Package release 0.4.167 from the current workspace snapshot

Constraint: Windows and Linux artifacts are built on native GitHub runners from a temporary snapshot branch
Rejected: Build Windows/Linux locally on Apple Silicon | docker/wine packaging is not stable on this host
Confidence: medium
Scope-risk: moderate
Directive: This snapshot branch is transport-only and should be deleted after the release completes
Tested: local verify/build stages before snapshot creation
Not-tested: remote packaging before workflow execution

tests/unit/agent-budget-policy-sync.test.ts

@@ -0,0 +1,112 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { afterEach, describe, expect, it } from "vitest";
+import { AppDatabase } from "../../src/main/database";
+
+const tempDirs: string[] = [];
+
+async function createTempDir(prefix: string) {
+  const dir = await mkdtemp(join(tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+afterEach(async () => {
+  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+});
+
+describe("agent budget policy synchronization", () => {
+  it("updates the canonical agent-scope policy instead of creating duplicate active policies", async () => {
+    const profileDir = await createTempDir("agentcompany-budget-sync-");
+    const db = new AppDatabase(profileDir);
+    db.init();
+
+    const companyId = db.saveCompany({
+      name: "Budget Sync Co",
+      description: "Budget sync regression coverage",
+      status: "active",
+    });
+    db.updateConnectorHealth({
+      id: "codex_local",
+      status: "ready",
+      authState: "authenticated",
+      version: "test",
+      lastError: null,
+    });
+    const workspaceId = db.saveWorkspace({
+      companyId,
+      name: "Primary",
+      localPath: profileDir,
+      repoUrl: "",
+      repoRef: "",
+      isPrimary: true,
+    });
+    const agentId = db.saveAgent({
+      companyId,
+      name: "Engineer",
+      role: "Engineer",
+      title: "Backend Engineer",
+      status: "active",
+      reportsTo: null,
+      connectorId: "codex_local",
+      workspaceId,
+      model: null,
+      capabilities: "Build backend services",
+      budgetMonthlyUsd: 100,
+      department: "engineering",
+    });
+
+    const firstPolicyId = db.saveBudgetPolicy({
+      companyId,
+      scopeType: "agent",
+      scopeId: agentId,
+      metric: "billed_cents",
+      windowKind: "calendar_month_utc",
+      amount: 10_000,
+      warnPercent: 80,
+      hardStopEnabled: true,
+      notifyEnabled: true,
+      isActive: true,
+    });
+
+    db.saveAgent({
+      id: agentId,
+      companyId,
+      name: "Engineer",
+      role: "Engineer",
+      title: "Backend Engineer",
+      status: "active",
+      reportsTo: null,
+      connectorId: "codex_local",
+      workspaceId,
+      model: null,
+      capabilities: "Build backend services",
+      budgetMonthlyUsd: 250,
+      department: "engineering",
+    });
+
+    const secondPolicyId = db.saveBudgetPolicy({
+      companyId,
+      scopeType: "agent",
+      scopeId: agentId,
+      metric: "billed_cents",
+      windowKind: "calendar_month_utc",
+      amount: 25_000,
+      warnPercent: 80,
+      hardStopEnabled: true,
+      notifyEnabled: true,
+      isActive: true,
+    });
+
+    const agentPolicies = db.listBudgetPolicies(companyId).filter(
+      (policy) => policy.scopeType === "agent" && policy.scopeId === agentId,
+    );
+    expect(secondPolicyId).toBe(firstPolicyId);
+    expect(agentPolicies).toHaveLength(1);
+    expect(agentPolicies[0]?.amount).toBe(25_000);
+    expect(db.getActivePoliciesForRun(companyId, agentId, null).map((policy) => policy.amount)).toEqual([25_000]);
+
+    db.close();
+  });
+});

tests/unit/agent-hire-routing.test.ts

@@ -0,0 +1,98 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { afterEach, describe, expect, it } from "vitest";
+import { AppDatabase } from "../../src/main/database";
+import { getHireRoutingValidationError, resolveHireReportsTo } from "../../src/main/agent-permissions";
+
+const tempDirs: string[] = [];
+
+async function createTempDir(prefix: string) {
+  const dir = await mkdtemp(join(tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+afterEach(async () => {
+  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+});
+
+describe("hire routing guards", () => {
+  it("defaults same-department hires to the requester and infers department leads for cross-department hires", async () => {
+    const profileDir = await createTempDir("agentcompany-hire-manager-");
+    const db = new AppDatabase(profileDir);
+    db.init();
+
+    const companyId = db.saveCompany({
+      name: "Routing Co",
+      description: "Hire routing regression coverage",
+      status: "active",
+    });
+    db.updateConnectorHealth({
+      id: "codex_local",
+      status: "ready",
+      authState: "authenticated",
+      version: "test",
+      lastError: null,
+    });
+    const workspaceId = db.saveWorkspace({
+      companyId,
+      name: "Primary",
+      localPath: profileDir,
+      repoUrl: "",
+      repoRef: "",
+      isPrimary: true,
+    });
+    const ceoId = db.saveAgent({
+      companyId,
+      name: "CEO",
+      role: "CEO",
+      title: "Chief Executive Officer",
+      status: "active",
+      reportsTo: null,
+      connectorId: "codex_local",
+      workspaceId,
+      model: null,
+      capabilities: "Lead the company",
+      budgetMonthlyUsd: 250,
+      department: "executive",
+    });
+    const hrId = db.saveAgent({
+      companyId,
+      name: "HR Lead",
+      role: "HR Lead",
+      title: "Head of HR",
+      status: "active",
+      reportsTo: ceoId,
+      connectorId: "codex_local",
+      workspaceId,
+      model: null,
+      capabilities: "Run hiring operations",
+      budgetMonthlyUsd: 180,
+      department: "hr",
+    });
+    const ctoId = db.saveAgent({
+      companyId,
+      name: "CTO",
+      role: "CTO",
+      title: "Chief Technology Officer",
+      status: "active",
+      reportsTo: ceoId,
+      connectorId: "codex_local",
+      workspaceId,
+      model: null,
+      capabilities: "Lead engineering",
+      budgetMonthlyUsd: 220,
+      department: "engineering",
+    });
+
+    expect(resolveHireReportsTo(db, companyId, hrId, undefined, "hr")).toBe(hrId);
+    expect(resolveHireReportsTo(db, companyId, hrId, undefined, "engineering")).toBe(ctoId);
+    expect(getHireRoutingValidationError(db, companyId, hrId, hrId, "engineering")).toBe(
+      "Selected manager must belong to the same department as the new hire, unless they are a top-level executive.",
+    );
+    expect(getHireRoutingValidationError(db, companyId, ctoId, ctoId, "engineering")).toBeNull();
+
+    db.close();
+  });
+});

tests/unit/agent-schema-validation.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+import { hireRequestSchema } from "../../src/shared/contracts/schemas-agents";
+import { getHireNameValidationError } from "../../src/main/agent-permissions";
+
+const baseHireRequest = {
+  companyId: "00000000-0000-0000-0000-000000000000",
+  requestedByAgentId: null,
+  name: "Alice",
+  role: "Engineer",
+  title: "Backend Engineer",
+  department: "engineering" as const,
+  reportsTo: null,
+  connectorId: "codex_local" as const,
+  workspaceId: null,
+  model: null,
+  metadataJson: "{}",
+  capabilities: "Build backend services",
+  budgetMonthlyUsd: 120,
+};
+
+describe("agent input schemas", () => {
+  it("rejects whitespace-only hire names", () => {
+    expect(() =>
+      hireRequestSchema.parse({
+        ...baseHireRequest,
+        name: "   ",
+      }),
+    ).toThrow();
+  });
+
+  it("trims semantic hire fields before persistence", () => {
+    const parsed = hireRequestSchema.parse({
+      ...baseHireRequest,
+      name: "  Alice  ",
+      role: "  Engineer  ",
+      title: "  Backend Engineer  ",
+    });
+
+    expect(parsed.name).toBe("Alice");
+    expect(parsed.role).toBe("Engineer");
+    expect(parsed.title).toBe("Backend Engineer");
+  });
+
+  it("rejects role-like names for non-executive hires", () => {
+    expect(getHireNameValidationError({
+      name: "Backend Engineer",
+      role: "Backend Engineer",
+      title: "Backend Engineer",
+    })).toBe("Hire name must be a real display name, not just the role.");
+  });
+
+  it("allows executive acronyms when they are the intended display name", () => {
+    expect(getHireNameValidationError({
+      name: "CTO",
+      role: "CTO",
+      title: "Chief Technology Officer",
+    })).toBeNull();
+  });
+});

tests/unit/budget-policy-input.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { buildBudgetPolicyInput, getBudgetPolicyAmountDollars } from "../../src/renderer/lib/budget-policy-input";
+
+describe("budget-policy-input", () => {
+  it("preserves the existing policy id on edit", () => {
+    const payload = buildBudgetPolicyInput({
+      policyId: "policy-123",
+      companyId: "00000000-0000-0000-0000-000000000001",
+      scopeType: "agent",
+      scopeId: "00000000-0000-0000-0000-000000000002",
+      amountDollars: "250.00",
+      warnPercent: "85",
+      hardStopEnabled: true,
+      notifyEnabled: true,
+    });
+
+    expect(payload?.id).toBe("policy-123");
+    expect(payload?.amount).toBe(25000);
+    expect(payload?.warnPercent).toBe(85);
+  });
+
+  it("formats stored cents back to dollars for edit forms", () => {
+    expect(
+      getBudgetPolicyAmountDollars({
+        id: "policy-123",
+        companyId: "company-1",
+        scopeType: "agent",
+        scopeId: "agent-1",
+        metric: "billed_cents",
+        windowKind: "calendar_month_utc",
+        amount: 12550,
+        warnPercent: 80,
+        hardStopEnabled: true,
+        notifyEnabled: true,
+        isActive: true,
+        createdAt: "2026-01-01T00:00:00.000Z",
+        updatedAt: "2026-01-01T00:00:00.000Z",
+      }),
+    ).toBe("125.50");
+  });
+});

tests/unit/command-paths.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { normalizeCommandValue } from "@agentcompany/adapter-utils/server-utils";
+import { buildWindowsSpawnTarget, normalizeCommandValue } from "@agentcompany/adapter-utils/server-utils";
 import { commandLooksLike } from "@agentcompany/adapter-utils/test-utils";
 
 describe("command path normalization", () => {
@@ -21,4 +21,27 @@ describe("command path normalization", () => {
     expect(commandLooksLike('"C:\\Users\\First Last\\AppData\\Local\\bin\\claude.exe"', "claude")).toBe(true);
     expect(commandLooksLike("'C:\\Users\\First Last\\AppData\\Local\\bin\\codex.exe'", "codex")).toBe(true);
   });
+
+  it("spawns direct exe paths on Windows instead of wrapping them through cmd.exe", () => {
+    const target = buildWindowsSpawnTarget(
+      "C:\\Users\\First Last\\AppData\\Local\\bin\\claude.exe",
+      ["--version"],
+      "cmd.exe",
+    );
+    expect(target).toEqual({
+      command: "C:\\Users\\First Last\\AppData\\Local\\bin\\claude.exe",
+      args: ["--version"],
+    });
+  });
+
+  it("still wraps shell scripts through cmd.exe on Windows", () => {
+    const target = buildWindowsSpawnTarget(
+      "C:\\Tools\\agentcompany\\launch.cmd",
+      ["--version"],
+      "cmd.exe",
+    );
+    expect(target.command).toBe("cmd.exe");
+    expect(target.args[0]).toBe("/d");
+    expect(target.args.at(-1)).toContain("launch.cmd");
+  });
 });

tests/unit/company-mode-switch.test.ts

@@ -0,0 +1,151 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { IPC_CHANNELS } from "@shared/contracts";
+import { AppDatabase } from "../../src/main/database";
+import { registerCoreAdminHandlers } from "../../src/main/ipc-core-admin-handlers";
+import { createThreadIntegration } from "../../src/main/thread-integration";
+
+const tempDirs: string[] = [];
+
+async function createTempDir(prefix: string) {
+  const dir = await mkdtemp(join(tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+afterEach(async () => {
+  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+});
+
+describe("company mode switching", () => {
+  it("clears cofounder review artifacts when switching back to AI CEO", async () => {
+    const profileDir = await createTempDir("agentcompany-mode-switch-");
+    const db = new AppDatabase(profileDir);
+    db.init();
+
+    db.updateConnectorHealth({
+      id: "codex_local",
+      status: "ready",
+      authState: "authenticated",
+      version: "test",
+      lastError: null,
+    });
+
+    const companyId = db.saveCompany({
+      name: "Mode Switch Co",
+      description: "Execution mode cleanup",
+      status: "active",
+      executionMode: "ai_cofounder",
+      autoApproveHires: false,
+      reviewDeliverables: true,
+    });
+    const workspaceId = db.saveWorkspace({
+      companyId,
+      name: "Primary",
+      localPath: profileDir,
+      repoUrl: "",
+      repoRef: "",
+      isPrimary: true,
+    });
+    const ceoId = db.saveAgent({
+      companyId,
+      name: "CEO",
+      role: "CEO",
+      title: "Chief Executive Officer",
+      status: "active",
+      reportsTo: null,
+      connectorId: "codex_local",
+      workspaceId,
+      model: null,
+      capabilities: "Lead the company",
+      budgetMonthlyUsd: 250,
+    });
+    const engineerId = db.saveAgent({
+      companyId,
+      name: "Engineer",
+      role: "Engineer",
+      title: "Lead Engineer",
+      status: "active",
+      reportsTo: ceoId,
+      connectorId: "codex_local",
+      workspaceId,
+      model: null,
+      capabilities: "Ship features",
+      budgetMonthlyUsd: 180,
+      department: "engineering",
+    });
+    const taskId = db.saveTask({
+      companyId,
+      title: "Ship feature",
+      description: "Waits for cofounder review.",
+      assigneeAgentId: engineerId,
+      workspaceId,
+      priority: "high",
+      status: "in_progress",
+    });
+
+    const threadIntegration = createThreadIntegration({
+      db,
+      logger: { info: () => {}, error: () => {} },
+    });
+
+    threadIntegration.onTaskCreated(taskId, companyId);
+    threadIntegration.onRunFinished("run-1", taskId, engineerId, companyId, "succeeded", null);
+    db.setTaskRequiresUserReview(taskId, true);
+    const approvalId = db.requestApproval({
+      companyId,
+      relatedTaskId: taskId,
+      requestedByAgentId: engineerId,
+      type: "deliverable_review",
+      payloadSummary: "Review deliverable",
+      impactSummary: "Needs review",
+      payloadJson: "{}",
+    });
+    threadIntegration.onApprovalCreated(approvalId, companyId, taskId, "deliverable_review", "Review deliverable");
+
+    expect(db.listThreadWaitStates(companyId).length).toBeGreaterThan(0);
+    expect(db.getTask(taskId).requiresUserReview).toBe(true);
+    expect(db.getApprovalRecord(approvalId).state).toBe("pending");
+
+    const handlers = new Map<string, (...args: any[]) => any>();
+    registerCoreAdminHandlers({
+      registerHandle: (channel, handler) => {
+        handlers.set(channel, handler);
+      },
+      db,
+      ensureCompanyExists: (id) => (db.hasCompany(id) ? null : { ok: false, error: { code: "COMPANY_NOT_FOUND", message: "missing" } }),
+      publishDomainChanged: vi.fn(),
+      handleApprovalResolved: (resolvedApprovalId, resolvedCompanyId, decision) => {
+        threadIntegration.onApprovalResolved(resolvedApprovalId, resolvedCompanyId, decision);
+      },
+      checkConnector: vi.fn(),
+      openConnectorAuthTerminal: vi.fn(),
+      openGenericTerminal: vi.fn(),
+    });
+
+    const saveCompany = handlers.get(IPC_CHANNELS.saveCompany);
+    if (!saveCompany) {
+      throw new Error("saveCompany handler was not registered.");
+    }
+
+    const result = await saveCompany(null, {
+      id: companyId,
+      name: "Mode Switch Co",
+      description: "Execution mode cleanup",
+      status: "active",
+      autoApproveHires: true,
+      reviewDeliverables: false,
+      executionMode: "ai_ceo",
+    }) as { ok: boolean };
+
+    expect(result.ok).toBe(true);
+    expect(db.getCompanyExecutionMode(companyId)).toBe("ai_ceo");
+    expect(db.listThreadWaitStates(companyId)).toHaveLength(0);
+    expect(db.getTask(taskId).requiresUserReview).toBe(false);
+    expect(db.getApprovalRecord(approvalId).state).toBe("approved");
+
+    db.close();
+  });
+});

tests/unit/ipc-core-admin-handlers.test.ts

@@ -32,6 +32,7 @@ describe("ipc-core-admin-handlers connector saves", () => {
       db,
       ensureCompanyExists: () => null,
       publishDomainChanged: vi.fn(),
+      handleApprovalResolved: vi.fn(),
       checkConnector: vi.fn(),
       openConnectorAuthTerminal: vi.fn(),
       openGenericTerminal: vi.fn(),