From 41c0e60d1eb6be1e0eb88455b4672ac7133a929d Mon Sep 17 00:00:00 2001 From: Dotta Date: Sun, 8 Nov 2026 23:38:35 -0600 Subject: [PATCH] fix(authz): tell agents to reply now after a final board-only denial In the plugins.configure-plugin chat eval, the agent got the final denial with a plugin settings link and still searched the API for two more minutes, reasoning that the request implied another route. Say to stop working on the denied step and reply now. Co-Authored-By: Claude Opus 5.5 --- server/src/__tests__/board-access-denial.test.ts | 1 + server/src/routes/authz.ts | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/server/src/__tests__/board-access-denial.test.ts b/server/src/__tests__/board-access-denial.test.ts index d8217041624..c545fa7831c 100644 --- a/server/src/__tests__/board-access-denial.test.ts +++ b/server/src/__tests__/board-access-denial.test.ts @@ -51,6 +51,7 @@ describe("board-only denial", () => { expect(res.body.code).toBe(BOARD_ACCESS_REQUIRED_CODE); expect(res.body.remediation).toContain("this denial is final"); expect(res.body.remediation).toContain("do not search for one"); + expect(res.body.remediation).toContain("reply now"); expect(res.body.remediation).toContain(link); }); diff --git a/server/src/routes/authz.ts b/server/src/routes/authz.ts index 9b16388328e..7be801f0faa 100644 --- a/server/src/routes/authz.ts +++ b/server/src/routes/authz.ts @@ -98,7 +98,7 @@ export function boardAccessRequired(req: Request) { : "They can do it in the Paperclip web app or with their own board credentials. Link a page only if you already know its route; do not search for one."; return forbidden("Board access required", { code: BOARD_ACCESS_REQUIRED_CODE, - remediation: `This action is board-only by design and this denial is final: no agent credential, tool or other API route can do it, so do not search for one. Tell the person that a board user must do it. ${where}`, + remediation: `This action is board-only by design and this denial is final: no agent credential, tool or other API route can do it, so do not search for one. Stop working on this step and reply now: tell the person that a board user must do it. ${where}`, }); }