agent-dealer 0.2.0 → 1.0.0

package/bundle/server/dist/repository/authority-attempts.js

@@ -0,0 +1,189 @@
+// packages/server/src/repository/authority-attempts.ts
+//
+// Durable checkout ledger for short-lived Agent Deck execution authority (NOT-91). A row is
+// written BEFORE the mint call (status `acquiring`) so a crash between "asked Deck for
+// authority" and "released it" leaves something for restart reconciliation
+// (authority-lifecycle.ts's reconcileAuthoritiesAtStartup) and worker-death recovery
+// (coordinator/recovery.ts) to revoke against, instead of an authority that only ever lived
+// in one in-process async call's local variables.
+import { v4 as uuid } from "uuid";
+import { getDb } from "../db/index.js";
+function rowToAttempt(row) {
+    return {
+        id: row.id,
+        ownerKind: row.owner_kind,
+        ownerId: row.owner_id,
+        idempotencyKey: row.idempotency_key,
+        authorityId: row.authority_id,
+        deckId: row.deck_id,
+        runId: row.run_id,
+        attemptId: row.attempt_id,
+        ttlMs: row.ttl_ms,
+        toolScopeHint: row.tool_scope_hint_json ? JSON.parse(row.tool_scope_hint_json) : null,
+        status: row.status,
+        staleAt: row.stale_at,
+        expiresAt: row.expires_at,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+/** Inserted BEFORE the mint call — `acquiring` must never survive a process boundary. */
+export function createAuthorityAttempt(input) {
+    const now = new Date().toISOString();
+    const row = {
+        id: uuid(),
+        owner_kind: input.ownerKind,
+        owner_id: input.ownerId,
+        idempotency_key: input.idempotencyKey,
+        authority_id: null,
+        deck_id: input.deckId,
+        run_id: input.runId,
+        attempt_id: input.attemptId,
+        ttl_ms: input.ttlMs,
+        tool_scope_hint_json: input.toolScopeHint ? JSON.stringify(input.toolScopeHint) : null,
+        status: "acquiring",
+        stale_at: null,
+        expires_at: null,
+        created_at: now,
+        updated_at: now,
+    };
+    getDb()
+        .prepare(`
+      INSERT INTO authority_attempts (
+        id, owner_kind, owner_id, idempotency_key, authority_id, deck_id, run_id, attempt_id,
+        ttl_ms, tool_scope_hint_json, status, stale_at, expires_at, created_at, updated_at
+      ) VALUES (
+        @id, @owner_kind, @owner_id, @idempotency_key, @authority_id, @deck_id, @run_id, @attempt_id,
+        @ttl_ms, @tool_scope_hint_json, @status, @stale_at, @expires_at, @created_at, @updated_at
+      )
+    `)
+        .run(row);
+    return rowToAttempt(row);
+}
+/** `acquiring` → `active`, once mint + verify + materialize all succeed. CAS-fenced on the
+ * row still being `acquiring` — a no-op if it was already revoked out from under this call
+ * (e.g. a concurrent abort). Returns the updated row, or null if the CAS missed. */
+export function activateAuthorityAttempt(id, input) {
+    const now = new Date().toISOString();
+    const row = getDb()
+        .prepare(`
+      UPDATE authority_attempts SET
+        status = 'active', authority_id = @authority_id, expires_at = @expires_at, updated_at = @now
+      WHERE id = @id AND status = 'acquiring'
+      RETURNING *
+    `)
+        .get({ id, authority_id: input.authorityId, expires_at: input.expiresAt, now });
+    return row ? rowToAttempt(row) : null;
+}
+function setTerminalStatus(id, status) {
+    const now = new Date().toISOString();
+    const row = getDb()
+        .prepare(`
+      UPDATE authority_attempts SET status = @status, updated_at = @now
+      WHERE id = @id AND status IN ('acquiring', 'active')
+      RETURNING *
+    `)
+        .get({ id, status, now });
+    return row ? rowToAttempt(row) : null;
+}
+/** Normal end-of-use — the caller already revoked (or is about to revoke) the authority on
+ * Deck's side; this just closes the ledger row. */
+export function closeAuthorityAttempt(id) {
+    return setTerminalStatus(id, "closed");
+}
+/** Mint/verify/materialize failed — the caller already revoked (or has nothing to revoke,
+ * e.g. mint itself never returned an authorityId). */
+export function markAuthorityAttemptFailed(id) {
+    return setTerminalStatus(id, "failed");
+}
+/** One row, by id — the per-row counterpart to `revokeOpenActiveAuthorityAttempts`'s
+ * per-owner bulk flip, and what a resolved `acquiring` row is set to. */
+export function markAuthorityAttemptRevoked(id) {
+    return setTerminalStatus(id, "revoked");
+}
+export function getAuthorityAttempt(id) {
+    const row = getDb().prepare("SELECT * FROM authority_attempts WHERE id = ?").get(id);
+    return row ? rowToAttempt(row) : null;
+}
+/** Stamps a still-`acquiring` row as needing resolution — see schema.sql's `stale_at`
+ * comment. CAS-fenced on `status = 'acquiring'` (a no-op once the row has moved on) and on
+ * `stale_at IS NULL` (a no-op if already stamped), so calling this from every path that
+ * identifies a row as needing resolution is always safe to repeat. */
+export function markAuthorityAttemptStale(id) {
+    const now = new Date().toISOString();
+    const row = getDb()
+        .prepare(`
+      UPDATE authority_attempts SET stale_at = @now, updated_at = @now
+      WHERE id = @id AND status = 'acquiring' AND stale_at IS NULL
+      RETURNING *
+    `)
+        .get({ id, now });
+    return row ? rowToAttempt(row) : null;
+}
+/** Every row durably flagged as needing resolution and not yet resolved — the periodic
+ * retry sweep's input (authority-lifecycle.ts's `retryStaleAuthorityAttempts`). Unlike the
+ * startup sweep, this never re-derives staleness from a fresh scan of every open row: it
+ * only ever returns rows some other call already positively marked via
+ * `markAuthorityAttemptStale`, so it stays safe to call on a running process without risking
+ * a legitimately in-flight mint. */
+export function listStaleAcquiringAuthorityAttempts() {
+    const rows = getDb()
+        .prepare("SELECT * FROM authority_attempts WHERE status = 'acquiring' AND stale_at IS NOT NULL ORDER BY stale_at ASC")
+        .all();
+    return rows.map(rowToAttempt);
+}
+/** Every row for this owner still `acquiring`/`active` — a fresh attempt (a new
+ * idempotencyKey for the same owner) revokes these first (NOT-91's "revoke-before-new-
+ * attempt"): a prior attempt's authority has no legitimate further use once a new one
+ * starts. */
+export function listOpenAuthorityAttemptsForOwner(ownerKind, ownerId) {
+    const rows = getDb()
+        .prepare("SELECT * FROM authority_attempts WHERE owner_kind = ? AND owner_id = ? AND status IN ('acquiring', 'active') ORDER BY created_at ASC")
+        .all(ownerKind, ownerId);
+    return rows.map(rowToAttempt);
+}
+/**
+ * DB-only CAS: flips every `active` row for this owner (a known `authorityId`) to `revoked`
+ * and returns them, so the caller can best-effort revoke each on Deck's side. Synchronous and
+ * side-effect-free on Deck, so it is safe to call from inside a `better-sqlite3` transaction
+ * (recovery.ts's reclaim/dead-letter, commands.ts's abortIssue) — the actual network revoke
+ * happens only after that transaction commits.
+ *
+ * Deliberately excludes `acquiring` rows (no `authorityId` yet): a coordinator can crash
+ * after Deck committed a mint but before that row was activated with the resulting id, so an
+ * `acquiring` row alone can't be assumed to have nothing live behind it. Terminalizing it here
+ * on a guess is exactly the leak NOT-91's review caught — it must instead be resolved by
+ * replaying its stored idempotencyKey (authority-lifecycle.ts's `resolveAcquiringAttempts`),
+ * which needs an async mint() call this synchronous DB-only helper can't make. Callers pair
+ * this with `listOpenAcquiringAuthorityAttempts` for that owner and resolve those separately,
+ * outside any surrounding transaction.
+ */
+export function revokeOpenActiveAuthorityAttempts(ownerKind, ownerId) {
+    const now = new Date().toISOString();
+    const rows = getDb()
+        .prepare(`
+      UPDATE authority_attempts SET status = 'revoked', updated_at = @now
+      WHERE owner_kind = @owner_kind AND owner_id = @owner_id AND status = 'active'
+      RETURNING *
+    `)
+        .all({ owner_kind: ownerKind, owner_id: ownerId, now });
+    return rows.map(rowToAttempt);
+}
+/** Read-only: every `acquiring` row for this owner (no `authorityId` yet) — the counterpart
+ * to `revokeOpenActiveAuthorityAttempts` a caller resolves separately, asynchronously, via
+ * `authority-lifecycle.ts`'s `resolveAcquiringAttempts`. Never mutates status itself, so it is
+ * safe to call from inside a `better-sqlite3` transaction alongside the active-row revoke. */
+export function listOpenAcquiringAuthorityAttempts(ownerKind, ownerId) {
+    const rows = getDb()
+        .prepare("SELECT * FROM authority_attempts WHERE owner_kind = ? AND owner_id = ? AND status = 'acquiring' ORDER BY created_at ASC")
+        .all(ownerKind, ownerId);
+    return rows.map(rowToAttempt);
+}
+/** Every row still `acquiring`/`active` for any owner — the startup sweep's input
+ * (authority-lifecycle.ts's reconcileAuthoritiesAtStartup). */
+export function listAllOpenAuthorityAttempts() {
+    const rows = getDb()
+        .prepare("SELECT * FROM authority_attempts WHERE status IN ('acquiring', 'active') ORDER BY created_at ASC")
+        .all();
+    return rows.map(rowToAttempt);
+}

package/bundle/server/dist/repository/findings.js

@@ -0,0 +1,70 @@
+import { v4 as uuid } from "uuid";
+import { getDb } from "../db/index.js";
+function rowToFinding(row) {
+    return {
+        id: row.id,
+        issueId: row.issue_id,
+        fingerprint: row.fingerprint,
+        severity: row.severity,
+        title: row.title,
+        rationale: row.rationale,
+        evidenceRef: row.evidence_ref,
+        file: row.file,
+        line: row.line,
+        status: row.status,
+        firstRound: row.first_round,
+        lastRound: row.last_round,
+    };
+}
+/**
+ * Inserts a new finding, or — if one with the same (issue, fingerprint) is
+ * open/recurring — marks it recurring and bumps last_round (PRD §6.4).
+ */
+export function reconcileFinding(input) {
+    const db = getDb();
+    const existing = db
+        .prepare(`SELECT * FROM findings WHERE issue_id = ? AND fingerprint = ? AND status IN ('open', 'recurring')`)
+        .get(input.issueId, input.fingerprint);
+    if (existing) {
+        db.prepare("UPDATE findings SET status = 'recurring', last_round = ? WHERE id = ?").run(input.round, existing.id);
+        const row = db.prepare("SELECT * FROM findings WHERE id = ?").get(existing.id);
+        return rowToFinding(row);
+    }
+    const row = {
+        id: uuid(),
+        issue_id: input.issueId,
+        fingerprint: input.fingerprint,
+        severity: input.severity,
+        title: input.title,
+        rationale: input.rationale,
+        evidence_ref: input.evidenceRef ?? null,
+        file: input.file ?? null,
+        line: input.line ?? null,
+        status: "open",
+        first_round: input.round,
+        last_round: input.round,
+    };
+    db.prepare(`
+    INSERT INTO findings (
+      id, issue_id, fingerprint, severity, title, rationale, evidence_ref, file, line,
+      status, first_round, last_round
+    ) VALUES (
+      @id, @issue_id, @fingerprint, @severity, @title, @rationale, @evidence_ref, @file, @line,
+      @status, @first_round, @last_round
+    )
+  `).run(row);
+    return rowToFinding(row);
+}
+export function resolveFinding(id) {
+    getDb().prepare("UPDATE findings SET status = 'resolved' WHERE id = ?").run(id);
+    const row = getDb().prepare("SELECT * FROM findings WHERE id = ?").get(id);
+    if (!row)
+        throw new Error(`Finding not found: ${id}`);
+    return rowToFinding(row);
+}
+export function listFindingsForIssue(issueId) {
+    const rows = getDb()
+        .prepare("SELECT * FROM findings WHERE issue_id = ? ORDER BY first_round ASC")
+        .all(issueId);
+    return rows.map(rowToFinding);
+}

package/bundle/server/dist/repository/findings.test.js

@@ -0,0 +1,68 @@
+import { test, before } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-findings-"));
+const { migrate } = await import("../db/index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue } = await import("./issues.js");
+const { reconcileFinding, resolveFinding, listFindingsForIssue } = await import("./findings.js");
+before(() => {
+    migrate();
+});
+function seedIssue(title) {
+    return createIssue({
+        title,
+        repo: "acme/app",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        baseBranch: "main",
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual"
+    }).id;
+}
+test("creates a new finding as open", () => {
+    const issueId = seedIssue("Finding issue 1");
+    const finding = reconcileFinding({
+        issueId,
+        fingerprint: "fp-1",
+        severity: "blocking",
+        title: "Missing null check",
+        rationale: "user can be undefined",
+        round: 1
+    });
+    assert.equal(finding.status, "open");
+    assert.equal(finding.firstRound, 1);
+    assert.equal(finding.lastRound, 1);
+});
+test("marks a repeated fingerprint as recurring and bumps last_round", () => {
+    const issueId = seedIssue("Finding issue 2");
+    reconcileFinding({ issueId, fingerprint: "fp-1", severity: "blocking", title: "T", rationale: "R", round: 1 });
+    const again = reconcileFinding({
+        issueId,
+        fingerprint: "fp-1",
+        severity: "blocking",
+        title: "T",
+        rationale: "R",
+        round: 2
+    });
+    assert.equal(again.status, "recurring");
+    assert.equal(again.firstRound, 1);
+    assert.equal(again.lastRound, 2);
+});
+test("resolves a finding", () => {
+    const issueId = seedIssue("Finding issue 3");
+    const finding = reconcileFinding({
+        issueId,
+        fingerprint: "fp-1",
+        severity: "blocking",
+        title: "T",
+        rationale: "R",
+        round: 1
+    });
+    const resolved = resolveFinding(finding.id);
+    assert.equal(resolved.status, "resolved");
+    assert.equal(listFindingsForIssue(issueId).find((f) => f.id === finding.id)?.status, "resolved");
+});

package/bundle/server/dist/repository/human-actions.js

@@ -0,0 +1,142 @@
+import { v4 as uuid } from "uuid";
+import { getDb } from "../db/index.js";
+function rowToAction(row) {
+    return {
+        id: row.id,
+        issueId: row.issue_id,
+        runId: row.run_id,
+        workflowInstanceId: row.workflow_instance_id,
+        actionType: row.action_type,
+        reason: row.reason,
+        question: row.question,
+        evidenceJson: row.evidence_json,
+        responseOptionsJson: row.response_options_json,
+        continuationPreviewJson: row.continuation_preview_json,
+        requestId: row.request_id,
+        status: row.status,
+        resolutionJson: row.resolution_json,
+        resolvedBy: row.resolved_by,
+        requestedAt: row.requested_at,
+        resolvedAt: row.resolved_at,
+    };
+}
+export function createHumanAction(input) {
+    if (Boolean(input.issueId) === Boolean(input.runId)) {
+        throw new Error("createHumanAction requires exactly one of issueId or runId");
+    }
+    const db = getDb();
+    const now = new Date().toISOString();
+    const row = {
+        id: uuid(),
+        issue_id: input.issueId ?? null,
+        run_id: input.runId ?? null,
+        workflow_instance_id: input.workflowInstanceId ?? null,
+        action_type: input.actionType,
+        reason: input.reason,
+        question: input.question,
+        evidence_json: input.evidence !== undefined ? JSON.stringify(input.evidence) : null,
+        response_options_json: input.responseOptions !== undefined ? JSON.stringify(input.responseOptions) : null,
+        continuation_preview_json: input.continuationPreview !== undefined ? JSON.stringify(input.continuationPreview) : null,
+        request_id: input.requestId ?? null,
+        status: "open",
+        resolution_json: null,
+        resolved_by: null,
+        requested_at: now,
+        resolved_at: null,
+    };
+    // ON CONFLICT's target must repeat the partial index's predicate verbatim (schema.sql's
+    // idx_human_actions_open_request) — a bare `ON CONFLICT (issue_id, action_type,
+    // request_id)` throws SQLITE_ERROR against a partial unique index. A request_id-less
+    // insert (the vast majority of action types) never matches this partial index at all, so
+    // it always proceeds as a plain insert.
+    const info = db.prepare(`
+    INSERT INTO human_actions (
+      id, issue_id, run_id, workflow_instance_id, action_type, reason, question, evidence_json,
+      response_options_json, continuation_preview_json, request_id, status, resolution_json, resolved_by,
+      requested_at, resolved_at
+    ) VALUES (
+      @id, @issue_id, @run_id, @workflow_instance_id, @action_type, @reason, @question, @evidence_json,
+      @response_options_json, @continuation_preview_json, @request_id, @status, @resolution_json, @resolved_by,
+      @requested_at, @resolved_at
+    )
+    ON CONFLICT (issue_id, action_type, request_id) WHERE status = 'open' AND request_id IS NOT NULL DO NOTHING
+  `).run(row);
+    if (info.changes === 0 && input.requestId && input.issueId) {
+        // Lost the race to dedupe onto an already-open action for this exact request — return
+        // the winner, never a phantom row this insert never actually created. (The partial
+        // index's NULL-issue_id rows — Run-scoped actions — never collide with each other at
+        // all under standard SQL NULL semantics, so this race is only reachable Issue-scoped.)
+        const existing = findOpenHumanActionByRequestId(input.issueId, input.actionType, input.requestId);
+        if (existing)
+            return existing;
+    }
+    return rowToAction(row);
+}
+export function resolveHumanAction(id, resolvedBy, resolution) {
+    const now = new Date().toISOString();
+    getDb()
+        .prepare(`
+      UPDATE human_actions SET
+        status = 'resolved', resolution_json = ?, resolved_by = ?, resolved_at = ?
+      WHERE id = ? AND status = 'open'
+    `)
+        .run(JSON.stringify(resolution), resolvedBy, now, id);
+    const row = getDb().prepare("SELECT * FROM human_actions WHERE id = ?").get(id);
+    if (!row)
+        throw new Error(`Human action not found: ${id}`);
+    if (row.status !== "resolved")
+        throw new Error(`Human action already resolved or missing: ${id}`);
+    return rowToAction(row);
+}
+export function getHumanAction(id) {
+    const row = getDb().prepare("SELECT * FROM human_actions WHERE id = ?").get(id);
+    return row ? rowToAction(row) : null;
+}
+export function listOpenHumanActions() {
+    const rows = getDb()
+        .prepare("SELECT * FROM human_actions WHERE status = 'open' ORDER BY requested_at ASC")
+        .all();
+    return rows.map(rowToAction);
+}
+/** The one open action of this type for the issue, if any — used to make re-raising a
+ * pre-start action (e.g. product_scope_decision) idempotent instead of piling up
+ * duplicates across repeated calls. */
+export function findOpenHumanAction(issueId, actionType) {
+    const row = getDb()
+        .prepare("SELECT * FROM human_actions WHERE issue_id = ? AND action_type = ? AND status = 'open' ORDER BY requested_at ASC LIMIT 1")
+        .get(issueId, actionType);
+    return row ? rowToAction(row) : null;
+}
+/** Dedupe key for a repeated Deck INTERACTION_REQUIRED signal that names a request id
+ * (NOT-93) — a second signal for the same request must land on the one open action it
+ * already raised, never a duplicate. Callers (reflect-trigger.ts, commands.ts) still read
+ * this first to decide whether to raise at all; the actual race-proofing against a
+ * concurrent duplicate insert is `createHumanAction`'s own `ON CONFLICT ... DO NOTHING`
+ * against `idx_human_actions_open_request` (NOT-91) — this function alone is not atomic. */
+export function findOpenHumanActionByRequestId(issueId, actionType, requestId) {
+    const row = getDb()
+        .prepare("SELECT * FROM human_actions WHERE issue_id = ? AND action_type = ? AND request_id = ? AND status = 'open' ORDER BY requested_at ASC LIMIT 1")
+        .get(issueId, actionType, requestId);
+    return row ? rowToAction(row) : null;
+}
+export function listHumanActionsForIssue(issueId) {
+    const rows = getDb()
+        .prepare("SELECT * FROM human_actions WHERE issue_id = ? ORDER BY requested_at ASC")
+        .all(issueId);
+    return rows.map(rowToAction);
+}
+/** Run-scoped equivalent of `findOpenHumanAction` (NOT-95 — outbound-draft delivery
+ * parking has no Issue). */
+export function findOpenHumanActionForRun(runId, actionType) {
+    const row = getDb()
+        .prepare("SELECT * FROM human_actions WHERE run_id = ? AND action_type = ? AND status = 'open' ORDER BY requested_at ASC LIMIT 1")
+        .get(runId, actionType);
+    return row ? rowToAction(row) : null;
+}
+/** Run-scoped equivalent of `listHumanActionsForIssue` (NOT-95). */
+export function listHumanActionsForRun(runId) {
+    const rows = getDb()
+        .prepare("SELECT * FROM human_actions WHERE run_id = ? ORDER BY requested_at ASC")
+        .all(runId);
+    return rows.map(rowToAction);
+}

package/bundle/server/dist/repository/human-actions.test.js

@@ -0,0 +1,123 @@
+import { test, before } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-actions-"));
+const { migrate } = await import("../db/index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue } = await import("./issues.js");
+const { createRun } = await import("./runs.js");
+const { createHumanAction, resolveHumanAction, listOpenHumanActions, listHumanActionsForIssue, findOpenHumanActionByRequestId } = await import("./human-actions.js");
+before(() => {
+    migrate();
+});
+function seedIssue(title) {
+    return createIssue({
+        title,
+        repo: "acme/app",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        baseBranch: "main",
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual"
+    }).id;
+}
+test("creates an open action and lists it globally and per-issue", () => {
+    const issueId = seedIssue("Action issue 1");
+    const action = createHumanAction({
+        issueId,
+        actionType: "final_review",
+        reason: "Reviewer approved",
+        question: "Accept?",
+        responseOptions: ["complete", "repair", "close"]
+    });
+    assert.equal(action.status, "open");
+    assert.ok(listOpenHumanActions().some((a) => a.id === action.id));
+    assert.deepStrictEqual(listHumanActionsForIssue(issueId).map((a) => a.id), [action.id]);
+});
+test("resolves an action and removes it from the open queue", () => {
+    const issueId = seedIssue("Action issue 2");
+    const action = createHumanAction({
+        issueId,
+        actionType: "final_review",
+        reason: "Reviewer approved",
+        question: "Accept?",
+        responseOptions: ["complete", "repair", "close"]
+    });
+    const resolved = resolveHumanAction(action.id, "yusuke", { choice: "complete" });
+    assert.equal(resolved.status, "resolved");
+    assert.equal(resolved.resolvedBy, "yusuke");
+    assert.equal(listOpenHumanActions().some((a) => a.id === action.id), false);
+});
+test("createHumanAction persists Deck's requestId and defaults to null when none is supplied (NOT-93)", () => {
+    const issueId = seedIssue("Action issue 3");
+    const withRequestId = createHumanAction({
+        issueId,
+        actionType: "deck_interaction_required",
+        reason: "Control-plane decision required",
+        question: "Resolve it in Agent Deck, then resume?",
+        responseOptions: [{ choice: "resume", label: "Resume" }],
+        requestId: "req_abc123"
+    });
+    assert.equal(withRequestId.requestId, "req_abc123");
+    const withoutRequestId = createHumanAction({
+        issueId,
+        actionType: "policy_escalation",
+        reason: "infra hiccup",
+        question: "Resume?",
+        responseOptions: [{ choice: "resume", label: "Resume" }]
+    });
+    assert.equal(withoutRequestId.requestId, null);
+});
+test("findOpenHumanActionByRequestId dedupes a repeated Deck signal to the one open action it already raised", () => {
+    const issueId = seedIssue("Action issue 4");
+    const action = createHumanAction({
+        issueId,
+        actionType: "deck_interaction_required",
+        reason: "Control-plane decision required",
+        question: "Resolve it in Agent Deck, then resume?",
+        responseOptions: [{ choice: "resume", label: "Resume" }],
+        requestId: "req_dup1"
+    });
+    // A repeat of the same request id on the same issue/action type finds the existing
+    // open action instead of nothing (the caller uses this to skip creating a duplicate).
+    const found = findOpenHumanActionByRequestId(issueId, "deck_interaction_required", "req_dup1");
+    assert.equal(found?.id, action.id);
+    // A different request id, action type, or issue never matches.
+    assert.equal(findOpenHumanActionByRequestId(issueId, "deck_interaction_required", "req_other"), null);
+    assert.equal(findOpenHumanActionByRequestId(issueId, "policy_escalation", "req_dup1"), null);
+    assert.equal(findOpenHumanActionByRequestId(seedIssue("Action issue 5"), "deck_interaction_required", "req_dup1"), null);
+    // Once resolved, it's no longer open — a later repeat of the same request id (a
+    // genuinely new attempt reusing an old id would be a Deck bug, not Dealer's to guard)
+    // must not resurrect or match the resolved row.
+    resolveHumanAction(action.id, "yusuke", { choice: "resume" });
+    assert.equal(findOpenHumanActionByRequestId(issueId, "deck_interaction_required", "req_dup1"), null);
+});
+test("the open list includes run-scoped actions that have no issue", () => {
+    // NOT-71 acceptance: deleting the standalone Human actions page was only safe because the
+    // Issues home lists *every* open action. A run-scoped action (outbound-draft delivery
+    // parking, NOT-95) has no issue to open, so if it were missing from this list it would be
+    // unreachable in the UI entirely — the gap the ticket called out by name.
+    const run = createRun({
+        title: "outbound draft",
+        agentId: BUILTIN_AGENT_CLAUDE_ID,
+        repo: "acme/app",
+        taskCategory: "other",
+        status: "plan_pending"
+    });
+    const action = createHumanAction({
+        runId: run.id,
+        actionType: "outbound_delivery_interaction_required",
+        reason: "Delivery needs a human",
+        question: "Send the draft?",
+        responseOptions: ["complete", "close"]
+    });
+    assert.equal(action.issueId, null);
+    const listed = listOpenHumanActions().find((a) => a.id === action.id);
+    assert.ok(listed, "run-scoped action must appear in the global open list");
+    // ...and it must carry the choices the home screen resolves it with, since there is no
+    // issue page to fall back to.
+    assert.ok((listed.responseOptionsJson ?? "").includes("complete"));
+});