mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 12:04:41 +01:00
Dotta
df4b46b137
Automatic HTTPS for managed worktree runtimes cannot depend on every
project template and UI caller supplying an `expose` block, so the server
needs to tell three cases apart on a config it did not write:
- `unset` — a pre-feature block that only declares the backend
`urlTemplate`. Defaultable.
- `enabled` — an explicit opt-in, honored verbatim.
- `disabled` — a deliberate opt-out, which must survive the backfill.
An explicit negative beats a positive in the same block so a stale `type`
can never re-enable an opt-out. `resolveDeclaredRuntimeExposureConfig`
completes a bare `{ type: "tailscale_https" }` from the fail-closed
defaults while still rejecting smuggled fields, so the strict-config
guarantee from the PAP-17050 verdict is unchanged.