2 Commits

Include renames

Author	SHA1	Message	Date
DottaandPaperclip	4ac374103f	fix(connections): repair Asana MCP and add shared-app sign-in (#14756) ... ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Connections let agents use provider tools through the permission gateway. > - Asana provides an official remote MCP server, but its v2 server requires a registered MCP OAuth app. > - Setup can discover retired v1 endpoints and send a callback that differs from the displayed URL. > - This pull request repairs custom app setup and adds sign-in through Paperclip's shared app. > - Users can choose their own app without enrolling with Paperclip Cloud. > - Agents can use Asana tools after the user connects their account and sets action permissions. ## Linked Issues or Issue Description Related: #14739 supplies the personal credential repair used by resumed Asana setup. No duplicate Asana authentication PR was found. **What happened?** Asana setup failed even with a user-created app. Root discovery metadata still points at v1. MCP v2 uses the Asana OAuth issuer and requires an MCP app with a client secret. Local setup also displayed a localhost callback while an Origin header could make authorization use a numeric loopback callback. **Expected behavior** Sign in with Paperclip's app when its broker profile is available. Keep custom MCP app setup available without Cloud enrollment. Use the correct issuer, callback, client credentials, and resource throughout setup. **Steps to reproduce** 1. Open Asana in the connection catalog. 2. Supply an Asana MCP app's client ID and secret. 3. Start OAuth on a local instance opened with a numeric loopback address, or resume a draft that cached v1 metadata. 4. Observe the wrong discovery endpoint or callback mismatch. **Paperclip version or commit** Reproduced from b54b2dc35c. Rebased onto master at `0829d94af` after the single-screen setup change in #14811. **Deployment mode** Local development from source. The managed path also supports enrolled self-hosted instances. ## What Changed - Add the `asana.mcp` managed profile and the default Sign in with Asana method. - Use Asana's reviewed v2 protected-resource metadata before cached endpoints. - Require a custom MCP app's client secret and retain saved credentials during setup or reconnect. Repair only the known Asana v1 issuer/resource binding, retaining company and callback checks. - Expose a boolean for the acting user's saved client secret. The form offers secret reuse only when that user has an active grant with the required reference. - Let users select their own app from the enrollment and shared-app-unavailable screens, or from Advanced on the single-screen setup page. - Canonicalize HTTP loopback callbacks even when the request includes an Origin header. - Extend signed broker claims and provider URL validation for Asana. Require refresh credentials on managed authorization. - Document setup, distribution, and shared-app rollout requirements. - Resolve permission-profile name collisions when finishing another account. The live staging test found this after renaming the first Asana connection; OAuth succeeded but profile finalization failed. ## Verification - Final live staging proof used app commit `c6053157c4e42ac017727117b754ae77fa5c45fa` and the real Cloud broker at `767b63835170f664542afd0df99a76615e204b62`. In the embedded browser, default shared sign-in required no client credentials, returned through the central Cloud callback to the tenant, and discovered 39 actions. Get me succeeded through the gateway as the selected QA agent (2.1 seconds). The custom-app connection also returned a real result on this final build (0.9 seconds). - Retried the shared draft that failed during the first staging test. It completed after the profile-name fix, retained the selected agent, and kept the existing custom connection intact. Two database regressions reproduced the collision before the fix and passed afterward. The updated transaction rollback test also passes. - Shared reconnect returned to the same staging connection with 39 actions. Earlier staging checks verified the custom-app fallback when the shared profile was unavailable, saved-secret reuse on reconnect, and Off blocking the action test. Allowed was restored after that check. - Local live-provider checks also repaired a saved Asana v1 issuer/resource binding without reentering the secret and verified that numeric-loopback setup uses the displayed localhost callback. Expiring the local managed access-token timestamp triggered a real Asana refresh and a successful Get me call. These early local broker tests used enrollment/authentication and storage fixtures; the final staging proof used deployed Cloud identity and persistent storage. - The new production app is registered and configured, but production sign-in has not been deployed or verified. Live provider revocation was not run because the existing staging test app is shared with other connections. - After rebasing onto the single-screen setup flow, full `pnpm -r typecheck`, `pnpm build`, and `pnpm check:token-gates` pass. Focused verification passes 365 service and 36 broker-client tests. Broader checks pass all 833 shared-package tests and all 530 connector-page tests. The shared suite uses `TMPDIR=/private/tmp` to avoid macOS temporary-directory symlinks in its canonical-path tests. The UI tests verify the shared-app default and switching to a custom app with its required client secret. - Embedded-browser smoke on the current rebased build verified the shared sign-in default, Advanced → custom app (client ID and secret required), and switching back to Paperclip. Both existing Asana connections remained connected after restart. No new provider authorization was performed during this smoke. - The full local `pnpm test:run` was interrupted when the execution session restarted. Before interruption, it reported one runtime-slot restart test failure. That test passed on an isolated retry after clearing two unused PostgreSQL shared-memory segments. The full local suite did not complete; CI must pass on the current head before merge. - All 52 CI and security checks pass on `9318fd4e9b616cdc3de12f40cdb9bd32d865af4c` (CI run `36882064080`), including all eight browser shards, nine serialized-server shards, build, typecheck, and canary dry run. Two optional Storybook checks were skipped. Greptile review 4 reports 5/5 on this exact commit, with all review threads resolved. Its updated summary identifies the current SHA; this comment-triggered review did not publish a separate GitHub check run. - Provider revocation is unit-tested in the companion broker. Live provider revocation was not run because the existing test app is shared with other connections. ## Risks - The shared Paperclip Asana MCP app has been registered with its production callback and Any workspace distribution. Its secret is provisioned in the production secret store, and the runtime client ID and secret reference are configured. The production profile is enabled in the saved deployment configuration. The companion broker has merged and passed staging deployment; production sign-in still requires a production deployment and live verification. Custom setup remains available. - Asana MCP uses the provider's fixed `default` grant. Paperclip action policies limit agent tool use; they do not narrow provider consent. - The callback correction affects HTTP loopback OAuth flows. Public HTTPS callbacks retain their existing behavior. - Reviewed discovery URLs now override stale cached endpoints. Tests cover the Asana v1-to-v2 repair. - No schema migration. Connection removal retains the existing local-only revocation behavior. ## Model Used OpenAI GPT-6 through Codex, with code execution, browser testing, and GitHub tooling. The exact model variant and context window are not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-10-01 10:24:44 -05:00
3 people	467125fafb	feat(connections): one-screen connector setup with stated defaults (#14811) ... ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Agents use Connections (the Apps catalog) to act in services like Notion, GitHub, Google Workspace and Railway > - Each connector asked the user to answer setup questions before it went to the provider. Most of the questions already had the correct answer selected > - ROADMAP.md lists "simpler setup" for Apps and Connections as ongoing work. This change continues that work > - This pull request removes the questions that Paperclip can answer itself. It states the defaults in one line and moves the choices behind "Change" and onto the Permissions tab > - The benefit is that most connectors take one click in Paperclip and then the provider's own consent screen ## Linked Issues or Issue Description No public issue exists. This is the description, from the enhancement template. **What existing behavior does this improve?** The setup flow for tool connectors in the Apps catalog. **Subsystem affected** Apps and Connections: `ui/src/features/connections`, `ui/src/pages/apps`, the `packages/shared` app definitions, and the OAuth routes in `server/src/routes/tool-access.ts`. **Current behavior** Every connector opened with an Access step. The step asked who can use the connection and which agents get it, and both answers were already selected. 18 connectors also asked "How do you want to connect?" when Paperclip could rank the methods. The Google apps and Postman also asked "What should Paperclip be able to do?" before sign-in. The four gateway connectors (Zapier, Arcade, Composio, Executor) used a separate two-step wizard. Asana was pinned to a customer-owned OAuth app, so the user had to register an app in Asana's developer console. The "Set all" control on the Permissions tab changed only one action. After the user approved access, Railway's consent page showed "you can close this window" and did not return to Paperclip. **Proposed behavior** One screen per connector, with one primary button. The screen states the defaults in one sentence, for example "Connects for everyone in your organization, available to all agents". A "Change" link opens one Advanced panel. When the provider's metadata allows dynamic client registration, Paperclip registers a client itself. Connecting lands on the Permissions tab. On that tab, "Set all" changes every action in the group. **Reason and benefit** The user makes fewer decisions before the connection exists. Most choices are easier to make after the connection, on the Permissions tab, where a change has an immediate effect. **Breaking changes** None. No schema or API change. Existing connections keep their settings. ## What Changed - **No Access step.** `ConnectionSetupFlow` no longer has the Access step. The flow shows the resolved default above the primary button and on the completion screen. The access controls moved into one Advanced panel. The panel opens automatically only when a setting in it is required. - **A default method for every app.** The flow always picks the ranked default method. Alternate methods are in the Advanced panel. The Google and Postman capability choice is not asked before sign-in. The write-capable method is the default. - **Gateway connectors.** `RemoteMcpProductionSetup` (Zapier, Arcade, Composio, Executor) no longer has its own Access step. Its commit path and the main commit path use one helper, `askFirstCatalogEntryIdsFor`, for server-suggested defaults. - **Dynamic registration from live metadata.** `canRegisterOAuthClientDynamically` now allows registration when the provider advertises a registration endpoint, even if the catalog entry lists only customer-owned clients. The Asana and Linear definitions and catalog text match live probes. Asana issues clients for loopback callbacks only, so a hosted deployment still needs an Asana app. - **Connection setup states.** New `packages/shared/src/connection-setup-state.ts` sorts each method into `instant`, `authorize`, `paste` or `register`. The gallery card verb ("Connect" or "Add key") comes from this resolver and the instance's ownership availability. - **Generic MCP.** The generic path no longer asks "Does it need a key?" first. A credential challenge from the server shows the key field. - **Permissions tab.** Each action row shows its risk level. Each group has a "Set all" control. The control sends one change for the whole group. Before, each row's save started from the same render, so the saves overwrote each other. The Zapier/Arcade/Composio/Executor setup screen had the same defect. - **OAuth callback interstitial.** A cross-site browser navigation to `/api/tools/oauth/callback` gets a small same-origin "Finishing your connection…" page. That page repeats the request, and the repeat does the code exchange. Railway's consent page replaces itself after about two seconds, and the code exchange plus tool discovery takes longer than that. The interstitial uses only a meta refresh, because the OAuth code is single-use. Requests without `Sec-Fetch-Site: cross-site` take the old path. - **Linear registers through its MCP server.** Linear pins the console endpoints at `linear.app`. Pinned endpoints now replace discovery only when the method cannot register, or when the connection has an operator-entered client. So a Linear connection now finds the registration endpoint at `mcp.linear.app`. - **Own-OAuth-app recovery stays on the one-click screen.** When the method also accepts a customer-owned client, the client fields are in the Advanced panel. The panel opens after a failed sign-in. "Try again" resumes the draft with the operator's client. - **E2E specs** follow the one-screen flow. The Access-step clicks are removed, the specs open **Change** before they pick agents, and they expect GitHub's **Add key** verb. - **Default permissions do not change.** New connections still allow every action. The user can set actions to Ask first or Off on the Permissions tab. ## Verification - `cd ui && npx vitest run src/pages/apps src/features/connections --no-file-parallelism` - `cd packages/shared && npx vitest run src/app-definitions.test.ts src/connection-setup-state.test.ts` - `cd server && npx vitest run src/__tests__/tool-access-service.test.ts src/__tests__/remote-mcp-connectors.test.ts` - `pnpm check:token-gates` - New tests: - `PermissionsPanel.group.test.tsx` checks that "Set all" sends one change for the whole group. It fails on the old code. - `action-permissions.test.ts` checks the group update. - `connection-setup-state.test.ts` checks the four setup states. - A server test checks that a cross-site callback gets the interstitial and does not use the OAuth state, and that the same-origin repeat completes the connection. - Manual check on a hosted staging deployment. GitHub, Google Drive, Composio, Notion, PostHog and Railway each connected from one screen and returned to the Permissions tab. On Railway, "Set all" changed all 65 write actions, and the change remained after a reload. - Visual changes: snapshot baselines are intentionally not updated. See the `doc/design/DECISION-SHEET.md` entry "Per-change snapshot verification demoted to dormant (Jul 13 2026)". ## Risks - **Fewer confirmation clicks.** Organization-wide access is the default, and the user does not confirm it on a separate step. This was already the preselected answer. The flow shows the default before the user clicks and again after the connection. - **Google write scope.** Google apps now request the write-capable scope by default. A narrower scope needs a new sign-in. - **Dynamic registration from live metadata.** A provider can advertise registration and then reject a redirect URI. Asana rejects hosted callbacks, for example. In that case registration fails, and the customer-owned client path remains available for recovery. - **Callback interstitial.** The OAuth callback adds one same-origin step for cross-site browser navigations. Browsers without `Sec-Fetch-*` headers use the old direct path. - Chat and bot connectors (Discord, Telegram, Microsoft Teams, iMessage) do not change. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - Claude Opus 5.5 (Anthropic), model ID `claude-opus-5-5`, used through Claude Code with tool use (shell, file editing, browser automation) and extended thinking. It wrote the code, the tests and this description. A human product owner directed the work and tested it by hand. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: scotttong <squadbot000@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 23:13:47 -07:00