@penclipai/server 2026.426.0 → 2026.505.0

package/dist/routes/issues.js

@@ -3,18 +3,18 @@ import { Router } from "express";
 import multer from "multer";
 import { z } from "zod";
 import { issueExecutionDecisions } from "@penclipai/db";
-import { addIssueCommentSchema, acceptIssueThreadInteractionSchema, createIssueAttachmentMetadataSchema, createIssueThreadInteractionSchema, createIssueWorkProductSchema, createIssueLabelSchema, checkoutIssueSchema, createChildIssueSchema, createIssueSchema, feedbackTargetTypeSchema, feedbackTraceStatusSchema, feedbackVoteValueSchema, upsertIssueFeedbackVoteSchema, linkIssueApprovalSchema, issueDocumentKeySchema, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, rejectIssueThreadInteractionSchema, restoreIssueDocumentRevisionSchema, respondIssueThreadInteractionSchema, updateIssueWorkProductSchema, upsertIssueDocumentSchema, updateIssueSchema, getClosedIsolatedExecutionWorkspaceMessage, isClosedIsolatedExecutionWorkspace, } from "@penclipai/shared";
+import { addIssueCommentSchema, acceptIssueThreadInteractionSchema, cancelIssueThreadInteractionSchema, createIssueAttachmentMetadataSchema, createIssueThreadInteractionSchema, createIssueWorkProductSchema, createIssueLabelSchema, checkoutIssueSchema, createChildIssueSchema, createIssueSchema, feedbackTargetTypeSchema, feedbackTraceStatusSchema, feedbackVoteValueSchema, upsertIssueFeedbackVoteSchema, linkIssueApprovalSchema, issueDocumentKeySchema, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, rejectIssueThreadInteractionSchema, restoreIssueDocumentRevisionSchema, respondIssueThreadInteractionSchema, updateIssueWorkProductSchema, upsertIssueDocumentSchema, updateIssueSchema, getClosedIsolatedExecutionWorkspaceMessage, isClosedIsolatedExecutionWorkspace, normalizeIssueIdentifier as normalizeIssueReferenceIdentifier, } from "@penclipai/shared";
 import { getTelemetryClient } from "../telemetry.js";
 import { trackAgentTaskCompleted } from "@penclipai/shared/telemetry";
 import { validate } from "../middleware/validate.js";
 import * as serviceIndex from "../services/index.js";
-import { accessService, agentService, goalService, heartbeatService, issueApprovalService, issueThreadInteractionService, ISSUE_LIST_DEFAULT_LIMIT, ISSUE_LIST_MAX_LIMIT, issueReferenceService, issueService, clampIssueListLimit, documentService, logActivity, projectService, routineService, workProductService, } from "../services/index.js";
+import { accessService, agentService, companyService, goalService, heartbeatService, issueApprovalService, issueThreadInteractionService, ISSUE_LIST_DEFAULT_LIMIT, ISSUE_LIST_MAX_LIMIT, issueReferenceService, issueService, clampIssueListLimit, documentService, logActivity, projectService, routineService, workProductService, } from "../services/index.js";
 import { logger } from "../middleware/logger.js";
 import { conflict, forbidden, HttpError, notFound, unauthorized } from "../errors.js";
 import { assertBoard, assertCompanyAccess, getActorInfo } from "./authz.js";
 import { assertNoAgentHostWorkspaceCommandMutation, collectIssueWorkspaceCommandPaths, } from "./workspace-command-authz.js";
 import { shouldWakeAssigneeOnCheckout } from "./issues-checkout-wakeup.js";
-import { isInlineAttachmentContentType, MAX_ATTACHMENT_BYTES, normalizeContentType, SVG_CONTENT_TYPE, } from "../attachment-types.js";
+import { isInlineAttachmentContentType, normalizeIssueAttachmentMaxBytes, normalizeContentType, SVG_CONTENT_TYPE, } from "../attachment-types.js";
 import { queueIssueAssignmentWakeup } from "../services/issue-assignment-wakeup.js";
 import { resolveExplicitRequestUiLocale } from "../ui-locale.js";
 import { assertEnvironmentSelectionForCompany } from "./environment-selection.js";
@@ -22,7 +22,7 @@ import { executionWorkspaceService as executionWorkspaceServiceDirect } from "..
 import { feedbackService } from "../services/feedback.js";
 import { instanceSettingsService } from "../services/instance-settings.js";
 import { environmentService } from "../services/environments.js";
-import { applyIssueExecutionPolicyTransition, normalizeIssueExecutionPolicy, parseIssueExecutionState, } from "../services/issue-execution-policy.js";
+import { applyIssueExecutionPolicyTransition, normalizeIssueExecutionPolicy, parseIssueExecutionState, redactIssueMonitorExternalRef, setIssueExecutionPolicyMonitorScheduledBy, } from "../services/issue-execution-policy.js";
 const MAX_ISSUE_COMMENT_LIMIT = 500;
 const updateIssueRouteSchema = updateIssueSchema.extend({
     interrupt: z.boolean().optional(),
@@ -73,6 +73,39 @@ function summarizeIssueReferenceActivityDetails(input) {
         ...(input.currentReferencedIssues.length > 0 ? { currentReferencedIssues: input.currentReferencedIssues } : {}),
     };
 }
+function monitorPoliciesEqual(left, right) {
+    return JSON.stringify(left?.monitor ?? null) === JSON.stringify(right?.monitor ?? null);
+}
+function applyActorMonitorScheduledBy(policy, actorType) {
+    return setIssueExecutionPolicyMonitorScheduledBy(policy, actorType === "user" ? "board" : "assignee");
+}
+function assertCanManageIssueMonitor(req, assigneeAgentId, monitorChanged) {
+    if (!monitorChanged)
+        return;
+    if (req.actor.type === "board")
+        return;
+    if (req.actor.type === "agent" && req.actor.agentId && req.actor.agentId === assigneeAgentId)
+        return;
+    throw forbidden("Only the assignee agent or a board user can manage issue monitors");
+}
+function summarizeIssueMonitor(issue, policy) {
+    const state = parseIssueExecutionState(issue.executionState);
+    return {
+        nextCheckAt: issue.monitorNextCheckAt?.toISOString() ?? policy?.monitor?.nextCheckAt ?? null,
+        lastTriggeredAt: issue.monitorLastTriggeredAt?.toISOString() ?? state?.monitor?.lastTriggeredAt ?? null,
+        attemptCount: issue.monitorAttemptCount ?? state?.monitor?.attemptCount ?? 0,
+        notes: policy?.monitor?.notes ?? issue.monitorNotes ?? state?.monitor?.notes ?? null,
+        scheduledBy: issue.monitorScheduledBy ?? policy?.monitor?.scheduledBy ?? state?.monitor?.scheduledBy ?? null,
+        kind: policy?.monitor?.kind ?? state?.monitor?.kind ?? null,
+        serviceName: policy?.monitor?.serviceName ?? state?.monitor?.serviceName ?? null,
+        externalRef: redactIssueMonitorExternalRef(policy?.monitor?.externalRef ?? state?.monitor?.externalRef ?? null),
+        timeoutAt: policy?.monitor?.timeoutAt ?? state?.monitor?.timeoutAt ?? null,
+        maxAttempts: policy?.monitor?.maxAttempts ?? state?.monitor?.maxAttempts ?? null,
+        recoveryPolicy: policy?.monitor?.recoveryPolicy ?? state?.monitor?.recoveryPolicy ?? null,
+        status: state?.monitor?.status ?? (policy?.monitor ? "scheduled" : null),
+        clearReason: state?.monitor?.clearReason ?? null,
+    };
+}
 function activityExecutionParticipantKey(participant) {
     return participant.type === "agent" ? `agent:${participant.agentId}` : `user:${participant.userId}`;
 }
@@ -251,6 +284,7 @@ export function issueRoutes(db, storage, opts = {}) {
         pluginWorkerManager: opts.pluginWorkerManager,
     });
     const feedback = feedbackService(db);
+    const companiesSvc = companyService(db);
     const instanceSettings = instanceSettingsService(db);
     const agentsSvc = agentService(db);
     const projectsSvc = projectService(db);
@@ -271,10 +305,6 @@ export function issueRoutes(db, storage, opts = {}) {
     };
     const feedbackExportService = opts?.feedbackExportService;
     const environmentsSvc = environmentService(db);
-    const upload = multer({
-        storage: multer.memoryStorage(),
-        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
-    });
     function withContentPath(attachment) {
         return {
             ...attachment,
@@ -323,7 +353,11 @@ export function issueRoutes(db, storage, opts = {}) {
     function translateMessage(req, key) {
         return typeof req.t === "function" ? req.t(key) : key;
     }
-    async function runSingleFileUpload(req, res) {
+    async function runSingleFileUpload(req, res, fileSizeLimit) {
+        const upload = multer({
+            storage: multer.memoryStorage(),
+            limits: { fileSize: fileSizeLimit, files: 1 },
+        });
         await new Promise((resolve, reject) => {
             upload.single("file")(req, res, (err) => {
                 if (err)
@@ -431,23 +465,40 @@ export function issueRoutes(db, storage, opts = {}) {
             res.status(403).json({ error: "Agent authentication required" });
             return false;
         }
-        if (issue.status !== "in_progress" || issue.assigneeAgentId === null) {
+        if (issue.assigneeAgentId === null) {
             return true;
         }
         if (issue.assigneeAgentId !== actorAgentId) {
             if (await hasActiveCheckoutManagementOverride(actorAgentId, issue.companyId, issue.assigneeAgentId)) {
                 return true;
             }
-            res.status(409).json({
-                error: "Issue is checked out by another agent",
-                details: {
-                    issueId: issue.id,
-                    assigneeAgentId: issue.assigneeAgentId,
-                    actorAgentId,
-                },
-            });
+            if (issue.status === "in_progress") {
+                res.status(409).json({
+                    error: "Issue is checked out by another agent",
+                    details: {
+                        issueId: issue.id,
+                        assigneeAgentId: issue.assigneeAgentId,
+                        actorAgentId,
+                    },
+                });
+            }
+            else {
+                res.status(403).json({
+                    error: "Agent cannot mutate another agent's issue",
+                    details: {
+                        issueId: issue.id,
+                        assigneeAgentId: issue.assigneeAgentId,
+                        actorAgentId,
+                        status: issue.status,
+                        securityPrinciples: ["Least Privilege", "Complete Mediation", "Fail Securely"],
+                    },
+                });
+            }
             return false;
         }
+        if (issue.status !== "in_progress") {
+            return true;
+        }
         const runId = requireAgentRunId(req, res);
         if (!runId)
             return false;
@@ -479,7 +530,6 @@ export function issueRoutes(db, storage, opts = {}) {
                 details: {
                     issueId: issue.id,
                     status: issue.status,
-                    securityPrinciples: ["Complete Mediation", "Fail Securely"],
                 },
             });
             return false;
@@ -500,7 +550,6 @@ export function issueRoutes(db, storage, opts = {}) {
                     holdId: activePauseHold.holdId,
                     rootIssueId: activePauseHold.rootIssueId,
                     mode: activePauseHold.mode,
-                    securityPrinciples: ["Complete Mediation", "Fail Securely", "Secure Defaults"],
                 },
             });
             return false;
@@ -609,9 +658,10 @@ export function issueRoutes(db, storage, opts = {}) {
             executionWorkspace: workspace,
         });
     }
-    async function normalizeIssueIdentifier(rawId) {
-        if (/^[A-Z]+-\d+$/i.test(rawId)) {
-            const issue = await svc.getByIdentifier(rawId);
+    async function resolveIssueRouteId(rawId) {
+        const identifier = normalizeIssueReferenceIdentifier(rawId);
+        if (identifier) {
+            const issue = await svc.getByIdentifier(identifier);
             if (issue) {
                 return issue.id;
             }
@@ -639,7 +689,7 @@ export function issueRoutes(db, storage, opts = {}) {
     // Resolve issue identifiers (e.g. "PAP-39") to UUIDs for all /issues/:id routes
     router.param("id", async (req, res, next, rawId) => {
         try {
-            req.params.id = await normalizeIssueIdentifier(rawId);
+            req.params.id = await resolveIssueRouteId(rawId);
             next();
         }
         catch (err) {
@@ -649,7 +699,7 @@ export function issueRoutes(db, storage, opts = {}) {
     // Resolve issue identifiers (e.g. "PAP-39") to UUIDs for company-scoped attachment routes.
     router.param("issueId", async (req, res, next, rawId) => {
         try {
-            req.params.issueId = await normalizeIssueIdentifier(rawId);
+            req.params.issueId = await resolveIssueRouteId(rawId);
             next();
         }
         catch (err) {
@@ -687,6 +737,10 @@ export function issueRoutes(db, storage, opts = {}) {
             ? Number.parseInt(rawLimit, 10)
             : null;
         const limit = parsedLimit === null ? ISSUE_LIST_DEFAULT_LIMIT : clampIssueListLimit(parsedLimit);
+        const rawOffset = req.query.offset;
+        const parsedOffset = rawOffset !== undefined && /^\d+$/.test(rawOffset)
+            ? Number.parseInt(rawOffset, 10)
+            : null;
         if (assigneeUserFilterRaw === "me" && (!assigneeUserId || req.actor.type !== "board")) {
             res.status(403).json({ error: "assigneeUserId=me requires board authentication" });
             return;
@@ -707,6 +761,11 @@ export function issueRoutes(db, storage, opts = {}) {
             res.status(400).json({ error: `limit must be a positive integer up to ${ISSUE_LIST_MAX_LIMIT}` });
             return;
         }
+        if (rawOffset !== undefined && (parsedOffset === null || !Number.isInteger(parsedOffset) || parsedOffset < 0)) {
+            res.status(400).json({ error: "offset must be a non-negative integer" });
+            return;
+        }
+        const offset = parsedOffset ?? 0;
         const result = await svc.list(companyId, {
             status: normalizedStatus,
             assigneeAgentId: req.query.assigneeAgentId,
@@ -725,8 +784,10 @@ export function issueRoutes(db, storage, opts = {}) {
             originId: req.query.originId,
             includeRoutineExecutions: req.query.includeRoutineExecutions === "true" || req.query.includeRoutineExecutions === "1",
             excludeRoutineExecutions: req.query.excludeRoutineExecutions === "true" || req.query.excludeRoutineExecutions === "1",
+            includeBlockedBy: req.query.includeBlockedBy === "true" || req.query.includeBlockedBy === "1",
             q: req.query.q,
             limit,
+            offset,
         });
         res.json(result);
     });
@@ -795,13 +856,14 @@ export function issueRoutes(db, storage, opts = {}) {
         const currentExecutionWorkspacePromise = issue.executionWorkspaceId
             ? executionWorkspacesSvc.getById(issue.executionWorkspaceId)
             : Promise.resolve(null);
-        const [{ project, goal }, ancestors, commentCursor, wakeComment, relations, blockerAttention, attachments, continuationSummary, currentExecutionWorkspace,] = await Promise.all([
+        const [{ project, goal }, ancestors, commentCursor, wakeComment, relations, blockerAttention, productivityReview, attachments, continuationSummary, currentExecutionWorkspace,] = await Promise.all([
             resolveIssueProjectAndGoal(issue),
             svc.getAncestors(issue.id),
             svc.getCommentCursor(issue.id),
             wakeCommentId ? svc.getComment(wakeCommentId) : null,
             svc.getRelationSummaries(issue.id),
             svc.listBlockerAttention(issue.companyId, [issue]).then((map) => map.get(issue.id) ?? null),
+            svc.listProductivityReviews(issue.companyId, [issue.id]).then((map) => map.get(issue.id) ?? null),
             svc.listAttachments(issue.id),
             documentsSvc.getIssueDocumentByKey(issue.id, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY),
             currentExecutionWorkspacePromise,
@@ -814,6 +876,7 @@ export function issueRoutes(db, storage, opts = {}) {
                 description: issue.description,
                 status: issue.status,
                 ...(blockerAttention ? { blockerAttention } : {}),
+                productivityReview,
                 priority: issue.priority,
                 projectId: issue.projectId,
                 goalId: goal?.id ?? issue.goalId,
@@ -822,6 +885,8 @@ export function issueRoutes(db, storage, opts = {}) {
                 blocks: relations.blocks,
                 assigneeAgentId: issue.assigneeAgentId,
                 assigneeUserId: issue.assigneeUserId,
+                originKind: issue.originKind,
+                originId: issue.originId,
                 updatedAt: issue.updatedAt,
             },
             ancestors: ancestors.map((ancestor) => ({
@@ -881,13 +946,14 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
-        const [{ project, goal }, ancestors, mentionedProjectIds, documentPayload, relations, blockerAttention, referenceSummary] = await Promise.all([
+        const [{ project, goal }, ancestors, mentionedProjectIds, documentPayload, relations, blockerAttention, productivityReview, referenceSummary,] = await Promise.all([
             resolveIssueProjectAndGoal(issue),
             svc.getAncestors(issue.id),
             svc.findMentionedProjectIds(issue.id, { includeCommentBodies: false }),
             documentsSvc.getIssueDocumentPayload(issue),
             svc.getRelationSummaries(issue.id),
             svc.listBlockerAttention(issue.companyId, [issue]).then((map) => map.get(issue.id) ?? null),
+            svc.listProductivityReviews(issue.companyId, [issue.id]).then((map) => map.get(issue.id) ?? null),
             issueReferencesSvc.listIssueReferenceSummary(issue.id),
         ]);
         const mentionedProjects = mentionedProjectIds.length > 0
@@ -902,6 +968,7 @@ export function issueRoutes(db, storage, opts = {}) {
             goalId: goal?.id ?? issue.goalId,
             ancestors,
             ...(blockerAttention ? { blockerAttention } : {}),
+            productivityReview,
             blockedBy: relations.blockedBy,
             blocks: relations.blocks,
             relatedWork: referenceSummary,
@@ -1485,7 +1552,8 @@ export function issueRoutes(db, storage, opts = {}) {
         await assertIssueEnvironmentSelection(companyId, req.body.executionWorkspaceSettings?.environmentId);
         const actor = getActorInfo(req);
         const requestedUiLocale = resolveExplicitRequestUiLocale(req);
-        const executionPolicy = normalizeIssueExecutionPolicy(req.body.executionPolicy);
+        const executionPolicy = applyActorMonitorScheduledBy(normalizeIssueExecutionPolicy(req.body.executionPolicy), actor.actorType);
+        assertCanManageIssueMonitor(req, req.body.assigneeAgentId ?? null, Boolean(executionPolicy?.monitor));
         const issue = await svc.create(companyId, {
             ...req.body,
             executionPolicy,
@@ -1515,6 +1583,28 @@ export function issueRoutes(db, storage, opts = {}) {
                 }),
             },
         });
+        if (executionPolicy?.monitor) {
+            await logActivity(db, {
+                companyId,
+                actorType: actor.actorType,
+                actorId: actor.actorId,
+                agentId: actor.agentId,
+                runId: actor.runId,
+                action: "issue.monitor_scheduled",
+                entityType: "issue",
+                entityId: issue.id,
+                details: {
+                    identifier: issue.identifier,
+                    nextCheckAt: executionPolicy.monitor.nextCheckAt,
+                    notes: executionPolicy.monitor.notes,
+                    scheduledBy: executionPolicy.monitor.scheduledBy,
+                    serviceName: executionPolicy.monitor.serviceName ?? null,
+                    timeoutAt: executionPolicy.monitor.timeoutAt ?? null,
+                    maxAttempts: executionPolicy.monitor.maxAttempts ?? null,
+                    recoveryPolicy: executionPolicy.monitor.recoveryPolicy ?? null,
+                },
+            });
+        }
         void queueIssueAssignmentWakeup({
             heartbeat,
             issue,
@@ -1545,7 +1635,8 @@ export function issueRoutes(db, storage, opts = {}) {
         }
         await assertIssueEnvironmentSelection(parent.companyId, req.body.executionWorkspaceSettings?.environmentId);
         const actor = getActorInfo(req);
-        const executionPolicy = normalizeIssueExecutionPolicy(req.body.executionPolicy);
+        const executionPolicy = applyActorMonitorScheduledBy(normalizeIssueExecutionPolicy(req.body.executionPolicy), actor.actorType);
+        assertCanManageIssueMonitor(req, req.body.assigneeAgentId ?? null, Boolean(executionPolicy?.monitor));
         const { issue, parentBlockerAdded } = await svc.createChild(parent.id, {
             ...req.body,
             executionPolicy,
@@ -1572,6 +1663,29 @@ export function issueRoutes(db, storage, opts = {}) {
                 ...(parentBlockerAdded ? { parentBlockerAdded: true } : {}),
             },
         });
+        if (executionPolicy?.monitor) {
+            await logActivity(db, {
+                companyId: parent.companyId,
+                actorType: actor.actorType,
+                actorId: actor.actorId,
+                agentId: actor.agentId,
+                runId: actor.runId,
+                action: "issue.monitor_scheduled",
+                entityType: "issue",
+                entityId: issue.id,
+                details: {
+                    identifier: issue.identifier,
+                    parentId: parent.id,
+                    nextCheckAt: executionPolicy.monitor.nextCheckAt,
+                    notes: executionPolicy.monitor.notes,
+                    scheduledBy: executionPolicy.monitor.scheduledBy,
+                    serviceName: executionPolicy.monitor.serviceName ?? null,
+                    timeoutAt: executionPolicy.monitor.timeoutAt ?? null,
+                    maxAttempts: executionPolicy.monitor.maxAttempts ?? null,
+                    recoveryPolicy: executionPolicy.monitor.recoveryPolicy ?? null,
+                },
+            });
+        }
         void queueIssueAssignmentWakeup({
             heartbeat,
             issue,
@@ -1583,6 +1697,24 @@ export function issueRoutes(db, storage, opts = {}) {
         });
         res.status(201).json(issue);
     });
+    router.post("/issues/:id/monitor/check-now", async (req, res) => {
+        const id = req.params.id;
+        const issue = await svc.getById(id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        assertCompanyAccess(req, issue.companyId);
+        assertCanManageIssueMonitor(req, issue.assigneeAgentId, true);
+        const actor = getActorInfo(req);
+        await heartbeat.triggerIssueMonitor(issue.id, {
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId ?? null,
+            runId: actor.runId ?? null,
+        });
+        res.json({ ok: true });
+    });
     router.patch("/issues/:id", validate(updateIssueRouteSchema), async (req, res) => {
         const id = req.params.id;
         const existing = await svc.getById(id);
@@ -1684,7 +1816,7 @@ export function issueRoutes(db, storage, opts = {}) {
             updateFields.status = "todo";
         }
         if (req.body.executionPolicy !== undefined) {
-            updateFields.executionPolicy = normalizeIssueExecutionPolicy(req.body.executionPolicy);
+            updateFields.executionPolicy = applyActorMonitorScheduledBy(normalizeIssueExecutionPolicy(req.body.executionPolicy), actor.actorType);
         }
         const previousExecutionPolicy = normalizeIssueExecutionPolicy(existing.executionPolicy ?? null);
         const nextExecutionPolicy = updateFields.executionPolicy !== undefined
@@ -1693,9 +1825,12 @@ export function issueRoutes(db, storage, opts = {}) {
         if (normalizedAssigneeAgentId !== undefined) {
             updateFields.assigneeAgentId = normalizedAssigneeAgentId;
         }
+        const monitorChanged = monitorPoliciesEqual(previousExecutionPolicy, nextExecutionPolicy) === false;
+        assertCanManageIssueMonitor(req, existing.assigneeAgentId, req.body.executionPolicy !== undefined && monitorChanged);
         const transition = applyIssueExecutionPolicyTransition({
             issue: existing,
             policy: nextExecutionPolicy,
+            previousPolicy: previousExecutionPolicy,
             requestedStatus: typeof updateFields.status === "string" ? updateFields.status : undefined,
             requestedAssigneePatch: {
                 assigneeAgentId: normalizedAssigneeAgentId,
@@ -1707,6 +1842,7 @@ export function issueRoutes(db, storage, opts = {}) {
             },
             commentBody,
             reviewRequest: reviewRequest === undefined ? undefined : reviewRequest,
+            monitorExplicitlyUpdated: req.body.executionPolicy !== undefined && monitorChanged,
         });
         const decisionId = transition.decision ? randomUUID() : null;
         if (decisionId) {
@@ -1980,6 +2116,51 @@ export function issueRoutes(db, storage, opts = {}) {
                 },
             });
         }
+        const nextStoredExecutionPolicy = normalizeIssueExecutionPolicy(issue.executionPolicy ?? null);
+        const previousMonitor = summarizeIssueMonitor(existing, previousExecutionPolicy);
+        const nextMonitor = summarizeIssueMonitor(issue, nextStoredExecutionPolicy);
+        const monitorScheduledChanged = previousMonitor.nextCheckAt !== nextMonitor.nextCheckAt;
+        if (nextMonitor.nextCheckAt && (monitorScheduledChanged || previousMonitor.notes !== nextMonitor.notes)) {
+            await logActivity(db, {
+                companyId: issue.companyId,
+                actorType: actor.actorType,
+                actorId: actor.actorId,
+                agentId: actor.agentId,
+                runId: actor.runId,
+                action: "issue.monitor_scheduled",
+                entityType: "issue",
+                entityId: issue.id,
+                details: {
+                    identifier: issue.identifier,
+                    nextCheckAt: nextMonitor.nextCheckAt,
+                    previousNextCheckAt: previousMonitor.nextCheckAt,
+                    notes: nextMonitor.notes,
+                    scheduledBy: nextMonitor.scheduledBy,
+                    serviceName: nextMonitor.serviceName,
+                    timeoutAt: nextMonitor.timeoutAt,
+                    maxAttempts: nextMonitor.maxAttempts,
+                    recoveryPolicy: nextMonitor.recoveryPolicy,
+                },
+            });
+        }
+        else if (!nextMonitor.nextCheckAt && previousMonitor.nextCheckAt) {
+            await logActivity(db, {
+                companyId: issue.companyId,
+                actorType: actor.actorType,
+                actorId: actor.actorId,
+                agentId: actor.agentId,
+                runId: actor.runId,
+                action: "issue.monitor_cleared",
+                entityType: "issue",
+                entityId: issue.id,
+                details: {
+                    identifier: issue.identifier,
+                    previousNextCheckAt: previousMonitor.nextCheckAt,
+                    reason: nextMonitor.clearReason ?? "manual",
+                    notes: previousMonitor.notes,
+                },
+            });
+        }
         if (issue.status === "done" && existing.status !== "done") {
             const tc = getTelemetryClient();
             if (tc && actor.agentId) {
@@ -2701,6 +2882,48 @@ export function issueRoutes(db, storage, opts = {}) {
         });
         res.json(interaction);
     });
+    router.post("/issues/:id/interactions/:interactionId/cancel", validate(cancelIssueThreadInteractionSchema), async (req, res) => {
+        const id = req.params.id;
+        const interactionId = req.params.interactionId;
+        const issue = await svc.getById(id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        assertCompanyAccess(req, issue.companyId);
+        assertBoard(req);
+        const actor = getActorInfo(req);
+        const interaction = await issueThreadInteractionService(db).cancelQuestions(issue, interactionId, req.body, {
+            agentId: actor.agentId,
+            userId: actor.actorType === "user" ? actor.actorId : null,
+        });
+        await logActivity(db, {
+            companyId: issue.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "issue.thread_interaction_cancelled",
+            entityType: "issue",
+            entityId: issue.id,
+            details: {
+                interactionId: interaction.id,
+                interactionKind: interaction.kind,
+                interactionStatus: interaction.status,
+                cancellationReason: interaction.kind === "ask_user_questions"
+                    ? (interaction.result?.cancellationReason ?? null)
+                    : null,
+            },
+        });
+        queueResolvedInteractionContinuationWakeup({
+            heartbeat,
+            issue,
+            interaction,
+            actor,
+            source: "issue.interaction.cancel",
+        });
+        res.json(interaction);
+    });
     router.get("/issues/:id/comments/:commentId", async (req, res) => {
         const id = req.params.id;
         const commentId = req.params.commentId;
@@ -3211,13 +3434,15 @@ export function issueRoutes(db, storage, opts = {}) {
         }
         if (!(await assertAgentIssueMutationAllowed(req, res, issue)))
             return;
+        const company = await companiesSvc.getById(companyId);
+        const attachmentMaxBytes = normalizeIssueAttachmentMaxBytes(company?.attachmentMaxBytes);
         try {
-            await runSingleFileUpload(req, res);
+            await runSingleFileUpload(req, res, attachmentMaxBytes);
         }
         catch (err) {
             if (err instanceof multer.MulterError) {
                 if (err.code === "LIMIT_FILE_SIZE") {
-                    res.status(422).json({ error: `Attachment exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
+                    res.status(422).json({ error: `Attachment exceeds ${attachmentMaxBytes} bytes` });
                     return;
                 }
                 res.status(400).json({ error: err.message });