mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-22 16:51:28 +02:00
DottaandPaperclip
47ded8bf97
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Agent runs need credentials for a specific provider and sign-in method. > - Connections already owns accounts, grants, and access permissions. > - AI authentication should use those same boundaries. > - This pull request adds the storage, API, adoption, and runtime foundation. > - Legacy agents keep their authentication until they explicitly adopt a managed connection. ## Linked Issues or Issue Description **Problem or motivation** AI credentials are configured separately from Connections. Agents cannot consistently reuse a responsible user's account or a permitted shared account. **Proposed solution** Manage AI accounts with the existing Connections grants and permissions. Keep model and harness selection independent from credential selection. Preserve legacy authentication until validated adoption. **Alternatives considered** A separate credential registry would duplicate ownership and access policy. Automatic fallback would risk using the wrong account. **Roadmap alignment** This extends the shipped Apps, multi-user, secrets, and agent-runtime capabilities. The maintainer requested the feature and reviewed the UI. Related groundwork: #11899 (connection permissions), #10910 (connection wizard), #11692 (Claude subscription profiles), and #11854 (Codex account rotation). ## What Changed - Add AI-purpose/runtime-auth contracts and an additive, idempotent migration. - Add Claude, OpenAI, OpenRouter, and Grok provider capabilities and catalog entries. - Store credentials on grants. Resolve responsible-user defaults or explicit permitted grants. - Isolate managed credentials and provider sessions across accounts. Block missing credentials without ambient fallback. - Keep imported legacy secrets unchanged during reconnect. Use independent local Codex/Grok sign-in attempts for rotating credentials. - Add authorization, migration, concurrent refresh, retry, cancellation, and legacy-compatibility tests. This is part 1 of a two-PR stack. The app UI follows in #13248. Merge the foundation first. ## Verification - Updated against master `04e364236`, preserving upstream provider login and connector workflows. - Full workspace typecheck, production build, Storybook build, and token gates passed on the integrated branch. Final local-login changes passed 59 focused tests; new-agent and inbox regression suites passed 63 tests. - Browser checks verified automatic local Claude account detection, resumable Codex login commands, retry, focus restoration, and desktop/phone layouts. Commands create their isolated directory before invoking the CLI. - All current-head CI checks passed on `2a996560a`, including all server/workspace tests, browser shards, runner verification, typecheck, build, and canary dry run. Greptile reviewed that commit at 5/5 with no unresolved threads. Earlier local full-suite attempts hit the Mac PostgreSQL shared-memory limit; the complete suites passed in CI. - Renumbered the additive AI migration to `0276` after upstream migrations and regenerated its snapshot. Existing legacy agents retain their configuration. - Added local login status checks, owner-scoped retry, managed OpenCode remote homes, credential-aware model discovery, and task connection-repair delivery. ## Risks - Managed credential failures intentionally block execution. They do not restore legacy fallback. - Preview-era copied Codex/Grok subscriptions require independent reconnect. - The integrated branch has live provider acceptance coverage. This update verifies local Claude detection and Codex API-key task repair; it does not add a new subscription authorization/refresh or Daytona stress pass. - Runtime-auth connections must stay excluded from tool and channel handling. ## Model Used OpenAI GPT-6 through Codex, with reasoning, repository tools, code execution, and browser testing. The exact runtime model identifier and context-window size are not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
68 lines
2.5 KiB
JSON
68 lines
2.5 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"slug": "microsoft-teams",
|
|
"name": "Microsoft Teams",
|
|
"description": "Let people start and continue Paperclip work with an agent from Microsoft Teams.",
|
|
"categories": [
|
|
"communication"
|
|
],
|
|
"featured": false,
|
|
"branding": {
|
|
"logoUrl": "/brands/apps/microsoft-teams.svg"
|
|
},
|
|
"urlPatterns": [
|
|
"https://teams.microsoft.com/*"
|
|
],
|
|
"methods": [
|
|
{
|
|
"key": "chat-agent",
|
|
"label": "Chat with an agent",
|
|
"purpose": "channel",
|
|
"provider": "microsoft-teams",
|
|
"transport": "chat_sdk",
|
|
"auth": "api_key",
|
|
"ownershipModes": [
|
|
"customer"
|
|
],
|
|
"whenToUse": "Let people in Microsoft Teams start and continue work with one Paperclip agent.",
|
|
"credentialFields": [
|
|
{
|
|
"key": "clientId",
|
|
"label": "Application / Client ID",
|
|
"type": "text",
|
|
"required": true,
|
|
"placeholder": "00000000-0000-0000-0000-000000000000",
|
|
"secret": false
|
|
},
|
|
{
|
|
"key": "tenantId",
|
|
"label": "Directory / Tenant ID",
|
|
"type": "text",
|
|
"required": true,
|
|
"placeholder": "00000000-0000-0000-0000-000000000000",
|
|
"secret": false
|
|
},
|
|
{
|
|
"key": "clientSecret",
|
|
"label": "Client secret",
|
|
"type": "password",
|
|
"required": true,
|
|
"placeholder": "Paste the client-secret value",
|
|
"secret": true
|
|
}
|
|
],
|
|
"guidanceMd": "Use a Microsoft 365 work or school organization where you can register an Entra app, create a single-tenant Azure Bot, and upload or install a Teams app. Personal or free Teams accounts at teams.live.com cannot complete this setup. Enable personal, team, and groupChat bot scopes and the ChannelMessage.Read.Group and ChatMessage.Read.Chat resource-specific application permissions. Those RSC grants let an installed app receive every message in a team or group chat without an @mention, so explain that access to installers. One team install covers its standard channels; private and shared channels require a separate installation and are not supported by this release.",
|
|
"consoleLinks": {
|
|
"register": "https://dev.teams.microsoft.com/apps",
|
|
"docs": "https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/create-a-bot-for-teams"
|
|
},
|
|
"riskTier": "S3",
|
|
"requiredResourceFilters": [
|
|
"team",
|
|
"channel",
|
|
"chat"
|
|
]
|
|
}
|
|
]
|
|
}
|