Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-19 10:36:26 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
0b62c736a0ca097469e215739e61aa7832f1d3da
PaperClipAI/server/package.json
T
dependabot[bot]Devin FoleyPaperclip
 1b58ac6ec9 build(deps): bump smol-toml from 1.8.0 to 1.9.1 (#16020) 
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - The Codex runner must set trust for the exact startup project.
> - smol-toml 1.9.1 returns tables with null prototypes.
> - Object spread replaces those prototypes and causes strict validation
to reject valid trust edits.
> - This PR keeps the parsed tables and adds tests for the dependency
update.
> - Codex can start while unrelated settings and trust boundaries stay
intact.

## Linked Issues or Issue Description

Refs #16028. That merged PR contains the same table-preservation fix and
tests for both prototype styles.
This branch retains that work and adds more regression cases.
Related dependency updates: #15293 and #15364.

**What happened?**

Eight startup trust tests fail after the update to smol-toml 1.9.1.
The error is `codex_startup_trust_cannot_preserve_configuration`.

**Expected behavior**

Set trust for the exact startup project.
Keep unrelated configuration bytes and sibling project trust unchanged.

**Steps to reproduce**

1. Check out the original PR head,
`90b133dfd963af4f19b4df11fdd6c11b4eeb2a2d`.
2. Install dependencies with `pnpm install --frozen-lockfile`.
3. In `packages/paperclip-runner`, run `pnpm exec vitest run
src/drivers/codex/codex-startup-trust.test.ts`.

**Paperclip version or commit**

The verified head is `1a8e8ad8b2e1049ebb68595d85c92e3c0621559d`.

**Deployment mode**

Built from source on Linux. The affected code runs before Codex starts.

## What Changed

- Keep Dependabot's update from smol-toml 1.8.0 to 1.9.1 in the runner
and server.
- Keep parsed project tables. Use `parse("")` to create missing tables
with the parser's prototype.
- Keep strict candidate validation and the upstream tests for both
prototype styles.
- Add tests for nested values, dates, times, special numbers,
prototype-named keys, sibling trust, and repeated calls.
- Preserve the original Dependabot commit and lockfile. The two
follow-up commits change only the trust source and tests.

## Verification

- All 28 startup trust cases pass at the verified head. Run the command
above.
- The focused strict TypeScript check passes. Use `tsc --ignoreConfig
--noEmit --module nodenext --moduleResolution nodenext --target es2023
--types node --esModuleInterop --strict --skipLibCheck
src/drivers/codex/codex-startup-trust.ts
src/drivers/codex/codex-startup-trust.test.ts`.
- The runner TypeScript build passes. The full local build stops because
the test workspace has no Cargo executable.
- The broader Codex suite passed 271 of 272 cases before the source
conflict resolution. One unrelated fixture expects the runtime's
workspace path to be absent.
- The repository type check exited 137 in the DB package. The full local
test command was stopped after resource exhaustion.
- The final files merge cleanly with master
`976cdc77ed564dc3e014621505890b647e554a7f`. `git diff --check` passes.
- [CI for the verified
head](https://github.com/paperclipai/paperclip/actions/runs/38664681165)
passed. All 55 active checks passed; two Storybook checks were skipped.
Snyk also passed. [Greptile cycle
3](https://github.com/paperclipai/paperclip/pull/16020#issuecomment-6182103775)
scored this head 5/5 with no actionable findings and no open review
threads.

## Risks

- This update changes the parser used by the runner and server. CI must
check both packages.
- The trust edit must preserve unrelated TOML values and bytes.
Regression tests cover this behavior.
- Local resource and tool limits prevent a complete local validation
result. The full remote CI run passed at the verified head.

## Model Used

OpenAI GPT-6 through Codex helped with the compatibility fix, tests, and
review.
The runtime does not expose the exact model snapshot or context window
size.
The agent used repository tools, code execution, and GitHub tools.
Dependabot produced the original dependency and lockfile update.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass — the focused 28-case suite
and strict type check pass; broader limits are listed above
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes — this
PR records the compatibility behavior and verification
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---

## Original Dependabot Update

Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.8.0
to 1.9.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/squirrelchat/smol-toml/releases">smol-toml's
releases</a>.</em></p>
<blockquote>
<h2>v1.9.1</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: reject invalid extra exponent sign by <a
href="https://github.com/cyyynthia"><code>@cyyynthia</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/squirrelchat/smol-toml/compare/v1.9.0...v1.9.1">https://github.com/squirrelchat/smol-toml/compare/v1.9.0...v1.9.1</a></p>
<h2>v1.9.0</h2>
<p><strong>Huge update</strong>!!! This is most likely the largest
update the library received since its release, with lots of new features
and improvements.</p>
<h3>Performance improvements</h3>
<p>Significant parts of the internal parse logic have been rewritten,
improving performance by <strong>1.5x-2x</strong>. The library was
already comfortably ahead of the others, but it is now faster than ever,
sitting at <strong>4x faster parse performance</strong> than the closest
maintained implementation.</p>
<p>Problematic code paths have also been replaced by safer
implementations, solving potential DoS vectors. See
GHSA-r4xh-jqrq-34v2.</p>
<p>Note: the objects returned by the library now have a <em>null
prototype</em>. This is a transparent change for 99.9% of users, and is
one of the most significant contributors to the major performance gains
in this version.</p>
<h3>Full Temporal support</h3>
<p>Version 1.8.0 brought support for Temporal in <code>stringify</code>;
now the library is also able to emit Temporal objects instead of its own
ad-hoc <code>TomlDate</code> object. It is not enabled by default, but
it will become the default in v2. Enable by setting <code>useLegacyDate:
false</code> in the parser's options.</p>
<h4>Better Temporal support in stringify</h4>
<p>Temporal support has been improved since it released: Temporal
objects that cannot be represented (such as
<code>Temporal.PlainMonthDay</code>) now throw an error (instead of
silently emitting a bogus object).</p>
<p>A new option has been added to <code>stringify</code> to disallow
Temporal objects that cannot be fully represented in TOML. This includes
<code>ZonedDateTime</code> objects with a IANA timezone attached instead
of a plain offset, and dates with a specific calendar value set. Enable
by setting <code>strictTemporal: true</code> in the options.</p>
<h3>Handling of unsafe keys</h3>
<p>Since its release the library has been protected against prototype
pollution attacks, setting properties like <code>__proto__</code> using
safe mechanisms that do not trigger prototype pollution. However, while
the returned objects are safe on their own, they may become problematic
if used carelessly.</p>
<p>Inspired by <code>secure-json-parse</code>, the library now offers a
way to either drop unsafe properties from the returned object, or to
throw an error and reject documents altogether. By default, these
potentially unsafe keys are preserved and returned.</p>
<h3>Miscellaneous updates</h3>
<ul>
<li>Unicode BOM is now gracefully accepted and ignored.</li>
<li>Table array headers are now properly checked again. Reported in <a
href="https://redirect.github.com/squirrelchat/smol-toml/issues/65">#65</a>.</li>
<li>Closed certain gaps where invalid whitespace would be accepted.
Reported in <a
href="https://redirect.github.com/squirrelchat/smol-toml/issues/61">#61</a>.</li>
<li>Bogus local date and local time values with a UTC offset are no
longer accepted.</li>
<li>Certain error messages are more accurate and handle errors at line
boundaries better.</li>
<li>The default export of the lib is now formally deprecated; use a
<code>import *</code> instead. Proposed in <a
href="https://redirect.github.com/squirrelchat/smol-toml/issues/50">#50</a>.</li>
<li>On Node 20+, strings that contain lone surrogates are now normalised
to well-formed strings.</li>
<li>On Node 20+, keys that contain lone surrogates are now
rejected.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/squirrelchat/smol-toml/compare/v1.8.0...v1.9.0">https://github.com/squirrelchat/smol-toml/compare/v1.8.0...v1.9.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/69aa050fef018b71799519bb2cbb54f158a0c5f9"><code>69aa050</code></a>
fix: actually properly fix exponent issues</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/7be7084d24c85909cec84ecaafe39737ef4e4472"><code>7be7084</code></a>
chore: version bump</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/be3290da3309502447e020ce106bb8a11d99e580"><code>be3290d</code></a>
chore: upgrade deps</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/86c76134ad7a50e8e101ef7fd82cb0f155b278d8"><code>86c7613</code></a>
fix: reject invalid extra exponent sign</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/6f9739a5ab481f57c3112024bc4947534b580b58"><code>6f9739a</code></a>
fix: gate <code>[is|to]WellFormed</code> (Node 18 compat)</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/a73ca32c7c9237f744c880d900ad15307a0cef56"><code>a73ca32</code></a>
fix: no Temporal with toml-test when Node &lt; 26</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/7727890604580bd3fc2d7d2f79ad6e67b745ebe7"><code>7727890</code></a>
chore: version bump</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/641903d60d47900080602b6a83e919d2a526547f"><code>641903d</code></a>
chore: rewrite README.md</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/2df14c57945fec5a3737bc0cdce06a436bf9a77e"><code>2df14c5</code></a>
fix(types): make it work if Temporal doesn't exist</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/3eaa44ef54b859990969935664b12023b26d0eae"><code>3eaa44e</code></a>
chore: update benchmark harness</li>
<li>Additional commits viewable in <a
href="https://github.com/squirrelchat/smol-toml/compare/v1.8.0...v1.9.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=smol-toml&package-manager=npm_and_yarn&previous-version=1.8.0&new-version=1.9.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Devin Foley <devin@devinfoley.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-14 18:46:09 -07:00

192 lines
6.3 KiB
JSON
Raw Blame History

{
"name": "@paperclipai/server",
"version": "0.3.1",
"license": "MIT",
"homepage": "https://github.com/paperclipai/paperclip",
"bugs": {
"url": "https://github.com/paperclipai/paperclip/issues"
},
"repository": {
"type": "git",
"url": "https://github.com/paperclipai/paperclip",
"directory": "server"
},
"type": "module",
"exports": {
".": "./src/index.ts"
},
"publishConfig": {
"access": "public",
"exports": {
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js"
}
},
"main": "./dist/index.js",
"types": "./dist/index.d.ts"
},
"files": [
"dist",
"ui-dist",
"skills"
],
"scripts": {
"dev": "tsx src/index.ts",
"dev:watch": "cross-env PAPERCLIP_MIGRATION_PROMPT=never PAPERCLIP_MIGRATION_AUTO_APPLY=true tsx ./scripts/dev-watch.ts",
"prepare:ui-dist": "bash ../scripts/prepare-server-ui-dist.sh",
"build": "pnpm run prepare:runner-vendor && node scripts/verify-runner-vendor-dependencies.mjs && tsc && mkdir -p dist/onboarding-assets dist/built-ins dist/services/scripts dist/vendor/paperclip-runner && cp -R src/onboarding-assets/. dist/onboarding-assets/ && cp -R src/built-ins/. dist/built-ins/ && cp -R src/services/scripts/. dist/services/scripts/ && cp -Rf ../packages/paperclip-runner/dist/. dist/vendor/paperclip-runner/ && node scripts/write-build-stamp.mjs",
"prepack": "pnpm run prepare:ui-dist && pnpm run build",
"postpack": "rm -rf ui-dist",
"clean": "rm -rf dist",
"start": "node dist/index.js",
"prepare:runner-vendor": "node scripts/prepare-runner-vendor.mjs",
"typecheck": "pnpm run prepare:runner-vendor && pnpm --filter @paperclipai/plugin-sdk ensure-build-deps && tsc --noEmit"
},
"dependencies": {
"@agentclientprotocol/claude-agent-acp": "0.73.0",
"@agentclientprotocol/codex-acp": "1.6.2",
"@ai-sdk/amazon-bedrock": "5.0.113",
"@ai-sdk/anthropic": "4.0.78",
"@ai-sdk/google": "4.0.93",
"@ai-sdk/openai": "4.0.86",
"@ai-sdk/xai": "5.0.20",
"@aws-sdk/client-s3": "^3.1141.0",
"@chat-adapter/discord": "4.39.0",
"@chat-adapter/github": "4.39.0",
"@chat-adapter/slack": "4.39.0",
"@chat-adapter/teams": "4.39.0",
"@chat-adapter/telegram": "4.39.0",
"@discordjs/ws": "1.2.3",
"@grpc/grpc-js": "1.14.5",
"@modelcontextprotocol/sdk": "^1.31.0",
"@openrouter/ai-sdk-provider": "3.1.0",
"@opentelemetry/api": "^1.9.0",
"@paperclipai/adapter-claude-local": "workspace:*",
"@paperclipai/adapter-codex-local": "workspace:*",
"@paperclipai/adapter-cursor-cloud": "workspace:*",
"@paperclipai/adapter-cursor-local": "workspace:*",
"@paperclipai/adapter-gemini-local": "workspace:*",
"@paperclipai/adapter-grok-local": "workspace:*",
"@paperclipai/adapter-kimi-local": "workspace:*",
"@paperclipai/adapter-openclaw-gateway": "workspace:*",
"@paperclipai/adapter-opencode-local": "workspace:*",
"@paperclipai/adapter-pi-local": "workspace:*",
"@paperclipai/adapter-utils": "workspace:*",
"@paperclipai/db": "workspace:*",
"@paperclipai/hermes-paperclip-adapter": "workspace:*",
"@paperclipai/plugin-sdk": "workspace:*",
"@paperclipai/shared": "workspace:*",
"@paperclipai/skills-catalog": "workspace:*",
"@photon-ai/advanced-imessage": "2.1.0",
"@vercel/connect": "2.3.3",
"acorn": "8.18.0",
"acpx": "0.13.1",
"ai": "7.0.130",
"ajv": "^8.20.0",
"ajv-formats": "^3.0.1",
"better-auth": "1.7.2",
"chat": "4.39.0",
"chokidar": "^5.0.0",
"compression": "^1.8.2",
"detect-port": "^2.1.0",
"dompurify": "^3.4.16",
"dotenv": "^17.4.2",
"drizzle-orm": "^0.45.2",
"embedded-postgres": "^18.1.0-beta.16",
"express": "^5.1.0",
"heif2jpeg": "0.1.6",
"jsdom": "^30.0.1",
"light-my-request": "^6.6.0",
"multer": "^2.4.0",
"nice-grpc": "2.1.17",
"nice-grpc-common": "2.0.4",
"open": "^11.0.4",
"opencode-ai": "1.18.34",
"pino": "^10.0.0",
"pino-http": "^11.0.0",
"pino-pretty": "^13.1.3",
"sharp": "^0.35.4",
"smol-toml": "^1.9.1",
"ssh2": "^1.17.0",
"svix": "1.76.1",
"ws": "^8.22.0",
"zod": "^4.4.3"
},
"bundleDependencies": [
"@agentclientprotocol/claude-agent-acp",
"@agentclientprotocol/codex-acp",
"@chat-adapter/discord",
"@chat-adapter/github",
"@chat-adapter/slack",
"@chat-adapter/teams",
"@chat-adapter/telegram",
"@discordjs/ws",
"acpx"
],
"devDependencies": {
"@opentelemetry/context-async-hooks": "2.10.0",
"@opentelemetry/sdk-trace": "2.10.0",
"@paperclipai/paperclip-runner": "workspace:*",
"@types/compression": "^1.8.1",
"@types/express": "^5.0.0",
"@types/express-serve-static-core": "^5.1.3",
"@types/jsdom": "^30.0.0",
"@types/multer": "^2.2.0",
"@types/node": "^24.0.0",
"@types/sharp": "^0.32.0",
"@types/supertest": "^7.2.1",
"@types/ws": "^8.18.2",
"cross-env": "^10.1.0",
"supertest": "^7.0.0",
"tsx": "^4.23.15",
"typescript": "^7.0.2",
"vite": "^8.2.2",
"vitest": "^5.0.3"
},
"peerDependencies": {
"@opentelemetry/auto-instrumentations-node": "0.79.0",
"@opentelemetry/exporter-trace-otlp-grpc": "0.221.0",
"@opentelemetry/exporter-trace-otlp-http": "0.221.0",
"@opentelemetry/exporter-trace-otlp-proto": "0.221.0",
"@opentelemetry/resources": "2.10.0",
"@opentelemetry/sdk-node": "0.221.0",
"@opentelemetry/semantic-conventions": "1.43.0",
"@sentry/node": "10.71.0"
},
"peerDependenciesMeta": {
"@opentelemetry/auto-instrumentations-node": {
"optional": true
},
"@opentelemetry/exporter-trace-otlp-grpc": {
"optional": true
},
"@opentelemetry/exporter-trace-otlp-http": {
"optional": true
},
"@opentelemetry/exporter-trace-otlp-proto": {
"optional": true
},
"@opentelemetry/resources": {
"optional": true
},
"@opentelemetry/sdk-node": {
"optional": true
},
"@opentelemetry/semantic-conventions": {
"optional": true
},
"@sentry/node": {
"optional": true
}
},
"engines": {
"node": ">=24.11.0"
},
"optionalDependencies": {
"@github/copilot-darwin-arm64": "1.0.88",
"@github/copilot-darwin-x64": "1.0.88",
"@github/copilot-linux-x64": "1.0.88"
}
}
Reference in new issue View Git Blame Copy Permalink