Files
PaperClipAI/server/src
Devin Foley ada47be764 fix(server): refuse agent-initiated issue assignment to paused agents (#10648)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - Agents can create and assign issues to other agents, and commonly
escalate to their org-chart manager (`reports_to`) when they hit
something outside their authority
> - Issue assignment already refuses terminated and pending-approval
assignees, but accepts paused assignees from any actor
> - A paused agent never runs, so agent-initiated escalations to a
paused manager become invisible dead letters — accepted silently, never
picked up, never surfaced
> - This pull request refuses paused assignees when the assigning actor
is an agent, at the single normalization helper all four assignment
paths flow through
> - The benefit is that agent-routed work can no longer silently vanish
into a paused agent's queue

## Linked Issues or Issue Description

Fixes #10641

## What Changed

- `normalizeIssueAssigneeAgentReference` (used by issue create, both
child-create routes, and issue update) now throws a 409 when an
**agent** actor assigns to a **paused** agent, with a message naming the
alternatives: assign an invokable agent, leave the issue unassigned, or
escalate to a board operator.
- Board/user actors are unchanged and may still assign to paused agents
deliberately — the pause state is visible in the UI, and staging work
for a later unpause is a legitimate workflow. Terminated /
pending-approval / invalid-org-chain refusals are unchanged for all
actors.
- This matches the existing precedent for watchdogs ("Cannot assign
watchdog to an agent that is not invokable") using the same
conflict-error shape.

## Verification

- `pnpm vitest run
server/src/__tests__/issue-assignee-invokability-routes.test.ts` — new
coverage: agent PATCH → paused assignee 409 (no update call), agent
child-create → paused assignee 409 (no create call), agent assignment to
an invokable agent still 200, board assignment to a paused agent still
200.
- Neighboring suites unchanged: `issue-update-comment-wakeup-routes`,
`issue-agent-mutation-ownership-routes`,
`issue-create-deduplication-routes`, `issue-watchdogs-routes` (97
tests).
- `cd server && pnpm run typecheck`.

## Risks

- Low. The only behavior change is a new 409 for agent actors assigning
to paused agents — previously a silent dead-letter. Agents that relied
on this (escalation flows) now get an actionable error instead; human
workflows are untouched.

## Model Used

Claude Fable 5 (`claude-fable-5`, Anthropic) via Claude Code — extended
thinking, agentic tool use. No other models involved.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-08-01 15:05:16 -07:00
..
…
…
…