Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-29 21:07:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(inbox): separate automatic recovery cleanup from user participation

Browse Source 
Keep exact workspace owner verification holds stable and let sandbox agents inspect authorized issue activity.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Devin FoleyandPaperclip committed 2026-10-12 17:40:07 -07:00
1 parent 4b958ecbd8
commit 697e132ca4
13 files changed
+194 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/adapter-utils/src/sandbox-callback-bridge.test.ts
+5
View File
@@ -1501,6 +1501,7 @@ describe("sandbox callback bridge", () => {
{ method: "GET", path: "/api/goals/goal-1" },
{ method: "GET", path: "/api/issues/issue-1" },
{ method: "GET", path: "/api/issues/issue-1/heartbeat-context" },
{ method: "GET", path: "/api/issues/issue-1/activity" },
{ method: "GET", path: "/api/issues/issue-1/comments" },
{ method: "GET", path: "/api/issues/issue-1/comments/c-1" },
{ method: "POST", path: "/api/issues/issue-1/comments" },
@@ -1547,6 +1548,10 @@ describe("sandbox callback bridge", () => {
}
const denied: Array<{ method: string; path: string }> = [
{ method: "POST", path: "/api/issues/issue-1/activity" },
{ method: "GET", path: "/api/issues/issue-1/activity/extra" },
{ method: "GET", path: "/api/companies/co-1/activity" },
{ method: "GET", path: "/api/companies/co-1/audit/agent-actions" },
{ method: "GET", path: "/api/companies/co-1/agent-commentary" },
{ method: "POST", path: "/api/companies/co-1/agent-commentary/other" },
{ method: "POST", path: "/api/companies/co-1/email/inboxes" },
packages/adapter-utils/src/sandbox-callback-bridge.ts
+2
View File
@@ -162,6 +162,8 @@ export const DEFAULT_SANDBOX_CALLBACK_BRIDGE_ROUTE_ALLOWLIST: readonly SandboxCa
// Issue lifecycle: read context, checkout, update, comment, document, release
{ method: "GET", path: /^\/api\/issues\/[^/]+$/ },
{ method: "GET", path: /^\/api\/issues\/[^/]+\/heartbeat-context$/ },
// The controller still checks company membership and issue read authority.
{ method: "GET", path: /^\/api\/issues\/[^/]+\/activity$/ },
{ method: "GET", path: /^\/api\/issues\/[^/]+\/comments(?:\/[^/]+)?$/ },
{ method: "POST", path: /^\/api\/issues\/[^/]+\/comments$/ },
{ method: "GET", path: /^\/api\/issues\/[^/]+\/documents(?:\/[^/]+)?$/ },