mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-19 20:44:16 +02:00
DottaandPaperclip
c41e00bca4
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Agent startup checks access to every source retained by a workspace. > - Repository admission repeats these checks while it holds a company lock. > - PR #16334 indexed the workspace privacy query. The next source-task query still cast the task primary key to text. > - That second query scanned company history for every workspace and delayed other agent launches. > - This pull request keeps the task column indexed and guards the retained identifiers before conversion. > - The benefit is faster startup with the same source validation and access decisions. ## Linked Issues or Issue Description Refs #16334. **What happened?** Agent launches still spent minutes preparing repositories after the first authorization query fix. The source-task lookup scanned 14,191 task rows for one matching source. **Expected behavior** Source validation should use the task primary key and workspace-binding index. It must still reject missing, malformed, noncanonical, and foreign-company sources. **Steps to reproduce** 1. Seed company task history and a workspace with attached and retained source tasks. 2. Call `assertTaskWorkspaceAccess` and capture its source-task SQL. 3. Run `EXPLAIN (ANALYZE, FORMAT JSON)` on that query. The baseline scans unrelated task history. ## What Changed - Convert retained text identifiers with the existing canonical UUID guard. Keep the indexed task column as a UUID. - Exercise the real source-access service against PostgreSQL. Verify complete source results, malformed and uppercase input behavior, and rows examined by the plan. - Document the second source-validation query and its regression coverage. ## Verification - Red: the new regression failed because the source lookup examined 1,202 rows for two sources. - Green: four focused workspace suites passed, 147 tests total. The final regression also checks malformed and uppercase query inputs. - Live read-only comparison: two warmups, then five samples per variant in alternating order. Median client query time changed from 4.88 ms to 0.35 ms. Complete result rows matched. Shared buffer hits changed from 3,984 to 5. These measurements cover this SQL statement, not total agent startup. - The complete source-access helper also passed for the same retained reader in read-only transactions. Its median changed from 15.75 ms to 10.75 ms; repository admission still repeats other checks. - `pnpm -r typecheck` and `pnpm build` passed locally. The staged Linux build and all seven final regression cases passed on Node 24.20.0. - All 55 current-head checks/statuses passed; two Storybook checks were skipped. Greptile reviewed `6cfb755` at 5/5 with no findings. - The full local test run encountered a tracing-test failure in `native-session-executor.test.ts`. Both that test alone and the complete file passed on rerun (698 tests). The remaining full-suite run is still in progress. ## Risks - This changes SQL planning on an authorization path. The canonical guard preserves the former exact lowercase text match and avoids UUID parse errors. - Company filters, missing-source checks, project checks, and per-source access decisions remain in place. - No schema migration or new index is required. Repeated checks across large repository histories remain a separate source of startup work. ## Model Used - OpenAI Codex, GPT-6 family, with reasoning, shell tools, code execution, and browser verification. The exact model ID and context-window size are not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>