fix: restore fork-specific patches after upstream rebase

Re-apply fork customizations that failed to apply during the automated
rebase of upstream d5b9f6c..d785b19:

- SurfaceGuard wrapping for company settings routes (App.tsx)
- Cloud billing detection in SidebarAccountMenu
- Cloud company creation in CompanySwitcher
- Missing imports in Layout.tsx (useFeatures, findCompanyByUrlSegment)
- Brand directory support in server app
- Fork-specific route and service changes
- Adapter execution fork patches (credential rotation, managed instance)

Work in progress — additional fork patches being applied by parallel agents.

Author: claude

packages/adapters/codex-local/src/server/execute.ts

@@ -390,6 +390,7 @@ export async function assertCodexCredentialsLaunchable(input: {
   companyId: string;
   configuredCodexHome: string | null;
   configuredApiKey: string | null;
+  configuredAuthJson?: string | null;
   effectiveCodexHome: string;
   target: MaybeResolvedExecutionTarget;
   cwd: string;
@@ -401,6 +402,7 @@ export async function assertCodexCredentialsLaunchable(input: {
     companyId: input.companyId,
     configuredCodexHome: input.configuredCodexHome,
     configuredApiKey: input.configuredApiKey,
+    configuredAuthJson: input.configuredAuthJson,
   });
   if (!credentialReadiness.managed || credentialReadiness.ready) return;
 
@@ -442,8 +444,9 @@ export async function assertCodexCredentialsLaunchable(input: {
   throw new Error(
     `no Codex credentials provisioned for managed home "${input.effectiveCodexHome}" ` +
       `(no usable auth.json and OPENAI_API_KEY is empty). ` +
-      `Sign in to Codex on the host with a ChatGPT subscription, or configure a per-agent ` +
-      `OPENAI_API_KEY.`,
+      `Configure a per-agent OPENAI_API_KEY, or supply a ChatGPT-plan credential ` +
+      `(CODEX_AUTH_JSON) minted with \`codex login\` on your own machine. On a ` +
+      `self-hosted install, signing in to Codex on the host also works.`,
   );
 }
 
@@ -729,6 +732,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
     companyId: agent.companyId,
     configuredCodexHome,
     configuredApiKey: configuredOpenAiApiKey,
+    configuredAuthJson: configuredCodexAuthJson,
     effectiveCodexHome,
     target: executionTarget,
     cwd,

packages/adapters/opencode-local/src/server/execute.test.ts

@@ -1,3 +1,4 @@
+import { mkdtemp, readdir, rm, mkdir } from "node:fs/promises";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import fs from "node:fs/promises";
 import os from "node:os";
@@ -8,7 +9,7 @@ vi.mock("@paperclipai/adapter-utils/execution-target", async (importOriginal) =>
   return { ...actual, runAdapterExecutionTargetProcess: vi.fn() };
 });
 
-import { ensureRemoteOpenCodeModelConfiguredAndAvailable, execute } from "./execute.js";
+import { buildOpenCodeSkillsDir, ensureRemoteOpenCodeModelConfiguredAndAvailable, execute } from "./execute.js";
 import { runAdapterExecutionTargetProcess } from "@paperclipai/adapter-utils/execution-target";
 
 const runProcessMock = vi.mocked(runAdapterExecutionTargetProcess);
@@ -33,6 +34,109 @@ function probeResult(overrides: Record<string, unknown>) {
   } as never;
 }
 
+describe("buildOpenCodeSkillsDir create-agent inclusion", () => {
+  const cleanupDirs: string[] = [];
+
+  afterEach(async () => {
+    while (cleanupDirs.length > 0) {
+      const dir = cleanupDirs.pop();
+      if (!dir) continue;
+      await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+  });
+
+  async function makeConfigWithSkills() {
+    const root = await mkdtemp(path.join(os.tmpdir(), "paperclip-opencode-skilltest-"));
+    cleanupDirs.push(root);
+    const createAgentSource = path.join(root, "paperclip-create-agent");
+    const coordinationSource = path.join(root, "paperclip");
+    const memorySource = path.join(root, "para-memory-files");
+    await mkdir(createAgentSource, { recursive: true });
+    await mkdir(coordinationSource, { recursive: true });
+    await mkdir(memorySource, { recursive: true });
+    // Runtime skills are configured directly on the adapter config so the helper
+    // resolves them without touching the packaged skills directory.
+    return {
+      paperclipRuntimeSkills: [
+        {
+          key: "paperclipai/paperclip/paperclip-create-agent",
+          runtimeName: "paperclip-create-agent",
+          source: createAgentSource,
+        },
+        {
+          key: "paperclipai/paperclip/paperclip",
+          runtimeName: "paperclip",
+          source: coordinationSource,
+        },
+        {
+          key: "paperclipai/paperclip/para-memory-files",
+          runtimeName: "para-memory-files",
+          source: memorySource,
+        },
+      ],
+    } as Record<string, unknown>;
+  }
+
+  it("includes the paperclip-create-agent skill when the agent can hire", async () => {
+    const config = await makeConfigWithSkills();
+    const dir = await buildOpenCodeSkillsDir(config, { canCreateAgents: true });
+    cleanupDirs.push(path.dirname(dir));
+    const entries = await readdir(dir);
+    expect(entries).toContain("paperclip-create-agent");
+  });
+
+  it("excludes the paperclip-create-agent skill when the agent cannot hire", async () => {
+    const config = await makeConfigWithSkills();
+    const dir = await buildOpenCodeSkillsDir(config, { canCreateAgents: false });
+    cleanupDirs.push(path.dirname(dir));
+    const entries = await readdir(dir);
+    expect(entries).not.toContain("paperclip-create-agent");
+  });
+
+  // Managed agents run instruction bundles (ceo/AGENTS.md, HEARTBEAT.md) that
+  // MANDATE the coordination (`paperclip`) and memory (`para-memory-files`)
+  // skills. Those skills are never in a managed agent's explicit desiredSkills,
+  // so they must be force-included whenever the agent is managed.
+  it("includes coordination + memory + create-agent skills for a managed agent that can hire", async () => {
+    const config = await makeConfigWithSkills();
+    const dir = await buildOpenCodeSkillsDir(config, {
+      canCreateAgents: true,
+      managed: true,
+    });
+    cleanupDirs.push(path.dirname(dir));
+    const entries = await readdir(dir);
+    expect(entries).toContain("paperclip");
+    expect(entries).toContain("para-memory-files");
+    expect(entries).toContain("paperclip-create-agent");
+  });
+
+  it("includes coordination + memory but NOT create-agent for a managed agent that cannot hire", async () => {
+    const config = await makeConfigWithSkills();
+    const dir = await buildOpenCodeSkillsDir(config, {
+      canCreateAgents: false,
+      managed: true,
+    });
+    cleanupDirs.push(path.dirname(dir));
+    const entries = await readdir(dir);
+    expect(entries).toContain("paperclip");
+    expect(entries).toContain("para-memory-files");
+    expect(entries).not.toContain("paperclip-create-agent");
+  });
+
+  it("does NOT force coordination/memory skills on a non-managed (BYO) agent", async () => {
+    const config = await makeConfigWithSkills();
+    const dir = await buildOpenCodeSkillsDir(config, {
+      canCreateAgents: false,
+      managed: false,
+    });
+    cleanupDirs.push(path.dirname(dir));
+    const entries = await readdir(dir);
+    expect(entries).not.toContain("paperclip");
+    expect(entries).not.toContain("para-memory-files");
+    expect(entries).not.toContain("paperclip-create-agent");
+  });
+});
+
 describe("OpenCode local skill injection", () => {
   it("injects runtime skills into the configured child HOME", async () => {
     const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-opencode-configured-home-"));

packages/adapters/opencode-local/src/server/execute.ts

@@ -59,7 +59,7 @@ import {
   isPaperclipSkillSourceMissing,
   readPaperclipRuntimeSkillEntries,
   readPaperclipIssueWorkModeFromContext,
-  resolveLegacyPaperclipDesiredSkillNames,
+  resolvePaperclipDesiredSkillNames,
   PAPERCLIP_CREATE_AGENT_SKILL_KEY,
   PAPERCLIP_COORDINATION_SKILL_KEY,
   PARA_MEMORY_FILES_SKILL_KEY,
@@ -224,12 +224,54 @@ async function ensureOpenCodeSkillsInjected(
   }
 }
 
-async function buildOpenCodeSkillsDir(config: Record<string, unknown>): Promise<string> {
+/**
+ * Managed-instruction agents (the seeded CEO + hired reports) mandate the
+ * coordination + memory skills in their templates, so those skills must be
+ * force-mounted for managed agents. BYO/external-instruction agents are left
+ * untouched.
+ */
+function agentUsesManagedInstructions(agent: AdapterExecutionContext["agent"]): boolean {
+  const adapterConfig = agent.adapterConfig;
+  if (typeof adapterConfig !== "object" || adapterConfig === null) return false;
+  return (adapterConfig as Record<string, unknown>).instructionsBundleMode === "managed";
+}
+
+/**
+ * Skills that must be mounted for this agent regardless of its explicit
+ * desiredSkills configuration:
+ * - An agent that can hire (`canCreateAgents`) needs the create-agent skill so
+ *   it has the hire-flow instructions in its sandbox.
+ * - A managed agent (`managed`) is instructed by its bundle to use the
+ *   coordination (`paperclip`) and memory (`para-memory-files`) skills, so both
+ *   must be present even though managed agents carry no explicit desiredSkills.
+ */
+function alwaysIncludeSkillKeysForAgent(opts?: {
+  canCreateAgents?: boolean;
+  managed?: boolean;
+}): string[] {
+  const keys: string[] = [];
+  if (opts?.managed) {
+    keys.push(PAPERCLIP_COORDINATION_SKILL_KEY, PARA_MEMORY_FILES_SKILL_KEY);
+  }
+  if (opts?.canCreateAgents) {
+    keys.push(PAPERCLIP_CREATE_AGENT_SKILL_KEY);
+  }
+  return keys;
+}
+
+export async function buildOpenCodeSkillsDir(
+  config: Record<string, unknown>,
+  opts?: { canCreateAgents?: boolean; managed?: boolean },
+): Promise<string> {
   const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-opencode-skills-"));
   const target = path.join(tmp, "skills");
   await fs.mkdir(target, { recursive: true });
   const availableEntries = await readPaperclipRuntimeSkillEntries(config, __moduleDir);
-  const desiredNames = new Set(resolveLegacyPaperclipDesiredSkillNames(config, availableEntries));
+  const desiredNames = new Set(
+    resolvePaperclipDesiredSkillNames(config, availableEntries, {
+      alwaysIncludeSkillKeys: alwaysIncludeSkillKeysForAgent(opts),
+    }),
+  );
   for (const entry of availableEntries) {
     if (!desiredNames.has(entry.key)) continue;
     if (isPaperclipSkillSourceMissing(entry)) continue;
@@ -298,7 +340,12 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
   let effectiveExecutionCwd = adapterExecutionTargetRemoteCwd(executionTarget, cwd);
   await ensureAbsoluteDirectory(cwd, { createIfMissing: true });
   const openCodeSkillEntries = await readPaperclipRuntimeSkillEntries(config, __moduleDir);
-  const desiredOpenCodeSkillNames = resolveLegacyPaperclipDesiredSkillNames(config, openCodeSkillEntries);
+  const desiredOpenCodeSkillNames = resolvePaperclipDesiredSkillNames(config, openCodeSkillEntries, {
+    alwaysIncludeSkillKeys: alwaysIncludeSkillKeysForAgent({
+      canCreateAgents: Boolean(agent.permissions?.canCreateAgents),
+      managed: agentUsesManagedInstructions(agent),
+    }),
+  });
   if (!executionTargetIsRemote) {
     await ensureOpenCodeSkillsInjected(
       onLog,

server/src/app.ts

@@ -426,18 +426,17 @@ export async function createApp(
       deploymentExposure: opts.deploymentExposure,
       authReady: opts.authReady,
       companyDeletionEnabled: opts.companyDeletionEnabled,
-      databaseBackupHealth: opts.databaseBackupHealth,
     }),
   );
   api.use(openApiRoutes());
   api.use("/cloud", cloudRoutes());
   api.use("/companies", companyRoutes(db, opts.storageService));
   api.use(llmRoutes(db));
   api.use(folderRoutes(db));
-  api.use(companySkillRoutes(db));
+  api.use(companySkillRoutes(db, { pluginWorkerManager: workerManager }));
   api.use(companySkillPolicyRoutes(db));
   api.use(inboxAgentPolicyRoutes(db));
-  api.use(builtInAgentRoutes(db));
+  api.use(builtInAgentRoutes(db, { pluginWorkerManager: workerManager }));
   api.use(summarySlotRoutes(db));
   api.use(statusCardRoutes(db));
   api.use(teamsCatalogRoutes(db));

server/src/index.ts

@@ -60,6 +60,7 @@ import {
   issueService,
   instanceSettingsService,
   reconcileBuiltInAgentsOnStartup,
+  reconcileCloudUpstreamRunsOnStartup,
   reconcileCodexLocalManagedHomesOnStartup,
   reconcilePersistedRuntimeServicesOnStartup,
   routineService,
@@ -942,6 +943,19 @@ export async function startServer(): Promise<StartedServer> {
       logger.error({ err }, "startup reconciliation of persisted runtime services failed");
     });
 
+  void reconcileCloudUpstreamRunsOnStartup(db as any)
+    .then((result) => {
+      if (result.reconciled > 0) {
+        logger.warn(
+          { reconciled: result.reconciled },
+          "reconciled cloud upstream runs from a previous server process",
+        );
+      }
+    })
+    .catch((err) => {
+      logger.error({ err }, "startup reconciliation of cloud upstream runs failed");
+    });
+
   // Backfill auth.json into any already-isolated codex_local managed home that
   // was created by the #8272 isolation guard before the Phase 1 seeding fix.
   // Idempotent; the Phase 1 execute-time seeding covers new strandings.
@@ -1025,15 +1039,15 @@ export async function startServer(): Promise<StartedServer> {
       logger.warn(managedEnvironmentsResult, "managed sandbox environments ensured from managed config");
     }
   } catch (err) {
-    const heartbeatMaxQueuedRunAgeMs = Math.max(
-      1,
-      Number(process.env.PAPERCLIP_HEARTBEAT_MAX_QUEUED_RUN_AGE_MS) || 24 * 60 * 60 * 1000,
-    );
-
     logger.error({ err }, "failed to apply managed environments from managed config");
     throw err;
   }
 
+  const heartbeatMaxQueuedRunAgeMs = Math.max(
+    1,
+    Number(process.env.PAPERCLIP_HEARTBEAT_MAX_QUEUED_RUN_AGE_MS) || 24 * 60 * 60 * 1000,
+  );
+
   let drainHeartbeatRunsForShutdown: ((
     signal: "SIGINT" | "SIGTERM",
     runIds?: readonly string[] | null,

server/src/middleware/auth.ts

@@ -487,7 +487,6 @@ export function cloudActorHeaderSourceFromHeaders(
       const value = headers[name.toLowerCase()];
       return Array.isArray(value) ? value[0] : value;
     },
-    cloudStack: { stackId, stackRole, ...(stackSlug ? { stackSlug } : {}) },
   };
 }
 
@@ -709,14 +708,6 @@ function constantTimeStringEqual(left: string, right: string): boolean {
   return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
 }
 
-function cloudTenantCompanyId(stackId: string): string {
-  const bytes = createHash("sha256").update(`paperclip-cloud-tenant-company:${stackId}`).digest();
-  bytes[6] = (bytes[6] & 0x0f) | 0x50;
-  bytes[8] = (bytes[8] & 0x3f) | 0x80;
-  const hex = bytes.subarray(0, 16).toString("hex");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-
 export function humanizeCloudStackSlug(stackId: string): string {
   const slug = stackId
     .trim()

server/src/routes/agents.ts

@@ -73,7 +73,6 @@ import {
   collectAgentAdapterWorkspaceCommandPaths,
 } from "./workspace-command-authz.js";
 import type { PluginWorkerManager } from "../services/plugin-worker-manager.js";
-  listServerAdapters,
 import { environmentService } from "../services/environments.js";
 import { resolveEnvironmentExecutionTarget } from "../services/environment-execution-target.js";
 import { environmentRuntimeService } from "../services/environment-runtime.js";
@@ -84,7 +83,6 @@ import type {
   AdapterEnvironmentTestResult,
   AdapterModelProfileDefinition,
 } from "@paperclipai/adapter-utils";
-import { getDisabledAdapterTypes } from "../services/adapter-plugin-store.js";
 import { skillVersionSelectionMap } from "../services/runtime-skill-selections.js";
 import { secretService } from "../services/secrets.js";
 import { authorizationDeniedDetails } from "../services/authorization.js";

server/src/routes/companies.ts

@@ -24,14 +24,14 @@ import {
   feedbackVoteValueSchema,
   hidesCompanyPage,
   updateCompanyBrandingSchema,
+  updateCompanySchema,
+} from "@paperclipai/shared";
 import {
   canCreateStackCompany,
   cloudTenantCompanyId,
   isCompanyIdConflict,
   withCloudStackSlugAlias,
 } from "../services/cloud-tenant-company.js";
-  updateCompanySchema,
-} from "@paperclipai/shared";
 import {
   COMPANY_IMPORT_TRANSFERS_ROUTE_PATH,
   companyImportTransferDeclarationSchema,

server/src/routes/health.ts

@@ -264,23 +264,14 @@ export function healthRoutes(
         })
       : null;
 
-    const databaseBackup = opts.databaseBackupHealth
-      ? inspectDatabaseBackupHealth(opts.databaseBackupHealth)
-      : undefined;
-    const warnings = databaseBackup?.warnings.length ? databaseBackup.warnings : undefined;
-
     if (!exposeFullDetails) {
-      const redactedDatabaseBackup = databaseBackup ? redactedDatabaseBackupHealth(databaseBackup) : undefined;
-      const redactedWarnings = redactedDatabaseBackup?.warnings.length ? redactedDatabaseBackup.warnings : undefined;
       res.json({
         status: "ok",
         deploymentMode: opts.deploymentMode,
         deploymentExposure: opts.deploymentExposure,
         commit,
         bootstrapStatus,
         bootstrapInviteActive,
-        ...(redactedDatabaseBackup ? { databaseBackup: redactedDatabaseBackup } : {}),
-        ...(redactedWarnings ? { warnings: redactedWarnings } : {}),
         ...(devServer ? { devServer } : {}),
         // Token-authorized probe on an otherwise redacted response: the control
         // plane needs readiness without a board session, and nothing else about