feat: agent instructions path API with chain-of-command authz

Add PATCH /agents/:id/instructions-path endpoint for setting or clearing
an agent's instructions file path. Supports relative path resolution
against adapterConfig.cwd. Enforce chain-of-command authorization —
only the agent itself, board members, or ancestor managers can update.
Guard instructions path keys in the general agent update endpoint too.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/shared/src/index.ts

@@ -131,6 +131,7 @@ export {
   createAgentSchema,
   createAgentHireSchema,
   updateAgentSchema,
+  updateAgentInstructionsPathSchema,
   createAgentKeySchema,
   wakeAgentSchema,
   resetAgentSessionSchema,
@@ -140,6 +141,7 @@ export {
   type CreateAgent,
   type CreateAgentHire,
   type UpdateAgent,
+  type UpdateAgentInstructionsPath,
   type CreateAgentKey,
   type WakeAgent,
   type ResetAgentSession,

packages/shared/src/validators/agent.ts

@@ -59,6 +59,13 @@ export const updateAgentSchema = createAgentSchema
 
 export type UpdateAgent = z.infer<typeof updateAgentSchema>;
 
+export const updateAgentInstructionsPathSchema = z.object({
+  path: z.string().trim().min(1).nullable(),
+  adapterConfigKey: z.string().trim().min(1).optional(),
+});
+
+export type UpdateAgentInstructionsPath = z.infer<typeof updateAgentInstructionsPathSchema>;
+
 export const createAgentKeySchema = z.object({
   name: z.string().min(1).default("default"),
 });

packages/shared/src/validators/index.ts

@@ -9,6 +9,7 @@ export {
   createAgentSchema,
   createAgentHireSchema,
   updateAgentSchema,
+  updateAgentInstructionsPathSchema,
   createAgentKeySchema,
   wakeAgentSchema,
   resetAgentSessionSchema,
@@ -18,6 +19,7 @@ export {
   type CreateAgent,
   type CreateAgentHire,
   type UpdateAgent,
+  type UpdateAgentInstructionsPath,
   type CreateAgentKey,
   type WakeAgent,
   type ResetAgentSession,