Persist non-issue inbox dismissals

server/src/__tests__/inbox-dismissals.test.ts

@@ -0,0 +1,212 @@
+import { randomUUID } from "node:crypto";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  agents,
+  approvals,
+  companies,
+  createDb,
+  heartbeatRuns,
+  inboxDismissals,
+  invites,
+  joinRequests,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+import { inboxDismissalService } from "../services/inbox-dismissals.ts";
+import { sidebarBadgeService } from "../services/sidebar-badges.ts";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping embedded Postgres inbox dismissal tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+describeEmbeddedPostgres("inbox dismissals", () => {
+  let db!: ReturnType<typeof createDb>;
+  let dismissalsSvc!: ReturnType<typeof inboxDismissalService>;
+  let badgesSvc!: ReturnType<typeof sidebarBadgeService>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-inbox-dismissals-");
+    db = createDb(tempDb.connectionString);
+    dismissalsSvc = inboxDismissalService(db);
+    badgesSvc = sidebarBadgeService(db);
+  }, 20_000);
+
+  afterEach(async () => {
+    await db.delete(inboxDismissals);
+    await db.delete(joinRequests);
+    await db.delete(invites);
+    await db.delete(heartbeatRuns);
+    await db.delete(approvals);
+    await db.delete(agents);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await tempDb?.cleanup();
+  });
+
+  it("upserts a single dismissal record per user and inbox item key", async () => {
+    const companyId = randomUUID();
+    const userId = "board-user";
+    const firstDismissedAt = new Date("2026-03-11T01:00:00.000Z");
+    const secondDismissedAt = new Date("2026-03-11T02:00:00.000Z");
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: "PAP",
+      requireBoardApprovalForNewAgents: false,
+    });
+
+    await dismissalsSvc.dismiss(companyId, userId, "approval:approval-1", firstDismissedAt);
+    await dismissalsSvc.dismiss(companyId, userId, "approval:approval-1", secondDismissedAt);
+
+    const dismissals = await dismissalsSvc.list(companyId, userId);
+
+    expect(dismissals).toHaveLength(1);
+    expect(dismissals[0]?.itemKey).toBe("approval:approval-1");
+    expect(new Date(dismissals[0]?.dismissedAt ?? 0).toISOString()).toBe(secondDismissedAt.toISOString());
+  });
+
+  it("honors dismissal timestamps and resurfaces approvals with newer activity", async () => {
+    const companyId = randomUUID();
+    const userId = "board-user";
+    const primaryAgentId = randomUUID();
+    const secondaryAgentId = randomUUID();
+    const hiddenApprovalId = randomUUID();
+    const resurfacedApprovalId = randomUUID();
+    const inviteId = randomUUID();
+    const hiddenJoinRequestId = randomUUID();
+    const hiddenRunId = randomUUID();
+    const visibleRunId = randomUUID();
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: "PAP",
+      requireBoardApprovalForNewAgents: false,
+    });
+
+    await db.insert(agents).values([
+      {
+        id: primaryAgentId,
+        companyId,
+        name: "Primary",
+        role: "engineer",
+        status: "active",
+        adapterType: "codex_local",
+        adapterConfig: {},
+        runtimeConfig: {},
+        permissions: {},
+      },
+      {
+        id: secondaryAgentId,
+        companyId,
+        name: "Secondary",
+        role: "engineer",
+        status: "active",
+        adapterType: "codex_local",
+        adapterConfig: {},
+        runtimeConfig: {},
+        permissions: {},
+      },
+    ]);
+
+    await db.insert(approvals).values([
+      {
+        id: hiddenApprovalId,
+        companyId,
+        type: "hire_agent",
+        status: "pending",
+        payload: {},
+        updatedAt: new Date("2026-03-11T01:00:00.000Z"),
+      },
+      {
+        id: resurfacedApprovalId,
+        companyId,
+        type: "hire_agent",
+        status: "revision_requested",
+        payload: {},
+        updatedAt: new Date("2026-03-11T03:00:00.000Z"),
+      },
+    ]);
+
+    await db.insert(invites).values({
+      id: inviteId,
+      companyId,
+      inviteType: "company_join",
+      tokenHash: "hash-1",
+      allowedJoinTypes: "both",
+      expiresAt: new Date("2026-03-12T00:00:00.000Z"),
+    });
+
+    await db.insert(joinRequests).values({
+      id: hiddenJoinRequestId,
+      inviteId,
+      companyId,
+      requestType: "human",
+      status: "pending_approval",
+      requestIp: "127.0.0.1",
+      createdAt: new Date("2026-03-11T01:00:00.000Z"),
+      updatedAt: new Date("2026-03-11T01:00:00.000Z"),
+    });
+
+    await db.insert(heartbeatRuns).values([
+      {
+        id: hiddenRunId,
+        companyId,
+        agentId: primaryAgentId,
+        invocationSource: "assignment",
+        status: "failed",
+        createdAt: new Date("2026-03-11T01:00:00.000Z"),
+        updatedAt: new Date("2026-03-11T01:00:00.000Z"),
+      },
+      {
+        id: visibleRunId,
+        companyId,
+        agentId: secondaryAgentId,
+        invocationSource: "assignment",
+        status: "timed_out",
+        createdAt: new Date("2026-03-11T04:00:00.000Z"),
+        updatedAt: new Date("2026-03-11T04:00:00.000Z"),
+      },
+    ]);
+
+    await dismissalsSvc.dismiss(companyId, userId, `approval:${hiddenApprovalId}`, new Date("2026-03-11T02:00:00.000Z"));
+    await dismissalsSvc.dismiss(companyId, userId, `approval:${resurfacedApprovalId}`, new Date("2026-03-11T02:00:00.000Z"));
+    await dismissalsSvc.dismiss(companyId, userId, `join:${hiddenJoinRequestId}`, new Date("2026-03-11T02:00:00.000Z"));
+    await dismissalsSvc.dismiss(companyId, userId, `run:${hiddenRunId}`, new Date("2026-03-11T02:00:00.000Z"));
+
+    const dismissedAtByKey = new Map(
+      (await dismissalsSvc.list(companyId, userId)).map((dismissal) => [
+        dismissal.itemKey,
+        new Date(dismissal.dismissedAt).getTime(),
+      ]),
+    );
+
+    const badges = await badgesSvc.get(companyId, {
+      dismissals: dismissedAtByKey,
+      joinRequests: [{
+        id: hiddenJoinRequestId,
+        createdAt: new Date("2026-03-11T01:00:00.000Z"),
+        updatedAt: new Date("2026-03-11T01:00:00.000Z"),
+      }],
+      unreadTouchedIssues: 1,
+    });
+
+    expect(badges).toEqual({
+      inbox: 3,
+      approvals: 1,
+      failedRuns: 1,
+      joinRequests: 0,
+    });
+  });
+});

server/src/app.ts

@@ -24,6 +24,7 @@ import { costRoutes } from "./routes/costs.js";
 import { activityRoutes } from "./routes/activity.js";
 import { dashboardRoutes } from "./routes/dashboard.js";
 import { sidebarBadgeRoutes } from "./routes/sidebar-badges.js";
+import { inboxDismissalRoutes } from "./routes/inbox-dismissals.js";
 import { instanceSettingsRoutes } from "./routes/instance-settings.js";
 import { llmRoutes } from "./routes/llms.js";
 import { assetRoutes } from "./routes/assets.js";
@@ -166,6 +167,7 @@ export async function createApp(
   api.use(activityRoutes(db));
   api.use(dashboardRoutes(db));
   api.use(sidebarBadgeRoutes(db));
+  api.use(inboxDismissalRoutes(db));
   api.use(instanceSettingsRoutes(db));
   const hostServicesDisposers = new Map<string, () => void>();
   const workerManager = createPluginWorkerManager();

server/src/routes/inbox-dismissals.ts

@@ -0,0 +1,69 @@
+import { Router } from "express";
+import { z } from "zod";
+import type { Db } from "@paperclipai/db";
+import { validate } from "../middleware/validate.js";
+import { assertCompanyAccess, getActorInfo } from "./authz.js";
+import { inboxDismissalService, logActivity } from "../services/index.js";
+
+const inboxDismissalSchema = z.object({
+  itemKey: z.string().trim().min(1).regex(/^(approval|join|run):.+$/, "Unsupported inbox item key"),
+});
+
+export function inboxDismissalRoutes(db: Db) {
+  const router = Router();
+  const svc = inboxDismissalService(db);
+
+  router.get("/companies/:companyId/inbox-dismissals", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    if (req.actor.type !== "board") {
+      res.status(403).json({ error: "Board authentication required" });
+      return;
+    }
+    if (!req.actor.userId) {
+      res.status(403).json({ error: "Board user context required" });
+      return;
+    }
+    const dismissals = await svc.list(companyId, req.actor.userId);
+    res.json(dismissals);
+  });
+
+  router.post(
+    "/companies/:companyId/inbox-dismissals",
+    validate(inboxDismissalSchema),
+    async (req, res) => {
+      const companyId = req.params.companyId as string;
+      assertCompanyAccess(req, companyId);
+      if (req.actor.type !== "board") {
+        res.status(403).json({ error: "Board authentication required" });
+        return;
+      }
+      if (!req.actor.userId) {
+        res.status(403).json({ error: "Board user context required" });
+        return;
+      }
+
+      const dismissal = await svc.dismiss(companyId, req.actor.userId, req.body.itemKey, new Date());
+      const actor = getActorInfo(req);
+      await logActivity(db, {
+        companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        action: "inbox.dismissed",
+        entityType: "company",
+        entityId: companyId,
+        details: {
+          userId: req.actor.userId,
+          itemKey: dismissal.itemKey,
+          dismissedAt: dismissal.dismissedAt,
+        },
+      });
+
+      res.status(201).json(dismissal);
+    },
+  );
+
+  return router;
+}

server/src/routes/index.ts

@@ -12,6 +12,7 @@ export { costRoutes } from "./costs.js";
 export { activityRoutes } from "./activity.js";
 export { dashboardRoutes } from "./dashboard.js";
 export { sidebarBadgeRoutes } from "./sidebar-badges.js";
+export { inboxDismissalRoutes } from "./inbox-dismissals.js";
 export { llmRoutes } from "./llms.js";
 export { accessRoutes } from "./access.js";
 export { instanceSettingsRoutes } from "./instance-settings.js";

server/src/routes/sidebar-badges.ts

@@ -1,12 +1,20 @@
 import { Router } from "express";
 import type { Db } from "@paperclipai/db";
-import { and, eq, sql } from "drizzle-orm";
-import { joinRequests } from "@paperclipai/db";
+import { and, eq } from "drizzle-orm";
+import { inboxDismissals, joinRequests } from "@paperclipai/db";
 import { sidebarBadgeService } from "../services/sidebar-badges.js";
 import { accessService } from "../services/access.js";
 import { dashboardService } from "../services/dashboard.js";
 import { assertCompanyAccess } from "./authz.js";
 
+function buildDismissedAtByKey(
+  dismissals: Array<{ itemKey: string; dismissedAt: Date | string }>,
+): Map<string, number> {
+  return new Map(
+    dismissals.map((dismissal) => [dismissal.itemKey, new Date(dismissal.dismissedAt).getTime()]),
+  );
+}
+
 export function sidebarBadgeRoutes(db: Db) {
   const router = Router();
   const svc = sidebarBadgeService(db);
@@ -26,23 +34,36 @@ export function sidebarBadgeRoutes(db: Db) {
       canApproveJoins = await access.hasPermission(companyId, "agent", req.actor.agentId, "joins:approve");
     }
 
-    const joinRequestCount = canApproveJoins
+    const visibleJoinRequests = canApproveJoins
       ? await db
-        .select({ count: sql<number>`count(*)` })
+        .select({
+          id: joinRequests.id,
+          updatedAt: joinRequests.updatedAt,
+          createdAt: joinRequests.createdAt,
+        })
         .from(joinRequests)
         .where(and(eq(joinRequests.companyId, companyId), eq(joinRequests.status, "pending_approval")))
-        .then((rows) => Number(rows[0]?.count ?? 0))
-      : 0;
+      : [];
+
+    const dismissedAtByKey =
+      req.actor.type === "board" && req.actor.userId
+        ? await db
+          .select({ itemKey: inboxDismissals.itemKey, dismissedAt: inboxDismissals.dismissedAt })
+          .from(inboxDismissals)
+          .where(and(eq(inboxDismissals.companyId, companyId), eq(inboxDismissals.userId, req.actor.userId)))
+          .then(buildDismissedAtByKey)
+        : new Map<string, number>();
 
     const badges = await svc.get(companyId, {
-      joinRequests: joinRequestCount,
+      dismissals: dismissedAtByKey,
+      joinRequests: visibleJoinRequests,
     });
     const summary = await dashboard.summary(companyId);
     const hasFailedRuns = badges.failedRuns > 0;
     const alertsCount =
       (summary.agents.error > 0 && !hasFailedRuns ? 1 : 0) +
       (summary.costs.monthBudgetCents > 0 && summary.costs.monthUtilizationPercent >= 80 ? 1 : 0);
-    badges.inbox = badges.failedRuns + alertsCount + joinRequestCount + badges.approvals;
+    badges.inbox = badges.failedRuns + alertsCount + badges.joinRequests + badges.approvals;
 
     res.json(badges);
   });

server/src/services/inbox-dismissals.ts

@@ -0,0 +1,41 @@
+import { and, desc, eq } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { inboxDismissals } from "@paperclipai/db";
+
+export function inboxDismissalService(db: Db) {
+  return {
+    list: async (companyId: string, userId: string) =>
+      db
+        .select()
+        .from(inboxDismissals)
+        .where(and(eq(inboxDismissals.companyId, companyId), eq(inboxDismissals.userId, userId)))
+        .orderBy(desc(inboxDismissals.updatedAt)),
+
+    dismiss: async (
+      companyId: string,
+      userId: string,
+      itemKey: string,
+      dismissedAt: Date = new Date(),
+    ) => {
+      const now = new Date();
+      const [row] = await db
+        .insert(inboxDismissals)
+        .values({
+          companyId,
+          userId,
+          itemKey,
+          dismissedAt,
+          updatedAt: now,
+        })
+        .onConflictDoUpdate({
+          target: [inboxDismissals.companyId, inboxDismissals.userId, inboxDismissals.itemKey],
+          set: {
+            dismissedAt,
+            updatedAt: now,
+          },
+        })
+        .returning();
+      return row;
+    },
+  };
+}

server/src/services/index.ts

@@ -19,6 +19,7 @@ export { financeService } from "./finance.js";
 export { heartbeatService } from "./heartbeat.js";
 export { dashboardService } from "./dashboard.js";
 export { sidebarBadgeService } from "./sidebar-badges.js";
+export { inboxDismissalService } from "./inbox-dismissals.js";
 export { accessService } from "./access.js";
 export { boardAuthService } from "./board-auth.js";
 export { instanceSettingsService } from "./instance-settings.js";

server/src/services/sidebar-badges.ts

@@ -1,4 +1,4 @@
-import { and, desc, eq, inArray, not, sql } from "drizzle-orm";
+import { and, desc, eq, inArray, not } from "drizzle-orm";
 import type { Db } from "@paperclipai/db";
 import { agents, approvals, heartbeatRuns } from "@paperclipai/db";
 import type { SidebarBadges } from "@paperclipai/shared";
@@ -6,14 +6,34 @@ import type { SidebarBadges } from "@paperclipai/shared";
 const ACTIONABLE_APPROVAL_STATUSES = ["pending", "revision_requested"];
 const FAILED_HEARTBEAT_STATUSES = ["failed", "timed_out"];
 
+function normalizeTimestamp(value: Date | string | null | undefined): number {
+  if (!value) return 0;
+  const timestamp = new Date(value).getTime();
+  return Number.isFinite(timestamp) ? timestamp : 0;
+}
+
+function isDismissed(
+  dismissedAtByKey: ReadonlyMap<string, number>,
+  itemKey: string,
+  activityAt: Date | string | null | undefined,
+) {
+  const dismissedAt = dismissedAtByKey.get(itemKey);
+  if (dismissedAt == null) return false;
+  return dismissedAt >= normalizeTimestamp(activityAt);
+}
+
 export function sidebarBadgeService(db: Db) {
   return {
     get: async (
       companyId: string,
-      extra?: { joinRequests?: number; unreadTouchedIssues?: number },
+      extra?: {
+        dismissals?: ReadonlyMap<string, number>;
+        joinRequests?: Array<{ id: string; updatedAt: Date | string | null; createdAt: Date | string }>;
+        unreadTouchedIssues?: number;
+      },
     ): Promise<SidebarBadges> => {
       const actionableApprovals = await db
-        .select({ count: sql<number>`count(*)` })
+        .select({ id: approvals.id, updatedAt: approvals.updatedAt })
         .from(approvals)
         .where(
           and(
@@ -21,11 +41,15 @@ export function sidebarBadgeService(db: Db) {
             inArray(approvals.status, ACTIONABLE_APPROVAL_STATUSES),
           ),
         )
-        .then((rows) => Number(rows[0]?.count ?? 0));
+        .then((rows) =>
+          rows.filter((row) => !isDismissed(extra?.dismissals ?? new Map(), `approval:${row.id}`, row.updatedAt)).length
+        );
 
       const latestRunByAgent = await db
         .selectDistinctOn([heartbeatRuns.agentId], {
+          id: heartbeatRuns.id,
           runStatus: heartbeatRuns.status,
+          createdAt: heartbeatRuns.createdAt,
         })
         .from(heartbeatRuns)
         .innerJoin(agents, eq(heartbeatRuns.agentId, agents.id))
@@ -39,10 +63,17 @@ export function sidebarBadgeService(db: Db) {
         .orderBy(heartbeatRuns.agentId, desc(heartbeatRuns.createdAt));
 
       const failedRuns = latestRunByAgent.filter((row) =>
-        FAILED_HEARTBEAT_STATUSES.includes(row.runStatus),
+        FAILED_HEARTBEAT_STATUSES.includes(row.runStatus)
+        && !isDismissed(extra?.dismissals ?? new Map(), `run:${row.id}`, row.createdAt),
       ).length;
 
-      const joinRequests = extra?.joinRequests ?? 0;
+      const joinRequests = (extra?.joinRequests ?? []).filter((row) =>
+        !isDismissed(
+          extra?.dismissals ?? new Map(),
+          `join:${row.id}`,
+          row.updatedAt ?? row.createdAt,
+        )
+      ).length;
       const unreadTouchedIssues = extra?.unreadTouchedIssues ?? 0;
       return {
         inbox: actionableApprovals + failedRuns + joinRequests + unreadTouchedIssues,