Merge remote-tracking branch 'origin/master' into PAP-11173-conference-room-work

# Conflicts:
#	packages/adapter-utils/src/server-utils.ts
#	packages/db/src/migrations/meta/_journal.json
#	packages/shared/src/constants.ts
#	packages/shared/src/index.ts
#	packages/skills-catalog/generated/catalog.json
#	server/src/__tests__/adapter-registry.test.ts
#	server/src/__tests__/agent-live-run-routes.test.ts
#	server/src/__tests__/issues-service.test.ts
#	server/src/adapters/registry.ts
#	server/src/routes/issues.ts
#	server/src/services/document-annotations.ts
#	server/src/services/heartbeat.ts
#	server/src/services/issues.ts
#	server/src/services/routines.ts
#	ui/src/components/IssueChatThread.tsx
#	ui/src/components/IssueChatThreadClassic.tsx
#	ui/src/components/IssueProperties.test.tsx
#	ui/src/components/IssueProperties.tsx
#	ui/src/components/MarkdownBody.tsx
#	ui/src/components/Sidebar.test.tsx
#	ui/src/components/routine-sections/editable-sections.tsx
#	ui/src/context/LiveUpdatesProvider.tsx
#	ui/src/lib/queryKeys.ts
#	ui/src/pages/BoardChat.tsx

packages/shared/src/validators/adapter-skills.ts

@@ -11,7 +11,6 @@ export const agentSkillStateSchema = z.enum([
 
 export const agentSkillOriginSchema = z.enum([
   "company_managed",
-  "paperclip_required",
   "user_installed",
   "external_unknown",
 ]);
@@ -39,8 +38,6 @@ export const agentSkillEntrySchema = z.object({
   currentVersionId: z.string().uuid().nullable().optional(),
   desired: z.boolean(),
   managed: z.boolean(),
-  required: z.boolean().optional(),
-  requiredReason: z.string().nullable().optional(),
   state: agentSkillStateSchema,
   origin: agentSkillOriginSchema.optional(),
   originLabel: z.string().nullable().optional(),

packages/shared/src/validators/agent.ts

@@ -12,6 +12,7 @@ import { agentDesiredSkillSelectionSchema } from "./adapter-skills.js";
 
 export const agentPermissionsSchema = z.object({
   canCreateAgents: z.boolean().optional().default(false),
+  canCreateSkills: z.boolean().optional().default(true),
   trustPreset: trustPresetSchema.optional(),
   authorizationPolicy: trustAuthorizationPolicySchema.optional(),
 }).catchall(z.unknown());
@@ -113,8 +114,45 @@ export const updateAgentInstructionsPathSchema = z.object({
 
 export type UpdateAgentInstructionsPath = z.infer<typeof updateAgentInstructionsPathSchema>;
 
+export const taskBridgeAgentKeyScopeSchema = z.object({
+  kind: z.literal("task_bridge"),
+  projectId: z.string().uuid().optional().nullable(),
+  projectIds: z.array(z.string().uuid()).max(50).optional(),
+  parentIssueId: z.string().uuid().optional().nullable(),
+  parentIssueIds: z.array(z.string().uuid()).max(50).optional(),
+  allowedAssigneeAgentIds: z.array(z.string().uuid()).max(50).optional(),
+}).strict().superRefine((value, ctx) => {
+  const hasProjectBoundary = Boolean(value.projectId) || Boolean(value.projectIds?.length);
+  const hasParentBoundary = Boolean(value.parentIssueId) || Boolean(value.parentIssueIds?.length);
+  if (!hasProjectBoundary && !hasParentBoundary) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "task_bridge keys require at least one project or parent issue boundary",
+      path: ["projectId"],
+    });
+  }
+});
+
+export const standardAgentKeyScopeSchema = z.object({
+  kind: z.literal("standard"),
+}).strict();
+
+export const agentApiKeyScopeSchema = z.union([
+  standardAgentKeyScopeSchema,
+  taskBridgeAgentKeyScopeSchema,
+]);
+
+export type AgentApiKeyScope = z.infer<typeof agentApiKeyScopeSchema>;
+export type TaskBridgeAgentKeyScope = z.infer<typeof taskBridgeAgentKeyScopeSchema>;
+
+export function normalizeAgentApiKeyScope(value: unknown): AgentApiKeyScope {
+  const parsed = agentApiKeyScopeSchema.safeParse(value);
+  return parsed.success ? parsed.data : { kind: "standard" };
+}
+
 export const createAgentKeySchema = z.object({
   name: z.string().min(1).default("default"),
+  scope: agentApiKeyScopeSchema.optional().default({ kind: "standard" }),
 });
 
 export type CreateAgentKey = z.infer<typeof createAgentKeySchema>;
@@ -161,6 +199,7 @@ export type TestAdapterEnvironment = z.infer<typeof testAdapterEnvironmentSchema
 
 export const updateAgentPermissionsSchema = z.object({
   canCreateAgents: z.boolean(),
+  canCreateSkills: z.boolean().optional(),
   canAssignTasks: z.boolean(),
   trustPreset: trustPresetSchema.optional(),
   authorizationPolicy: trustAuthorizationPolicySchema.optional(),

packages/shared/src/validators/environment-custom-images.ts

@@ -0,0 +1,97 @@
+import { z } from "zod";
+import {
+  ENVIRONMENT_CUSTOM_IMAGE_SETUP_CONNECTION_TYPES,
+  ENVIRONMENT_CUSTOM_IMAGE_SETUP_SESSION_STATUSES,
+  ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_KINDS,
+  ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_STATUSES,
+} from "../constants.js";
+
+const isoDateTime = z.union([z.date(), z.string().datetime()]);
+const providerKeySchema = z.string().min(1).max(200);
+const optionalRecordSchema = z.record(z.string(), z.unknown()).optional().nullable();
+
+export const environmentCustomImageTemplateKindSchema = z.enum(ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_KINDS);
+export const environmentCustomImageTemplateStatusSchema = z.enum(ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_STATUSES);
+export const environmentCustomImageSetupSessionStatusSchema = z.enum(
+  ENVIRONMENT_CUSTOM_IMAGE_SETUP_SESSION_STATUSES,
+);
+export const environmentCustomImageSetupConnectionTypeSchema = z.enum(
+  ENVIRONMENT_CUSTOM_IMAGE_SETUP_CONNECTION_TYPES,
+);
+
+export const environmentCustomImageSetupConnectionSummarySchema = z.object({
+  type: environmentCustomImageSetupConnectionTypeSchema,
+  username: z.string().min(1).max(200).optional().nullable(),
+  hostRedacted: z.literal(true).optional().default(true),
+  portRedacted: z.literal(true).optional().default(true),
+  label: z.string().min(1).max(200).optional().nullable(),
+  instructions: z.string().min(1).max(1000).optional().nullable(),
+}).strict();
+export type EnvironmentCustomImageSetupConnectionSummary =
+  z.infer<typeof environmentCustomImageSetupConnectionSummarySchema>;
+
+export const environmentCustomImageTemplateSchema = z.object({
+  id: z.string().uuid(),
+  companyId: z.string().uuid(),
+  environmentId: z.string().uuid(),
+  provider: providerKeySchema,
+  templateKind: environmentCustomImageTemplateKindSchema,
+  templateRef: z.string().min(1).nullable(),
+  sourceTemplateRef: z.string().min(1).nullable(),
+  sourceEnvironmentConfigFingerprint: z.string().min(1).nullable(),
+  status: environmentCustomImageTemplateStatusSchema,
+  createdByUserId: z.string().min(1).nullable(),
+  createdByAgentId: z.string().uuid().nullable(),
+  capturedAt: isoDateTime.nullable(),
+  lastUsedAt: isoDateTime.nullable(),
+  supersededByTemplateId: z.string().uuid().nullable(),
+  metadata: optionalRecordSchema,
+  createdAt: isoDateTime,
+  updatedAt: isoDateTime,
+}).strict();
+export type EnvironmentCustomImageTemplate =
+  z.infer<typeof environmentCustomImageTemplateSchema>;
+
+export const environmentCustomImageSetupSessionSchema = z.object({
+  id: z.string().uuid(),
+  companyId: z.string().uuid(),
+  environmentId: z.string().uuid(),
+  templateId: z.string().uuid().nullable(),
+  promotedTemplateId: z.string().uuid().nullable(),
+  provider: providerKeySchema,
+  providerLeaseId: z.string().min(1).nullable(),
+  environmentLeaseId: z.string().uuid().nullable(),
+  status: environmentCustomImageSetupSessionStatusSchema,
+  startedByUserId: z.string().min(1).nullable(),
+  startedByAgentId: z.string().uuid().nullable(),
+  baseTemplateRef: z.string().min(1).nullable(),
+  expiresAt: isoDateTime.nullable(),
+  finishedAt: isoDateTime.nullable(),
+  failureReason: z.string().min(1).nullable(),
+  connectionSummary: environmentCustomImageSetupConnectionSummarySchema.nullable(),
+  connectionSecretRef: z.string().min(1).nullable(),
+  metadata: optionalRecordSchema,
+  createdAt: isoDateTime,
+  updatedAt: isoDateTime,
+}).strict();
+export type EnvironmentCustomImageSetupSession =
+  z.infer<typeof environmentCustomImageSetupSessionSchema>;
+
+export const startEnvironmentCustomImageSetupSessionSchema = z.object({
+  templateId: z.string().uuid().optional().nullable(),
+  ttlSeconds: z.number().int().min(60).max(24 * 60 * 60).optional(),
+}).strict();
+export type StartEnvironmentCustomImageSetupSession =
+  z.infer<typeof startEnvironmentCustomImageSetupSessionSchema>;
+
+export const finishEnvironmentCustomImageSetupSessionSchema = z.object({
+  metadata: z.record(z.string(), z.unknown()).optional(),
+}).strict();
+export type FinishEnvironmentCustomImageSetupSession =
+  z.infer<typeof finishEnvironmentCustomImageSetupSessionSchema>;
+
+export const cancelEnvironmentCustomImageSetupSessionSchema = z.object({
+  reason: z.string().min(1).max(1000).optional(),
+}).strict();
+export type CancelEnvironmentCustomImageSetupSession =
+  z.infer<typeof cancelEnvironmentCustomImageSetupSessionSchema>;

packages/shared/src/validators/environment.ts

@@ -5,6 +5,7 @@ import {
   ENVIRONMENT_LEASE_STATUSES,
   ENVIRONMENT_STATUSES,
 } from "../constants.js";
+import { envConfigSchema } from "./secret.js";
 
 export const environmentDriverSchema = z.enum(ENVIRONMENT_DRIVERS);
 export const environmentStatusSchema = z.enum(ENVIRONMENT_STATUSES);
@@ -17,6 +18,7 @@ const environmentFields = {
   driver: environmentDriverSchema,
   status: environmentStatusSchema.optional().default("active"),
   config: z.record(z.string(), z.unknown()).optional().default({}),
+  envVars: envConfigSchema.optional().default({}),
   metadata: z.record(z.string(), z.unknown()).optional().nullable(),
 };
 
@@ -29,6 +31,7 @@ export const updateEnvironmentSchema = z.object({
   driver: environmentDriverSchema.optional(),
   status: environmentStatusSchema.optional(),
   config: z.record(z.string(), z.unknown()).optional(),
+  envVars: envConfigSchema.optional(),
   metadata: z.record(z.string(), z.unknown()).optional().nullable(),
 }).strict();
 export type UpdateEnvironment = z.infer<typeof updateEnvironmentSchema>;
@@ -38,6 +41,7 @@ export const probeEnvironmentConfigSchema = z.object({
   description: z.string().optional().nullable(),
   driver: environmentDriverSchema,
   config: z.record(z.string(), z.unknown()).optional().default({}),
+  envVars: envConfigSchema.optional().default({}),
   metadata: z.record(z.string(), z.unknown()).optional().nullable(),
 }).strict();
 export type ProbeEnvironmentConfig = z.infer<typeof probeEnvironmentConfigSchema>;

packages/shared/src/validators/execution-workspace.ts

@@ -1,4 +1,8 @@
 import { z } from "zod";
+import {
+  WORKSPACE_OVERVIEW_DEFAULT_LIMIT,
+  WORKSPACE_OVERVIEW_MAX_LIMIT,
+} from "../constants.js";
 
 export const executionWorkspaceStatusSchema = z.enum([
   "active",
@@ -8,6 +12,23 @@ export const executionWorkspaceStatusSchema = z.enum([
   "cleanup_failed",
 ]);
 
+const workspaceOverviewStatusFilterSchema = z.preprocess((value) => {
+  if (value === undefined || value === null) return undefined;
+  const rawValues = Array.isArray(value) ? value : [value];
+  const statuses = rawValues.flatMap((entry) => {
+    if (typeof entry !== "string") return [];
+    return entry.split(",").map((part) => part.trim()).filter(Boolean);
+  });
+  return statuses.length > 0 ? statuses : undefined;
+}, z.array(executionWorkspaceStatusSchema).optional());
+
+export const workspaceOverviewQuerySchema = z.object({
+  projectId: z.string().uuid().optional(),
+  status: workspaceOverviewStatusFilterSchema,
+  limit: z.coerce.number().int().min(1).max(WORKSPACE_OVERVIEW_MAX_LIMIT).optional().default(WORKSPACE_OVERVIEW_DEFAULT_LIMIT),
+  offset: z.coerce.number().int().min(0).optional().default(0),
+}).strict();
+
 export const executionWorkspaceConfigSchema = z.object({
   environmentId: z.string().uuid().optional().nullable(),
   provisionCommand: z.string().optional().nullable(),
@@ -129,3 +150,4 @@ export const updateExecutionWorkspaceSchema = z.object({
 }).strict();
 
 export type UpdateExecutionWorkspace = z.infer<typeof updateExecutionWorkspaceSchema>;
+export type WorkspaceOverviewQuery = z.infer<typeof workspaceOverviewQuerySchema>;

packages/shared/src/validators/external-object.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+import {
+  EXTERNAL_OBJECT_LIVENESS_STATES,
+  EXTERNAL_OBJECT_MENTION_CONFIDENCES,
+  EXTERNAL_OBJECT_MENTION_SOURCE_KINDS,
+  EXTERNAL_OBJECT_STATUS_CATEGORIES,
+  EXTERNAL_OBJECT_STATUS_TONES,
+} from "../constants.js";
+
+export const externalObjectStatusCategorySchema = z.enum(EXTERNAL_OBJECT_STATUS_CATEGORIES);
+export const externalObjectStatusToneSchema = z.enum(EXTERNAL_OBJECT_STATUS_TONES);
+export const externalObjectLivenessStateSchema = z.enum(EXTERNAL_OBJECT_LIVENESS_STATES);
+export const externalObjectMentionSourceKindSchema = z.enum(EXTERNAL_OBJECT_MENTION_SOURCE_KINDS);
+export const externalObjectMentionConfidenceSchema = z.enum(EXTERNAL_OBJECT_MENTION_CONFIDENCES);
+export const externalObjectProviderKeySchema = z.string().trim().min(1).max(80).regex(/^[a-z][a-z0-9_.-]*$/);
+export const externalObjectTypeSchema = z.string().trim().min(1).max(80).regex(/^[a-z][a-z0-9_]*$/);
+
+export const externalObjectCanonicalIdentitySchema = z
+  .object({
+    scheme: z.enum(["http", "https"]),
+    host: z.string().trim().min(1),
+    path: z.string().trim().min(1),
+    queryParamHashes: z.record(z.string().regex(/^[a-f0-9]{64}$/)).optional(),
+  })
+  .strict();
+
+export const externalObjectMentionSourceSchema = z
+  .object({
+    sourceKind: externalObjectMentionSourceKindSchema,
+    documentKey: z.string().trim().min(1).optional().nullable(),
+    propertyKey: z.string().trim().min(1).optional().nullable(),
+  })
+  .strict();
+
+export type ExternalObjectCanonicalIdentityInput = z.infer<typeof externalObjectCanonicalIdentitySchema>;
+export type ExternalObjectMentionSourceInput = z.infer<typeof externalObjectMentionSourceSchema>;
+export type ExternalObjectProviderKeyInput = z.infer<typeof externalObjectProviderKeySchema>;
+export type ExternalObjectTypeInput = z.infer<typeof externalObjectTypeSchema>;

packages/shared/src/validators/index.ts

@@ -1,13 +1,16 @@
 export {
+  instanceSettingsSchema,
   instanceGeneralSettingsSchema,
   patchInstanceGeneralSettingsSchema,
   type InstanceGeneralSettings,
   type PatchInstanceGeneralSettings,
   instanceExperimentalSettingsSchema,
   patchInstanceExperimentalSettingsSchema,
+  patchInstanceSettingsSchema,
   issueGraphLivenessAutoRecoveryRequestSchema,
   type InstanceExperimentalSettings,
   type PatchInstanceExperimentalSettings,
+  type PatchInstanceSettings,
   type IssueGraphLivenessAutoRecoveryRequest,
 } from "./instance.js";
 
@@ -38,6 +41,24 @@ export {
   type UpdateEnvironment,
   type ProbeEnvironmentConfig,
 } from "./environment.js";
+export {
+  environmentCustomImageTemplateKindSchema,
+  environmentCustomImageTemplateStatusSchema,
+  environmentCustomImageSetupSessionStatusSchema,
+  environmentCustomImageSetupConnectionTypeSchema,
+  environmentCustomImageSetupConnectionSummarySchema,
+  environmentCustomImageTemplateSchema,
+  environmentCustomImageSetupSessionSchema,
+  startEnvironmentCustomImageSetupSessionSchema,
+  finishEnvironmentCustomImageSetupSessionSchema,
+  cancelEnvironmentCustomImageSetupSessionSchema,
+  type EnvironmentCustomImageSetupConnectionSummary,
+  type EnvironmentCustomImageTemplate,
+  type EnvironmentCustomImageSetupSession,
+  type StartEnvironmentCustomImageSetupSession,
+  type FinishEnvironmentCustomImageSetupSession,
+  type CancelEnvironmentCustomImageSetupSession,
+} from "./environment-custom-images.js";
 export {
   feedbackDataSharingPreferenceSchema,
   feedbackTargetTypeSchema,
@@ -56,6 +77,22 @@ export {
   updateResourceMembershipSchema,
   type UpdateResourceMembership,
 } from "./resource-memberships.js";
+
+export {
+  externalObjectStatusCategorySchema,
+  externalObjectStatusToneSchema,
+  externalObjectLivenessStateSchema,
+  externalObjectMentionSourceKindSchema,
+  externalObjectMentionConfidenceSchema,
+  externalObjectProviderKeySchema,
+  externalObjectTypeSchema,
+  externalObjectCanonicalIdentitySchema,
+  externalObjectMentionSourceSchema,
+  type ExternalObjectCanonicalIdentityInput,
+  type ExternalObjectMentionSourceInput,
+  type ExternalObjectProviderKeyInput,
+  type ExternalObjectTypeInput,
+} from "./external-object.js";
 export {
   companySkillSourceTypeSchema,
   companySkillTrustLevelSchema,
@@ -188,6 +225,10 @@ export {
   updateAgentInstructionsBundleSchema,
   upsertAgentInstructionsFileSchema,
   updateAgentInstructionsPathSchema,
+  agentApiKeyScopeSchema,
+  normalizeAgentApiKeyScope,
+  standardAgentKeyScopeSchema,
+  taskBridgeAgentKeyScopeSchema,
   createAgentKeySchema,
   agentMineInboxQuerySchema,
   wakeAgentSchema,
@@ -201,6 +242,8 @@ export {
   type UpdateAgentInstructionsBundle,
   type UpsertAgentInstructionsFile,
   type UpdateAgentInstructionsPath,
+  type AgentApiKeyScope,
+  type TaskBridgeAgentKeyScope,
   type CreateAgentKey,
   type AgentMineInboxQuery,
   type WakeAgent,
@@ -296,6 +339,7 @@ export {
   issueDocumentKeySchema,
   upsertIssueDocumentSchema,
   restoreIssueDocumentRevisionSchema,
+  upsertIssueWatchdogSchema,
   type CreateIssue,
   type CreateChildIssue,
   type CreateAcceptedPlanDecomposition,
@@ -316,6 +360,7 @@ export {
   type IssueDocumentFormat,
   type UpsertIssueDocument,
   type RestoreIssueDocumentRevision,
+  type UpsertIssueWatchdog,
 } from "./issue.js";
 
 export {
@@ -369,6 +414,7 @@ export {
 export {
   executionWorkspaceConfigSchema,
   updateExecutionWorkspaceSchema,
+  workspaceOverviewQuerySchema,
   executionWorkspaceStatusSchema,
   executionWorkspaceCloseActionKindSchema,
   executionWorkspaceCloseActionSchema,
@@ -377,6 +423,7 @@ export {
   executionWorkspaceCloseReadinessSchema,
   executionWorkspaceCloseReadinessStateSchema,
   type UpdateExecutionWorkspace,
+  type WorkspaceOverviewQuery,
 } from "./execution-workspace.js";
 
 export {
@@ -484,6 +531,27 @@ export {
   type CreateAssetImageMetadata,
 } from "./asset.js";
 
+export {
+  pipelineAutomationRetryCleanupOptionsSchema,
+  pipelineAutomationRetryRequestSchema,
+  pipelineAutomationRetryScopeSchema,
+  pipelineStageAutomationSchema,
+  pipelineStageApproverSchema,
+  pipelineStageConfigSchema,
+  pipelineStageKindSchema,
+  pipelineStageOnEnterSchema,
+  pipelineStageVariableSchema,
+  type PipelineAutomationRetryCleanupOptions,
+  type PipelineAutomationRetryRequest,
+  type PipelineAutomationRetryScope,
+  type PipelineStageAutomationConfig,
+  type PipelineStageApprover,
+  type PipelineStageConfig,
+  type PipelineStageKind,
+  type PipelineStageOnEnter,
+  type PipelineStageVariable,
+} from "./pipeline.js";
+
 export {
   createCompanyInviteSchema,
   createOpenClawInvitePromptSchema,

packages/shared/src/validators/instance.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import {
+  instanceExperimentalSettingsSchema,
+  patchInstanceExperimentalSettingsSchema,
+} from "./instance.js";
+
+describe("instance experimental settings validators", () => {
+  it("defaults the server info debug view off", () => {
+    const settings = instanceExperimentalSettingsSchema.parse({});
+
+    expect(settings.enableServerInfoDebugView).toBe(false);
+  });
+
+  it("accepts server info debug view patches", () => {
+    expect(
+      patchInstanceExperimentalSettingsSchema.parse({
+        enableServerInfoDebugView: true,
+      }),
+    ).toEqual({
+      enableServerInfoDebugView: true,
+    });
+  });
+});

packages/shared/src/validators/instance.ts

@@ -41,11 +41,15 @@ export const patchInstanceGeneralSettingsSchema = instanceGeneralSettingsSchema.
 export const instanceExperimentalSettingsSchema = z.object({
   enableEnvironments: z.boolean().default(false),
   enableIsolatedWorkspaces: z.boolean().default(false),
-  enableStreamlinedLeftNavigation: z.boolean().default(false),
+  enableStreamlinedLeftNavigation: z.boolean().default(true),
+  enablePipelines: z.boolean().default(false),
   enableConferenceRoomChat: z.boolean().default(false),
+  enableTaskWatchdogs: z.boolean().default(false),
   enableIssuePlanDecompositions: z.boolean().default(false),
   enableExperimentalFileViewer: z.boolean().default(false),
   enableCloudSync: z.boolean().default(false),
+  enableExternalObjects: z.boolean().default(false),
+  enableServerInfoDebugView: z.boolean().default(false),
   autoRestartDevServerWhenIdle: z.boolean().default(false),
   enableIssueGraphLivenessAutoRecovery: z.boolean().default(false),
   issueGraphLivenessAutoRecoveryLookbackHours: z
@@ -58,6 +62,10 @@ export const instanceExperimentalSettingsSchema = z.object({
 
 export const patchInstanceExperimentalSettingsSchema = instanceExperimentalSettingsSchema.partial();
 
+export const patchInstanceSettingsSchema = z.object({
+  defaultEnvironmentId: z.string().uuid().nullable().optional(),
+}).strict();
+
 export const issueGraphLivenessAutoRecoveryRequestSchema = z.object({
   lookbackHours: z
     .number()
@@ -71,6 +79,16 @@ export type InstanceGeneralSettings = z.infer<typeof instanceGeneralSettingsSche
 export type PatchInstanceGeneralSettings = z.infer<typeof patchInstanceGeneralSettingsSchema>;
 export type InstanceExperimentalSettings = z.infer<typeof instanceExperimentalSettingsSchema>;
 export type PatchInstanceExperimentalSettings = z.infer<typeof patchInstanceExperimentalSettingsSchema>;
+export type PatchInstanceSettings = z.infer<typeof patchInstanceSettingsSchema>;
 export type IssueGraphLivenessAutoRecoveryRequest = z.infer<
   typeof issueGraphLivenessAutoRecoveryRequestSchema
 >;
+
+export const instanceSettingsSchema = z.object({
+  id: z.string().uuid(),
+  defaultEnvironmentId: z.string().uuid().nullable(),
+  general: instanceGeneralSettingsSchema,
+  experimental: instanceExperimentalSettingsSchema,
+  createdAt: z.union([z.date(), z.string().datetime()]),
+  updatedAt: z.union([z.date(), z.string().datetime()]),
+}).strict();

packages/shared/src/validators/issue.test.ts

@@ -227,10 +227,17 @@ describe("issue validators", () => {
     }).status).toBe("backlog");
   });
 
-  it("defaults issue work mode to standard and accepts planning", () => {
+  it("defaults issue work mode to standard and accepts ask and planning", () => {
     expect(createIssueSchema.parse({ title: "Plan first" }).workMode).toBe("standard");
+    expect(createIssueSchema.parse({ title: "Ask first", workMode: "ask" }).workMode).toBe("ask");
     expect(createIssueSchema.parse({ title: "Plan first", workMode: "planning" }).workMode).toBe("planning");
+    expect(updateIssueSchema.parse({ workMode: "ask" }).workMode).toBe("ask");
     expect(updateIssueSchema.parse({ workMode: "planning" }).workMode).toBe("planning");
+    expect(suggestedTaskDraftSchema.parse({
+      clientKey: "ask-child",
+      title: "Ask child",
+      workMode: "ask",
+    }).workMode).toBe("ask");
     expect(suggestedTaskDraftSchema.parse({
       clientKey: "planning-child",
       title: "Plan child",

packages/shared/src/validators/issue.ts

@@ -24,6 +24,7 @@ import {
   ISSUE_THREAD_INTERACTION_CONTINUATION_POLICIES,
   ISSUE_THREAD_INTERACTION_KINDS,
   ISSUE_THREAD_INTERACTION_STATUSES,
+  ISSUE_WATCHDOG_DISCOVERY_KINDS,
   MODEL_PROFILE_KEYS,
   REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT,
 } from "../constants.js";
@@ -394,6 +395,14 @@ const createIssueBaseSchema = z.object({
   executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
   executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
   labelIds: z.array(z.string().uuid()).optional(),
+  watchdogDiscovery: z.object({
+    kind: z.enum(ISSUE_WATCHDOG_DISCOVERY_KINDS),
+    evidenceMarkdown: multilineTextSchema.optional().nullable(),
+  }).strict().optional().nullable(),
+  watchdog: z.object({
+    agentId: z.string().uuid(),
+    instructions: multilineTextSchema.optional().nullable(),
+  }).strict().optional().nullable(),
 });
 
 export const createIssueInputSchema = createIssueBaseSchema.extend({
@@ -404,10 +413,18 @@ export const createIssueSchema = withCreateIssueStatusDefault(createIssueBaseSch
 
 export type CreateIssue = z.infer<typeof createIssueSchema>;
 
+export const upsertIssueWatchdogSchema = z.object({
+  agentId: z.string().uuid(),
+  instructions: multilineTextSchema.optional().nullable(),
+}).strict();
+
+export type UpsertIssueWatchdog = z.infer<typeof upsertIssueWatchdogSchema>;
+
 export const createChildIssueSchema = withCreateIssueStatusDefault(createIssueBaseSchema
   .omit({
     parentId: true,
     inheritExecutionWorkspaceFromIssueId: true,
+    watchdogDiscovery: true,
   })
   .extend({
     acceptanceCriteria: z.array(z.string().trim().min(1).max(500)).max(20).optional(),
@@ -430,7 +447,7 @@ export const createIssueLabelSchema = z.object({
 
 export type CreateIssueLabel = z.infer<typeof createIssueLabelSchema>;
 
-export const updateIssueSchema = createIssueBaseSchema.partial().extend({
+export const updateIssueSchema = createIssueBaseSchema.omit({ watchdog: true }).partial().extend({
   requestDepth: issueRequestDepthInputSchema.optional(),
   assigneeAgentId: z.string().trim().min(1).optional().nullable(),
   comment: multilineTextSchema.pipe(z.string().min(1)).optional(),
@@ -646,6 +663,7 @@ export const askUserQuestionsPayloadSchema = z.object({
   version: z.literal(1),
   title: z.string().trim().max(240).nullable().optional(),
   submitLabel: z.string().trim().max(120).nullable().optional(),
+  supersedeOnUserComment: z.boolean().optional(),
   questions: z.array(askUserQuestionsQuestionSchema).min(1).max(10),
 }).superRefine((value, ctx) => {
   const seenQuestionIds = new Set<string>();
@@ -684,6 +702,8 @@ export const askUserQuestionsResultSchema = z.object({
   answers: z.array(askUserQuestionsAnswerSchema).max(20),
   cancelled: z.literal(true).optional(),
   cancellationReason: z.string().trim().max(4000).nullable().optional(),
+  expirationReason: z.literal("superseded_by_comment").optional(),
+  commentId: z.string().uuid().nullable().optional(),
   summaryMarkdown: z.string().max(20000).nullable().optional(),
 });
 

packages/shared/src/validators/pipeline.ts

@@ -0,0 +1,159 @@
+import { z } from "zod";
+import {
+  ISSUE_EXECUTION_WORKSPACE_PREFERENCES,
+  issueExecutionWorkspaceSettingsSchema,
+} from "./issue.js";
+
+const routineVariableLikeNameSchema = z.string().trim().regex(/^[A-Za-z][A-Za-z0-9_]*$/);
+
+export const pipelineStageKindSchema = z.enum(["working", "review", "done", "cancelled"]);
+export const legacyPipelineStageKindSchema = z.enum(["open", "working", "review", "done", "cancelled"]);
+
+export const pipelineStageApproverSchema = z.object({
+  kind: z.enum(["any_human", "user", "agent"]).optional().default("any_human"),
+  id: z.string().trim().min(1).max(200).optional(),
+}).superRefine((value, ctx) => {
+  if (value.kind !== "any_human" && (typeof value.id !== "string" || value.id.length === 0)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["id"],
+      message: "Specific stage approvers require an id",
+    });
+  }
+});
+
+export const pipelineStageOnEnterSchema = z.object({
+  type: z.literal("run_routine"),
+  routineId: z.string().uuid(),
+  id: z.string().trim().min(1).max(200).optional(),
+  projectId: z.string().uuid().optional().nullable(),
+  projectWorkspaceId: z.string().uuid().optional().nullable(),
+  executionWorkspaceId: z.string().uuid().optional().nullable(),
+  executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
+  executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
+}).passthrough();
+
+export const pipelineStageAutomationSchema = z.object({
+  routineId: z.string().uuid().optional().nullable(),
+  assigneeAgentId: z.string().uuid().optional().nullable(),
+  instructionsBody: z.string().optional().nullable(),
+  projectId: z.string().uuid().optional().nullable(),
+  projectWorkspaceId: z.string().uuid().optional().nullable(),
+  executionWorkspaceId: z.string().uuid().optional().nullable(),
+  executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
+  executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
+}).passthrough();
+
+export const pipelineStageCarryOverPolicySchema = z.object({
+  version: z.literal(1).default(1),
+  mode: z.enum(["all_except", "only"]).default("all_except"),
+  includeFields: z.array(routineVariableLikeNameSchema).max(100).default([]),
+  excludeFields: z.array(routineVariableLikeNameSchema).max(100).default([]),
+});
+
+export const pipelineStageBreakdownSchema = z.object({
+  targetPipelineId: z.string().uuid(),
+  targetStageKey: z.string().trim().min(1).max(120),
+  pieceNoun: z.string().trim().min(1).max(80).default("piece"),
+  carryOverPolicy: pipelineStageCarryOverPolicySchema.optional(),
+  inheritFields: z.array(routineVariableLikeNameSchema).max(100).default([]),
+  advanceTo: z.string().trim().min(1).max(120).optional(),
+  waitForPieces: z.boolean().optional().default(false),
+  whenFinishedMoveTo: z.string().trim().min(1).max(120).optional(),
+}).superRefine((value, ctx) => {
+  if (value.waitForPieces && !value.whenFinishedMoveTo) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["whenFinishedMoveTo"],
+      message: "Breakdown stages that wait for pieces need a destination stage",
+    });
+  }
+});
+
+export const pipelineStageVariableSchema = z.object({
+  key: routineVariableLikeNameSchema,
+  label: z.string().trim().max(120),
+  type: z.enum(["select", "text", "multiline"]).default("text"),
+  options: z.array(z.string().trim().min(1).max(120)).max(50).optional().default([]),
+  required: z.boolean().optional().default(false),
+  showInAddForm: z.boolean().optional().default(false),
+}).superRefine((value, ctx) => {
+  if (value.type === "select" && value.options.length === 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["options"],
+      message: "Select variables require at least one option",
+    });
+  }
+  if (value.type !== "select" && value.options.length > 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["options"],
+      message: "Only select variables can define options",
+    });
+  }
+});
+
+export const pipelineStageConfigSchema = z.object({
+  variables: z.array(pipelineStageVariableSchema).default([]),
+  disabled: z.boolean().optional(),
+  disabledReason: z.string().trim().max(1_000).nullable().optional(),
+  requireApproval: z.boolean().optional(),
+  approver: pipelineStageApproverSchema.optional(),
+  /** Legacy input only; the server migrates it to requireApproval/approver. */
+  reviewerKind: z.enum(["human", "any"]).optional(),
+  whatHappensHere: z.string().trim().max(10_000).optional(),
+  onEnter: pipelineStageOnEnterSchema.optional(),
+  automation: pipelineStageAutomationSchema.optional(),
+  breakdown: pipelineStageBreakdownSchema.optional(),
+  approveToStageKey: z.string().trim().min(1).max(120).optional(),
+  rejectToStageKey: z.string().trim().min(1).max(120).optional(),
+  requestChangesToStageKey: z.string().trim().min(1).max(120).optional(),
+  requireRejectReason: z.boolean().optional(),
+  requireRequestChangesReason: z.boolean().optional(),
+  requireChildrenTerminal: z.boolean().optional(),
+  requireNoUnresolvedDrift: z.boolean().optional(),
+}).passthrough().superRefine((value, ctx) => {
+  const keys = new Set<string>();
+  value.variables.forEach((variable, index) => {
+    if (keys.has(variable.key)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["variables", index, "key"],
+        message: "Pipeline stage variable keys must be unique",
+      });
+    }
+    keys.add(variable.key);
+  });
+});
+
+export const pipelineAutomationRetryScopeSchema = z.enum(["current_stage", "previous_stage"]);
+
+export const pipelineAutomationRetryCleanupOptionsSchema = z.object({
+  retireDirectChildren: z.boolean().default(true),
+  retireDescendants: z.boolean().default(true),
+  cancelLinkedAutomationIssues: z.boolean().default(true),
+});
+
+export const pipelineAutomationRetryRequestSchema = z.object({
+  scope: pipelineAutomationRetryScopeSchema,
+  targetStageId: z.string().uuid().nullable().optional(),
+  expectedVersion: z.number().int().positive(),
+  cleanup: pipelineAutomationRetryCleanupOptionsSchema.default({
+    retireDirectChildren: true,
+    retireDescendants: true,
+    cancelLinkedAutomationIssues: true,
+  }),
+});
+
+export type PipelineStageKind = z.infer<typeof pipelineStageKindSchema>;
+export type PipelineStageApprover = z.infer<typeof pipelineStageApproverSchema>;
+export type PipelineStageOnEnter = z.infer<typeof pipelineStageOnEnterSchema>;
+export type PipelineStageAutomationConfig = z.infer<typeof pipelineStageAutomationSchema>;
+export type PipelineStageCarryOverPolicy = z.infer<typeof pipelineStageCarryOverPolicySchema>;
+export type PipelineStageBreakdown = z.infer<typeof pipelineStageBreakdownSchema>;
+export type PipelineStageVariable = z.infer<typeof pipelineStageVariableSchema>;
+export type PipelineStageConfig = z.infer<typeof pipelineStageConfigSchema>;
+export type PipelineAutomationRetryScope = z.infer<typeof pipelineAutomationRetryScopeSchema>;
+export type PipelineAutomationRetryCleanupOptions = z.infer<typeof pipelineAutomationRetryCleanupOptionsSchema>;
+export type PipelineAutomationRetryRequest = z.infer<typeof pipelineAutomationRetryRequestSchema>;

packages/shared/src/validators/plugin.test.ts

@@ -37,6 +37,66 @@ describe("plugin manifest validators", () => {
 
     expect(parsed.capabilities).toEqual(["ui.dashboardWidget.register"]);
   });
+
+  it("accepts sandbox provider template config bindings", () => {
+    const parsed = pluginManifestV1Schema.parse({
+      id: "paperclip.template-provider",
+      apiVersion: 1,
+      version: "0.1.0",
+      displayName: "Template Provider",
+      description: "Sandbox provider with captured template config binding.",
+      author: "Paperclip",
+      categories: ["automation"],
+      capabilities: ["environment.drivers.register"],
+      entrypoints: { worker: "./dist/worker.js" },
+      environmentDrivers: [
+        {
+          driverKey: "template-provider",
+          kind: "sandbox_provider",
+          displayName: "Template Provider",
+          supportsTemplateCapture: true,
+          templateRefKind: "provider_template",
+          templateConfigBinding: {
+            field: "templateId",
+            unsetFields: ["image"],
+          },
+          configSchema: { type: "object" },
+        },
+      ],
+    });
+
+    expect(parsed.environmentDrivers?.[0]?.templateConfigBinding).toEqual({
+      field: "templateId",
+      unsetFields: ["image"],
+    });
+  });
+
+  it("rejects template config bindings that replace provider identity", () => {
+    const parsed = pluginManifestV1Schema.safeParse({
+      id: "paperclip.bad-template-provider",
+      apiVersion: 1,
+      version: "0.1.0",
+      displayName: "Bad Template Provider",
+      categories: ["automation"],
+      capabilities: ["environment.drivers.register"],
+      entrypoints: { worker: "./dist/worker.js" },
+      environmentDrivers: [
+        {
+          driverKey: "bad-template-provider",
+          kind: "sandbox_provider",
+          displayName: "Bad Template Provider",
+          templateConfigBinding: {
+            field: "provider",
+          },
+          configSchema: { type: "object" },
+        },
+      ],
+    });
+
+    expect(parsed.success).toBe(false);
+    if (parsed.success) return;
+    expect(parsed.error.issues.some((issue) => issue.message.includes("provider key"))).toBe(true);
+  });
 });
 
 describe("plugin managed routine validators", () => {

packages/shared/src/validators/plugin.ts

@@ -25,6 +25,7 @@ import {
   ISSUE_SURFACE_VISIBILITIES,
 } from "../constants.js";
 import { routineVariableSchema } from "./routine.js";
+import { externalObjectProviderKeySchema, externalObjectTypeSchema } from "./external-object.js";
 
 // ---------------------------------------------------------------------------
 // JSON Schema placeholder – a permissive validator for JSON Schema objects
@@ -116,6 +117,42 @@ export const pluginToolDeclarationSchema = z.object({
   parametersSchema: jsonSchemaSchema,
 });
 
+const pluginEnvironmentTemplateConfigFieldSchema = z.string()
+  .min(1)
+  .max(100)
+  .regex(
+    /^[A-Za-z_][A-Za-z0-9_-]*$/,
+    "Template config binding fields must be top-level config keys using letters, digits, underscores, or hyphens",
+  )
+  .refine((value) => value !== "provider", {
+    message: "Template config binding must not replace the sandbox provider key",
+  });
+
+export const pluginEnvironmentTemplateConfigBindingSchema = z.object({
+  field: pluginEnvironmentTemplateConfigFieldSchema,
+  unsetFields: z.array(pluginEnvironmentTemplateConfigFieldSchema).max(20).optional(),
+}).strict().superRefine((value, ctx) => {
+  const unsetFields = value.unsetFields ?? [];
+  const seen = new Set<string>();
+  for (const [index, field] of unsetFields.entries()) {
+    if (field === value.field) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "Template config binding cannot unset the same field it sets",
+        path: ["unsetFields", index],
+      });
+    }
+    if (seen.has(field)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "Template config binding unsetFields must be unique",
+        path: ["unsetFields", index],
+      });
+    }
+    seen.add(field);
+  }
+});
+
 export const pluginEnvironmentDriverDeclarationSchema = z.object({
   driverKey: z.string().min(1).regex(
     /^[a-z0-9][a-z0-9._-]*$/,
@@ -124,6 +161,13 @@ export const pluginEnvironmentDriverDeclarationSchema = z.object({
   kind: z.enum(["environment_driver", "sandbox_provider"]).optional(),
   displayName: z.string().min(1).max(100),
   description: z.string().max(500).optional(),
+  supportsReusableLeases: z.boolean().optional(),
+  supportsInteractiveSetup: z.boolean().optional(),
+  interactiveSetupConnectionTypes: z.array(z.string().min(1).max(100)).max(10).optional(),
+  supportsTemplateCapture: z.boolean().optional(),
+  templateRefKind: z.string().min(1).max(100).optional(),
+  templateConfigBinding: pluginEnvironmentTemplateConfigBindingSchema.optional(),
+  supportsTemplateDelete: z.boolean().optional(),
   configSchema: jsonSchemaSchema,
 });
 
@@ -567,6 +611,55 @@ export const pluginApiRouteDeclarationSchema = z.object({
 
 export type PluginApiRouteDeclarationInput = z.infer<typeof pluginApiRouteDeclarationSchema>;
 
+export const pluginObjectReferenceRefreshPolicySchema = z.object({
+  defaultTtlSeconds: z.number().int().positive().max(86_400).optional(),
+  staleAfterSeconds: z.number().int().positive().max(604_800).optional(),
+}).superRefine((value, ctx) => {
+  if (
+    value.defaultTtlSeconds != null &&
+    value.staleAfterSeconds != null &&
+    value.staleAfterSeconds < value.defaultTtlSeconds
+  ) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "staleAfterSeconds must be greater than or equal to defaultTtlSeconds",
+      path: ["staleAfterSeconds"],
+    });
+  }
+});
+
+export const pluginObjectReferenceProviderDeclarationSchema = z.object({
+  providerKey: externalObjectProviderKeySchema,
+  displayName: z.string().min(1).max(100),
+  objectTypes: z.array(externalObjectTypeSchema).min(1),
+  urlPatterns: z.array(z.string().trim().min(1).max(500)).optional(),
+  refreshPolicy: pluginObjectReferenceRefreshPolicySchema.optional(),
+  webhookEndpointKeys: z.array(z.string().min(1)).optional(),
+}).superRefine((value, ctx) => {
+  const duplicateObjectTypes = value.objectTypes.filter((type, i) => value.objectTypes.indexOf(type) !== i);
+  if (duplicateObjectTypes.length > 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `Duplicate objectTypes: ${[...new Set(duplicateObjectTypes)].join(", ")}`,
+      path: ["objectTypes"],
+    });
+  }
+
+  const webhookKeys = value.webhookEndpointKeys ?? [];
+  const duplicateWebhookKeys = webhookKeys.filter((key, i) => webhookKeys.indexOf(key) !== i);
+  if (duplicateWebhookKeys.length > 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `Duplicate webhookEndpointKeys: ${[...new Set(duplicateWebhookKeys)].join(", ")}`,
+      path: ["webhookEndpointKeys"],
+    });
+  }
+});
+
+export type PluginObjectReferenceProviderDeclarationInput = z.infer<
+  typeof pluginObjectReferenceProviderDeclarationSchema
+>;
+
 // ---------------------------------------------------------------------------
 // Plugin Manifest V1 schema
 // ---------------------------------------------------------------------------
@@ -646,6 +739,7 @@ export const pluginManifestV1Schema = z.object({
   routines: z.array(pluginManagedRoutineDeclarationSchema).optional(),
   skills: z.array(pluginManagedSkillDeclarationSchema).optional(),
   localFolders: z.array(pluginLocalFolderDeclarationSchema).optional(),
+  objectReferences: z.array(pluginObjectReferenceProviderDeclarationSchema).optional(),
   launchers: z.array(pluginLauncherDeclarationSchema).optional(),
   ui: z.object({
     slots: z.array(pluginUiSlotDeclarationSchema).min(1).optional(),
@@ -786,6 +880,31 @@ export const pluginManifestV1Schema = z.object({
     }
   }
 
+  if (manifest.objectReferences && manifest.objectReferences.length > 0) {
+    for (const capability of ["external.objects.detect", "external.objects.read"] as const) {
+      if (!manifest.capabilities.includes(capability)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `Capability '${capability}' is required when objectReferences are declared`,
+          path: ["capabilities"],
+        });
+      }
+    }
+
+    const declaredWebhookKeys = new Set((manifest.webhooks ?? []).map((webhook) => webhook.endpointKey));
+    for (const [providerIndex, provider] of manifest.objectReferences.entries()) {
+      for (const endpointKey of provider.webhookEndpointKeys ?? []) {
+        if (!declaredWebhookKeys.has(endpointKey)) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `objectReferences webhookEndpointKey "${endpointKey}" must match a declared webhook endpoint`,
+            path: ["objectReferences", providerIndex, "webhookEndpointKeys"],
+          });
+        }
+      }
+    }
+  }
+
   if (manifest.database) {
     const requiredCapabilities = [
       "database.namespace.migrate",
@@ -949,6 +1068,18 @@ export const pluginManifestV1Schema = z.object({
     }
   }
 
+  if (manifest.objectReferences) {
+    const providerKeys = manifest.objectReferences.map((provider) => provider.providerKey);
+    const duplicateProviders = providerKeys.filter((key, i) => providerKeys.indexOf(key) !== i);
+    if (duplicateProviders.length > 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `Duplicate object reference provider keys: ${[...new Set(duplicateProviders)].join(", ")}`,
+        path: ["objectReferences"],
+      });
+    }
+  }
+
   // UI slot ids must be unique within the plugin (namespaced at runtime)
   if (manifest.ui) {
     if (manifest.ui.slots) {

packages/shared/src/validators/routine.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import {
   routineRevisionSnapshotV1Schema,
+  routineVariableSchema,
   updateRoutineSchema,
 } from "./routine.js";
 
@@ -83,4 +84,30 @@ describe("routine validators", () => {
       baseRevisionId,
     }).baseRevisionId).toBe(baseRevisionId);
   });
+
+  it("accepts date variables with valid YYYY-MM-DD defaults", () => {
+    expect(routineVariableSchema.parse({
+      name: "startDate",
+      type: "date",
+      defaultValue: "2024-02-29",
+    })).toMatchObject({
+      name: "startDate",
+      type: "date",
+      defaultValue: "2024-02-29",
+    });
+  });
+
+  it("rejects date variables with non-calendar or non-string defaults", () => {
+    expect(() => routineVariableSchema.parse({
+      name: "startDate",
+      type: "date",
+      defaultValue: "2024-02-30",
+    })).toThrow(/YYYY-MM-DD/);
+
+    expect(() => routineVariableSchema.parse({
+      name: "startDate",
+      type: "date",
+      defaultValue: 20240229,
+    })).toThrow(/YYYY-MM-DD/);
+  });
 });

packages/shared/src/validators/routine.ts

@@ -13,6 +13,7 @@ import {
   issueExecutionWorkspaceSettingsSchema,
 } from "./issue.js";
 import { envConfigSchema } from "./secret.js";
+import { isValidRoutineDateString } from "../routine-variables.js";
 
 const routineVariableValueSchema = z.union([z.string(), z.number().finite(), z.boolean()]);
 
@@ -47,6 +48,15 @@ export const routineVariableSchema = z.object({
       });
     }
   }
+  if (value.type === "date" && value.defaultValue != null) {
+    if (typeof value.defaultValue !== "string" || !isValidRoutineDateString(value.defaultValue)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["defaultValue"],
+        message: "Date variable defaults must be valid YYYY-MM-DD calendar dates",
+      });
+    }
+  }
 });
 
 export const createRoutineSchema = z.object({
@@ -149,6 +159,7 @@ export const runRoutineSchema = z.object({
   payload: z.record(z.string(), z.unknown()).optional().nullable(),
   variables: z.record(z.string(), routineVariableValueSchema).optional().nullable(),
   projectId: z.string().uuid().optional().nullable(),
+  projectWorkspaceId: z.string().uuid().optional().nullable(),
   assigneeAgentId: z.string().uuid().optional().nullable(),
   idempotencyKey: z.string().trim().max(255).optional().nullable(),
   source: z.enum(["manual", "api"]).optional().default("manual"),

packages/shared/src/validators/workspace-file-resource.ts

@@ -90,7 +90,7 @@ export const resolvedWorkspaceResourceSchema = z.object({
   denialReason: z.string().nullable().optional(),
   capabilities: z.object({
     preview: z.boolean(),
-    download: z.literal(false),
+    download: z.boolean(),
     listChildren: z.boolean(),
   }),
 });