Add company artifacts page (#7621)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Operators need a way to inspect files and work products created by
agents across a company without opening each issue one by one.
> - The existing issue detail surfaces already show attachments and
outputs, but there was no company-level artifacts index or search-result
affordance for artifact-like records.
> - The backend needed a company-scoped artifacts projection API that
preserves issue/run attribution and safe links back to source records.
> - The UI needed a first-class Artifacts page, sidebar entry, reusable
artifact cards, and deep-link handling that keeps company prefixes
intact.
> - This pull request adds the company artifacts API and page, then
wires artifacts into search and issue output surfaces.
> - The benefit is a single place to browse, filter, and open generated
work products and attachments while preserving company boundaries.

## Linked Issues or Issue Description

Fixes #7622.

Feature request fields:

- Problem/motivation: company operators need a consolidated artifacts
surface for attachments and work products produced by agents.
- Proposed solution: add a company-scoped artifacts projection endpoint,
a board Artifacts route, reusable cards, sidebar navigation, and
artifact search integration.
- Alternatives considered: keep artifact discovery only on individual
issue pages; that forces operators to know the source issue before
finding generated outputs.
- Roadmap alignment: checked `ROADMAP.md`; this is a focused board
UI/API improvement and does not duplicate a listed roadmap item.

## What Changed

- Added shared artifact types and validators.
- Added a company-scoped artifact projection service/API with tests for
attachment/work-product attribution.
- Added Artifacts board UI route, API client, sidebar link, cards,
filters, and storybook coverage.
- Added artifact result handling to company search and issue
output/deep-link flows.
- Rebased the branch onto the latest `public-gh/master` state and
resolved the route-test conflict by preserving both upstream
team-catalog coverage and artifact route coverage.
- Fixed a local Sidebar test helper so it no longer depends on a
runtime-undefined `React.act` export in this dependency install.

## Verification

- `pnpm --filter @paperclipai/ui exec vitest run
src/components/artifacts/ArtifactCard.test.tsx src/api/artifacts.test.ts
src/lib/company-routes.test.ts`
- `pnpm --filter @paperclipai/ui exec vitest run
src/pages/Artifacts.test.tsx src/pages/Search.test.tsx
src/components/Sidebar.test.tsx`
- `pnpm exec vitest run
server/src/__tests__/company-artifacts-service.test.ts
server/src/__tests__/company-search-service.test.ts
server/src/__tests__/company-search-rate-limit-routes.test.ts
server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts`
- Confirmed the PR diff does not include `pnpm-lock.yaml` or
`.github/workflows/*`.
- Duplicate search: no open PRs or issues found for `artifact page
ArtifactCard` in `paperclipai/paperclip`.

Screenshots are intentionally omitted per the internal task instruction
not to add design screenshots or images to this PR unless they are
specifically part of the work. I also attempted browser capture in this
runner, but `agent-browser` failed to launch Chrome and Playwright
Chromium is missing `libatk-1.0.so.0`.

## Risks

- Low-to-medium risk: this adds a new API projection and UI surface, so
attribution/link regressions could affect artifact navigation.
- Company scoping is covered in the new service/API tests.
- No database migrations are included.
- No lockfile or workflow changes are included.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

OpenAI Codex, GPT-5 coding agent with tool use and local command
execution. Exact hosted model identifier is not exposed in this runtime.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots (intentionally omitted per task instruction; browser capture
unavailable in this runner)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>

packages/shared/src/index.ts

@@ -404,6 +404,7 @@ export type {
   ProjectManagedByPlugin,
   ProjectWorkspace,
   CompanySearchHighlight,
+  CompanySearchArtifactSummary,
   CompanySearchIssueSummary,
   CompanySearchResponse,
   CompanySearchResult,
@@ -446,6 +447,13 @@ export type {
   IssueWorkProductProvider,
   IssueWorkProductStatus,
   IssueWorkProductReviewState,
+  CompanyArtifact,
+  CompanyArtifactAgentSummary,
+  CompanyArtifactIssueSummary,
+  CompanyArtifactMediaKind,
+  CompanyArtifactProjectSummary,
+  CompanyArtifactSource,
+  CompanyArtifactsResponse,
   CreateDocumentAnnotationCommentRequest,
   CreateDocumentAnnotationThreadRequest,
   DocumentAnnotationAnchorRemapSnapshot,
@@ -982,6 +990,14 @@ export {
   issueWorkProductTypeSchema,
   issueWorkProductStatusSchema,
   issueWorkProductReviewStateSchema,
+  COMPANY_ARTIFACTS_DEFAULT_LIMIT,
+  COMPANY_ARTIFACTS_MAX_LIMIT,
+  COMPANY_ARTIFACTS_MAX_QUERY_LENGTH,
+  companyArtifactMediaKindSchema,
+  companyArtifactSchema,
+  companyArtifactSourceSchema,
+  companyArtifactsQuerySchema,
+  companyArtifactsResponseSchema,
   updateExecutionWorkspaceSchema,
   executionWorkspaceStatusSchema,
   executionWorkspaceCloseActionKindSchema,
@@ -1016,6 +1032,7 @@ export {
   type CreateIssueAttachmentMetadata,
   type CreateIssueWorkProduct,
   type UpdateIssueWorkProduct,
+  type CompanyArtifactsQuery,
   type UpdateExecutionWorkspace,
   type IssueDocumentFormat,
   type UpsertIssueDocument,

packages/shared/src/types/artifact.ts

@@ -0,0 +1,41 @@
+export type CompanyArtifactSource = "document" | "attachment" | "work_product";
+
+export type CompanyArtifactMediaKind = "image" | "video" | "text" | "document" | "file" | "empty";
+
+export interface CompanyArtifactIssueSummary {
+  id: string;
+  identifier: string;
+  title: string;
+}
+
+export interface CompanyArtifactProjectSummary {
+  id: string;
+  name: string;
+}
+
+export interface CompanyArtifactAgentSummary {
+  id: string;
+  name: string;
+}
+
+export interface CompanyArtifact {
+  id: string;
+  source: CompanyArtifactSource;
+  mediaKind: CompanyArtifactMediaKind;
+  title: string;
+  previewText: string | null;
+  contentType: string | null;
+  contentPath: string | null;
+  openPath: string | null;
+  downloadPath: string | null;
+  issue: CompanyArtifactIssueSummary;
+  project: CompanyArtifactProjectSummary | null;
+  createdByAgent: CompanyArtifactAgentSummary | null;
+  updatedAt: string;
+  href: string;
+}
+
+export interface CompanyArtifactsResponse {
+  artifacts: CompanyArtifact[];
+  nextCursor: string | null;
+}

packages/shared/src/types/index.ts

@@ -162,6 +162,7 @@ export type {
 export type { Project, ProjectCodebase, ProjectCodebaseOrigin, ProjectGoalRef, ProjectManagedByPlugin, ProjectWorkspace } from "./project.js";
 export type {
   CompanySearchHighlight,
+  CompanySearchArtifactSummary,
   CompanySearchIssueSummary,
   CompanySearchResponse,
   CompanySearchResult,
@@ -213,6 +214,15 @@ export type {
   IssueWorkProductReviewState,
   AttachmentArtifactWorkProductMetadata,
 } from "./work-product.js";
+export type {
+  CompanyArtifact,
+  CompanyArtifactAgentSummary,
+  CompanyArtifactIssueSummary,
+  CompanyArtifactMediaKind,
+  CompanyArtifactProjectSummary,
+  CompanyArtifactSource,
+  CompanyArtifactsResponse,
+} from "./artifact.js";
 export type {
   Issue,
   IssueWorkMode,

packages/shared/src/types/search.ts

@@ -1,9 +1,9 @@
 import type { IssuePriority, IssueStatus } from "../constants.js";
 
-export const COMPANY_SEARCH_SCOPES = ["all", "issues", "comments", "documents", "agents", "projects"] as const;
+export const COMPANY_SEARCH_SCOPES = ["all", "issues", "comments", "documents", "artifacts", "agents", "projects"] as const;
 export type CompanySearchScope = (typeof COMPANY_SEARCH_SCOPES)[number];
 
-export type CompanySearchResultType = "issue" | "agent" | "project";
+export type CompanySearchResultType = "issue" | "artifact" | "agent" | "project";
 
 export interface CompanySearchHighlight {
   start: number;
@@ -29,6 +29,18 @@ export interface CompanySearchIssueSummary {
   updatedAt: string;
 }
 
+export interface CompanySearchArtifactSummary {
+  id: string;
+  source: "document" | "attachment" | "work_product";
+  mediaKind: "image" | "video" | "text" | "document" | "file" | "empty";
+  issueId: string;
+  issueIdentifier: string;
+  issueTitle: string;
+  projectId: string | null;
+  projectName: string | null;
+  updatedAt: string;
+}
+
 export interface CompanySearchResult {
   id: string;
   type: CompanySearchResultType;
@@ -40,6 +52,7 @@ export interface CompanySearchResult {
   snippet: string | null;
   snippets: CompanySearchSnippet[];
   issue?: CompanySearchIssueSummary;
+  artifact?: CompanySearchArtifactSummary;
   updatedAt: string | null;
   previewImageUrl: string | null;
 }

packages/shared/src/validators/artifact.ts

@@ -0,0 +1,57 @@
+import { z } from "zod";
+
+export const COMPANY_ARTIFACTS_DEFAULT_LIMIT = 30;
+export const COMPANY_ARTIFACTS_MAX_LIMIT = 100;
+export const COMPANY_ARTIFACTS_MAX_QUERY_LENGTH = 160;
+
+export const companyArtifactSourceSchema = z.enum(["document", "attachment", "work_product"]);
+
+export const companyArtifactMediaKindSchema = z.enum(["image", "video", "text", "document", "file", "empty"]);
+
+export const companyArtifactsQuerySchema = z.object({
+  kind: z.enum(["image", "video", "text", "document", "file", "all"]).optional().default("all"),
+  projectId: z.string().uuid().optional(),
+  q: z.string().trim().max(COMPANY_ARTIFACTS_MAX_QUERY_LENGTH).optional(),
+  limit: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .max(COMPANY_ARTIFACTS_MAX_LIMIT)
+    .optional()
+    .default(COMPANY_ARTIFACTS_DEFAULT_LIMIT),
+  cursor: z.string().min(1).optional(),
+});
+
+export const companyArtifactSchema = z.object({
+  id: z.string().min(1),
+  source: companyArtifactSourceSchema,
+  mediaKind: companyArtifactMediaKindSchema,
+  title: z.string(),
+  previewText: z.string().nullable(),
+  contentType: z.string().nullable(),
+  contentPath: z.string().nullable(),
+  openPath: z.string().nullable(),
+  downloadPath: z.string().nullable(),
+  issue: z.object({
+    id: z.string().uuid(),
+    identifier: z.string(),
+    title: z.string(),
+  }),
+  project: z.object({
+    id: z.string().uuid(),
+    name: z.string(),
+  }).nullable(),
+  createdByAgent: z.object({
+    id: z.string().uuid(),
+    name: z.string(),
+  }).nullable(),
+  updatedAt: z.string().datetime(),
+  href: z.string().min(1),
+});
+
+export const companyArtifactsResponseSchema = z.object({
+  artifacts: z.array(companyArtifactSchema),
+  nextCursor: z.string().nullable(),
+});
+
+export type CompanyArtifactsQuery = z.infer<typeof companyArtifactsQuerySchema>;

packages/shared/src/validators/index.ts

@@ -326,6 +326,18 @@ export {
   type UpdateIssueWorkProduct,
 } from "./work-product.js";
 
+export {
+  COMPANY_ARTIFACTS_DEFAULT_LIMIT,
+  COMPANY_ARTIFACTS_MAX_LIMIT,
+  COMPANY_ARTIFACTS_MAX_QUERY_LENGTH,
+  companyArtifactMediaKindSchema,
+  companyArtifactSchema,
+  companyArtifactSourceSchema,
+  companyArtifactsQuerySchema,
+  companyArtifactsResponseSchema,
+  type CompanyArtifactsQuery,
+} from "./artifact.js";
+
 export {
   executionWorkspaceConfigSchema,
   updateExecutionWorkspaceSchema,