mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-29 21:07:40 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The CLI exposes board/operator controls for managing agent configuration and instructions. > - Agent instructions files influence future agent behavior, so deleting one is a destructive configuration mutation. > - Nearby destructive CLI commands already require explicit `--yes` confirmation before sending DELETE requests. > - `agent instructions-file:delete` skipped that local confirmation guard and could delete a bundle file from a scripted or mistyped command. > - This pull request aligns that command with the existing destructive-command safety convention. > - The benefit is a small, predictable operator-safety guard with focused regression coverage. ## Linked Issues or Issue Description Bug report: ### Pre-submission checklist - [x] I have searched existing open and closed issues and this is not a duplicate. - [x] I am on the latest released version of Paperclip (or can reproduce on `master`). - [x] I have confirmed the error originates in Paperclip itself — not in my agent adapter, API provider, or local configuration. ### What happened? `paperclipai agent instructions-file:delete` deleted an agent instructions bundle file without requiring explicit CLI confirmation. ### Expected behavior Destructive CLI delete operations should require `--yes` before sending a DELETE request. ### Steps to reproduce 1. Run `npx paperclipai agent instructions-file:delete <agent-id> --path AGENTS.md`. 2. Observe that the CLI immediately issues `DELETE /api/agents/:agentId/instructions-bundle/file?path=AGENTS.md`. 3. No local confirmation guard blocks the destructive request. ### Paperclip version or commit `fd472d02ba950519ca5eff75ed9fd55cf976f4c2` ### Deployment mode Local dev (`pnpm dev`) ### Installation method Built from source (`pnpm dev` / `pnpm build`) ### Agent adapter(s) involved - [x] Not adapter-specific (core bug) ### Database mode Not database-related ### Access context Board (human operator) ### Node.js version `v20.x` ### Operating system macOS ### Relevant logs or output ```text Current behavior is local CLI behavior: the command proceeds to the DELETE call without requiring `--yes`. ``` ### Relevant config (if applicable) None. ### Additional context This command already sits next to other destructive CLI actions such as `agent delete`, which require explicit confirmation. Aligning the guard makes the CLI safety model consistent. ### Privacy checklist - [x] I have reviewed all pasted output for PII (usernames, file paths, API keys, tokens, company names) and redacted where necessary. ## What Changed - Added a `--yes` confirmation option to `agent instructions-file:delete`. - Refuse the command locally before resolving API context or sending a DELETE request when confirmation is missing. - Updated CLI parity coverage for confirmed and refused instructions-file deletion. - Updated the CLI documentation example to include `--yes`. ## Verification - `/Users/xinran/Downloads/dev/paperclip-pr-work/node_modules/.bin/vitest run cli/src/__tests__/agent-lifecycle.test.ts --config cli/vitest.config.ts` equivalent executed from the PR worktree using temporary dependency symlinks: 3 tests passed. - `git diff --check` ## Risks - Low risk: this only changes one destructive CLI command and matches existing `agent delete`, `issue delete`, and other delete-command confirmation behavior. - Scripts that intentionally delete instructions files must add `--yes`, which is the intended explicit confirmation path. - No database, API contract, or lockfile changes. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5-based coding agent in Codex desktop with shell/tool use and local test execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: 馨冉 <xinxincui239@gmail.com> Co-authored-by: Paperclip <noreply@paperclip.ing>
152 lines
7.4 KiB
TypeScript
152 lines
7.4 KiB
TypeScript
import { Command } from "commander";
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
import { registerAgentCommands } from "../commands/client/agent.js";
|
|
|
|
const COMPANY_ID = "22222222-2222-4222-8222-222222222222";
|
|
const AGENT_ID = "11111111-1111-4111-8111-111111111111";
|
|
const REVISION_ID = "33333333-3333-4333-8333-333333333333";
|
|
|
|
function createProgram(): Command {
|
|
const program = new Command();
|
|
program.exitOverride();
|
|
program.configureOutput({
|
|
writeOut: () => {},
|
|
writeErr: () => {},
|
|
});
|
|
registerAgentCommands(program);
|
|
return program;
|
|
}
|
|
|
|
async function run(args: string[]): Promise<void> {
|
|
await createProgram().parseAsync([
|
|
...args,
|
|
"--api-base", "http://localhost:3100",
|
|
"--api-key", "board-token",
|
|
], { from: "user" });
|
|
}
|
|
|
|
describe("agent lifecycle commands", () => {
|
|
beforeEach(() => {
|
|
vi.restoreAllMocks();
|
|
delete process.env.PAPERCLIP_API_KEY;
|
|
delete process.env.PAPERCLIP_API_URL;
|
|
vi.spyOn(console, "log").mockImplementation(() => {});
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.restoreAllMocks();
|
|
});
|
|
|
|
it("wraps agent lifecycle and state endpoints", async () => {
|
|
const fetchMock = vi.fn().mockImplementation(() => Promise.resolve(jsonResponse()));
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
|
|
await run([
|
|
"agent", "create",
|
|
"--company-id", COMPANY_ID,
|
|
"--payload-json", JSON.stringify({ name: "Builder", adapterType: "codex_local" }),
|
|
]);
|
|
await run(["agent", "hire", "--company-id", COMPANY_ID, "--payload-json", "{}"]);
|
|
await run(["agent", "update", AGENT_ID, "--payload-json", JSON.stringify({ title: "Senior Builder" })]);
|
|
await run(["agent", "pause", AGENT_ID]);
|
|
await run(["agent", "resume", AGENT_ID]);
|
|
await run(["agent", "approve", AGENT_ID]);
|
|
await run(["agent", "terminate", AGENT_ID]);
|
|
await run(["agent", "heartbeat:invoke", AGENT_ID]);
|
|
await run(["agent", "claude-login", AGENT_ID]);
|
|
await run(["agent", "delete", AGENT_ID, "--yes"]);
|
|
|
|
expect(fetchMock.mock.calls.map((call) => [call[1]?.method ?? "GET", call[0]])).toEqual([
|
|
["POST", `http://localhost:3100/api/companies/${COMPANY_ID}/agents`],
|
|
["POST", `http://localhost:3100/api/companies/${COMPANY_ID}/agent-hires`],
|
|
["PATCH", `http://localhost:3100/api/agents/${AGENT_ID}`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/pause`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/resume`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/approve`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/terminate`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/heartbeat/invoke`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/claude-login`],
|
|
["DELETE", `http://localhost:3100/api/agents/${AGENT_ID}`],
|
|
]);
|
|
});
|
|
|
|
it("sends automatic selection when omitted and supports explicit runner overrides", async () => {
|
|
const fetchMock = vi.fn().mockImplementation(() => Promise.resolve(jsonResponse()));
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
const payload = { name: "Builder", adapterType: "codex_local" };
|
|
await run(["agent", "create", "--company-id", COMPANY_ID, "--payload-json", JSON.stringify(payload)]);
|
|
await run(["agent", "create", "--company-id", COMPANY_ID, "--payload-json", JSON.stringify({ ...payload, runner: "auto" }), "--runner", "legacy"]);
|
|
await run(["agent", "hire", "--company-id", COMPANY_ID, "--payload-json", JSON.stringify(payload), "--runner", "paperclip"]);
|
|
expect(JSON.parse(fetchMock.mock.calls[0]![1].body).runner).toBeUndefined();
|
|
expect(JSON.parse(fetchMock.mock.calls[1]![1].body).runner).toBe("legacy");
|
|
expect(JSON.parse(fetchMock.mock.calls[2]![1].body).runner).toBe("paperclip");
|
|
});
|
|
|
|
it("wraps configuration, runtime, skills, and instructions endpoints", async () => {
|
|
const fetchMock = vi.fn().mockImplementation(() => Promise.resolve(jsonResponse()));
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
|
|
await run(["agent", "permissions:update", AGENT_ID, "--payload-json", JSON.stringify({ canCreateAgents: true, canAssignTasks: true })]);
|
|
await run(["agent", "configuration", AGENT_ID]);
|
|
await run(["agent", "config-revisions", AGENT_ID]);
|
|
await run(["agent", "config-revision:get", AGENT_ID, REVISION_ID]);
|
|
await run(["agent", "config-revision:rollback", AGENT_ID, REVISION_ID]);
|
|
await run(["agent", "runtime-state", AGENT_ID]);
|
|
await run(["agent", "runtime-state:reset-session", AGENT_ID, "--task-key", "task-1"]);
|
|
await run(["agent", "task-sessions", AGENT_ID]);
|
|
await run(["agent", "skills", AGENT_ID]);
|
|
await run([
|
|
"agent",
|
|
"skills:sync",
|
|
AGENT_ID,
|
|
"--desired-skills",
|
|
"paperclip,github",
|
|
"--mode",
|
|
"replace",
|
|
]);
|
|
await run(["agent", "instructions-path:update", AGENT_ID, "--payload-json", JSON.stringify({ path: "/tmp/AGENTS.md" })]);
|
|
await run(["agent", "instructions-bundle", AGENT_ID]);
|
|
await run(["agent", "instructions-bundle:update", AGENT_ID, "--payload-json", JSON.stringify({ mode: "managed" })]);
|
|
await run(["agent", "instructions-file:get", AGENT_ID, "--path", "AGENTS.md"]);
|
|
await run(["agent", "instructions-file:put", AGENT_ID, "--path", "AGENTS.md", "--content", "hello"]);
|
|
await run(["agent", "instructions-file:delete", AGENT_ID, "--path", "AGENTS.md", "--yes"]);
|
|
|
|
expect(fetchMock.mock.calls.map((call) => [call[1]?.method ?? "GET", call[0]])).toEqual([
|
|
["PATCH", `http://localhost:3100/api/agents/${AGENT_ID}/permissions`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/configuration`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/config-revisions`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/config-revisions/${REVISION_ID}`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/config-revisions/${REVISION_ID}/rollback`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/runtime-state`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/runtime-state/reset-session`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/task-sessions`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/skills`],
|
|
["POST", `http://localhost:3100/api/agents/${AGENT_ID}/skills/sync`],
|
|
["PATCH", `http://localhost:3100/api/agents/${AGENT_ID}/instructions-path`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/instructions-bundle`],
|
|
["PATCH", `http://localhost:3100/api/agents/${AGENT_ID}/instructions-bundle`],
|
|
["GET", `http://localhost:3100/api/agents/${AGENT_ID}/instructions-bundle/file?path=AGENTS.md`],
|
|
["PUT", `http://localhost:3100/api/agents/${AGENT_ID}/instructions-bundle/file`],
|
|
["DELETE", `http://localhost:3100/api/agents/${AGENT_ID}/instructions-bundle/file?path=AGENTS.md`],
|
|
]);
|
|
});
|
|
|
|
it("refuses to delete an instructions file without confirmation", async () => {
|
|
const fetchMock = vi.fn().mockImplementation(() => Promise.resolve(jsonResponse()));
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
vi.spyOn(process, "exit").mockImplementation(((code?: string | number | null) => {
|
|
throw new Error(`exit:${code ?? 0}`);
|
|
}) as typeof process.exit);
|
|
|
|
await expect(run(["agent", "instructions-file:delete", AGENT_ID, "--path", "AGENTS.md"])).rejects.toThrow(
|
|
"exit:1",
|
|
);
|
|
|
|
expect(fetchMock).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
function jsonResponse(body: unknown = { ok: true }, init: ResponseInit = { status: 200 }): Response {
|
|
return new Response(JSON.stringify(body), init);
|
|
}
|