Address built-in agent review feedback

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/built-in-agent-routes.test.ts

@@ -115,6 +115,7 @@ describe("built-in agent routes", () => {
     expect(res.status, JSON.stringify(res.body)).toBe(200);
     expect(mockBuiltInAgentService.list).toHaveBeenCalledWith(companyId);
     expect(res.body).toEqual([expect.objectContaining({ status: "ready", agentId })]);
+    expect(res.body[0].agent.adapterConfig).toEqual({});
   });
 
   it("denies list requests outside the actor company boundary", async () => {
@@ -143,7 +144,7 @@ describe("built-in agent routes", () => {
 
     const res = await request(app)
       .post(`/api/companies/${companyId}/built-in-agents/briefs/provision`)
-      .send({ adapterType: "codex_local", adapterConfig: { model: "gpt-5.4" } });
+      .send({ adapterType: "codex_local", adapterConfig: { model: "gpt-5.4" }, budgetMonthlyCents: 5000 });
 
     expect(res.status, JSON.stringify(res.body)).toBe(200);
     expect(mockAccessService.decide).toHaveBeenCalledWith({
@@ -157,6 +158,7 @@ describe("built-in agent routes", () => {
       {
         adapterType: "codex_local",
         adapterConfig: { model: "gpt-5.4" },
+        budgetMonthlyCents: 5000,
       },
       { requestedByAgentId: null, requestedByUserId: "board-user" },
     );

server/src/__tests__/built-in-agents.test.ts

@@ -6,6 +6,7 @@ import {
   agentConfigRevisions,
   agents,
   approvals,
+  budgetPolicies,
   companies,
   createDb,
 } from "@paperclipai/db";
@@ -52,6 +53,7 @@ describeEmbeddedPostgres("built-in agents", () => {
     await db.delete(activityLog);
     await db.delete(approvals);
     await db.delete(agents);
+    await db.delete(budgetPolicies);
     await db.delete(companies);
   });
 
@@ -142,6 +144,7 @@ describeEmbeddedPostgres("built-in agents", () => {
     const result = await builtIns.provision(companyId, "briefs", {
       adapterType: "process",
       adapterConfig: { command: "echo safe" },
+      budgetMonthlyCents: 5000,
     }, { requestedByUserId: "board-user" });
 
     expect(result.state).toMatchObject({
@@ -152,6 +155,7 @@ describeEmbeddedPostgres("built-in agents", () => {
         status: "pending_approval",
         adapterType: "process",
         adapterConfig: { command: "echo safe" },
+        budgetMonthlyCents: 5000,
       },
     });
     expect(result.approval).toMatchObject({
@@ -165,6 +169,7 @@ describeEmbeddedPostgres("built-in agents", () => {
         role: "general",
         adapterType: "process",
         adapterConfig: { command: "echo safe" },
+        budgetMonthlyCents: 5000,
         agentId: result.state.agentId,
         sourceBuiltInAgentKey: "briefs",
         featureKeys: ["briefs"],
@@ -205,7 +210,7 @@ describeEmbeddedPostgres("built-in agents", () => {
     await expect(builtIns.get(companyId, "briefs")).resolves.toMatchObject({
       status: "ready",
       agentId: result.state.agentId,
-      agent: { status: "idle", adapterType: "process", adapterConfig: { command: "echo safe" } },
+      agent: { status: "idle", adapterType: "process", adapterConfig: { command: "echo safe" }, budgetMonthlyCents: 5000 },
     });
   });
 

server/src/routes/built-in-agents.ts

@@ -7,6 +7,19 @@ import { accessService, logActivity } from "../services/index.js";
 import { builtInAgentService } from "../services/built-in-agents.js";
 import { authorizationDeniedDetails } from "../services/authorization.js";
 import { assertCompanyAccess, getActorInfo } from "./authz.js";
+import type { BuiltInAgentState } from "../services/built-in-agents.js";
+
+function redactBuiltInAgentListState(state: BuiltInAgentState): BuiltInAgentState {
+  if (!state.agent) return state;
+  return {
+    ...state,
+    agent: {
+      ...state.agent,
+      adapterConfig: {},
+      runtimeConfig: {},
+    },
+  };
+}
 
 export function builtInAgentRoutes(db: Db) {
   const router = Router();
@@ -56,7 +69,8 @@ export function builtInAgentRoutes(db: Db) {
   router.get("/companies/:companyId/built-in-agents", async (req, res) => {
     const companyId = req.params.companyId as string;
     assertCompanyAccess(req, companyId);
-    res.json(await svc.list(companyId));
+    const states = await svc.list(companyId);
+    res.json(states.map(redactBuiltInAgentListState));
   });
 
   router.post(

server/src/services/built-in-agents.ts

@@ -35,6 +35,7 @@ export interface BuiltInAgentState {
 export interface BuiltInAgentProvisionInput {
   adapterType?: string;
   adapterConfig?: Record<string, unknown>;
+  budgetMonthlyCents?: number;
 }
 
 export interface BuiltInAgentProvisionActor {
@@ -224,7 +225,7 @@ function definitionPatch(definition: BuiltInAgentDefinition, input: BuiltInAgent
     capabilities: definition.shortPurpose,
     adapterType,
     adapterConfig: input.adapterConfig ?? {},
-    budgetMonthlyCents: definition.defaultBudgetMonthlyCents ?? 0,
+    budgetMonthlyCents: input.budgetMonthlyCents ?? definition.defaultBudgetMonthlyCents ?? 0,
   };
 }
 
@@ -314,6 +315,9 @@ export function builtInAgentService(db: Db) {
         patch.adapterType = adapterType;
         patch.adapterConfig = input.adapterConfig ?? existing.adapterConfig;
       }
+      if (input.budgetMonthlyCents !== undefined) {
+        patch.budgetMonthlyCents = input.budgetMonthlyCents;
+      }
       const updated = await agentSvc.update(existing.id, patch, {
         allowBuiltInAgentMetadata: true,
         recordRevision: { source: "built-in-agent:ensure" },