From e486bd818ce627d60420790b29e9017c8324c196 Mon Sep 17 00:00:00 2001
From: Dave <david.els1@outlook.com>
Date: Sat, 26 Sep 2026 10:23:12 +0200
Subject: [PATCH] fix(agent-api): log comment_added activity for agent-posted
 comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every other comment path in this codebase (the owner's own addOwnerComment,
and the client manager's POST /api/client/cards/:id/comments) writes a
comment_added row so the card's activity feed shows "commented" in its
timeline. The agent comment route was the one path silently invisible to
that audit trail — exactly where an audit trail matters most, since it's a
machine writing on the owner's behalf.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../agent/cards/[cardId]/comments/route.ts    | 39 +++++++++++++------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/src/app/api/agent/cards/[cardId]/comments/route.ts b/src/app/api/agent/cards/[cardId]/comments/route.ts
index 3b755b8..9deb476 100644
--- a/src/app/api/agent/cards/[cardId]/comments/route.ts
+++ b/src/app/api/agent/cards/[cardId]/comments/route.ts
@@ -1,6 +1,7 @@
 import { getAdminPb } from "@/lib/pb/admin";
 import { requireAgentToken } from "@/lib/agent/auth";
 import { getOwnerUser } from "@/lib/agent/owner";
+import { logActivity } from "@/app/actions/activity";
 import { jsonError, jsonOk } from "@/lib/http/json";
 import type { CardRecord } from "@/lib/pb/types";
 
@@ -36,20 +37,34 @@ export async function POST(
     return jsonError("A non-empty body is required", 400);
   }
 
-  const pb = await getAdminPb();
-  const card = await pb.collection("cards").getOne<CardRecord>(cardId).catch(() => null);
-  if (!card || card.archived) return jsonError("Card not found", 404);
+  try {
+    const pb = await getAdminPb();
+    const card = await pb.collection("cards").getOne<CardRecord>(cardId).catch(() => null);
+    if (!card || card.archived) return jsonError("Card not found", 404);
 
-  const owner = await getOwnerUser();
+    const owner = await getOwnerUser();
 
-  const prefix = "🤖 Drafted by your agent:\n\n";
-  const trimmed = body.trim().slice(0, MAX_BODY_LENGTH - prefix.length);
+    const prefix = "🤖 Drafted by your agent:\n\n";
+    const trimmed = body.trim().slice(0, MAX_BODY_LENGTH - prefix.length);
 
-  const comment = await pb.collection("comments").create({
-    card: cardId,
-    author: owner.id,
-    body: `${prefix}${trimmed}`,
-  });
+    const comment = await pb.collection("comments").create({
+      card: cardId,
+      author: owner.id,
+      body: `${prefix}${trimmed}`,
+    });
 
-  return jsonOk({ id: comment.id }, 201);
+    await logActivity({
+      project: card.project,
+      card: card.id,
+      actor: owner.id,
+      action: "comment_added",
+    }).catch((error) => {
+      console.error("[agent-api] posted comment but activity failed", error);
+    });
+
+    return jsonOk({ id: comment.id }, 201);
+  } catch (error) {
+    console.error("[agent-api] create comment failed", error);
+    return jsonError("Something went wrong", 500);
+  }
 }