@rudderhq/server 0.2.5-canary.9 → 0.2.5

package/dist/routes/issues.js

@@ -1,17 +1,15 @@
 import { Router } from "express";
 import multer from "multer";
 import { buildIssueDocumentsPrompt } from "@rudderhq/agent-runtime-utils/server-utils";
-import { addIssueCommentSchema, createIssueAttachmentMetadataSchema, createIssueWorkspaceAttachmentSchema, createIssueWorkProductSchema, createIssueLabelSchema, checkoutIssueSchema, createIssueSchema, linkIssueApprovalSchema, reportIssueCommitSchema, issueDocumentKeySchema, reorderIssueSchema, updateIssueLabelSchema, updateIssueWorkProductSchema, upsertIssueDocumentSchema, updateIssueSchema, isUuidLike, } from "@rudderhq/shared";
+import { createIssueWorkProductSchema, createIssueLabelSchema, linkIssueApprovalSchema, issueDocumentKeySchema, reorderIssueSchema, updateIssueLabelSchema, updateIssueWorkProductSchema, upsertIssueDocumentSchema, isUuidLike, } from "@rudderhq/shared";
 import { validate } from "../middleware/validate.js";
 import { accessService, agentService, executionWorkspaceService, goalService, heartbeatService, issueApprovalService, issueService, documentService, logActivity, projectService, automationService, workProductService, } from "../services/index.js";
 import { organizationWorkspaceBrowserService } from "../services/organization-workspace-browser.js";
-import { logger } from "../middleware/logger.js";
-import { forbidden, HttpError, unauthorized, unprocessable } from "../errors.js";
+import { forbidden, unauthorized } from "../errors.js";
 import { assertBoard, assertCompanyAccess, getActorInfo } from "./authz.js";
-import { shouldWakeAssigneeOnCheckout } from "./issues-checkout-wakeup.js";
-import { isAllowedContentType, MAX_ATTACHMENT_BYTES } from "../attachment-types.js";
-import { queueIssueAssignmentWakeup } from "../services/issue-assignment-wakeup.js";
-import { buildIssueReviewWakeupOptions, queueIssueReviewWakeup } from "../services/issue-review-wakeup.js";
+import { MAX_ATTACHMENT_BYTES } from "../attachment-types.js";
+import { registerIssueCommentAttachmentRoutes } from "./issues.comments-attachments.js";
+import { registerIssueMutationRoutes } from "./issues.mutations.js";
 const MAX_ISSUE_COMMENT_LIMIT = 500;
 export function issueRoutes(db, storage) {
     const router = Router();
@@ -933,1127 +931,44 @@ export function issueRoutes(db, storage) {
         });
         res.json({ ok: true });
     });
-    router.post("/orgs/:orgId/issues", validate(createIssueSchema), async (req, res) => {
-        const orgId = req.params.orgId;
-        assertCompanyAccess(req, orgId);
-        if (req.body.assigneeAgentId || req.body.assigneeUserId || req.body.reviewerAgentId || req.body.reviewerUserId) {
-            await assertCanAssignTasks(req, orgId);
-        }
-        const actor = getActorInfo(req);
-        const createInput = {
-            ...req.body,
-            createdByAgentId: actor.agentId,
-            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
-        };
-        const hasExplicitAssignee = Object.prototype.hasOwnProperty.call(req.body, "assigneeAgentId") ||
-            Object.prototype.hasOwnProperty.call(req.body, "assigneeUserId");
-        if (actor.actorType === "agent" && actor.agentId && !hasExplicitAssignee) {
-            createInput.assigneeAgentId = actor.agentId;
-        }
-        const issue = await svc.create(orgId, {
-            ...createInput,
-        });
-        await logActivity(db, {
-            orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "issue.created",
-            entityType: "issue",
-            entityId: issue.id,
-            details: { title: issue.title, identifier: issue.identifier },
-        });
-        void queueIssueAssignmentWakeup({
-            heartbeat,
-            issue,
-            reason: "issue_assigned",
-            mutation: "create",
-            contextSource: "issue.create",
-            requestedByActorType: actor.actorType,
-            requestedByActorId: actor.actorId,
-        });
-        void queueIssueReviewWakeup({
-            heartbeat,
-            issue,
-            mutation: "create_in_review",
-            contextSource: "issue.create",
-            requestedByActorType: actor.actorType,
-            requestedByActorId: actor.actorId,
-            actorAgentId: actor.agentId,
-        });
-        res.status(201).json(issue);
-    });
-    router.patch("/issues/:id", validate(updateIssueSchema), async (req, res) => {
-        const id = req.params.id;
-        const existing = await svc.getById(id);
-        if (!existing) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, existing.orgId);
-        const assigneeWillChange = (req.body.assigneeAgentId !== undefined && req.body.assigneeAgentId !== existing.assigneeAgentId) ||
-            (req.body.assigneeUserId !== undefined && req.body.assigneeUserId !== existing.assigneeUserId);
-        const reviewerWillChange = (req.body.reviewerAgentId !== undefined && req.body.reviewerAgentId !== existing.reviewerAgentId) ||
-            (req.body.reviewerUserId !== undefined && req.body.reviewerUserId !== existing.reviewerUserId);
-        const isAgentReturningIssueToCreator = req.actor.type === "agent" &&
-            !!req.actor.agentId &&
-            existing.assigneeAgentId === req.actor.agentId &&
-            req.body.assigneeAgentId === null &&
-            typeof req.body.assigneeUserId === "string" &&
-            !!existing.createdByUserId &&
-            req.body.assigneeUserId === existing.createdByUserId;
-        if (assigneeWillChange) {
-            if (!isAgentReturningIssueToCreator) {
-                await assertCanAssignTasks(req, existing.orgId);
-            }
-        }
-        if (reviewerWillChange) {
-            await assertCanAssignTasks(req, existing.orgId);
-        }
-        if (!(await assertAgentRunCheckoutOwnership(req, res, existing)))
-            return;
-        const actor = getActorInfo(req);
-        const isClosed = existing.status === "done" || existing.status === "cancelled";
-        const { comment: commentBody, reopen: reopenRequested, hiddenAt: hiddenAtRaw, reviewDecision, ...updateFields } = req.body;
-        if (hiddenAtRaw !== undefined) {
-            updateFields.hiddenAt = hiddenAtRaw ? new Date(hiddenAtRaw) : null;
-        }
-        if (commentBody && reopenRequested === true && isClosed && updateFields.status === undefined) {
-            updateFields.status = "todo";
-        }
-        if (reviewDecision !== undefined) {
-            if (!commentBody) {
-                throw unprocessable("Reviewer decisions require a comment");
-            }
-            if (!statusAcceptsReviewerDecision(existing.status)) {
-                throw unprocessable("Reviewer decisions can only be recorded while the issue is in_review or blocked");
-            }
-            if (actor.actorType === "agent" && !isReviewerAgentForIssue(actor, existing)) {
-                throw forbidden("Only the reviewer agent can record a reviewer decision");
-            }
-            const decisionStatus = statusForReviewDecision(reviewDecision);
-            if (decisionStatus) {
-                updateFields.status = decisionStatus;
-            }
-            else {
-                delete updateFields.status;
-            }
-        }
-        let reviewedCompletionNormalized = false;
-        if (updateFields.status === "done" &&
-            !canAgentCompleteIssue(actor, existing)) {
-            res.status(403).json({ error: "Only the checked-out assignee or reviewer can complete issue" });
-            return;
-        }
-        if (updateFields.status === "done" &&
-            issueHasReviewer(existing) &&
-            actor.actorType === "agent" &&
-            !(statusAcceptsReviewerDecision(existing.status) && isReviewerAgentForIssue(actor, existing))) {
-            updateFields.status = "in_review";
-            reviewedCompletionNormalized = true;
-        }
-        let issue;
-        try {
-            issue = await svc.update(id, updateFields);
-        }
-        catch (err) {
-            if (err instanceof HttpError && err.status === 422) {
-                logger.warn({
-                    issueId: id,
-                    orgId: existing.orgId,
-                    assigneePatch: {
-                        assigneeAgentId: req.body.assigneeAgentId === undefined ? "__omitted__" : req.body.assigneeAgentId,
-                        assigneeUserId: req.body.assigneeUserId === undefined ? "__omitted__" : req.body.assigneeUserId,
-                        reviewerAgentId: req.body.reviewerAgentId === undefined ? "__omitted__" : req.body.reviewerAgentId,
-                        reviewerUserId: req.body.reviewerUserId === undefined ? "__omitted__" : req.body.reviewerUserId,
-                    },
-                    currentAssignee: {
-                        assigneeAgentId: existing.assigneeAgentId,
-                        assigneeUserId: existing.assigneeUserId,
-                        reviewerAgentId: existing.reviewerAgentId,
-                        reviewerUserId: existing.reviewerUserId,
-                    },
-                    error: err.message,
-                    details: err.details,
-                }, "issue update rejected with 422");
-            }
-            throw err;
-        }
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        await automationsSvc.syncRunStatusForIssue(issue.id);
-        if (actor.runId) {
-            await heartbeat.reportRunActivity(actor.runId).catch((err) => logger.warn({ err, runId: actor.runId }, "failed to clear detached run warning after issue activity"));
-        }
-        // Build activity details with previous values for changed fields
-        const previous = {};
-        for (const key of Object.keys(updateFields)) {
-            if (key in existing && existing[key] !== updateFields[key]) {
-                previous[key] = existing[key];
-            }
-        }
-        const hasFieldChanges = Object.keys(previous).length > 0;
-        const reopened = commentBody &&
-            reopenRequested === true &&
-            isClosed &&
-            previous.status !== undefined &&
-            issue.status === "todo";
-        const reopenFromStatus = reopened ? existing.status : null;
-        await logActivity(db, {
-            orgId: issue.orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "issue.updated",
-            entityType: "issue",
-            entityId: issue.id,
-            details: {
-                ...updateFields,
-                identifier: issue.identifier,
-                ...(commentBody ? { source: "comment" } : {}),
-                ...(reopened ? { reopened: true, reopenedFrom: reopenFromStatus } : {}),
-                ...(reviewedCompletionNormalized
-                    ? {
-                        normalizedFromStatus: "done",
-                        normalizedReason: "reviewed_issue_assignee_completion",
-                    }
-                    : {}),
-                _previous: hasFieldChanges ? previous : undefined,
-            },
-        });
-        let comment = null;
-        if (commentBody) {
-            comment = await svc.addComment(id, commentBody, {
-                agentId: actor.agentId ?? undefined,
-                userId: actor.actorType === "user" ? actor.actorId : undefined,
-            });
-            await logActivity(db, {
-                orgId: issue.orgId,
-                actorType: actor.actorType,
-                actorId: actor.actorId,
-                agentId: actor.agentId,
-                runId: actor.runId,
-                action: "issue.comment_added",
-                entityType: "issue",
-                entityId: issue.id,
-                details: {
-                    commentId: comment.id,
-                    bodySnippet: comment.body.slice(0, 120),
-                    identifier: issue.identifier,
-                    issueTitle: issue.title,
-                    ...(reopened ? { reopened: true, reopenedFrom: reopenFromStatus, source: "comment" } : {}),
-                    ...(hasFieldChanges ? { updated: true } : {}),
-                },
-            });
-        }
-        if (reviewDecision !== undefined) {
-            const reviewOutcome = reviewDecision === "blocked" ? "human_handoff" : "review_closed";
-            await logActivity(db, {
-                orgId: issue.orgId,
-                actorType: actor.actorType,
-                actorId: actor.actorId,
-                agentId: actor.agentId,
-                runId: actor.runId,
-                action: "issue.review_decision_recorded",
-                entityType: "issue",
-                entityId: issue.id,
-                details: {
-                    decision: reviewDecision,
-                    outcome: reviewOutcome,
-                    operatorActionRequired: reviewOutcome === "human_handoff",
-                    status: issue.status,
-                    identifier: issue.identifier,
-                    commentId: comment?.id ?? null,
-                },
-            });
-            if (reviewerDecisionRequiresHumanHandoff(reviewDecision)) {
-                await logActivity(db, {
-                    orgId: issue.orgId,
-                    actorType: actor.actorType,
-                    actorId: actor.actorId,
-                    agentId: actor.agentId,
-                    runId: actor.runId,
-                    action: "issue.human_intervention_required",
-                    entityType: "issue",
-                    entityId: issue.id,
-                    details: {
-                        decision: reviewDecision,
-                        status: issue.status,
-                        identifier: issue.identifier,
-                        issueTitle: issue.title,
-                        commentId: comment?.id ?? null,
-                        previousReviewerAgentId: existing.reviewerAgentId,
-                        previousReviewerUserId: existing.reviewerUserId,
-                        nextAction: "Human/operator intervention is required before agent review can continue.",
-                    },
-                });
-            }
-        }
-        const assigneeChanged = assigneeWillChange;
-        const reviewerChanged = reviewerWillChange;
-        const statusChangedFromBacklog = existing.status === "backlog" &&
-            issue.status !== "backlog" &&
-            updateFields.status !== undefined;
-        const statusChangedToInReview = existing.status !== "in_review" &&
-            issue.status === "in_review" &&
-            updateFields.status !== undefined;
-        const statusChangedToBlocked = existing.status !== "blocked" &&
-            issue.status === "blocked" &&
-            updateFields.status !== undefined;
-        const statusReturnedFromReviewToAssignee = statusAcceptsReviewerDecision(existing.status) &&
-            (issue.status === "in_progress" || issue.status === "todo") &&
-            updateFields.status !== undefined;
-        const reviewerChangedInReviewableStatus = reviewerChanged &&
-            statusAcceptsReviewerDecision(existing.status) &&
-            statusAcceptsReviewerDecision(issue.status);
-        // Merge all wakeups from this update into one enqueue per agent to avoid duplicate runs.
-        void (async () => {
-            const wakeups = new Map();
-            if (assigneeChanged && issue.assigneeAgentId && issue.status !== "backlog") {
-                wakeups.set(issue.assigneeAgentId, {
-                    source: "assignment",
-                    triggerDetail: "system",
-                    reason: "issue_assigned",
-                    payload: { issueId: issue.id, mutation: "update" },
-                    requestedByActorType: actor.actorType,
-                    requestedByActorId: actor.actorId,
-                    contextSnapshot: {
-                        issueId: issue.id,
-                        source: "issue.update",
-                        wakeSource: "assignment",
-                        wakeReason: "issue_assigned",
-                        issue: {
-                            id: issue.id,
-                            title: issue.title,
-                            description: issue.description,
-                            status: issue.status,
-                            priority: issue.priority,
-                        },
-                    },
-                });
-            }
-            if (!assigneeChanged && statusChangedFromBacklog && issue.assigneeAgentId) {
-                wakeups.set(issue.assigneeAgentId, {
-                    source: "automation",
-                    triggerDetail: "system",
-                    reason: "issue_status_changed",
-                    payload: { issueId: issue.id, mutation: "update" },
-                    requestedByActorType: actor.actorType,
-                    requestedByActorId: actor.actorId,
-                    contextSnapshot: {
-                        issueId: issue.id,
-                        source: "issue.status_change",
-                        wakeSource: "automation",
-                        wakeReason: "issue_status_changed",
-                        issue: {
-                            id: issue.id,
-                            title: issue.title,
-                            description: issue.description,
-                            status: issue.status,
-                            priority: issue.priority,
-                        },
-                    },
-                });
-            }
-            if (!assigneeChanged && statusReturnedFromReviewToAssignee && issue.assigneeAgentId) {
-                const commentContext = comment
-                    ? {
-                        commentId: comment.id,
-                        wakeCommentId: comment.id,
-                        comment: {
-                            id: comment.id,
-                            body: comment.body,
-                            authorAgentId: comment.authorAgentId,
-                            authorUserId: comment.authorUserId,
-                        },
-                    }
-                    : {};
-                wakeups.set(issue.assigneeAgentId, {
-                    source: "assignment",
-                    triggerDetail: "system",
-                    reason: "issue_changes_requested",
-                    payload: {
-                        issueId: issue.id,
-                        mutation: "review_changes_requested",
-                        ...(comment ? { commentId: comment.id } : {}),
-                    },
-                    requestedByActorType: actor.actorType,
-                    requestedByActorId: actor.actorId,
-                    contextSnapshot: {
-                        issueId: issue.id,
-                        taskId: issue.id,
-                        source: "issue.review_changes_requested",
-                        wakeSource: "assignment",
-                        wakeReason: "issue_changes_requested",
-                        issue: {
-                            id: issue.id,
-                            title: issue.title,
-                            description: issue.description,
-                            status: issue.status,
-                            priority: issue.priority,
-                        },
-                        ...commentContext,
-                    },
-                });
-            }
-            if ((statusChangedToInReview || statusChangedToBlocked || reviewerChangedInReviewableStatus) && issue.reviewerAgentId) {
-                const mutation = statusChangedToInReview
-                    ? "status_to_in_review"
-                    : statusChangedToBlocked
-                        ? "status_to_blocked"
-                        : issue.status === "blocked"
-                            ? "reviewer_changed_blocked"
-                            : "reviewer_changed_in_review";
-                const actorIsReviewerAgent = actor.actorType === "agent" && actor.actorId === issue.reviewerAgentId;
-                const actorIsAssigneeAgent = actor.actorType === "agent" && actor.actorId === issue.assigneeAgentId;
-                const assigneeHandoffToReview = (statusChangedToInReview || statusChangedToBlocked) && actorIsAssigneeAgent;
-                if (!actorIsReviewerAgent || assigneeHandoffToReview) {
-                    wakeups.set(issue.reviewerAgentId, buildIssueReviewWakeupOptions({
-                        issue,
-                        mutation,
-                        contextSource: statusChangedToInReview || statusChangedToBlocked ? "issue.status_change" : "issue.reviewer_change",
-                        requestedByActorType: actor.actorType,
-                        requestedByActorId: actor.actorId,
-                    }));
-                }
-            }
-            if (commentBody && comment) {
-                let mentionedIds = [];
-                try {
-                    mentionedIds = await svc.findMentionedAgents(issue.orgId, commentBody);
-                }
-                catch (err) {
-                    logger.warn({ err, issueId: id }, "failed to resolve @-mentions");
-                }
-                for (const mentionedId of mentionedIds) {
-                    if (wakeups.has(mentionedId))
-                        continue;
-                    if (actor.actorType === "agent" && actor.actorId === mentionedId)
-                        continue;
-                    wakeups.set(mentionedId, {
-                        source: "automation",
-                        triggerDetail: "system",
-                        reason: "issue_comment_mentioned",
-                        payload: { issueId: id, commentId: comment.id },
-                        requestedByActorType: actor.actorType,
-                        requestedByActorId: actor.actorId,
-                        contextSnapshot: {
-                            issueId: id,
-                            taskId: id,
-                            commentId: comment.id,
-                            wakeCommentId: comment.id,
-                            wakeReason: "issue_comment_mentioned",
-                            wakeSource: "comment.mention",
-                            source: "comment.mention",
-                            issue: {
-                                id: issue.id,
-                                title: issue.title,
-                                description: issue.description,
-                                status: issue.status,
-                                priority: issue.priority,
-                            },
-                            comment: {
-                                id: comment.id,
-                                body: comment.body,
-                                authorAgentId: comment.authorAgentId,
-                                authorUserId: comment.authorUserId,
-                            },
-                        },
-                    });
-                }
-            }
-            for (const [agentId, wakeup] of wakeups.entries()) {
-                heartbeat
-                    .wakeup(agentId, wakeup)
-                    .catch((err) => logger.warn({ err, issueId: issue.id, agentId }, "failed to wake agent on issue update"));
-            }
-        })();
-        res.json({ ...issue, comment });
-    });
-    router.delete("/issues/:id", async (req, res) => {
-        const id = req.params.id;
-        const existing = await svc.getById(id);
-        if (!existing) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, existing.orgId);
-        const attachments = await svc.listAttachments(id);
-        const issue = await svc.remove(id);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        for (const attachment of attachments) {
-            try {
-                await storage.deleteObject(attachment.orgId, attachment.objectKey);
-            }
-            catch (err) {
-                logger.warn({ err, issueId: id, attachmentId: attachment.id }, "failed to delete attachment object during issue delete");
-            }
-        }
-        const actor = getActorInfo(req);
-        await logActivity(db, {
-            orgId: issue.orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "issue.deleted",
-            entityType: "issue",
-            entityId: issue.id,
-        });
-        res.json(issue);
-    });
-    router.post("/issues/:id/checkout", validate(checkoutIssueSchema), async (req, res) => {
-        const id = req.params.id;
-        const issue = await svc.getById(id);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, issue.orgId);
-        if (issue.projectId) {
-            const project = await projectsSvc.getById(issue.projectId);
-            if (project?.pausedAt) {
-                res.status(409).json({
-                    error: project.pauseReason === "budget"
-                        ? "Project is paused because its budget hard-stop was reached"
-                        : "Project is paused",
-                });
-                return;
-            }
-        }
-        if (req.actor.type === "agent" && req.actor.agentId !== req.body.agentId) {
-            res.status(403).json({ error: "Agent can only checkout as itself" });
-            return;
-        }
-        const checkoutRunId = requireAgentRunId(req, res);
-        if (req.actor.type === "agent" && !checkoutRunId)
-            return;
-        const updated = await svc.checkout(id, req.body.agentId, req.body.expectedStatuses, checkoutRunId);
-        const actor = getActorInfo(req);
-        await logActivity(db, {
-            orgId: issue.orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "issue.checked_out",
-            entityType: "issue",
-            entityId: issue.id,
-            details: { agentId: req.body.agentId },
-        });
-        if (shouldWakeAssigneeOnCheckout({
-            actorType: req.actor.type,
-            actorAgentId: req.actor.type === "agent" ? req.actor.agentId ?? null : null,
-            checkoutAgentId: req.body.agentId,
-            checkoutRunId,
-        })) {
-            void heartbeat
-                .wakeup(req.body.agentId, {
-                source: "assignment",
-                triggerDetail: "system",
-                reason: "issue_checked_out",
-                payload: { issueId: issue.id, mutation: "checkout" },
-                requestedByActorType: actor.actorType,
-                requestedByActorId: actor.actorId,
-                contextSnapshot: { issueId: issue.id, source: "issue.checkout" },
-            })
-                .catch((err) => logger.warn({ err, issueId: issue.id }, "failed to wake assignee on issue checkout"));
-        }
-        res.json(updated);
-    });
-    router.post("/issues/:id/release", async (req, res) => {
-        const id = req.params.id;
-        const existing = await svc.getById(id);
-        if (!existing) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, existing.orgId);
-        if (!(await assertAgentRunCheckoutOwnership(req, res, existing)))
-            return;
-        const actorRunId = requireAgentRunId(req, res);
-        if (req.actor.type === "agent" && !actorRunId)
-            return;
-        const released = await svc.release(id, req.actor.type === "agent" ? req.actor.agentId : undefined, actorRunId);
-        if (!released) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        const actor = getActorInfo(req);
-        await logActivity(db, {
-            orgId: released.orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "issue.released",
-            entityType: "issue",
-            entityId: released.id,
-        });
-        res.json(released);
-    });
-    router.post("/issues/:id/commit", validate(reportIssueCommitSchema), async (req, res) => {
-        const id = req.params.id;
-        const issue = await svc.getById(id);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, issue.orgId);
-        if (req.actor.type !== "agent") {
-            res.status(403).json({ error: "Agent authentication required" });
-            return;
-        }
-        if (!(await assertAgentRunCheckoutOwnership(req, res, issue)))
-            return;
-        const actor = getActorInfo(req);
-        const commitRun = await resolveAgentIssueRunId(req, res, issue);
-        if (!commitRun.ok)
-            return;
-        const sha = req.body.sha.trim().toLowerCase();
-        const subject = commitSubject(req.body.message);
-        const shortSha = sha.slice(0, 7);
-        if (commitRun.runId) {
-            await heartbeat.reportRunActivity(commitRun.runId).catch((err) => logger.warn({ err, runId: commitRun.runId }, "failed to clear detached run warning after issue commit activity"));
-        }
-        await logActivity(db, {
-            orgId: issue.orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: commitRun.runId,
-            action: "issue.code_committed",
-            entityType: "issue",
-            entityId: issue.id,
-            details: {
-                sha,
-                shortSha,
-                message: req.body.message,
-                subject,
-                identifier: issue.identifier,
-                issueTitle: issue.title,
-                branch: req.body.branch ?? null,
-                repoPath: req.body.repoPath ?? null,
-                workspacePath: req.body.workspacePath ?? null,
-                commitCount: req.body.commitCount ?? 1,
-            },
-        });
-        res.status(201).json({
-            ok: true,
-            issueId: issue.id,
-            sha,
-            shortSha,
-            message: req.body.message,
-            subject,
-            runId: commitRun.runId,
-        });
-    });
-    router.get("/issues/:id/comments", async (req, res) => {
-        const id = req.params.id;
-        const issue = await svc.getById(id);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, issue.orgId);
-        const afterCommentId = typeof req.query.after === "string" && req.query.after.trim().length > 0
-            ? req.query.after.trim()
-            : typeof req.query.afterCommentId === "string" && req.query.afterCommentId.trim().length > 0
-                ? req.query.afterCommentId.trim()
-                : null;
-        const order = typeof req.query.order === "string" && req.query.order.trim().toLowerCase() === "asc"
-            ? "asc"
-            : "desc";
-        const limitRaw = typeof req.query.limit === "string" && req.query.limit.trim().length > 0
-            ? Number(req.query.limit)
-            : null;
-        const limit = limitRaw && Number.isFinite(limitRaw) && limitRaw > 0
-            ? Math.min(Math.floor(limitRaw), MAX_ISSUE_COMMENT_LIMIT)
-            : null;
-        const comments = await svc.listComments(id, {
-            afterCommentId,
-            order,
-            limit,
-        });
-        res.json(comments);
-    });
-    router.get("/issues/:id/comments/:commentId", async (req, res) => {
-        const id = req.params.id;
-        const commentId = req.params.commentId;
-        const issue = await svc.getById(id);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, issue.orgId);
-        const comment = await svc.getComment(commentId);
-        if (!comment || comment.issueId !== id) {
-            res.status(404).json({ error: "Comment not found" });
-            return;
-        }
-        res.json(comment);
-    });
-    router.post("/issues/:id/comments", validate(addIssueCommentSchema), async (req, res) => {
-        const id = req.params.id;
-        const issue = await svc.getById(id);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, issue.orgId);
-        if (!(await assertAgentRunCheckoutOwnership(req, res, issue)))
-            return;
-        const commentRun = await resolveAgentIssueRunId(req, res, issue);
-        if (!commentRun.ok)
-            return;
-        const actor = getActorInfo(req);
-        const reopenRequested = req.body.reopen === true;
-        const interruptRequested = req.body.interrupt === true;
-        const isClosed = issue.status === "done" || issue.status === "cancelled";
-        let reopened = false;
-        let reopenFromStatus = null;
-        let interruptedRunId = null;
-        let currentIssue = issue;
-        if (reopenRequested && isClosed) {
-            const reopenedIssue = await svc.update(id, { status: "todo" });
-            if (!reopenedIssue) {
-                res.status(404).json({ error: "Issue not found" });
-                return;
-            }
-            reopened = true;
-            reopenFromStatus = issue.status;
-            currentIssue = reopenedIssue;
-            await logActivity(db, {
-                orgId: currentIssue.orgId,
-                actorType: actor.actorType,
-                actorId: actor.actorId,
-                agentId: actor.agentId,
-                runId: actor.runId,
-                action: "issue.updated",
-                entityType: "issue",
-                entityId: currentIssue.id,
-                details: {
-                    status: "todo",
-                    reopened: true,
-                    reopenedFrom: reopenFromStatus,
-                    source: "comment",
-                    identifier: currentIssue.identifier,
-                },
-            });
-        }
-        if (interruptRequested) {
-            if (req.actor.type !== "board") {
-                res.status(403).json({ error: "Only board users can interrupt active runs from issue comments" });
-                return;
-            }
-            let runToInterrupt = currentIssue.executionRunId
-                ? await heartbeat.getRun(currentIssue.executionRunId)
-                : null;
-            if ((!runToInterrupt || runToInterrupt.status !== "running") &&
-                currentIssue.assigneeAgentId) {
-                const activeRun = await heartbeat.getActiveRunForAgent(currentIssue.assigneeAgentId);
-                const activeIssueId = activeRun &&
-                    activeRun.contextSnapshot &&
-                    typeof activeRun.contextSnapshot === "object" &&
-                    typeof activeRun.contextSnapshot.issueId === "string"
-                    ? activeRun.contextSnapshot.issueId
-                    : null;
-                if (activeRun && activeRun.status === "running" && activeIssueId === currentIssue.id) {
-                    runToInterrupt = activeRun;
-                }
-            }
-            if (runToInterrupt && runToInterrupt.status === "running") {
-                const cancelled = await heartbeat.cancelRun(runToInterrupt.id);
-                if (cancelled) {
-                    interruptedRunId = cancelled.id;
-                    await logActivity(db, {
-                        orgId: cancelled.orgId,
-                        actorType: actor.actorType,
-                        actorId: actor.actorId,
-                        agentId: actor.agentId,
-                        runId: actor.runId,
-                        action: "heartbeat.cancelled",
-                        entityType: "heartbeat_run",
-                        entityId: cancelled.id,
-                        details: { agentId: cancelled.agentId, source: "issue_comment_interrupt", issueId: currentIssue.id },
-                    });
-                }
-            }
-        }
-        const comment = await svc.addComment(id, req.body.body, {
-            agentId: actor.agentId ?? undefined,
-            userId: actor.actorType === "user" ? actor.actorId : undefined,
-        });
-        if (commentRun.runId) {
-            await heartbeat.reportRunActivity(commentRun.runId).catch((err) => logger.warn({ err, runId: commentRun.runId }, "failed to clear detached run warning after issue comment"));
-        }
-        await logActivity(db, {
-            orgId: currentIssue.orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: commentRun.runId,
-            action: "issue.comment_added",
-            entityType: "issue",
-            entityId: currentIssue.id,
-            details: {
-                commentId: comment.id,
-                bodySnippet: comment.body.slice(0, 120),
-                identifier: currentIssue.identifier,
-                issueTitle: currentIssue.title,
-                ...(reopened ? { reopened: true, reopenedFrom: reopenFromStatus, source: "comment" } : {}),
-                ...(interruptedRunId ? { interruptedRunId } : {}),
-            },
-        });
-        // Merge all wakeups from this comment into one enqueue per agent to avoid duplicate runs.
-        void (async () => {
-            const wakeups = new Map();
-            const assigneeId = currentIssue.assigneeAgentId;
-            const actorIsAgent = actor.actorType === "agent";
-            const selfComment = actorIsAgent && actor.actorId === assigneeId;
-            const backlogComment = currentIssue.status === "backlog";
-            const skipWake = selfComment || isClosed || backlogComment;
-            if (assigneeId && (reopened || !skipWake)) {
-                if (reopened) {
-                    wakeups.set(assigneeId, {
-                        source: "automation",
-                        triggerDetail: "system",
-                        reason: "issue_reopened_via_comment",
-                        payload: {
-                            issueId: currentIssue.id,
-                            commentId: comment.id,
-                            reopenedFrom: reopenFromStatus,
-                            mutation: "comment",
-                            ...(interruptedRunId ? { interruptedRunId } : {}),
-                        },
-                        requestedByActorType: actor.actorType,
-                        requestedByActorId: actor.actorId,
-                        contextSnapshot: {
-                            issueId: currentIssue.id,
-                            taskId: currentIssue.id,
-                            commentId: comment.id,
-                            source: "issue.comment.reopen",
-                            wakeReason: "issue_reopened_via_comment",
-                            reopenedFrom: reopenFromStatus,
-                            ...(interruptedRunId ? { interruptedRunId } : {}),
-                        },
-                    });
-                }
-                else {
-                    wakeups.set(assigneeId, {
-                        source: "automation",
-                        triggerDetail: "system",
-                        reason: "issue_commented",
-                        payload: {
-                            issueId: currentIssue.id,
-                            commentId: comment.id,
-                            mutation: "comment",
-                            ...(interruptedRunId ? { interruptedRunId } : {}),
-                        },
-                        requestedByActorType: actor.actorType,
-                        requestedByActorId: actor.actorId,
-                        contextSnapshot: {
-                            issueId: currentIssue.id,
-                            taskId: currentIssue.id,
-                            commentId: comment.id,
-                            wakeCommentId: comment.id,
-                            source: "issue.comment",
-                            wakeReason: "issue_commented",
-                            issue: {
-                                id: currentIssue.id,
-                                title: currentIssue.title,
-                                description: currentIssue.description,
-                                status: currentIssue.status,
-                                priority: currentIssue.priority,
-                            },
-                            comment: {
-                                id: comment.id,
-                                body: comment.body,
-                                authorAgentId: comment.authorAgentId,
-                                authorUserId: comment.authorUserId,
-                            },
-                            ...(interruptedRunId ? { interruptedRunId } : {}),
-                        },
-                    });
-                }
-            }
-            let mentionedIds = [];
-            try {
-                mentionedIds = await svc.findMentionedAgents(issue.orgId, req.body.body);
-            }
-            catch (err) {
-                logger.warn({ err, issueId: id }, "failed to resolve @-mentions");
-            }
-            for (const mentionedId of mentionedIds) {
-                if (wakeups.has(mentionedId))
-                    continue;
-                if (actorIsAgent && actor.actorId === mentionedId)
-                    continue;
-                wakeups.set(mentionedId, {
-                    source: "automation",
-                    triggerDetail: "system",
-                    reason: "issue_comment_mentioned",
-                    payload: { issueId: id, commentId: comment.id },
-                    requestedByActorType: actor.actorType,
-                    requestedByActorId: actor.actorId,
-                    contextSnapshot: {
-                        issueId: id,
-                        taskId: id,
-                        commentId: comment.id,
-                        wakeCommentId: comment.id,
-                        wakeReason: "issue_comment_mentioned",
-                        wakeSource: "comment.mention",
-                        source: "comment.mention",
-                        issue: {
-                            id: currentIssue.id,
-                            title: currentIssue.title,
-                            description: currentIssue.description,
-                            status: currentIssue.status,
-                            priority: currentIssue.priority,
-                        },
-                        comment: {
-                            id: comment.id,
-                            body: comment.body,
-                            authorAgentId: comment.authorAgentId,
-                            authorUserId: comment.authorUserId,
-                        },
-                    },
-                });
-            }
-            for (const [agentId, wakeup] of wakeups.entries()) {
-                heartbeat
-                    .wakeup(agentId, wakeup)
-                    .catch((err) => logger.warn({ err, issueId: currentIssue.id, agentId }, "failed to wake agent on issue comment"));
-            }
-        })();
-        res.status(201).json(comment);
-    });
-    router.get("/issues/:id/attachments", async (req, res) => {
-        const issueId = req.params.id;
-        const issue = await svc.getById(issueId);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        assertCompanyAccess(req, issue.orgId);
-        const attachments = await svc.listAttachments(issueId);
-        res.json(attachments.map(withContentPath));
-    });
-    router.post("/orgs/:orgId/issues/:issueId/attachments", async (req, res) => {
-        const orgId = req.params.orgId;
-        const issueId = req.params.issueId;
-        assertCompanyAccess(req, orgId);
-        const issue = await svc.getById(issueId);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        if (issue.orgId !== orgId) {
-            res.status(422).json({ error: "Issue does not belong to organization" });
-            return;
-        }
-        try {
-            await runSingleFileUpload(req, res);
-        }
-        catch (err) {
-            if (err instanceof multer.MulterError) {
-                if (err.code === "LIMIT_FILE_SIZE") {
-                    res.status(422).json({ error: `Attachment exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
-                    return;
-                }
-                res.status(400).json({ error: err.message });
-                return;
-            }
-            throw err;
-        }
-        const file = req.file;
-        if (!file) {
-            res.status(400).json({ error: "Missing file field 'file'" });
-            return;
-        }
-        const contentType = (file.mimetype || "").toLowerCase();
-        if (!isAllowedContentType(contentType)) {
-            res.status(422).json({ error: `Unsupported attachment type: ${contentType || "unknown"}` });
-            return;
-        }
-        if (file.buffer.length <= 0) {
-            res.status(422).json({ error: "Attachment is empty" });
-            return;
-        }
-        const parsedMeta = createIssueAttachmentMetadataSchema.safeParse(req.body ?? {});
-        if (!parsedMeta.success) {
-            res.status(400).json({ error: "Invalid attachment metadata", details: parsedMeta.error.issues });
-            return;
-        }
-        const actor = getActorInfo(req);
-        const stored = await storage.putFile({
-            orgId,
-            namespace: `issues/${issueId}`,
-            originalFilename: file.originalname || null,
-            contentType,
-            body: file.buffer,
-        });
-        const attachment = await svc.createAttachment({
-            issueId,
-            issueCommentId: parsedMeta.data.issueCommentId ?? null,
-            usage: parsedMeta.data.usage ?? "issue",
-            provider: stored.provider,
-            objectKey: stored.objectKey,
-            contentType: stored.contentType,
-            byteSize: stored.byteSize,
-            sha256: stored.sha256,
-            originalFilename: stored.originalFilename,
-            createdByAgentId: actor.agentId,
-            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
-        });
-        if (attachment.usage === "issue") {
-            await logActivity(db, {
-                orgId,
-                actorType: actor.actorType,
-                actorId: actor.actorId,
-                agentId: actor.agentId,
-                runId: actor.runId,
-                action: "issue.attachment_added",
-                entityType: "issue",
-                entityId: issueId,
-                details: {
-                    attachmentId: attachment.id,
-                    usage: attachment.usage,
-                    originalFilename: attachment.originalFilename,
-                    contentType: attachment.contentType,
-                    byteSize: attachment.byteSize,
-                },
-            });
-        }
-        res.status(201).json(withContentPath(attachment));
-    });
-    router.post("/orgs/:orgId/issues/:issueId/attachments/workspace-file", validate(createIssueWorkspaceAttachmentSchema), async (req, res) => {
-        const orgId = req.params.orgId;
-        const issueId = req.params.issueId;
-        assertCompanyAccess(req, orgId);
-        const issue = await svc.getById(issueId);
-        if (!issue) {
-            res.status(404).json({ error: "Issue not found" });
-            return;
-        }
-        if (issue.orgId !== orgId) {
-            res.status(422).json({ error: "Issue does not belong to organization" });
-            return;
-        }
-        const workspaceFile = await workspaceBrowser.readAttachmentFile(orgId, req.body.path);
-        if (workspaceFile.buffer.length <= 0) {
-            res.status(422).json({ error: "Attachment is empty" });
-            return;
-        }
-        if (workspaceFile.buffer.length > MAX_ATTACHMENT_BYTES) {
-            res.status(422).json({ error: `Attachment exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
-            return;
-        }
-        if (!isAllowedContentType(workspaceFile.contentType)) {
-            res.status(422).json({ error: `Unsupported attachment type: ${workspaceFile.contentType || "unknown"}` });
-            return;
-        }
-        const actor = getActorInfo(req);
-        const stored = await storage.putFile({
-            orgId,
-            namespace: `issues/${issueId}`,
-            originalFilename: workspaceFile.originalFilename,
-            contentType: workspaceFile.contentType,
-            body: workspaceFile.buffer,
-        });
-        const attachment = await svc.createAttachment({
-            issueId,
-            issueCommentId: null,
-            usage: "issue",
-            provider: stored.provider,
-            objectKey: stored.objectKey,
-            contentType: stored.contentType,
-            byteSize: stored.byteSize,
-            sha256: stored.sha256,
-            originalFilename: stored.originalFilename,
-            createdByAgentId: actor.agentId,
-            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
-        });
-        await logActivity(db, {
-            orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "issue.attachment_added",
-            entityType: "issue",
-            entityId: issueId,
-            details: {
-                attachmentId: attachment.id,
-                usage: attachment.usage,
-                originalFilename: attachment.originalFilename,
-                contentType: attachment.contentType,
-                byteSize: attachment.byteSize,
-                workspacePath: workspaceFile.normalizedPath,
-            },
-        });
-        res.status(201).json(withContentPath(attachment));
-    });
-    router.get("/attachments/:attachmentId/content", async (req, res, next) => {
-        const attachmentId = req.params.attachmentId;
-        const attachment = await svc.getAttachmentById(attachmentId);
-        if (!attachment) {
-            res.status(404).json({ error: "Attachment not found" });
-            return;
-        }
-        assertCompanyAccess(req, attachment.orgId);
-        const object = await storage.getObject(attachment.orgId, attachment.objectKey);
-        res.setHeader("Content-Type", attachment.contentType || object.contentType || "application/octet-stream");
-        res.setHeader("Content-Length", String(attachment.byteSize || object.contentLength || 0));
-        res.setHeader("Cache-Control", "private, max-age=60");
-        const filename = attachment.originalFilename ?? "attachment";
-        res.setHeader("Content-Disposition", `inline; filename=\"${filename.replaceAll("\"", "")}\"`);
-        object.stream.on("error", (err) => {
-            next(err);
-        });
-        object.stream.pipe(res);
-    });
-    router.delete("/attachments/:attachmentId", async (req, res) => {
-        const attachmentId = req.params.attachmentId;
-        const attachment = await svc.getAttachmentById(attachmentId);
-        if (!attachment) {
-            res.status(404).json({ error: "Attachment not found" });
-            return;
-        }
-        assertCompanyAccess(req, attachment.orgId);
-        try {
-            await storage.deleteObject(attachment.orgId, attachment.objectKey);
-        }
-        catch (err) {
-            logger.warn({ err, attachmentId }, "storage delete failed while removing attachment");
-        }
-        const removed = await svc.removeAttachment(attachmentId);
-        if (!removed) {
-            res.status(404).json({ error: "Attachment not found" });
-            return;
-        }
-        const actor = getActorInfo(req);
-        await logActivity(db, {
-            orgId: removed.orgId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "issue.attachment_removed",
-            entityType: "issue",
-            entityId: removed.issueId,
-            details: {
-                attachmentId: removed.id,
-            },
-        });
-        res.json({ ok: true });
+    registerIssueMutationRoutes({
+        router,
+        db,
+        storage,
+        svc,
+        access,
+        agentsSvc,
+        projectsSvc,
+        goalsSvc,
+        heartbeat,
+        issueApprovalsSvc,
+        automationsSvc,
+        executionWorkspacesSvc,
+        assertCanAssignTasks,
+        boardUserId,
+        assertAgentRunCheckoutOwnership,
+        resolveAgentIssueRunId,
+        requireAgentRunId,
+        issueHasReviewer,
+        isReviewerAgentForIssue,
+        canAgentCompleteIssue,
+        statusForReviewDecision,
+        statusAcceptsReviewerDecision,
+        reviewerDecisionRequiresHumanHandoff,
+        commitSubject,
+    });
+    registerIssueCommentAttachmentRoutes({
+        router,
+        db,
+        storage,
+        svc,
+        runSingleFileUpload,
+        withContentPath,
+        MAX_ISSUE_COMMENT_LIMIT,
+        heartbeat,
+        workspaceBrowser,
+        assertAgentRunCheckoutOwnership,
+        resolveAgentIssueRunId,
     });
     return router;
 }