mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-01 15:35:12 +01:00
<!-- Write all pull request text in Simplified Technical English (ASD-STE100): short sentences, one instruction per sentence, simple approved vocabulary, and the active voice. --> ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Execution workspaces isolate an agent task from the primary checkout. > - Pull request preparation can need a branch that already contains completed work. > - The workspace policy could not require an exact existing branch. > - Workspace cleanup also treated worktree creation as branch ownership. > - This pull request adds an exact existing-branch policy and separate branch ownership metadata. > - The benefit is safe pull request preparation that preserves every existing commit and operator-owned branch. ## Linked Issues or Issue Description **What happened?** A pull request preparation run could not pin its execution workspace to an exact existing branch. Workspace reuse and cleanup could also confuse worktree creation with branch ownership. **Expected behavior** The run must attach only to the requested branch in an isolated Git worktree. It must fail if the branch is missing, busy, or inconsistent. Cleanup must not delete a branch that Paperclip does not own. **Steps to reproduce** 1. Create a branch that contains completed work. 2. Configure a pull request preparation task to use that branch. 3. Start the task and observe that the prior policy cannot require the exact branch. **Paperclip version or commit** This behavior reproduces on the base revision before this pull request. **Deployment mode** Local development with isolated Git worktrees. ## What Changed - Add `existingBranch` to the execution workspace policy and shared validation contracts. - Require `existingBranch` to use an isolated Git worktree and reject conflicting branch templates. - Attach to the exact branch without creating, renaming, resetting, or deleting it. - Track branch ownership separately from worktree creation and use that ownership during cleanup. - Return HTTP 422 for invalid existing-branch settings on every issue-producing route. - Add a bounded repair script for existing pull request preparation tasks. - Add focused policy, route, heartbeat, runtime, and ready-comment tests. - Document the exact-branch behavior and safety rules. ## Verification - `pnpm exec vitest run server/src/__tests__/execution-workspace-policy.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts server/src/__tests__/issue-existing-branch-validation-status.test.ts server/src/__tests__/workspace-runtime.test.ts server/src/services/workspace-runtime-exposure.test.ts server/src/services/workspace-runtime-ready-comment.test.ts` passed 335 tests. - `pnpm -r typecheck` passed for all workspace projects. - `pnpm test:run` passed 4,431 tests. Two unrelated embedded-Postgres setup hooks timed out under aggregate load. Their isolated rerun passed 74 tests. - `pnpm build` passed for all workspace projects. - The two review regressions passed with 139 unrelated tests skipped. - All latest-head CI gates passed after one unrelated timing-sensitive test passed on rerun. - Greptile scored the latest head 5/5 with no unresolved review threads. ## Risks - Invalid workspace settings now return HTTP 422 instead of a generic validation response. - The exact branch must already exist and must not be checked out by another worktree. - The new policy fails closed when it cannot prove branch identity or ownership. - This change has no database migration. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex from the GPT-5 family assisted with this change. The runtime did not expose its exact deployment ID or context window. The agent used high-reasoning mode, repository tools, shell execution, and code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
213 lines
8.2 KiB
TypeScript
213 lines
8.2 KiB
TypeScript
import express from "express";
|
|
import { readFileSync } from "node:fs";
|
|
import request from "supertest";
|
|
import { describe, expect, it, vi } from "vitest";
|
|
import {
|
|
createAcceptedPlanDecompositionSchema,
|
|
createIssueSchema,
|
|
runRoutineSchema,
|
|
updateIssueSchema,
|
|
} from "@paperclipai/shared";
|
|
import { z } from "zod";
|
|
import { errorHandler } from "../middleware/error-handler.js";
|
|
import { validateIssueMutationBody } from "../middleware/validate.js";
|
|
|
|
const EXISTING_BRANCH_PATH = ["executionWorkspaceSettings", "workspaceStrategy", "existingBranch"];
|
|
|
|
// Mirrors the route-level schema in routes/issues.ts.
|
|
const updateIssueRouteSchema = updateIssueSchema.extend({
|
|
interrupt: z.boolean().optional(),
|
|
});
|
|
|
|
function buildApp(schema: Parameters<typeof validateIssueMutationBody>[0]) {
|
|
const handler = vi.fn((_req: express.Request, res: express.Response) => {
|
|
res.status(200).json({ ok: true });
|
|
});
|
|
const app = express();
|
|
app.use(express.json());
|
|
app.post("/target", validateIssueMutationBody(schema), handler);
|
|
app.use(errorHandler);
|
|
return { app, handler };
|
|
}
|
|
|
|
function settingsBody(settings: Record<string, unknown>) {
|
|
return { executionWorkspaceSettings: settings };
|
|
}
|
|
|
|
describe("existingBranch issue create/update validation status", () => {
|
|
it("returns 422 with field details for invalid branch syntax on update", async () => {
|
|
const { app, handler } = buildApp(updateIssueRouteSchema);
|
|
const res = await request(app).post("/target").send(settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
|
|
}));
|
|
expect(res.status).toBe(422);
|
|
expect(res.body.error).toBe("Validation error");
|
|
expect(res.body.details).toHaveLength(1);
|
|
expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
|
|
expect(res.body.details[0].message).toBe("existingBranch must be a valid git branch name");
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns 422 for placement outside isolated_workspace + git_worktree on update", async () => {
|
|
const { app, handler } = buildApp(updateIssueRouteSchema);
|
|
const res = await request(app).post("/target").send(settingsBody({
|
|
mode: "shared_workspace",
|
|
workspaceStrategy: { type: "project_primary", existingBranch: "feature/pinned" },
|
|
}));
|
|
expect(res.status).toBe(422);
|
|
const messages = res.body.details.map((detail: { message: string }) => detail.message).sort();
|
|
expect(messages).toEqual([
|
|
'existingBranch requires mode "isolated_workspace"',
|
|
'existingBranch requires workspaceStrategy.type "git_worktree"',
|
|
]);
|
|
for (const detail of res.body.details) {
|
|
expect(detail.path).toEqual(EXISTING_BRANCH_PATH);
|
|
}
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns 422 when existingBranch is combined with branchTemplate on update", async () => {
|
|
const { app, handler } = buildApp(updateIssueRouteSchema);
|
|
const res = await request(app).post("/target").send(settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: {
|
|
type: "git_worktree",
|
|
existingBranch: "feature/pinned",
|
|
branchTemplate: "agent/{issue}",
|
|
},
|
|
}));
|
|
expect(res.status).toBe(422);
|
|
expect(res.body.details).toHaveLength(1);
|
|
expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
|
|
expect(res.body.details[0].message).toBe("existingBranch and branchTemplate are mutually exclusive");
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns 422 for the same semantic failures on create", async () => {
|
|
const { app, handler } = buildApp(createIssueSchema);
|
|
const res = await request(app).post("/target").send({
|
|
title: "Pinned worktree issue",
|
|
status: "todo",
|
|
...settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: { type: "git_worktree", existingBranch: "-bad-leading-dash" },
|
|
}),
|
|
});
|
|
expect(res.status).toBe(422);
|
|
expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns 422 for an invalid branch on a routine-created issue", async () => {
|
|
const { app, handler } = buildApp(runRoutineSchema);
|
|
const res = await request(app).post("/target").send(settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
|
|
}));
|
|
expect(res.status).toBe(422);
|
|
expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns 422 for an invalid branch nested in an accepted plan child", async () => {
|
|
const { app, handler } = buildApp(createAcceptedPlanDecompositionSchema);
|
|
const res = await request(app).post("/target").send({
|
|
acceptedPlanRevisionId: "11111111-1111-4111-8111-111111111111",
|
|
children: [{
|
|
title: "Pinned child",
|
|
status: "todo",
|
|
...settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
|
|
}),
|
|
}],
|
|
});
|
|
expect(res.status).toBe(422);
|
|
expect(res.body.details[0].path).toEqual(["children", 0, ...EXISTING_BRANCH_PATH]);
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("keeps 400 for validation failures unrelated to existingBranch", async () => {
|
|
const { app, handler } = buildApp(createIssueSchema);
|
|
const res = await request(app).post("/target").send({ title: 42, status: "todo" });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toBe("Validation error");
|
|
expect(res.body.details.length).toBeGreaterThan(0);
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("keeps 400 when existingBranch and unrelated failures are mixed", async () => {
|
|
const { app, handler } = buildApp(createIssueSchema);
|
|
const res = await request(app).post("/target").send({
|
|
title: 42,
|
|
status: "todo",
|
|
...settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
|
|
}),
|
|
});
|
|
expect(res.status).toBe(400);
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("keeps 400 when a nested existingBranch failure is mixed with an unrelated child failure", async () => {
|
|
const { app, handler } = buildApp(createAcceptedPlanDecompositionSchema);
|
|
const res = await request(app).post("/target").send({
|
|
acceptedPlanRevisionId: "11111111-1111-4111-8111-111111111111",
|
|
children: [{
|
|
title: 42,
|
|
status: "todo",
|
|
...settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
|
|
}),
|
|
}],
|
|
});
|
|
expect(res.status).toBe(400);
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("passes a valid pinned existingBranch through to the handler", async () => {
|
|
const { app, handler } = buildApp(updateIssueRouteSchema);
|
|
const res = await request(app).post("/target").send(settingsBody({
|
|
mode: "isolated_workspace",
|
|
workspaceStrategy: { type: "git_worktree", existingBranch: "feature/pinned" },
|
|
}));
|
|
expect(res.status).toBe(200);
|
|
expect(handler).toHaveBeenCalledTimes(1);
|
|
});
|
|
});
|
|
|
|
describe("existingBranch issue mutation route registrations", () => {
|
|
const routes = [
|
|
{
|
|
source: readFileSync(new URL("../routes/issues.ts", import.meta.url), "utf8"),
|
|
schemas: [
|
|
"createIssueSchema",
|
|
"createChildIssueSchema",
|
|
"createAcceptedPlanDecompositionSchema",
|
|
"updateIssueRouteSchema",
|
|
],
|
|
},
|
|
{
|
|
source: readFileSync(new URL("../routes/routines.ts", import.meta.url), "utf8"),
|
|
schemas: ["runRoutineSchema"],
|
|
},
|
|
];
|
|
|
|
it("uses the semantic issue validator for every issue route schema with workspace settings", () => {
|
|
for (const { source, schemas } of routes) {
|
|
for (const schema of schemas) {
|
|
const validators = Array.from(
|
|
source.matchAll(new RegExp(`\\b(validate(?:IssueMutationBody)?)\\(${schema}\\)`, "g")),
|
|
(match) => match[1],
|
|
);
|
|
expect(validators, `${schema} must use validateIssueMutationBody at every route registration`).toEqual([
|
|
"validateIssueMutationBody",
|
|
]);
|
|
}
|
|
}
|
|
});
|
|
});
|