Files
PaperClipAI/packages/shared/src/app-definitions.generated.ts
T
Devin Foley 059ae49cab feat(connections): add Unikraft Cloud connection (#17139)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Apps connections give agents governed access to external services
through vault credentials, grants, action policies, the tool gateway,
and audit.
> - Unikraft Cloud runs unikernel micro-VMs, services, and volumes
across regional metros, and it offers a sandbox plugin for commands and
files.
> - Unikraft is not in the catalog. It has no hosted MCP server, so the
generic "Connect your own MCP server" flow cannot reach it.
> - Daytona (#16483) added a native REST pattern for this case: a
catalog generated from the provider's published OpenAPI specifications
and executed through the gateway.
> - This pull request adds Unikraft on that pattern and moves the shared
native-provider code into one registry, so the shared connection code
does not name each provider.
> - The benefit is governed agent access to all published Unikraft
actions, with the token kept in the vault and sent only to published
Unikraft hosts.

## Linked Issues or Issue Description

Refs #16483

**Problem or motivation**

Teams that run workloads on Unikraft Cloud want their agents to list
instances, read logs, deploy and scale services, and run commands in
sandboxes. Unikraft is not in the Apps catalog. Unikraft has no hosted
MCP server, so operators cannot connect it through the remote MCP flow.

**Proposed solution**

Add a native Unikraft connection. Generate its actions from Unikraft's
official OpenAPI specifications for the platform API and the sandbox
plugin. Pin the specifications to a reviewed commit. The operator
connects an API token. The token stays in the vault and goes only to the
five published metro hosts. Every action takes an optional metro.
Actions without a metro use the connection's default metro, which the
operator can change under Advanced.

**Alternatives considered**

A catalog-only AppDefinition was not possible because no hosted MCP
endpoint exists. Wrapping the `unikraft` CLI was rejected because it
would expose host filesystem behavior and CLI login state. A second copy
of the Daytona bridge was rejected; the shared transport and catalog
contract are now one module with a provider registry.

**Roadmap alignment**

This extends the existing Apps and Connections provider coverage. It
uses the existing credential, grant, policy, gateway, and audit model.
It does not overlap planned core work.

## What Changed

- Added `scripts/generate-unikraft-tools.mjs` and its tests. The
generator reads the platform and sandbox plugin specifications at commit
`5dd107ea1cd8716b83cb86a83ed2a6ee46f99b5b`, resolves shared parameters,
records source SHA-256 hashes, and writes
`server/src/services/unikraft/operations.generated.json`.
- The catalog has 105 actions: 89 platform operations and 16 sandbox
plugin operations. The server-sent audit event stream is recorded in the
inventory and is not advertised as an action.
- Classification: GET operations and sandbox reads and waits are reads.
Delete, stop, suspend, detach, unpin, and sandbox command execution,
signals, and stdin are destructive. All other operations are writes.
- Added `server/src/services/connectors/unikraft/client.ts` and its
generated catalog. It validates arguments against the generated schemas,
accepts only published metros, rejects path traversal, sends JSON bodies
on GET and DELETE as the specification requires, and verifies the token
with `GET /v1/users/quotas`. A sandbox wait that times out (documented
HTTP 408) returns a still-running result instead of a failure.
- Moved the bounded, credential-redacting HTTP sender and the catalog
contract helpers from `daytona.ts` to `native-rest-client.ts`. Added
`native-provider-catalogs.ts`. `tool-access.ts`, the
`tool-access/catalog` and `token-broker` modules,
`connectors/tool-policy.ts`, and `tool-gateway.ts` now use this registry
instead of Daytona-specific checks. Daytona behavior does not change.
- Added the Unikraft definition source, the generated definition, the
brand mark and manifest entry, and the permission review (`liveProof:
not-run`).
- Added `doc/connections/UNIKRAFT.md` with a sequence diagram,
endpoints, setup, actions, and limits. Updated the connections README,
the permission audit, and both capability maps.
- Tests: definition shape, database-backed gateway reads, writes,
deletes, and sandbox commands for personal and shared grants, default
and per-call metros, rejection of unpublished metros and traversal, Off
policies, revocation, stale-contract blocking, credential export denial,
schema validation for all actions, pinned-transport tests for GET and
DELETE bodies, and a browser setup check.

## Verification

- `pnpm exec vitest run packages/shared/src
server/src/__tests__/unikraft-connection.test.ts
server/src/__tests__/unikraft-http-boundary.test.ts
server/src/__tests__/daytona-connection.test.ts
server/src/__tests__/daytona-http-boundary.test.ts
server/src/__tests__/tool-access-service.test.ts
server/src/__tests__/tool-gateway-service.test.ts
server/src/__tests__/tool-gateway.test.ts
ui/src/pages/apps/AppsConnect.test.tsx ui/src/pages/apps/Browse.test.tsx
ui/src/lib/app-brand-assets.test.ts` plus `connector-tool-policy` and
`tool-catalog-publication`: all passed after the rebase onto the split
tool-access modules.
- `node --test scripts/generate-unikraft-tools.test.mjs
scripts/generate-daytona-tools.test.mjs
scripts/app-brand-validation.test.mjs`: 20 passed.
- `node scripts/check-app-brand-assets.mjs`, `node
scripts/check-maps.mjs`, and `git diff --check`: passed.
- `pnpm --filter @paperclipai/shared typecheck`, `pnpm --filter
@paperclipai/server typecheck`, and `pnpm --filter @paperclipai/ui
typecheck`: clean.
- `npx playwright test --config tests/e2e/playwright.config.ts
tests/e2e/unikraft-connector.spec.ts
tests/e2e/daytona-connector.spec.ts`: 2 passed.
- `node scripts/generate-unikraft-tools.mjs` regenerates the committed
catalog with the recorded hashes.
- Manual: on a local instance, open Connectors, search for Unikraft, and
select **Add key**. Confirm the icon, the password field, the key
guidance, and the default metro select under **Change**.
- Not verified: a real Unikraft account. Live provider read and write
proof is pending.

## Risks

- A Unikraft token acts for the whole organization in every metro.
Unikraft offers no narrower token permissions. Assign only trusted
agents and review action permissions.
- Sandbox actions run arbitrary commands inside the selected instance.
They are classified as destructive.
- A timed-out write can still complete at the provider. The bridge does
not retry writes automatically.
- New metros fail closed until the specification is regenerated and
reviewed. Legacy `*.kraft.cloud` hosts are not reachable.
- The Daytona refactor moves code without behavior changes. All Daytona
tests pass without edits.
- The generated JSON snapshot is large because it holds the provider
input contracts. No migration or lockfile change is required.

## Model Used

- Claude Opus 5.5 (Anthropic), model ID `claude-opus-5-5`, 1M context
window, used through Claude Code with tool use (shell, file editing, web
research, browser tests).

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-10-22 15:14:26 -07:00

112 lines
8.3 KiB
TypeScript

import a0 from "./app-definitions/agentmail.json" with { type: "json" };
import a1 from "./app-definitions/zapier.json" with { type: "json" };
import a2 from "./app-definitions/arcade.json" with { type: "json" };
import a3 from "./app-definitions/executor.json" with { type: "json" };
import a4 from "./app-definitions/railway.json" with { type: "json" };
import a5 from "./app-definitions/github.json" with { type: "json" };
import a6 from "./app-definitions/github-code-review-bot.json" with { type: "json" };
import a7 from "./app-definitions/slack.json" with { type: "json" };
import a8 from "./app-definitions/microsoft-teams.json" with { type: "json" };
import a9 from "./app-definitions/imessage-photon.json" with { type: "json" };
import a10 from "./app-definitions/telegram.json" with { type: "json" };
import a11 from "./app-definitions/discord.json" with { type: "json" };
import a12 from "./app-definitions/notion.json" with { type: "json" };
import a13 from "./app-definitions/posthog.json" with { type: "json" };
import a14 from "./app-definitions/linear.json" with { type: "json" };
import a15 from "./app-definitions/context7.json" with { type: "json" };
import a16 from "./app-definitions/shopify.json" with { type: "json" };
import a17 from "./app-definitions/composio.json" with { type: "json" };
import a18 from "./app-definitions/oauth-generic.json" with { type: "json" };
import a19 from "./app-definitions/api-key-generic.json" with { type: "json" };
import a20 from "./app-definitions/sentry.json" with { type: "json" };
import a21 from "./app-definitions/vercel.json" with { type: "json" };
import a22 from "./app-definitions/enterpret.json" with { type: "json" };
import a23 from "./app-definitions/anthropic.json" with { type: "json" };
import a24 from "./app-definitions/browser-use-cloud.json" with { type: "json" };
import a25 from "./app-definitions/cognee.json" with { type: "json" };
import a26 from "./app-definitions/jira.json" with { type: "json" };
import a27 from "./app-definitions/airtable.json" with { type: "json" };
import a28 from "./app-definitions/beehiiv.json" with { type: "json" };
import a29 from "./app-definitions/bitly.json" with { type: "json" };
import a30 from "./app-definitions/candid.json" with { type: "json" };
import a31 from "./app-definitions/cloudflare.json" with { type: "json" };
import a32 from "./app-definitions/cloudinary.json" with { type: "json" };
import a33 from "./app-definitions/coda.json" with { type: "json" };
import a34 from "./app-definitions/hugging-face.json" with { type: "json" };
import a35 from "./app-definitions/kernel.json" with { type: "json" };
import a36 from "./app-definitions/local-falcon.json" with { type: "json" };
import a37 from "./app-definitions/make.json" with { type: "json" };
import a38 from "./app-definitions/manufact.json" with { type: "json" };
import a39 from "./app-definitions/miro.json" with { type: "json" };
import a40 from "./app-definitions/netlify.json" with { type: "json" };
import a41 from "./app-definitions/oreilly.json" with { type: "json" };
import a42 from "./app-definitions/planetscale.json" with { type: "json" };
import a43 from "./app-definitions/resend.json" with { type: "json" };
import a44 from "./app-definitions/ticktick.json" with { type: "json" };
import a45 from "./app-definitions/todoist.json" with { type: "json" };
import a46 from "./app-definitions/webflow.json" with { type: "json" };
import a47 from "./app-definitions/wix.json" with { type: "json" };
import a48 from "./app-definitions/brex.json" with { type: "json" };
import a49 from "./app-definitions/clickhouse.json" with { type: "json" };
import a50 from "./app-definitions/egnyte.json" with { type: "json" };
import a51 from "./app-definitions/embat.json" with { type: "json" };
import a52 from "./app-definitions/mixpanel.json" with { type: "json" };
import a53 from "./app-definitions/postman.json" with { type: "json" };
import a54 from "./app-definitions/razorpay.json" with { type: "json" };
import a55 from "./app-definitions/sanity.json" with { type: "json" };
import a56 from "./app-definitions/stripe.json" with { type: "json" };
import a57 from "./app-definitions/supabase.json" with { type: "json" };
import a58 from "./app-definitions/ticket-tailor.json" with { type: "json" };
import a59 from "./app-definitions/asana.json" with { type: "json" };
import a60 from "./app-definitions/box.json" with { type: "json" };
import a61 from "./app-definitions/mem0.json" with { type: "json" };
import a62 from "./app-definitions/pagerduty.json" with { type: "json" };
import a63 from "./app-definitions/similarweb.json" with { type: "json" };
import a64 from "./app-definitions/xero.json" with { type: "json" };
import a65 from "./app-definitions/youcom.json" with { type: "json" };
import a66 from "./app-definitions/fireflies.json" with { type: "json" };
import a67 from "./app-definitions/zep.json" with { type: "json" };
import a68 from "./app-definitions/supermemory.json" with { type: "json" };
import a69 from "./app-definitions/honcho.json" with { type: "json" };
import a70 from "./app-definitions/neon.json" with { type: "json" };
import a71 from "./app-definitions/superagent.json" with { type: "json" };
import a72 from "./app-definitions/telem.json" with { type: "json" };
import a73 from "./app-definitions/gauge.json" with { type: "json" };
import a74 from "./app-definitions/tavily.json" with { type: "json" };
import a75 from "./app-definitions/calendly.json" with { type: "json" };
import a76 from "./app-definitions/exa.json" with { type: "json" };
import a77 from "./app-definitions/firecrawl.json" with { type: "json" };
import a78 from "./app-definitions/parallel-search.json" with { type: "json" };
import a79 from "./app-definitions/windsor-ai.json" with { type: "json" };
import a80 from "./app-definitions/gsc-wizard.json" with { type: "json" };
import a81 from "./app-definitions/clickup.json" with { type: "json" };
import a82 from "./app-definitions/klaviyo.json" with { type: "json" };
import a83 from "./app-definitions/ditto.json" with { type: "json" };
import a84 from "./app-definitions/braintrust.json" with { type: "json" };
import a85 from "./app-definitions/google-workspace.json" with { type: "json" };
import a86 from "./app-definitions/gmail.json" with { type: "json" };
import a87 from "./app-definitions/google-drive.json" with { type: "json" };
import a88 from "./app-definitions/google-docs.json" with { type: "json" };
import a89 from "./app-definitions/google-sheets.json" with { type: "json" };
import a90 from "./app-definitions/google-slides.json" with { type: "json" };
import a91 from "./app-definitions/google-calendar.json" with { type: "json" };
import a92 from "./app-definitions/google-chat.json" with { type: "json" };
import a93 from "./app-definitions/google-people.json" with { type: "json" };
import a94 from "./app-definitions/google-workspace-search.json" with { type: "json" };
import a95 from "./app-definitions/openai.json" with { type: "json" };
import a96 from "./app-definitions/openrouter.json" with { type: "json" };
import a97 from "./app-definitions/xai.json" with { type: "json" };
import a98 from "./app-definitions/google.json" with { type: "json" };
import a99 from "./app-definitions/bedrock.json" with { type: "json" };
import a100 from "./app-definitions/responses-api.json" with { type: "json" };
import a101 from "./app-definitions/messages-api.json" with { type: "json" };
import a102 from "./app-definitions/chat-completions-api.json" with { type: "json" };
import a103 from "./app-definitions/local.json" with { type: "json" };
import a104 from "./app-definitions/daytona.json" with { type: "json" };
import a105 from "./app-definitions/monday.json" with { type: "json" };
import a106 from "./app-definitions/paperclip-notebook.json" with { type: "json" };
import a107 from "./app-definitions/unikraft.json" with { type: "json" };
import a108 from "./app-definitions/speko.json" with { type: "json" };
import type { AppDefinition } from "./types/app-definition.js";
export const APP_DEFINITIONS=[a0,a1,a2,a3,a4,a5,a6,a7,a8,a9,a10,a11,a12,a13,a14,a15,a16,a17,a18,a19,a20,a21,a22,a23,a24,a25,a26,a27,a28,a29,a30,a31,a32,a33,a34,a35,a36,a37,a38,a39,a40,a41,a42,a43,a44,a45,a46,a47,a48,a49,a50,a51,a52,a53,a54,a55,a56,a57,a58,a59,a60,a61,a62,a63,a64,a65,a66,a67,a68,a69,a70,a71,a72,a73,a74,a75,a76,a77,a78,a79,a80,a81,a82,a83,a84,a85,a86,a87,a88,a89,a90,a91,a92,a93,a94,a95,a96,a97,a98,a99,a100,a101,a102,a103,a104,a105,a106,a107,a108] as AppDefinition[];