fix(secrets): let an approved binding fill a blank agent config value (#20908)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - Agents can propose binding a company secret to another agent; a
person approves it with "Create binding" on a chat card
> - Approval refuses when the target config key already holds a
different value, so it never overwrites a working credential
> - An empty string or empty plain value also counted as "already
exists"
> - So an agent whose key was cleared could not be repaired through the
governed binding card: approval returned 409
> - This pull request treats a blank value like an unset key; non-empty
values still conflict
> - The benefit is that the supported binding approval repairs a member
with a blank credential

## Linked Issues or Issue Description

Refs #20879

**What happened**
In the `teams.configure-team` chat eval, the CEO proposed binding the
company OpenRouter secret to the QA member as `env.OPENROUTER_API_KEY`.
QA's saved value was an empty string. Approving that proposal fails with
409 "Agent config path already exists: env.OPENROUTER_API_KEY".

**Expected behavior**
Approval fills a blank value (empty string or empty plain value) with
the secret reference. A non-empty value still blocks the approval.

**Steps to reproduce**
1. Save an agent with `adapterConfig.env.TOKEN = ""`.
2. Have an agent propose a binding of a company secret to that agent as
`env.TOKEN`.
3. Approve the proposal as the board user.
4. The approval returns 409 and the binding is not created.

## What Changed

- `secret-proposals.ts`: `applyBindingApproval` treats `undefined`, `""`
and `{ type: "plain", value: "" }` as an unset key for both `env.<KEY>`
and other config paths.
- `secret-proposals-routes.test.ts`: regression tests for an empty
string and an empty plain value. The existing test that a non-empty
value conflicts still passes.

## Verification

- `pnpm exec vitest run src/__tests__/secret-proposals-routes.test.ts`
(in `server/`): 49 passed.
- Red check: without the service change, the two new tests fail.

## Risks

- Low risk. Only a blank value changes behavior. A blank value carries
no credential, so nothing working is replaced.

## Model Used

- Anthropic Claude Opus 5.5 (`claude-opus-5-5`), tool use and code
execution in Claude Code.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

server/src/__tests__/secret-proposals-routes.test.ts

@@ -817,6 +817,35 @@ describeEmbeddedPostgres("secret proposal routes", () => {
     expect(history.filter(row => row.action === "secret.proposal.approved")).toHaveLength(2);
   });
 
+  it.each([
+    ["an empty string", ""],
+    ["an empty plain value", { type: "plain", value: "" }],
+  ])("fills a target key left as %s instead of refusing the approved binding", async (_label, blank) => {
+    const fixture = await seedRun();
+    const agentApp = createAgentApp(fixture);
+    const boardApp = createBoardApp(fixture);
+    const secret = await request(agentApp).post("/api/agents/me/secret-proposals").send({
+      kind: "secret", name: "dev/blank/token", value: "blank-fixture", justification: "Needed by task",
+    });
+    const binding = await request(agentApp).post("/api/agents/me/secret-proposals").send({
+      kind: "binding", secretProposalId: secret.body.id, configPath: "env.BLANK_TOKEN", justification: "Use saved secret",
+    });
+    await db.update(agents).set({ adapterConfig: { env: { BLANK_TOKEN: blank, KEEP: "kept" } } })
+      .where(eq(agents.id, fixture.agentId));
+
+    const approved = await request(boardApp)
+      .post(`/api/companies/${fixture.companyId}/secret-proposals/${binding.body.id}/approve`).send({ cascade: true });
+
+    expect(approved.status).toBe(200);
+    const [saved] = await db.select().from(companySecrets);
+    const env = ((await db.select().from(agents))[0].adapterConfig as { env: Record<string, unknown> }).env;
+    expect(env.BLANK_TOKEN).toMatchObject({ type: "secret_ref", secretId: saved.id, version: "latest" });
+    expect(JSON.stringify(env.KEEP)).toContain("kept");
+    expect(await db.select().from(companySecretBindings)).toEqual([
+      expect.objectContaining({ secretId: saved.id, targetId: fixture.agentId, configPath: "env.BLANK_TOKEN" }),
+    ]);
+  });
+
   it("approves a binding without cascade after its secret proposal was approved separately", async () => {
     const fixture = await seedRun();
     const agentApp = createAgentApp(fixture);

server/src/services/secret-proposals.ts

@@ -667,6 +667,12 @@ export function createSecretProposalsService(db: Db) {
     return updated;
   }
 
+  function isBlankConfigValue(value: unknown) {
+    if (value === undefined || value === "") return true;
+    const record = asRecord(value);
+    return record.type === "plain" && record.value === "";
+  }
+
   async function applyBindingApproval(
     txDb: Db,
     proposal: Proposal,
@@ -701,13 +707,13 @@ export function createSecretProposalsService(db: Db) {
     if (namespace === "env") {
       const env = { ...asRecord(adapterConfig.env) };
       const existing = env[key];
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(binding)) {
+      if (!isBlankConfigValue(existing) && JSON.stringify(existing) !== JSON.stringify(binding)) {
         throw conflict(`Agent config path already exists: ${proposal.configPath}`);
       }
       adapterConfig.env = { ...env, [key]: binding };
     } else {
       const existing = adapterConfig[proposal.configPath];
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(binding)) {
+      if (!isBlankConfigValue(existing) && JSON.stringify(existing) !== JSON.stringify(binding)) {
         throw conflict(`Agent config path already exists: ${proposal.configPath}`);
       }
       adapterConfig[proposal.configPath] = binding;