Files
PaperClipAI/packages/shared/src/validators/issue.test.ts
T
b13eb5b2b5 Skill Studio: three-pane skill IDE with sandboxed test runs (#9241)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - The Skills Manager gives operators a reusable skill layer, but
iteration still required manual edits, ad hoc prompts, and indirect run
inspection.
> - Skill authors need a focused workflow for editing skill files,
saving representative test inputs, and running those inputs through an
agent without exposing harness tasks as normal company work.
> - The backend therefore needs durable test inputs, reusable run
templates, hidden harness issues, scoped run execution, retention
metadata, and read-containment rules around hidden work.
> - The frontend needs a three-pane Studio that keeps skill files, saved
inputs/templates, and run output/history visible together while
preserving the existing design system and token rules.
> - This pull request ships that Skill Studio surface end to end:
database migrations, shared contracts, server APIs/services, hidden
harness execution behavior, UI routes/components, and focused tests.
> - The benefit is faster and safer skill iteration, with inspectable
outputs and fewer ways for internal harness work to leak into normal
task lists, costs, or adjacent read APIs.

## Linked Issues or Issue Description

No public GitHub issue exists for this feature. Feature request summary:

- Problem: Skill authors need to edit and test company skills in one
place instead of switching between the skill detail page, task creation,
run output, and manual prompt history.
- Proposed solution: Add a Skill Studio workbench with saved inputs,
reusable templates, hidden sandboxed test runs, live run status, output
inspection, run history, rerun/delete controls, and frontmatter-aware
editing.
- Expected users: Paperclip operators and agent-company maintainers who
create, fork, import, and tune skills.
- Related public PRs: Supersedes #9205, which was replaced so the public
PR branch name follows contributor policy.
- Duplicate search: searched public GitHub issues and PRs for "Skill
Studio"; no other active public issue or PR directly covers this
feature.

## What Changed

- Added database migrations for Skill Studio test inputs, test runs,
test run retention, and reusable run templates.
- Added shared Skill Studio types, validators, route helpers,
frontmatter utilities, and status handling.
- Added server services and routes for saved inputs, test runs,
templates, reruns, terminal-run deletion, hidden harness issue
execution, and run-detail hydration.
- Strengthened hidden-issue read containment across issue-adjacent
routes and cost rollups used by skill test harness work.
- Added the Skill Studio UI with skill file editing, frontmatter
editing, saved inputs, templates, run creation/cancel/rerun/delete
flows, output rendering, history, route support, and responsive pane
behavior.
- Added focused backend, shared, and UI tests for the new APIs, routing
logic, editor/run behavior, hidden-issue containment, and migration
safety.
- Rebased onto current `master`, removed the generated lockfile diff
from the PR, and verified no workflow files are changed.

## Verification

- [x] `pnpm --filter @paperclipai/db check:migrations`
- [x] `pnpm check:token-gates`
- [x] `pnpm exec vitest run
server/src/__tests__/company-skills-service.test.ts
server/src/__tests__/company-skills-routes.test.ts
server/src/__tests__/company-skill-test-runs-service.test.ts
ui/src/lib/skill-studio.test.ts ui/src/pages/SkillStudio.test.tsx` — 5
files, 132 tests passed
- [x] Greptile review on the latest PR head
- [x] GitHub PR checks on the latest PR head

## Risks

- Medium risk because this is a broad feature touching database schema,
server orchestration, issue visibility, and a large UI surface.
- Hidden harness issue containment is security-sensitive; this PR
includes regression coverage for adjacent read paths and cost rollups.
- The new migrations are additive and use idempotent guards where
applicable, but deployed databases that previously tested draft
migration numbers should still be checked carefully.
- The UI depends on a new resizable panels package in `ui/package.json`;
the lockfile is intentionally left to repository automation.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

OpenAI Codex, GPT-5 coding agent with shell, git, and GitHub CLI tool
use. Earlier feature commits include assistance from other Paperclip
coding agents; this PR preparation, rebase, cleanup commit, and PR body
were completed by OpenAI Codex in a Paperclip worktree.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-09 13:08:56 -05:00

421 lines
13 KiB
TypeScript

import { describe, expect, it } from "vitest";
import { MAX_ISSUE_REQUEST_DEPTH } from "../index.js";
import {
addIssueCommentSchema,
createIssueSchema,
issueBlockedInboxAttentionSchema,
resolveIssueRecoveryActionSchema,
respondIssueThreadInteractionSchema,
suggestedTaskDraftSchema,
updateIssueSchema,
upsertIssueDocumentSchema,
} from "./issue.js";
import { createAgentSchema } from "./agent.js";
describe("issue validators", () => {
it("passes real line breaks through unchanged", () => {
const parsed = createIssueSchema.parse({
title: "Follow up PR",
description: "Line 1\n\nLine 2",
});
expect(parsed.description).toBe("Line 1\n\nLine 2");
});
it("accepts null and omitted optional multiline issue fields", () => {
expect(createIssueSchema.parse({ title: "Follow up PR", description: null }).description)
.toBeNull();
expect(createIssueSchema.parse({ title: "Follow up PR" }).description)
.toBeUndefined();
expect(updateIssueSchema.parse({ comment: undefined }).comment)
.toBeUndefined();
});
it("normalizes JSON-escaped line breaks in issue descriptions", () => {
const parsed = createIssueSchema.parse({
title: "Follow up PR",
description: "PR: https://example.com/pr/1\\n\\nShip the follow-up.",
});
expect(parsed.description).toBe("PR: https://example.com/pr/1\n\nShip the follow-up.");
});
it("normalizes escaped line breaks in issue update comments", () => {
const parsed = updateIssueSchema.parse({
comment: "Done\\n\\n- Verified the route",
});
expect(parsed.comment).toBe("Done\n\n- Verified the route");
});
it("keeps issue attribution fields create-only", () => {
const created = createIssueSchema.parse({
title: "Preserve attribution input for route checks",
createdByUserId: "spoofed-creator",
responsibleUserId: "spoofed-responsible",
});
const updated = updateIssueSchema.parse({
title: "Do not update attribution",
createdByUserId: "spoofed-creator",
responsibleUserId: "spoofed-responsible",
});
expect(created.createdByUserId).toBe("spoofed-creator");
expect(created.responsibleUserId).toBe("spoofed-responsible");
expect(updated).not.toHaveProperty("createdByUserId");
expect(updated).not.toHaveProperty("responsibleUserId");
});
it("allows false-positive recovery resolutions to atomically restore the source issue status", () => {
expect(
resolveIssueRecoveryActionSchema.parse({
outcome: "false_positive",
sourceIssueStatus: "in_review",
}),
).toMatchObject({
outcome: "false_positive",
sourceIssueStatus: "in_review",
});
expect(
resolveIssueRecoveryActionSchema.safeParse({
outcome: "false_positive",
sourceIssueStatus: "blocked",
}).success,
).toBe(false);
expect(
resolveIssueRecoveryActionSchema.safeParse({
outcome: "false_positive",
}).success,
).toBe(false);
});
it("allows restored recovery resolutions to return the source issue to todo", () => {
expect(
resolveIssueRecoveryActionSchema.parse({
outcome: "restored",
sourceIssueStatus: "todo",
}),
).toMatchObject({
outcome: "restored",
sourceIssueStatus: "todo",
});
expect(
resolveIssueRecoveryActionSchema.safeParse({
outcome: "false_positive",
sourceIssueStatus: "todo",
}).success,
).toBe(false);
});
it("allows cancelled recovery resolutions to atomically restore the source issue status", () => {
expect(
resolveIssueRecoveryActionSchema.parse({
outcome: "cancelled",
sourceIssueStatus: "in_review",
}),
).toMatchObject({
outcome: "cancelled",
sourceIssueStatus: "in_review",
});
expect(
resolveIssueRecoveryActionSchema.safeParse({
outcome: "cancelled",
sourceIssueStatus: "blocked",
}).success,
).toBe(false);
expect(
resolveIssueRecoveryActionSchema.safeParse({
outcome: "cancelled",
}).success,
).toBe(false);
});
it("rejects recovery outcomes that are not supported by the source-scoped resolution endpoint", () => {
expect(
resolveIssueRecoveryActionSchema.safeParse({
outcome: "delegated",
}).success,
).toBe(false);
expect(
resolveIssueRecoveryActionSchema.safeParse({
outcome: "escalated",
}).success,
).toBe(false);
});
it("normalizes escaped line breaks in issue comment bodies", () => {
const parsed = addIssueCommentSchema.parse({
body: "Progress update\\r\\n\\r\\nNext action.",
});
expect(parsed.body).toBe("Progress update\n\nNext action.");
});
it("accepts structured issue comment presentation and metadata", () => {
const parsed = addIssueCommentSchema.parse({
body: "Paperclip needs a disposition before this issue can continue.",
authorType: "system",
presentation: {
kind: "system_notice",
tone: "warning",
title: "Needs disposition",
},
metadata: {
version: 1,
sourceRunId: "11111111-1111-4111-8111-111111111111",
sections: [
{
title: "Evidence",
rows: [
{ type: "key_value", label: "Cause", value: "successful_run_missing_state" },
{ type: "issue_link", label: "Source issue", identifier: "PAP-3440" },
{ type: "run_link", label: "Run", runId: "11111111-1111-4111-8111-111111111111" },
],
},
],
},
});
expect(parsed.presentation?.detailsDefaultOpen).toBe(false);
expect(parsed.metadata?.sourceRunId).toBe("11111111-1111-4111-8111-111111111111");
expect(parsed.metadata?.sections[0]?.rows).toHaveLength(3);
});
it("rejects arbitrary issue comment metadata", () => {
const parsed = addIssueCommentSchema.safeParse({
body: "Hidden details",
metadata: {
version: 1,
transcript: "raw log dump",
},
});
expect(parsed.success).toBe(false);
});
it("normalizes escaped line breaks in generated task drafts", () => {
const parsed = suggestedTaskDraftSchema.parse({
clientKey: "task-1",
title: "Follow up",
description: "Line 1\\n\\nLine 2",
});
expect(parsed.description).toBe("Line 1\n\nLine 2");
});
it("normalizes escaped line breaks in thread summaries and documents", () => {
const response = respondIssueThreadInteractionSchema.parse({
answers: [],
summaryMarkdown: "Summary\\n\\nNext action",
});
const document = upsertIssueDocumentSchema.parse({
format: "markdown",
body: "# Plan\\n\\nShip it",
});
expect(response.summaryMarkdown).toBe("Summary\n\nNext action");
expect(document.body).toBe("# Plan\n\nShip it");
});
it("clamps oversized requestDepth values on create", () => {
const parsed = createIssueSchema.parse({
title: "Clamp request depth",
requestDepth: MAX_ISSUE_REQUEST_DEPTH + 500,
});
expect(parsed.requestDepth).toBe(MAX_ISSUE_REQUEST_DEPTH);
});
it("defaults omitted create status to todo when an assignee is present", () => {
expect(createIssueSchema.parse({
title: "Assigned work",
assigneeAgentId: "22222222-2222-4222-8222-222222222222",
}).status).toBe("todo");
expect(createIssueSchema.parse({ title: "Unassigned work" }).status).toBe("backlog");
expect(createIssueSchema.parse({
title: "Deliberately parked",
assigneeAgentId: "22222222-2222-4222-8222-222222222222",
status: "backlog",
}).status).toBe("backlog");
});
it("defaults issue work mode to standard and accepts ask, planning, and skill_test", () => {
expect(createIssueSchema.parse({ title: "Plan first" }).workMode).toBe("standard");
expect(createIssueSchema.parse({ title: "Ask first", workMode: "ask" }).workMode).toBe("ask");
expect(createIssueSchema.parse({ title: "Plan first", workMode: "planning" }).workMode).toBe("planning");
expect(createIssueSchema.parse({
title: "Harness test",
workMode: "skill_test",
harnessKind: "skill_test",
})).toMatchObject({ workMode: "skill_test", harnessKind: "skill_test" });
expect(updateIssueSchema.parse({ workMode: "ask" }).workMode).toBe("ask");
expect(updateIssueSchema.parse({ workMode: "planning" }).workMode).toBe("planning");
expect(updateIssueSchema.parse({ workMode: "skill_test" }).workMode).toBe("skill_test");
expect(suggestedTaskDraftSchema.parse({
clientKey: "ask-child",
title: "Ask child",
workMode: "ask",
}).workMode).toBe("ask");
expect(suggestedTaskDraftSchema.parse({
clientKey: "planning-child",
title: "Plan child",
workMode: "planning",
}).workMode).toBe("planning");
expect(suggestedTaskDraftSchema.parse({
clientKey: "skill-test-child",
title: "Test child",
workMode: "skill_test",
}).workMode).toBe("skill_test");
});
it("validates blocked inbox attention payloads and requires redacted secret fields", () => {
const parsed = issueBlockedInboxAttentionSchema.parse({
kind: "blocked",
state: "needs_attention",
reason: "blocked_by_unassigned_issue",
severity: "critical",
stoppedSinceAt: "2026-05-09T12:00:00.000Z",
owner: { type: "unknown", agentId: null, userId: null, label: null },
action: { label: "Assign blocker", detail: "Assign the leaf blocker." },
sourceIssue: {
id: "11111111-1111-4111-8111-111111111111",
identifier: "PAP-1",
title: "Blocked source",
status: "blocked",
priority: "high",
assigneeAgentId: null,
assigneeUserId: null,
},
leafIssue: {
id: "22222222-2222-4222-8222-222222222222",
identifier: "PAP-2",
title: "Unassigned leaf",
status: "todo",
priority: "medium",
assigneeAgentId: null,
assigneeUserId: null,
},
recoveryIssue: null,
approvalId: null,
interactionId: null,
sampleIssueIdentifier: "PAP-2",
redaction: {
externalDetailsRedacted: false,
secretFieldsOmitted: true,
},
});
expect(parsed.redaction.secretFieldsOmitted).toBe(true);
expect(issueBlockedInboxAttentionSchema.safeParse({
...parsed,
redaction: { externalDetailsRedacted: false, secretFieldsOmitted: false },
}).success).toBe(false);
});
it("rejects unknown issue work modes", () => {
expect(createIssueSchema.safeParse({ title: "Plan first", workMode: "normal" }).success).toBe(false);
expect(suggestedTaskDraftSchema.safeParse({
clientKey: "bad-child",
title: "Bad child",
workMode: "analysis",
}).success).toBe(false);
});
it("clamps oversized requestDepth values on update", () => {
const parsed = updateIssueSchema.parse({
requestDepth: MAX_ISSUE_REQUEST_DEPTH + 1,
});
expect(parsed.requestDepth).toBe(MAX_ISSUE_REQUEST_DEPTH);
});
it("accepts the cheap model profile in issue assignee adapter overrides", () => {
const parsed = createIssueSchema.parse({
title: "Run a cheap heartbeat",
assigneeAdapterOverrides: {
modelProfile: "cheap",
},
});
expect(parsed.assigneeAdapterOverrides?.modelProfile).toBe("cheap");
});
it("rejects unknown issue model profile keys", () => {
const parsed = updateIssueSchema.safeParse({
assigneeAdapterOverrides: {
modelProfile: "fast",
},
});
expect(parsed.success).toBe(false);
});
it("validates agent runtime cheap model profile config without rejecting other runtime fields", () => {
const parsed = createAgentSchema.parse({
name: "Coder",
adapterType: "codex_local",
runtimeConfig: {
heartbeat: { enabled: true },
modelProfiles: {
cheap: {
enabled: true,
label: "Cheap Codex",
adapterConfig: {
model: "gpt-5.3-codex-spark",
},
},
},
},
});
expect(parsed.runtimeConfig.modelProfiles?.cheap?.adapterConfig).toEqual({
model: "gpt-5.3-codex-spark",
});
expect(parsed.runtimeConfig.heartbeat).toEqual({ enabled: true });
});
it("validates cheap model profile env bindings like top-level adapter config", () => {
const parsed = createAgentSchema.safeParse({
name: "Coder",
adapterType: "codex_local",
runtimeConfig: {
modelProfiles: {
cheap: {
adapterConfig: {
env: {
API_TOKEN: 123,
},
},
},
},
},
});
expect(parsed.success).toBe(false);
});
it("rejects unknown agent runtime model profile keys", () => {
const parsed = createAgentSchema.safeParse({
name: "Coder",
adapterType: "codex_local",
runtimeConfig: {
modelProfiles: {
fast: {
adapterConfig: {
model: "gpt-5-mini",
},
},
},
},
});
expect(parsed.success).toBe(false);
});
});