Files
PaperClipAI/ui/src/api/environments.ts
T
Devin Foley 90ead239a8 feat(ui/server): name cross-company environment secret refs instead of calling them missing (#10577)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - Environment configs (sandbox providers, SSH) can bind stored company
secrets through `format: "secret-ref"` fields, picked in the environment
editor's secret picker
> - Environments are instance-scoped and shared by every company on an
instance, but the picker lists only the current company's secrets, so a
ref pointing at another company's secret renders as "Missing secret (…)"
in destructive styling
> - That state is indistinguishable from a genuinely deleted secret, so
operators "fix" a healthy binding by creating a duplicate secret in
their own company — the exact sequence that used to corrupt bindings
before #10576
> - This pull request adds an instance-gated metadata endpoint for an
environment's secret refs and teaches the picker to name a cross-company
secret and its owner honestly
> - The benefit is that operators can tell a healthy cross-company
binding from a broken one, and stop creating duplicate secrets

## Linked Issues or Issue Description

**Is your feature request related to a problem? Please describe.**

In the environment editor, a secret-ref field that points at a secret
owned by a different company shows "Missing secret (22095402…)" in red,
with "The previously selected secret is no longer available. Pick
another or remove the binding." The binding is actually healthy — the
current company's picker just cannot list the other company's secrets.
Operators react by creating a duplicate secret and re-pointing the
field.

**Describe the solution you'd like**

The editor should know the referenced secret's name, status, and owning
company (metadata only, never the value) and present a cross-company ref
neutrally, a deleted secret as deleted, and only an unknown id as
missing.

Related: #10576 (fixes the binding corruption this UI state used to
trigger).

## What Changed

- New `GET /environments/:id/secret-refs` returns `{ refs: [{
configPath, secretId, name, status, companyId, companyName }] }` for the
environment's config-derived secret refs. Values are never returned. The
route sits behind `assertCanAccessInstanceEnvironments`, the same gate
as environment editing.
- New `secretService.describeSecretRefs` loads that metadata across
companies; unknown ids are omitted.
- `SecretBindingPicker` reads an optional `SecretRefHintsContext` (keyed
by secret id). With a hint, a ref the company list cannot show renders
as `NAME — Owning Company` with neutral styling and the note "Owned by
the … company. The binding keeps working; selecting a secret from this
list re-points it here." A hint with `status: "deleted"` reports the
secret as deleted. Without hints, behavior is byte-identical to before —
agent editors and other picker users are unaffected.
- `CompanyEnvironments` fetches descriptors for the environment being
edited and provides them through the context.

## Verification

- `cd server && pnpm vitest run src/__tests__/environment-routes.test.ts
src/__tests__/secrets-service.test.ts` — new endpoint happy path, agent
403 (descriptors never computed), and embedded-Postgres coverage proving
cross-company names resolve and unknown ids drop out.
- `cd ui && pnpm vitest run src/components/SecretBindingPicker.test.tsx
src/components/JsonSchemaForm.test.tsx
src/pages/CompanyEnvironments.test.tsx` — hinted cross-company
rendering, hinted deleted secret, and unchanged no-hint fallback.
- `pnpm run typecheck` in `server` and `ui`.
- Manual: edit an environment whose secret-ref field references another
company's secret; the field names the secret and its owning company
instead of "Missing secret".

## Risks

- The endpoint exposes secret names and company names across companies
to instance-level environment editors. Those actors already manage
instance-shared environments (and instance admins are implicit members
of every company), so this reveals no secret material and no new reach;
the service method documents that callers must sit behind an
instance-level gate.
- UI change is additive and context-gated; pickers without a provider
render exactly as before.

## Model Used

Claude Fable 5 (`claude-fable-5`, Anthropic) via Claude Code — extended
thinking, agentic tool use (file edits, vitest/tsc runs). No other
models involved.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-07-31 16:46:26 -07:00

161 lines
6.0 KiB
TypeScript

import type {
CancelEnvironmentCustomImageSetupSession,
Environment,
EnvironmentCapabilities,
EnvironmentLease,
EnvironmentProbeResult,
EnvironmentCustomImageSetupSession,
EnvironmentCustomImageTemplate,
EnvironmentCustomImageTerminalSessionToken,
FinishEnvironmentCustomImageSetupSession,
StartEnvironmentCustomImageSetupSession,
CreateEnvironmentCustomImageTerminalSessionToken,
} from "@paperclipai/shared";
import { api } from "./client";
export interface EnvironmentCustomImageOverview {
activeTemplate: EnvironmentCustomImageTemplate | null;
/**
* `false` means the environment config changed since capture and runs fall
* back to the base image until a new image is captured. `null` when unknown.
*/
activeTemplateMatchesConfig?: boolean | null;
activeSession: EnvironmentCustomImageSetupSession | null;
latestSession: EnvironmentCustomImageSetupSession | null;
}
export type EnvironmentCustomImageReconciliation =
| { action: "relinked"; template: EnvironmentCustomImageTemplate }
| { action: "detached"; template: EnvironmentCustomImageTemplate };
export type EnvironmentUpdateResult = Environment & {
customImageReconciliation?: EnvironmentCustomImageReconciliation;
};
export interface EnvironmentCustomImageConnectionPayload {
type: string;
command?: string | null;
token?: string | null;
expiresAt?: string | null;
metadata?: Record<string, unknown> | null;
}
export interface EnvironmentCustomImageSetupSessionResult {
session: EnvironmentCustomImageSetupSession;
connectionPayload: EnvironmentCustomImageConnectionPayload | null;
}
export interface EnvironmentCustomImageFinishResult extends EnvironmentCustomImageSetupSessionResult {
template: EnvironmentCustomImageTemplate;
}
export interface EnvironmentCustomImageRollbackResult {
activeTemplate: EnvironmentCustomImageTemplate;
supersededTemplate: EnvironmentCustomImageTemplate;
}
function customImageCompanyQuery(companyId: string): string {
return `companyId=${encodeURIComponent(companyId)}`;
}
export interface EnvironmentSecretRefDescriptor {
configPath: string;
secretId: string;
name: string;
status: string;
companyId: string;
companyName: string | null;
}
export const environmentsApi = {
list: (companyId: string) => api.get<Environment[]>(`/companies/${companyId}/environments`),
capabilities: (companyId: string) =>
api.get<EnvironmentCapabilities>(`/companies/${companyId}/environments/capabilities`),
lease: (leaseId: string) => api.get<EnvironmentLease>(`/environment-leases/${leaseId}`),
secretRefs: (environmentId: string) =>
api.get<{ refs: EnvironmentSecretRefDescriptor[] }>(`/environments/${environmentId}/secret-refs`),
create: (companyId: string, body: {
name: string;
description?: string | null;
driver: "local" | "ssh" | "sandbox" | "plugin";
config?: Record<string, unknown>;
metadata?: Record<string, unknown> | null;
}) => api.post<Environment>(`/companies/${companyId}/environments`, body),
update: (environmentId: string, body: {
name?: string;
description?: string | null;
driver?: "local" | "ssh" | "sandbox" | "plugin";
status?: "active" | "archived";
config?: Record<string, unknown>;
metadata?: Record<string, unknown> | null;
}) => api.patch<EnvironmentUpdateResult>(`/environments/${environmentId}`, body),
probe: (environmentId: string, companyId?: string | null) =>
api.post<EnvironmentProbeResult>(
companyId
? `/environments/${environmentId}/probe?${customImageCompanyQuery(companyId)}`
: `/environments/${environmentId}/probe`,
{},
),
probeConfig: (companyId: string, body: {
name?: string;
driver: "local" | "ssh" | "sandbox" | "plugin";
description?: string | null;
config?: Record<string, unknown>;
metadata?: Record<string, unknown> | null;
}) => api.post<EnvironmentProbeResult>(`/companies/${companyId}/environments/probe-config`, body),
customImageTemplate: (environmentId: string, companyId: string) =>
api.get<EnvironmentCustomImageOverview>(
`/environments/${environmentId}/custom-image-template?${customImageCompanyQuery(companyId)}`,
),
startCustomImageSetupSession: (
environmentId: string,
companyId: string,
body: StartEnvironmentCustomImageSetupSession = {},
) =>
api.post<EnvironmentCustomImageSetupSessionResult>(
`/environments/${environmentId}/custom-image-setup-sessions?${customImageCompanyQuery(companyId)}`,
body,
),
customImageSetupSession: (sessionId: string) =>
api.get<EnvironmentCustomImageSetupSessionResult>(
`/environment-custom-image-setup-sessions/${sessionId}`,
),
createCustomImageTerminalSessionToken: (
sessionId: string,
body: CreateEnvironmentCustomImageTerminalSessionToken = {},
) =>
api.post<EnvironmentCustomImageTerminalSessionToken>(
`/environment-custom-image-setup-sessions/${sessionId}/terminal-session-token`,
body,
),
finishCustomImageSetupSession: (
sessionId: string,
body: FinishEnvironmentCustomImageSetupSession = {},
) =>
api.post<EnvironmentCustomImageFinishResult>(
`/environment-custom-image-setup-sessions/${sessionId}/finish`,
body,
),
cancelCustomImageSetupSession: (
sessionId: string,
body: CancelEnvironmentCustomImageSetupSession = {},
) =>
api.post<EnvironmentCustomImageSetupSession>(
`/environment-custom-image-setup-sessions/${sessionId}/cancel`,
body,
),
rollbackCustomImageTemplate: (environmentId: string, companyId: string) =>
api.post<EnvironmentCustomImageRollbackResult>(
`/environments/${environmentId}/custom-image-template/rollback?${customImageCompanyQuery(companyId)}`,
{},
),
disableCustomImageTemplate: (
environmentId: string,
companyId: string,
options: { deleteProviderTemplate?: boolean } = {},
) =>
api.delete<EnvironmentCustomImageTemplate>(
`/environments/${environmentId}/custom-image-template?${customImageCompanyQuery(companyId)}&deleteProviderTemplate=${options.deleteProviderTemplate === true ? "true" : "false"}`,
),
};