Files
PaperClipAI/docs/agents-runtime.md
T
DottaandPaperclip fd2f82ac5b [codex] Add built-in Hermes adapters (#8543)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Agent adapters are the boundary between the control plane and the
runtimes that actually do work.
> - Hermes support needs to be available as first-class local and
gateway adapters while still preserving the adapter-manager override
path for external packages.
> - The adapter work touches runtime execution, UI adapter metadata,
onboarding prompts, scoped credentials, release packaging, and smoke
coverage, so the handoff needs concrete verification rather than only
unit tests.
> - This pull request adds built-in Hermes local and Hermes gateway
support, keeps external adapter overrides compatible, and
documents/tests the gateway flow end to end.
> - The benefit is that operators can hire Hermes-backed agents without
a manual plugin install, while self-hosted installs can still
override/shadow the built-ins through Adapter manager packages.

## Linked Issues or Issue Description

No public GitHub issue exists for this exact Hermes built-in adapter,
gateway onboarding, and release-source work.

Problem description:
- Hermes local and gateway adapters need a public, reviewable source
path in the monorepo so package artifacts and built-in adapter behavior
match the application source.
- Operators need built-in `hermes_local` and `hermes_gateway` adapter
choices without losing the ability to install external Hermes packages
as overrides.
- Gateway onboarding needs secure defaults for API server URLs, API
keys, and generated agent setup text.
- Hermes-originated task bridge credentials need narrower API-key scope
configuration.
- Related public PRs found during duplicate search include #3027, #2363,
#7544, #7950, #8095, and #8543.

## What Changed

- Added the unified Hermes adapter package with local and gateway
server/UI/CLI exports, config schemas, transcript parsing, model
detection, and package metadata.
- Registered `hermes_local` and `hermes_gateway` as built-in adapters
across shared constants, server registries, CLI packaging, and UI
adapter registries.
- Kept the external adapter override path compatible so installed Hermes
packages can shadow built-ins and restore the built-in parser when
disabled.
- Added Hermes gateway onboarding docs, board-operator docs, Docker
smoke assets, and shell smoke harnesses for join/e2e validation.
- Added scoped task-bridge API-key support, authorization checks,
issue-origin handling, and tests for Hermes-created Paperclip tasks.
- Hardened gateway transport and redaction behavior for API keys,
headers, session data, and smoke diagnostics.
- Updated release packaging/bootstrap checks for the Hermes packages
while leaving `pnpm-lock.yaml` out of the PR per repository policy.

## Verification

Targeted local verification recorded before PR handoff:
- `pnpm --filter @paperclipai/hermes-paperclip-adapter exec vitest run
src/gateway/server/execute.test.ts` — 14/14 passed.
- `pnpm test:hermes-gateway-smoke` — 6/6 passed.
- Hermes package typecheck/build checks passed.
- Focused server/UI adapter tests passed — 31/31.
- Release helper Node tests passed — 18/18.
- `git diff --check origin/master..HEAD` passed.

Fresh Docker E2E smoke evidence:
- Ran `pnpm smoke:hermes-gateway-e2e` on 2026-06-26 with a fresh state
directory and fresh Docker container against a live Paperclip dev
server.
- Hermes direct execution reached `completed`.
- Hermes stop/cancel path reached `cancelled`.
- Hermes gateway created a Paperclip task, Paperclip ran the Hermes
agent, and the task reached `done` with the expected marker response.
- Temporary board auth keys, token files, smoke state, and Docker
containers were cleaned up after the run.

PR checks on head `b5eae40ce`:
- GitHub Actions passed: `policy`, `review`, `Typecheck + Release
Registry`, all general test shards, all serialized server shards,
`Build`, `Canary Dry Run`, `e2e`, and aggregate `verify`.
- External checks passed: Snyk and Socket Project Report.
- External Socket Pull Request Alerts remained pending after the
first-party CI matrix completed.

## Risks

- Medium risk: this spans adapter registration, package publishing,
gateway execution, onboarding docs, API-key scoping, and UI adapter
metadata.
- Migration risk is low: the scope-config migration adds a nullable
column and does not rewrite existing keys.
- Gateway execution depends on operator-provided Hermes API
configuration; the smoke covers the Docker gateway path but real
deployments may differ by network/auth setup.
- Direct Greptile review on the latest expanded diff is file-count
limited, although the commitperclip review gate passed.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

OpenAI Codex, GPT-5 coding agent, tool use enabled in a local repository
workspace. Context window size is not exposed in this environment.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Commitperclip review gate is green; direct Greptile review is
file-count limited on the latest expanded diff
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-06-26 16:04:58 -05:00

6.8 KiB

Agent Runtime Guide

Status: User-facing guide Last updated: 2026-03-26 Audience: Operators setting up and running agents in Paperclip

1. What this system does

Agents in Paperclip do not run continuously.
They run in heartbeats: short execution windows triggered by a wakeup.

Each heartbeat:

  1. Starts the configured agent adapter (for example, Claude CLI or Codex CLI)
  2. Gives it the current prompt/context
  3. Lets it work until it exits, times out, or is cancelled
  4. Stores results (status, token usage, errors, logs)
  5. Updates the UI live

2. When an agent wakes up

An agent can be woken up in four ways:

  • timer: scheduled interval (for example every 5 minutes)
  • assignment: when work is assigned/checked out to that agent
  • on_demand: manual wakeup (button/API)
  • automation: system-triggered wakeup for future automations

If an agent is already running, new wakeups are merged (coalesced) instead of launching duplicate runs.

3. What to configure per agent

3.1 Adapter choice

Built-in adapters:

  • claude_local: runs your local claude CLI
  • codex_local: runs your local codex CLI
  • opencode_local: runs your local opencode CLI
  • cursor: runs Cursor in background mode
  • pi_local: runs an embedded Pi agent locally
  • hermes_local: starts your local hermes CLI through @paperclipai/hermes-paperclip-adapter
  • hermes_gateway: calls an already-running Hermes API server through @paperclipai/hermes-paperclip-adapter/gateway
  • openclaw_gateway: connects to an OpenClaw gateway endpoint
  • process: generic shell command adapter
  • http: calls an external HTTP endpoint

External plugin adapters (install via the adapter manager or API):

  • droid_local: runs your local Factory Droid CLI (@henkey/droid-paperclip-adapter)

For local CLI adapters (claude_local, codex_local, opencode_local, hermes_local, droid_local), Paperclip assumes the CLI is already installed and authenticated on the host machine. For hermes_gateway, Paperclip assumes the Hermes API server is already running, reachable from the Paperclip server, and configured with an API key. The older @paperclipai/adapter-hermes-gateway npm package is only a deprecated compatibility shim; the adapter type remains hermes_gateway.

3.2 Runtime behavior

In agent runtime settings, configure heartbeat policy:

  • enabled: allow scheduled heartbeats
  • intervalSec: timer interval (0 = disabled)
  • wakeOnAssignment: wake when assigned work
  • wakeOnOnDemand: allow ping-style on-demand wakeups
  • wakeOnAutomation: allow system automation wakeups

3.3 Working directory and execution limits

For local adapters, set:

  • cwd (working directory)
  • timeoutSec (max runtime per heartbeat)
  • graceSec (time before force-kill after timeout/cancel)
  • optional env vars and extra CLI args
  • use Test environment in agent configuration to run adapter-specific diagnostics before saving

3.4 Prompt templates

You can set:

  • promptTemplate: used for every run (first run and resumed sessions)

Templates support variables like {{agent.id}}, {{agent.name}}, and run context values.

Note: bootstrapPromptTemplate is deprecated and should not be used for new agents. Existing configs that use it will continue to work but should be migrated to the managed instructions bundle system.

4. Session resume behavior

Paperclip stores session IDs for resumable adapters.

  • Next heartbeat reuses the saved session automatically.
  • This gives continuity across heartbeats.
  • You can reset a session if context gets stale or confused.

Use session reset when:

  • you significantly changed prompt strategy
  • the agent is stuck in a bad loop
  • you want a clean restart

5. Logs, status, and run history

For each heartbeat run you get:

  • run status (queued, running, succeeded, failed, timed_out, cancelled)
  • error text and stderr/stdout excerpts
  • token usage/cost when available from the adapter
  • full logs (stored outside core run rows, optimized for large output)

In local/dev setups, full logs are stored on disk under the configured run-log path.

6. Live updates in the UI

Paperclip pushes runtime/activity updates to the browser in real time.

You should see live changes for:

  • agent status
  • heartbeat run status
  • task/activity updates caused by agent work
  • dashboard/cost/activity panels as relevant

If the connection drops, the UI reconnects automatically.

7. Common operating patterns

7.1 Simple autonomous loop

  1. Enable timer wakeups (for example every 300s)
  2. Keep assignment wakeups on
  3. Use a focused prompt template that tells agents to act in the same heartbeat, leave durable progress, and mark blocked work with an owner/action
  4. Watch run logs and adjust prompt/config over time

7.2 Event-driven loop (less constant polling)

  1. Disable timer or set a long interval
  2. Keep wake-on-assignment enabled
  3. Use child issues, comments, and on-demand wakeups for handoffs instead of loops that poll agents, sessions, or processes

7.3 Safety-first loop

  1. Short timeout
  2. Conservative prompt
  3. Monitor errors + cancel quickly when needed
  4. Reset sessions when drift appears

8. Troubleshooting

If runs fail repeatedly:

  1. Check adapter command availability (e.g. claude/codex/opencode/hermes installed and logged in).
  2. Verify cwd exists and is accessible.
  3. Inspect run error + stderr excerpt, then full log.
  4. Confirm timeout is not too low.
  5. Reset session and retry.
  6. Pause agent if it is causing repeated bad updates.

Typical failure causes:

  • CLI not installed/authenticated
  • bad working directory
  • malformed adapter args/env
  • prompt too broad or missing constraints
  • process timeout

Claude-specific note:

  • If ANTHROPIC_API_KEY is set in adapter env or host environment, Claude uses API-key auth instead of subscription login. Paperclip surfaces this as a warning in environment tests, not a hard error.

9. Security and risk notes

Local CLI adapters run unsandboxed on the host machine.

That means:

  • prompt instructions matter
  • configured credentials/env vars are sensitive
  • working directory permissions matter

Start with least privilege where possible, and avoid exposing secrets in broad reusable prompts unless intentionally required.

10. Minimal setup checklist

  1. Choose adapter (e.g. claude_local, codex_local, opencode_local, hermes_local, hermes_gateway, cursor, or openclaw_gateway). External plugins like droid_local are also available via the adapter manager.
  2. Set cwd to the target workspace (for local adapters).
  3. Optionally add a prompt template (promptTemplate) or use the managed instructions bundle.
  4. Configure heartbeat policy (timer and/or assignment wakeups).
  5. Trigger a manual wakeup.
  6. Confirm run succeeds and session/token usage is recorded.
  7. Watch live updates and iterate prompt/config.