2 Commits

Include renames

Author	SHA1	Message	Date
DottaandPaperclip	3910352c92	feat(runner): add experimental Cursor Cloud provider (#18068) ... ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Runner gives each provider durable execution, tool, and completion contracts. > - Cursor Cloud currently has a direct adapter outside that native contract. > - Cloud work needs exact ownership across HTTP, SSE, Stop, and recovery. > - This PR adds a qualified Cloud API driver and verified proxy to Runner. > - Product setup and hosted placement remain separate dependent changes. ## Linked Issues or Issue Description Refs #5664, #11803, #17299, and #17471. Product integration is #18069. Managed-only API placement is #18310. The related direct-adapter model/transcript work is not replaced. No duplicate native Cursor Cloud integration was found. ## What Changed - Add native `cursor_cloud` / `cursor_cloud_api` with explicit model/repository validation, bounded HTTP/SSE, durable per-turn checkpoints and a qualified Node proxy launched through the Rust facade. - Commit terminal custody before publication/release; coalesce consumers, preserve ambiguous create/Stop/recovery fences, reject late tools, and distinguish definitely-unsent oversized requests from ambiguous responses. - Support scoped cold attachment, current authority, reconnect and verified artifact staging. Keep unsupported warm/external and Windows paths closed. - Preserve early source cursors and verify immutable legacy prefixes before suffix replay, including supported compaction/masking. Optional proof publication failure falls back to complete cold verification. - Preserve canonical records at the durable native producer with JSON-safe privacy and the existing 8MiB bound; drain admitted successor flushes. Reconcile upstream semantic/pack/schema/lifecycle changes and retain S3 and legacy CLI checks. ## Verification Core head `37c442ec8dd4`: all 66 check contexts are terminal successful/neutral/skipped, including required `ci / verify` and `ci / e2e`; fresh exact-head Greptile is 5/5 with zero unresolved threads. Dependent Product `81e828d20a77` and Top `dd2959689627` include the later client handoff correction and are running their own fresh gates. Core: 47/47 Rust, 4/4 compiled-native retirement, 19/19 settlement and normal Runner build passed. Runtime Top `9af1a5de42a2`: build and recursive typecheck passed. Earlier source-scoped evidence includes 398 focused tests, five relay tests and token/type gates. The 251-assertion, 7/8-suite run failed physical PostgreSQL teardown; the unchanged stable WSP suite passed 128 through the documented wrapper. The downstream fixture corrections passed 7/7 browser and 121/121 startup tests without timeout/oracle relaxation; a broken-unsubscribe control fails. Hosted runtime `9af1a5de42a2` has a passing normal build and recursive typecheck. Latest dependent heads additionally contain a pure client fix for stale live/history overlap, with 48 focused tests, UI typecheck and token gates passing. Its new client is not deployed in the frozen hosted image; server/native/API/provider source is unchanged by these four downstream files. Fresh hosted Linux admission on `9af1a5de42a2` retired its owned runner/proxy/socket with zero prompts. The saved configuration survived reopening, and Test authenticated the bound key/catalog/selected model without a prompt. Artifact with `claude-sonnet-4-5` completed, downloaded the exact 27 bytes, matched 121 canonical identities against complete logs and independently reached FINISHED. The active Stop retry was clicked within its immutable boundary, produced one canonical interrupted turn and acknowledged run-only cancellation, retained a valid 35.076s quiet window (maximum gap 4.584s), and independently remained CANCELLED/artifact-absent beyond the original 180-second command deadline. All provider-observer credential callbacks, DB clients and loaders closed; accounting is settled and explicitly unpriced. The first fresh Stop retains its failed 10.373s sampling gap and every sample. On the upgraded9af server, the historical F226 artifact was reopened and downloaded with its exact original hash after its provider agent had been deleted/GET404 earlier today. Historical F226 full Artifact/Stop cleanup, Question, corrected Plan and reconnect retain their original identities. Deleting the three newly created disposable provider agents and the new-case post-delete grade remain blocked on explicit user approval after automatic review rejected expanding the two original approved IDs. No new-case cleanup or complete fresh matrix pass is claimed; this is separate from the directly observed task/Stop behavior and retained exact cleanup proof. Retained failures: stale fixture 132/133; E8 48/135 with 87 reset-hook failures; Mac 17 SQL failures/skips; earlier startup-title, title-save, custody/Stop and deletion failures with unknown causes and bounded recoveries. `dea023` Artifact passed 17 checks but Stop failed its false warning and 50 duplicate log identities. Pre-repair ACK failure and original Core CI failure remain recorded; retry alone establishes no cause or full local-suite pass. Provider dollar cost stays UNKNOWN. ## Risks Experimental: Cursor independently acknowledges neither the effective model nor instruction digest before the first prompt. The caller’s explicit values are submitted and behavior checked live. Unpriced provider dollar cost stays UNKNOWN. Only qualified per-turn controllers are admitted. Uncertain work and incomplete cleanup stay fenced. Existing damaged/duplicate archives remain failed evidence. Prefix proof adds bounded object-store I/O; the 8MiB producer bound does not guarantee future providers’ output fits. ## Model Used OpenAI Codex, GPT-6 family, assisted with reasoning, repository tools, code execution, browser verification, and delegated code review. The serving model’s exact API ID and context window are not exposed. No value is inferred from the model catalog. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used and the limits of available model metadata - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have linked public issues or described the issue in this PR - [x] I have not referenced internal or instance-local Paperclip issues or links - [x] My branch describes the change and contains no internal ticket ID - [x] I have run the scoped local tests reported above; pending gates are stated separately - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation - [x] I have considered and documented the risks - [x] All required CI gates pass on the current head - [x] Fresh Greptile is 5/5 with no unresolved findings on the current head - [x] I will address all reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-11-03 08:38:57 -06:00
Devin FoleyandClaude Opus 5.5	16816d45e6	fix(runner): keep OpenCode thread/read within runnerd's frame limit (#18218) ... ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Paperclip Runner runs OpenCode agents through runnerd and the OpenCode app-server proxy (`packages/paperclip-runner/src/cli/opencode-app-server-proxy.ts`). > - When runnerd restores an OpenCode session, it sends `thread/resume` and then `thread/read`. It uses `thread/read` only to find an active provider turn. > - The proxy answered `thread/read` with the full retained OpenCode message history (`GET /session/{id}/message`) in one JSON-RPC line. > - runnerd rejects a provider stdout line that is larger than 4 MiB (`CODEX_APP_SERVER_MAX_FRAME_BYTES`). A long OpenCode session therefore can never resume. Each restore fails with `harness stdout frame exceeded 4194304 bytes`, and the run stops with `provider_frame_too_large`. > - This pull request makes the proxy return turn metadata only, the same as the Codex metadata-only read. > - The benefit is that long OpenCode sessions resume again, and resume no longer reads the full message history. ## Linked Issues or Issue Description **What happened?** A Paperclip Runner OpenCode task on staging tried to resume its session in a new sandbox. The restored OpenCode state was approximately 41.5 MB. The `run.attach` command failed with `failed to resume OpenCode provider: failed to start opencode provider: harness stdout frame exceeded 4194304 bytes`. The server recorded `native_session_recovery_failed` with error code `provider_frame_too_large`, and it stopped automatic replay. Each new attempt has the same failure, because the message history only grows. **Steps to reproduce** 1. Run an OpenCode task until its session holds more than 4 MiB of message parts. 2. Let the run continue in a new runner process, so that runnerd must send `thread/resume` and then `thread/read`. 3. The proxy writes the full message history in the `thread/read` response. runnerd rejects the frame and the resume fails. **Expected behavior** The resume succeeds. The size of the session history does not change the size of the `thread/read` response. **Root cause** `thread/read` in the OpenCode proxy added `transcript: await session.read?.()`. No consumer reads this field. The Rust provider reads only `thread.turns` (`latest_active_turn_id`). The Codex path already avoids message hydration for the same check ("Never hydrate message contents just to decide whether this thread has an active turn"). ## What Changed - `opencode-app-server-proxy.ts`: `thread/read` now returns `thread.id`, `thread.cwd` and `thread.turns` only. It does not call `session.read()`. - `test/fixtures/fake-opencode-server.mjs`: the fake OpenCode server can now return a large retained message history. The test enables this with a `fake-message-history-bytes` file in `XDG_DATA_HOME`. This follows the existing file-switch pattern of the fixture. Without the file, the response is `[]`, as before. - `src/cli/opencode-proxy-thread-read.test.ts`: a new regression test. It builds the real bundled proxy entrypoint, starts a session, stops the proxy, gives the persisted session a 5 MiB history, then starts a new proxy and sends `thread/resume` and `thread/read` (the runnerd restore sequence). It asserts that all stdout frames stay below 4 MiB and that `thread/read` still reports the thread id and turns. ## Verification - Red before the fix: `npx vitest run src/cli/opencode-proxy-thread-read.test.ts` failed with `expected 5243183 to be less than 4194304`. The 5,243,183-byte frame was the `thread/read` response. - Green after the fix: the same command passes. - `npx vitest run src/cli/opencode-app-server-proxy.test.ts src/cli/opencode-proxy-thread-read.test.ts`: 6 passed. - `npx vitest run src/cli/opencode-proxy src/backends/native-instruction-measurement.test.ts src/drivers/opencode`: 158 passed, 1 failed. The failure (`opencode-server-driver.test.ts` > "uses provider structure rather than prose length to select a post-tool answer") also fails on the unchanged base commit in this environment. This change does not touch that path. - `tsc -p tsconfig.json --noEmit` for `packages/paperclip-runner`: passed. - Safety checks: - Consumers: only the runnerd Rust provider (`read_thread`) calls `thread/read` on this proxy. It reads `thread.turns`. No TypeScript or Rust code reads `transcript`. - Active-turn detection does not change. The `turns` logic is the same code. - Resume now does less work: one `GET /session/{id}/message` request less. - Not run locally: the Rust tests and a full runnerd plus real OpenCode resume. This environment has no Rust toolchain. The Rust code does not change. CI runs the Rust suites. ## Risks - Low risk. The change removes one unused response field. - If an external tool read `transcript` from the proxy's `thread/read`, it does not get it now. I found no such consumer in this repository. - Tasks that already failed with `provider_frame_too_large` continue only after this proxy reaches the runner provider pack and the task runs again. ## Model Used - Provider: Anthropic. Model: Claude Opus 5.5 (`claude-opus-5-5`). Used through Claude Code with tool use (shell, file edit, GitHub connector) and standard reasoning. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above (related: #16401 kept OpenCode turns alive through oversized SSE events. It does not change `thread/read`.) - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes (none required: no documented contract includes `transcript`) - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [ ] I will address all Greptile and reviewer comments before requesting merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 15:13:29 -07:00