Let bots manage their hooks, with the user confirming what widens them

Bots get list_hooks, pause_hook and delete_hook, which act directly since
they only take away. A new hook, or a new name, brief or filter, or
switching a paused one back on, goes through propose_hook: it stores a
hook_proposals row and puts a [hook-proposal:ID] card in the reply, which
the user it was proposed to confirms or rejects. The card is read from
what Confirm saves, with the bot's reason labelled as its own; confirming
checks everything again and saves through the Hooks modal's helpers. A
new hook's URL is shown on the card once, to the user only, never in the
outcome the bot is told. What calls a hook, its computers and its signing
are never proposed. Only chat replies propose, and a hook call's own run
gets no hook tools, so a caller's payload can't reach them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/hook-proposals/claim-hook-proposal.ts

@@ -0,0 +1,28 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import AppError from "@/src/utils/app-error";
+import type { HookProposalRecord } from "./parse-hook-proposal-row";
+
+type Params = {
+    proposal: HookProposalRecord;
+    status: "confirmed" | "rejected";
+};
+
+/**
+ * Decides a hook proposal exactly once: only a pending one moves, and
+ * only one that hasn't expired can be confirmed, so two tabs or a double
+ * click never make two hooks. Throws why when it can't.
+ */
+export default async function claimHookProposal({ proposal, status }: Params) {
+    const now = Date.now();
+    const claimed = await BunSQLite.sql<{ id: number }>({
+        sql: `UPDATE hook_proposals SET status = ?, decided_at = ?, updated_at = ?
+            WHERE id = ? AND status = 'pending' ${status == "confirmed" ? "AND expires_at > ?" : ""} RETURNING id`,
+        values: [status, now, now, proposal.id, ...(status == "confirmed" ? [now] : [])],
+    });
+
+    if (claimed.payload?.[0]) return;
+
+    if (proposal.status != "pending") throw new AppError(`This proposal was already ${proposal.status}.`);
+
+    throw new AppError(`This proposal expired. Ask the bot to propose it again.`);
+}