mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-06 20:34:57 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Operators need first-party agent capabilities for repeatable company work, not just manually created one-off agents. > - Built-in agents need to behave like normal company-scoped agents while preserving approval gates, permissions, budgets, and audit trails. > - Reflection and coaching work also needs bundled instructions, skill content, and a routine so the feature can be installed and reset predictably. > - The API, database, UI, portability, and tests all need to agree on the built-in lifecycle from not provisioned through setup, approval, ready, paused, and reset. > - This pull request adds built-in agent provisioning and the Reflection Coach bundle end-to-end. > - The benefit is a safer first-party path for Paperclip-managed agents without bypassing the same governance model used for operator-created agents. ## Linked Issues or Issue Description No public GitHub issue was found for this exact built-in agent and Reflection Coach bundle work. Problem/motivation: - Paperclip did not have a first-party built-in agent lifecycle for product-owned agents. - Bundled agent resources such as default instructions, skills, and routines needed managed ownership and reset semantics. - Approval-gated companies needed built-in setup to preserve requested adapter, budget, manager, and permission state through board approval. - The board UI needed clear built-in badges, setup affordances, readiness state, and bundle status without exposing secrets. Proposed solution: - Add a company-scoped built-in agent registry, provisioning/reset/reconcile/status APIs, and Reflection Coach bundled resources. - Track bundled managed resources in the database with idempotent migration behavior. - Reuse existing agent approval, authorization, budget, and activity-log paths instead of creating a bypass. - Add UI setup, badges, gates, bundle panels, and route coverage for built-in agents. Duplicate search: - Searched GitHub PRs for `built-in agents Reflection Coach repo:paperclipai/paperclip`; only this PR was returned. - Searched GitHub issues for the same query; no public issues were returned. ## What Changed - Added built-in agent definitions, lifecycle state derivation, provisioning, reset, reconcile, status, and routine-control routes. - Added the `built_in_managed_resources` migration and schema exports for bundled instructions, skill, and routine ownership. - Added the Reflection Coach built-in bundle with default instructions, skill catalog content, routine template, default permissions, and managed-resource drift handling. - Added approval-aware provisioning behavior that preserves requested adapter config, budgets, manager assignment, and built-in permissions through hire approval. - Added authorization and mutation gates for built-in agent and skill changes, including consented Reflection Coach change paths. - Added UI surfaces for built-in agent setup, roster/detail badges, readiness gates, bundle status, routine controls, and route filtering. - Added company import/export and validator coverage for built-in managed resources and low-trust/red-team presets. - Addressed Greptile follow-ups for pending approval reconciliation, consent-gate error propagation, config-read authorization fallback, approval-path manager preservation, and non-model adapter provisioning. ## Verification Local verification: - `git diff --check public/master..HEAD` passed. - `pnpm check:token-gates` passed with all gates clean. - `pnpm exec vitest run ui/src/components/ConfigureBuiltInAgentModal.test.tsx` passed: 1 file, 4 tests. - `pnpm exec vitest run ui/src/components/EntityRow.test.tsx ui/src/pages/Agents.test.tsx ui/src/components/BuiltInAgentGate.test.tsx ui/src/components/ConfigureBuiltInAgentModal.test.tsx ui/src/components/BuiltInBundlePanel.test.tsx ui/src/pages/InstanceExperimentalSettings.test.tsx ui/src/pages/Routines.test.tsx` passed: 7 files, 64 tests. - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/built-in-agents.test.ts src/__tests__/authorization-service.test.ts src/__tests__/company-skills-routes.test.ts` passed: 3 files, 91 tests. - `pnpm --filter @paperclipai/db check:migrations` passed. - `pnpm -r typecheck` passed after the rebase; `pnpm --filter ui typecheck` passed after the final UI review fix. Remote verification on latest head `1c61f693a4ec881d739022b0e75a8ca8bf8c2cd8`: - Merge state: `CLEAN`. - Greptile: `5/5`, zero unresolved Greptile threads. - PR check rollup: all checks successful, neutral, or skipped as expected. - Passing gates include Build, Typecheck + Release Registry, all server shards, all workspace shards, all serialized server suites, e2e, Canary Dry Run, policy, review, verify, Socket, Superagent, and Snyk. ## Risks - This adds a new managed-resource table and migration; the migration uses idempotent create/add/index guards and passed migration safety checks. - Built-in agent provisioning touches approval and authorization paths; tests cover pending approval preservation, stale retry rejection, consent gates, and config-read fallback behavior. - Reflection Coach creates managed instructions, skill, and routine resources; drift/reset behavior is covered by service tests and redacted API responses. - Non-model adapter setup now provisions a `needs_setup` built-in row before command/endpoint fields are complete; this matches the server lifecycle and is covered by the setup modal regression test. ## Model Used OpenAI Codex coding agent based on GPT-5. Exact hosted model ID, context-window size, and reasoning-mode labels are not exposed in this runtime; tool use, shell execution, GitHub CLI/API access, and local code editing were enabled. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
145 lines
6.8 KiB
Markdown
145 lines
6.8 KiB
Markdown
# Built-in Agents
|
|
|
|
Built-in agents are first-party, company-scoped agents that Paperclip can resolve by a stable registry key. They are normal rows in `agents`, but they carry immutable metadata under `metadata.paperclipBuiltInAgent` so services can find them without hardcoding a database id.
|
|
|
|
The first built-ins are `briefs` and `learning`. Operators can provision them from the API without going through board hire approval, but the route still requires the same `agents:create` permission as normal agent creation.
|
|
|
|
## Runtime Model
|
|
|
|
The subsystem has four layers:
|
|
|
|
- Registry: `server/src/services/built-in-agents.ts` defines the static `BuiltInAgentDefinition` list.
|
|
- Marker: `server/src/services/built-in-agent-metadata.ts` reads and writes `metadata.paperclipBuiltInAgent`.
|
|
- Provisioning service: `builtInAgentService(db)` finds, creates, updates, resets, and requires built-ins per company.
|
|
- Routes: `server/src/routes/built-in-agents.ts` exposes list, provision, and reset APIs.
|
|
|
|
Built-in agent state is derived from the marked agent row:
|
|
|
|
- `not_provisioned`: no active marked row exists for the company/key.
|
|
- `needs_setup`: a row exists, but adapter config is incomplete for the adapter type.
|
|
- `ready`: adapter config is complete and the agent is not paused.
|
|
- `paused`: the marked row is paused. Scheduled/background work should log the paused warning and skip queueing work.
|
|
|
|
Use `builtInAgentService(db).requireBuiltInAgent(companyId, key)` from backend features that need a built-in agent before scheduling work. It throws HTTP 412 with `code: "built_in_agent_not_configured"` for missing or incomplete agents. Paused agents return the agent plus a `built_in_agent_paused` warning so callers can pass the warning through to logs or API responses without treating the agent as ready for scheduling.
|
|
|
|
## API
|
|
|
|
All routes are company-scoped:
|
|
|
|
- `GET /api/companies/:companyId/built-in-agents`
|
|
Lists registry definitions with current company state.
|
|
- `POST /api/companies/:companyId/built-in-agents/:key/provision`
|
|
Creates or configures the built-in for the company. Body accepts optional `adapterType` and `adapterConfig`.
|
|
- `POST /api/companies/:companyId/built-in-agents/:key/reset`
|
|
Restores registry-owned display/default fields on the marked row while preserving operator adapter setup.
|
|
|
|
Provision and reset require `agents:create`. Provision intentionally skips `requireBoardApprovalForNewAgents` because built-ins are registry-owned system capacity, not ad hoc hires.
|
|
|
|
## Add a New Built-in Agent
|
|
|
|
1. Add a definition in `DEFINITIONS` inside `server/src/services/built-in-agents.ts`.
|
|
2. Pick a stable lowercase `key` using only letters, numbers, `_`, and `-`. Do not rename keys after release.
|
|
3. Set `displayName`, `shortPurpose`, `defaultInstructions`, `defaultRole`, and at least one `featureKeys` entry.
|
|
4. Set `allowedAdapterTypes` to the smallest set that actually works for this built-in.
|
|
5. Decide whether the built-in needs a nonzero `defaultBudgetMonthlyCents`.
|
|
6. Add or update tests in `server/src/__tests__/built-in-agents.test.ts`.
|
|
7. If the built-in is surfaced in UI or docs, add those changes in the same PR.
|
|
8. Run the focused tests from the repo root with `pnpm --filter @paperclipai/server exec vitest run src/__tests__/built-in-agents.test.ts src/__tests__/built-in-agent-routes.test.ts`.
|
|
|
|
Do not write built-in markers directly through generic agent create/update routes. The agent service rejects marker add, remove, and mutation unless the built-in service explicitly opts in.
|
|
|
|
## Worked Example: `digest`
|
|
|
|
Hypothetical registry diff:
|
|
|
|
```diff
|
|
const DEFINITIONS = validateBuiltInAgentDefinitions([
|
|
{
|
|
key: "learning",
|
|
displayName: "Learning Agent",
|
|
featureKeys: ["learning"],
|
|
shortPurpose: "Maintains reusable company learning from completed work and recurring patterns.",
|
|
defaultInstructions:
|
|
"You are Paperclip's built-in Learning agent. Extract durable lessons from completed work, preserve useful patterns, and keep learning artifacts grounded in source context.",
|
|
defaultRole: "general",
|
|
allowedAdapterTypes: ["codex_local", "claude_local", "gemini_local", "opencode_local", "process"],
|
|
defaultBudgetMonthlyCents: 0,
|
|
},
|
|
+ {
|
|
+ key: "digest",
|
|
+ displayName: "Digest Agent",
|
|
+ featureKeys: ["digest"],
|
|
+ shortPurpose: "Summarizes recent company activity into a board-readable digest.",
|
|
+ defaultInstructions:
|
|
+ "You are Paperclip's built-in Digest agent. Produce short, sourced summaries of recent company activity, decisions, blockers, and next actions.",
|
|
+ defaultRole: "general",
|
|
+ allowedAdapterTypes: ["codex_local", "claude_local", "process"],
|
|
+ defaultBudgetMonthlyCents: 0,
|
|
+ },
|
|
]);
|
|
```
|
|
|
|
Add focused test coverage:
|
|
|
|
```ts
|
|
expect(listBuiltInAgentDefinitions().map((definition) => definition.key).sort()).toEqual([
|
|
"briefs",
|
|
"digest",
|
|
"learning",
|
|
]);
|
|
```
|
|
|
|
If a background job needs the agent:
|
|
|
|
```ts
|
|
const { agent, warning } = await builtInAgentService(db).requireBuiltInAgent(companyId, "digest");
|
|
if (warning) {
|
|
logger.info({ warning }, "Skipping digest work because built-in agent is paused");
|
|
return;
|
|
}
|
|
|
|
await heartbeatService(db).wakeup(agent.id, {
|
|
source: "automation",
|
|
triggerDetail: "system",
|
|
reason: "Generate company digest",
|
|
});
|
|
```
|
|
|
|
If the agent is missing or not configured, the helper throws:
|
|
|
|
```json
|
|
{
|
|
"error": "Built-in agent is not configured: digest",
|
|
"code": "built_in_agent_not_configured",
|
|
"details": {
|
|
"code": "built_in_agent_not_configured",
|
|
"key": "digest",
|
|
"status": "needs_setup",
|
|
"agentId": "..."
|
|
}
|
|
}
|
|
```
|
|
|
|
## PR Checklist
|
|
|
|
- Registry definition has a stable key and at least one feature key.
|
|
- `allowedAdapterTypes` is intentionally narrow.
|
|
- Provisioning does not require board hire approval.
|
|
- Generic agent create/update cannot forge or remove the marker.
|
|
- Routes remain company-scoped and write activity for mutations.
|
|
- Background consumers use `requireBuiltInAgent(companyId, key)` instead of open-coding marker lookup.
|
|
- Paused built-ins skip scheduled/background work and leave an inspectable log or warning.
|
|
- Focused tests pass:
|
|
|
|
```sh
|
|
pnpm --filter @paperclipai/server exec vitest run src/__tests__/built-in-agents.test.ts src/__tests__/built-in-agent-routes.test.ts
|
|
```
|
|
|
|
## Operational Notes
|
|
|
|
- One active built-in row per company/key is allowed. Duplicate active markers are treated as a conflict and must be repaired manually.
|
|
- Terminated built-in rows are ignored for lookup; provisioning can create a replacement.
|
|
- `reset` restores registry-owned defaults but preserves adapter setup so operators do not lose local model or command configuration.
|
|
- Unknown marker keys are ignored during startup reconciliation. This prevents removed experimental built-ins from breaking server boot.
|
|
- Feature code should treat 412 `built_in_agent_not_configured` as an operator setup problem, not as a 500.
|