mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-03 01:14:48 +01:00
## Thinking Path > - Paperclip is a control plane for AI-agent companies, so execution policy and trust boundaries are part of the product's safety contract. > - Low-trust review work needs narrower authority than normal same-company agents because hostile PRs, comments, attachments, and generated output can carry prompt-injection payloads. > - The current V1 shape gives trusted workers broad company context, which is useful for normal execution but too permissive for a reviewer assigned to hostile content. > - This branch adds a `low_trust_review` preset, source-trust tagging, route-level containment, and quarantine handling so low-trust output does not automatically flow into higher-trust wake context. > - The branch has been rebased onto current `origin/master`, and the low-trust migration was renumbered to `0097_low_trust_source_trust.sql` to avoid collisions with existing `0091` through `0096` migrations. > - Greptile feedback was addressed by tightening low-trust detection, preserving project-level trust policy checks, fixing issue-kind promotion lookup, removing duplicate post-lease isolation assertion, documenting fail-closed source-trust behavior, bounding ancestry checks, enforcing runtime issue context for CEOs, awaiting accepted-plan monitor authorization, and making low-trust issue source-trust tagging atomic. > - The benefit is a first production slice of deny-by-default review containment with regression coverage for the main control-plane pivot surfaces. Fixes #7531. ## What Changed - Added shared trust-policy types and validators, plus database/source-trust fields for issues, comments, documents, and work products. - Implemented server enforcement for low-trust issue scope, agent self-view redaction, secret/plugin/runtime denial paths, promotion checks, and quarantined continuation/wake context. - Added focused low-trust regression tests for resolver behavior, source trust, route authorization, heartbeat preflight ordering, runtime containment, and quarantine redaction. - Added board UI affordances for selecting/reviewing the low-trust preset and surfacing source-trust badges in relevant issue views. - Added `doc/LOW-TRUST-PRESETS.md`, updated `doc/SPEC-implementation.md`, and committed the low-trust review contract plan under `doc/plans/`. - Rebasing note: the original `0097_low_trust_source_trust.sql` migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered migration are not broken by the renumbered migration. ## Verification - Rebased branch onto current `origin/master` and force-pushed with lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`. - Confirmed the PR diff does not include `pnpm-lock.yaml` or `.github/workflows` changes. - Resolved upstream UI/comment conflicts by preserving deleted-comment tombstone behavior and low-trust source-trust badges/metadata. - Renumbered the low-trust source-trust migration to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied an old-numbered copy are not broken. - `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts` - `pnpm exec vitest run server/src/__tests__/source-trust.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts ui/src/lib/trust-policy-ui.test.ts ui/src/components/TrustPresetSection.test.tsx` - `pnpm run typecheck:build-gaps` - `git diff --check` - GitHub checks pass on head `2719f31e3`: build, typecheck/release registry, general tests, serialized server suites, e2e, canary, verify, policy/review, Socket, and Snyk. - Greptile Review passes with Confidence Score 5/5 and zero unresolved Greptile review threads. - No design screenshots/images were added because the task explicitly says not to add them unless they are specifically part of the work. ## Risks - Medium risk: this touches shared trust-policy contracts, server authorization paths, heartbeat context generation, migration metadata, and UI preset controls. - Low-trust containment is intentionally deny-by-default; legitimate future review workflows may need explicit allowlisted exceptions. - Plugin/runtime/security surfaces are broad, so regression tests cover the current known routes but future integrations must route through the same containment layer. - The PR is ready for review; GitHub checks are green and Greptile is 5/5. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI workflow. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] UI changes are covered by focused tests; no screenshots were added per task instruction not to add design images unless specifically required - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
169 lines
6.2 KiB
TypeScript
169 lines
6.2 KiB
TypeScript
import { z } from "zod";
|
|
import {
|
|
AGENT_ICON_NAMES,
|
|
AGENT_ROLES,
|
|
AGENT_STATUSES,
|
|
INBOX_MINE_ISSUE_STATUS_FILTER,
|
|
} from "../constants.js";
|
|
import { agentAdapterTypeSchema } from "../adapter-type.js";
|
|
import { envConfigSchema } from "./secret.js";
|
|
import { trustAuthorizationPolicySchema, trustPresetSchema } from "./trust-policy.js";
|
|
|
|
export const agentPermissionsSchema = z.object({
|
|
canCreateAgents: z.boolean().optional().default(false),
|
|
trustPreset: trustPresetSchema.optional(),
|
|
authorizationPolicy: trustAuthorizationPolicySchema.optional(),
|
|
}).catchall(z.unknown());
|
|
|
|
export const agentInstructionsBundleModeSchema = z.enum(["managed", "external"]);
|
|
|
|
export const updateAgentInstructionsBundleSchema = z.object({
|
|
mode: agentInstructionsBundleModeSchema.optional(),
|
|
rootPath: z.string().trim().min(1).nullable().optional(),
|
|
entryFile: z.string().trim().min(1).optional(),
|
|
clearLegacyPromptTemplate: z.boolean().optional().default(false),
|
|
});
|
|
|
|
export type UpdateAgentInstructionsBundle = z.infer<typeof updateAgentInstructionsBundleSchema>;
|
|
|
|
export const upsertAgentInstructionsFileSchema = z.object({
|
|
path: z.string().trim().min(1),
|
|
content: z.string(),
|
|
clearLegacyPromptTemplate: z.boolean().optional().default(false),
|
|
});
|
|
|
|
export type UpsertAgentInstructionsFile = z.infer<typeof upsertAgentInstructionsFileSchema>;
|
|
|
|
const adapterConfigSchema = z.record(z.string(), z.unknown()).superRefine((value, ctx) => {
|
|
const envValue = value.env;
|
|
if (envValue === undefined) return;
|
|
const parsed = envConfigSchema.safeParse(envValue);
|
|
if (!parsed.success) {
|
|
ctx.addIssue({
|
|
code: z.ZodIssueCode.custom,
|
|
message: "adapterConfig.env must be a map of valid env bindings",
|
|
path: ["env"],
|
|
});
|
|
}
|
|
});
|
|
|
|
export const createAgentInstructionsBundleSchema = z.object({
|
|
entryFile: z.string().trim().min(1).optional(),
|
|
files: z.record(z.string(), z.string()).refine((files) => Object.keys(files).length > 0, {
|
|
message: "instructionsBundle.files must contain at least one file",
|
|
}),
|
|
});
|
|
|
|
const agentModelProfileConfigSchema = z.object({
|
|
enabled: z.boolean().optional(),
|
|
label: z.string().trim().min(1).optional(),
|
|
adapterConfig: adapterConfigSchema,
|
|
}).strict();
|
|
|
|
export const agentRuntimeConfigSchema = z.object({
|
|
modelProfiles: z.object({
|
|
cheap: agentModelProfileConfigSchema.optional(),
|
|
}).strict().optional(),
|
|
}).catchall(z.unknown());
|
|
|
|
export const createAgentSchema = z.object({
|
|
name: z.string().min(1),
|
|
role: z.enum(AGENT_ROLES).optional().default("general"),
|
|
title: z.string().optional().nullable(),
|
|
icon: z.enum(AGENT_ICON_NAMES).optional().nullable(),
|
|
reportsTo: z.string().uuid().optional().nullable(),
|
|
capabilities: z.string().optional().nullable(),
|
|
desiredSkills: z.array(z.string().min(1)).optional(),
|
|
adapterType: agentAdapterTypeSchema,
|
|
adapterConfig: adapterConfigSchema.optional().default({}),
|
|
instructionsBundle: createAgentInstructionsBundleSchema.optional(),
|
|
runtimeConfig: agentRuntimeConfigSchema.optional().default({}),
|
|
defaultEnvironmentId: z.string().uuid().optional().nullable(),
|
|
budgetMonthlyCents: z.number().int().nonnegative().optional().default(0),
|
|
permissions: agentPermissionsSchema.optional(),
|
|
metadata: z.record(z.string(), z.unknown()).optional().nullable(),
|
|
});
|
|
|
|
export type CreateAgent = z.infer<typeof createAgentSchema>;
|
|
|
|
export const createAgentHireSchema = createAgentSchema.extend({
|
|
sourceIssueId: z.string().uuid().optional().nullable(),
|
|
sourceIssueIds: z.array(z.string().uuid()).optional(),
|
|
});
|
|
|
|
export type CreateAgentHire = z.infer<typeof createAgentHireSchema>;
|
|
|
|
export const updateAgentSchema = createAgentSchema
|
|
.omit({ permissions: true })
|
|
.partial()
|
|
.extend({
|
|
permissions: z.never().optional(),
|
|
replaceAdapterConfig: z.boolean().optional(),
|
|
status: z.enum(AGENT_STATUSES).optional(),
|
|
spentMonthlyCents: z.number().int().nonnegative().optional(),
|
|
});
|
|
|
|
export type UpdateAgent = z.infer<typeof updateAgentSchema>;
|
|
|
|
export const updateAgentInstructionsPathSchema = z.object({
|
|
path: z.string().trim().min(1).nullable(),
|
|
adapterConfigKey: z.string().trim().min(1).optional(),
|
|
});
|
|
|
|
export type UpdateAgentInstructionsPath = z.infer<typeof updateAgentInstructionsPathSchema>;
|
|
|
|
export const createAgentKeySchema = z.object({
|
|
name: z.string().min(1).default("default"),
|
|
});
|
|
|
|
export type CreateAgentKey = z.infer<typeof createAgentKeySchema>;
|
|
|
|
export const agentMineInboxQuerySchema = z.object({
|
|
userId: z.string().trim().min(1),
|
|
status: z.string().trim().min(1).optional().default(INBOX_MINE_ISSUE_STATUS_FILTER),
|
|
});
|
|
|
|
export type AgentMineInboxQuery = z.infer<typeof agentMineInboxQuerySchema>;
|
|
|
|
export const wakeAgentSchema = z.object({
|
|
source: z.enum(["timer", "assignment", "on_demand", "automation"]).optional().default("on_demand"),
|
|
triggerDetail: z.enum(["manual", "ping", "callback", "system"]).optional(),
|
|
reason: z.string().optional().nullable(),
|
|
payload: z.record(z.string(), z.unknown()).optional().nullable(),
|
|
idempotencyKey: z.string().optional().nullable(),
|
|
forceFreshSession: z.preprocess(
|
|
(value) => (value === null ? undefined : value),
|
|
z.boolean().optional().default(false),
|
|
),
|
|
});
|
|
|
|
export type WakeAgent = z.infer<typeof wakeAgentSchema>;
|
|
|
|
export const resetAgentSessionSchema = z.object({
|
|
taskKey: z.string().min(1).optional().nullable(),
|
|
});
|
|
|
|
export type ResetAgentSession = z.infer<typeof resetAgentSessionSchema>;
|
|
|
|
export const testAdapterEnvironmentSchema = z.object({
|
|
adapterConfig: adapterConfigSchema.optional().default({}),
|
|
/**
|
|
* Optional environment to run the adapter test inside. When omitted, the
|
|
* test runs against the local Paperclip host. When provided and the
|
|
* environment is non-local (SSH/sandbox), the test probes are executed
|
|
* inside that environment so the result reflects real agent execution.
|
|
*/
|
|
environmentId: z.string().uuid().optional().nullable(),
|
|
});
|
|
|
|
export type TestAdapterEnvironment = z.infer<typeof testAdapterEnvironmentSchema>;
|
|
|
|
export const updateAgentPermissionsSchema = z.object({
|
|
canCreateAgents: z.boolean(),
|
|
canAssignTasks: z.boolean(),
|
|
trustPreset: trustPresetSchema.optional(),
|
|
authorizationPolicy: trustAuthorizationPolicySchema.optional(),
|
|
});
|
|
|
|
export type UpdateAgentPermissions = z.infer<typeof updateAgentPermissionsSchema>;
|