mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-27 19:35:13 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Environment configs (sandbox providers, SSH) can bind stored company secrets through `format: "secret-ref"` fields, picked in the environment editor's secret picker > - Environments are instance-scoped and shared by every company on an instance, but the picker lists only the current company's secrets, so a ref pointing at another company's secret renders as "Missing secret (…)" in destructive styling > - That state is indistinguishable from a genuinely deleted secret, so operators "fix" a healthy binding by creating a duplicate secret in their own company — the exact sequence that used to corrupt bindings before #10576 > - This pull request adds an instance-gated metadata endpoint for an environment's secret refs and teaches the picker to name a cross-company secret and its owner honestly > - The benefit is that operators can tell a healthy cross-company binding from a broken one, and stop creating duplicate secrets ## Linked Issues or Issue Description **Is your feature request related to a problem? Please describe.** In the environment editor, a secret-ref field that points at a secret owned by a different company shows "Missing secret (22095402…)" in red, with "The previously selected secret is no longer available. Pick another or remove the binding." The binding is actually healthy — the current company's picker just cannot list the other company's secrets. Operators react by creating a duplicate secret and re-pointing the field. **Describe the solution you'd like** The editor should know the referenced secret's name, status, and owning company (metadata only, never the value) and present a cross-company ref neutrally, a deleted secret as deleted, and only an unknown id as missing. Related: #10576 (fixes the binding corruption this UI state used to trigger). ## What Changed - New `GET /environments/:id/secret-refs` returns `{ refs: [{ configPath, secretId, name, status, companyId, companyName }] }` for the environment's config-derived secret refs. Values are never returned. The route sits behind `assertCanAccessInstanceEnvironments`, the same gate as environment editing. - New `secretService.describeSecretRefs` loads that metadata across companies; unknown ids are omitted. - `SecretBindingPicker` reads an optional `SecretRefHintsContext` (keyed by secret id). With a hint, a ref the company list cannot show renders as `NAME — Owning Company` with neutral styling and the note "Owned by the … company. The binding keeps working; selecting a secret from this list re-points it here." A hint with `status: "deleted"` reports the secret as deleted. Without hints, behavior is byte-identical to before — agent editors and other picker users are unaffected. - `CompanyEnvironments` fetches descriptors for the environment being edited and provides them through the context. ## Verification - `cd server && pnpm vitest run src/__tests__/environment-routes.test.ts src/__tests__/secrets-service.test.ts` — new endpoint happy path, agent 403 (descriptors never computed), and embedded-Postgres coverage proving cross-company names resolve and unknown ids drop out. - `cd ui && pnpm vitest run src/components/SecretBindingPicker.test.tsx src/components/JsonSchemaForm.test.tsx src/pages/CompanyEnvironments.test.tsx` — hinted cross-company rendering, hinted deleted secret, and unchanged no-hint fallback. - `pnpm run typecheck` in `server` and `ui`. - Manual: edit an environment whose secret-ref field references another company's secret; the field names the secret and its owning company instead of "Missing secret". ## Risks - The endpoint exposes secret names and company names across companies to instance-level environment editors. Those actors already manage instance-shared environments (and instance admins are implicit members of every company), so this reveals no secret material and no new reach; the service method documents that callers must sit behind an instance-level gate. - UI change is additive and context-gated; pickers without a provider render exactly as before. ## Model Used Claude Fable 5 (`claude-fable-5`, Anthropic) via Claude Code — extended thinking, agentic tool use (file edits, vitest/tsc runs). No other models involved. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge
161 lines
6.0 KiB
TypeScript
161 lines
6.0 KiB
TypeScript
import type {
|
|
CancelEnvironmentCustomImageSetupSession,
|
|
Environment,
|
|
EnvironmentCapabilities,
|
|
EnvironmentLease,
|
|
EnvironmentProbeResult,
|
|
EnvironmentCustomImageSetupSession,
|
|
EnvironmentCustomImageTemplate,
|
|
EnvironmentCustomImageTerminalSessionToken,
|
|
FinishEnvironmentCustomImageSetupSession,
|
|
StartEnvironmentCustomImageSetupSession,
|
|
CreateEnvironmentCustomImageTerminalSessionToken,
|
|
} from "@paperclipai/shared";
|
|
import { api } from "./client";
|
|
|
|
export interface EnvironmentCustomImageOverview {
|
|
activeTemplate: EnvironmentCustomImageTemplate | null;
|
|
/**
|
|
* `false` means the environment config changed since capture and runs fall
|
|
* back to the base image until a new image is captured. `null` when unknown.
|
|
*/
|
|
activeTemplateMatchesConfig?: boolean | null;
|
|
activeSession: EnvironmentCustomImageSetupSession | null;
|
|
latestSession: EnvironmentCustomImageSetupSession | null;
|
|
}
|
|
|
|
export type EnvironmentCustomImageReconciliation =
|
|
| { action: "relinked"; template: EnvironmentCustomImageTemplate }
|
|
| { action: "detached"; template: EnvironmentCustomImageTemplate };
|
|
|
|
export type EnvironmentUpdateResult = Environment & {
|
|
customImageReconciliation?: EnvironmentCustomImageReconciliation;
|
|
};
|
|
|
|
export interface EnvironmentCustomImageConnectionPayload {
|
|
type: string;
|
|
command?: string | null;
|
|
token?: string | null;
|
|
expiresAt?: string | null;
|
|
metadata?: Record<string, unknown> | null;
|
|
}
|
|
|
|
export interface EnvironmentCustomImageSetupSessionResult {
|
|
session: EnvironmentCustomImageSetupSession;
|
|
connectionPayload: EnvironmentCustomImageConnectionPayload | null;
|
|
}
|
|
|
|
export interface EnvironmentCustomImageFinishResult extends EnvironmentCustomImageSetupSessionResult {
|
|
template: EnvironmentCustomImageTemplate;
|
|
}
|
|
|
|
export interface EnvironmentCustomImageRollbackResult {
|
|
activeTemplate: EnvironmentCustomImageTemplate;
|
|
supersededTemplate: EnvironmentCustomImageTemplate;
|
|
}
|
|
|
|
function customImageCompanyQuery(companyId: string): string {
|
|
return `companyId=${encodeURIComponent(companyId)}`;
|
|
}
|
|
|
|
export interface EnvironmentSecretRefDescriptor {
|
|
configPath: string;
|
|
secretId: string;
|
|
name: string;
|
|
status: string;
|
|
companyId: string;
|
|
companyName: string | null;
|
|
}
|
|
|
|
export const environmentsApi = {
|
|
list: (companyId: string) => api.get<Environment[]>(`/companies/${companyId}/environments`),
|
|
capabilities: (companyId: string) =>
|
|
api.get<EnvironmentCapabilities>(`/companies/${companyId}/environments/capabilities`),
|
|
lease: (leaseId: string) => api.get<EnvironmentLease>(`/environment-leases/${leaseId}`),
|
|
secretRefs: (environmentId: string) =>
|
|
api.get<{ refs: EnvironmentSecretRefDescriptor[] }>(`/environments/${environmentId}/secret-refs`),
|
|
create: (companyId: string, body: {
|
|
name: string;
|
|
description?: string | null;
|
|
driver: "local" | "ssh" | "sandbox" | "plugin";
|
|
config?: Record<string, unknown>;
|
|
metadata?: Record<string, unknown> | null;
|
|
}) => api.post<Environment>(`/companies/${companyId}/environments`, body),
|
|
update: (environmentId: string, body: {
|
|
name?: string;
|
|
description?: string | null;
|
|
driver?: "local" | "ssh" | "sandbox" | "plugin";
|
|
status?: "active" | "archived";
|
|
config?: Record<string, unknown>;
|
|
metadata?: Record<string, unknown> | null;
|
|
}) => api.patch<EnvironmentUpdateResult>(`/environments/${environmentId}`, body),
|
|
probe: (environmentId: string, companyId?: string | null) =>
|
|
api.post<EnvironmentProbeResult>(
|
|
companyId
|
|
? `/environments/${environmentId}/probe?${customImageCompanyQuery(companyId)}`
|
|
: `/environments/${environmentId}/probe`,
|
|
{},
|
|
),
|
|
probeConfig: (companyId: string, body: {
|
|
name?: string;
|
|
driver: "local" | "ssh" | "sandbox" | "plugin";
|
|
description?: string | null;
|
|
config?: Record<string, unknown>;
|
|
metadata?: Record<string, unknown> | null;
|
|
}) => api.post<EnvironmentProbeResult>(`/companies/${companyId}/environments/probe-config`, body),
|
|
customImageTemplate: (environmentId: string, companyId: string) =>
|
|
api.get<EnvironmentCustomImageOverview>(
|
|
`/environments/${environmentId}/custom-image-template?${customImageCompanyQuery(companyId)}`,
|
|
),
|
|
startCustomImageSetupSession: (
|
|
environmentId: string,
|
|
companyId: string,
|
|
body: StartEnvironmentCustomImageSetupSession = {},
|
|
) =>
|
|
api.post<EnvironmentCustomImageSetupSessionResult>(
|
|
`/environments/${environmentId}/custom-image-setup-sessions?${customImageCompanyQuery(companyId)}`,
|
|
body,
|
|
),
|
|
customImageSetupSession: (sessionId: string) =>
|
|
api.get<EnvironmentCustomImageSetupSessionResult>(
|
|
`/environment-custom-image-setup-sessions/${sessionId}`,
|
|
),
|
|
createCustomImageTerminalSessionToken: (
|
|
sessionId: string,
|
|
body: CreateEnvironmentCustomImageTerminalSessionToken = {},
|
|
) =>
|
|
api.post<EnvironmentCustomImageTerminalSessionToken>(
|
|
`/environment-custom-image-setup-sessions/${sessionId}/terminal-session-token`,
|
|
body,
|
|
),
|
|
finishCustomImageSetupSession: (
|
|
sessionId: string,
|
|
body: FinishEnvironmentCustomImageSetupSession = {},
|
|
) =>
|
|
api.post<EnvironmentCustomImageFinishResult>(
|
|
`/environment-custom-image-setup-sessions/${sessionId}/finish`,
|
|
body,
|
|
),
|
|
cancelCustomImageSetupSession: (
|
|
sessionId: string,
|
|
body: CancelEnvironmentCustomImageSetupSession = {},
|
|
) =>
|
|
api.post<EnvironmentCustomImageSetupSession>(
|
|
`/environment-custom-image-setup-sessions/${sessionId}/cancel`,
|
|
body,
|
|
),
|
|
rollbackCustomImageTemplate: (environmentId: string, companyId: string) =>
|
|
api.post<EnvironmentCustomImageRollbackResult>(
|
|
`/environments/${environmentId}/custom-image-template/rollback?${customImageCompanyQuery(companyId)}`,
|
|
{},
|
|
),
|
|
disableCustomImageTemplate: (
|
|
environmentId: string,
|
|
companyId: string,
|
|
options: { deleteProviderTemplate?: boolean } = {},
|
|
) =>
|
|
api.delete<EnvironmentCustomImageTemplate>(
|
|
`/environments/${environmentId}/custom-image-template?${customImageCompanyQuery(companyId)}&deleteProviderTemplate=${options.deleteProviderTemplate === true ? "true" : "false"}`,
|
|
),
|
|
};
|