## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Issue comments are part of the control plane boundary between agent
collaboration and task mutation.
> - Mention grants intentionally let a mentioned peer agent answer on an
issue thread without taking ownership of the task.
> - Closed issue comments have a second mutation guard because comments
can also request resume or reopen behavior.
> - A mention-granted comment should stay append-only unless the actor
also has mutation authority.
> - This pull request preserves the narrow comment path while keeping
explicit `resume` and `reopen` intent behind mutation authorization.
> - The benefit is a smaller authorization exception with regression
coverage for both allowed and denied paths.
## Linked Issues or Issue Description
Refs #2884
Related prior authorization work: #8024, #7863, #6113, #7998.
Bug fix description:
- What happened: a mention-granted non-assignee agent could be treated
as authorized for the closed issue comment route without preserving a
clean distinction between append-only comments and explicit
reopen/resume mutation intent.
- Expected behavior: a mention grant allows a plain comment on a closed
issue, but `resume: true` or `reopen: true` still requires mutation
authorization.
- Steps to reproduce: create a closed issue assigned to one agent, give
a different agent a valid mention-scoped comment grant, then POST a
comment as that agent with and without `resume`/`reopen` intent.
- Deployment mode: server route behavior; covered by focused Vitest
regression tests.
## What Changed
- Preserve the `issue:comment` authorization decision in `POST
/api/issues/:id/comments` so the route can identify legitimate
mention-grant decisions.
- Skip the closed-issue non-assignee mutation fallback only for inert
mention-granted comments.
- Continue requiring mutation authorization when a mention-granted
closed issue comment includes explicit `resume` or `reopen` intent.
- Add regression coverage for the allowed inert comment and denied
resume/reopen cases.
## Verification
- `pnpm vitest run
server/src/__tests__/issue-comment-reopen-routes.test.ts` passed
locally: 72 tests.
## Risks
- Low risk: scoped to the issue comment route and tests for a specific
authorization decision reason.
- Residual risk: CI should run the full PR suite.
## Model Used
OpenAI GPT-5 Codex via Paperclip Git Expert agent, with tool use for
code inspection, test execution, Git, and GitHub operations.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Nicky Leach
fb0e3fb02a