../middleware/company-scope";
-import { requirePermission } from "../middleware/request-actor";
 import { listAgentMemoryFiles, loadAgentMemoryContext, readAgentMemoryFile } from "../services/memory-file-service";
 
 export function createObservabilityRouter(ctx: AppContext) {
@@ -48,56 +44,6 @@ export function createObservabilityRouter(ctx: AppContext) {
     );
   });
 
-  const modelPricingUpdateSchema = z.object({
-    providerType: z.string().min(1),
-    modelId: z.string().min(1),
-    displayName: z.string().min(1).optional(),
-    inputUsdPer1M: z.number().min(0),
-    outputUsdPer1M: z.number().min(0),
-    currency: z.string().min(1).optional()
-  });
-
-  router.get("/models/pricing", async (req, res) => {
-    const rows = await listModelPricing(ctx.db, req.companyId!);
-    return sendOk(
-      res,
-      rows.map((row) => ({
-        companyId: row.companyId,
-        providerType: row.providerType,
-        modelId: row.modelId,
-        displayName: row.displayName,
-        inputUsdPer1M: typeof row.inputUsdPer1M === "number" ? row.inputUsdPer1M : Number(row.inputUsdPer1M ?? 0),
-        outputUsdPer1M: typeof row.outputUsdPer1M === "number" ? row.outputUsdPer1M : Number(row.outputUsdPer1M ?? 0),
-        currency: row.currency,
-        updatedAt: row.updatedAt?.toISOString?.() ?? null,
-        updatedBy: row.updatedBy ?? null
-      }))
-    );
-  });
-
-  router.put("/models/pricing", async (req, res) => {
-    requirePermission("observability:write")(req, res, () => {});
-    if (res.headersSent) {
-      return;
-    }
-    const parsed = modelPricingUpdateSchema.safeParse(req.body);
-    if (!parsed.success) {
-      return sendError(res, parsed.error.message, 422);
-    }
-    const payload = parsed.data;
-    await upsertModelPricing(ctx.db, {
-      companyId: req.companyId!,
-      providerType: payload.providerType,
-      modelId: payload.modelId,
-      displayName: payload.displayName ?? null,
-      inputUsdPer1M: payload.inputUsdPer1M.toFixed(6),
-      outputUsdPer1M: payload.outputUsdPer1M.toFixed(6),
-      currency: payload.currency ?? "USD",
-      updatedBy: req.actor?.id ?? null
-    });
-    return sendOk(res, { ok: true });
-  });
-
   router.get("/heartbeats", async (req, res) => {
     const companyId = req.companyId!;
     const rawLimit = Number(req.query.limit ?? 100);
@@ -404,85 +350,6 @@ function toRecord(value: unknown) {
   return typeof value === "object" && value !== null ? (value as Record<string, unknown>) : null;
 }
 
-function resolveRunArtifactAbsolutePath(companyId: string, artifact: Record<string, unknown>) {
-  const companyWorkspaceRoot = resolveCompanyWorkspaceRootPath(companyId);
-  const absolutePathRaw = normalizeAbsoluteArtifactPath(
-    typeof artifact.absolutePath === "string" ? artifact.absolutePath.trim() : ""
-  );
-  const relativePathRaw = normalizeWorkspaceRelativeArtifactPath(
-    typeof artifact.relativePath === "string"
-      ? artifact.relativePath.trim()
-      : typeof artifact.path === "string"
-        ? artifact.path.trim()
-        : "",
-    companyId
-  );
-  const candidate = relativePathRaw
-    ? resolve(companyWorkspaceRoot, relativePathRaw)
-    : absolutePathRaw
-      ? absolutePathRaw
-      : "";
-  if (!candidate) {
-    return null;
-  }
-  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(companyWorkspaceRoot, candidate);
-  if (!isInsidePath(companyWorkspaceRoot, resolved)) {
-    return null;
-  }
-  return resolved;
-}
-
-function normalizeAbsoluteArtifactPath(value: string) {
-  const trimmed = value.trim();
-  if (!trimmed || !isAbsolute(trimmed)) {
-    return "";
-  }
-  return resolve(trimmed);
-}
-
-function normalizeWorkspaceRelativeArtifactPath(value: string, companyId: string) {
-  const trimmed = value.trim();
-  if (!trimmed) {
-    return "";
-  }
-  const unixSeparated = trimmed.replace(/\\/g, "/");
-  if (isAbsolute(unixSeparated)) {
-    return "";
-  }
-  const parts: string[] = [];
-  for (const part of unixSeparated.split("/")) {
-    if (!part || part === ".") {
-      continue;
-    }
-    if (part === "..") {
-      if (parts.length > 0 && parts[parts.length - 1] !== "..") {
-        parts.pop();
-      } else {
-        parts.push(part);
-      }
-      continue;
-    }
-    parts.push(part);
-  }
-  const normalized = parts.join("/");
-  if (!normalized) {
-    return "";
-  }
-  const workspaceScopedMatch = normalized.match(/(?:^|\/)workspace\/([^/]+)\/(.+)$/);
-  if (!workspaceScopedMatch) {
-    return normalized;
-  }
-  const scopedCompanyId = workspaceScopedMatch[1];
-  const scopedRelativePath = workspaceScopedMatch[2];
-  if (!scopedCompanyId || !scopedRelativePath) {
-    return "";
-  }
-  if (scopedCompanyId !== companyId) {
-    return "";
-  }
-  return scopedRelativePath;
-}
-
 function serializeRunRow(
   run: {
   id: string;

package/src/scripts/onboard-seed.ts

@@ -30,7 +30,6 @@ import {
 } from "../lib/instance-paths";
 import { buildDefaultCeoBootstrapPrompt } from "../lib/ceo-bootstrap-prompt";
 import { resolveDefaultRuntimeCwdForCompany } from "../lib/workspace-policy";
-import { ensureCompanyModelPricingDefaults } from "../services/model-pricing";
 import { applyTemplateManifest } from "../services/template-apply-service";
 import { ensureCompanyBuiltinTemplateDefaults } from "../services/template-catalog";
 
@@ -211,8 +210,6 @@ export async function ensureOnboardingSeed(input: {
       templateApplied = true;
       appliedTemplateId = template.id;
     }
-    await ensureCompanyModelPricingDefaults(db, companyId);
-
     return {
       companyId,
       companyName: resolvedCompanyName,
@@ -313,6 +310,7 @@ async function ensureCeoStartupTask(
     "Stand up your leadership operating baseline before taking on additional delivery work.",
     "",
     `1. Create your operating folder at \`${ceoOperatingFolder}/\`.`,
+    "   During heartbeats, prefer the absolute path in `$BOPODEV_AGENT_OPERATING_DIR` (set by the runtime) so files land under your agent folder even when the shell cwd is a project workspace.",
     "2. Author these files with your own voice and responsibilities:",
     `   - \`${ceoOperatingFolder}/AGENTS.md\``,
     `   - \`${ceoOperatingFolder}/HEARTBEAT.md\``,