fix(agent): declare granted write actions in draft access summary

[github-actions]

Opened automatically when rg/cmp-70-draft-access-writes was pushed.

The title is written from the diff and rewritten as you push, because this is squashed onto main and the title becomes the commit subject and the changelog line. Retitle it yourself and it is yours — the automation stops touching it.

---

Summary by cubic

Update draft access summaries to include granted write actions from crm.activity.create (notes, tasks) so users see accurate permissions.

• Bug Fixes
  • Add "Write notes on CRM records" and "Create tasks on CRM records" based on granted activity types.
  • Only list granted types; keep read-only drafts read-only; no duplicates; fixed order (NOTE, TASK).
  • Add tests to cover mixed activity types, deduping, and read-only behavior.

^{Written for commit 115e468. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
crm-agent	Ready	Preview	Aug 8, 2026 8:03am
crm-api	Ready	Preview	Aug 8, 2026 8:03am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
crm-app	Skipped		Aug 8, 2026 8:03am

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/agent/agent/subagents/agent_builder/lib/draft-input.ts">

<violation number="1" location="apps/agent/agent/subagents/agent_builder/lib/draft-input.ts:48">
P3: The new write-access map duplicates the activity-type enum already defined in the builderDraftToolInput zod schema (`z.enum(["NOTE", "TASK"])`). There's no linkage between the two, so if a new activity type is later allowed in the schema, it would silently disappear from the draft access declaration: it wouldn't be in ACTIVITY_ORDER or ACTIVITY_ACCESS, and no type error would surface because both are standalone `as const` constants. Consider deriving the access map keys/order from a single shared constant (e.g. exporting the activity-type enum from the schema and keying ACTIVITY_ACCESS off it as a `Record<ActivityType, string>`), so adding a type to the schema forces awareness of the corresponding access label.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P3: The new write-access map duplicates the activity-type enum already defined in the builderDraftToolInput zod schema (z.enum(["NOTE", "TASK"])). There's no linkage between the two, so if a new activity type is later allowed in the schema, it would silently disappear from the draft access declaration: it wouldn't be in ACTIVITY_ORDER or ACTIVITY_ACCESS, and no type error would surface because both are standalone as const constants. Consider deriving the access map keys/order from a single shared constant (e.g. exporting the activity-type enum from the schema and keying ACTIVITY_ACCESS off it as a Record<ActivityType, string>), so adding a type to the schema forces awareness of the corresponding access label.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/agent/agent/subagents/agent_builder/lib/draft-input.ts, line 48:

<comment>The new write-access map duplicates the activity-type enum already defined in the builderDraftToolInput zod schema (`z.enum(["NOTE", "TASK"])`). There's no linkage between the two, so if a new activity type is later allowed in the schema, it would silently disappear from the draft access declaration: it wouldn't be in ACTIVITY_ORDER or ACTIVITY_ACCESS, and no type error would surface because both are standalone `as const` constants. Consider deriving the access map keys/order from a single shared constant (e.g. exporting the activity-type enum from the schema and keying ACTIVITY_ACCESS off it as a `Record<ActivityType, string>`), so adding a type to the schema forces awareness of the corresponding access label.</comment>

<file context>
@@ -45,6 +45,13 @@ export const builderDraftToolInput = z.object({
 
 type BuilderDraftToolInput = z.infer<typeof builderDraftToolInput>;
 
+const ACTIVITY_ACCESS = {
+	NOTE: "Write notes on CRM records",
+	TASK: "Create tasks on CRM records",
</file context>