mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-09 16:02:36 +01:00
DottaandClaude Opus 5.5
63e550b338
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Agents call connected-app tools (for example GitHub
`create_repository`) through the tool gateway, and a write call waits
for a human approval card
> - The pending approval card showed an "Arguments and audit hash"
disclosure. The disclosure printed the 64-character SHA-256 of the
reviewed arguments
> - A new user in onboarding testing called this "a long hash string in
the review approval card" that is confusing and unapproachable
> - The hash identifies the exact arguments for audit. The approver does
not need to read it to decide
> - This pull request removes the raw hash from the card text and keeps
it behind a "Copy audit hash" action
> - The benefit is a plain approval card, with the audit value still
available to people who need it
## Linked Issues or Issue Description
**What happened?**
On the pending tool-approval card, the "Arguments and audit hash"
disclosure printed the raw SHA-256 of the reviewed arguments (for
example `8ca5312877235a…`, 64 hex characters) under the arguments JSON.
**Expected behavior**
The approval card uses plain language. Internal identifiers do not show
as card text. A person who needs the audit hash can still get it.
**Steps to reproduce**
1. Let an agent call a write tool on a connected app (for example GitHub
`create_repository`).
2. Open the pending "Approve tool action" card ("Review request").
3. Expand "Arguments and audit hash". The raw 64-character hash shows
under the arguments.
**Paperclip version or commit**
Current `master` (819420a60a) and the Paperclip Cloud staging build used
for onboarding tests.
## What Changed
- New `ToolActionAuditHashCopy` button
(`ui/src/components/ToolActionAuditHashCopy.tsx`). It copies the
arguments hash to the clipboard through the shared `useCopyAction` hook,
and shows "Copied" or "Couldn’t copy".
- `IssueThreadInteractionCard` (`RequestToolActionCard`): the disclosure
is now "Arguments". The raw hash `<p>` is replaced by the copy button.
- `TaskChatCompactInteractionCard`: the same change in both places that
printed `toolAction.argumentsHash`.
- If the clipboard is blocked, the button shows "Couldn’t copy" and the
hash then shows as selectable text, so the audit value stays reachable
(review feedback).
- Tests: a new regression test renders the review flow with the real
staging payload shape (GitHub `create_repository`, raw gallery tool id,
64-hex hash) and asserts that no `/[0-9a-f]{12,}/i` text shows before or
after the disclosure opens, and that the copy action writes the hash.
The existing long-proposal test now asserts that the hash is not in the
disclosure text. `ToolActionAuditHashCopy.test.tsx` covers copy success
and the blocked-clipboard fallback. The clipboard mock is restored after
the test.
## Verification
Red on `master` (new test only, before the fix):
```
FAIL src/components/task-chat/TaskChatInteractionCard.test.tsx > TaskChatInteractionCard > keeps raw tool ids and the audit hash out of the tool approval card text
AssertionError: expected 'Gcreate_repository · Name: brainrot-s…' not to match /[0-9a-f]{12,}/i
+ Received:
"Gcreate_repository · Name: brainrot-storefront-prototype · Private: trueArguments and audit hash{\"name\":\"brainrot-storefront-prototype\",\"private\":true}8ca5312877235a4c0f6e9b1d2a7c3e5f9081b2c4d6e8fa1b3c5d7e9f0a2b4c6dDeclineApprove & run"
Test Files 1 failed (1)
Tests 1 failed | 32 skipped (33)
```
Green after the fix (same test):
```
Test Files 1 passed (1)
Tests 1 passed | 32 skipped (33)
```
Neighbouring suites (`ui/src/components/task-chat`,
`IssueThreadInteractionCard.test.tsx`, `AttentionQueueRow.test.tsx`,
`transcript/RunTranscriptView.test.tsx`), after rebase on current
`master`:
```
Test Files 62 passed (62)
Tests 1047 passed (1047)
```
After the review fixes (`ToolActionAuditHashCopy.test.tsx`, `task-chat`,
`IssueThreadInteractionCard.test.tsx`):
```
Test Files 61 passed (61)
Tests 1004 passed (1004)
```
- `pnpm check:token-gates`: all gates clean.
- `tsc --noEmit` on `ui`: no errors in the changed files.
- Visual check in Storybook story `Issue Thread Interactions / Tool
Action Pending Write`, disclosure open:
- Before: the summary reads "Arguments and audit hash" and a mono line
`sha256:9f2c1a7be4d0c8a3` shows under the JSON.
- After: the summary reads "Arguments". A small ghost "Copy audit hash"
button shows under the JSON. No hash text shows.
## Risks
- Low risk. UI copy and layout change on one card type only. The server
payload, the approval decision, and the stored hash do not change.
- A person who read the hash off the card must now use the copy button.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
## Model Used
- Anthropic Claude Opus 5.5 (`claude-opus-5-5`), in Claude Code with
tool use (shell, file edits, browser). Default context window and
reasoning mode.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>