mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 12:04:41 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Environments give each agent run an execution target: the local host, SSH, or a sandbox provider > - A managed deployment can provision one platform-managed sandbox environment through the `PAPERCLIP_MANAGED_CONFIG` `environments` section > - That row is fully locked today. A tenant cannot add environment variables for their agents. There is also no way to hide local execution — run selection falls back to the local row > - A platform that manages the sandbox for its tenants needs both: the tenant adds env vars (and nothing else), and local execution is neither visible nor reachable > - This pull request opens exactly one tenant edit (env vars) on the managed sandbox row, and adds an `enableManagedSandboxOnly` mode that hides local and makes run selection fail closed > - The benefit is a complete managed-sandbox experience with no change for self-hosted instances ## Linked Issues or Issue Description **Subsystem affected** Environments (managed sandbox provisioning, environment routes, run environment selection) and the environments UI. **Problem or motivation** Platform-provisioned sandbox environments (`metadata.managedByPaperclip`) reject every write on cloud-managed instances. Agents often need environment variables inside their sandbox. The tenant has no way to set them on the managed row. Separately, an operator cannot remove local execution: the environment list always shows the local row, and run selection falls back to it when no default is set. **Proposed solution** Allow an envVars-only PATCH on the managed sandbox row, and echo those env vars back for editing. Add a managed-tier feature (`enableManagedSandboxOnly`) that hides the local environment from all read surfaces and redirects local-landing run selection to the managed sandbox environment, failing closed when it is unavailable. **Alternatives considered** UI-only hiding of the local row. This was rejected: it does not stop a run from resolving to local, so it is presentation without enforcement. Full unlock of the managed row was also rejected: name, driver, and config stay platform-owned so boot reconciliation cannot fight tenant edits. ## What Changed - `server/src/routes/environments.ts`: the platform-provisioned write floor admits an envVars-only PATCH on the generalized managed sandbox row (sandbox driver, `managedByPaperclip`, not legacy kubernetes-marker rows). Name, driver, config, status, metadata, and DELETE stay rejected. The read floor stops blanking env vars on that row; credential-shaped config keys stay redacted for every actor. Legacy kubernetes-marker rows keep the full floor. - Same file: under `enableManagedSandboxOnly`, the environments list and the by-id read omit the local row for every actor, including instance admins. - `server/src/services/execution-workspace-policy.ts`: `resolveExecutionWorkspaceEnvironmentId` gains the managed-sandbox-only inputs. A selection that lands on the local environment is redirected to the managed sandbox environment. With no active managed row it throws `ManagedSandboxUnavailableError` — never local. Non-local selections (ssh, user-created sandboxes) are untouched. - `server/src/services/heartbeat.ts`: the run path reads the flag, looks up the managed row (`findManagedSandboxEnvironment`, new read-only finder in `environments.ts`), and passes both to the resolver. Mirrors the forced-kubernetes precedent, which keeps precedence when both regimes are on. - `server/src/services/managed-environments.ts`: after a successful reconcile, the instance default environment moves to the managed sandbox row when the current default is unset, local, or dangling. A tenant-chosen custom environment is never overridden. - `packages/shared`: new `enableManagedSandboxOnly` key (schema default false, catalog tier `managed`, cloudDefault false, selfHostedDefault false) and the matching interface field. - UI: managed rows show a "Managed by Paperclip" lock badge; editing one opens a dedicated env-vars-only editor that sends the one PATCH shape the server admits (the old full form failed with a 403 on save). New `ui/src/lib/managed-sandbox-environment.ts` mirrors the local filter for cached lists (applied in the project picker; the agent picker already excluded local). The experimental settings page gains the toggle at its alphabetical card position. `environmentsApi.update` now declares the `envVars` field it already sent. - Tests: environment route floor coverage (envVars-only accepted, mixed bodies rejected, legacy rows still blanked and locked, local hidden and 404 under the flag, self-hosted unchanged), an embedded-postgres service test pinning that boot reconciliation never touches tenant env vars, resolver redirect/fail-closed cases, managed-environments default-stamping cases, and UI lib/settings tests. ## Verification - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/environment-routes.test.ts src/__tests__/environment-service.test.ts src/__tests__/execution-workspace-policy.test.ts src/services/managed-environments.test.ts` — all pass. - `pnpm --filter @paperclipai/shared exec vitest run` — 425 pass (catalog/schema default parity is pinned by an existing test). - `pnpm --filter @paperclipai/ui exec tsc --noEmit` and the affected UI suites (CompanyEnvironments, InstanceExperimentalSettings incl. card-order test, new lib test) — all pass. - Full workspace `pnpm test`: 3,414 passed. 17 files report failures on this machine; the identical 17 fail on a clean `origin/master` worktree in the same environment (git-worktree/skills/embedded-postgres environment dependencies and plugin-SDK zero-test collections). One additional file (`issue-monitor-scheduler.test.ts`) failed one timing-sensitive test in one of two full-suite runs and passes 7/7 in isolation on this branch — a flake in a domain this diff does not touch. The branch introduces no new failures. - Self-hosted zero-delta: every new behavior is gated on the cloud-managed instance check or the new flag, which defaults to false in schema and catalog; pinned by the "does not floor platform-marked rows on self-hosted instances" and flag-off tests. ## Risks - Behavior is opt-in twice over: the write-floor exception applies only to rows the managed-config provisioner stamps, and the hiding/forcing applies only when `enableManagedSandboxOnly` is on (default false everywhere). Self-hosted instances see no change. - The env-vars echo is scoped to the generalized managed sandbox row; legacy kubernetes-marker rows keep the blanket floor because pre-generalization builds may have written platform values there. - Fail-closed run selection means a managed instance with the flag on and an archived managed row (provider plugin down) refuses runs with a precise error instead of running locally. That is the intended posture. ## Model Used Claude Fable 5 (`claude-fable-5`), extended thinking, agentic tool use via Claude Code CLI. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge
299 lines
11 KiB
TypeScript
299 lines
11 KiB
TypeScript
import { z } from "zod";
|
|
import { instanceExperimentalSettingsSchema } from "./validators/instance.js";
|
|
|
|
/**
|
|
* Feature catalog for cloud-managed instances.
|
|
*
|
|
* The instance-settings zod schema is the feature manifest; this module adds
|
|
* only metadata about the flags the schema already declares. Keys are derived
|
|
* from the schema type, so adding, removing, or renaming a boolean flag in
|
|
* `instanceExperimentalSettingsSchema` without updating the metadata map is a
|
|
* compile error (and vice versa).
|
|
*
|
|
* Tiers:
|
|
* - `preference`: tenant-controllable taste setting; the cloud harness does
|
|
* not manage it.
|
|
* - `managed`: the cloud harness may set this per fleet/stack via
|
|
* `PAPERCLIP_MANAGED_CONFIG`.
|
|
* - `floor`: pinned by code on managed instances; no flag value may widen it.
|
|
*/
|
|
export const FEATURE_TIERS = ["preference", "managed", "floor"] as const;
|
|
|
|
export type FeatureTier = (typeof FEATURE_TIERS)[number];
|
|
|
|
type ExperimentalSettings = z.infer<typeof instanceExperimentalSettingsSchema>;
|
|
|
|
/**
|
|
* The boolean flag keys of the experimental settings schema. Non-flag keys
|
|
* (activation timestamps, numeric tuning values) are excluded.
|
|
*/
|
|
export type InstanceFeatureKey = {
|
|
[K in keyof ExperimentalSettings]: ExperimentalSettings[K] extends boolean ? K : never;
|
|
}[keyof ExperimentalSettings];
|
|
|
|
export interface FeatureCatalogEntry {
|
|
title: string;
|
|
description: string;
|
|
tier: FeatureTier;
|
|
/** Desired default on cloud-managed instances. */
|
|
cloudDefault: boolean;
|
|
/** Must match the schema default; enforced by test. */
|
|
selfHostedDefault: boolean;
|
|
}
|
|
|
|
export const INSTANCE_FEATURE_CATALOG: Record<InstanceFeatureKey, FeatureCatalogEntry> = {
|
|
enableEnvironments: {
|
|
title: "Environments",
|
|
description:
|
|
"Show environment management in company settings and allow project and agent environment assignment controls.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableManagedSandboxOnly: {
|
|
title: "Managed Sandbox Only",
|
|
description:
|
|
"Hide the local environment and run all agents in the platform-managed sandbox environment.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableIsolatedWorkspaces: {
|
|
title: "Isolated Workspaces",
|
|
description:
|
|
"Show execution workspace controls in project configuration and allow isolated workspace behavior for task runs.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableStreamlinedLeftNavigation: {
|
|
title: "Streamlined Left Navigation",
|
|
description: "Use the streamlined main sidebar navigation layout.",
|
|
tier: "preference",
|
|
cloudDefault: true,
|
|
selfHostedDefault: true,
|
|
},
|
|
enableApps: {
|
|
title: "Apps",
|
|
description:
|
|
"Show the Apps navigation and allow access to app connections, gateways, and advanced app tooling.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enablePipelines: {
|
|
title: "Pipelines",
|
|
description: "Enable pipeline definitions and pipeline-driven case production surfaces.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableCases: {
|
|
title: "Cases",
|
|
description:
|
|
"Durable work products that tasks create and iterate on. Adds the Cases tab and the agent case API.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableConferenceRoomChat: {
|
|
title: "Conference Room Chat",
|
|
description:
|
|
"Add the Conference Room team chat, the live activity feed, and the redesigned onboarding; restyles task threads as chat bubbles.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableClassicTaskInterface: {
|
|
title: "Classic Task Interface",
|
|
description:
|
|
"Restore the pre-chat task detail page: the page-level header with inline description editor, the plain comment thread, and the fixed Properties sidebar. Chat-only features (streaming activity folding, inline plan/question cards, the three-mode composer) are unavailable in the classic view.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableTaskWatchdogs: {
|
|
title: "Task Watchdogs",
|
|
description:
|
|
"Show task detail controls for configuring watchdog agents that verify stopped task subtrees and restore live paths when work should continue.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableIssuePlanDecompositions: {
|
|
title: "Task Plan Decomposition Panel",
|
|
description: "Show accepted-plan decomposition history on task detail pages.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableExperimentalFileViewer: {
|
|
title: "Experimental File Viewer",
|
|
description:
|
|
"Show task detail controls for browsing and previewing workspace files relative to a task.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableStatusCards: {
|
|
title: "Status Cards",
|
|
description:
|
|
"Enable the experimental shared status-card board, update engine, and gated API.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableExternalObjects: {
|
|
title: "External Objects",
|
|
description:
|
|
"Detect external URLs in issues and show resolved status for pull requests, tickets, and other referenced work objects.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableSmokeLab: {
|
|
title: "Smoke Lab",
|
|
description:
|
|
"Add the Smoke Lab tab and dashboard card for exercising integration paths against deterministic local fixtures. Private deployments only.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableBuiltInAgents: {
|
|
title: "Built-in Agents",
|
|
description:
|
|
"Show Paperclip-managed built-in agent surfaces, including roster badges, the Built-in agents tab, and setup controls.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableBetaSkills: {
|
|
title: "Beta skills",
|
|
description: "Allow agents to pin beta releases of the Paperclip core skill.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableSummaries: {
|
|
title: "Summaries",
|
|
description:
|
|
"Show Summarizer-generated status slots on project and workspace pages, with on-demand refresh and revision history.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableDecisions: {
|
|
title: "Decisions",
|
|
description:
|
|
"Show the Decisions item in the main sidebar — the attention home that surfaces tasks awaiting input.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableGoalsSidebarLink: {
|
|
title: "Goals Sidebar Link",
|
|
description: "Restore the Goals item in the main sidebar while the goals surface is being evaluated.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableSimplifiedEnglishInteractions: {
|
|
title: "Simplified English Interactions",
|
|
description:
|
|
"Instruct agents to write user interactions (confirmations, questions, suggested tasks) in ASD-STE100 Simplified Technical English with brief decision context.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableServerInfoDebugView: {
|
|
title: "Server Info Debug View",
|
|
description:
|
|
"Show a Server section in the account drawer with the current server restart time and running commit.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
autoRestartDevServerWhenIdle: {
|
|
title: "Auto-Restart Dev Server When Idle",
|
|
description:
|
|
"In local development, wait for queued and running agent runs to finish, then restart the server automatically when backend changes make the current boot stale.",
|
|
tier: "preference",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableIssueGraphLivenessAutoRecovery: {
|
|
title: "Auto-Create Recovery Tasks",
|
|
description:
|
|
"Let the heartbeat scheduler create recovery tasks for task dependency chains found inside the configured lookback window.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableWorkspaceBranchReconcileForward: {
|
|
title: "Workspace Branch Reconcile Forward",
|
|
description:
|
|
"Let execution workspaces reconcile a diverged recorded branch forward instead of failing branch containment.",
|
|
tier: "managed",
|
|
cloudDefault: true,
|
|
selfHostedDefault: true,
|
|
},
|
|
enableWorkspaceDirtyQuarantineRepair: {
|
|
title: "Workspace Dirty Quarantine Repair",
|
|
description:
|
|
"Let workspace runtime recovery quarantine and repair dirty execution workspaces before runs.",
|
|
tier: "managed",
|
|
cloudDefault: true,
|
|
selfHostedDefault: true,
|
|
},
|
|
enableOwnerInstanceAdmin: {
|
|
title: "Owner Instance Admin",
|
|
description:
|
|
"On cloud-managed instances, grant the stack owner instance-admin access to their own dedicated instance. Elevation is computed at the trusted-header auth boundary; no instance admin role rows are created. Inert on self-hosted instances.",
|
|
tier: "managed",
|
|
cloudDefault: true,
|
|
selfHostedDefault: false,
|
|
},
|
|
enableWorktreeRunExecution: {
|
|
title: "Worktree Run Execution",
|
|
description:
|
|
"Let the scheduler execute runs inside an isolated git-worktree preview instance for tasks created after activation.",
|
|
tier: "managed",
|
|
cloudDefault: false,
|
|
selfHostedDefault: false,
|
|
},
|
|
};
|
|
|
|
export const INSTANCE_FEATURE_KEYS = Object.keys(INSTANCE_FEATURE_CATALOG).sort() as InstanceFeatureKey[];
|
|
|
|
/**
|
|
* Shape of the `feature-catalog.json` release artifact the cloud harness
|
|
* imports per app release and validates feature writes against.
|
|
*/
|
|
export const featureCatalogArtifactSchema = z
|
|
.object({
|
|
catalogVersion: z.string().min(1),
|
|
features: z.record(
|
|
z.string().min(1),
|
|
z.object({ tier: z.enum(FEATURE_TIERS) }).strict(),
|
|
),
|
|
})
|
|
.strict();
|
|
|
|
export type FeatureCatalogArtifact = z.infer<typeof featureCatalogArtifactSchema>;
|
|
|
|
export function buildFeatureCatalogArtifact(catalogVersion: string): FeatureCatalogArtifact {
|
|
if (catalogVersion.trim().length === 0) {
|
|
throw new Error("catalogVersion must be a non-empty string");
|
|
}
|
|
const features: FeatureCatalogArtifact["features"] = {};
|
|
for (const key of INSTANCE_FEATURE_KEYS) {
|
|
features[key] = { tier: INSTANCE_FEATURE_CATALOG[key].tier };
|
|
}
|
|
return { catalogVersion, features };
|
|
}
|
|
|
|
/** Deterministic serialization (sorted keys, trailing newline) for the artifact file. */
|
|
export function renderFeatureCatalogArtifact(catalogVersion: string): string {
|
|
return `${JSON.stringify(buildFeatureCatalogArtifact(catalogVersion), null, 2)}\n`;
|
|
}
|