11901ae5d8
Add AES-256-GCM local encrypted secrets provider with auto-generated master key, stub providers for AWS/GCP/Vault, and a secrets service that normalizes adapter configs (converting sensitive inline values to secret refs in strict mode) and resolves secret refs back to plain values at runtime. Extract redaction utilities from agent routes into shared module. Redact sensitive values in activity logs, config revisions, and approval payloads. Block rollback of revisions containing redacted secrets. Filter hidden issues from list queries. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1025 lines
32 KiB
TypeScript
1025 lines
32 KiB
TypeScript
import { Router, type Request } from "express";
|
|
import type { Db } from "@paperclip/db";
|
|
import { agents as agentsTable, companies, heartbeatRuns } from "@paperclip/db";
|
|
import { and, desc, eq, inArray, sql } from "drizzle-orm";
|
|
import {
|
|
createAgentKeySchema,
|
|
createAgentHireSchema,
|
|
createAgentSchema,
|
|
resetAgentSessionSchema,
|
|
updateAgentPermissionsSchema,
|
|
wakeAgentSchema,
|
|
updateAgentSchema,
|
|
} from "@paperclip/shared";
|
|
import { validate } from "../middleware/validate.js";
|
|
import {
|
|
agentService,
|
|
approvalService,
|
|
heartbeatService,
|
|
issueApprovalService,
|
|
issueService,
|
|
logActivity,
|
|
secretService,
|
|
} from "../services/index.js";
|
|
import { forbidden } from "../errors.js";
|
|
import { assertBoard, assertCompanyAccess, getActorInfo } from "./authz.js";
|
|
import { listAdapterModels } from "../adapters/index.js";
|
|
import { redactEventPayload } from "../redaction.js";
|
|
|
|
export function agentRoutes(db: Db) {
|
|
const router = Router();
|
|
const svc = agentService(db);
|
|
const approvalsSvc = approvalService(db);
|
|
const heartbeat = heartbeatService(db);
|
|
const issueApprovalsSvc = issueApprovalService(db);
|
|
const secretsSvc = secretService(db);
|
|
const strictSecretsMode = process.env.PAPERCLIP_SECRETS_STRICT_MODE === "true";
|
|
|
|
function canCreateAgents(agent: { role: string; permissions: Record<string, unknown> | null | undefined }) {
|
|
if (!agent.permissions || typeof agent.permissions !== "object") return false;
|
|
return Boolean((agent.permissions as Record<string, unknown>).canCreateAgents);
|
|
}
|
|
|
|
async function assertCanCreateAgentsForCompany(req: Request, companyId: string) {
|
|
assertCompanyAccess(req, companyId);
|
|
if (req.actor.type === "board") return null;
|
|
if (!req.actor.agentId) throw forbidden("Agent authentication required");
|
|
const actorAgent = await svc.getById(req.actor.agentId);
|
|
if (!actorAgent || actorAgent.companyId !== companyId) {
|
|
throw forbidden("Agent key cannot access another company");
|
|
}
|
|
if (!canCreateAgents(actorAgent)) {
|
|
throw forbidden("Missing permission: can create agents");
|
|
}
|
|
return actorAgent;
|
|
}
|
|
|
|
async function assertCanReadConfigurations(req: Request, companyId: string) {
|
|
return assertCanCreateAgentsForCompany(req, companyId);
|
|
}
|
|
|
|
async function actorCanReadConfigurationsForCompany(req: Request, companyId: string) {
|
|
assertCompanyAccess(req, companyId);
|
|
if (req.actor.type === "board") return true;
|
|
if (!req.actor.agentId) return false;
|
|
const actorAgent = await svc.getById(req.actor.agentId);
|
|
if (!actorAgent || actorAgent.companyId !== companyId) return false;
|
|
return canCreateAgents(actorAgent);
|
|
}
|
|
|
|
async function assertCanUpdateAgent(req: Request, targetAgent: { id: string; companyId: string }) {
|
|
assertCompanyAccess(req, targetAgent.companyId);
|
|
if (req.actor.type === "board") return;
|
|
if (!req.actor.agentId) throw forbidden("Agent authentication required");
|
|
|
|
const actorAgent = await svc.getById(req.actor.agentId);
|
|
if (!actorAgent || actorAgent.companyId !== targetAgent.companyId) {
|
|
throw forbidden("Agent key cannot access another company");
|
|
}
|
|
|
|
if (actorAgent.id === targetAgent.id) return;
|
|
if (actorAgent.role === "ceo") return;
|
|
if (canCreateAgents(actorAgent)) return;
|
|
throw forbidden("Only CEO or agent creators can modify other agents");
|
|
}
|
|
|
|
function parseSourceIssueIds(input: {
|
|
sourceIssueId?: string | null;
|
|
sourceIssueIds?: string[];
|
|
}): string[] {
|
|
const values: string[] = [];
|
|
if (Array.isArray(input.sourceIssueIds)) values.push(...input.sourceIssueIds);
|
|
if (typeof input.sourceIssueId === "string" && input.sourceIssueId.length > 0) {
|
|
values.push(input.sourceIssueId);
|
|
}
|
|
return Array.from(new Set(values));
|
|
}
|
|
|
|
function asRecord(value: unknown): Record<string, unknown> | null {
|
|
if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
|
|
return value as Record<string, unknown>;
|
|
}
|
|
|
|
function summarizeAgentUpdateDetails(patch: Record<string, unknown>) {
|
|
const changedTopLevelKeys = Object.keys(patch).sort();
|
|
const details: Record<string, unknown> = { changedTopLevelKeys };
|
|
|
|
const adapterConfigPatch = asRecord(patch.adapterConfig);
|
|
if (adapterConfigPatch) {
|
|
details.changedAdapterConfigKeys = Object.keys(adapterConfigPatch).sort();
|
|
}
|
|
|
|
const runtimeConfigPatch = asRecord(patch.runtimeConfig);
|
|
if (runtimeConfigPatch) {
|
|
details.changedRuntimeConfigKeys = Object.keys(runtimeConfigPatch).sort();
|
|
}
|
|
|
|
return details;
|
|
}
|
|
|
|
function redactForRestrictedAgentView(agent: Awaited<ReturnType<typeof svc.getById>>) {
|
|
if (!agent) return null;
|
|
return {
|
|
...agent,
|
|
adapterConfig: {},
|
|
runtimeConfig: {},
|
|
};
|
|
}
|
|
|
|
function redactAgentConfiguration(agent: Awaited<ReturnType<typeof svc.getById>>) {
|
|
if (!agent) return null;
|
|
return {
|
|
id: agent.id,
|
|
companyId: agent.companyId,
|
|
name: agent.name,
|
|
role: agent.role,
|
|
title: agent.title,
|
|
status: agent.status,
|
|
reportsTo: agent.reportsTo,
|
|
adapterType: agent.adapterType,
|
|
adapterConfig: redactEventPayload(agent.adapterConfig),
|
|
runtimeConfig: redactEventPayload(agent.runtimeConfig),
|
|
permissions: agent.permissions,
|
|
updatedAt: agent.updatedAt,
|
|
};
|
|
}
|
|
|
|
function redactRevisionSnapshot(snapshot: unknown): Record<string, unknown> {
|
|
if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot)) return {};
|
|
const record = snapshot as Record<string, unknown>;
|
|
return {
|
|
...record,
|
|
adapterConfig: redactEventPayload(
|
|
typeof record.adapterConfig === "object" && record.adapterConfig !== null
|
|
? (record.adapterConfig as Record<string, unknown>)
|
|
: {},
|
|
),
|
|
runtimeConfig: redactEventPayload(
|
|
typeof record.runtimeConfig === "object" && record.runtimeConfig !== null
|
|
? (record.runtimeConfig as Record<string, unknown>)
|
|
: {},
|
|
),
|
|
metadata:
|
|
typeof record.metadata === "object" && record.metadata !== null
|
|
? redactEventPayload(record.metadata as Record<string, unknown>)
|
|
: record.metadata ?? null,
|
|
};
|
|
}
|
|
|
|
function redactConfigRevision(
|
|
revision: Record<string, unknown> & { beforeConfig: unknown; afterConfig: unknown },
|
|
) {
|
|
return {
|
|
...revision,
|
|
beforeConfig: redactRevisionSnapshot(revision.beforeConfig),
|
|
afterConfig: redactRevisionSnapshot(revision.afterConfig),
|
|
};
|
|
}
|
|
|
|
function toLeanOrgNode(node: Record<string, unknown>): Record<string, unknown> {
|
|
const reports = Array.isArray(node.reports)
|
|
? (node.reports as Array<Record<string, unknown>>).map((report) => toLeanOrgNode(report))
|
|
: [];
|
|
return {
|
|
id: String(node.id),
|
|
name: String(node.name),
|
|
role: String(node.role),
|
|
status: String(node.status),
|
|
reports,
|
|
};
|
|
}
|
|
|
|
router.get("/adapters/:type/models", (req, res) => {
|
|
const type = req.params.type as string;
|
|
const models = listAdapterModels(type);
|
|
res.json(models);
|
|
});
|
|
|
|
router.get("/companies/:companyId/agents", async (req, res) => {
|
|
const companyId = req.params.companyId as string;
|
|
assertCompanyAccess(req, companyId);
|
|
const result = await svc.list(companyId);
|
|
const canReadConfigs = await actorCanReadConfigurationsForCompany(req, companyId);
|
|
if (canReadConfigs || req.actor.type === "board") {
|
|
res.json(result);
|
|
return;
|
|
}
|
|
res.json(result.map((agent) => redactForRestrictedAgentView(agent)));
|
|
});
|
|
|
|
router.get("/companies/:companyId/org", async (req, res) => {
|
|
const companyId = req.params.companyId as string;
|
|
assertCompanyAccess(req, companyId);
|
|
const tree = await svc.orgForCompany(companyId);
|
|
const leanTree = tree.map((node) => toLeanOrgNode(node as Record<string, unknown>));
|
|
res.json(leanTree);
|
|
});
|
|
|
|
router.get("/companies/:companyId/agent-configurations", async (req, res) => {
|
|
const companyId = req.params.companyId as string;
|
|
await assertCanReadConfigurations(req, companyId);
|
|
const rows = await svc.list(companyId);
|
|
res.json(rows.map((row) => redactAgentConfiguration(row)));
|
|
});
|
|
|
|
router.get("/agents/me", async (req, res) => {
|
|
if (req.actor.type !== "agent" || !req.actor.agentId) {
|
|
res.status(401).json({ error: "Agent authentication required" });
|
|
return;
|
|
}
|
|
const agent = await svc.getById(req.actor.agentId);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
const chainOfCommand = await svc.getChainOfCommand(agent.id);
|
|
res.json({ ...agent, chainOfCommand });
|
|
});
|
|
|
|
router.get("/agents/:id", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, agent.companyId);
|
|
if (req.actor.type === "agent" && req.actor.agentId !== id) {
|
|
const canRead = await actorCanReadConfigurationsForCompany(req, agent.companyId);
|
|
if (!canRead) {
|
|
const chainOfCommand = await svc.getChainOfCommand(agent.id);
|
|
res.json({ ...redactForRestrictedAgentView(agent), chainOfCommand });
|
|
return;
|
|
}
|
|
}
|
|
const chainOfCommand = await svc.getChainOfCommand(agent.id);
|
|
res.json({ ...agent, chainOfCommand });
|
|
});
|
|
|
|
router.get("/agents/:id/configuration", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
await assertCanReadConfigurations(req, agent.companyId);
|
|
res.json(redactAgentConfiguration(agent));
|
|
});
|
|
|
|
router.get("/agents/:id/config-revisions", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
await assertCanReadConfigurations(req, agent.companyId);
|
|
const revisions = await svc.listConfigRevisions(id);
|
|
res.json(revisions.map((revision) => redactConfigRevision(revision)));
|
|
});
|
|
|
|
router.get("/agents/:id/config-revisions/:revisionId", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const revisionId = req.params.revisionId as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
await assertCanReadConfigurations(req, agent.companyId);
|
|
const revision = await svc.getConfigRevision(id, revisionId);
|
|
if (!revision) {
|
|
res.status(404).json({ error: "Revision not found" });
|
|
return;
|
|
}
|
|
res.json(redactConfigRevision(revision));
|
|
});
|
|
|
|
router.post("/agents/:id/config-revisions/:revisionId/rollback", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const revisionId = req.params.revisionId as string;
|
|
const existing = await svc.getById(id);
|
|
if (!existing) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
await assertCanUpdateAgent(req, existing);
|
|
|
|
const actor = getActorInfo(req);
|
|
const updated = await svc.rollbackConfigRevision(id, revisionId, {
|
|
agentId: actor.agentId,
|
|
userId: actor.actorType === "user" ? actor.actorId : null,
|
|
});
|
|
if (!updated) {
|
|
res.status(404).json({ error: "Revision not found" });
|
|
return;
|
|
}
|
|
|
|
await logActivity(db, {
|
|
companyId: updated.companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "agent.config_rolled_back",
|
|
entityType: "agent",
|
|
entityId: updated.id,
|
|
details: { revisionId },
|
|
});
|
|
|
|
res.json(updated);
|
|
});
|
|
|
|
router.get("/agents/:id/runtime-state", async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, agent.companyId);
|
|
|
|
const state = await heartbeat.getRuntimeState(id);
|
|
res.json(state);
|
|
});
|
|
|
|
router.get("/agents/:id/task-sessions", async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, agent.companyId);
|
|
|
|
const sessions = await heartbeat.listTaskSessions(id);
|
|
res.json(
|
|
sessions.map((session) => ({
|
|
...session,
|
|
sessionParamsJson: redactEventPayload(session.sessionParamsJson ?? null),
|
|
})),
|
|
);
|
|
});
|
|
|
|
router.post("/agents/:id/runtime-state/reset-session", validate(resetAgentSessionSchema), async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, agent.companyId);
|
|
|
|
const taskKey =
|
|
typeof req.body.taskKey === "string" && req.body.taskKey.trim().length > 0
|
|
? req.body.taskKey.trim()
|
|
: null;
|
|
const state = await heartbeat.resetRuntimeSession(id, { taskKey });
|
|
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: "user",
|
|
actorId: req.actor.userId ?? "board",
|
|
action: "agent.runtime_session_reset",
|
|
entityType: "agent",
|
|
entityId: id,
|
|
details: { taskKey: taskKey ?? null },
|
|
});
|
|
|
|
res.json(state);
|
|
});
|
|
|
|
router.post("/companies/:companyId/agent-hires", validate(createAgentHireSchema), async (req, res) => {
|
|
const companyId = req.params.companyId as string;
|
|
await assertCanCreateAgentsForCompany(req, companyId);
|
|
const sourceIssueIds = parseSourceIssueIds(req.body);
|
|
const { sourceIssueId: _sourceIssueId, sourceIssueIds: _sourceIssueIds, ...hireInput } = req.body;
|
|
const normalizedAdapterConfig = await secretsSvc.normalizeAdapterConfigForPersistence(
|
|
companyId,
|
|
((hireInput.adapterConfig ?? {}) as Record<string, unknown>),
|
|
{ strictMode: strictSecretsMode },
|
|
);
|
|
const normalizedHireInput = {
|
|
...hireInput,
|
|
adapterConfig: normalizedAdapterConfig,
|
|
};
|
|
|
|
const company = await db
|
|
.select()
|
|
.from(companies)
|
|
.where(eq(companies.id, companyId))
|
|
.then((rows) => rows[0] ?? null);
|
|
if (!company) {
|
|
res.status(404).json({ error: "Company not found" });
|
|
return;
|
|
}
|
|
|
|
const requiresApproval = company.requireBoardApprovalForNewAgents;
|
|
const status = requiresApproval ? "pending_approval" : "idle";
|
|
const agent = await svc.create(companyId, {
|
|
...normalizedHireInput,
|
|
status,
|
|
spentMonthlyCents: 0,
|
|
lastHeartbeatAt: null,
|
|
});
|
|
|
|
let approval: Awaited<ReturnType<typeof approvalsSvc.getById>> | null = null;
|
|
const actor = getActorInfo(req);
|
|
|
|
if (requiresApproval) {
|
|
const requestedAdapterType = normalizedHireInput.adapterType ?? agent.adapterType;
|
|
const requestedAdapterConfig =
|
|
redactEventPayload(
|
|
(normalizedHireInput.adapterConfig ?? agent.adapterConfig) as Record<string, unknown>,
|
|
) ?? {};
|
|
const requestedRuntimeConfig =
|
|
redactEventPayload(
|
|
(normalizedHireInput.runtimeConfig ?? agent.runtimeConfig) as Record<string, unknown>,
|
|
) ?? {};
|
|
const requestedMetadata =
|
|
redactEventPayload(
|
|
((normalizedHireInput.metadata ?? agent.metadata ?? {}) as Record<string, unknown>),
|
|
) ?? {};
|
|
approval = await approvalsSvc.create(companyId, {
|
|
type: "hire_agent",
|
|
requestedByAgentId: actor.actorType === "agent" ? actor.actorId : null,
|
|
requestedByUserId: actor.actorType === "user" ? actor.actorId : null,
|
|
status: "pending",
|
|
payload: {
|
|
name: normalizedHireInput.name,
|
|
role: normalizedHireInput.role,
|
|
title: normalizedHireInput.title ?? null,
|
|
reportsTo: normalizedHireInput.reportsTo ?? null,
|
|
capabilities: normalizedHireInput.capabilities ?? null,
|
|
adapterType: requestedAdapterType,
|
|
adapterConfig: requestedAdapterConfig,
|
|
runtimeConfig: requestedRuntimeConfig,
|
|
budgetMonthlyCents:
|
|
typeof normalizedHireInput.budgetMonthlyCents === "number"
|
|
? normalizedHireInput.budgetMonthlyCents
|
|
: agent.budgetMonthlyCents,
|
|
metadata: requestedMetadata,
|
|
agentId: agent.id,
|
|
requestedByAgentId: actor.actorType === "agent" ? actor.actorId : null,
|
|
requestedConfigurationSnapshot: {
|
|
adapterType: requestedAdapterType,
|
|
adapterConfig: requestedAdapterConfig,
|
|
runtimeConfig: requestedRuntimeConfig,
|
|
},
|
|
},
|
|
decisionNote: null,
|
|
decidedByUserId: null,
|
|
decidedAt: null,
|
|
updatedAt: new Date(),
|
|
});
|
|
|
|
if (sourceIssueIds.length > 0) {
|
|
await issueApprovalsSvc.linkManyForApproval(approval.id, sourceIssueIds, {
|
|
agentId: actor.actorType === "agent" ? actor.actorId : null,
|
|
userId: actor.actorType === "user" ? actor.actorId : null,
|
|
});
|
|
}
|
|
}
|
|
|
|
await logActivity(db, {
|
|
companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "agent.hire_created",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
details: {
|
|
name: agent.name,
|
|
role: agent.role,
|
|
requiresApproval,
|
|
approvalId: approval?.id ?? null,
|
|
issueIds: sourceIssueIds,
|
|
},
|
|
});
|
|
|
|
if (approval) {
|
|
await logActivity(db, {
|
|
companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "approval.created",
|
|
entityType: "approval",
|
|
entityId: approval.id,
|
|
details: { type: approval.type, linkedAgentId: agent.id },
|
|
});
|
|
}
|
|
|
|
res.status(201).json({ agent, approval });
|
|
});
|
|
|
|
router.post("/companies/:companyId/agents", validate(createAgentSchema), async (req, res) => {
|
|
const companyId = req.params.companyId as string;
|
|
assertCompanyAccess(req, companyId);
|
|
|
|
if (req.actor.type === "agent") {
|
|
assertBoard(req);
|
|
}
|
|
|
|
const normalizedAdapterConfig = await secretsSvc.normalizeAdapterConfigForPersistence(
|
|
companyId,
|
|
((req.body.adapterConfig ?? {}) as Record<string, unknown>),
|
|
{ strictMode: strictSecretsMode },
|
|
);
|
|
|
|
const agent = await svc.create(companyId, {
|
|
...req.body,
|
|
adapterConfig: normalizedAdapterConfig,
|
|
status: "idle",
|
|
spentMonthlyCents: 0,
|
|
lastHeartbeatAt: null,
|
|
});
|
|
|
|
const actor = getActorInfo(req);
|
|
await logActivity(db, {
|
|
companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "agent.created",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
details: { name: agent.name, role: agent.role },
|
|
});
|
|
|
|
res.status(201).json(agent);
|
|
});
|
|
|
|
router.patch("/agents/:id/permissions", validate(updateAgentPermissionsSchema), async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const existing = await svc.getById(id);
|
|
if (!existing) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, existing.companyId);
|
|
|
|
if (req.actor.type === "agent") {
|
|
const actorAgent = req.actor.agentId ? await svc.getById(req.actor.agentId) : null;
|
|
if (!actorAgent || actorAgent.companyId !== existing.companyId) {
|
|
res.status(403).json({ error: "Forbidden" });
|
|
return;
|
|
}
|
|
if (actorAgent.role !== "ceo") {
|
|
res.status(403).json({ error: "Only CEO can manage permissions" });
|
|
return;
|
|
}
|
|
}
|
|
|
|
const agent = await svc.updatePermissions(id, req.body);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
|
|
const actor = getActorInfo(req);
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "agent.permissions_updated",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
details: req.body,
|
|
});
|
|
|
|
res.json(agent);
|
|
});
|
|
|
|
router.patch("/agents/:id", validate(updateAgentSchema), async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const existing = await svc.getById(id);
|
|
if (!existing) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
await assertCanUpdateAgent(req, existing);
|
|
|
|
if (Object.prototype.hasOwnProperty.call(req.body, "permissions")) {
|
|
res.status(422).json({ error: "Use /api/agents/:id/permissions for permission changes" });
|
|
return;
|
|
}
|
|
|
|
const patchData = { ...(req.body as Record<string, unknown>) };
|
|
if (Object.prototype.hasOwnProperty.call(patchData, "adapterConfig")) {
|
|
const adapterConfig = asRecord(patchData.adapterConfig);
|
|
if (!adapterConfig) {
|
|
res.status(422).json({ error: "adapterConfig must be an object" });
|
|
return;
|
|
}
|
|
patchData.adapterConfig = await secretsSvc.normalizeAdapterConfigForPersistence(
|
|
existing.companyId,
|
|
adapterConfig,
|
|
{ strictMode: strictSecretsMode },
|
|
);
|
|
}
|
|
|
|
const actor = getActorInfo(req);
|
|
const agent = await svc.update(id, patchData, {
|
|
recordRevision: {
|
|
createdByAgentId: actor.agentId,
|
|
createdByUserId: actor.actorType === "user" ? actor.actorId : null,
|
|
source: "patch",
|
|
},
|
|
});
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "agent.updated",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
details: summarizeAgentUpdateDetails(patchData),
|
|
});
|
|
|
|
res.json(agent);
|
|
});
|
|
|
|
router.post("/agents/:id/pause", async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const agent = await svc.pause(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
|
|
await heartbeat.cancelActiveForAgent(id);
|
|
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: "user",
|
|
actorId: req.actor.userId ?? "board",
|
|
action: "agent.paused",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
});
|
|
|
|
res.json(agent);
|
|
});
|
|
|
|
router.post("/agents/:id/resume", async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const agent = await svc.resume(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: "user",
|
|
actorId: req.actor.userId ?? "board",
|
|
action: "agent.resumed",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
});
|
|
|
|
res.json(agent);
|
|
});
|
|
|
|
router.post("/agents/:id/terminate", async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const agent = await svc.terminate(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
|
|
await heartbeat.cancelActiveForAgent(id);
|
|
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: "user",
|
|
actorId: req.actor.userId ?? "board",
|
|
action: "agent.terminated",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
});
|
|
|
|
res.json(agent);
|
|
});
|
|
|
|
router.delete("/agents/:id", async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const agent = await svc.remove(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: "user",
|
|
actorId: req.actor.userId ?? "board",
|
|
action: "agent.deleted",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
});
|
|
|
|
res.json({ ok: true });
|
|
});
|
|
|
|
router.get("/agents/:id/keys", async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const keys = await svc.listKeys(id);
|
|
res.json(keys);
|
|
});
|
|
|
|
router.post("/agents/:id/keys", validate(createAgentKeySchema), async (req, res) => {
|
|
assertBoard(req);
|
|
const id = req.params.id as string;
|
|
const key = await svc.createApiKey(id, req.body.name);
|
|
|
|
const agent = await svc.getById(id);
|
|
if (agent) {
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: "user",
|
|
actorId: req.actor.userId ?? "board",
|
|
action: "agent.key_created",
|
|
entityType: "agent",
|
|
entityId: agent.id,
|
|
details: { keyId: key.id, name: key.name },
|
|
});
|
|
}
|
|
|
|
res.status(201).json(key);
|
|
});
|
|
|
|
router.delete("/agents/:id/keys/:keyId", async (req, res) => {
|
|
assertBoard(req);
|
|
const keyId = req.params.keyId as string;
|
|
const revoked = await svc.revokeKey(keyId);
|
|
if (!revoked) {
|
|
res.status(404).json({ error: "Key not found" });
|
|
return;
|
|
}
|
|
res.json({ ok: true });
|
|
});
|
|
|
|
router.post("/agents/:id/wakeup", validate(wakeAgentSchema), async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, agent.companyId);
|
|
|
|
if (req.actor.type === "agent" && req.actor.agentId !== id) {
|
|
res.status(403).json({ error: "Agent can only invoke itself" });
|
|
return;
|
|
}
|
|
|
|
const run = await heartbeat.wakeup(id, {
|
|
source: req.body.source,
|
|
triggerDetail: req.body.triggerDetail ?? "manual",
|
|
reason: req.body.reason ?? null,
|
|
payload: req.body.payload ?? null,
|
|
idempotencyKey: req.body.idempotencyKey ?? null,
|
|
requestedByActorType: req.actor.type === "agent" ? "agent" : "user",
|
|
requestedByActorId: req.actor.type === "agent" ? req.actor.agentId ?? null : req.actor.userId ?? null,
|
|
contextSnapshot: {
|
|
triggeredBy: req.actor.type,
|
|
actorId: req.actor.type === "agent" ? req.actor.agentId : req.actor.userId,
|
|
},
|
|
});
|
|
|
|
if (!run) {
|
|
res.status(202).json({ status: "skipped" });
|
|
return;
|
|
}
|
|
|
|
const actor = getActorInfo(req);
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "heartbeat.invoked",
|
|
entityType: "heartbeat_run",
|
|
entityId: run.id,
|
|
details: { agentId: id },
|
|
});
|
|
|
|
res.status(202).json(run);
|
|
});
|
|
|
|
router.post("/agents/:id/heartbeat/invoke", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const agent = await svc.getById(id);
|
|
if (!agent) {
|
|
res.status(404).json({ error: "Agent not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, agent.companyId);
|
|
|
|
if (req.actor.type === "agent" && req.actor.agentId !== id) {
|
|
res.status(403).json({ error: "Agent can only invoke itself" });
|
|
return;
|
|
}
|
|
|
|
const run = await heartbeat.invoke(
|
|
id,
|
|
"on_demand",
|
|
{
|
|
triggeredBy: req.actor.type,
|
|
actorId: req.actor.type === "agent" ? req.actor.agentId : req.actor.userId,
|
|
},
|
|
"manual",
|
|
{
|
|
actorType: req.actor.type === "agent" ? "agent" : "user",
|
|
actorId: req.actor.type === "agent" ? req.actor.agentId ?? null : req.actor.userId ?? null,
|
|
},
|
|
);
|
|
|
|
if (!run) {
|
|
res.status(202).json({ status: "skipped" });
|
|
return;
|
|
}
|
|
|
|
const actor = getActorInfo(req);
|
|
await logActivity(db, {
|
|
companyId: agent.companyId,
|
|
actorType: actor.actorType,
|
|
actorId: actor.actorId,
|
|
agentId: actor.agentId,
|
|
runId: actor.runId,
|
|
action: "heartbeat.invoked",
|
|
entityType: "heartbeat_run",
|
|
entityId: run.id,
|
|
details: { agentId: id },
|
|
});
|
|
|
|
res.status(202).json(run);
|
|
});
|
|
|
|
router.get("/companies/:companyId/heartbeat-runs", async (req, res) => {
|
|
const companyId = req.params.companyId as string;
|
|
assertCompanyAccess(req, companyId);
|
|
const agentId = req.query.agentId as string | undefined;
|
|
const runs = await heartbeat.list(companyId, agentId);
|
|
res.json(runs);
|
|
});
|
|
|
|
router.post("/heartbeat-runs/:runId/cancel", async (req, res) => {
|
|
assertBoard(req);
|
|
const runId = req.params.runId as string;
|
|
const run = await heartbeat.cancelRun(runId);
|
|
|
|
if (run) {
|
|
await logActivity(db, {
|
|
companyId: run.companyId,
|
|
actorType: "user",
|
|
actorId: req.actor.userId ?? "board",
|
|
action: "heartbeat.cancelled",
|
|
entityType: "heartbeat_run",
|
|
entityId: run.id,
|
|
details: { agentId: run.agentId },
|
|
});
|
|
}
|
|
|
|
res.json(run);
|
|
});
|
|
|
|
router.get("/heartbeat-runs/:runId/events", async (req, res) => {
|
|
const runId = req.params.runId as string;
|
|
const run = await heartbeat.getRun(runId);
|
|
if (!run) {
|
|
res.status(404).json({ error: "Heartbeat run not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, run.companyId);
|
|
|
|
const afterSeq = Number(req.query.afterSeq ?? 0);
|
|
const limit = Number(req.query.limit ?? 200);
|
|
const events = await heartbeat.listEvents(runId, Number.isFinite(afterSeq) ? afterSeq : 0, Number.isFinite(limit) ? limit : 200);
|
|
const redactedEvents = events.map((event) => ({
|
|
...event,
|
|
payload: redactEventPayload(event.payload),
|
|
}));
|
|
res.json(redactedEvents);
|
|
});
|
|
|
|
router.get("/heartbeat-runs/:runId/log", async (req, res) => {
|
|
const runId = req.params.runId as string;
|
|
const run = await heartbeat.getRun(runId);
|
|
if (!run) {
|
|
res.status(404).json({ error: "Heartbeat run not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, run.companyId);
|
|
|
|
const offset = Number(req.query.offset ?? 0);
|
|
const limitBytes = Number(req.query.limitBytes ?? 256000);
|
|
const result = await heartbeat.readLog(runId, {
|
|
offset: Number.isFinite(offset) ? offset : 0,
|
|
limitBytes: Number.isFinite(limitBytes) ? limitBytes : 256000,
|
|
});
|
|
|
|
res.json(result);
|
|
});
|
|
|
|
router.get("/issues/:id/live-runs", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const issueSvc = issueService(db);
|
|
const issue = await issueSvc.getById(id);
|
|
if (!issue) {
|
|
res.status(404).json({ error: "Issue not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, issue.companyId);
|
|
|
|
const liveRuns = await db
|
|
.select({
|
|
id: heartbeatRuns.id,
|
|
status: heartbeatRuns.status,
|
|
invocationSource: heartbeatRuns.invocationSource,
|
|
triggerDetail: heartbeatRuns.triggerDetail,
|
|
startedAt: heartbeatRuns.startedAt,
|
|
finishedAt: heartbeatRuns.finishedAt,
|
|
createdAt: heartbeatRuns.createdAt,
|
|
agentId: heartbeatRuns.agentId,
|
|
agentName: agentsTable.name,
|
|
adapterType: agentsTable.adapterType,
|
|
})
|
|
.from(heartbeatRuns)
|
|
.innerJoin(agentsTable, eq(heartbeatRuns.agentId, agentsTable.id))
|
|
.where(
|
|
and(
|
|
eq(heartbeatRuns.companyId, issue.companyId),
|
|
inArray(heartbeatRuns.status, ["queued", "running"]),
|
|
sql`${heartbeatRuns.contextSnapshot} ->> 'issueId' = ${id}`,
|
|
),
|
|
)
|
|
.orderBy(desc(heartbeatRuns.createdAt));
|
|
|
|
res.json(liveRuns);
|
|
});
|
|
|
|
router.get("/issues/:id/active-run", async (req, res) => {
|
|
const id = req.params.id as string;
|
|
const issueSvc = issueService(db);
|
|
const issue = await issueSvc.getById(id);
|
|
if (!issue) {
|
|
res.status(404).json({ error: "Issue not found" });
|
|
return;
|
|
}
|
|
assertCompanyAccess(req, issue.companyId);
|
|
|
|
if (!issue.assigneeAgentId || issue.status !== "in_progress") {
|
|
res.json(null);
|
|
return;
|
|
}
|
|
|
|
const agent = await svc.getById(issue.assigneeAgentId);
|
|
if (!agent) {
|
|
res.json(null);
|
|
return;
|
|
}
|
|
|
|
const run = await heartbeat.getActiveRunForAgent(issue.assigneeAgentId);
|
|
if (!run) {
|
|
res.json(null);
|
|
return;
|
|
}
|
|
|
|
res.json({
|
|
...run,
|
|
agentId: agent.id,
|
|
agentName: agent.name,
|
|
adapterType: agent.adapterType,
|
|
});
|
|
});
|
|
|
|
return router;
|
|
}
|