mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-23 09:07:46 +02:00
DottaandPaperclip
fc0d390d98
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Cloud sets managed feature values for each tenant stack. > - Staging lets admins change experimental features. > - The staging exception also let old tenant false values override Cloud true values. > - This could disable required features such as isolated workspaces. > - This pull request keeps every Cloud-enabled feature on and rejects attempts to disable it. > - The same rule applies to staging, production, and managed stacks without a hostname. ## Linked Issues or Issue Description Refs: #16876 **What happened?** The staging override added in #16876 treats managed true values as editable defaults. A stored tenant false value can disable a feature that Cloud enables. Settings writes also accept attempts to disable Cloud-enabled features. **Expected behavior** If Cloud sets a feature to true, the tenant reads true and cannot turn it off. This applies to every managed stack. Staging can still change allowed experiments that Cloud has not enabled. **Steps to reproduce** 1. Set a managed staging primary hostname and enable isolated workspaces in `PAPERCLIP_MANAGED_CONFIG`. 2. Start with `enableIsolatedWorkspaces: false` in the tenant settings row. 3. Read `/api/instance/settings/experimental`. Before this fix, staging returns false. 4. Try to PATCH that flag to false. After this fix, the API returns 403 without saving, and reads return true with managed control metadata. **Paperclip version or commit** Reproduced against master at `cde944ed75648adfb569e86133adc8b118b55dd6`. ## What Changed - Keep managed true values in the staging read overlay. They override old tenant values and lock the existing UI controls. - Reject attempts to set any Cloud-enabled feature to false before writing settings. - Cover every managed feature in service tests across staging, production, and an absent hostname. Add real-service HTTP tests for isolation on staging and production. - Update operator documentation and the feature and access maps. ## Verification - Confirmed the new service regression fails before the fix: staging returns stored false, and writes can attempt to disable enabled flags. - Passed all six focused settings suites: 168 tests. Passed the final route and overlay suites after adding the HTTP regression: 109 tests. - Passed existing experimental settings UI tests: 54 tests. These cover the existing managed-control behavior. - Passed `node scripts/check-maps.mjs` and `git diff --check`. - Passed `pnpm -r typecheck` and `pnpm build`. The first typecheck used an install that did not honor locked versions and hit an unrelated `@pierre/diffs` API mismatch. Reinstalling from the lockfile resolved it; no lockfile changes are included. - Full CI passed on `f43136812a92ec838a24f0c423270e4fbd997c28`: 55 successful checks, one neutral review check, and two expected skips. This includes typecheck, build, general and serialized tests, runner checks, and E2E shards. [CI run](https://github.com/paperclipai/paperclip/actions/runs/39411907756). - The duplicate local `pnpm test:run` was stopped after the complete CI matrix passed. It is not counted as a completed local full-suite pass. - Greptile reviewed `f43136812a92ec838a24f0c423270e4fbd997c28`: 5/5 with no outstanding findings. The only finding on the first review was the repository rule against new code comments; those comments were removed. ## Risks - Staging users can no longer disable a feature that Cloud enables. This is the intended behavior. - Clients that send a stale full settings form containing false for a Cloud-enabled feature receive 403 and must reload. - No database migration is needed. Stored false values remain in the database, but cannot override an active Cloud true value. - Cloud-disabled staging experiments remain editable. Production restrictions and self-hosted settings remain unchanged. ## Model Used - OpenAI Codex, `gpt-6.1-sol`, with reasoning, repository tools, and test execution. The context window size is not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
111 lines
7.7 KiB
Markdown
111 lines
7.7 KiB
Markdown
---
|
|
navigation: {"section":"Oversight and operation","sectionOrder":70,"order":40}
|
|
---
|
|
|
|
# Instance operations
|
|
|
|
An operator can install and run Paperclip, diagnose the instance, configure supported deployment settings, manage its service, and produce a recoverable database backup.
|
|
|
|
Implementation: [CLI entry point](../../cli/src/index.ts), [instance settings](../../ui/src/pages/InstanceExperimentalSettings.tsx), [backup command](../../cli/src/commands/db-backup.ts).
|
|
|
|
Agent access: [companion](../agent-access-map/instance-operations.md).
|
|
|
|
## Sub-features
|
|
|
|
- `install-update`: inspect install channel/version and apply supported update or rollback operations.
|
|
- `server-service`: start/stop the intended instance and inspect its service health.
|
|
- `configuration`: configure database, server binding, storage, secrets, and available experimental settings.
|
|
- `diagnostics`: use doctor/health output to distinguish readiness from a listening port.
|
|
- `backup`: create and inspect backups and verify restore only into a separate disposable target.
|
|
|
|
## How to get to it (user POV)
|
|
|
|
### `operator-cli`
|
|
|
|
Use `paperclipai install`, `run`, `service`, `doctor`, `configure`, `channels`, or `update --help` for the intended operation.
|
|
|
|
### `settings-backup`
|
|
|
|
Use currently visible instance settings for experiments/access and `paperclipai db:backup --help` for one-off backup. Some legacy general-settings URLs redirect.
|
|
|
|
## Driving it with Playwright and the Paperclip CLI
|
|
|
|
Preconditions: follow the [baseline](./README.md#before-driving-a-journey). Use a disposable data directory/service identity. Do not update, restart, or restore over an unrelated live instance as a documentation test.
|
|
|
|
### `operator-cli`
|
|
|
|
Automated: [doctor](../../cli/src/__tests__/doctor.test.ts), [update command](../../cli/src/__tests__/update-command.test.ts), and [service manager](../../cli/src/__tests__/service-manager.test.ts) cover command contracts.
|
|
|
|
Manual: Inspect the selected installation/channel and configuration, start the isolated instance, confirm health and browser access, then stop that instance. For update changes, use the dry-run/check path first and verify installed version and rollback state on an owned disposable installation.
|
|
|
|
Routine HTTP monitoring may use `GET /api/liveness` (or `HEAD`). It returns only
|
|
process startup status and the public build commit without SQL or authentication.
|
|
It remains reachable during an idle drain. Use `/api/health` for explicit database
|
|
readiness, signed bootstrap, and authorized diagnostics; liveness does not
|
|
establish database health or claim a workspace.
|
|
|
|
Automated: [static UI idle completion](../../server/src/__tests__/static-ui-idle.test.ts)
|
|
covers real aborted file streams, disconnects before file lookup, nested routers,
|
|
and unfinished parent/fallback writes. Mounted Express applications retain their
|
|
conservative hold. It does not qualify provider cleanup or a hosted sleep/wake cycle.
|
|
|
|
Manual: On an otherwise idle disposable instance, close a static UI download
|
|
served by the admitted application before it finishes. Repeat with a disconnect
|
|
before headers arrive. Confirm that neither leaves a permanent request hold. An
|
|
unfinished application write must still prevent sleep after its client leaves.
|
|
|
|
### `settings-backup`
|
|
|
|
Automated: [experimental settings](../../ui/src/pages/InstanceExperimentalSettings.test.tsx) and [database backup routes](../../server/src/__tests__/instance-database-backups-routes.test.ts) cover their UI/API contracts.
|
|
|
|
Manual: Change a harmless experimental setting, reload, and confirm the affected route honors it. Back up a disposable instance, inspect the reported file and metadata, and restore using the documented procedure into a second isolated target. Verify a known record after restoration.
|
|
|
|
Cloud staging: On a managed `*.staging.paperclip.app` instance, verify experiments
|
|
are visible, Cloud-enabled controls are locked on, and other experiments are
|
|
editable by a Cloud stack Admin or instance admin with changes surviving reload.
|
|
With an old stored false value and a Cloud true value, verify the effective
|
|
setting is true and an API attempt to disable it returns 403 without saving.
|
|
Repeat the enabled-feature check on production and managed stacks without a hostname.
|
|
As a stack Admin, verify a harmless experiment saves while general instance
|
|
settings and task-drain operations remain denied. Demote that user to Member
|
|
and verify the next experimental write is denied.
|
|
Production keeps its hidden controls and managed feature values. Staging retains
|
|
other Cloud restrictions. [Settings policy tests](../../server/src/__tests__/instance-settings-managed-overlay.test.ts),
|
|
[route tests](../../server/src/__tests__/instance-settings-routes.test.ts), and
|
|
[health tests](../../server/src/__tests__/health.test.ts) exercise simulated Cloud
|
|
identities and persistence; they do not establish a deployed staging walkthrough.
|
|
|
|
## Gotchas
|
|
|
|
- Source-checkout update/check commands report manual update guidance; they do
|
|
not qualify a managed installation. Rollback restores retained CLI payloads,
|
|
not database migrations. Service status applies to its selected service
|
|
identity, not automatically to an owned foreground dev server.
|
|
|
|
- A successful backup write does not prove restoration works.
|
|
- Settings visibility and mutability differ for cloud-managed and self-hosted instances.
|
|
- Keep the three data paths distinct: first-party Telemetry, operator-configured OpenTelemetry, and local run logs.
|
|
|
|
### Storybook verification
|
|
|
|
#### `backup`
|
|
|
|
Scope: ui
|
|
Storybook: Mount shipped InstanceGeneralSettings in CompanySettings with daily/weekly/monthly retention presets, selected values, saving/error/loading and cloud-hidden controls. Backup creation and restore remain separate CLI/operator checks.
|
|
Production: PATCH /api/instance/settings/general must enforce instance settings authority and managed hidden fields, persist retention and survive reload. Separately inspect a real backup and restore a known record into a second disposable target; a successful write does not prove restoration.
|
|
Sources: Source: [InstanceGeneralSettings.tsx](../../ui/src/pages/InstanceGeneralSettings.tsx), [CompanySettings.tsx](../../ui/src/pages/CompanySettings.tsx), [instance-settings.ts](../../server/src/routes/instance-settings.ts), [db-backup.ts](../../cli/src/commands/db-backup.ts). Tests: [InstanceGeneralSettings.test.tsx](../../ui/src/pages/InstanceGeneralSettings.test.tsx), [instance-settings-routes.test.ts](../../server/src/__tests__/instance-settings-routes.test.ts), [instance-settings-managed-overlay.test.ts](../../server/src/__tests__/instance-settings-managed-overlay.test.ts), [instance-database-backups-routes.test.ts](../../server/src/__tests__/instance-database-backups-routes.test.ts)
|
|
|
|
#### `install-update`
|
|
|
|
Scope: cli
|
|
Storybook: No authored story required for install, channel selection, update or rollback command execution.
|
|
Production: Use an owned managed installation: check/dry-run, installed version, retained payload rollback and failure. Source-checkout guidance is a separate case; rollback does not undo database migrations.
|
|
Sources: Source: [index.ts](../../cli/src/index.ts), [install.ts](../../cli/src/commands/install.ts), [update.ts](../../cli/src/commands/update.ts). Tests: [install-command.test.ts](../../cli/src/__tests__/install-command.test.ts), [update-command.test.ts](../../cli/src/__tests__/update-command.test.ts)
|
|
|
|
#### `diagnostics`
|
|
|
|
Scope: cli
|
|
Storybook: No authored story required for doctor/health command results.
|
|
Production: Run doctor against an owned data directory; check readiness and nonzero failures. A listening port alone does not prove readiness; repair requires observing the repaired result.
|
|
Sources: Source: [doctor.ts](../../cli/src/commands/doctor.ts). Tests: [doctor.test.ts](../../cli/src/__tests__/doctor.test.ts)
|