Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-23 09:07:46 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
572bef4ba7679451ac1543db25cb8ebd533bf919
PaperClipAI/maps/agent-access-map/gateways-profiles.md
T
DottaandPaperclip 9ef434fe79 docs: expose feature map IDs and add a recipe index (#16987) 
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Its feature map describes user journeys and their verification
paths.
> - The map already defines feature IDs and full capability IDs.
> - The README and child pages did not show those IDs consistently.
> - Readers need those IDs to connect issues, tests, stories, and
evidence.
> - This pull request adds a recipe index and displays the existing IDs.
> - The benefit is clear references across the product and agent access
maps.

## Linked Issues or Issue Description

**Issue type**

Missing documentation.

**Where is the issue?**

`maps/feature-map/README.md`, the child recipes, and their agent access
companions.

**What's wrong?**

The README sends readers to Storybook to browse features. Child pages
show local keys, such as `installation`, without the full
`plugins/installation` ID. Readers must inspect the generator to find
the full reference.

**Suggested fix**

List recipe links and existing IDs in the README. Show each feature ID
and full capability ID in its child pages. Explain capability IDs and
entry-point references. Keep the current keys and anchors.

Related work: Refs #15288. Refs #16052. Refs #15983. No duplicate open
PR or issue was found by title search.

## What Changed

- Add an index grouped by feature area. It lists every recipe, feature
ID, and full capability ID.
- Explain how IDs are formed and used in issues, tests, Storybook, and
evidence.
- Add feature IDs to all product recipes and agent access companions.
- Show full capability IDs beside recipe keys and below access and
Storybook guidance headings.
- Preserve existing keys, heading anchors, and generated ID values. Keep
the latest upstream company capability in the index.

## Verification

- `node scripts/check-maps.mjs` passes for 34 feature families and 175
capability IDs.
- `node --test scripts/check-maps.test.mjs
scripts/storybook-feature-index.test.mjs` passes all 17 tests.
- `node scripts/storybook-feature-index.mjs` passes on this checkout and
generates the feature indexes and overview inputs.
- `git diff --check` passes.
- A source comparison confirms that the README matches the recipe index.
After removal of the added ID labels, all 68 child pages match the
upstream prose and headings.
- Full workspace checks were attempted: `pnpm -r typecheck`, `pnpm
test:run`, and `pnpm build`. They could not start because the local pnpm
wrapper could not fetch and verify the pinned pnpm 9.15.4 release. This
checkout also has no workspace dependencies installed.
- `node scripts/storybook-catalog.mjs` could not run because
`storybook/internal/csf-tools` is not installed. The direct map and
index checks above pass without that dependency.
- Remote typecheck, release-registry, and full build checks passed. The
first attempts of [server shard
3/12](https://github.com/paperclipai/paperclip/actions/runs/39460473910/job/118758430448)
and [server shard
12/12](https://github.com/paperclipai/paperclip/actions/runs/39460473910/job/118758429932)
stopped after their runners received a shutdown signal. The test steps
were canceled. GitHub rejects the rerun request with HTTP 403: "The
workflow run containing this job is already running". Five other CI jobs
remain active. The next action is to rerun the two interrupted shards
after workflow 39460473910 ends. No application changes were made to
address these runner interruptions.
- To inspect the result, open the feature-map README, follow a recipe
link, and compare its full capability IDs with its access companion.

## Risks

- Low risk. The change updates map documentation only. It changes no
application code or ID schema.
- The readable README index and child labels repeat source IDs. Keep
them aligned when a capability changes.
- Generated capability descriptions now include the visible ID prefix.
Generated IDs, labels, navigation order, and verification fields remain
the same.
- Full local workspace checks and catalog generation remain unverified
for the environment reasons above.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

OpenAI Codex, model `gpt-6.1-sol`, with a 475,000-token context window
and `xhigh` reasoning effort. The model used local file tools, shell
commands, and GitHub CLI access.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-20 12:00:36 -05:00

218 lines
10 KiB
Markdown
Raw Blame History

# Tool gateways and access profiles — agent access
Product map: [Tool gateways and access profiles](../feature-map/gateways-profiles.md).
Feature ID: `gateways-profiles`.
Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
Native REST transport reconciled in this change; see the
[shared transport contract](README.md#native-rest-transport).
This is a source-reviewed baseline of representative operations and known gaps.
Each capability needs operation-level review before its entire scope can be
qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
for format, permission checks, evidence and maintenance.
## `gateway`
Capability ID: `gateways-profiles/gateway`.
Review: `baseline`.
API: `present` — representative operation IDs:
- `POST /api/companies/{companyId}/tools/gateways`.
Agent access: `restricted` — Board tools:admin REST; CLI connections/configuration where
supported.
Policy: Named gateway/profile administration and credentials are board tools:admin;
agent sessions/tool use use separate scoped authority.
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
at the reviewed commit above.
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
verify any listed agent request/result path separately. A delegated operation needs its
own policy and access review.
Gaps: No agent named-gateway management path; assigned tool use exists separately.
## `profiles`
Capability ID: `gateways-profiles/profiles`.
Review: `baseline`.
API: `present` — representative operation IDs:
- `POST /api/companies/{companyId}/tools/profiles`.
- `PATCH /api/tool-profiles/{profileId}`.
Agent access: `restricted` — Board management REST; agent receives effective tool
assignment.
Policy: Named gateway/profile administration and credentials are board tools:admin;
agent sessions/tool use use separate scoped authority.
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
at the reviewed commit above.
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
verify any listed agent request/result path separately. A delegated operation needs its
own policy and access review.
Gaps: Agent access to tools does not permit profile editing.
Backend evidence: [profile entry validation](../../server/src/__tests__/tool-profile-entry-validation.test.ts)
covers company-scoped selector references and bounded reads for a large immutable
runtime assignment. Batched validation retains the checks before profile and
entry writes. It grants no profile-management authority to agents.
## `client-connect`
Capability ID: `gateways-profiles/client-connect`.
Review: `baseline`.
API: `present` — representative operation IDs:
- `GET /api/tool-gateway/gateways/{gatewayId}/mcp`.
- `POST /api/tool-gateway/sessions`.
Agent access: `partial` — Agent REST / native `call_api` for scoped session creation
and revocation; existing MCP client protocol and assigned native app tools.
Policy: Named gateway/profile administration and credentials are board tools:admin;
agent sessions/tool use use separate scoped authority.
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
at the reviewed commit above.
Verification: `not-run` — exercise a listed permitted operation with actual agent
credentials/run context; inspect its result and applicable persistence/attribution.
Assert the relevant denied actor, owner, company or mode from Policy. Review the
remaining operations before qualifying the whole capability.
Gaps: Scoped sessions remain agent/run-bound. MCP requires its existing protocol
client; named gateways and gateway-token management retain board permissions.
Native assigned-tool results above 500,000 encoded bytes are stored as scoped response assets.
`read_tool_result` reads bounded JSON pages without repeating the upstream call,
including when generic `call_api` is disabled.
Each encoded page is at most 500,000 bytes and continues by byte offset until the
entire result has been read. Current run authority, same task
and agent, and asset/responsible-user access remain required. Provider content
stays untrusted. The
[response integration tests](../../server/src/services/native-runtime/runner-api.integration.test.ts)
cover full Unicode reconstruction after controller recreation, low-trust access,
foreign assets, paused agents, and one upstream execution. The
[native PRP regression](../../server/src/services/native-runtime/runner-tool-results-prp.integration.test.ts)
also verifies complete delivery of escape-heavy pages through native Runner,
including a text wrapper larger than the PRP command limit that is decoded before
command serialization. The
[opt-in live probe](../../server/src/__tests__/helpers/verify-assigned-tool-results-live.ts)
uses real Codex and Runner with a synthetic large upstream response; it does not
publish to an external service.
Discovery collapses identical descriptors with the same gateway name across
providers, including native assigned-tool startup and fresh searches. Conflicting
definitions remain an error. Distinct names and the normal invocation grants,
approvals and revocation checks remain independent. Regression coverage lives in
[gateway tests](../../server/src/__tests__/tool-gateway.test.ts) and
[assigned-tool tests](../../server/src/services/native-runtime/assigned-mcp-tools.test.ts);
these fixtures do not certify a live external-client journey.
Native assigned tools return bounded input-schema repair guidance after argument
validation fails. Rejection creates no execution receipt and discloses no submitted
values or unknown keys. Corrected calls keep the same authorization checks.
[Runner regressions](../../packages/paperclip-runner/runner/crates/runner-core/src/tests/provider_assigned_tool_validation.rs)
cover discovery repair and unauthorized calls; the
[Codex transport fixture](../../packages/paperclip-runner/runner/crates/runner-core/tests/support/codex_assigned_tool_validation.rs)
covers rejection, corrected dispatch, and completion with a simulated provider.
This does not establish live model or GitHub access.
Remote invocation regressions preserve access to authorized sibling tools after
a fetch failure, timeout, non-authentication HTTP error, or JSON-RPC rejection.
HTTP 401/403 and insufficient-scope errors keep their connection gates. The
gateway records each failed invocation and never automatically replays it.
This covers the gateway service with synthetic providers and a local HTTP
server, not a live external provider or all client surfaces.
## `tokens`
Capability ID: `gateways-profiles/tokens`.
Review: `baseline`.
API: `present` — representative operation IDs:
- `POST /api/tool-gateway/gateways/{gatewayId}/tokens`.
- `POST /api/tool-gateway/gateway-tokens/{tokenId}/revoke`.
Agent access: `restricted` — Board tools:admin token management.
Policy: Named gateway/profile administration and credentials are board tools:admin;
agent sessions/tool use use separate scoped authority.
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
at the reviewed commit above.
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
verify any listed agent request/result path separately. A delegated operation needs its
own policy and access review.
Gaps: Gateway-token management requires board tools:admin at the HTTP route.
A grant to use an app does not create this authority; native `call_api` preserves
the denial.
## `activity`
Capability ID: `gateways-profiles/activity`.
Review: `baseline`.
API: `present` — representative operation IDs:
- `GET /api/tool-gateway/audit`.
Agent access: `restricted` — Board tools:view_audit; agent receives its own tool
receipts/errors.
Policy: Named gateway/profile administration and credentials are board tools:admin;
agent sessions/tool use use separate scoped authority.
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
at the reviewed commit above.
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
verify any listed agent request/result path separately. A delegated operation needs its
own policy and access review.
Gaps: Audit management API exists but broad audit visibility is not an agent use-path
guarantee.
### Execution-host stdio assignments
Runner registers verified, session-local stdio servers from the execution host
with native Codex and through the shared ACPX runtime. ACPX clients must support
stdio MCP assignments. The transport uses each implementation's own schemas and
responses. Each binding requires a private Unix socket to identify the shared
resource whose calls are serialized. This is a separate binding alongside the
HTTP gateway; it does not create gateway/profile administration
authority. Tasks cannot supply these reserved environment inputs. Read-only
sessions omit them.
ACPX adapters use their applicable ACPX permission policy. Host-assigned native
Codex tools run without a new per-call prompt, matching existing execution-host shell
utilities. Explicit deny/prompt rules remain effective; requested approvals use
PRP with active thread/turn checks and one-time decisions. Preconfigured Claude
rejects interactive approval requests. See the [Runner contract](../../packages/paperclip-runner/README.md#assigned-local-mcp-servers).
Local fixture coverage: [binding validation](../../packages/paperclip-runner/src/drivers/stdio-mcp.test.ts),
[relay processes and cancellation](../../packages/paperclip-runner/runner/crates/runner-core/tests/stdio_mcp.rs),
and [approval projection](../../packages/paperclip-runner/src/drivers/codex/codex-question-adapter.test.ts).
Provider-client image and approval smoke tests used native Codex and Claude SDK;
that coverage is not an exhaustive adapter compatibility test.
Vendor-client evidence belongs in the PR. These checks do not
certify live external credentials, deployment isolation or gateway revocation.
Reference in new issue View Git Blame Copy Permalink