mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-21 00:05:49 +02:00
DottaandPaperclip
40ecacff4c
## Thinking Path > - Paperclip manages agent work through company-scoped tasks. > - Speko voice connections bind a caller to that work. > - Private voice routes must recognize an authenticated human caller. > - Cloud sign-in uses a trusted Cloud actor, rather than a local session actor. > - The voice caller check rejected that existing authentication type. > - This pull request accepts authenticated Cloud callers and retains the current access checks. > - Cloud users can load call history and start private voice sessions. ## Linked Issues or Issue Description Refs #15727, #15728, #15729. **What happened?** A signed-in Cloud user sees “Sign in to start a private voice conversation” when the Speko connection loads call activity. The same check prevents the user from starting a private voice session. **Expected behavior** The trusted Cloud user identity should have the same voice caller access as a local authenticated session. The current company and user identity checks must still apply. **Steps to reproduce** 1. Sign in to a Cloud workspace with experimental chat connectors enabled. 2. Connect a Speko persona to an existing agent. 3. Open its call activity, or start a browser voice session. 4. Observe the sign-in rejection despite the authenticated workspace session. **Paperclip version or commit** Reproduced on the voice route in master atb8ffeb973a. **Deployment mode** Paperclip Cloud with trusted tenant authentication. ## What Changed - Accept `cloud_tenant` and `session` actors with a user ID as private voice callers. - Use current company membership for Cloud owners, including owners with temporary administrator access. Retain local administrator authority, company isolation, and credential-source restrictions. - Add route regressions for call history, session creation, administrator authority, missing identities, company boundaries, and rejected caller types. - Add Cloud authentication qualification steps to the Speko runbook. ## Verification - Before the fix: 2 Cloud regressions failed; 9 boundary and local-user tests passed. - After the fix: all 100 voice caller and real-database persistence regressions passed. The Cloud-owner route test covers history, session creation, persisted caller authority, and membership revocation. - Repository typecheck and build passed with the repository’s pinned dependencies. - All current-head CI gates passed. Greptile reviewedf84fee2605at 5/5 with no remaining findings. The repaired local full repository test run is still in progress. The first local full-suite attempt failed on missing native database library aliases; those aliases were repaired only in the isolated test dependency. No skipped run is counted as database proof. - On Cloud, verify that signed-in call activity loads and private session creation reaches media setup. Real conversation and spoken playback acceptance remain separate. ## Risks The change accepts an existing trusted Cloud actor type. Authentication still runs in the current middleware. Raw Cloud headers, board API keys, MCP OAuth, Cloud control credentials, and agent callers cannot establish private voice caller authority. No migration, UI change, credential, transcript, or lockfile is included. ## Model Used OpenAI Codex, GPT-6 family, with tool use and code execution. The exact serving variant and context window are not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>