mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-20 15:09:57 +02:00
## Thinking Path > - Paperclip is the open source control plane for agent companies. > - People choose a harness when creating an agent. > - The server should resolve that harness to a qualified runner. > - Codex is the first harness in the staged default rollout. > - Saved agents must retain their execution choices. > - New Codex agents therefore use Paperclip Runner on qualified macOS/Linux targets, with an explicit Legacy override. ## Linked Issues or Issue Description Refs #16028, #15555, #15673, #15422, #15631, #15926, #15932, #16149. The runtime/install prerequisite and release repair are merged. This slice owns Codex creation, setup, configuration and preservation. Other harness defaults remain unchanged. It adds no database migration; incoming master migrations, required maps and regression coverage are retained. ## What Changed - Resolve `runner: auto | paperclip | legacy` at the common creation boundary across onboarding, API/CLI, hires, built-ins, plugins and imports. Freeze pending hires and export resolved execution choices. - Preserve existing runners on upgrades, unrelated edits and import updates, including compatible accounts, workspace settings, Codex effort and intentional clears. - Use the underlying harness picker and branding; put the runner override in Advanced. Use the shared dropdown and update production-component stories and creation contracts. - Support qualified Apple Silicon, Intel Mac, Linux x64 and Linux ARM64. Linux requires GNU libc 2.39+. Disabled, external, unsupported and unqualified combinations retain their applicable Legacy execution. - Test the selected runtime/account/model/environment. Ordinary Connect probes eligible immutable managed targets and refreshes scoped discovery. Creation/discovery do not provision. Auth, dependency, incompatible-setting and cleanup failures remain actionable without changing runners. - Keep setup probes read-only, preserve local/SSH isolation and resolve packaged assets before staging credentials. Bound cleanup reads by the remaining absolute deadline; physically close every owned ingress socket before endpoint release. Unconfirmed cleanup retains recovery state. - Preserve validated completed-onboarding callbacks through startup recovery. First file-producing work belongs to the child task and uses the existing dependency/block handoff and task-scoped registration. - Reuse existing E2E fixtures, artifact checks, reporting and controls. Keep Docker/Cargo/native compilation remote. Paperclip tarballs contain no Codex payloads; official optional npm platform dependencies remain. ## Verification Current tested head: `1c03a8815672d82c264a9b08d4ea1984e8fae107`. **Merge-ready: required CI, fresh review, package qualification, Mac core acceptance and Test task/follow-up acceptance pass.** The existing attachment and native-continuity oracles independently verify both Test downloads, run attribution and unchanged native/provider/workspace identities. The maintainer authorized a code-owner-review exception for this PR only. The first Test setup failure and normal Board completion-review friction are retained below. Actual post-merge packages and private Cloud distribution remain separate qualification gates. - [Current CI](https://github.com/paperclipai/paperclip/actions/runs/38564241625): all 48 ordinary jobs and required verify/E2E pass. Attempt 1 retained six simultaneous host-shutdown cancellations. One failed-only retry passes those six lanes and two aggregates, preserving 40 successes. Actual integration checkout `53104c1` combines this head with master `c80`; it is not relabeled as the branch tree. Fresh exact-head Greptile 5/5, 30 resolved threads, no actionable findings. - [Exact-source package qualification](https://github.com/paperclipai/paperclip/actions/runs/38565287239): nine applicable jobs pass, nine conditional jobs skip. Four remote native producers; Linux x64 clean install; Intel Mac, Apple Silicon and Linux ARM64 native startup/physical cleanup controls. All 18 tarballs/four daemon source/hash/manifest bindings and 343 migrations through 0344 verify. No Codex payload is packed. These hosted tarballs are not a published npm canary. - Normal Apple Silicon installation and credential-free native startup/cleanup pass using the packaged daemon, with no source build or provider turn. Fresh installed DB initialization passes. Upgrade 651a→1c03 preserves all three complete execution configs, accounts, ten recorded run profiles, paused budgets, active incidents, cost summaries and two historical unpriced events. Historical recovery state is retained. - Cleanup regressions: four delayed-read baseline failures become 15 passing deadline/authority controls. No-acknowledgement and prior-error socket ownership regressions become 12 passing controls. Direct runtime/server types, maps: 35 areas / 176 IDs, diff checks and independent reviews pass. Permission/auth/reconnect policy and the 10-second setup budget remain intact. - Existing source coverage includes creation/selection/imports, pending approvals, recovery, account/lifecycle handling, mounted forms, dropdowns and E2E support. Full typechecks/tests/build/token and applicable Storybook checks pass in the recorded current CI; no duplicate suite or weakened grader. - Literal 9546 live Mac proof: ordinary Auto Codex onboarding, useful document, real completed-child callback/reply, seven successful native runs, manual follow-up and independently downloaded1,101-byte child file. Existing Legacy title edit/reload preserves execution; two real Legacy runs produce independently checked15/34-byte files. These remain historical source records. - Current literal 1c03 Mac core acceptance passes independent checks: ordinary Auto native Codex onboarding without runner override; only timeout 180 seconds/concurrency 1 saved; six successful native runs and six serialized turns (maximum overlap 1); both same-task continuity checks and five mechanical callback checks; actual rendered parent reply and exact child downloads. The useful handoff advances from revision 1 to 2. Both files are 48 bytes, SHA-256 `8b742bd4e8123a7c078f0a8d9f3449fbfa8a320d7d90be641a2818db3c53d92c` and `f42db9774fa06e804ab7d596fc8b922a2b638921c418b87d0111151d290a6afe`; exactly one byte changes and old history remains. The agent is paused with zero active runs/errors. Both artifact work products have `isPrimary=false`, and descriptive titles fail a stricter title-helper assumption; these retained results are scoped editorial follow-up, not new merge gates. Six source-bound screenshots are uploaded and verified in the private primary QA report. - [Literal 9546 managed proof](https://d1p6rlowie26tp.cloudfront.net/runner-e2e/campaigns/gha-38485488621-1/index.html): original 19 assertions and completed judge pass, four native turns, child-bound240-byte file and session/workspace continuity. Checkout reports a verified generated target-lock mutation; full final porcelain was not retained. Signed execution-image identity remains separate from Core source. - Actual 651a Test deployment succeeds on one owned/pinned target. One ordinary Auto API-key Connect then fails native cleanup before hire. Controller turn/drain/suspend completion and service-recorded environment cleanup are observed; they do not certify physical deletion or native authority retirement. Failure/recovery/unknown holds are retained. No Legacy switch or unchanged paid retry. The two source repairs above require actual treatment. - [Current immutable Core preview](https://github.com/paperclipai/paperclip/actions/runs/38570365725) and matching DB/shared artifacts pass. One owned, pinned Test target serves exact `1c03`; identical migration history correctly skips the migrator. Ordinary Auto Codex Connect succeeds and hires native; saved native selection and QA bounds survive reload. The initial child preparation attempt fails before provider work, with actual stdout identifying `renewal_deadline`; its trigger remains unknown and the failure is retained. Normal Board **Try again** and **Resume** recover the child to Done, producing a browser-verified 44-byte file, SHA-256 `0a8458b1efcc2d7a0d815689458c4caab039a46c7c7a3e5805de6bc8b1a96ecc`. The actual parent callback reports the completed child document/file. The existing validator requires a parent-owned attachment, so recovery enters normal Review; after byte checking, normal **Approve completion** reaches parent Done. No forced status or duplicate parent file is used. The validator is unchanged from integrated and current master. Autonomous initial callback-to-Done is not proven. The same-child follow-up completes document revision 2 and publishes a second independently downloaded 44-byte file, SHA-256 `22022257300fae762784632d08d3bbe0bab61e2ce81f91864a14dcd7aa464591`; only the revision digit changes. The unchanged existing native-continuity and attachment oracles pass. All ten recorded runs are terminal: nine native successes and the retained pre-provider setup failure. The QA agent is paused with zero active runs. The pre-existing parent evidence scope mismatch is a separate follow-up, with ordinary completion review exercised rather than a forced status or relaxed validation. This unsigned Core preview remains distinct from post-merge private Cloud composition. ## Risks - Saved agents are not migrated. Explicit runner changes use normal configuration/session rules; historical runs retain their recorded execution. - Native readiness depends on verified assets and server-owned target qualification. A Legacy probe, HTTP200 or successful account save cannot prove native readiness. - Recovery exceptions remain restricted to validated completed-onboarding reports; process-loss, ownership and terminal-state safeguards remain active. Unexecuted live journeys stay open. - Linux ARM paid tasks, Windows, Alpine and 32-bit ARM remain deferred. Cold Cargo cache misses are recorded; no warm-cache speedup is claimed. - Historical invoices/physical cleanup remain unconfirmed and held. After merge, exact published npm canary, signed standard image/migrator, private composition and serving/live acceptance still require qualification. Production deployment/default promotion is not authorized. ## Model Used OpenAI Codex, GPT-6 family, with reasoning, tools, code execution and parallel agents. Exact serving snapshot and context-window size are not exposed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used with available version and capability details - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have linked public issues or PRs above - [x] I have not referenced internal/instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal ticket id - [x] I have run the stated focused tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation - [x] I have considered and documented risks - [x] All Paperclip CI gates are green on the current candidate - [x] Greptile is 5/5 with no open findings on the current candidate - [x] I will address all reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
191 lines
8.8 KiB
TypeScript
191 lines
8.8 KiB
TypeScript
import { normalizePaperclipOperationalSkillPreference } from "../../packages/adapter-utils/src/server-utils.js";
|
|
import { isDeepStrictEqual } from "node:util";
|
|
import type { RunnerApi } from "./api.js";
|
|
import { deleteDaytonaEnvironment, installFixtureDaytonaProvider, type LiveFixtureValues } from "./live-fixtures.js";
|
|
import { isImmutableDaytonaImage } from "./catalog.js";
|
|
import type { CredentialName, MatrixExecution } from "./types.js";
|
|
|
|
export const MANAGED_FIRST_TASK_CELL = "confirmation-replies.runner-codex.daytona.task-card-accept";
|
|
export function isManagedFirstTask(execution: Pick<MatrixExecution, "id">): boolean {
|
|
return execution.id === MANAGED_FIRST_TASK_CELL;
|
|
}
|
|
|
|
interface FirstTaskRuntimeBound {
|
|
timeoutSec: 180;
|
|
maxConcurrentRuns: 1;
|
|
before: Record<string, unknown>;
|
|
after: Record<string, unknown>;
|
|
}
|
|
|
|
export type FirstTaskFixtureValues = LiveFixtureValues & {
|
|
onboardingRuntimeBound?: FirstTaskRuntimeBound;
|
|
};
|
|
|
|
export async function startFirstTaskWithRuntimeBound(input: {
|
|
api: Pick<RunnerApi, "get" | "patch">;
|
|
execution: MatrixExecution;
|
|
agent: Record<string, any>;
|
|
observe: (bound: FirstTaskRuntimeBound) => void;
|
|
start: () => Promise<void>;
|
|
}): Promise<void> {
|
|
if (input.execution.profile.id === "runner-codex") {
|
|
const snapshot = (agent: Record<string, any>) => structuredClone(Object.fromEntries([
|
|
"id", "companyId", "adapterType", "adapterConfig", "runtimeConfig", "permissions", "defaultEnvironmentId", "budgetMonthlyCents", "metadata",
|
|
].map(key => [key, agent?.[key]]))) as Record<string, any>;
|
|
const before = snapshot(input.agent);
|
|
if (!before.id || !before.companyId || before.adapterType !== "paperclip_runner" || before.adapterConfig?.provider !== "codex") {
|
|
throw new Error("First-task runtime bound requires the wizard's original native Codex selection");
|
|
}
|
|
const agentPath = `/api/agents/${encodeURIComponent(before.id)}`;
|
|
if (!isDeepStrictEqual(snapshot(await input.api.get(agentPath)), before)) {
|
|
throw new Error("The automatic wizard configuration changed before the first-task runtime bound");
|
|
}
|
|
const runtimeConfig = { ...before.runtimeConfig, heartbeat: { ...before.runtimeConfig?.heartbeat, maxConcurrentRuns: 1 } };
|
|
await input.api.patch(agentPath, { adapterConfig: { timeoutSec: 180 }, runtimeConfig });
|
|
const after = snapshot(await input.api.get(agentPath));
|
|
const expected = { ...before, adapterConfig: { ...before.adapterConfig, timeoutSec: 180 }, runtimeConfig };
|
|
if (!isDeepStrictEqual(after, expected)) {
|
|
throw new Error("The first-task runtime bound was not confirmed with the original execution and account settings");
|
|
}
|
|
input.observe({ timeoutSec: 180, maxConcurrentRuns: 1, before, after });
|
|
}
|
|
await input.start();
|
|
}
|
|
|
|
export async function provisionFirstTaskFixtures(input: {
|
|
api: Pick<RunnerApi, "get" | "patch" | "postSensitive"> & Partial<Pick<RunnerApi, "post" | "delete">>;
|
|
execution: MatrixExecution;
|
|
nonce: string;
|
|
daytonaImage?: string;
|
|
company: LiveFixtureValues["company"];
|
|
credentials: Partial<Record<CredentialName, string>>;
|
|
}): Promise<FirstTaskFixtureValues> {
|
|
const { api, execution, nonce, company, credentials } = input;
|
|
const managed = isManagedFirstTask(execution);
|
|
if (
|
|
!["first-task", "completion-updates", "confirmation-replies"].includes(execution.suite.id) || execution.task.flow !== "first_task" ||
|
|
(execution.environment.id !== "local" && !managed) ||
|
|
![
|
|
"legacy-codex",
|
|
"legacy-claude",
|
|
"runner-codex",
|
|
"runner-acpx-claude",
|
|
].includes(execution.profile.id)
|
|
) {
|
|
throw new Error(
|
|
"First-task fixtures require a supported local onboarding profile",
|
|
);
|
|
}
|
|
if (managed && (!isImmutableDaytonaImage(input.daytonaImage) || !api.post || !api.delete)) {
|
|
throw new Error("Managed onboarding requires the immutable image and normal environment create/cleanup APIs");
|
|
}
|
|
const required = managed ? [execution.profile.credential, "DAYTONA_API_KEY" as const] : [execution.profile.credential];
|
|
for (const name of required) if (!credentials[name]) throw new Error(`Missing credential ${name}`);
|
|
const previousSettings = managed ? await api.get<{
|
|
defaultEnvironmentId: string | null;
|
|
experimental: { enableManagedSandboxOnly: boolean };
|
|
}>("/api/instance/settings") : null;
|
|
if (managed && (!previousSettings ||
|
|
(previousSettings.defaultEnvironmentId !== null && typeof previousSettings.defaultEnvironmentId !== "string") ||
|
|
typeof previousSettings.experimental?.enableManagedSandboxOnly !== "boolean")) {
|
|
throw new Error("Managed onboarding fixture prior instance settings could not be read");
|
|
}
|
|
await api.patch(`/api/companies/${company.id}`, { budgetMonthlyCents: 500 });
|
|
let localEnvironment: LiveFixtureValues["environment"] | undefined;
|
|
if (!managed) {
|
|
const environments = await api.get<Array<LiveFixtureValues["environment"]>>(`/api/companies/${company.id}/environments?driver=local`);
|
|
localEnvironment = environments.find(candidate => candidate.driver === "local");
|
|
if (!localEnvironment) throw new Error("Onboarding fixture local environment missing");
|
|
}
|
|
const secretRefs: LiveFixtureValues["secretRefs"] = {};
|
|
for (const name of required) {
|
|
const secret = await api.postSensitive<{ id: string }>(`/api/companies/${company.id}/secrets`, {
|
|
name: `First task ${name}`, key: name, value: credentials[name],
|
|
});
|
|
secretRefs[name] = { type: "secret_ref", secretId: secret.id, version: "latest" };
|
|
}
|
|
let environment: LiveFixtureValues["environment"];
|
|
let teardown = async () => {};
|
|
if (managed) {
|
|
const remoteApi = api as Pick<RunnerApi, "post" | "delete">;
|
|
await installFixtureDaytonaProvider(remoteApi, execution);
|
|
environment = await remoteApi.post<LiveFixtureValues["environment"]>(`/api/companies/${company.id}/environments`,
|
|
execution.environment.buildEnvironment({ secretRefs, daytonaImage: input.daytonaImage, executionId: nonce }));
|
|
let restoreDefault = false;
|
|
let restoreManagedOnly = false;
|
|
let environmentDeleted = false;
|
|
teardown = async () => {
|
|
const failures: unknown[] = [];
|
|
if (restoreManagedOnly) {
|
|
try {
|
|
await api.patch("/api/instance/settings/experimental", { enableManagedSandboxOnly: previousSettings!.experimental.enableManagedSandboxOnly });
|
|
restoreManagedOnly = false;
|
|
} catch (error) { failures.push(error); }
|
|
}
|
|
if (restoreDefault) {
|
|
try {
|
|
await api.patch("/api/instance/settings", { defaultEnvironmentId: previousSettings!.defaultEnvironmentId });
|
|
restoreDefault = false;
|
|
} catch (error) { failures.push(error); }
|
|
}
|
|
if (!restoreDefault && !environmentDeleted) {
|
|
try {
|
|
await deleteDaytonaEnvironment(remoteApi, environment.id);
|
|
environmentDeleted = true;
|
|
} catch (error) { failures.push(error); }
|
|
}
|
|
if (failures.length) throw new AggregateError(failures, restoreDefault
|
|
? "Managed onboarding fixture cleanup failed; instance default restoration is unconfirmed and environment deletion was not attempted"
|
|
: "Managed onboarding fixture cleanup failed");
|
|
};
|
|
try {
|
|
restoreDefault = true;
|
|
await api.patch("/api/instance/settings", { defaultEnvironmentId: environment.id });
|
|
restoreManagedOnly = true;
|
|
await api.patch("/api/instance/settings/experimental", { enableManagedSandboxOnly: true });
|
|
} catch (error) {
|
|
try { await teardown(); } catch (cleanup) { throw new AggregateError([error, cleanup], "Managed onboarding fixture setup and cleanup failed"); }
|
|
throw error;
|
|
}
|
|
} else environment = localEnvironment!;
|
|
|
|
return {
|
|
company,
|
|
environment,
|
|
secretRefs,
|
|
agent: { id: "", name: `Garden lead ${nonce}`, companyId: company.id },
|
|
...(managed ? { setupLeases: [], setupQualification: { recorded: false, adapterType: null, platformResponses: 0, adapterResponses: 0 } } : {}),
|
|
teardown,
|
|
};
|
|
}
|
|
|
|
export function firstTaskNativeRuntimePatch(
|
|
execution: MatrixExecution,
|
|
fixtures: LiveFixtureValues,
|
|
agent: Record<string, any>,
|
|
) {
|
|
if (!["runner-codex", "runner-acpx-claude"].includes(execution.profile.id))
|
|
throw new Error("Unsupported native first-task profile");
|
|
const built = execution.profile.buildAgent({
|
|
environmentId: fixtures.environment.id,
|
|
environmentFixtureId: "local",
|
|
workspacePath: agent.adapterConfig?.cwd ?? "",
|
|
secretRefs: fixtures.secretRefs,
|
|
executionId: execution.id,
|
|
});
|
|
const config = {
|
|
...agent.adapterConfig,
|
|
...(built.adapterConfig as Record<string, unknown>),
|
|
};
|
|
// Preserve the wizard's model choice (including its unset provider default).
|
|
if (agent.adapterConfig?.model == null) delete config.model;
|
|
else config.model = agent.adapterConfig.model;
|
|
return {
|
|
adapterType: "paperclip_runner",
|
|
adapterConfig: normalizePaperclipOperationalSkillPreference(
|
|
"paperclip_runner",
|
|
config,
|
|
),
|
|
};
|
|
}
|