Files
PaperClipAI/ui/src/components/onboarding/ModelSourceTiles.tsx
T
DottaandPaperclip e38d6d16b6 feat(connections): add advanced provider setup and live browser qualification (#15341)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Users connect accounts and choose an agent harness and model.
> - The runtime change in #14970 supports custom providers on those
connections.
> - Normal setup must stay simple while advanced users can choose a
compatible gateway.
> - Shared connector rows and access controls keep these choices
consistent.
> - This pull request refines the agent setup UI and adds review stories
and repeatable browser qualification.
> - The qualification checks real tools and downloaded outputs, not only
a successful run status.

## Linked Issues or Issue Description

Refs #14970, #37, #13083, #14104, #14565, #12692.

The core implementation in #14970 is merged. This branch incorporates
its squash commit and targets `master`. Both PRs contain our
implementation. #14016 is a reference only and is not a dependency. This
PR has 96 changed files.

## What Changed

- Complete model-provider connector presentation beside other
connectors. Each row uses the existing Connect action and connection
list. Tags are stored without category UI. The base PR includes the
provider forms and routes.
- Show persistent Subscription, API Key, and Advanced choices. Label
Advanced as Custom Gateway. Reuse provider logos, connection lists, and
permissions controls. Default access to the organization and all agents
when permitted; keep narrowing controls under Advanced.
- Keep Configure reachable before subscription sign-in, so users can
select a supported environment when the default cannot sign in. Testing
and saving still require a connection. Show the execution environment in
Configure. Preserve the confirmed Connect choice. Editing a method,
credential, saved account, or advanced choice requires that current
choice to connect before testing or saving. Use matching model and
thinking-effort dropdowns and retain connection icons in selected
values.
- Preserve the new harness model default when switching an existing
OpenCode agent to Codex or Claude, and resolve user-selected model names
with the effective harness.
- Load popular OpenRouter models through the shared connection-model
discovery path. Keep explicit model lists and manual model entry
available.
- Group onboarding, connection setup, agent runtime, management,
recovery, and production-component stories under AI Connections /
Provider routing.
- Add an explicit-only provider-connections browser suite for managed
local or existing local/staging targets. Use private browser profiles
and credential handoffs. Support human-assisted subscription sign-in
without sharing passwords or tokens in reports.
- Verify persisted connection identity, runtime probes, tool execution,
exact artifact bytes, completion, and context-dependent follow-up.
Retain source/model provenance, cost bounds, closed error diagnostics,
original failures, and cleanup evidence.
- Add Gemini startup-model and skill-root fixes, Grok private-history
detection, ACP filesystem regression fixtures, selected-workspace
handling for local Hermes, and artifact-helper workspace fallback.
- Keep managed Grok runtime homes disposable. Remove host-side
transcript retention/restoration because private file modes do not
isolate same-user agent processes. Ignore earlier development archives
and use a fresh task handoff when history is unavailable. Verify the
absence of restored transcripts with a separate same-user process.
- Capture stopped-run diagnostics before deleting an attached-company
fixture agent. Track creation and owned sign-in receipts; revoke only
this attempt's accounts and never adopt a concurrent campaign's newly
created account. Preserve failure signals and final status through
cleanup.
- Require the requested environment in the saved agent and every run,
including follow-ups. Reject a forced incompatible target. Keep one
cancellation state through startup, every cell, reporting, and teardown
for SIGINT, SIGTERM, and SIGHUP. Stop further paid cells after
interruption. Document qualification limits.

## Verification

- Current head `b3bb3e94d577d43d9965a6b9daba039f599b2e49` includes
master `d9f600043`. The security fix in `a758fde31` passes full
workspace typecheck, production build, and 119 connection/Grok
regressions. The unchanged UI passes all 126
configuration/model-discovery tests and token gates. The final
published-guide correction passes Grok adapter typecheck. Earlier head
`eebd8225c` passed the complete deterministic runner suite (1,404 Vitest
tests and 128 Node tests) and all CI jobs. Current-head CI run
`37520147514` passed all 47 jobs, including the full sharded Vitest and
browser matrix, production build, and canary dry run. All 55 checks
completed: 53 successes and two expected skips. The current-head
security scan passed, Greptile is 5/5, and no review threads remain
open.
- A separate same-user process reproduced reading a restored Grok
transcript before the security fix. The regression now finds no
transcript. Existing fresh-session fallback and ordinary session
metadata behavior pass.
- The final account-choice and cleanup fixes pass 85 setup tests and 26
qualification-harness tests. Regressions verify that editing a
connection invalidates confirmation, Configure remains reachable before
sign-in, diagnostics are captured before fixture deletion, and
concurrent campaigns cannot adopt or revoke each other's accounts. UI
and E2E typechecks pass.
- The Storybook build and actual Chromium production-component stories
passed during this change. Review the neighboring AI Connections /
Provider routing stories, regular connector rows, three connection
modes, model discovery, and the single execution-environment control in
Configure.
- Cancellation smoke verified authenticated cleanup before browser close
for SIGINT, SIGTERM, and SIGHUP. Regressions cover interruption during
startup and reporting, missing-file ACP resource errors, and preserved
permission denials. Both ACP runtime versions and 54 ACPX/Grok
regressions passed. The deterministic connection-intent browser suite
passed two tests.
- Historical local qualification retained 43 passing API/gateway cells
out of 46, with downloaded outputs and follow-up receipts. These
attempts span earlier builds; they do not qualify this exact commit or
staging. Subscription combinations, Gemini overloads, and the unresolved
follow-up failure remain recorded rather than counted as passing.
- Use `pnpm test:e2e:runner -- --list --suite provider-connections` to
inspect the matrix. Follow `tests/runner-e2e/PROVIDER-CONNECTIONS.md`
for credentials, target URL, sign-in assistance, budget, evidence, and
cleanup. Paid live tests remain opt-in.

## Risks

- The core implementation in #14970 is merged. This PR adds no database
migration of its own.
- Subscription login needs an interactive provider session. Dedicated
accounts and staging qualification remain follow-up work; this PR does
not certify every login combination for production.
- Managed Grok transcript resume is deferred until provider history has
an OS isolation or authorized broker solution. Follow-ups start fresh
with Paperclip task context; earlier live Grok results do not qualify
this behavior.
- Gemini CLI 0.58.0 has an upstream ACP new-file error conversion
defect. Live overloads and one unresolved follow-up timeout remain
recorded. The stock CLI is unchanged, and those cases are not marked as
passing.
- Real-provider tests spend credits and use private credential/evidence
directories. The launcher requires explicit selection and checks target
ownership. It must not attach to a developer's database by accident.
- OpenClaw Gateway, Hermes Gateway, Claude Managed, AWS AgentCore,
Process, HTTP, and legacy ACPX local remain outside custom provider
setup.

## Model Used

OpenAI GPT-6 through Codex, with reasoning, repository tools, code
execution, and browser testing. The exact deployment model ID and
context window size were not exposed in this session.

## Checklist


- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-06 15:21:22 -05:00

242 lines
9.0 KiB
TypeScript

import { useRef, type ReactNode } from "react";
import { AnimatePresence, motion } from "motion/react";
import { cn } from "../../lib/utils";
import {
SOURCE_EXIT_FADE,
SOURCE_COLLAPSE_MOVE,
TAG_SWAP_ENTER,
TAG_SWAP_EXIT,
TAG_SWAP_TRAVEL,
} from "./onboarding-motion";
/**
* The connect step's row of model sources, and the tag under each one saying
* which credential the source would be reached with.
*
* Presentational only — the caller owns which source is picked and which
* credential mode is in force, because both outlive this row: the mode is set
* by a checkbox that sits below it, and the selection drives the step's CTA.
*/
/** How a source gets authenticated. Every tile is in the same mode at once. */
export type CredentialMode = "subscription" | "api";
export type ModelConnectionMode = CredentialMode | "advanced";
export type ModelSource = {
id: string;
label: string;
/** The brand mark, rendered into a 30px square. */
icon: ReactNode;
/** Override the row's credential mode; null leaves the tag slot empty. */
credentialMode?: ModelConnectionMode | null;
};
const CREDENTIAL_TAG_LABEL: Record<ModelConnectionMode, string> = {
subscription: "Subscription",
api: "API key",
advanced: "Custom Gateway",
};
/**
* The credential tag, swapping in a fixed-height slot.
*
* The slot has to hold its height whatever is in it: the tag is the last line
* of the tile, and a label that measured itself would resize the tile mid-swap
* and nudge the two beside it. `overflow-hidden` is doing real work too — it is
* what makes the outgoing label fall out of frame rather than slide past the
* tile's padding and over the row below.
*/
export function CredentialTag({ mode }: { mode: ModelConnectionMode }) {
return (
<span className="relative flex h-4 w-full items-center justify-center overflow-hidden text-(length:--text-micro) text-muted-foreground">
<AnimatePresence initial={false} mode="sync">
<motion.span
key={mode}
className="absolute inset-0 flex items-center justify-center whitespace-nowrap"
initial={{ opacity: 0, y: TAG_SWAP_TRAVEL }}
animate={{ opacity: 1, y: 0, transition: TAG_SWAP_ENTER }}
exit={{ opacity: 0, y: TAG_SWAP_TRAVEL, transition: TAG_SWAP_EXIT }}
>
{CREDENTIAL_TAG_LABEL[mode]}
</motion.span>
</AnimatePresence>
</span>
);
}
function ModelSourceTile({
source,
mode,
selected,
onSelect,
buttonRef,
settling,
}: {
source: ModelSource;
mode: ModelConnectionMode | null;
selected: boolean;
onSelect: () => void;
buttonRef: (node: HTMLButtonElement | null) => void;
settling: boolean;
}) {
return (
<button
ref={buttonRef}
type="button"
role="radio"
aria-checked={selected}
onClick={onSelect}
className={cn(
"flex min-w-0 flex-1 cursor-pointer flex-col items-center gap-1.5 self-stretch rounded-md border p-3",
// Longer while the row is settling back to its default. Dropping the
// selection is the last thing that happens on the way out, and at the
// interaction duration it landed as a colour swap after everything else
// had stopped — a cut rather than a release. Across the tile's travel
// it reads as the choice being let go.
"transition-(--tp-border-color-background-color) ease-(--motion-ease-standard)",
settling ? "duration-(--motion-duration-slow)" : "duration-(--motion-duration-fast)",
// Focus is a ring, never a border. The stroke has exactly one job here
// and lending it to focus as well would mean tabbing across the row
// looked like picking every tile in turn.
"outline-none focus-visible:ring-ring/50 focus-visible:ring-(length:--rad-3)",
// Selection is a lighter surface *and* a brighter edge. An earlier pass
// here used the fill alone, reasoning that a bright stroke on one tile
// made the row read as one outlined object beside a plain one. The
// design does both, and it is right: at these sizes one step of fill is
// too quiet to answer "which did I pick?" from across the screen, and
// the stroke is what carries it.
//
// Hover stops short of the selected fill, so pointing at a tile says
// "this one is live" rather than "this one is chosen".
selected
? "border-foreground/40 bg-accent"
: "border-border bg-card hover:bg-accent/40",
)}
>
<span className="flex size-(--sz-30px) shrink-0 items-center justify-center">
{source.icon}
</span>
{/*
One step up the named ladder each — the source name from text-xs (12px)
to --text-compact (13px), the tag under it from --text-nano (10px) to
--text-micro (11px), keeping the two a step apart. Both use the
font-size-only token form, so the line box comes from the tile's own
rhythm rather than the Tailwind scale's paired line-height.
*/}
<span className="text-(length:--text-compact) font-medium text-foreground">
{source.label}
</span>
{mode ? <CredentialTag mode={mode} /> : <span aria-hidden className="h-4" />}
</button>
);
}
export function ModelSourceTiles({
sources,
mode,
selectedId,
onSelect,
label,
collapsed = false,
settling = false,
}: {
sources: ModelSource[];
mode: ModelConnectionMode;
/** `null` before anything has been picked — the step opens this way. */
selectedId: string | null;
onSelect: (id: string) => void;
label: string;
/**
* Show only the chosen source, centred.
*
* The row is a question, and once a sign-in is running it has been answered —
* leaving the alternative on screen invites a press that would have to cancel
* a live server session to honour. Collapsing says the choice is made without
* disabling anything, which reads better than a greyed-out tile.
*/
collapsed?: boolean;
/**
* The row is returning to its default. Only changes how long the selected
* styling takes to leave — see the tile's own note.
*/
settling?: boolean;
}) {
const tiles = useRef(new Map<string, HTMLButtonElement>());
/**
* Arrow keys move the selection and the focus together, which is what a
* radio group is expected to do — without it the role would be announced and
* then not behave, which is worse than plain buttons. Selection wraps at both
* ends; three tiles is short enough that stopping at the edges just reads as
* the key having failed.
*/
const moveSelection = (delta: number) => {
if (sources.length === 0) return;
const current = sources.findIndex((source) => source.id === selectedId);
// Nothing picked yet: either arrow enters the row from the near end.
const from = current === -1 ? (delta > 0 ? -1 : 0) : current;
const next = (from + delta + sources.length) % sources.length;
const target = sources[next]!;
onSelect(target.id);
tiles.current.get(target.id)?.focus();
};
const shown = collapsed ? sources.filter((source) => source.id === selectedId) : sources;
return (
<div
role="radiogroup"
aria-label={label}
className={cn("flex items-start gap-3", collapsed && "justify-center")}
onKeyDown={(event) => {
// Collapsed, the row is a statement rather than a choice; arrow keys
// would move a selection that is no longer being asked for.
if (collapsed) return;
if (event.key === "ArrowRight" || event.key === "ArrowDown") {
event.preventDefault();
moveSelection(1);
} else if (event.key === "ArrowLeft" || event.key === "ArrowUp") {
event.preventDefault();
moveSelection(-1);
}
}}
>
{/*
`popLayout` takes the leaving tile out of flow at once, so the survivor's
`layout` animation targets its final centred position rather than
chasing a gap that is still closing.
The wrapper carries the width, not the tile: held at the width it had
with two in the row, so the kept tile travels without also growing.
*/}
<AnimatePresence initial={false} mode="popLayout">
{shown.map((source) => (
<motion.div
key={source.id}
layout
transition={SOURCE_COLLAPSE_MOVE}
exit={{ opacity: 0, transition: SOURCE_EXIT_FADE }}
className={cn(
"flex min-w-0",
collapsed ? "w-(--sz-source-tile-two-up)" : "flex-1",
)}
>
<ModelSourceTile
source={source}
mode={source.credentialMode === undefined ? mode : source.credentialMode}
selected={source.id === selectedId}
onSelect={() => onSelect(source.id)}
settling={settling}
buttonRef={(node) => {
if (node) tiles.current.set(source.id, node);
else tiles.current.delete(source.id);
}}
/>
</motion.div>
))}
</AnimatePresence>
</div>
);
}