mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-06 10:48:12 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Managed worktree services run isolated Paperclip instances with cloned databases. > - A reachable service was reported as ready even when its database, runtime identity, or login path was not usable. > - The first candidate added verified database seeding and managed repair in #11665. > - This pull request consolidates that candidate with signed login handoff and a complete readiness contract. > - Post-QA fixes close five defects in repair identity, repair responses, UI retry, seed journal handling, and seed-source trust. > - The benefit is a workspace that either opens safely or reports one accurate recovery action. ## Linked Issues or Issue Description No public GitHub issue exists for this work, so the problem is described here. **What happened** Managed workspace URLs could return HTTP 200 and report ready while login failed. QA also found cases where repair used the wrong instance identity, returned a generic error, left the UI stuck, rejected a safe journal lag, or trusted a mutable workspace manifest. **Expected behavior** Opening a ready workspace signs the board user in to the correct isolated instance. Provisioning and repair use a registered source and report a structured recovery state. **Actual behavior** Entry depended on a password copied into the clone. Several failure paths could publish stale readiness, hide the repair precondition, or trust state that the workspace could modify. **Additional context** This pull request includes the commits first published in #11665. That pull request keeps the original base head for review history. This consolidated pull request is the merge candidate. Related open readiness work includes #11575 and #11621. ## What Changed - Adds a short-lived, signed, single-use login ticket. It binds the user, workspace, instance, and runtime origin. - Exchanges the ticket through Better Auth. It creates the session and cookie through the supported adapter path. - Adds protected workspace readiness fields for the database, clone data, login handoff, seed phase, and runtime identity. - Fails readiness closed when the guest has no company or execution-workspace binding. - Binds ticket issuance to the exact cloned user and active company membership selected for the handoff. - Verifies every current active board identity through the exact-user handoff before publication or reuse. - Gates managed runtime publication on the readiness contract and the recorded worktree instance identity. - Refreshes runtime work products from the live runtime row after a port change. - Adds one workspace access card with ready, degraded, repairing, and failed states. - Uses the runtime response identity for repair. It returns structured repair precondition errors. - Lets a valid source journal lag converge during provisioning. - Binds seed and repair manifests to a source registered outside the agent-writable worktree. - Clears recovered UI errors so a successful retry can open the workspace. - Makes runtime tests register canonical sources and avoid ports owned by live host listeners. - Keeps Vitest on source suites when compiled `dist` trees exist. - Isolates CLI and adapter tests from ambient AWS and runtime API environment variables. - Preserves a 404 response for cross-company workspace ID lookups before runtime authorization. - Makes concurrent single-flight coverage independent of path-canonicalization scheduling order. ## Verification The following checks passed on the integrated head: ```sh pnpm -r typecheck pnpm build pnpm check:token-gates pnpm --filter @paperclipai/db check:migrations ``` - The server source lane passed 420 files and 4,953 tests. Five tests were skipped. - The CLI lane passed 57 files and 385 tests. - The database lane passed 26 files and 97 tests. - The shared package passed 58 files and 506 tests. - The adapter utility lane passed 640 tests. Four tests were skipped. - The Claude adapter passed 220 tests. One test was skipped. - The Codex adapter passed 323 tests. - The OpenClaw adapter passed 13 tests. - The OpenCode adapter passed 42 tests. - The plugin SDK passed 45 tests. - The workspace runtime suite passed 124 tests. - The caller-scoped readiness and handoff suite passed 52 tests. - The workspace provisioning shell suite passed 7 tests. - The runtime exposure suite passed 17 tests while live host mappings occupied fixed test ports. - `git diff --check` passed and the worktree is clean. The serialized route lane will run in GitHub CI with its normal shards. No deployment or active-workspace migration was performed. ## Risks - This is a medium-risk authentication and runtime-readiness change. - The login ticket uses exact origin, workspace, instance, and user binding. It has a short expiry and a one-time nonce. - Runtime publication is stricter. A real readiness, identity, per-user handoff, or control-plane database disagreement now blocks publication. - This pull request supersedes #11665 as the merge candidate. Close #11665 after this pull request merges. - No new database migration is included. The lockfile and workflow files are unchanged. - Deployment and active-workspace migration are intentionally outside this pull request. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used Claude Opus 5 (`claude-opus-5[1m]`), 1M context, extended thinking, tool use, and code execution produced the main candidate. OpenAI GPT-5 (`gpt-5`) through Codex, with agentic reasoning, tool use, and code execution, integrated the post-QA fixes and hardened the test gates. The Codex context-window size was not exposed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
150 lines
5.3 KiB
Bash
Executable File
150 lines
5.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
base_cwd="${PAPERCLIP_WORKSPACE_BASE_CWD:?PAPERCLIP_WORKSPACE_BASE_CWD is required}"
|
|
worktree_cwd="${PAPERCLIP_WORKSPACE_CWD:?PAPERCLIP_WORKSPACE_CWD is required}"
|
|
paperclip_dir="$worktree_cwd/.paperclip"
|
|
worktree_config_path="$paperclip_dir/config.json"
|
|
seed_manifest_path="$paperclip_dir/seed-manifest.json"
|
|
seed_pending_marker_path="$paperclip_dir/seed-pending"
|
|
seed_complete_marker_path="$paperclip_dir/seed-complete"
|
|
|
|
if [[ ! -d "$base_cwd" ]]; then
|
|
echo "Base workspace does not exist: $base_cwd" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -d "$worktree_cwd" ]]; then
|
|
echo "Derived worktree does not exist: $worktree_cwd" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -e "$seed_manifest_path" ]]; then
|
|
seed_manifest_state="$(SEED_MANIFEST_PATH="$seed_manifest_path" node <<'EOF'
|
|
const fs = require("node:fs");
|
|
try {
|
|
const value = JSON.parse(fs.readFileSync(process.env.SEED_MANIFEST_PATH, "utf8"));
|
|
const complete = value?.version === 2
|
|
&& value?.state === "verified"
|
|
&& value?.phase === "complete"
|
|
&& typeof value?.source?.instanceId === "string" && value.source.instanceId.length > 0
|
|
&& typeof value?.source?.configPath === "string" && value.source.configPath.length > 0
|
|
&& (value?.seedMode === "minimal" || value?.seedMode === "full")
|
|
&& typeof value?.snapshotAt === "string" && value.snapshotAt.length > 0
|
|
&& typeof value?.migrationRevision === "string" && value.migrationRevision.length > 0
|
|
&& typeof value?.targetInstanceId === "string" && value.targetInstanceId.length > 0
|
|
&& typeof value?.attemptId === "string" && value.attemptId.length > 0
|
|
&& typeof value?.startedAt === "string"
|
|
&& typeof value?.finishedAt === "string"
|
|
&& Array.isArray(value?.diagnostics)
|
|
&& value.diagnostics.some((entry) => entry?.phase === "complete" && entry?.status === "succeeded" && typeof entry?.at === "string");
|
|
process.stdout.write(complete ? "verified" : "incomplete");
|
|
} catch {
|
|
process.stdout.write("invalid");
|
|
}
|
|
EOF
|
|
)"
|
|
if [[ "$seed_manifest_state" == "verified" ]]; then
|
|
echo "Worktree database has a verified seed manifest; skipping runtime provisioning." >&2
|
|
exit 0
|
|
fi
|
|
elif [[ -e "$seed_complete_marker_path" || ! -e "$seed_pending_marker_path" ]]; then
|
|
echo "Worktree database is already seeded by a legacy marker; skipping runtime provisioning." >&2
|
|
exit 0
|
|
fi
|
|
|
|
if [[ ! -f "$worktree_config_path" ]]; then
|
|
echo "Worktree config does not exist: $worktree_config_path" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# The CLI derives the source from PAPERCLIP_WORKSPACE_BASE_CWD, which the
|
|
# control plane injects from the registered project-workspace row. The seed
|
|
# manifest is diagnostic evidence only and must never choose the clone source.
|
|
source_config_args=()
|
|
|
|
base_cli_runner_path="$base_cwd/cli/node_modules/tsx/dist/cli.mjs"
|
|
base_cli_entry_path="$base_cwd/cli/src/index.ts"
|
|
|
|
base_cli_files_present() {
|
|
[[ -f "$base_cli_runner_path" && -f "$base_cli_entry_path" ]]
|
|
}
|
|
|
|
base_cli_healthy() {
|
|
base_cli_files_present || return 1
|
|
(cd "$base_cwd" && node "$base_cli_runner_path" "$base_cli_entry_path" --help >/dev/null 2>&1)
|
|
}
|
|
|
|
repair_base_workspace_install() {
|
|
command -v pnpm >/dev/null 2>&1 || return 1
|
|
[[ -f "$base_cwd/package.json" && -f "$base_cwd/pnpm-lock.yaml" ]] || return 1
|
|
echo "Base workspace CLI at $base_cli_entry_path failed its health check (typically dangling pnpm symlinks after a partial install); repairing with pnpm install in $base_cwd." >&2
|
|
local repair_cmd=(pnpm install --prod=false --force --frozen-lockfile --config.confirmModulesPurge=false)
|
|
local repair_lock_dir=""
|
|
if command -v git >/dev/null 2>&1; then
|
|
repair_lock_dir="$(git -C "$base_cwd" rev-parse --absolute-git-dir 2>/dev/null || true)"
|
|
fi
|
|
if [[ ! -d "$repair_lock_dir" && -d "$base_cwd/.git" ]]; then
|
|
repair_lock_dir="$base_cwd/.git"
|
|
fi
|
|
if command -v flock >/dev/null 2>&1 && [[ -d "$repair_lock_dir" ]]; then
|
|
(
|
|
cd "$base_cwd" || exit 1
|
|
exec 9>"$repair_lock_dir/paperclip-provision-repair.lock"
|
|
flock 9
|
|
if base_cli_healthy; then
|
|
echo "Base workspace CLI became healthy while waiting for the repair lock; skipping reinstall." >&2
|
|
exit 0
|
|
fi
|
|
env -u NODE_ENV CI=true "${repair_cmd[@]}" >&2 || exit 1
|
|
base_cli_healthy
|
|
)
|
|
else
|
|
(cd "$base_cwd" && env -u NODE_ENV CI=true "${repair_cmd[@]}" >&2 && base_cli_healthy)
|
|
fi
|
|
}
|
|
|
|
ensure_base_cli_healthy() {
|
|
base_cli_files_present || return 1
|
|
base_cli_healthy && return 0
|
|
repair_base_workspace_install
|
|
}
|
|
|
|
run_ensure_seeded() {
|
|
if ensure_base_cli_healthy; then
|
|
(
|
|
cd "$worktree_cwd" &&
|
|
node "$base_cli_runner_path" "$base_cli_entry_path" worktree ensure-seeded --config "$worktree_config_path" "${source_config_args[@]}"
|
|
)
|
|
return
|
|
fi
|
|
|
|
if command -v pnpm >/dev/null 2>&1 && pnpm paperclipai --help >/dev/null 2>&1; then
|
|
(
|
|
cd "$worktree_cwd" &&
|
|
pnpm paperclipai worktree ensure-seeded --config "$worktree_config_path" "${source_config_args[@]}"
|
|
)
|
|
return
|
|
fi
|
|
|
|
if command -v paperclipai >/dev/null 2>&1; then
|
|
(
|
|
cd "$worktree_cwd" &&
|
|
paperclipai worktree ensure-seeded --config "$worktree_config_path" "${source_config_args[@]}"
|
|
)
|
|
return
|
|
fi
|
|
|
|
return 127
|
|
}
|
|
|
|
if run_ensure_seeded; then
|
|
exit 0
|
|
else
|
|
exit_code=$?
|
|
if [[ "$exit_code" -eq 127 ]]; then
|
|
echo "No usable paperclipai CLI found; cannot seed the worktree database." >&2
|
|
fi
|
|
exit "$exit_code"
|
|
fi
|