Bind normal native plan acceptance to its durable request, delivered answer, admitted run and completion contract. Commit a passive in-progress result with a visible next-message summary, preserve semantic finish priority, and suppress recovery until task-specific continuation without changing modes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep the failed full invocation and original paid cases explicit. Link the exact fixture corrections and independently reviewed v7 source proof.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Load route modules during fixture setup so cold transforms cannot leave a timed-out request running against the next test mock state. Dismiss delayed product announcements through the normal Board UI in the attachment receipt fixture.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Retain the failed paid case and original proof gaps. Document the verified private dependency-lock overlay and bot-owned tracked lock restoration.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep raw native command digests and exact execution origins while admitting at most eight leading ASCII space or tab bytes. Verify the relation in the settlement grader and retain independent local observations before a command mismatch aborts grading.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Separate source415 and source81 controller evidence from the unchanged e822 runtime. Retain failed attempts, scope the native denial pass, document pending plan settlement and exact command correlation, and distinguish implemented Pi notices from remaining rich-field gaps.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Regenerate pnpm 9.15.4 patch metadata without changing dependency versions or peer resolution. Bind both ACPX installations to their checked-in patches, including complete terminal diagnostics and rich protocol guards.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Agent chat tests verify the state changes that follow delegated work
> - A delegated task wakes its source conversation with a completion
reporting turn
> - That turn can move the conversation out of `in_review` for a short
time
> - The test read status during that turn and failed under runner load
> - This pull request waits for the completion turn to reply and settle
before it reads status
> - The benefit is a stable test that checks the intended final state
## Linked Issues or Issue Description
**What happened?**
The end-to-end test read a conversation status immediately after a
delegated task finished. The completion reporting turn briefly changed
the status during its checkout. The test could read `in_progress`
instead of the final `in_review` state.
**Expected behavior**
The test should read the conversation status after the completion
reporting turn replies and the conversation settles.
**Steps to reproduce**
1. Run `tests/e2e/agent-chat-projects.spec.ts` on a loaded four-vCPU
runner.
2. Run the test named `shared questions resume and existing project
reuse creates no project card`.
3. Observe that the status read can race the completion reporting turn.
**Paperclip version or commit**
`master` at the commit under test.
**Deployment mode**
Local dev with the end-to-end test runner.
**Installation method**
Built from source.
**Agent adapter(s) involved**
Not adapter-specific.
**Database mode**
Not database-related.
**Additional context**
The deterministic reproduction failed 3 of 3 times before this change
and passed 3 of 3 times after this change.
## What Changed
- Wait for the completion reporting turn with the existing `idle` helper
before the status assertion.
- Add a comment that explains the race and the required settling point.
- Change only `tests/e2e/agent-chat-projects.spec.ts`.
## Verification
- Run `tests/e2e/agent-chat-projects.spec.ts` with Playwright.
- Confirm that all 16 tests pass.
- Run the deterministic reproduction before and after the change.
- Confirm that the target test passes.
- Confirm that the end-to-end shard and the full CI suite pass.
- Confirm that Greptile gives a 5/5 result with no open findings.
## Risks
Low risk. The change affects one end-to-end test. It adds one wait
through an existing helper. It does not change product code, raise a
timeout, add a fixed sleep, or skip a test.
## Model Used
OpenAI Codex, GPT-5, tool use and code execution. The model context
window and reasoning mode were not provided for this handoff.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Co-authored-by: Paperclip <noreply@paperclip.ing>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Paperclip Runner keeps provider sessions and their event streams for
agent runs
> - The OpenCode driver closed its event queue after each terminal turn
> - A second turn on the same session then lost its response and
completion events
> - This pull request keeps the queue open between turns and rejects
late events for sealed turns
> - The benefit is reliable multi-turn OpenCode sessions with visible
diagnostics for late provider events
## Linked Issues or Issue Description
**What happened?**
The OpenCode driver closed its event queue when a turn completed, was
cancelled, or failed. A second turn on the same session then lost its
response and completion events.
**Expected behavior**
The session must keep its event stream open between turns. Each turn
must deliver its response and one terminal event. The session must close
the stream only during session shutdown or an unrecoverable pump error.
**Steps to reproduce**
1. Start one OpenCode session.
2. Run one turn and wait for its terminal event.
3. Run a second turn on the same session.
4. Confirm that the second turn delivers its response and terminal
event.
**Paperclip version or commit**
`c0e1d87ddc181329471fa80a2061b2c538bb6618`
**Deployment mode**
Built from source with the Paperclip Runner package test suite.
## What Changed
- Keep the OpenCode event queue open across completed, cancelled, and
failed turns.
- Track sealed turn ids and reject later events for those turns with a
diagnostic event.
- Preserve queue shutdown on session close and unrecoverable pump
errors.
- Give each simulated fixture turn unique provider event ids.
- Add regression tests for completed, cancelled, failed, and
closed-session paths.
## Verification
- Type check: `cd packages/paperclip-runner && node
./node_modules/typescript/bin/tsc -p tsconfig.json --noEmit` passed.
- Driver tests: `cd packages/paperclip-runner && npx vitest run
src/drivers/opencode/opencode-server-driver.test.ts` passed except for
the known pre-existing flaky test described below.
- Consumer tests: `cd packages/paperclip-runner && npx vitest run
src/native-session-runtime.test.ts
src/backends/harness-driver-backend.test.ts
src/cli/opencode-app-server-proxy.test.ts
src/conformance/harness-driver.test.ts` passed.
- The known flaky test reproduced on unmodified `master` because fixture
event order depends on a local MCP HTTP round-trip.
- CI must run the full pull request suite.
## Risks
- The queue now retains sealed turn ids for the session lifetime.
OpenCode does not reuse turn ids, so this set grows with the session.
- A late provider event cannot reach a later turn. The driver emits a
diagnostic event so the rejection remains visible.
- The change does not alter session shutdown or unrecoverable pump error
handling.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. This pull request fixes an
OpenCode Runner bug and does not add a roadmap feature.
## Model Used
OpenAI Codex, GPT-5, tool use and code execution; Anthropic Claude
Sonnet 5 also assisted with the implementation. The runtime did not
provide a context window size.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - The web UI has keyboard shortcuts for the inbox, task lists, cases,
and task detail, plus global shortcuts such as `c`, `/`, `?`, `[`, and
`]`
> - Shortcut enablement was an instance-wide General setting until
#14141 moved it to a per-user preference that defaults to off
> - The move did not carry the old instance value over, so every
existing user lost shortcuts on upgrade and had to find a new toggle
under Profile settings
> - A toggle that only turns off a standard, input-safe feature costs a
setting, a database column, two API routes, and a React context for
little benefit
> - This pull request removes both the instance setting and the personal
preference and enables keyboard shortcuts for every signed-in user
> - The benefit is one less thing to configure, no silent loss of
shortcuts on upgrade, and less code to maintain
## Linked Issues or Issue Description
Refs #14141 (the change that introduced the personal preference).
**What existing behavior does this improve?**
Keyboard shortcuts in the web UI stay off unless each user turns them on
in Profile settings.
**Subsystem affected**
Web UI shortcuts, Profile settings, instance general settings, the
`/api/auth/preferences` routes, and the `user` table.
**Current behavior**
Shortcuts default to off per user. #14141 moved the toggle from Instance
settings → General to Profile settings and did not carry the old
instance value over. Users who had shortcuts on lost them after the
upgrade and had to find the new toggle.
**Proposed behavior**
Keyboard shortcuts are always enabled for every signed-in user. There is
no instance setting and no personal preference. Shortcuts already ignore
key presses inside text inputs and modal dialogs, so an opt-out is not
needed.
**Reason and benefit**
Fewer settings, no silent loss of shortcuts on upgrade, and removal of a
database column, two API routes, a query hook, and a React context that
existed only to gate this feature.
**Breaking changes**
`GET` and `PATCH /api/auth/preferences` are removed. `PATCH
/api/instance/settings/general` no longer accepts `keyboardShortcuts`;
that schema is strict, so the key now returns 400.
`instance.general.keyboardShortcuts` is no longer a valid
`PAPERCLIP_HIDDEN_SETTINGS` key; the parser ignores unknown keys with a
warning.
## What Changed
- Removed the Keyboard shortcuts section from Profile settings, the
`useUserPreferences` hook, `queryKeys.auth.preferences`, and
`authApi.getPreferences` / `authApi.updatePreferences`.
- Removed `GeneralSettingsContext`. The inbox, legacy inbox, task list,
legacy task list, cases, and task detail pages no longer gate their key
handlers.
- Removed the `enabled` option from `useKeyboardShortcuts`. The app
shell always registers the global shortcuts.
- Removed `GET` and `PATCH /api/auth/preferences`, their OpenAPI
entries, and the `currentUserPreferencesSchema` /
`updateCurrentUserPreferencesSchema` validators.
- Removed `keyboardShortcuts` from `InstanceGeneralSettings`, the
general settings zod schema, the settings service defaults, and
`HIDEABLE_GENERAL_SECTIONS`.
- Added migration `0289_drop_user_keyboard_shortcuts`, which drops
`user.keyboard_shortcuts`.
- Updated `AGENTS.md`, `doc/SPEC.md`, `doc/SPEC-implementation.md`, and
`docs/deploy/environment-variables.md`.
- Parsed the stored general settings row with
`instanceGeneralSettingsSchema.strip()` in the feedback vote path, so a
retired key left in the row cannot reset the sharing preference to
`prompt` and overwrite the stored choice.
- Kept every bare global shortcut (`c`, `?`, `[`, `]`, `/`) out of open
modal dialogs in `useKeyboardShortcuts`; only `/` had that guard before.
- Updated the affected tests and added a Profile settings test that
asserts the toggle is gone, a hook test for the modal dialog guard, and
a feedback service regression test for the retired-key case.
## Verification
- Typecheck passes for `@paperclipai/shared`, `@paperclipai/db`
(including the migration numbering and safety checks),
`@paperclipai/server`, and `ui`.
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts
server/src/__tests__/openapi-routes.test.ts
server/src/__tests__/auth-routes.test.ts
server/src/__tests__/sentry.test.ts` → 119 passed.
- `pnpm exec vitest run ui/src/components/Layout.test.tsx
ui/src/pages/ProfileSettings.test.tsx ui/src/pages/IssueDetail.test.tsx
ui/src/pages/Inbox.test.tsx ui/src/pages/Cases.test.tsx
ui/src/hooks/useKeyboardShortcuts.test.tsx ui/src/pages/Agents.test.tsx
ui/src/pages/InstanceGeneralSettings.test.tsx` → 286 passed.
- `pnpm exec vitest run packages/shared/src/settings-visibility.test.ts`
→ 16 passed.
- `pnpm exec vitest run ui/src/hooks/useKeyboardShortcuts.test.tsx` → 7
passed.
- `pnpm exec vitest run server/src/__tests__/feedback-service.test.ts`
(embedded Postgres) → the new retired-key test passes with the fix and
fails without it.
- Manual: sign in with no settings changed, open the inbox, press `j`
and `k` to move the selection, press `?` to open the cheatsheet. Open
Settings → Profile and confirm there is no Keyboard shortcuts section.
## Risks
- The migration drops a column. It uses `DROP COLUMN IF EXISTS`, and the
column has no readers after this change. If you roll back to a build
from before this PR after the migration has run, re-add the column
first: `ALTER TABLE "user" ADD COLUMN "keyboard_shortcuts" boolean
DEFAULT false NOT NULL;`. The older build's ORM selects that column when
it loads users.
- Any external client that still sends `keyboardShortcuts` to `PATCH
/api/instance/settings/general` receives a 400. No in-repo client does.
- Stored `instance_settings.general.keyboardShortcuts` values are
stripped on read and ignored.
- Users who never turned the toggle on now get shortcuts. The handlers
skip text inputs, contenteditable regions, and modal dialogs, so typing
is unaffected.
## Model Used
Claude Fable 5.1 (`claude-fable-5-1`) in Claude Code, with extended
thinking and tool use.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Keep authorized residue scrubbing and unsafe-path checks while leaving untouched workspaces unchanged when no wake attachments were selected.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Fence the credential-reclamation hook used by the global recovery sweep so it cannot leave synthetic lease owners on earlier companies. Exercise a paused foreign receipt after the fault is armed and verify it settles without a leaked lease.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip must keep ownership of work until termination is verified.
> - A Stop request waits for the adapter and its cleanup to settle.
> - After 60 seconds, an unconfirmed Stop raises an error.
> - The error currently lacks run, adapter, and runtime context.
> - This makes it difficult to investigate which stop path is stuck.
> - This change adds bounded diagnostics while preserving termination
checks.
## Linked Issues or Issue Description
**What happened?**
An adapter can remain unsettled after its Stop request. The resulting
error says termination is unverified but does not identify the adapter
or run in error monitoring. The optional Sentry setup does not capture
request context, so the endpoint alone cannot fill the gap.
**Expected behavior**
Keep the Stop unconfirmed and preserve its live execution owner. When
optional Sentry is enabled, attach enough bounded context to investigate
the affected run.
**Steps to reproduce**
1. Register an adapter execution control and abort its controller.
2. Leave its settlement promise pending.
3. Wait for the configured Stop timeout.
4. Observe that Stop still fails, but the event now includes the run
UUID, built-in adapter, native/legacy runtime, timeout duration, and
abort-requested flag.
**Paperclip version or commit**
Master commit `17780751551b3bc1c2521f7694026c34534c46c9`; reproduced
with fake timers and mocked optional error monitoring.
**Deployment mode**
Server execution control, including local and hosted runs. Reporting
remains opt-in.
Searched related Stop PRs. #14523 and #14244 address Hermes cancellation
contracts; this change only adds diagnostics to the shared
unconfirmed-stop timeout.
## What Changed
- Use a typed timeout error with the existing message, name, and timer
stack.
- Pass run/adapter/runtime identity from the cancellation owner.
- Add an event-local, allowlisted Sentry context without changing the
default fingerprint.
- Rebuild the reported exception so arbitrary provider fields cannot be
serialized.
- Test timeout ownership, delayed settlement, privacy boundaries, and
absence of context on unrelated events.
- Document the additional opt-in fields.
## Verification
- `pnpm exec vitest run
server/src/services/adapter-execution-control.test.ts
server/src/__tests__/sentry.test.ts`: 38 passed, five real-SDK checks
skipped because the optional package is not installed.
- `pnpm -r typecheck` passed; server typecheck passed again after the
SDK test addition.
- With audited optional `@sentry/node@10.71.0` installed only in local
test dependencies, `PAPERCLIP_REQUIRE_SENTRY_TEST_SDK=1 pnpm exec vitest
run server/src/__tests__/run-failure-sentry-real-sdk.test.ts
server/src/services/adapter-execution-control.test.ts
server/src/__tests__/sentry.test.ts`: all 45 tests passed. The real SDK
uses an in-memory transport; no Sentry requests are sent.
- The broad local `pnpm test:run` command did not complete in the
available verification window and was stopped; no full local-suite pass
is claimed. `pnpm build` passed. All sharded GitHub CI checks passed on
the final PR head.
- Tests use fake timers and a mocked Sentry package; no provider or
monitoring requests.
## Risks
This is diagnostic coverage, not a claim that the underlying stop delay
is fixed. Unknown adapter/runtime values become `unknown`; malformed run
identifiers become `null`. No stop reason, prompt, output, provider
response, credentials, or arbitrary error properties are sent. Timeout,
cancellation acknowledgement, live-owner retention, and retry behavior
remain unchanged. No schema changes.
## Model Used
OpenAI Codex (GPT-6), with reasoning, repository inspection, and command
execution. The session does not expose a more specific model revision or
context-window size.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have described the issue in-PR following the relevant issue
template
- [x] I have not referenced internal/instance-local Paperclip issues or
links
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run the targeted tests locally and they pass; full checks
are in progress
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip manages work performed by AI agents.
> - The Cursor CLI adapter turns process output into run results.
> - Cursor can print a trace-file notice before a real error.
> - The adapter used the first stderr line as the failure summary.
> - This could hide the error behind an informational file path.
> - This change selects the first diagnostic after that known notice and
preserves the full logs.
## Linked Issues or Issue Description
**What happened?**
When Cursor exits with a nonzero code, a leading `cursor-retrieval:
tracing to ...` notice can become the error summary. A later error
remains in stderr but is absent from the summary. If the notice is the
only output, the summary does not explain that the process exited
unsuccessfully.
**Expected behavior**
Prefer the structured error, then a stderr diagnostic, then the exit
code. Keep the run failed and preserve the original logs.
**Steps to reproduce**
1. Use a fixture Cursor executable that writes the trace-file notice to
stderr.
2. Write `Authentication failed` on the next line, then exit with code
7.
3. The old adapter reports the trace-file notice. This change reports
the authentication error.
4. Repeat with only the notice. This change reports `Cursor exited with
code 7`.
**Paperclip version or commit**
Reproduced against master commit
`17780751551b3bc1c2521f7694026c34534c46c9` with local process fixtures.
**Deployment mode**
Local CLI adapter. The diagnostic helper is also used by environment
probes.
Searched open Cursor PRs and issues. PRs #14631 and #14435 concern
native ACP support; #11106 concerns MCP configuration. None changes this
legacy CLI diagnostic selection.
## What Changed
- Skip only the exact trace-location notice when choosing a diagnostic
line.
- Remove terminal control codes from summary candidates.
- Use the same selection for execution and environment probes.
- Preserve structured-error priority, exit status, retry decisions, and
raw stdout/stderr.
- Add child-process regression tests and narrow parsing cases. Document
the behavior.
## Verification
- Two execution regression cases failed on the previous implementation;
structured-error priority already passed.
- `pnpm exec vitest run packages/adapters/cursor-local`: all 16 tests
passed across five files.
- `pnpm --filter @paperclipai/adapter-cursor-local typecheck` passed.
- `pnpm -r typecheck` passed.
- All GitHub CI checks passed on the PR head. One preview-runtime
readiness test failed on the first attempt; its full local suite passed
(28 tests, three skips) and the failed CI shard passed on retry. No
unrelated source change was needed.
- The broad local `pnpm test:run` command did not complete in the
available verification window and was stopped; no full local-suite pass
is claimed. The full sharded GitHub CI suite passed. `pnpm build`
passed.
- Tests use local fixture processes. They make no Cursor provider
requests.
## Risks
A future Cursor notice format may no longer match and will remain
visible. Retrieval error lines and unknown diagnostics remain visible.
This improves diagnosis; it does not claim to fix an unknown provider or
machine failure. There are no schema, authentication, cancellation, or
retry-policy changes.
## Model Used
OpenAI Codex (GPT-6), with reasoning, repository inspection, and command
execution. The session does not expose a more specific model revision or
context-window size.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have described the issue in-PR following the relevant issue
template
- [x] I have not referenced internal/instance-local Paperclip issues or
links
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run the targeted tests locally and they pass; full checks
are in progress
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - The board UI uses shadcn theme tokens from `ui/src/index.css`.
> - Delete and remove dialogs confirm with a red button: `bg-destructive
text-destructive-foreground`.
> - In the light theme, `--destructive-foreground` has the same value as
`--destructive`. The label is red text on a red fill, so it is not
visible.
> - Operators cannot read the button that deletes data or removes a
connection.
> - This pull request sets the light `--destructive-foreground` to the
near-white value that the dark theme already uses.
> - The benefit is that every destructive confirm button shows a
readable label in both themes.
## Linked Issues or Issue Description
Fixes#14327
I searched open and closed PRs for `destructive-foreground`, "Remove
connection" and related terms. I found no PR that changes this token.
## What Changed
- `ui/src/index.css`: in `:root`, `--destructive-foreground` changes
from `oklch(0.577 0.245 27.325)` (the same as `--destructive`) to
`oklch(0.985 0 0)`. This is the value in `.dark`.
- Added `ui/src/components/DestructiveThemeTokens.test.ts`. The test
converts both tokens from OKLCH to sRGB and computes the WCAG contrast
ratio. `:root` must reach 4.5:1 (AA for normal text). `.dark` must reach
3:1, because it keeps the brighter red chosen in the gallery review
(about 3.6:1 today).
The fix applies to all five buttons that use
`text-destructive-foreground`: remove connection (`Browse.tsx`,
`Connections.tsx`), delete folder (`FolderControls.tsx`), delete
environment (`CompanyEnvironments.tsx`) and remove chat endpoint
(`ChatEndpointDetail.tsx`). No other file uses the token.
## Verification
- `pnpm exec vitest run src/components/DestructiveThemeTokens.test.ts`
in `ui`: 2 tests pass. The light theme contrast is about 4.8:1.
- Before the fix, the test fails for `:root` (1:1, red on red). With a
light gray foreground `oklch(0.88 0 0)` it also fails (3.3:1 < 4.5:1).
- Manual check on a self-hosted instance in the light theme: Apps →
connection → **Remove connection** showed a red button with no visible
label. After the fix, the label is white and readable.
Before and after, light theme (the same classes as the confirm button:
`bg-destructive text-destructive-foreground`):
<img
src="https://gist.githubusercontent.com/gentslava/3aa0d498e2475dd44e12bed11e7d7862/raw/c793570ebd416fe04cc390df8554515b4207590d/remove-connection-before-after.png"
alt="Remove connection button before and after the fix" width="520">
## Risks
- Low risk. The change is one token in the light theme. Only the five
confirm buttons above read `--destructive-foreground`.
## Model Used
- Claude Opus 5.5 (`claude-opus-5-5`) in Claude Code, with tool use
(shell, file edits). It found the cause, wrote the fix and the test, and
wrote this description.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
@cryppadotta @devinfoley a tiny one-line theme fix: the delete buttons
in the light theme are red-on-red right now, so people can't see what
they are about to click. Would be great to get it in when you have a
minute 🙏🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - A task can keep one agent process and workspace across human review
turns.
> - Large workspaces must survive each transfer between Daytona and the
host.
> - Small fixtures do not cross the previous 32 MiB filename-output
limit.
> - Correct files alone do not prove that finalization and recovery have
settled.
> - This pull request adds an explicit three-turn test with 60,000 files
and independent host checks.
> - The test detects lost files, replaced processes, and stale
finalization retries.
## Linked Issues or Issue Description
Refs: #14253, #14314, #14315, #14402, #14420.
This test covers the workspace Git streaming fix in #14253 and the
Daytona archive validation and native finalization fixes consolidated
from #14315 and #14314 into #14402. These runtime changes are merged
into master. This PR adds regression coverage.
## What Changed
- Add one explicit-only native Codex Daytona test. Broad matrix runs do
not select it.
- Create 60,000 small untracked files through ordinary provider
execution. Independently check all host file contents and the
39,828,890-byte filename manifest after each turn. Each continuation
changes all generated file contents, so stale host copies fail.
- Check spaces, newlines, leading hyphens, Unicode, and glob characters
in filenames.
- Require committed native finalization, successful workspace receipts,
no active transfer or runless cleanup, and no scheduled recovery before
each continuation and after the final turn.
- Use a fixed external instruction bundle so the same runner PID and
process identity can continue across the three browser-driven turns.
Managed agent folders intentionally stop the process for file collection
after #14420. Set the 20-minute idle window on the environment, then
verify the admitted policy on every run. Set a 25-minute Daytona
auto-stop window for this large-file test.
- Save public workspace-operation evidence when an E2E attempt fails.
- Bound this large-file fixture to 15 minutes per turn and 50 minutes
total, reserving five minutes outside the turns for setup, host
verification, and cleanup. A measured CI continuation succeeded in 11
minutes 5 seconds, exceeding the ordinary warm fixture's 10-minute
deadline. The ordinary fixture and all file, process, finalization, and
cleanup assertions remain unchanged.
## Verification
- Final PR head: `b7eed5517426507f5d7912edb8ae49163d1783b0`.
- `pnpm test:e2e:runner:unit` — 56 files and 708 tests passed locally.
The catalog retains all 407 existing cells and adds this one
explicit-only cell.
- `pnpm test:e2e:runner:typecheck` — passed locally.
- [Final-head
CI](https://github.com/paperclipai/paperclip/actions/runs/36640920233) —
all gates passed, including repository typechecks, tests, build, browser
suites, and canary dry run. The PR has 54 successful checks and two
expected skips. Fresh Greptile reviewed all seven files at 5/5; all
review threads are resolved.
- [Live single-cell Daytona
verification](https://github.com/paperclipai/paperclip/actions/runs/36637283902)
— passed on the first attempt in 1,822,299 ms (30m 22s) on `227074b7b`,
using native Codex `gpt-5.6-sol` and the verified Daytona image. All
three turns independently verified every one of the 60,000 file
contents, 39,828,890 filename bytes, and five unusual names. All runs
committed with one stable runner PID/process fingerprint,
native/provider sessions, runner instance, and sandbox. Final
browser/download assertions, all nine matchers, explicit cleanup, and
report publication passed. Results are published through the [Product
E2E history](https://d1p6rlowie26tp.cloudfront.net/runner-e2e/) and
[eval hub](https://pages.paperclip.ing/evals/).
- The final `b7eed5517` follow-up only extends the total allowance from
45 to 50 minutes, updates its catalog assertion/version, and documents
the setup/cleanup margin. Per-turn limits and behavioral assertions are
unchanged from the successful live run; that paid run was not repeated
for this allowance-only follow-up.
- The [first integrated-head live
attempt](https://github.com/paperclipai/paperclip/actions/runs/36632127364)
is retained: turn 1 passed, then turn 2 hit the old 10-minute deadline
while finalizing. Its trace records successful completion after 11m 5s
and successful cleanup. Process diagnostics also showed the intentional
managed agent-folder stop boundary introduced in #14420. These
observations motivated the larger turn budget and fixed external
instructions.
- The broad local `pnpm test:run` began alongside the build and
encountered server setup and port-test failures. The affected setup
suites and assertions passed on focused reruns after the build, using
canonical macOS temporary paths where needed. The redundant broad local
run was stopped; full-suite success is established by final-head CI, not
by that local run.
## Risks
- The live test makes provider calls and creates a billable Daytona
sandbox. It runs only when explicitly selected and deletes its sandbox
during cleanup.
- The test creates 60,000 files and can take several minutes per
transfer. Its longer retention window applies only to this fixture.
- The test will fail on a runtime that does not include all three
required fixes.
## Model Used
OpenAI GPT-6 in Codex assisted with code, terminal tools, and test
analysis. The exact serving model suffix and context-window size were
not exposed to this task.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
Reserve 15 seconds for public teardown, share remaining time across SDK/socket/host waits, subtract setup time from observer TTL, and bound close independently without extending qualification.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve the already-applied review repairs and remote extensions. Carry the current validation rollup in this qualification follow-up so the runtime prerequisite remains below the review file limit.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Withhold native tasks until exact owned observers are armed, preserve sealed retirement proof before environment teardown, and register explicit local and Daytona warm continuity cases.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep setup reads distinguishable from unknown operations without retaining raw paths, arguments, or contents.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep the current validation rollup on the Daytona qualification branch while the prerequisite runtime PR stays below the review file limit. Runtime and tests are unchanged.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Admit the actual staged runtime layout, retain sentinel and sibling mutation coverage, distinguish observed PRP identity from the sandbox lease, and bound setup readiness inside the caller deadline.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Arm bounded filesystem and process observers before publishing native actions, retain sealed file and retirement receipts before ephemeral lease teardown, and provide an independent attached-command fixture.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Compute the selected profile mode before the literal qualification guard narrows pending providers out of the selectable union.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Native runs report their task outcome through a structured finish
result.
> - A Board comment can permit a passive wait for the next response.
> - That exception accepted reports that also admitted blocking
unfinished work.
> - The task then stayed In Progress without a runner, and recovery
treated the wait as healthy.
> - This pull request rejects that contradiction and uses the existing
bounded continuation path.
> - Real wait conditions and protection against obsolete requests remain
in force.
## Linked Issues or Issue Description
**What happened?**
An agent answered a status inquiry with `yielded` and `response_wake`.
The same result listed blocking remaining work. The server accepted an
indefinite wait without a question, approval, dependency, or pause. No
further run was queued.
**Expected behavior**
Unfinished ordinary tasks must continue or have a recorded reason to
wait. A status reply alone must not suspend the work.
**Steps to reproduce**
1. Add a Board status inquiry to an unfinished assigned task.
2. Submit a successful native result with `yielded`, `response_wake`,
and `remainingWork[].blocksCompletion: true`.
3. Leave the task without any real wait condition.
4. Observe that the old policy preserves In Progress with no
continuation and suppresses recovery.
**Paperclip version or commit**
Reproduced in the native status policy at `da887ea3e`. The branch is
based on current master.
**Deployment mode**
Authenticated server with the native Paperclip Runner.
Related work: Refs #13338 (native response waits and recovery). Refs
#12071 (separate legacy recovery and retry-state work). This change
fixes the native unfinished-response-wait exception.
## What Changed
- Reject contradictory finish reports while the provider can still
correct them.
- Route accepted unfinished response waits through the existing
one-follow-up continuation budget. Repeated incomplete results create a
visible recovery action.
- Preserve questions, approvals, dependencies, pauses, conversation
lifecycles, and superseded Board requests.
- Recheck the current Board source in the decision transaction before
queuing repair.
- Let normal recovery reconsider old committed waits that report
blocking work and still have a current source.
- Add policy and database regression tests. Document the rule.
## Verification
- `pnpm exec vitest run
server/src/services/native-runtime/status-arbiter.test.ts
server/src/__tests__/heartbeat-process-recovery.test.ts
--no-file-parallelism`: 346 tests passed, no skips.
- `pnpm -r typecheck`: passed.
- `pnpm build`: passed.
- `git diff --check origin/master...HEAD`: passed.
- Final head `8f0824d9bb4d631f2347f8afffe5fff6d574cb69`: all CI checks
green (54 passed, 2 intentionally skipped), including all general tests,
serialized server suites, runner tests, eight E2E shards, and the canary
dry run.
- Greptile: 5/5 on the final head, with no unresolved review threads.
- The broad local `pnpm test:run` encountered an unrelated timing
failure in `workspace-runtime.test.ts` (waiting for managed process-tree
listeners). That test passed on an isolated rerun. The duplicate broad
run was stopped; the complete CI suite passed on the final commit.
- The transaction-race regression reproduced an obsolete continuation
before the fix. All 12 source-change cases now pass, covering passive
waits, corrective continuations, and exhausted-repair decisions.
## Risks
- Agents that previously parked unfinished ordinary tasks must now
continue or record an actual wait condition.
- Old contradictory waits become eligible for normal recovery. Existing
ownership, budget, pause, and supersession checks still apply.
- The rule uses the structured blocking-work flag. It does not infer
omitted work from prose.
- No schema, dependency, or UI change.
## Model Used
OpenAI GPT-6 through Codex, with reasoning, repository inspection, code
editing, and test execution. The session does not expose a more specific
deployment identifier or context-window size.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
