mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-13 07:12:00 +01:00
DottaandClaude Opus 5.5
491dfa1c6d
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Tool gateways let external MCP clients use a company's tools with a gateway client token > - A gateway client token is shown only once, to the caller that creates it > - Since delegated connection management (#17737), an agent can create a gateway client token for its responsible person > - In that case the agent receives the one-time token value, and it can repeat the value in chat > - This pull request makes gateway client token creation person-only > - The benefit is that the one-time token value goes only to the person who creates it in the gateway UI ## Linked Issues or Issue Description Refs #17737 **What happened** A person asked the CEO agent in chat to replace the token of a gateway client. The agent called `POST /api/tool-gateway/gateways/{gatewayId}/tokens` under delegated authority. The response gave the agent the new token value, and the agent put the value in its chat reply. **Expected behavior** An agent does not receive a gateway client token value. A person creates the token on the gateway's Tokens page and gives it to the client. The agent tells the person where to do this. **Steps to reproduce** 1. Give an agent delegated connection management for a responsible person with `tools:admin`. 2. As the agent, call `POST /api/tool-gateway/gateways/{gatewayId}/tokens` (for example through `call_api`). 3. See a 201 response that contains the new token value. ## What Changed - `POST /api/tool-gateway/gateways/:gatewayId/tokens` returns 403 `gateway_token_requires_person` to agent callers before it creates a token. The message is final. It gives the Tokens page path (`/<prefix>/apps/gateways/<gatewayId>/tokens`) and tells the agent not to ask for or repeat token values. The response also has `tokensPath`. - Board (person) callers are not changed. - The API catalog entry for the route now says that it is person-only. - Existing agent-issued tokens are not changed. Runtime issuer and responsible-user checks still apply to them. The integration tests now seed such tokens directly to keep that coverage. ## Verification - Red: the new integration test `never returns gateway client token plaintext to agent callers` fails on `master` (the agent `call_api` result is 201 with the token value). - Green: `cd server && npx vitest run src/__tests__/connection-management.integration.test.ts -t gateway` (24 passed). The test also checks that no token row is created for the agent, and that a person session still gets a 201 with the token. - `npx vitest run src/__tests__/tool-gateway.test.ts src/__tests__/openapi-routes.test.ts` (152 passed). - `npx vitest run src/services/native-runtime/runner-api.test.ts` (2090 passed). - `tsc --noEmit -p server`: no errors in the changed files. ## Risks - Behavior change: agents can no longer create gateway client tokens. A workflow that relied on that now gets a 403 that sends the person to the Tokens page. Agents can still revoke tokens and manage gateways under delegated authority. - Low migration risk: no schema change, and existing tokens keep working. ## Model Used - Anthropic Claude Opus 5.5 (`claude-opus-5-5`), tool use and code execution in Claude Code. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>