mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 02:00:52 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Sandbox agents need a safe login path for each supported adapter > - Codex device login and Claude setup-token login used separate session stores and route logic > - Separate stores made session lookup, expiry, and login capability checks harder to keep consistent > - This pull request unifies both flows on one session table and one capability contract > - The benefit is one company-scoped login model with public session identifiers and shared lifecycle rules ## Linked Issues or Issue Description **Subsystem affected** Cross-cutting (multiple of the above) **Problem or motivation** Codex and Claude sandbox login used separate session stores and different route paths. This split increased the risk of inconsistent company scoping, session lookup, and cleanup. **Proposed solution** Use `adapter_auth_sessions` for both login flows. Use public session identifiers for API access. Select login behavior from projected adapter capability data. Share the route spine, lease arguments, runner lifecycle, and reaper rules. **Alternatives considered** Keep two session tables and add matching fixes to both routes. This keeps duplicate logic and does not provide one capability contract, so this pull request uses shared infrastructure. **Roadmap alignment** This change supports the shipped Cloud / Sandbox agents milestone in `ROADMAP.md`. ## What Changed - Unify Codex device login and Claude setup-token login on `adapter_auth_sessions`. - Return and look up sessions with company-scoped public session identifiers. - Enforce one active session for each company, owner, and adapter. - Share the login route spine, sandbox lease arguments, runner lifecycle, and missing-auth check. - Add a standalone setup-token reaper with adapter-specific row selection. - Add optional login capability projection for adapters and drive route and UI selection from that data. - Rename the provider flag to `supportsLoginPty` and validate its deprecated alias. - Remove the old Claude setup-token session table and add the required migrations. ## Verification - Server typecheck passed with `tsc`. - Database typecheck passed. - UI typecheck passed with `tsc -b`. - Codex login service and route suites passed. - Setup-token session, route, and reaper suites passed. - Adapter session schema, plugin validator, capability projection, UI render, and Daytona suites passed. - GitHub Actions must confirm the complete CI gate after pull request creation. ## Risks - The migrations remove short-lived in-flight login rows during deployment. A login that spans the migration can continue until its provider lease expires. - The Codex credential store remains company-scoped. A cross-owner credential race remains a documented, board-accepted risk. - API clients that use internal session row identifiers no longer work. The API accepts only public session identifiers. ## Model Used Codex, GPT-5, exact runtime model ID not exposed in this handoff, large context window, reasoning, and repository tool use. The implementing engineer produced the code with AI assistance. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs: #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
200 lines
7.4 KiB
TypeScript
200 lines
7.4 KiB
TypeScript
import type { AgentAdapterType, EnvironmentDriver } from "./constants.js";
|
|
import type { SandboxEnvironmentProvider } from "./types/environment.js";
|
|
import type {
|
|
JsonSchema,
|
|
PluginEnvironmentTemplateConfigBinding,
|
|
SandboxProviderCapabilities,
|
|
} from "./types/plugin.js";
|
|
|
|
/**
|
|
* Resolve the DECLARED sandbox capabilities of a provider driver, with the
|
|
* legacy `supportsReusableLeases` flag folded in for compatibility.
|
|
*
|
|
* The result is a partial: a key is present only when the driver declared it,
|
|
* so a caller can tell a declared `false` from an absent key. The nested
|
|
* `sandboxCapabilities.reusableLeases` wins over the legacy flag when both are
|
|
* present. This is the DECLARATION only; the runtime still intersects it with
|
|
* the verified worker methods and any narrowing before it grants a capability.
|
|
*/
|
|
export function resolveDeclaredSandboxCapabilities(
|
|
driver: {
|
|
supportsReusableLeases?: boolean;
|
|
sandboxCapabilities?: SandboxProviderCapabilities;
|
|
},
|
|
): SandboxProviderCapabilities {
|
|
const declared: SandboxProviderCapabilities = { ...(driver.sandboxCapabilities ?? {}) };
|
|
if (declared.reusableLeases === undefined && driver.supportsReusableLeases !== undefined) {
|
|
declared.reusableLeases = driver.supportsReusableLeases;
|
|
}
|
|
return declared;
|
|
}
|
|
|
|
export type EnvironmentSupportStatus = "supported" | "unsupported";
|
|
|
|
export interface AdapterEnvironmentSupport {
|
|
adapterType: AgentAdapterType;
|
|
drivers: Record<EnvironmentDriver, EnvironmentSupportStatus>;
|
|
sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentSupportStatus>;
|
|
}
|
|
|
|
export interface EnvironmentProviderCapability {
|
|
status: EnvironmentSupportStatus;
|
|
supportsSavedProbe: boolean;
|
|
supportsUnsavedProbe: boolean;
|
|
supportsRunExecution: boolean;
|
|
supportsReusableLeases: boolean;
|
|
supportsInteractiveSetup: boolean;
|
|
interactiveSetupConnectionTypes: string[];
|
|
supportsTemplateCapture: boolean;
|
|
templateRefKind?: string;
|
|
templateConfigBinding?: PluginEnvironmentTemplateConfigBinding;
|
|
supportsTemplateDelete: boolean;
|
|
supportsLoginPty: boolean;
|
|
displayName?: string;
|
|
description?: string;
|
|
source?: "builtin" | "plugin";
|
|
pluginKey?: string;
|
|
pluginId?: string;
|
|
configSchema?: JsonSchema;
|
|
}
|
|
|
|
export interface EnvironmentCapabilities {
|
|
adapters: AdapterEnvironmentSupport[];
|
|
drivers: Record<EnvironmentDriver, EnvironmentSupportStatus>;
|
|
sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentProviderCapability>;
|
|
}
|
|
|
|
const REMOTE_MANAGED_ADAPTERS = new Set<AgentAdapterType>([
|
|
"claude_local",
|
|
"codex_local",
|
|
"cursor",
|
|
"gemini_local",
|
|
"grok_local",
|
|
"opencode_local",
|
|
"pi_local",
|
|
]);
|
|
|
|
export function adapterSupportsRemoteManagedEnvironments(adapterType: string): boolean {
|
|
return REMOTE_MANAGED_ADAPTERS.has(adapterType as AgentAdapterType);
|
|
}
|
|
|
|
export function supportedEnvironmentDriversForAdapter(adapterType: string): EnvironmentDriver[] {
|
|
return adapterSupportsRemoteManagedEnvironments(adapterType)
|
|
? ["local", "ssh", "sandbox"]
|
|
: ["local"];
|
|
}
|
|
|
|
export function supportedSandboxProvidersForAdapter(
|
|
adapterType: string,
|
|
additionalProviders: readonly string[] = [],
|
|
): SandboxEnvironmentProvider[] {
|
|
return adapterSupportsRemoteManagedEnvironments(adapterType)
|
|
? Array.from(new Set(additionalProviders)) as SandboxEnvironmentProvider[]
|
|
: [];
|
|
}
|
|
|
|
export function isEnvironmentDriverSupportedForAdapter(
|
|
adapterType: string,
|
|
driver: string,
|
|
): boolean {
|
|
return supportedEnvironmentDriversForAdapter(adapterType).includes(driver as EnvironmentDriver);
|
|
}
|
|
|
|
export function isSandboxProviderSupportedForAdapter(
|
|
adapterType: string,
|
|
provider: string | null | undefined,
|
|
additionalProviders: readonly string[] = [],
|
|
): boolean {
|
|
if (!provider) return false;
|
|
return supportedSandboxProvidersForAdapter(adapterType, additionalProviders).includes(
|
|
provider as SandboxEnvironmentProvider,
|
|
);
|
|
}
|
|
|
|
export function getAdapterEnvironmentSupport(
|
|
adapterType: AgentAdapterType,
|
|
additionalSandboxProviders: readonly string[] = [],
|
|
): AdapterEnvironmentSupport {
|
|
const supportedDrivers = new Set(supportedEnvironmentDriversForAdapter(adapterType));
|
|
const supportedProviders = new Set(supportedSandboxProvidersForAdapter(adapterType, additionalSandboxProviders));
|
|
const sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentSupportStatus> = {
|
|
fake: "unsupported",
|
|
};
|
|
for (const provider of additionalSandboxProviders) {
|
|
sandboxProviders[provider as SandboxEnvironmentProvider] = supportedProviders.has(provider as SandboxEnvironmentProvider)
|
|
? "supported"
|
|
: "unsupported";
|
|
}
|
|
return {
|
|
adapterType,
|
|
drivers: {
|
|
local: supportedDrivers.has("local") ? "supported" : "unsupported",
|
|
ssh: supportedDrivers.has("ssh") ? "supported" : "unsupported",
|
|
sandbox: supportedDrivers.has("sandbox") ? "supported" : "unsupported",
|
|
plugin: supportedDrivers.has("plugin") ? "supported" : "unsupported",
|
|
},
|
|
sandboxProviders,
|
|
};
|
|
}
|
|
|
|
export function getEnvironmentCapabilities(
|
|
adapterTypes: readonly AgentAdapterType[],
|
|
options: {
|
|
sandboxProviders?: Record<string, Partial<EnvironmentProviderCapability>>;
|
|
} = {},
|
|
): EnvironmentCapabilities {
|
|
const pluginProviderKeys = Object.keys(options.sandboxProviders ?? {});
|
|
const sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentProviderCapability> = {
|
|
fake: {
|
|
status: "unsupported",
|
|
supportsSavedProbe: true,
|
|
supportsUnsavedProbe: true,
|
|
supportsRunExecution: false,
|
|
// The fake provider runtime declares false. The presentation must match
|
|
// it, so execution and presentation agree.
|
|
supportsReusableLeases: false,
|
|
supportsInteractiveSetup: false,
|
|
interactiveSetupConnectionTypes: [],
|
|
supportsTemplateCapture: false,
|
|
supportsTemplateDelete: false,
|
|
supportsLoginPty: false,
|
|
displayName: "Fake",
|
|
source: "builtin",
|
|
},
|
|
};
|
|
for (const [provider, capability] of Object.entries(options.sandboxProviders ?? {})) {
|
|
sandboxProviders[provider as SandboxEnvironmentProvider] = {
|
|
status: capability.status ?? "supported",
|
|
supportsSavedProbe: capability.supportsSavedProbe ?? true,
|
|
supportsUnsavedProbe: capability.supportsUnsavedProbe ?? true,
|
|
supportsRunExecution: capability.supportsRunExecution ?? true,
|
|
// Default absent to false. A manifest that does not declare reusable
|
|
// leases must present as false, so execution (=== true) agrees.
|
|
supportsReusableLeases: capability.supportsReusableLeases ?? false,
|
|
supportsInteractiveSetup: capability.supportsInteractiveSetup ?? false,
|
|
interactiveSetupConnectionTypes: capability.interactiveSetupConnectionTypes ?? [],
|
|
supportsTemplateCapture: capability.supportsTemplateCapture ?? false,
|
|
templateRefKind: capability.templateRefKind,
|
|
templateConfigBinding: capability.templateConfigBinding,
|
|
supportsTemplateDelete: capability.supportsTemplateDelete ?? false,
|
|
supportsLoginPty: capability.supportsLoginPty ?? false,
|
|
displayName: capability.displayName,
|
|
description: capability.description,
|
|
source: capability.source ?? "plugin",
|
|
pluginKey: capability.pluginKey,
|
|
pluginId: capability.pluginId,
|
|
configSchema: capability.configSchema,
|
|
};
|
|
}
|
|
return {
|
|
adapters: adapterTypes.map((adapterType) => getAdapterEnvironmentSupport(adapterType, pluginProviderKeys)),
|
|
drivers: {
|
|
local: "supported",
|
|
ssh: "supported",
|
|
sandbox: "supported",
|
|
plugin: "unsupported",
|
|
},
|
|
sandboxProviders,
|
|
};
|
|
}
|