mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-09 16:35:27 +02:00
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Hosting operators (a managed cloud, an internal shared server) tune
the settings surface with `PAPERCLIP_HIDDEN_SETTINGS`, but hiding a
control never changes its value
> - An instance whose stored feedback-sharing preference is still the
schema default ("prompt") keeps prompting users even when the operator
hid the control, leaving them no way to answer
> - More generally, operators have no supported way to change what a
setting defaults to without patching code
> - This pull request adds `PAPERCLIP_SETTING_DEFAULTS`, a generic
operator-supplied read-time default overlay for registry-listed general
settings
> - The benefit is that any hosting operator can pair "hide the control"
with "default the value", while explicit user choices and self-hosted
stock behavior stay untouched
## Linked Issues or Issue Description
No public issue exists; following the enhancement template:
**What existing behavior does this improve?**
Hosting operators need to supply the default value of selected instance
settings (first: `feedbackDataSharingPreference`) via configuration,
without patching code and without a hard-coded, opinionated constant in
the product.
**Subsystem affected**
Server (instance-settings service, feedback service, boot) and
`packages/shared` (settings schemas).
**Current behavior**
Setting defaults are fixed in the shared zod schemas.
`PAPERCLIP_HIDDEN_SETTINGS` can hide the feedback-sharing control and
floor writes, but the stored value stays "prompt", so issue-chat
surfaces keep prompting with no way to answer.
**Proposed behavior**
`PAPERCLIP_SETTING_DEFAULTS` takes a JSON object validated against a
shared registry of defaultable fields. The operator value substitutes
for the schema default at read time: a field whose effective value is
still the schema default resolves to the operator value; an explicit
non-default user choice always wins. Never persisted; unsetting the
variable restores stock behavior. Malformed JSON or an invalid value for
a known field refuses startup (fail closed); unknown field names warn
and are ignored (mixed-version fleet safe).
**Reason and benefit**
Any hosting operator can pair "hide the control" with "default the
value" without forking the product. Explicit user choices and
self-hosted stock behavior stay untouched.
**Breaking changes**
None. With the variable unset, every read path is byte-identical to
before.
## What Changed
- New `packages/shared/src/setting-defaults.ts`:
`SETTING_DEFAULTS_ENV_KEY`, `DEFAULTABLE_GENERAL_SETTINGS` registry
(currently `feedbackDataSharingPreference`), `parseSettingDefaults`
(fail-closed for policy content, warn-ignore unknown fields),
`applyOperatorGeneralDefaults` (pure read-time overlay),
`stripOperatorGeneralEchoes` (persist-time echo strip, see below),
re-exported from the package index.
- New `server/src/services/setting-defaults.ts`: parse-once accessor
mirroring `settings-visibility.ts`.
- `server/src/services/instance-settings.ts`: `toGeneralView` applies
the overlay in `get`/`getGeneral`/update responses; persisted writes
never carry operator values. Because general-settings writes materialize
every field, a stored schema-default value is treated as unchosen —
deliberate, documented, and covered by tests.
- `server/src/services/feedback.ts`: the preference-persistence branch
now checks the effective (overlaid) preference, so a stray prompt answer
cannot overwrite an operator default; its local normalize fallback now
returns full schema defaults.
- `server/src/index.ts`: boot-time fail-fast parse with a log line
naming the defaulted settings, mirroring the managed-config posture.
- The hidden-settings write floor (`assertNoHiddenSettingChanges`) keeps
comparing against effective values, so clients echoing a full GET
response keep working. To keep the overlay strictly read-time,
`updateGeneral` strips such echoes at persist time: a write of the
operator value over a field whose stored value is still the schema
default (unchosen) maps back to the schema default, so an echo cannot
promote the operator value into an explicit stored choice and later
changes to (or removal of) `PAPERCLIP_SETTING_DEFAULTS` still take
effect. A write of any other value, or over an explicit stored choice,
persists as given.
- Docs: `PAPERCLIP_SETTING_DEFAULTS` row + "Operator setting defaults"
section in `docs/deploy/environment-variables.md`.
- Tests: `packages/shared/src/setting-defaults.test.ts` (parse matrix,
overlay precedence, echo-strip matrix, immutability) and
`server/src/__tests__/instance-settings-operator-defaults.test.ts`
(accessor, substitution, explicit-choice wins, unset identity,
never-persisted, full-GET echo stays unchosen, explicit non-default
write persists).
## Verification
- `npx vitest run packages/shared/src/setting-defaults.test.ts
server/src/__tests__/instance-settings-operator-defaults.test.ts
server/src/__tests__/instance-settings-managed-overlay.test.ts` — 33
tests passing.
- `npx vitest run server/src/__tests__/instance-settings-routes.test.ts
server/src/__tests__/instance-settings-service.test.ts` — 57 passing;
`npx vitest run server/src/__tests__/feedback-service.test.ts
server/src/__tests__/issue-feedback-routes.test.ts` — 18 passing.
- `pnpm --filter @paperclipai/shared typecheck` and `pnpm --filter
@paperclipai/server typecheck` — clean.
## Risks
- Low. With the variable unset every read path is byte-identical to
before (identity overlay, covered by tests). The overlay is read-time
only and never persisted, so no migration and no data risk. Fail-closed
parsing means a bad policy value is a loud boot failure rather than
silent drift — consistent with the existing managed-config contract.
## Model Used
Claude (Anthropic), model id `claude-fable-5`, extended thinking,
agentic tool use via Claude Code.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
137 lines
5.9 KiB
TypeScript
137 lines
5.9 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
DEFAULTABLE_GENERAL_SETTINGS,
|
|
SETTING_DEFAULTS_ENV_KEY,
|
|
applyOperatorGeneralDefaults,
|
|
parseSettingDefaults,
|
|
stripOperatorGeneralEchoes,
|
|
} from "./setting-defaults.js";
|
|
import { instanceGeneralSettingsSchema } from "./validators/instance.js";
|
|
|
|
describe("parseSettingDefaults", () => {
|
|
it("returns null defaults for an unset or blank variable", () => {
|
|
expect(parseSettingDefaults(undefined)).toEqual({ defaults: null, unknown: [] });
|
|
expect(parseSettingDefaults("")).toEqual({ defaults: null, unknown: [] });
|
|
expect(parseSettingDefaults(" ")).toEqual({ defaults: null, unknown: [] });
|
|
});
|
|
|
|
it("parses known fields and validates their values", () => {
|
|
const { defaults, unknown } = parseSettingDefaults(
|
|
'{"feedbackDataSharingPreference":"allowed"}',
|
|
);
|
|
expect(defaults).toEqual({ feedbackDataSharingPreference: "allowed" });
|
|
expect(unknown).toEqual([]);
|
|
});
|
|
|
|
it("collects unknown fields instead of failing, for mixed-version fleets", () => {
|
|
const { defaults, unknown } = parseSettingDefaults(
|
|
'{"feedbackDataSharingPreference":"not_allowed","someFutureSetting":true}',
|
|
);
|
|
expect(defaults).toEqual({ feedbackDataSharingPreference: "not_allowed" });
|
|
expect(unknown).toEqual(["someFutureSetting"]);
|
|
});
|
|
|
|
it("fails closed on malformed JSON and non-object shapes", () => {
|
|
expect(() => parseSettingDefaults("{nope")).toThrow(SETTING_DEFAULTS_ENV_KEY);
|
|
expect(() => parseSettingDefaults('"allowed"')).toThrow(/JSON object/);
|
|
expect(() => parseSettingDefaults("[1,2]")).toThrow(/JSON object/);
|
|
expect(() => parseSettingDefaults("null")).toThrow(/JSON object/);
|
|
});
|
|
|
|
it("fails closed on an invalid value for a known field", () => {
|
|
expect(() =>
|
|
parseSettingDefaults('{"feedbackDataSharingPreference":"sometimes"}'),
|
|
).toThrow(/feedbackDataSharingPreference/);
|
|
});
|
|
|
|
it("keeps every registry entry a real general-settings field", () => {
|
|
const shape = Object.keys(instanceGeneralSettingsSchema.shape);
|
|
for (const key of DEFAULTABLE_GENERAL_SETTINGS) {
|
|
expect(shape).toContain(key);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("applyOperatorGeneralDefaults", () => {
|
|
const schemaDefaults = instanceGeneralSettingsSchema.parse({});
|
|
|
|
it("is the identity when no operator defaults are configured", () => {
|
|
expect(applyOperatorGeneralDefaults(schemaDefaults, null)).toBe(schemaDefaults);
|
|
});
|
|
|
|
it("substitutes the operator value where the schema default still holds", () => {
|
|
const overlaid = applyOperatorGeneralDefaults(schemaDefaults, {
|
|
feedbackDataSharingPreference: "allowed",
|
|
});
|
|
expect(overlaid.feedbackDataSharingPreference).toBe("allowed");
|
|
// Other fields are untouched.
|
|
expect(overlaid.backupRetention).toEqual(schemaDefaults.backupRetention);
|
|
});
|
|
|
|
it("never overrides an explicit non-default choice", () => {
|
|
const chosen = { ...schemaDefaults, feedbackDataSharingPreference: "not_allowed" as const };
|
|
const overlaid = applyOperatorGeneralDefaults(chosen, {
|
|
feedbackDataSharingPreference: "allowed",
|
|
});
|
|
expect(overlaid.feedbackDataSharingPreference).toBe("not_allowed");
|
|
expect(overlaid).toBe(chosen);
|
|
});
|
|
|
|
it("does not mutate its input", () => {
|
|
const input = { ...schemaDefaults };
|
|
applyOperatorGeneralDefaults(input, { feedbackDataSharingPreference: "allowed" });
|
|
expect(input.feedbackDataSharingPreference).toBe(
|
|
schemaDefaults.feedbackDataSharingPreference,
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("stripOperatorGeneralEchoes", () => {
|
|
const schemaDefaults = instanceGeneralSettingsSchema.parse({});
|
|
const defaults = { feedbackDataSharingPreference: "allowed" as const };
|
|
|
|
it("is the identity when no operator defaults are configured", () => {
|
|
const next = { ...schemaDefaults, feedbackDataSharingPreference: "allowed" as const };
|
|
expect(stripOperatorGeneralEchoes(schemaDefaults, next, null)).toBe(next);
|
|
});
|
|
|
|
it("maps an echoed operator value on an unchosen field back to the schema default", () => {
|
|
// Stored is still the schema default (unchosen); the incoming full-object
|
|
// echo carries the overlaid operator value. Persisting it would make the
|
|
// operator value sticky, so it maps back to the schema default.
|
|
const next = { ...schemaDefaults, feedbackDataSharingPreference: "allowed" as const };
|
|
const stripped = stripOperatorGeneralEchoes(schemaDefaults, next, defaults);
|
|
expect(stripped.feedbackDataSharingPreference).toBe(
|
|
schemaDefaults.feedbackDataSharingPreference,
|
|
);
|
|
});
|
|
|
|
it("keeps an incoming value that differs from the operator default", () => {
|
|
const next = { ...schemaDefaults, feedbackDataSharingPreference: "not_allowed" as const };
|
|
const stripped = stripOperatorGeneralEchoes(schemaDefaults, next, defaults);
|
|
expect(stripped).toBe(next);
|
|
expect(stripped.feedbackDataSharingPreference).toBe("not_allowed");
|
|
});
|
|
|
|
it("keeps a write over an explicit stored choice, even at the operator value", () => {
|
|
// The user previously chose "not_allowed" and now picks the operator's
|
|
// value: stored is not the schema default, so this is a real transition
|
|
// and persists as given.
|
|
const stored = { ...schemaDefaults, feedbackDataSharingPreference: "not_allowed" as const };
|
|
const next = { ...schemaDefaults, feedbackDataSharingPreference: "allowed" as const };
|
|
const stripped = stripOperatorGeneralEchoes(stored, next, defaults);
|
|
expect(stripped).toBe(next);
|
|
expect(stripped.feedbackDataSharingPreference).toBe("allowed");
|
|
});
|
|
|
|
it("does not mutate its inputs", () => {
|
|
const stored = { ...schemaDefaults };
|
|
const next = { ...schemaDefaults, feedbackDataSharingPreference: "allowed" as const };
|
|
stripOperatorGeneralEchoes(stored, next, defaults);
|
|
expect(next.feedbackDataSharingPreference).toBe("allowed");
|
|
expect(stored.feedbackDataSharingPreference).toBe(
|
|
schemaDefaults.feedbackDataSharingPreference,
|
|
);
|
|
});
|
|
});
|