@paperclipai/server 2026.824.0 → 2026.825.0-beta.1

package/dist/services/issue-thread-interactions.js

@@ -1,6 +1,6 @@
 import { isDeepStrictEqual } from "node:util";
 import { and, asc, desc, eq, inArray, isNotNull, isNull, ne } from "drizzle-orm";
-import { agents, companies, documents, heartbeatRuns, issueComments, issueDocuments, issueThreadInteractions, issues, toolActionRequests, } from "@paperclipai/db";
+import { agents, companySecretProposals, companies, documents, heartbeatRuns, issueComments, issueDocuments, issueThreadInteractions, issues, toolActionRequests, } from "@paperclipai/db";
 import { trackInteractionCreated, trackInteractionResolved } from "@paperclipai/shared/telemetry";
 import { acceptIssueThreadInteractionSchema, askUserQuestionsPayloadSchema, askUserQuestionsResultSchema, cancelIssueThreadInteractionSchema, createIssueThreadInteractionSchema, legacyIssueThreadInteractionResolverPolicyAlias, normalizeIssueThreadInteractionResolverPolicy, rejectIssueThreadInteractionSchema, requestCheckboxConfirmationPayloadSchema, requestCheckboxConfirmationResultSchema, requestConfirmationPayloadSchema, requestConfirmationResultSchema, requestItemVerdictsPayloadSchema, requestItemVerdictsResultSchema, suggestTasksPayloadSchema, suggestTasksResultSchema, submitIssueThreadInteractionVerdictsSchema, withdrawIssueThreadInteractionSchema, } from "@paperclipai/shared";
 import { conflict, forbidden, notFound, unprocessable } from "../errors.js";
@@ -78,7 +78,7 @@ export function getMergeConfirmationPullRequestReferences(row) {
     const payload = row.payload && typeof row.payload === "object" && !Array.isArray(row.payload)
         ? row.payload
         : null;
-    if (!payload || payload.toolAction !== undefined)
+    if (!payload || payload.toolAction !== undefined || payload.secretProposal !== undefined)
         return [];
     const target = payload.target && typeof payload.target === "object" && !Array.isArray(payload.target)
         ? payload.target
@@ -129,7 +129,7 @@ export function resolveInteractionPolicy(args) {
     const resolverPolicyProvenance = args.requested === undefined ? "inherited" : "explicit";
     let effectiveResolverPolicy = requestedResolverPolicy;
     let effectiveResolverPolicySource = "requested";
-    if (args.hasToolAction) {
+    if (args.hasToolAction || args.hasSecretProposal) {
         effectiveResolverPolicy = "human_only";
         effectiveResolverPolicySource = "governed_action";
     }
@@ -167,8 +167,8 @@ function assertInteractionResolutionAllowed(current, actor) {
         governedAction: current.kind === "request_confirmation"
             && current.payload !== null
             && typeof current.payload === "object"
-            && "toolAction" in current.payload
-            && current.payload.toolAction !== undefined,
+            && (("toolAction" in current.payload && current.payload.toolAction !== undefined)
+                || ("secretProposal" in current.payload && current.payload.secretProposal !== undefined)),
     });
 }
 async function assertRequestConfirmationResolutionAllowedUnderLock(tx, issue, interaction, actor) {
@@ -488,7 +488,20 @@ function buildAdministrativeOutcomeResult(row, outcome, reason = null) {
             items: interaction.result?.items ?? [],
         };
     }
-    return { version: 1, outcome, reason };
+    return {
+        version: 1,
+        outcome,
+        reason,
+        ...(linkedSecretProposalId(row)
+            ? {
+                secretProposal: {
+                    version: 1,
+                    status: outcome === "withdrawn" ? "withdrawn" : "expired",
+                    updatedAt: new Date().toISOString(),
+                },
+            }
+            : {}),
+    };
 }
 // Rollback sentinel: the interaction was resolved by another actor between the
 // pending-rows read and the conditional update, so the enclosing transaction's
@@ -516,6 +529,65 @@ async function resolveLinkedToolActionRequests(db, interaction, outcome) {
     })
         .where(and(eq(toolActionRequests.companyId, interaction.companyId), eq(toolActionRequests.interactionId, interaction.id), inArray(toolActionRequests.status, outcome.fromStatuses)));
 }
+function linkedSecretProposalId(interaction) {
+    if (interaction.kind !== "request_confirmation")
+        return null;
+    const payload = interaction.payload && typeof interaction.payload === "object" && !Array.isArray(interaction.payload)
+        ? interaction.payload
+        : null;
+    const secretProposal = payload?.secretProposal && typeof payload.secretProposal === "object" && !Array.isArray(payload.secretProposal)
+        ? payload.secretProposal
+        : null;
+    return typeof secretProposal?.proposalId === "string" ? secretProposal.proposalId : null;
+}
+async function lockLinkedSecretProposal(db, interaction) {
+    const proposalId = linkedSecretProposalId(interaction);
+    if (!proposalId)
+        return;
+    await db
+        .select({ id: companySecretProposals.id })
+        .from(companySecretProposals)
+        .where(and(eq(companySecretProposals.id, proposalId), eq(companySecretProposals.companyId, interaction.companyId), eq(companySecretProposals.interactionId, interaction.id)))
+        .for("update");
+}
+async function resolveLinkedSecretProposal(db, interaction, outcome) {
+    const proposalId = linkedSecretProposalId(interaction);
+    if (!proposalId)
+        return;
+    const [proposal] = await db
+        .update(companySecretProposals)
+        .set({
+        status: outcome.status,
+        resolvedByUserId: outcome.actor.userId ?? null,
+        resolvedAt: outcome.now,
+        resolutionReason: outcome.reason ?? null,
+        valueCiphertext: null,
+        ciphertextScrubbedAt: outcome.now,
+        updatedAt: outcome.now,
+    })
+        .where(and(eq(companySecretProposals.id, proposalId), eq(companySecretProposals.companyId, interaction.companyId), eq(companySecretProposals.interactionId, interaction.id), eq(companySecretProposals.status, "pending")))
+        .returning();
+    if (!proposal)
+        throw conflict("Linked secret proposal is no longer pending");
+    const actorType = outcome.actor.userId ? "user" : outcome.actor.agentId ? "agent" : "system";
+    const actorId = outcome.actor.userId ?? outcome.actor.agentId ?? outcome.actor.systemId ?? "system";
+    await logActivity(db, {
+        companyId: interaction.companyId,
+        actorType,
+        actorId,
+        action: `secret.proposal.${outcome.status}`,
+        entityType: "company_secret_proposal",
+        entityId: proposal.id,
+        agentId: proposal.proposedByAgentId,
+        runId: proposal.originRunId,
+        details: {
+            ciphertextScrubbed: true,
+            issueId: proposal.originIssueId,
+            interactionId: interaction.id,
+            reason: outcome.reason ?? null,
+        },
+    });
+}
 function resolveActorKind(interaction) {
     if (interaction.resolvedByAgentId)
         return "agent";
@@ -1066,9 +1138,11 @@ export function issueThreadInteractionService(db, opts = {}) {
             throw interactionTerminalError({ status: expired.status, result: expired.result });
         const now = new Date();
         const result = await db.transaction(async (tx) => {
-            // Lock the issue before claiming the interaction. Policy mutations and
-            // review transitions use the same issue-row lock, so the authoritative
-            // review policy and requester are stable through the verdict write.
+            // Policy mutations and review transitions use the same issue-row lock,
+            // so the authoritative review policy and requester are stable through
+            // the verdict write. Terminal issue transitions also lock the issue
+            // before expiring linked proposals, so keep issue -> proposal ->
+            // interaction as the shared lifecycle order.
             const issueContext = await tx
                 .select({
                 id: issues.id,
@@ -1087,6 +1161,7 @@ export function issueThreadInteractionService(db, opts = {}) {
             if (!issueContext || issueContext.companyId !== args.issue.companyId) {
                 throw notFound("Issue not found");
             }
+            await lockLinkedSecretProposal(tx, args.current);
             const lockedCurrent = await tx
                 .select()
                 .from(issueThreadInteractions)
@@ -1216,6 +1291,10 @@ export function issueThreadInteractionService(db, opts = {}) {
             if (!issueContext || issueContext.companyId !== args.issue.companyId) {
                 throw notFound("Issue not found");
             }
+            // Terminal issue transitions expire linked proposals while holding this
+            // issue row. Match their issue -> proposal -> interaction order so a
+            // close/cancel race cannot invert the first two locks.
+            await lockLinkedSecretProposal(tx, args.current);
             const lockedCurrent = await tx
                 .select()
                 .from(issueThreadInteractions)
@@ -1231,6 +1310,12 @@ export function issueThreadInteractionService(db, opts = {}) {
                 throw issueThreadInteractionResolutionError(409, "interaction_already_resolved", "Interaction has already been resolved");
             }
             await assertRequestConfirmationResolutionAllowedUnderLock(tx, issueContext, lockedCurrent, args.actor);
+            await resolveLinkedSecretProposal(tx, lockedCurrent, {
+                status: "rejected",
+                actor: args.actor,
+                reason: reason || null,
+                now,
+            });
             const [resolved] = await tx
                 .update(issueThreadInteractions)
                 .set({
@@ -1239,6 +1324,9 @@ export function issueThreadInteractionService(db, opts = {}) {
                     version: 1,
                     outcome: "rejected",
                     reason: reason || null,
+                    ...(linkedSecretProposalId(lockedCurrent)
+                        ? { secretProposal: { version: 1, status: "rejected", updatedAt: now.toISOString() } }
+                        : {}),
                 },
                 resolvedByAgentId: args.actor.agentId ?? null,
                 resolvedByRunId: args.actor.runId ?? null,
@@ -1407,6 +1495,109 @@ export function issueThreadInteractionService(db, opts = {}) {
                 .then((rows) => rows[0] ?? null);
             return row ? hydrateInteraction(row) : null;
         },
+        recordSecretProposalExecutionResult: async (issue, interactionId, proposalId, execution) => {
+            const updated = await db.transaction(async (tx) => {
+                // Verdict and terminal-transition paths lock issue -> proposal ->
+                // interaction. Take the same order before recording the receipt so a
+                // concurrent rejection or issue close cannot deadlock here.
+                const lockedIssue = await tx
+                    .select({ id: issues.id })
+                    .from(issues)
+                    .where(and(eq(issues.id, issue.id), eq(issues.companyId, issue.companyId)))
+                    .for("update")
+                    .then((rows) => rows[0] ?? null);
+                if (!lockedIssue)
+                    throw notFound("Issue not found");
+                const proposal = await tx
+                    .select()
+                    .from(companySecretProposals)
+                    .where(and(eq(companySecretProposals.id, proposalId), eq(companySecretProposals.companyId, issue.companyId)))
+                    .for("update")
+                    .then((rows) => rows[0] ?? null);
+                const current = await tx
+                    .select()
+                    .from(issueThreadInteractions)
+                    .where(eq(issueThreadInteractions.id, interactionId))
+                    .for("update")
+                    .then((rows) => rows[0] ?? null);
+                if (!current || current.companyId !== issue.companyId || current.issueId !== issue.id) {
+                    throw notFound("Interaction not found");
+                }
+                if (!proposal
+                    || proposal.interactionId !== interactionId
+                    || current.status !== "accepted"
+                    || linkedSecretProposalId(current) !== proposalId) {
+                    throw conflict("Secret proposal interaction is not awaiting an execution result");
+                }
+                const now = new Date();
+                const payload = current.payload && typeof current.payload === "object" && !Array.isArray(current.payload)
+                    ? current.payload
+                    : {};
+                const secretProposalPayload = payload.secretProposal && typeof payload.secretProposal === "object"
+                    && !Array.isArray(payload.secretProposal)
+                    ? payload.secretProposal
+                    : {};
+                const proposalAlreadyExecuted = proposal.status === "approved"
+                    && proposal.appliedBindingConfigPath === secretProposalPayload.configPath;
+                const executionStatus = proposalAlreadyExecuted ? "executed" : execution.status;
+                if (executionStatus === "failed" && proposal.status === "pending") {
+                    const resolutionReason = `Interaction acceptance failed: ${execution.errorCode ?? "secret_proposal_execution_failed"}`;
+                    await tx
+                        .update(companySecretProposals)
+                        .set({
+                        status: "rejected",
+                        resolvedByUserId: current.resolvedByUserId ?? null,
+                        resolvedAt: now,
+                        resolutionReason,
+                        valueCiphertext: null,
+                        ciphertextScrubbedAt: now,
+                        updatedAt: now,
+                    })
+                        .where(and(eq(companySecretProposals.id, proposal.id), eq(companySecretProposals.status, "pending")));
+                    await logActivity(tx, {
+                        companyId: issue.companyId,
+                        actorType: current.resolvedByUserId ? "user" : "system",
+                        actorId: current.resolvedByUserId ?? "system",
+                        action: "secret.proposal.rejected",
+                        entityType: "company_secret_proposal",
+                        entityId: proposal.id,
+                        agentId: proposal.proposedByAgentId,
+                        runId: proposal.originRunId,
+                        details: {
+                            ciphertextScrubbed: true,
+                            issueId: proposal.originIssueId,
+                            interactionId: current.id,
+                            reason: resolutionReason,
+                            executionFailed: true,
+                        },
+                    });
+                }
+                const result = current.result && typeof current.result === "object" && !Array.isArray(current.result)
+                    ? current.result
+                    : {};
+                const [row] = await tx
+                    .update(issueThreadInteractions)
+                    .set({
+                    result: {
+                        ...result,
+                        version: 1,
+                        outcome: "accepted",
+                        secretProposal: {
+                            version: 1,
+                            status: executionStatus,
+                            errorCode: executionStatus === "failed" ? execution.errorCode ?? null : null,
+                            updatedAt: now.toISOString(),
+                        },
+                    },
+                    updatedAt: now,
+                })
+                    .where(eq(issueThreadInteractions.id, current.id))
+                    .returning();
+                await touchIssue(tx, issue.id);
+                return row;
+            });
+            return hydrateInteraction(updated);
+        },
         cancelPendingForDeletedAddressee: async (companyId, addresseeAgentId) => {
             const rows = await db
                 .select()
@@ -1511,6 +1702,7 @@ export function issueThreadInteractionService(db, opts = {}) {
                 requested: data.resolverPolicy,
                 governance,
                 hasToolAction: data.kind === "request_confirmation" && data.payload.toolAction !== undefined,
+                hasSecretProposal: data.kind === "request_confirmation" && data.payload.secretProposal !== undefined,
             });
             const normalizedData = { ...data, resolverPolicy: policy.requestedResolverPolicy };
             if (normalizedData.addresseeAgentId) {
@@ -1520,6 +1712,9 @@ export function issueThreadInteractionService(db, opts = {}) {
                 if (normalizedData.kind === "request_confirmation" && normalizedData.payload.toolAction !== undefined) {
                     throw unprocessable("Tool-action confirmations cannot be addressed to agents");
                 }
+                if (normalizedData.kind === "request_confirmation" && normalizedData.payload.secretProposal !== undefined) {
+                    throw unprocessable("Secret-proposal confirmations cannot be addressed to agents");
+                }
                 const addressee = await db
                     .select({
                     id: agents.id,
@@ -1644,7 +1839,10 @@ export function issueThreadInteractionService(db, opts = {}) {
                     // question cards that agents never withdrew). Each kind keeps its own
                     // result shape. Scoped strictly to the same agent + issue + kind, so
                     // other agents' or other kinds' pending cards are untouched.
-                    const canSupersedeSiblingCards = data.kind === "request_confirmation" || data.kind === "ask_user_questions";
+                    const canSupersedeSiblingCards = (data.kind === "request_confirmation"
+                        && data.payload.toolAction === undefined
+                        && data.payload.secretProposal === undefined)
+                        || data.kind === "ask_user_questions";
                     if (!actor.agentId || !canSupersedeSiblingCards) {
                         return { row, supersededRows: [] };
                     }
@@ -2281,6 +2479,12 @@ export function issueThreadInteractionService(db, opts = {}) {
                         actor,
                         now,
                     });
+                    await resolveLinkedSecretProposal(tx, row, {
+                        status: "expired",
+                        actor,
+                        reason: "Issue closed before the secret proposal was resolved",
+                        now,
+                    });
                     const [resolved] = await tx
                         .update(issueThreadInteractions)
                         .set({
@@ -2340,6 +2544,12 @@ export function issueThreadInteractionService(db, opts = {}) {
                     actor,
                     now,
                 });
+                await resolveLinkedSecretProposal(tx, current, {
+                    status: "withdrawn",
+                    actor,
+                    reason,
+                    now,
+                });
                 if (current.kind === "request_confirmation") {
                     const active = await tx
                         .select({ id: toolActionRequests.id })