mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-19 10:36:26 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - A growing part of that work runs in sandboxed environments rather than on the operator's local machine. > - Today sandbox providers can start fresh workspaces and run probes, but they do not have a shared contract for capturing and reusing prepared sandbox state. > - Operators need a way to set up tools, credentials, and project dependencies once, then reuse that prepared image for later agent runs. > - This pull request adds reusable sandbox custom images across the provider contract, server runtime, and board UI. > - It also keeps probes and sandbox copy flows aligned with pre-authenticated/custom-image environments. > - The benefit is faster, more reliable sandbox runs without repeatedly rebuilding the same environment setup. ## Linked Issues or Issue Description No public GitHub issue was found for this change. Inline feature request follows. ### Problem or motivation Sandboxed agents need reusable prepared runtime state so repeated runs do not require manual setup every time. Operators often need system packages, CLIs, SDKs, dependency caches, credentials, and project tooling available before an agent can work productively. ### Proposed solution Add a provider-level custom-image capability, server-side setup/capture lifecycle, Daytona/fake provider support, and board UI controls for creating, testing, selecting, and deleting custom images. ### Alternatives considered Leaving this as provider-specific setup outside Paperclip would keep the control plane blind to image state and would not give agents consistent environment metadata. Re-running setup commands for every lease is simpler, but slower and less reliable for interactive or credentialed setup. ### Roadmap alignment Checked `ROADMAP.md`; this aligns with the Cloud / Sandbox agents roadmap area and does not duplicate any related public issue or PR found by search. Additional context: - Subsystem affected: cross-cutting (`packages/db`, `packages/shared`, `packages/plugins`, `server`, `ui`). - Duplicate search: searched GitHub for `sandbox custom image` and `sandbox template environment`; no related public issues or PRs were found. ## What Changed - Added custom-image shared types, validators, constants, API paths, and database schema/migration. - Added server services/routes for custom-image templates and setup sessions, including runtime cleanup and provider metadata handling. - Extended plugin/sandbox provider capabilities for interactive setup, template capture, and template deletion. - Implemented custom-image support in the fake sandbox provider and Daytona provider. - Updated environment runtime/config handling so active custom images flow into leases, probes, and agent execution. - Added board UI controls and API client support for custom-image setup, capture, selection, status, and error states. - Hardened sandbox copy/probe behavior for insecure clipboard contexts and pre-authenticated sandbox images. - Added targeted coverage across shared validators, DB schema, server routes/services, provider plugins, adapter probes, and UI flows. ## Verification - `pnpm install --frozen-lockfile --ignore-scripts` - `pnpm vitest run packages/adapters/claude-local/src/server/test.probe.test.ts packages/adapters/claude-local/src/server/test.ts packages/adapters/codex-local/src/server/test.remote.test.ts packages/adapters/codex-local/src/server/test.ts` - `pnpm --filter @paperclipai/adapter-claude-local typecheck` - `pnpm --filter @paperclipai/adapter-codex-local typecheck` - `pnpm vitest run packages/db/src/environment-custom-images-schema.test.ts packages/shared/src/environment-custom-images.test.ts packages/shared/src/validators/plugin.test.ts server/src/__tests__/environment-custom-images-service.test.ts server/src/__tests__/workspace-runtime.test.ts packages/plugins/sandbox-providers/daytona/src/plugin.test.ts ui/src/pages/CompanyEnvironments.test.tsx ui/src/pages/CompanySettings.test.tsx` - `pnpm -r typecheck` - `pnpm build` - `rm -rf packages/db/dist && pnpm test:run` - Public-safety scan of the final diff found no internal Paperclip issue links, private instance URLs, or real secret patterns. ## Risks - Adds a database migration and new environment runtime tables, so migration ordering and rollback need care. - Provider implementations may differ in how reliably they can capture/delete images; unsupported providers surface capability-gated UI states. - Custom-image state can contain operator-prepared tooling and credentials inside the provider image, so providers must enforce their own access controls and cleanup semantics. - Broad surface area across shared contracts, server runtime, plugins, adapters, and UI means CI and Greptile review should be watched closely. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI GPT-5 (`gpt-5`) via Codex CLI with tool use and code execution. Assisted with branch cleanup, conflict resolution, local verification, and PR preparation. Earlier branch implementation work was assisted by Paperclip-managed Claude/Codex agents. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
249 lines
8.1 KiB
TypeScript
249 lines
8.1 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { PLUGIN_CAPABILITIES } from "../constants.js";
|
|
import { pluginManagedRoutineDeclarationSchema, pluginManifestV1Schema, pluginUiSlotDeclarationSchema } from "./plugin.js";
|
|
|
|
describe("plugin capability constants", () => {
|
|
it("exposes each capability once", () => {
|
|
expect(new Set(PLUGIN_CAPABILITIES).size).toBe(PLUGIN_CAPABILITIES.length);
|
|
});
|
|
});
|
|
|
|
describe("plugin manifest validators", () => {
|
|
it("accepts existing-style plugins that do not request access or authorization capabilities", () => {
|
|
const parsed = pluginManifestV1Schema.parse({
|
|
id: "paperclip.compat-dashboard",
|
|
apiVersion: 1,
|
|
version: "0.1.0",
|
|
displayName: "Compat Dashboard",
|
|
description: "Dashboard-only plugin without access or authorization host APIs.",
|
|
author: "Paperclip",
|
|
categories: ["ui"],
|
|
capabilities: ["ui.dashboardWidget.register"],
|
|
entrypoints: {
|
|
worker: "./dist/worker.js",
|
|
ui: "./dist/ui.js",
|
|
},
|
|
ui: {
|
|
slots: [
|
|
{
|
|
type: "dashboardWidget",
|
|
id: "compat-dashboard",
|
|
displayName: "Compat Dashboard",
|
|
exportName: "CompatDashboard",
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
expect(parsed.capabilities).toEqual(["ui.dashboardWidget.register"]);
|
|
});
|
|
|
|
it("accepts sandbox provider template config bindings", () => {
|
|
const parsed = pluginManifestV1Schema.parse({
|
|
id: "paperclip.template-provider",
|
|
apiVersion: 1,
|
|
version: "0.1.0",
|
|
displayName: "Template Provider",
|
|
description: "Sandbox provider with captured template config binding.",
|
|
author: "Paperclip",
|
|
categories: ["automation"],
|
|
capabilities: ["environment.drivers.register"],
|
|
entrypoints: { worker: "./dist/worker.js" },
|
|
environmentDrivers: [
|
|
{
|
|
driverKey: "template-provider",
|
|
kind: "sandbox_provider",
|
|
displayName: "Template Provider",
|
|
supportsTemplateCapture: true,
|
|
templateRefKind: "provider_template",
|
|
templateConfigBinding: {
|
|
field: "templateId",
|
|
unsetFields: ["image"],
|
|
},
|
|
configSchema: { type: "object" },
|
|
},
|
|
],
|
|
});
|
|
|
|
expect(parsed.environmentDrivers?.[0]?.templateConfigBinding).toEqual({
|
|
field: "templateId",
|
|
unsetFields: ["image"],
|
|
});
|
|
});
|
|
|
|
it("rejects template config bindings that replace provider identity", () => {
|
|
const parsed = pluginManifestV1Schema.safeParse({
|
|
id: "paperclip.bad-template-provider",
|
|
apiVersion: 1,
|
|
version: "0.1.0",
|
|
displayName: "Bad Template Provider",
|
|
categories: ["automation"],
|
|
capabilities: ["environment.drivers.register"],
|
|
entrypoints: { worker: "./dist/worker.js" },
|
|
environmentDrivers: [
|
|
{
|
|
driverKey: "bad-template-provider",
|
|
kind: "sandbox_provider",
|
|
displayName: "Bad Template Provider",
|
|
templateConfigBinding: {
|
|
field: "provider",
|
|
},
|
|
configSchema: { type: "object" },
|
|
},
|
|
],
|
|
});
|
|
|
|
expect(parsed.success).toBe(false);
|
|
if (parsed.success) return;
|
|
expect(parsed.error.issues.some((issue) => issue.message.includes("provider key"))).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("plugin managed routine validators", () => {
|
|
it("accepts core issue surface visibility values in routine templates", () => {
|
|
const parsed = pluginManagedRoutineDeclarationSchema.parse({
|
|
routineKey: "wiki.refresh",
|
|
title: "Refresh Wiki",
|
|
issueTemplate: { surfaceVisibility: "default" },
|
|
});
|
|
|
|
expect(parsed.issueTemplate?.surfaceVisibility).toBe("default");
|
|
});
|
|
|
|
it("rejects non-core issue surface visibility values in routine templates", () => {
|
|
const parsed = pluginManagedRoutineDeclarationSchema.safeParse({
|
|
routineKey: "wiki.refresh",
|
|
title: "Refresh Wiki",
|
|
issueTemplate: { surfaceVisibility: "normal" },
|
|
});
|
|
|
|
expect(parsed.success).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("plugin managed skill validators", () => {
|
|
const baseManifest = {
|
|
id: "paperclip.test-managed-skills",
|
|
apiVersion: 1,
|
|
version: "0.1.0",
|
|
displayName: "Managed Skills",
|
|
description: "Managed skills test plugin.",
|
|
author: "Paperclip",
|
|
categories: ["automation"],
|
|
entrypoints: { worker: "./dist/worker.js" },
|
|
} as const;
|
|
|
|
it("requires skills.managed when managed skills are declared", () => {
|
|
const parsed = pluginManifestV1Schema.safeParse({
|
|
...baseManifest,
|
|
capabilities: [],
|
|
skills: [{ skillKey: "wiki-maintainer", displayName: "Wiki Maintainer" }],
|
|
});
|
|
|
|
expect(parsed.success).toBe(false);
|
|
if (parsed.success) return;
|
|
expect(parsed.error.issues.some((issue) => issue.message.includes("skills.managed"))).toBe(true);
|
|
});
|
|
|
|
it("accepts managed skills with the skills.managed capability", () => {
|
|
const parsed = pluginManifestV1Schema.parse({
|
|
...baseManifest,
|
|
capabilities: ["skills.managed"],
|
|
skills: [{ skillKey: "wiki-maintainer", displayName: "Wiki Maintainer" }],
|
|
});
|
|
|
|
expect(parsed.skills?.[0]?.skillKey).toBe("wiki-maintainer");
|
|
});
|
|
});
|
|
|
|
describe("plugin UI slot validators", () => {
|
|
it("accepts route-scoped sidebar slots with a routePath", () => {
|
|
const parsed = pluginUiSlotDeclarationSchema.parse({
|
|
type: "routeSidebar",
|
|
id: "wiki-route-sidebar",
|
|
displayName: "Wiki Sidebar",
|
|
exportName: "WikiSidebar",
|
|
routePath: "wiki",
|
|
});
|
|
|
|
expect(parsed.routePath).toBe("wiki");
|
|
});
|
|
|
|
it("requires route-scoped sidebar slots to declare a routePath", () => {
|
|
const parsed = pluginUiSlotDeclarationSchema.safeParse({
|
|
type: "routeSidebar",
|
|
id: "wiki-route-sidebar",
|
|
displayName: "Wiki Sidebar",
|
|
exportName: "WikiSidebar",
|
|
});
|
|
|
|
expect(parsed.success).toBe(false);
|
|
if (parsed.success) return;
|
|
expect(parsed.error.issues[0]?.message).toBe("routeSidebar slots require routePath");
|
|
});
|
|
|
|
it("keeps reserved company route protection for route-scoped sidebars", () => {
|
|
const parsed = pluginUiSlotDeclarationSchema.safeParse({
|
|
type: "routeSidebar",
|
|
id: "settings-route-sidebar",
|
|
displayName: "Settings Sidebar",
|
|
exportName: "SettingsSidebar",
|
|
routePath: "settings",
|
|
});
|
|
|
|
expect(parsed.success).toBe(false);
|
|
if (parsed.success) return;
|
|
expect(parsed.error.issues.some((issue) => issue.message.includes("reserved by the host"))).toBe(true);
|
|
});
|
|
|
|
it("accepts workspace entity types as detailTab targets", () => {
|
|
const parsed = pluginUiSlotDeclarationSchema.parse({
|
|
type: "detailTab",
|
|
id: "workspace-diff-viewer",
|
|
displayName: "Diff",
|
|
exportName: "WorkspaceDiffViewer",
|
|
entityTypes: ["execution_workspace", "project_workspace"],
|
|
});
|
|
|
|
expect(parsed.entityTypes).toEqual(["execution_workspace", "project_workspace"]);
|
|
});
|
|
|
|
it("accepts execution_workspace as a toolbarButton entityType", () => {
|
|
const parsed = pluginUiSlotDeclarationSchema.parse({
|
|
type: "toolbarButton",
|
|
id: "workspace-open-diff",
|
|
displayName: "Open diff",
|
|
exportName: "OpenWorkspaceDiffButton",
|
|
entityTypes: ["execution_workspace"],
|
|
});
|
|
|
|
expect(parsed.entityTypes).toEqual(["execution_workspace"]);
|
|
});
|
|
|
|
it("accepts company settings page slots with a non-core settings route", () => {
|
|
const parsed = pluginUiSlotDeclarationSchema.parse({
|
|
type: "companySettingsPage",
|
|
id: "permissions-settings",
|
|
displayName: "Permissions",
|
|
exportName: "PermissionsSettingsPage",
|
|
routePath: "permissions",
|
|
});
|
|
|
|
expect(parsed.routePath).toBe("permissions");
|
|
});
|
|
|
|
it("prevents company settings page slots from shadowing core settings routes", () => {
|
|
const parsed = pluginUiSlotDeclarationSchema.safeParse({
|
|
type: "companySettingsPage",
|
|
id: "instance-settings",
|
|
displayName: "Instance",
|
|
exportName: "InstanceSettingsPage",
|
|
routePath: "instance",
|
|
});
|
|
|
|
expect(parsed.success).toBe(false);
|
|
if (parsed.success) return;
|
|
expect(parsed.error.issues.some((issue) => issue.message.includes("reserved by the host"))).toBe(true);
|
|
});
|
|
});
|