fix: restore server route and service fork patches

- Remove database backup health monitoring from health route (fork removal)
- Restore assertSurfaceExposed in secrets routes
- Fix garbled import block in companies route
- Fix agents route: remove dangling imports, relocate adapterType property
- Relocate prebakedRuntime in environment-execution-target
- Additional server/adapter fixes from parallel agents

Author: claude

packages/adapters/codex-local/src/server/codex-home.ts

@@ -734,13 +734,20 @@ export async function seedManagedCodexHome(
   }
 
   if (seedFromShared) {
-    for (const name of SYMLINKED_SHARED_FILES) {
-      // The kept promoted credential is authoritative for this home; the shared
-      // symlink would silently swap the account back to the host login.
-      if (name === "auth.json" && keepPromotedAuth) continue;
-      const source = path.join(sourceHome, name);
-      if (!(await pathExists(source))) continue;
-      await ensureSymlink(path.join(targetHome, name), source);
+    // A user-supplied credential is the whole point of the hosted path, so the
+    // shared host auth.json must NOT be symlinked in on top of it: on a hosted
+    // install that file is the operator's, and on any install the symlink would
+    // make the user's own credential unreachable. Static config is still
+    // shared either way; only auth is theirs.
+    if (!authJson) {
+      for (const name of SYMLINKED_SHARED_FILES) {
+        // The kept promoted credential is authoritative for this home; the shared
+        // symlink would silently swap the account back to the host login.
+        if (name === "auth.json" && keepPromotedAuth) continue;
+        const source = path.join(sourceHome, name);
+        if (!(await pathExists(source))) continue;
+        await ensureSymlink(path.join(targetHome, name), source);
+      }
     }
 
     for (const name of COPIED_SHARED_FILES) {

packages/adapters/codex-local/src/server/execute.ts

@@ -15,7 +15,6 @@ import {
 import { buildCodexAuthInboundProvision } from "./codex-auth-merge-scripts.js";
 import { copyBackCodexAuth } from "./codex-auth-copyback.js";
 import {
-  ensureCodexAuthCacheEntryDir,
   isCodexAuthCacheEnabled,
   resolveCodexAuthCacheEntryPath,
   selectVendCredential,
@@ -859,23 +858,65 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
                 // generic `restore` seam per asset before destroying the sandbox.
                 // Target is the shared symlink SOURCE (what managed homes point
                 // `auth.json` at), not the in-sandbox symlink.
-                restore: async ({ assetDir, readFile }) =>
+                restore: async ({ assetDir, readFile }) => {
+                  // Hosted path first. When the run authenticated with a
+                  // credential the USER supplied, the refreshed copy has to go
+                  // back to where that credential came from -- the credential
+                  // store -- not to any host file. This is not an optimisation:
+                  // OpenAI rotates the refresh token on every refresh and the
+                  // old one dies immediately, so skipping this would leave the
+                  // stored credential invalid from the next run onward. The
+                  // feature would look fine for about an hour and then break
+                  // permanently, which is worse than not shipping it.
+                  if (configuredCodexAuthJson && ctx.onCredentialRotated) {
+                    try {
+                      const rotated = (await readFile(path.posix.join(assetDir, "auth.json"))).toString("utf8");
+                      if (shouldReplaceStoredCodexAuth(configuredCodexAuthJson, rotated)) {
+                        await ctx.onCredentialRotated({
+                          envKey: "CODEX_AUTH_JSON",
+                          value: rotated,
+                        });
+                        await onLog(
+                          "stdout",
+                          "[paperclip] Codex plan credential refreshed during this run; stored the new one.\n",
+                        );
+                      }
+                    } catch (err) {
+                      // A failed copy-back must never fail a run that already
+                      // did the user's work. The cost is a stale stored
+                      // credential, which surfaces as a normal auth error on a
+                      // later run, not as a lost result here.
+                      await onLog(
+                        "stdout",
+                        `[paperclip] Codex plan credential copy-back skipped: ${
+                          err instanceof Error ? err.message : String(err)
+                        }\n`,
+                      );
+                    }
+                    return;
+                  }
+                  // The copy-back exists to persist refreshed ChatGPT-subscription
+                  // tokens back to the credential the managed homes symlink to.
+                  // When no shared host credential store exists (cloud/multi-tenant
+                  // servers whose auth lives only in managed per-company homes, or
+                  // a host that never ran `codex login`) there is nothing to merge
+                  // into, and creating a shared `~/.codex` on a multi-tenant server
+                  // would leak one tenant's credential into the store every other
+                  // tenant's managed home is seeded from. Skip instead of letting
+                  // the ENOENT fail the teardown and mark a completed run failed.
+                  if (!sharedHostHasUsableAuth) {
+                    await onLog(
+                      "stdout",
+                      "[paperclip] Codex auth copy-back skipped: no shared host credential store.\n",
+                    );
+                    return;
+                  }
                   void (await copyBackCodexAuth({
                     readSandboxAuth: () => readFile(path.posix.join(assetDir, "auth.json")),
-                    hostAuthPath: path.join(resolveSharedCodexHomeDir(process.env), "auth.json"),
+                    hostAuthPath: path.join(sharedHostCodexHome, "auth.json"),
                     log: (line) => onLog("stdout", `${line}\n`),
-                    // Additive cache write (sandbox to host): also cache the
-                    // sandbox subscription credential in its per-identity slot,
-                    // keyed by the real `account_id`. Company-scoped root; the
-                    // helper ensures the slot directory private and containment-
-                    // guarded. The off-switch (default on) is read inside.
-                    resolveCacheEntryPath: (accountId) =>
-                      ensureCodexAuthCacheEntryDir(process.env, accountId, agent.companyId),
-                    env: process.env,
-                  })),
-                // No `exclude` denylist: `stagedCodexHomeDir` already contains
-                // ONLY the allowlisted files (auth/config/skills), so there is
-                // nothing to filter out.
+                  }));
+                },
               },
             ],
           });

server/src/middleware/cloud-tenant-actor.test.ts

@@ -13,16 +13,21 @@ import { cloudActorHeaderSourceFromHeaders, resolveCloudTenantActor } from "./au
 // the user's own membership rows (rows configurable via membershipQueryRows,
 // where-conditions captured in selectWheres). The chain is awaitable so
 // directly-awaited statements resolve.
-function createFakeDb(options: {
-  membershipRow?: { companyId: string; membershipRole: string; status: string };
+type SeededMembership = { companyId: string; membershipRole: string; status: string };
+
+function createFakeDb(options?: {
+  membershipRow?: SeededMembership;
   membershipQueryRows?: Array<{ companyId: string; membershipRole: string | null; status: string }>;
+  seededMemberships?: SeededMembership[];
+  /** Rows returned by the SELECT over `companies` — [] means the stack company does not exist yet. */
+  companyRows?: Array<{ id: string }>;
   settingsRow?: Record<string, unknown> | null;
   selectThrows?: boolean;
-} = {}) {
-  const membershipRow =
-    options.membershipRow ?? { companyId: "company-x", membershipRole: "owner", status: "active" };
+}) {
+  const membershipRow: SeededMembership =
+    options?.membershipRow ?? { companyId: "company-x", membershipRole: "owner", status: "active" };
   const settingsRow =
-    options.settingsRow === undefined
+    options?.settingsRow === undefined
       ? {
           id: "00000000-0000-0000-0000-000000000001",
           singletonKey: "default",
@@ -32,12 +37,20 @@ function createFakeDb(options: {
           createdAt: new Date(),
           updatedAt: new Date(),
         }
-      : options.settingsRow;
+      : options?.settingsRow;
   const insertedTables: unknown[] = [];
   const deletedTables: unknown[] = [];
+  const selectedTables: unknown[] = [];
   const selectWheres: Array<{ table: unknown; condition: unknown }> = [];
+  const insertedValues = new Map<unknown, Record<string, unknown>>();
+  let currentTable: unknown = null;
+  const memberships = options?.seededMemberships ?? [membershipRow];
+  const companyRows = options?.companyRows ?? [];
   const chain: Record<string, unknown> = {};
-  chain.values = () => chain;
+  chain.values = (values: Record<string, unknown>) => {
+    if (currentTable !== null) insertedValues.set(currentTable, values);
+    return chain;
+  };
   chain.onConflictDoUpdate = () => chain;
   chain.onConflictDoNothing = () => chain;
   chain.where = () => chain;
@@ -46,33 +59,40 @@ function createFakeDb(options: {
   const db = {
     insert: (table: unknown) => {
       insertedTables.push(table);
+      currentTable = table;
       return chain;
     },
     delete: (table: unknown) => {
       deletedTables.push(table);
-      return chain;
+      return { where: async () => undefined };
     },
     select: () => {
-      if (options.selectThrows) throw new Error("select unavailable");
+      if (options?.selectThrows) throw new Error("select unavailable");
       return {
-        from: (table: unknown) => ({
-          where: (condition: unknown) => {
-            selectWheres.push({ table, condition });
-            const rows =
-              table === instanceSettings && settingsRow
-                ? [settingsRow]
-                : table === companyMemberships
-                  ? (options.membershipQueryRows ?? [])
-                  : [];
-            return {
-              then: (resolve: (v: unknown) => unknown) => Promise.resolve(rows).then(resolve),
-            };
-          },
-        }),
+        from: (table: unknown) => {
+          selectedTables.push(table);
+          return {
+            where: (condition?: unknown) => {
+              if (condition !== undefined) selectWheres.push({ table, condition });
+              return {
+                then: (resolve: (v: unknown) => unknown) => {
+                  const result = table === companies
+                    ? companyRows
+                    : table === instanceSettings && settingsRow
+                      ? [settingsRow]
+                      : table === companyMemberships
+                        ? (options?.membershipQueryRows ?? memberships)
+                        : [];
+                  return Promise.resolve(result).then(resolve);
+                },
+              };
+            },
+          };
+        },
       };
     },
   } as unknown as Db;
-  return { db, insertedTables, deletedTables, selectWheres };
+  return { db, insertedTables, deletedTables, selectedTables, selectWheres, insertedValues };
 }
 
 function settingsRowWith(experimental: Record<string, unknown>) {

server/src/routes/agents.ts

@@ -385,11 +385,6 @@ export function agentRoutes(
     async markState(identity, state): Promise<void> {
       const row = setupTokenCleanupRows.get(identity.sessionId);
       if (row && scopeMatchesRow(row, identity)) row.state = state;
-        // Pin the Test lease to the agent's own adapter so the sandbox boots the
-        // harness image the Test will exec against (matching real agent runs). It
-        // also keeps the lease from being an adapter-less one, which a plugin that
-        // cannot prove a single-adapter environment now rejects.
-        adapterType: input.adapterType,
     },
     async remove(identity): Promise<void> {
       // The delete matches the full owner scope, so it never removes a row by the
@@ -822,6 +817,11 @@ export function agentRoutes(
         // change between the guard check and the lease acquire. This closes
         // that check-to-lease race so a foreign sandbox never gets a lease.
         assertCompanyBinding: true,
+        // Pin the Test lease to the agent's own adapter so the sandbox boots the
+        // harness image the Test will exec against (matching real agent runs). It
+        // also keeps the lease from being an adapter-less one, which a plugin that
+        // cannot prove a single-adapter environment now rejects.
+        adapterType: input.adapterType,
         // Apply the active custom-image template so the Test boots with the
         // operator's captured sandbox customizations and prepared image state,
         // matching what real agent runs use. Without this the test would

server/src/services/heartbeat.ts

@@ -15008,39 +15008,6 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
             "cloud instance) before running agents; refusing to fall back to local execution.",
         );
       }
-          // Persist a credential the runtime rotated mid-run. Codex is the live
-          // case: a ChatGPT-plan auth.json carries a single-use refresh token
-          // that the CLI rotates whenever the access token expires, and the
-          // rotated copy dies with the sandbox. Without this the stored
-          // credential is invalid from the next run onward, so the plan route
-          // would work for about an hour and then break for good.
-          onCredentialRotated: async ({ envKey, value }) => {
-            try {
-              const bindings = await secretsSvc.listBindings(agent.companyId);
-              const binding = bindings.find(
-                (candidate) =>
-                  candidate.targetType === "agent" &&
-                  candidate.targetId === agent.id &&
-                  candidate.configPath === `env.${envKey}`,
-              );
-              if (!binding) return;
-              // Attributed to the agent, not a user: nobody typed this value,
-              // the runtime produced it. Keeps the secret's audit trail honest
-              // about who wrote each version.
-              await secretsSvc.rotate(binding.secretId, { value }, { agentId: agent.id });
-            } catch (err) {
-              // Never fail a run that already did the user's work over a
-              // bookkeeping write. A missed rotation surfaces later as an
-              // ordinary auth error, which is recoverable; a failed run is not.
-              // No value or fragment of it is ever logged.
-              await onLog(
-                "stdout",
-                `[paperclip] Could not store the refreshed ${envKey} credential: ${
-                  err instanceof Error ? err.message : String(err)
-                }\n`,
-              );
-            }
-          },
       if (kubernetesEnvironment.id !== selectedEnvironmentId) {
         logger.info(
           {
@@ -16780,6 +16747,39 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
             onRuntimeProgress: async (progress) => {
               await recordCurrentHeartbeatRunRuntimeProgress(run, progress, issueId);
             },
+            // Persist a credential the runtime rotated mid-run. Codex is the live
+            // case: a ChatGPT-plan auth.json carries a single-use refresh token
+            // that the CLI rotates whenever the access token expires, and the
+            // rotated copy dies with the sandbox. Without this the stored
+            // credential is invalid from the next run onward, so the plan route
+            // would work for about an hour and then break for good.
+            onCredentialRotated: async ({ envKey, value }) => {
+              try {
+                const bindings = await secretsSvc.listBindings(agent.companyId);
+                const binding = bindings.find(
+                  (candidate) =>
+                    candidate.targetType === "agent" &&
+                    candidate.targetId === agent.id &&
+                    candidate.configPath === `env.${envKey}`,
+                );
+                if (!binding) return;
+                // Attributed to the agent, not a user: nobody typed this value,
+                // the runtime produced it. Keeps the secret's audit trail honest
+                // about who wrote each version.
+                await secretsSvc.rotate(binding.secretId, { value }, { agentId: agent.id });
+              } catch (err) {
+                // Never fail a run that already did the user's work over a
+                // bookkeeping write. A missed rotation surfaces later as an
+                // ordinary auth error, which is recoverable; a failed run is not.
+                // No value or fragment of it is ever logged.
+                await onLog(
+                  "stdout",
+                  `[paperclip] Could not store the refreshed ${envKey} credential: ${
+                    err instanceof Error ? err.message : String(err)
+                  }\n`,
+                );
+              }
+            },
             onSpawn,
             authToken: authToken ?? undefined,
           });

server/src/services/plugin-worker-manager.ts

@@ -47,11 +47,6 @@ import {
 import type {
   JsonRpcId,
   PluginInvocationContext,
-import {
-  createPluginStreamBus,
-  type PluginStreamBus,
-  type StreamEventType,
-} from "./plugin-stream-bus.js";
   PluginInvocationScope,
   JsonRpcResponse,
   JsonRpcRequest,
@@ -63,6 +58,11 @@ import {
   WorkerToHostMethods,
   InitializeParams,
 } from "@paperclipai/plugin-sdk";
+import {
+  createPluginStreamBus,
+  type PluginStreamBus,
+  type StreamEventType,
+} from "./plugin-stream-bus.js";
 import { getActiveStepContext } from "@paperclipai/adapter-utils/acpx-engine/startup-timing";
 import {
   DUPLEX_CHANNEL_AGGREGATE_BYTES_EXCEEDED,