0 Fork 0

mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-29 12:59:13 +01:00

Files

T

nickyleachandPaperclip 27bdb45fae fix(server): keep the API base path prefix and scope the launcher profile

The paperclip-api helper dropped any path prefix from PAPERCLIP_API_URL by
taking only the URL origin, so a reverse-proxied deployment sent every
request to the wrong path. It now keeps the normalized base, including its
prefix, and rejects a path that resolves outside that prefix. A generated
property test with 200 cases and a named table cover this.

A host-credentials run now stages the token-free paperclip-api helper, but
it also picked up a forced PATH/ZDOTDIR/BASH_ENV and six shell profile files
meant for a managed Git credential run. That silently narrowed the host's own
shell setup. The launcher now applies the profile redirection only when it
also stages git or gh, and a host-credentials run keeps only its PATH entry
and the launcher directory. A login shell can still reorder PATH ahead of the
launcher directory on a host-credentials run; nothing here restores it, since
doing so would again override the host's own profile. This is a known,
accepted residual.

The API access note rendered from a launcher directory alone, so a future
caller that stages only git and gh, without paperclip-api, could still make
the note teach a command that is not on PATH. The launcher now reports its
staged program list, and the note reads that list instead of the directory.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-09-16 09:33:06 +00:00

src

fix(server): keep the API base path prefix and scope the launcher profile

2026-09-16 09:33:06 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572 )

2026-08-17 22:11:30 -05:00

package.json

feat(connections): add self-serve intent runtime (#12345 )

2026-08-29 12:08:34 -05:00

README.md

PAPA-430: workspace finalize gates + no-remote-git enforcement (#6969 )

2026-05-29 08:25:29 -07:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

README.md

@paperclipai/adapter-utils

Shared utilities for Paperclip adapters: process spawning, environment injection, sandbox/SSH transport, workspace sync, and the round-trip helpers that move code between the local execution-workspace cwd and wherever the agent actually runs.

For the adapter-author guide see docs/adapters/creating-an-adapter.md and the in-repo notes at packages/adapters/AUTHORING.md.

No-remote-git contract

The local execution-workspace cwd is the only persistence boundary across runs. No adapter may depend on a git remote for cross-run state.

Adapters that run the agent on a different host should use the SSH round-trip helpers in src/ssh.ts:

prepareWorkspaceForSshExecution({ spec, localDir, remoteDir }) — bundles the local cwd (tracked files, dirty edits, untracked additions, and the git history needed to reconstruct it) to remoteDir before the run starts. Runs with no git remote configured.
restoreWorkspaceFromSshExecution({ spec, localDir, remoteDir, ... }) — syncs the remote cwd back into localDir after the run, including any new commits the agent created. Also runs with no git remote configured.

prepareRemoteManagedRuntime in src/remote-managed-runtime.ts wraps both calls for adapters that want a per-run remote workspace and an automatic restoreWorkspace() finally hook.

The invariant is pinned by the no-remote-git contract case in src/ssh-fixture.test.ts, which asserts that a remote-only commit propagates to the local worktree through the prepare → restore round-trip with no git remote configured at any point. Do not regress that test.