bopodev-api 0.1.34 → 0.1.36

package/src/realtime/office-space.ts

@@ -139,6 +139,7 @@ async function loadOfficeOccupantForAgent(db: BopoDb, companyId: string, agentId
       companyId: agents.companyId,
       name: agents.name,
       avatarSeed: agents.avatarSeed,
+      lucideIconName: agents.lucideIconName,
       role: agents.role,
       status: agents.status,
       providerType: agents.providerType,
@@ -222,6 +223,7 @@ function deriveAgentOccupant(
     companyId: string;
     name: string;
     avatarSeed?: string | null;
+    lucideIconName?: string | null;
     role: string;
     status: string;
     providerType: string;
@@ -300,6 +302,7 @@ function deriveAgentOccupant(
       taskLabel: `${formatActionLabel(pendingApproval.action)} approval`,
       providerType: normalizeProviderType(agent.providerType),
       avatarSeed: agent.avatarSeed ?? null,
+      lucideIconName: agent.lucideIconName?.trim() ? agent.lucideIconName.trim() : null,
       focusEntityType: "approval",
       focusEntityId: pendingApproval.id,
       updatedAt: pendingApproval.createdAt.toISOString()
@@ -320,6 +323,7 @@ function deriveAgentOccupant(
       taskLabel: claimedIssues[0]?.title ?? "Checking in on work",
       providerType: normalizeProviderType(agent.providerType),
       avatarSeed: agent.avatarSeed ?? null,
+      lucideIconName: agent.lucideIconName?.trim() ? agent.lucideIconName.trim() : null,
       focusEntityType: claimedIssues[0] ? "issue" : "agent",
       focusEntityId: claimedIssues[0]?.id ?? agent.id,
       updatedAt: activeRun.startedAt.toISOString()
@@ -340,6 +344,7 @@ function deriveAgentOccupant(
       taskLabel: "Paused",
       providerType: normalizeProviderType(agent.providerType),
       avatarSeed: agent.avatarSeed ?? null,
+      lucideIconName: agent.lucideIconName?.trim() ? agent.lucideIconName.trim() : null,
       focusEntityType: "agent",
       focusEntityId: agent.id,
       updatedAt: agent.updatedAt.toISOString()
@@ -359,6 +364,7 @@ function deriveAgentOccupant(
     taskLabel: nextAssignedIssue ? `Up next: ${nextAssignedIssue.title}` : "Waiting for work",
     providerType: normalizeProviderType(agent.providerType),
     avatarSeed: agent.avatarSeed ?? null,
+    lucideIconName: agent.lucideIconName?.trim() ? agent.lucideIconName.trim() : null,
     focusEntityType: nextAssignedIssue ? "issue" : "agent",
     focusEntityId: nextAssignedIssue?.id ?? agent.id,
     updatedAt: nextAssignedIssue?.updatedAt.toISOString() ?? agent.updatedAt.toISOString()
@@ -396,6 +402,7 @@ function deriveHireCandidateOccupant(approval: {
     taskLabel: "Awaiting hire approval",
     providerType,
     avatarSeed: null,
+    lucideIconName: null,
     focusEntityType: "approval",
     focusEntityId: approval.id,
     updatedAt: approval.createdAt.toISOString()

package/src/routes/agents.ts

@@ -108,6 +108,8 @@ const UPDATE_AGENT_ALLOWED_KEYS = new Set([
   "heartbeatCron",
   "monthlyBudgetUsd",
   "canHireAgents",
+  "canAssignAgents",
+  "canCreateIssues",
   "runtimeConfig",
   "runtimeCommand",
   "runtimeArgs",
@@ -120,7 +122,9 @@ const UPDATE_AGENT_ALLOWED_KEYS = new Set([
   "interruptGraceSec",
   "runtimeEnv",
   "runPolicy",
-  "enabledSkillIds"
+  "enabledSkillIds",
+  "lucideIconName",
+  "avatarSeed"
 ]);
 const UPDATE_RUNTIME_CONFIG_ALLOWED_KEYS = new Set([
   "runtimeCommand",
@@ -485,6 +489,8 @@ export function createAgentsRouter(ctx: AppContext) {
       heartbeatCron: parsed.data.heartbeatCron,
       monthlyBudgetUsd: parsed.data.monthlyBudgetUsd.toFixed(4),
       canHireAgents: parsed.data.canHireAgents,
+      canAssignAgents: parsed.data.canAssignAgents,
+      canCreateIssues: parsed.data.canCreateIssues,
       ...runtimeConfigToDb(runtimeConfig),
       initialState: runtimeConfigToStateBlobPatch(runtimeConfig)
     });
@@ -537,6 +543,12 @@ export function createAgentsRouter(ctx: AppContext) {
       if (parsed.data.canHireAgents !== undefined) {
         forbiddenFieldUpdates.push("canHireAgents");
       }
+      if (parsed.data.canAssignAgents !== undefined) {
+        forbiddenFieldUpdates.push("canAssignAgents");
+      }
+      if (parsed.data.canCreateIssues !== undefined) {
+        forbiddenFieldUpdates.push("canCreateIssues");
+      }
       if (parsed.data.status !== undefined) {
         forbiddenFieldUpdates.push("status");
       }
@@ -616,10 +628,18 @@ export function createAgentsRouter(ctx: AppContext) {
       if (requiresRuntimeCwd(effectiveProviderType) && hasText(effectiveRuntimeCwd)) {
         await mkdir(effectiveRuntimeCwd, { recursive: true });
       }
+      const nextLucideIconName =
+        parsed.data.lucideIconName === undefined ? undefined : parsed.data.lucideIconName.trim();
+
+      const nextAvatarSeed =
+        parsed.data.avatarSeed === undefined ? undefined : parsed.data.avatarSeed.trim();
+
       const agent = await updateAgent(ctx.db, {
         companyId: req.companyId!,
         id: req.params.agentId,
         managerAgentId: parsed.data.managerAgentId,
+        lucideIconName: nextLucideIconName,
+        avatarSeed: nextAvatarSeed,
         role:
           parsed.data.role !== undefined || parsed.data.roleKey !== undefined || parsed.data.title !== undefined
             ? resolveAgentRoleText(
@@ -639,6 +659,8 @@ export function createAgentsRouter(ctx: AppContext) {
         monthlyBudgetUsd:
           typeof parsed.data.monthlyBudgetUsd === "number" ? parsed.data.monthlyBudgetUsd.toFixed(4) : undefined,
         canHireAgents: parsed.data.canHireAgents,
+        canAssignAgents: parsed.data.canAssignAgents,
+        canCreateIssues: parsed.data.canCreateIssues,
         ...runtimeConfigToDb(nextRuntime),
         stateBlob: runtimeConfigToStateBlobPatch(nextRuntime)
       });

package/src/routes/assistant.ts

@@ -2,9 +2,11 @@ import { Router } from "express";
 import { z } from "zod";
 import {
   createAssistantThread,
+  deleteAssistantThread,
   getAssistantThreadById,
   getOrCreateAssistantThread,
-  listAssistantMessages
+  listAssistantMessages,
+  listAssistantThreadsForCompany
 } from "bopodev-db";
 import type { AppContext } from "../context";
 import { sendError, sendOk } from "../http";
@@ -30,6 +32,20 @@ export function createAssistantRouter(ctx: AppContext) {
     return sendOk(res, { brains: listAskAssistantBrains() });
   });
 
+  router.get("/threads", async (req, res) => {
+    const companyId = req.companyId!;
+    const rawLimit = Number(req.query.limit ?? 50);
+    const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.floor(rawLimit), 1), 100) : 50;
+    const rows = await listAssistantThreadsForCompany(ctx.db, companyId, limit);
+    return sendOk(res, {
+      threads: rows.map((t) => ({
+        id: t.id,
+        updatedAt: t.updatedAt.toISOString(),
+        preview: t.previewBody ? truncateAssistantPreview(t.previewBody) : null
+      }))
+    });
+  });
+
   router.get("/messages", async (req, res) => {
     const companyId = req.companyId!;
     const qThread =
@@ -97,6 +113,19 @@ export function createAssistantRouter(ctx: AppContext) {
     return sendOk(res, { threadId: thread.id });
   });
 
+  router.delete("/threads/:threadId", async (req, res) => {
+    const companyId = req.companyId!;
+    const threadId = typeof req.params.threadId === "string" ? req.params.threadId.trim() : "";
+    if (!threadId) {
+      return sendError(res, "threadId is required.", 422);
+    }
+    const ok = await deleteAssistantThread(ctx.db, companyId, threadId);
+    if (!ok) {
+      return sendError(res, "Chat thread not found.", 404);
+    }
+    return sendOk(res, { deleted: true });
+  });
+
   return router;
 }
 
@@ -107,3 +136,13 @@ function safeJsonParse(raw: string): unknown {
     return null;
   }
 }
+
+const ASSISTANT_THREAD_PREVIEW_MAX = 120;
+
+function truncateAssistantPreview(body: string): string {
+  const singleLine = body.replace(/\s+/g, " ").trim();
+  if (singleLine.length <= ASSISTANT_THREAD_PREVIEW_MAX) {
+    return singleLine;
+  }
+  return `${singleLine.slice(0, ASSISTANT_THREAD_PREVIEW_MAX - 1)}…`;
+}

package/src/routes/companies.ts

@@ -3,8 +3,18 @@ import type { NextFunction, Request, Response } from "express";
 import { Router } from "express";
 import multer from "multer";
 import { z } from "zod";
-import { CompanySchema } from "bopodev-contracts";
-import { createAgent, createCompany, deleteCompany, listCompanies, updateCompany } from "bopodev-db";
+import { CompanySchema, TemplateManifestSchema } from "bopodev-contracts";
+import {
+  createAgent,
+  createCompany,
+  deleteCompany,
+  getCurrentTemplateVersion,
+  getTemplateBySlug,
+  listAgents,
+  listCompanies,
+  updateAgent,
+  updateCompany
+} from "bopodev-db";
 import type { AppContext } from "../context";
 import { sendError, sendOk, sendOkValidated } from "../http";
 import { normalizeRuntimeConfig, resolveRuntimeModelForProvider, runtimeConfigToDb, runtimeConfigToStateBlobPatch } from "../lib/agent-config";
@@ -19,10 +29,22 @@ import {
   pipeCompanyExportZip,
   readCompanyExportFileText
 } from "../services/company-file-archive-service";
-import { buildCompanyPortabilityExport } from "../services/company-export-service";
-import { CompanyFileImportError, importCompanyFromZipBuffer } from "../services/company-file-import-service";
-import { ensureCompanyBuiltinPluginDefaults } from "../services/plugin-runtime";
-import { ensureCompanyBuiltinTemplateDefaults } from "../services/template-catalog";
+import {
+  assertManifestHasCeoAgent,
+  CompanyFileImportError,
+  importCompanyFromZipBuffer,
+  parseCompanyZipBuffer,
+  seedOperationalDataFromPackage,
+  summarizeCompanyPackageForPreview
+} from "../services/company-file-import-service";
+import { ensureBuiltinPluginsRegistered } from "../services/plugin-runtime";
+import { listStarterPackMetadata, readStarterPackZipBuffer, resolveStarterPackDefinition } from "../services/starter-pack-registry";
+import { TemplateApplyError, applyTemplateManifest } from "../services/template-apply-service";
+import {
+  ensureCompanyBuiltinTemplateDefaults,
+  getBuiltinStarterTemplateBySlug,
+  type BuiltinStarterTemplateDefinition
+} from "../services/template-catalog";
 
 const zipUpload = multer({
   storage: multer.memoryStorage(),
@@ -43,7 +65,8 @@ const createCompanySchema = z.object({
   providerType: z
     .enum(["codex", "claude_code", "cursor", "gemini_cli", "opencode", "openai_api", "anthropic_api", "http", "shell"])
     .optional(),
-  runtimeModel: z.string().optional()
+  runtimeModel: z.string().optional(),
+  starterPackId: z.string().min(1).optional()
 });
 
 const updateCompanySchema = z
@@ -73,6 +96,36 @@ export function createCompaniesRouter(ctx: AppContext) {
     );
   });
 
+  router.get("/starter-packs", requireBoardRole, async (_req, res) => {
+    return sendOk(res, { starterPacks: listStarterPackMetadata() });
+  });
+
+  router.post("/import/files/preview", requireBoardRole, zipUpload.single("archive"), async (req, res) => {
+    const file = req.file;
+    if (!file?.buffer) {
+      return sendError(res, 'Upload a .zip file in field "archive".', 422);
+    }
+    try {
+      const parsed = parseCompanyZipBuffer(file.buffer);
+      const summary = summarizeCompanyPackageForPreview(parsed);
+      const warnings: string[] = [];
+      if (!summary.hasCeo) {
+        warnings.push("No agent with roleKey 'ceo' found; the company may not be ready to run until you add a CEO.");
+      }
+      return sendOk(res, { ok: true, ...summary, errors: [] as string[], warnings });
+    } catch (err) {
+      const message = err instanceof CompanyFileImportError ? err.message : String(err);
+      return sendOk(res, {
+        ok: false,
+        companyName: "",
+        counts: { projects: 0, agents: 0, goals: 0, routines: 0, skillFiles: 0, knowledgeFiles: 0 },
+        hasCeo: false,
+        errors: [message],
+        warnings: [] as string[]
+      });
+    }
+  });
+
   router.post("/import/files", requireBoardRole, zipUpload.single("archive"), async (req, res) => {
     const file = req.file;
     if (!file?.buffer) {
@@ -173,11 +226,11 @@ export function createCompaniesRouter(ctx: AppContext) {
     if (!canAccessCompany(req, companyId)) {
       return sendError(res, "Actor does not have access to this company.", 403);
     }
-    const payload = await buildCompanyPortabilityExport(ctx.db, companyId);
-    if (!payload) {
-      return sendError(res, "Company not found.", 404);
-    }
-    return sendOk(res, payload);
+    return sendError(
+      res,
+      "JSON company export was removed. Use POST /companies/:companyId/export/files/zip for the portable company zip.",
+      410
+    );
   });
 
   router.post("/", requireBoardRole, async (req, res) => {
@@ -185,14 +238,142 @@ export function createCompaniesRouter(ctx: AppContext) {
     if (!parsed.success) {
       return sendError(res, parsed.error.message, 422);
     }
-    const company = await createCompany(ctx.db, parsed.data);
     const providerType =
       parseAgentProvider(parsed.data.providerType) ??
       parseAgentProvider(process.env[DEFAULT_AGENT_PROVIDER_ENV]) ??
       "shell";
+    const requestedModel = parsed.data.runtimeModel?.trim() || process.env[DEFAULT_AGENT_MODEL_ENV]?.trim() || undefined;
+
+    const companyInput = {
+      name: parsed.data.name,
+      mission: parsed.data.mission ?? null
+    };
+
+    if (parsed.data.starterPackId?.trim()) {
+      const packId = parsed.data.starterPackId.trim();
+      const builtinTemplate = getBuiltinStarterTemplateBySlug(packId);
+      const zipPack = resolveStarterPackDefinition(packId);
+      if (!builtinTemplate && !zipPack) {
+        return sendError(res, `Unknown starter pack: ${packId}`, 422);
+      }
+
+      const company = await createCompany(ctx.db, companyInput);
+      await ensureCompanyBuiltinTemplateDefaults(ctx.db, company.id);
+      await ensureBuiltinPluginsRegistered(ctx.db, [company.id]);
+
+      try {
+        if (builtinTemplate) {
+          const templateRow = await getTemplateBySlug(ctx.db, company.id, packId);
+          if (!templateRow) {
+            return sendError(res, `Starter template '${packId}' was not registered.`, 500);
+          }
+          const templateVersion = await getCurrentTemplateVersion(ctx.db, company.id, templateRow.id);
+          if (!templateVersion) {
+            return sendError(res, `Starter template '${packId}' has no current version.`, 500);
+          }
+          let manifestRaw: unknown;
+          try {
+            manifestRaw = JSON.parse(templateVersion.manifestJson) as unknown;
+          } catch {
+            return sendError(res, `Starter template '${packId}' has invalid manifest JSON.`, 500);
+          }
+          const manifestParsed = TemplateManifestSchema.safeParse(manifestRaw);
+          if (!manifestParsed.success) {
+            return sendError(res, `Starter template '${packId}' has invalid manifest: ${manifestParsed.error.message}`, 422);
+          }
+          const variables = buildStarterTemplateVariables(builtinTemplate, companyInput);
+          await applyTemplateManifest(ctx.db, {
+            companyId: company.id,
+            templateId: templateRow.id,
+            templateVersion: templateVersion.version,
+            templateVersionId: templateVersion.id,
+            manifest: manifestParsed.data,
+            variables
+          });
+        } else {
+          let packBuffer: Buffer;
+          try {
+            packBuffer = await readStarterPackZipBuffer(packId);
+          } catch (err) {
+            return sendError(res, `Failed to read starter pack: ${String(err)}`, 500);
+          }
+          let parsedPackage;
+          try {
+            parsedPackage = parseCompanyZipBuffer(packBuffer);
+            assertManifestHasCeoAgent(parsedPackage.doc);
+          } catch (err) {
+            const message = err instanceof CompanyFileImportError ? err.message : String(err);
+            return sendError(res, message, 422);
+          }
+          await seedOperationalDataFromPackage(ctx.db, company.id, parsedPackage);
+        }
+      } catch (err) {
+        const message =
+          err instanceof TemplateApplyError
+            ? err.message
+            : err instanceof CompanyFileImportError
+              ? err.message
+              : String(err);
+        return sendError(res, message, 422);
+      }
+
+      const agents = await listAgents(ctx.db, company.id);
+      const rk = (a: (typeof agents)[number]) => (a.roleKey ?? "").toLowerCase();
+      const leaderAgent =
+        agents.find((a) => rk(a) === "ceo") ??
+        agents.find((a) => rk(a) === "cmo") ??
+        agents.find((a) => a.canHireAgents) ??
+        agents[0] ??
+        null;
+      if (!leaderAgent) {
+        return sendError(res, "Starter did not yield an agent to attach the selected CEO runtime to.", 422);
+      }
+
+      const defaultRuntimeCwd = await resolveDefaultRuntimeCwdForCompany(ctx.db, company.id);
+      const resolvedRuntimeModel = resolveRuntimeModelForProvider(
+        providerType,
+        await resolveOpencodeRuntimeModel(
+          providerType,
+          normalizeRuntimeConfig({
+            defaultRuntimeCwd,
+            runtimeConfig: {
+              runtimeModel: requestedModel,
+              runtimeEnv: resolveSeedRuntimeEnv(providerType)
+            }
+          })
+        )
+      );
+      const bootstrapPrompt = leaderAgent.bootstrapPrompt?.trim()
+        ? leaderAgent.bootstrapPrompt
+        : buildDefaultCeoBootstrapPrompt();
+      const defaultRuntimeConfig = normalizeRuntimeConfig({
+        defaultRuntimeCwd,
+        runtimeConfig: {
+          runtimeModel: resolvedRuntimeModel,
+          bootstrapPrompt,
+          runtimeEnv: resolveSeedRuntimeEnv(providerType),
+          ...(providerType === "shell"
+            ? {
+                runtimeCommand: "echo",
+                runtimeArgs: ["ceo bootstrap heartbeat"]
+              }
+            : {})
+        }
+      });
+      await updateAgent(ctx.db, {
+        companyId: company.id,
+        id: leaderAgent.id,
+        providerType,
+        ...runtimeConfigToDb(defaultRuntimeConfig),
+        stateBlob: runtimeConfigToStateBlobPatch(defaultRuntimeConfig)
+      });
+
+      return sendOk(res, company);
+    }
+
+    const company = await createCompany(ctx.db, companyInput);
     const defaultRuntimeCwd = await resolveDefaultRuntimeCwdForCompany(ctx.db, company.id);
     await mkdir(defaultRuntimeCwd, { recursive: true });
-    const requestedModel = parsed.data.runtimeModel?.trim() || process.env[DEFAULT_AGENT_MODEL_ENV]?.trim() || undefined;
     const resolvedRuntimeModel = resolveRuntimeModelForProvider(
       providerType,
       await resolveOpencodeRuntimeModel(
@@ -232,10 +413,12 @@ export function createCompaniesRouter(ctx: AppContext) {
       heartbeatCron: "*/5 * * * *",
       monthlyBudgetUsd: "100.0000",
       canHireAgents: true,
+      canAssignAgents: true,
+      canCreateIssues: true,
       ...runtimeConfigToDb(defaultRuntimeConfig),
       initialState: runtimeConfigToStateBlobPatch(defaultRuntimeConfig)
     });
-    await ensureCompanyBuiltinPluginDefaults(ctx.db, company.id);
+    await ensureBuiltinPluginsRegistered(ctx.db, [company.id]);
     await ensureCompanyBuiltinTemplateDefaults(ctx.db, company.id);
     return sendOk(res, company);
   });
@@ -272,6 +455,35 @@ export function createCompaniesRouter(ctx: AppContext) {
   return router;
 }
 
+function buildStarterTemplateVariables(
+  definition: BuiltinStarterTemplateDefinition,
+  input: { name: string; mission: string | null }
+): Record<string, unknown> {
+  const name = input.name.trim();
+  const missionTail = (input.mission ?? "").trim() || name;
+  const defaults: Record<string, string> = {
+    brandName: name,
+    productName: name,
+    targetAudience: missionTail,
+    primaryChannel: "LinkedIn"
+  };
+  const out: Record<string, unknown> = {};
+  for (const v of definition.variables) {
+    const key = v.key;
+    if (defaults[key] !== undefined) {
+      out[key] = defaults[key]!;
+      continue;
+    }
+    const dv = v.defaultValue;
+    if (dv !== undefined && dv !== null && String(dv).length > 0) {
+      out[key] = dv;
+      continue;
+    }
+    out[key] = missionTail;
+  }
+  return out;
+}
+
 function requireCompanyWriteAccess(req: Request, res: Response, next: NextFunction) {
   const targetCompanyId = readCompanyIdParam(req);
   if (!targetCompanyId) {

package/src/routes/issues.ts

@@ -16,6 +16,7 @@ import {
   deleteIssue,
   desc,
   eq,
+  getCompanyAgent,
   getIssue,
   heartbeatRuns,
   getIssueAttachment,
@@ -40,10 +41,16 @@ import {
   type CommentRecipientInput,
   type PersistedCommentRecipient
 } from "../lib/comment-recipients";
+import {
+  agentIssueCreateAssigneeForbiddenMessage,
+  agentIssueCreateForbiddenMessage,
+  agentIssuePutAssigneeChangeForbiddenMessage
+} from "../lib/agent-issue-permissions";
 import { isInsidePath, normalizeCompanyWorkspacePath, resolveProjectWorkspacePath } from "../lib/instance-paths";
 import { requireCompanyScope } from "../middleware/company-scope";
 import { enforcePermission } from "../middleware/request-actor";
 import { triggerIssueCommentDispatchWorker } from "../services/comment-recipient-dispatch-service";
+import { knowledgeFileExists } from "../services/company-knowledge-file-service";
 import { publishAttentionSnapshot } from "../realtime/attention";
 import {
   createIssueCommentLegacySchema,
@@ -102,10 +109,26 @@ function normalizeOptionalExternalLink(value: string | null | undefined) {
   return trimmed.length > 0 ? trimmed : null;
 }
 
+async function validateIssueKnowledgePaths(companyId: string, paths: string[]): Promise<string | null> {
+  for (const p of paths) {
+    if (!(await knowledgeFileExists({ companyId, relativePath: p }))) {
+      return `Knowledge file not found: ${p}`;
+    }
+  }
+  return null;
+}
+
 function toIssueResponse(issue: Record<string, unknown>, goalIds: string[] = []) {
   const labels = parseStringArray(issue.labelsJson);
   const tags = parseStringArray(issue.tagsJson);
-  const { labelsJson: _labelsJson, tagsJson: _tagsJson, goalId: _legacyGoalId, ...rest } = issue as Record<string, unknown> & {
+  const knowledgePaths = parseStringArray(issue.knowledgePathsJson);
+  const {
+    labelsJson: _labelsJson,
+    tagsJson: _tagsJson,
+    knowledgePathsJson: _knowledgePathsJson,
+    goalId: _legacyGoalId,
+    ...rest
+  } = issue as Record<string, unknown> & {
     goalId?: unknown;
   };
   const externalRaw = rest.externalLink;
@@ -116,7 +139,8 @@ function toIssueResponse(issue: Record<string, unknown>, goalIds: string[] = [])
     externalLink,
     labels,
     tags,
-    goalIds
+    goalIds,
+    knowledgePaths
   };
 }
 
@@ -170,6 +194,28 @@ export function createIssuesRouter(ctx: AppContext) {
     if (!parsed.success) {
       return sendError(res, parsed.error.message, 422);
     }
+    if (req.actor?.type === "agent") {
+      const agentRow = await getCompanyAgent(ctx.db, req.companyId!, req.actor.id);
+      if (!agentRow) {
+        return sendError(res, "Agent not found.", 403);
+      }
+      const orchestration = {
+        canAssignAgents: agentRow.canAssignAgents ?? true,
+        canCreateIssues: agentRow.canCreateIssues ?? true
+      };
+      const createDeny = agentIssueCreateForbiddenMessage(orchestration);
+      if (createDeny) {
+        return sendError(res, createDeny, 403);
+      }
+      const assignDeny = agentIssueCreateAssigneeForbiddenMessage(
+        orchestration,
+        req.actor.id,
+        parsed.data.assigneeAgentId ?? null
+      );
+      if (assignDeny) {
+        return sendError(res, assignDeny, 403);
+      }
+    }
     if (parsed.data.assigneeAgentId) {
       const assignmentValidation = await validateIssueAssignmentScope(
         ctx,
@@ -181,6 +227,12 @@ export function createIssuesRouter(ctx: AppContext) {
         return sendError(res, assignmentValidation, 422);
       }
     }
+    if (parsed.data.knowledgePaths.length > 0) {
+      const kpErr = await validateIssueKnowledgePaths(req.companyId!, parsed.data.knowledgePaths);
+      if (kpErr) {
+        return sendError(res, kpErr, 422);
+      }
+    }
     const issue = await createIssue(ctx.db, {
       companyId: req.companyId!,
       projectId: parsed.data.projectId,
@@ -193,7 +245,8 @@ export function createIssuesRouter(ctx: AppContext) {
       priority: parsed.data.priority,
       assigneeAgentId: parsed.data.assigneeAgentId,
       labels: parsed.data.labels,
-      tags: parsed.data.tags
+      tags: parsed.data.tags,
+      knowledgePaths: parsed.data.knowledgePaths
     });
     await appendActivity(ctx.db, {
       companyId: req.companyId!,
@@ -538,6 +591,26 @@ export function createIssuesRouter(ctx: AppContext) {
       if (!existingIssue) {
         return sendError(res, "Issue not found.", 404);
       }
+      if (req.actor?.type === "agent" && parsed.data.assigneeAgentId !== undefined) {
+        const agentRow = await getCompanyAgent(ctx.db, req.companyId!, req.actor.id);
+        if (!agentRow) {
+          return sendError(res, "Agent not found.", 403);
+        }
+        const orchestration = {
+          canAssignAgents: agentRow.canAssignAgents ?? true,
+          canCreateIssues: agentRow.canCreateIssues ?? true
+        };
+        const prevAssignee = existingIssue.assigneeAgentId;
+        const putDeny = agentIssuePutAssigneeChangeForbiddenMessage(
+          orchestration,
+          req.actor.id,
+          prevAssignee,
+          parsed.data.assigneeAgentId!
+        );
+        if (putDeny) {
+          return sendError(res, putDeny, 403);
+        }
+      }
       const effectiveProjectId = parsed.data.projectId ?? existingIssue.projectId;
       const effectiveAssigneeAgentId =
         parsed.data.assigneeAgentId === undefined ? existingIssue.assigneeAgentId : parsed.data.assigneeAgentId;
@@ -558,6 +631,12 @@ export function createIssuesRouter(ctx: AppContext) {
     if (updateBody.externalLink !== undefined) {
       updateBody.externalLink = normalizeOptionalExternalLink(updateBody.externalLink) ?? null;
     }
+    if (updateBody.knowledgePaths !== undefined && updateBody.knowledgePaths.length > 0) {
+      const kpErr = await validateIssueKnowledgePaths(req.companyId!, updateBody.knowledgePaths);
+      if (kpErr) {
+        return sendError(res, kpErr, 422);
+      }
+    }
     const issue = await updateIssue(ctx.db, { companyId: req.companyId!, id: req.params.issueId, ...updateBody });
     if (!issue) {
       return sendError(res, "Issue not found.", 404);