fix(scout): prevent duplicate bounty drafts and add scout traffic alerts

apps/web/src/app/api/scout/draft/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { ScoutDraftRequestSchema, ScoutDraftResponseSchema, TaskStatus } from "@agent-bounty/contracts";
 import { prisma } from "@/lib/prisma";
 import Stripe from "stripe";
+import { sendTrafficAlert } from "@/lib/traffic-alert";
 
 const stripe = process.env.STRIPE_SECRET_KEY ? new Stripe(process.env.STRIPE_SECRET_KEY, {
   apiVersion: "2026-05-27.dahlia",
@@ -69,6 +70,23 @@ export async function POST(request: NextRequest) {
       };
 
       ScoutDraftResponseSchema.parse(responseData);
+      void sendTrafficAlert({
+        level: "info",
+        action: "SCOUT_DRAFT_CREATED_OPEN",
+        surface: "scout/draft",
+        actorType: "SYSTEM",
+        actorId: "scout-service",
+        taskId: task.id,
+        message: `Scout 發布免扣費 OPEN 任務：${parsed.title}`,
+        metadata: {
+          reward_amount: parsed.reward_amount,
+          reward_currency: parsed.reward_currency,
+          scout_id: parsed.scout_id,
+          source: "beta_zero_friction",
+          auto_open: true,
+        },
+      });
+
       return NextResponse.json(responseData);
     }
 
@@ -114,6 +132,21 @@ export async function POST(request: NextRequest) {
     };
 
     ScoutDraftResponseSchema.parse(responseData); // strict output validation
+    void sendTrafficAlert({
+      level: "info",
+      action: "SCOUT_DRAFT_CREATED_PAYMENT_PENDING",
+      surface: "scout/draft",
+      actorType: "SYSTEM",
+      actorId: "scout-service",
+      taskId: task.id,
+      message: `Scout 建立付費草稿任務：${parsed.title}`,
+      metadata: {
+        reward_amount: parsed.reward_amount,
+        reward_currency: parsed.reward_currency,
+        scout_id: parsed.scout_id,
+        auto_open: false,
+      },
+    });
 
     return NextResponse.json(responseData);
 

apps/web/src/app/api/scout/issue-exists/route.ts

@@ -0,0 +1,67 @@
+import { NextRequest, NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+
+export const dynamic = "force-dynamic";
+
+const validateApiKey = (request: NextRequest) => {
+  const authHeader = request.headers.get("Authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return NextResponse.json({ error: "Unauthorized: Missing Bearer token" }, { status: 401 });
+  }
+
+  const token = authHeader.split(" ")[1];
+  if (process.env.API_KEY && token !== process.env.API_KEY) {
+    return NextResponse.json({ error: "Forbidden: Invalid API Key" }, { status: 403 });
+  }
+
+  return null;
+};
+
+export async function GET(request: NextRequest) {
+  const authError = validateApiKey(request);
+  if (authError) {
+    return authError;
+  }
+
+  const issueUrl = new URL(request.url).searchParams.get("issue_url");
+  if (!issueUrl) {
+    return NextResponse.json({ error: "Missing issue_url" }, { status: 400 });
+  }
+
+  try {
+    const latestTask = await prisma.task.findFirst({
+      where: {
+        description: { contains: issueUrl },
+      },
+      select: {
+        id: true,
+        status: true,
+        created_at: true,
+      },
+      orderBy: {
+        created_at: "desc",
+      },
+    });
+
+    if (!latestTask) {
+      return NextResponse.json({
+        issue_url: issueUrl,
+        exists: false,
+      });
+    }
+
+    return NextResponse.json({
+      issue_url: issueUrl,
+      exists: true,
+      task_id: latestTask.id,
+      status: latestTask.status,
+      created_at: latestTask.created_at.toISOString(),
+    });
+  } catch (error) {
+    console.error("[Issue Exists API Error]", error);
+    return NextResponse.json(
+      { error: "InternalError", message: error instanceof Error ? error.message : String(error) },
+      { status: 500 }
+    );
+  }
+}