bopodev-api 0.1.34 → 0.1.36

package/src/services/company-knowledge-file-service.ts

@@ -0,0 +1,361 @@
+import { mkdir, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve } from "node:path";
+import { isInsidePath, resolveCompanyKnowledgePath, resolveCompanyProjectsWorkspacePath } from "../lib/instance-paths";
+
+const MAX_OBSERVABILITY_FILES = 200;
+const MAX_OBSERVABILITY_FILE_BYTES = 512 * 1024;
+const MAX_PATH_SEGMENTS = 32;
+const TEXT_EXT = new Set([".md", ".yaml", ".yml", ".txt", ".json"]);
+
+/** Default file body when POST create omits `content`. Markdown/text start empty (no frontmatter boilerplate). */
+function defaultContentForNewKnowledgeFile(relativePath: string): string {
+  const lower = relativePath.toLowerCase();
+  if (lower.endsWith(".json")) {
+    return "{}\n";
+  }
+  return "";
+}
+
+export function assertKnowledgeRelativePath(relativePath: string): string {
+  const normalized = relativePath.trim().replace(/\\/g, "/");
+  if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
+    throw new Error("Invalid relative path.");
+  }
+  const parts = normalized.split("/").filter(Boolean);
+  if (parts.length === 0 || parts.length > MAX_PATH_SEGMENTS) {
+    throw new Error("Invalid relative path.");
+  }
+  for (const p of parts) {
+    if (p === "." || p === ".." || p.startsWith(".")) {
+      throw new Error("Invalid relative path.");
+    }
+  }
+  const base = parts[parts.length - 1]!;
+  const lower = base.toLowerCase();
+  const ext = lower.includes(".") ? lower.slice(lower.lastIndexOf(".")) : "";
+  if (!TEXT_EXT.has(ext)) {
+    throw new Error("Only text knowledge files (.md, .yaml, .yml, .txt, .json) are allowed.");
+  }
+  return normalized;
+}
+
+async function knowledgeRoot(companyId: string) {
+  const root = resolveCompanyKnowledgePath(companyId);
+  const companyWorkspace = resolveCompanyProjectsWorkspacePath(companyId);
+  if (!isInsidePath(companyWorkspace, root)) {
+    throw new Error("Invalid knowledge root.");
+  }
+  return { root };
+}
+
+export async function listKnowledgeFiles(input: { companyId: string; maxFiles?: number }) {
+  const { root } = await knowledgeRoot(input.companyId);
+  await mkdir(root, { recursive: true });
+  const maxFiles = Math.max(1, Math.min(MAX_OBSERVABILITY_FILES, input.maxFiles ?? MAX_OBSERVABILITY_FILES));
+  const relativePaths = await walkKnowledgeTextFiles(root, maxFiles);
+  return { root, files: relativePaths.map((relativePath) => ({ relativePath })) };
+}
+
+export type KnowledgeTreeNode =
+  | { type: "file"; name: string; relativePath: string }
+  | { type: "dir"; name: string; children: KnowledgeTreeNode[] };
+
+/** Nested tree from flat relative paths (trie). */
+export function buildKnowledgeTreeFromPaths(files: { relativePath: string }[]): KnowledgeTreeNode[] {
+  type Trie = { dirs: Map<string, Trie>; files: KnowledgeTreeNode[] };
+  const root: Trie = { dirs: new Map(), files: [] };
+
+  for (const { relativePath } of [...files].sort((a, b) => a.relativePath.localeCompare(b.relativePath))) {
+    const parts = relativePath.split("/").filter(Boolean);
+    if (parts.length === 0) {
+      continue;
+    }
+    const fileName = parts.pop()!;
+    let node = root;
+    for (const segment of parts) {
+      if (!node.dirs.has(segment)) {
+        node.dirs.set(segment, { dirs: new Map(), files: [] });
+      }
+      node = node.dirs.get(segment)!;
+    }
+    node.files.push({ type: "file", name: fileName, relativePath });
+  }
+
+  function trieToNodes(trie: Trie): KnowledgeTreeNode[] {
+    const dirNodes: KnowledgeTreeNode[] = [];
+    for (const [name, child] of [...trie.dirs.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+      const children = trieToNodes(child);
+      dirNodes.push({ type: "dir", name, children });
+    }
+    const sortedFiles = [...trie.files].sort((a, b) => a.name.localeCompare(b.name));
+    return [...dirNodes, ...sortedFiles];
+  }
+
+  return trieToNodes(root);
+}
+
+async function walkKnowledgeTextFiles(knowledgeDir: string, maxFiles: number): Promise<string[]> {
+  const collected: string[] = [];
+  const queue = [knowledgeDir];
+  while (queue.length > 0 && collected.length < maxFiles) {
+    const current = queue.shift();
+    if (!current) {
+      continue;
+    }
+    let entries: import("node:fs").Dirent[];
+    try {
+      entries = await readdir(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (collected.length >= maxFiles) {
+        break;
+      }
+      const absolutePath = join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!entry.name.startsWith(".")) {
+          queue.push(absolutePath);
+        }
+        continue;
+      }
+      if (entry.name.startsWith(".")) {
+        continue;
+      }
+      const lower = entry.name.toLowerCase();
+      const ext = lower.includes(".") ? lower.slice(lower.lastIndexOf(".")) : "";
+      if (TEXT_EXT.has(ext)) {
+        collected.push(relative(knowledgeDir, absolutePath).replace(/\\/g, "/"));
+      }
+    }
+  }
+  return collected.sort((a, b) => a.localeCompare(b));
+}
+
+export async function readKnowledgeFile(input: { companyId: string; relativePath: string }) {
+  const { root } = await knowledgeRoot(input.companyId);
+  const rel = assertKnowledgeRelativePath(input.relativePath);
+  const candidate = resolve(root, rel);
+  if (!isInsidePath(root, candidate)) {
+    throw new Error("Requested path is outside of knowledge directory.");
+  }
+  const info = await stat(candidate);
+  if (!info.isFile()) {
+    throw new Error("Requested path is not a file.");
+  }
+  if (info.size > MAX_OBSERVABILITY_FILE_BYTES) {
+    throw new Error("File exceeds size limit.");
+  }
+  const content = await readFile(candidate, "utf8");
+  return {
+    relativePath: rel,
+    content,
+    sizeBytes: info.size
+  };
+}
+
+export async function writeKnowledgeFile(input: {
+  companyId: string;
+  relativePath: string;
+  content: string;
+}) {
+  const { root } = await knowledgeRoot(input.companyId);
+  const rel = assertKnowledgeRelativePath(input.relativePath);
+  const candidate = resolve(root, rel);
+  if (!isInsidePath(root, candidate)) {
+    throw new Error("Requested path is outside of knowledge directory.");
+  }
+  const bytes = Buffer.byteLength(input.content, "utf8");
+  if (bytes > MAX_OBSERVABILITY_FILE_BYTES) {
+    throw new Error("Content exceeds size limit.");
+  }
+  const parent = dirname(candidate);
+  if (!isInsidePath(root, parent)) {
+    throw new Error("Invalid parent directory.");
+  }
+  await mkdir(parent, { recursive: true });
+  await writeFile(candidate, input.content, { encoding: "utf8" });
+  const info = await stat(candidate);
+  return {
+    relativePath: rel,
+    sizeBytes: info.size
+  };
+}
+
+/** Create a new file; fails if it already exists. */
+export async function createKnowledgeFile(input: {
+  companyId: string;
+  relativePath: string;
+  content?: string;
+}) {
+  const { root } = await knowledgeRoot(input.companyId);
+  const rel = assertKnowledgeRelativePath(input.relativePath);
+  const candidate = resolve(root, rel);
+  if (!isInsidePath(root, candidate)) {
+    throw new Error("Requested path is outside of knowledge directory.");
+  }
+  try {
+    await stat(candidate);
+    throw new Error("A file already exists at this path.");
+  } catch (error) {
+    if (error instanceof Error && error.message === "A file already exists at this path.") {
+      throw error;
+    }
+    const code = error && typeof error === "object" && "code" in error ? (error as NodeJS.ErrnoException).code : undefined;
+    if (code !== "ENOENT") {
+      throw error;
+    }
+  }
+  const body = input.content ?? defaultContentForNewKnowledgeFile(rel);
+  const bytes = Buffer.byteLength(body, "utf8");
+  if (bytes > MAX_OBSERVABILITY_FILE_BYTES) {
+    throw new Error("Content exceeds size limit.");
+  }
+  const parent = dirname(candidate);
+  if (!isInsidePath(root, parent)) {
+    throw new Error("Invalid parent directory.");
+  }
+  await mkdir(parent, { recursive: true });
+  await writeFile(candidate, body, { encoding: "utf8" });
+  const info = await stat(candidate);
+  return {
+    relativePath: rel,
+    sizeBytes: info.size
+  };
+}
+
+/** Rename/move a knowledge file within the knowledge root. */
+export async function renameKnowledgeFile(input: {
+  companyId: string;
+  fromRelativePath: string;
+  toRelativePath: string;
+}) {
+  const fromRel = assertKnowledgeRelativePath(input.fromRelativePath.trim());
+  const toRel = assertKnowledgeRelativePath(input.toRelativePath.trim());
+  if (fromRel === toRel) {
+    return { relativePath: toRel };
+  }
+  const { root } = await knowledgeRoot(input.companyId);
+  const fromAbs = resolve(root, fromRel);
+  const toAbs = resolve(root, toRel);
+  if (!isInsidePath(root, fromAbs) || !isInsidePath(root, toAbs)) {
+    throw new Error("Requested path is outside of knowledge directory.");
+  }
+  const fromInfo = await stat(fromAbs);
+  if (!fromInfo.isFile()) {
+    throw new Error("Source path is not a file.");
+  }
+  try {
+    await stat(toAbs);
+    throw new Error("A file already exists at the destination path.");
+  } catch (error) {
+    if (error instanceof Error && error.message === "A file already exists at the destination path.") {
+      throw error;
+    }
+    const code = error && typeof error === "object" && "code" in error ? (error as NodeJS.ErrnoException).code : undefined;
+    if (code !== "ENOENT") {
+      throw error;
+    }
+  }
+  const parent = dirname(toAbs);
+  if (!isInsidePath(root, parent)) {
+    throw new Error("Invalid parent directory.");
+  }
+  await mkdir(parent, { recursive: true });
+  await rename(fromAbs, toAbs);
+  return { relativePath: toRel };
+}
+
+/** Folder path prefix (no trailing slash), e.g. `guides/onboarding`. */
+export function assertKnowledgeFolderPrefix(prefix: string): string {
+  const normalized = prefix.trim().replace(/\\/g, "/").replace(/\/+$/g, "");
+  if (!normalized) {
+    throw new Error("Invalid folder path.");
+  }
+  if (normalized.startsWith("/") || normalized.includes("..")) {
+    throw new Error("Invalid folder path.");
+  }
+  const parts = normalized.split("/").filter(Boolean);
+  if (parts.length === 0 || parts.length > MAX_PATH_SEGMENTS - 1) {
+    throw new Error("Invalid folder path.");
+  }
+  for (const p of parts) {
+    if (p === "." || p === ".." || p.startsWith(".")) {
+      throw new Error("Invalid folder path.");
+    }
+  }
+  return parts.join("/");
+}
+
+/**
+ * Rename a knowledge folder by moving every file under `fromPrefix/` to the same relative paths under `toPrefix`.
+ */
+export async function renameKnowledgeFolderPrefix(input: {
+  companyId: string;
+  fromPrefix: string;
+  toPrefix: string;
+}) {
+  const fromP = assertKnowledgeFolderPrefix(input.fromPrefix);
+  const toP = assertKnowledgeFolderPrefix(input.toPrefix);
+  if (fromP === toP) {
+    return { moved: 0, fromPrefix: fromP, toPrefix: toP };
+  }
+  if (toP.startsWith(`${fromP}/`) || fromP.startsWith(`${toP}/`)) {
+    throw new Error("Invalid folder rename: one folder sits inside the other.");
+  }
+  const { files } = await listKnowledgeFiles({ companyId: input.companyId, maxFiles: MAX_OBSERVABILITY_FILES });
+  const paths = files.map((f) => f.relativePath);
+  const filePathsToMove = paths.filter((p) => p.startsWith(`${fromP}/`));
+  if (filePathsToMove.length === 0) {
+    throw new Error("No files found under that folder.");
+  }
+  const existing = new Set(paths);
+  for (const p of filePathsToMove) {
+    const np = `${toP}${p.slice(fromP.length)}`;
+    if (existing.has(np) && !filePathsToMove.includes(np)) {
+      throw new Error(`A file already exists at ${np}.`);
+    }
+  }
+  const sorted = [...filePathsToMove].sort((a, b) => b.length - a.length);
+  for (const p of sorted) {
+    const np = `${toP}${p.slice(fromP.length)}`;
+    await renameKnowledgeFile({
+      companyId: input.companyId,
+      fromRelativePath: p,
+      toRelativePath: np
+    });
+    existing.delete(p);
+    existing.add(np);
+  }
+  return { moved: sorted.length, fromPrefix: fromP, toPrefix: toP };
+}
+
+export async function deleteKnowledgeFile(input: { companyId: string; relativePath: string }) {
+  const { root } = await knowledgeRoot(input.companyId);
+  const rel = assertKnowledgeRelativePath(input.relativePath);
+  const candidate = resolve(root, rel);
+  if (!isInsidePath(root, candidate)) {
+    throw new Error("Requested path is outside of knowledge directory.");
+  }
+  const info = await stat(candidate);
+  if (!info.isFile()) {
+    throw new Error("Requested path is not a file.");
+  }
+  await rm(candidate, { force: true });
+  return { relativePath: rel };
+}
+
+export async function knowledgeFileExists(input: { companyId: string; relativePath: string }): Promise<boolean> {
+  try {
+    const rel = assertKnowledgeRelativePath(input.relativePath);
+    const { root } = await knowledgeRoot(input.companyId);
+    const candidate = resolve(root, rel);
+    if (!isInsidePath(root, candidate)) {
+      return false;
+    }
+    const info = await stat(candidate);
+    return info.isFile();
+  } catch {
+    return false;
+  }
+}

package/src/services/company-skill-file-service.ts

@@ -1,4 +1,4 @@
-import { mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import TurndownService from "turndown";
@@ -8,6 +8,9 @@ const MAX_OBSERVABILITY_FILES = 200;
 const MAX_OBSERVABILITY_FILE_BYTES = 512 * 1024;
 const SKILL_MD = "SKILL.md";
 export const SKILL_LINK_BASENAME = ".bopo-skill-link.json";
+/** Optional UI-only label for the skill in Settings (does not rename files or the skill id). */
+export const SKILL_SIDEBAR_TITLE_BASENAME = ".bopo-skill-sidebar-title.json";
+const MAX_SKILL_SIDEBAR_TITLE_CHARS = 200;
 const SKILL_ID_RE = /^[a-zA-Z0-9_-]+$/;
 const TEXT_EXT = new Set([".md", ".yaml", ".yml", ".txt", ".json"]);
 
@@ -27,6 +30,8 @@ export type CompanySkillPackageListItem = {
   skillId: string;
   linkedUrl: string | null;
   linkLastFetchedAt: string | null;
+  /** When set, shown in Settings sidebar instead of `skillId`. */
+  sidebarTitle: string | null;
 };
 
 export function assertCompanySkillId(skillId: string): string {
@@ -101,6 +106,24 @@ export async function readOptionalSkillLinkUrl(root: string): Promise<string | n
   return rec?.url ?? null;
 }
 
+export async function readOptionalSkillSidebarTitle(root: string): Promise<string | null> {
+  try {
+    const raw = await readFile(join(root, SKILL_SIDEBAR_TITLE_BASENAME), "utf8");
+    const parsed: unknown = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") {
+      return null;
+    }
+    const t = (parsed as { sidebarTitle?: unknown }).sidebarTitle;
+    if (typeof t !== "string") {
+      return null;
+    }
+    const s = t.trim();
+    return s.length > 0 ? s : null;
+  } catch {
+    return null;
+  }
+}
+
 async function writeSkillLinkMetadata(root: string, url: string): Promise<{ lastFetchedAt: string }> {
   const lastFetchedAt = new Date().toISOString();
   await writeFile(
@@ -131,10 +154,12 @@ export async function listCompanySkillPackages(input: { companyId: string; maxSk
     if (!hasMd && !linkedUrl) {
       continue;
     }
+    const sidebarTitle = await readOptionalSkillSidebarTitle(skillDir);
     items.push({
       skillId: ent.name,
       linkedUrl,
-      linkLastFetchedAt: linkRec?.lastFetchedAt ?? null
+      linkLastFetchedAt: linkRec?.lastFetchedAt ?? null,
+      sidebarTitle
     });
     if (items.length >= maxSkills) {
       break;
@@ -227,6 +252,47 @@ export async function readCompanySkillFile(input: {
   };
 }
 
+function assertSkillSidebarTitle(trimmed: string): string {
+  if (!trimmed) {
+    throw new Error("Title is empty.");
+  }
+  if (trimmed.length > MAX_SKILL_SIDEBAR_TITLE_CHARS) {
+    throw new Error(`Title must be at most ${MAX_SKILL_SIDEBAR_TITLE_CHARS} characters.`);
+  }
+  if (/[\r\n]/.test(trimmed)) {
+    throw new Error("Title cannot contain line breaks.");
+  }
+  return trimmed;
+}
+
+/** Set or clear the Settings-only sidebar label for a company skill package. */
+export async function setCompanySkillSidebarTitle(input: {
+  companyId: string;
+  skillId: string;
+  /** Empty / whitespace removes the custom title (sidebar falls back to skill id). */
+  title: string;
+}) {
+  const { root, id } = await skillRoot(input.companyId, input.skillId);
+  const hasMd = await skillDirHasSkillMd(root);
+  const linkedUrl = await readOptionalSkillLinkUrl(root);
+  if (!hasMd && !linkedUrl) {
+    throw new Error("Skill not found.");
+  }
+  const metaPath = join(root, SKILL_SIDEBAR_TITLE_BASENAME);
+  const trimmedAll = input.title.trim();
+  if (!trimmedAll || trimmedAll === id) {
+    try {
+      await rm(metaPath, { force: true });
+    } catch {
+      /* noop */
+    }
+    return { skillId: id, sidebarTitle: null as string | null };
+  }
+  const t = assertSkillSidebarTitle(trimmedAll);
+  await writeFile(metaPath, JSON.stringify({ sidebarTitle: t }, null, 2), "utf8");
+  return { skillId: id, sidebarTitle: t };
+}
+
 export async function writeCompanySkillFile(input: {
   companyId: string;
   skillId: string;
@@ -263,6 +329,89 @@ export async function writeCompanySkillFile(input: {
   };
 }
 
+/** Rename/move a text file within one skill package directory. */
+export async function renameCompanySkillFile(input: {
+  companyId: string;
+  skillId: string;
+  fromRelativePath: string;
+  toRelativePath: string;
+}) {
+  const { root } = await skillRoot(input.companyId, input.skillId);
+  const fromRel = assertSkillRelativePath(input.fromRelativePath.trim());
+  const toRel = assertSkillRelativePath(input.toRelativePath.trim());
+  if (fromRel === toRel) {
+    return { skillId: input.skillId, relativePath: toRel };
+  }
+  const fromAbs = resolve(root, fromRel);
+  const toAbs = resolve(root, toRel);
+  if (!isInsidePath(root, fromAbs) || !isInsidePath(root, toAbs)) {
+    throw new Error("Requested path is outside of skill directory.");
+  }
+  const hasMd = await skillDirHasSkillMd(root);
+  const linkedUrl = await readOptionalSkillLinkUrl(root);
+  if (linkedUrl && !hasMd && fromRel === SKILL_MD) {
+    throw new Error("This skill is loaded from a URL only; save a local copy before renaming.");
+  }
+  const fromInfo = await stat(fromAbs);
+  if (!fromInfo.isFile()) {
+    throw new Error("Source path is not a file.");
+  }
+  try {
+    await stat(toAbs);
+    throw new Error("A file already exists at the destination path.");
+  } catch (error) {
+    if (error instanceof Error && error.message === "A file already exists at the destination path.") {
+      throw error;
+    }
+    const code = error && typeof error === "object" && "code" in error ? (error as NodeJS.ErrnoException).code : undefined;
+    if (code !== "ENOENT") {
+      throw error;
+    }
+  }
+  const parent = dirname(toAbs);
+  if (!isInsidePath(root, parent)) {
+    throw new Error("Invalid parent directory.");
+  }
+  await mkdir(parent, { recursive: true });
+  await rename(fromAbs, toAbs);
+  return { skillId: input.skillId, relativePath: toRel };
+}
+
+/** Delete one text file from a skill package. Removing sole local SKILL.md with no URL link deletes the package folder. */
+export async function deleteCompanySkillFile(input: {
+  companyId: string;
+  skillId: string;
+  relativePath: string;
+}) {
+  const { root } = await skillRoot(input.companyId, input.skillId);
+  const rel = assertSkillRelativePath(input.relativePath.trim());
+  const candidate = resolve(root, rel);
+  if (!isInsidePath(root, candidate)) {
+    throw new Error("Requested path is outside of skill directory.");
+  }
+  const hasMd = await skillDirHasSkillMd(root);
+  const linkedUrl = await readOptionalSkillLinkUrl(root);
+  if (rel === SKILL_MD && linkedUrl && !hasMd) {
+    throw new Error("This skill is loaded from a URL only; delete the whole skill or refresh from URL.");
+  }
+  const allFiles = await walkSkillTextFiles(root, MAX_OBSERVABILITY_FILES);
+  if (rel === SKILL_MD && allFiles.length > 1) {
+    throw new Error("Remove other files in this skill before deleting SKILL.md.");
+  }
+  const info = await stat(candidate);
+  if (!info.isFile()) {
+    throw new Error("Requested path is not a file.");
+  }
+  await rm(candidate, { force: true });
+  if (rel === SKILL_MD && allFiles.length === 1) {
+    const stillLinked = await readOptionalSkillLinkUrl(root);
+    if (!stillLinked) {
+      await rm(root, { recursive: true, force: true });
+    }
+  }
+  return { skillId: input.skillId, relativePath: rel };
+}
+
 /** Remove `skills/<id>/` entirely (local files and linked-skill pointer). */
 export async function deleteCompanySkillPackage(input: { companyId: string; skillId: string }) {
   const { root, id } = await skillRoot(input.companyId, input.skillId);

package/src/services/governance-service.ts

@@ -4,6 +4,8 @@ import {
   AGENT_ROLE_LABELS,
   AgentCreateRequestSchema,
   AgentRoleKeySchema,
+  PluginInstallSourceTypeSchema,
+  PluginManifestV2Schema,
   TemplateManifestDefault,
   TemplateManifestSchema
 } from "bopodev-contracts";
@@ -13,6 +15,7 @@ import {
   approvalRequests,
   agents,
   appendAuditEvent,
+  appendPluginInstall,
   createAgent,
   createGoal,
   createIssue,
@@ -28,6 +31,7 @@ import {
   projects,
   eq,
   updateProjectWorkspace,
+  markPluginInstallsSuperseded,
   updatePluginConfig
 } from "bopodev-db";
 import {
@@ -44,6 +48,8 @@ import {
 } from "../lib/instance-paths";
 import { assertRuntimeCwdForCompany, hasText, resolveDefaultRuntimeCwdForCompany } from "../lib/workspace-policy";
 import { appendDurableFact } from "./memory-file-service";
+import { writePackagedPluginManifestToFilesystem } from "./plugin-manifest-loader";
+import { registerPluginManifest } from "./plugin-runtime";
 import { applyTemplateManifest } from "./template-apply-service";
 
 const approvalGatedActions = new Set([
@@ -97,7 +103,14 @@ const grantPluginCapabilitiesPayloadSchema = z.object({
   enabled: z.boolean().optional(),
   priority: z.number().int().min(0).max(1000).optional(),
   grantedCapabilities: z.array(z.string().min(1)).default([]),
-  config: z.record(z.string(), z.unknown()).default({})
+  capabilityNamespaces: z.array(z.string().min(1)).default([]),
+  config: z.record(z.string(), z.unknown()).default({}),
+  sourceType: PluginInstallSourceTypeSchema.optional(),
+  sourceRef: z.string().optional(),
+  integrity: z.string().optional(),
+  buildHash: z.string().optional(),
+  manifestJson: z.string().optional(),
+  install: z.boolean().default(true)
 });
 const applyTemplatePayloadSchema = z.object({
   templateId: z.string().min(1),
@@ -311,6 +324,8 @@ async function applyApprovalAction(db: BopoDb, companyId: string, action: string
       heartbeatCron: parsed.data.heartbeatCron,
       monthlyBudgetUsd: parsed.data.monthlyBudgetUsd.toFixed(4),
       canHireAgents: parsed.data.canHireAgents,
+      canAssignAgents: parsed.data.canAssignAgents,
+      canCreateIssues: parsed.data.canCreateIssues,
       ...runtimeConfigToDb(runtimeConfig),
       initialState: runtimeConfigToStateBlobPatch(runtimeConfig)
     });
@@ -556,13 +571,52 @@ async function applyApprovalAction(db: BopoDb, companyId: string, action: string
     if (!parsed.success) {
       throw new GovernanceError("Approval payload for plugin capability grant is invalid.");
     }
+    if (parsed.data.manifestJson) {
+      let rawManifest: unknown;
+      try {
+        rawManifest = JSON.parse(parsed.data.manifestJson);
+      } catch {
+        throw new GovernanceError("Plugin install manifest JSON is invalid.");
+      }
+      const manifestParsed = PluginManifestV2Schema.safeParse(rawManifest);
+      if (!manifestParsed.success) {
+        throw new GovernanceError("Plugin install manifest payload failed validation.");
+      }
+      await writePackagedPluginManifestToFilesystem(manifestParsed.data, {
+        sourceType: parsed.data.sourceType ?? "registry",
+        sourceRef: parsed.data.sourceRef,
+        integrity: parsed.data.integrity,
+        buildHash: parsed.data.buildHash
+      });
+      await registerPluginManifest(db, manifestParsed.data);
+      await markPluginInstallsSuperseded(db, {
+        companyId,
+        pluginId: parsed.data.pluginId
+      });
+      await appendPluginInstall(db, {
+        companyId,
+        pluginId: parsed.data.pluginId,
+        pluginVersion: manifestParsed.data.version,
+        sourceType: parsed.data.sourceType ?? "registry",
+        sourceRef: parsed.data.sourceRef ?? null,
+        integrity: parsed.data.integrity ?? null,
+        buildHash: parsed.data.buildHash ?? null,
+        artifactPath: manifestParsed.data.install?.artifactPath ?? null,
+        manifestJson: JSON.stringify(manifestParsed.data),
+        status: "active"
+      });
+    }
+    const configWithNamespaces = {
+      ...parsed.data.config,
+      _grantedCapabilityNamespaces: parsed.data.capabilityNamespaces
+    };
     await updatePluginConfig(db, {
       companyId,
       pluginId: parsed.data.pluginId,
       enabled: parsed.data.enabled,
       priority: parsed.data.priority,
       grantedCapabilitiesJson: JSON.stringify(parsed.data.grantedCapabilities),
-      configJson: JSON.stringify(parsed.data.config)
+      configJson: JSON.stringify(configWithNamespaces)
     });
     return {
       applied: true,
@@ -572,7 +626,8 @@ async function applyApprovalAction(db: BopoDb, companyId: string, action: string
         pluginId: parsed.data.pluginId,
         enabled: parsed.data.enabled ?? null,
         priority: parsed.data.priority ?? null,
-        grantedCapabilities: parsed.data.grantedCapabilities
+        grantedCapabilities: parsed.data.grantedCapabilities,
+        capabilityNamespaces: parsed.data.capabilityNamespaces
       }
     };
   }