mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-31 06:04:11 +01:00
LKL-ZREO
6c1ee40af0
## Thinking Path > - Paperclip manages AI agents and the tools they can use. > - Native runs can receive assigned app tools through governed tool access. > - Large tool catalogs use a search tool with offset paging. > - The server refreshes grants before each page so revocations take effect at once. > - The old paging code applied the saved offset after this live list changed. > - A revoked earlier tool shifted the list and caused a later allowed tool to be skipped. > - This pull request keeps the offset on the fixed session catalog and filters grants during the scan. > - The benefit is complete tool discovery without weakening live revocation. ## Linked Issues or Issue Description **What happened?** `paperclip_search_assigned_tools` used an offset against the current authorized tool list. If an earlier tool was revoked between pages, the list became shorter. The next page then skipped a tool that was still authorized. **Expected behavior** Paging must return every matching tool that remains authorized. A live revocation must hide the revoked tool without changing the position of later tools. **Steps to reproduce** 1. Create an assigned tool catalog with `alpha`, `bravo`, `charlie`, and `delta`. 2. Request two tools from offset `0`. The result contains `alpha` and `bravo` with next offset `2`. 3. Revoke `alpha` before the next request. 4. Request two tools from offset `2`. 5. The old code returns only `delta` and skips the still-authorized `charlie` tool. **Paperclip version or commit** `0f14d261233c545aa6a8a38ec253c498a5130fff` **Agent adapter(s) involved** Not adapter-specific. This bug is in the native assigned-tool discovery path. Related work: Refs #14218. ## What Changed - Keep search offsets on the fixed tool catalog for the session. - Apply fresh grant checks while scanning that fixed sequence. - Add a regression test for a revocation between two pages. ## Verification - `node node_modules/vitest/vitest.mjs run server/src/services/native-runtime/assigned-mcp-tools.test.ts` - `node node_modules/typescript/bin/tsc -p server/tsconfig.json --noEmit` - `git diff --check` ## Risks - Low risk. The API and numeric offset format do not change. - Revoked tools remain hidden immediately. - No database, migration, or public documentation change is required. ## Model Used - OpenAI GPT-5.6, Codex agent with tool use and code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge