mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-06 14:02:36 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Paperclip provides CLI commands and guidance for operators and agents > - The `pnpm paperclipai` script can pass argument values through a shell > - Shell re-parsing can execute command substitutions inside quoted values > - This pull request routes guidance through inert-argv `npx paperclipai` commands and adds regression coverage > - The benefit is safer operator guidance across documentation and runtime hints ## Linked Issues or Issue Description This pull request fixes a command-injection-class defect in Paperclip CLI guidance. **What happened?** The `pnpm paperclipai <sub> --flag "$VALUE"` form can re-parse argument values through a shell. A command substitution inside a quoted value can execute on the host. **Expected behavior** Paperclip guidance must pass CLI values as inert argument values. Host-derived values must not appear in copyable commands. **Steps to reproduce** 1. Run a Paperclip guidance command that uses the `pnpm paperclipai` script. 2. Provide a quoted value that contains a command substitution. 3. Observe that the shell can evaluate the substitution before the CLI starts. 4. Compare the result with the `npx paperclipai` form. **Paperclip version or commit** `5670984b75d109950c968542a0111ebb6967f4da` **Deployment mode** All deployment modes that show or use the affected CLI guidance. **Installation method** Built from source and installed CLI guidance. **Agent adapter(s) involved** Not adapter-specific (core bug). **Database mode** Not database-related. **Access context** Both. **Additional context** The earlier merged PR [#11343](https://github.com/paperclipai/paperclip/pull/11343) used the unsafe `pnpm exec paperclipai` form. This fresh PR replaces that guidance with the safe `npx paperclipai` form. ## What Changed - Standardize documentation and runtime hints on `npx paperclipai`. - Remove the broken `pnpm exec paperclipai` guidance. - Use a static `<host>` placeholder in private-hostname guidance. - Add regression tests for unsafe forms, continued lines, static hosts, and offline guidance. ## Verification - `git diff --check origin/master...origin/fix/paperclipai-cli-npx-safe-invocation` passes. - The branch adds `server/src/__tests__/cli-invocation-safety.test.ts` and updates private-hostname tests. - CI must run the new tests, typecheck, lint, and build checks. - Local Vitest execution was not available because this worktree has no installed Vitest binary. ## Risks - The change affects operator and agent documentation text. - The runtime hints now show `<host>` instead of a request-derived host value. - No database schema or migration changes exist. - CI will detect any missed unsafe invocation or type error. ## Model Used OpenAI GPT-5, exact model ID `gpt-5`, with tool use and code-review assistance. The model used repository inspection, Git operations, and PR preparation. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] CI ran the test suites and they pass; local test execution was unavailable in this worktree - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I addressed all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
173 lines
5.3 KiB
TypeScript
173 lines
5.3 KiB
TypeScript
/**
|
|
* Generates README.md with Mermaid org chart for company exports.
|
|
*/
|
|
import type { CompanyPortabilityManifest } from "@paperclipai/shared";
|
|
|
|
const ROLE_LABELS: Record<string, string> = {
|
|
ceo: "CEO",
|
|
cto: "CTO",
|
|
cmo: "CMO",
|
|
cfo: "CFO",
|
|
coo: "COO",
|
|
vp: "VP",
|
|
manager: "Manager",
|
|
engineer: "Engineer",
|
|
agent: "Agent",
|
|
};
|
|
|
|
/**
|
|
* Generate a Mermaid flowchart (TD = top-down) representing the org chart.
|
|
* Returns null if there are no agents.
|
|
*/
|
|
export function generateOrgChartMermaid(agents: CompanyPortabilityManifest["agents"]): string | null {
|
|
if (agents.length === 0) return null;
|
|
|
|
const lines: string[] = [];
|
|
lines.push("```mermaid");
|
|
lines.push("graph TD");
|
|
|
|
// Node definitions with role labels
|
|
for (const agent of agents) {
|
|
const roleLabel = ROLE_LABELS[agent.role] ?? agent.role;
|
|
const id = mermaidId(agent.slug);
|
|
lines.push(` ${id}["${mermaidEscape(agent.name)}<br/><small>${mermaidEscape(roleLabel)}</small>"]`);
|
|
}
|
|
|
|
// Edges from parent to child
|
|
const slugSet = new Set(agents.map((a) => a.slug));
|
|
for (const agent of agents) {
|
|
if (agent.reportsToSlug && slugSet.has(agent.reportsToSlug)) {
|
|
lines.push(` ${mermaidId(agent.reportsToSlug)} --> ${mermaidId(agent.slug)}`);
|
|
}
|
|
}
|
|
|
|
lines.push("```");
|
|
return lines.join("\n");
|
|
}
|
|
|
|
/** Sanitize slug for use as a Mermaid node ID (alphanumeric + underscore). */
|
|
function mermaidId(slug: string): string {
|
|
return slug.replace(/[^a-zA-Z0-9_]/g, "_");
|
|
}
|
|
|
|
/** Escape text for Mermaid node labels. */
|
|
function mermaidEscape(s: string): string {
|
|
return s.replace(/"/g, """).replace(/</g, "<").replace(/>/g, ">");
|
|
}
|
|
|
|
/** Build a display label for a skill's source, linking to GitHub when available. */
|
|
function skillSourceLabel(skill: CompanyPortabilityManifest["skills"][number]): string {
|
|
if (skill.sourceLocator) {
|
|
// For GitHub or URL sources, render as a markdown link
|
|
if (skill.sourceType === "github" || skill.sourceType === "skills_sh" || skill.sourceType === "url") {
|
|
return `[${skill.sourceType}](${skill.sourceLocator})`;
|
|
}
|
|
return skill.sourceLocator;
|
|
}
|
|
if (skill.sourceType === "local") return "local";
|
|
return skill.sourceType ?? "\u2014";
|
|
}
|
|
|
|
/**
|
|
* Generate the README.md content for a company export.
|
|
*/
|
|
export function generateReadme(
|
|
manifest: CompanyPortabilityManifest,
|
|
options: {
|
|
companyName: string;
|
|
companyDescription: string | null;
|
|
},
|
|
): string {
|
|
const lines: string[] = [];
|
|
|
|
lines.push(`# ${options.companyName}`);
|
|
lines.push("");
|
|
if (options.companyDescription) {
|
|
lines.push(`> ${options.companyDescription}`);
|
|
lines.push("");
|
|
}
|
|
|
|
// Org chart image (generated during export as images/org-chart.png)
|
|
if (manifest.agents.length > 0) {
|
|
lines.push("");
|
|
lines.push("");
|
|
}
|
|
|
|
// What's Inside table
|
|
lines.push("## What's Inside");
|
|
lines.push("");
|
|
lines.push("> This is an [Agent Company](https://agentcompanies.io) package from [Paperclip](https://paperclip.ing)");
|
|
lines.push("");
|
|
|
|
const counts: Array<[string, number]> = [];
|
|
if (manifest.agents.length > 0) counts.push(["Agents", manifest.agents.length]);
|
|
if (manifest.projects.length > 0) counts.push(["Projects", manifest.projects.length]);
|
|
if (manifest.skills.length > 0) counts.push(["Skills", manifest.skills.length]);
|
|
if (manifest.issues.length > 0) counts.push(["Tasks", manifest.issues.length]);
|
|
|
|
if (counts.length > 0) {
|
|
lines.push("| Content | Count |");
|
|
lines.push("|---------|-------|");
|
|
for (const [label, count] of counts) {
|
|
lines.push(`| ${label} | ${count} |`);
|
|
}
|
|
lines.push("");
|
|
}
|
|
|
|
// Agents table
|
|
if (manifest.agents.length > 0) {
|
|
lines.push("### Agents");
|
|
lines.push("");
|
|
lines.push("| Agent | Role | Reports To |");
|
|
lines.push("|-------|------|------------|");
|
|
for (const agent of manifest.agents) {
|
|
const roleLabel = ROLE_LABELS[agent.role] ?? agent.role;
|
|
const reportsTo = agent.reportsToSlug ?? "\u2014";
|
|
lines.push(`| ${agent.name} | ${roleLabel} | ${reportsTo} |`);
|
|
}
|
|
lines.push("");
|
|
}
|
|
|
|
// Projects list
|
|
if (manifest.projects.length > 0) {
|
|
lines.push("### Projects");
|
|
lines.push("");
|
|
for (const project of manifest.projects) {
|
|
const desc = project.description ? ` \u2014 ${project.description}` : "";
|
|
lines.push(`- **${project.name}**${desc}`);
|
|
}
|
|
lines.push("");
|
|
}
|
|
|
|
// Skills list
|
|
if (manifest.skills.length > 0) {
|
|
lines.push("### Skills");
|
|
lines.push("");
|
|
lines.push("| Skill | Description | Source |");
|
|
lines.push("|-------|-------------|--------|");
|
|
for (const skill of manifest.skills) {
|
|
const desc = skill.description ?? "\u2014";
|
|
const source = skillSourceLabel(skill);
|
|
lines.push(`| ${skill.name} | ${desc} | ${source} |`);
|
|
}
|
|
lines.push("");
|
|
}
|
|
|
|
// Getting Started
|
|
lines.push("## Getting Started");
|
|
lines.push("");
|
|
lines.push("```bash");
|
|
lines.push("npx paperclipai company import this-github-url-or-folder");
|
|
lines.push("```");
|
|
lines.push("");
|
|
lines.push("See [Paperclip](https://paperclip.ing) for more information.");
|
|
lines.push("");
|
|
|
|
// Footer
|
|
lines.push("---");
|
|
lines.push(`Exported from [Paperclip](https://paperclip.ing) on ${new Date().toISOString().split("T")[0]}`);
|
|
lines.push("");
|
|
|
|
return lines.join("\n");
|
|
}
|