mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-08 21:03:51 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Paperclip provides CLI commands and guidance for operators and agents > - The `pnpm paperclipai` script can pass argument values through a shell > - Shell re-parsing can execute command substitutions inside quoted values > - This pull request routes guidance through inert-argv `npx paperclipai` commands and adds regression coverage > - The benefit is safer operator guidance across documentation and runtime hints ## Linked Issues or Issue Description This pull request fixes a command-injection-class defect in Paperclip CLI guidance. **What happened?** The `pnpm paperclipai <sub> --flag "$VALUE"` form can re-parse argument values through a shell. A command substitution inside a quoted value can execute on the host. **Expected behavior** Paperclip guidance must pass CLI values as inert argument values. Host-derived values must not appear in copyable commands. **Steps to reproduce** 1. Run a Paperclip guidance command that uses the `pnpm paperclipai` script. 2. Provide a quoted value that contains a command substitution. 3. Observe that the shell can evaluate the substitution before the CLI starts. 4. Compare the result with the `npx paperclipai` form. **Paperclip version or commit** `5670984b75d109950c968542a0111ebb6967f4da` **Deployment mode** All deployment modes that show or use the affected CLI guidance. **Installation method** Built from source and installed CLI guidance. **Agent adapter(s) involved** Not adapter-specific (core bug). **Database mode** Not database-related. **Access context** Both. **Additional context** The earlier merged PR [#11343](https://github.com/paperclipai/paperclip/pull/11343) used the unsafe `pnpm exec paperclipai` form. This fresh PR replaces that guidance with the safe `npx paperclipai` form. ## What Changed - Standardize documentation and runtime hints on `npx paperclipai`. - Remove the broken `pnpm exec paperclipai` guidance. - Use a static `<host>` placeholder in private-hostname guidance. - Add regression tests for unsafe forms, continued lines, static hosts, and offline guidance. ## Verification - `git diff --check origin/master...origin/fix/paperclipai-cli-npx-safe-invocation` passes. - The branch adds `server/src/__tests__/cli-invocation-safety.test.ts` and updates private-hostname tests. - CI must run the new tests, typecheck, lint, and build checks. - Local Vitest execution was not available because this worktree has no installed Vitest binary. ## Risks - The change affects operator and agent documentation text. - The runtime hints now show `<host>` instead of a request-derived host value. - No database schema or migration changes exist. - CI will detect any missed unsafe invocation or type error. ## Model Used OpenAI GPT-5, exact model ID `gpt-5`, with tool use and code-review assistance. The model used repository inspection, Git operations, and PR preparation. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] CI ran the test suites and they pass; local test execution was unavailable in this worktree - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I addressed all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
153 lines
4.3 KiB
Markdown
153 lines
4.3 KiB
Markdown
---
|
|
title: Control-Plane Commands
|
|
summary: Issue, agent, approval, and dashboard commands
|
|
---
|
|
|
|
Client-side commands for managing issues, agents, approvals, and more.
|
|
|
|
## Issue Commands
|
|
|
|
```sh
|
|
# List issues
|
|
npx paperclipai issue list [--status todo,in_progress] [--assignee-agent-id <id>] [--match text]
|
|
|
|
# Get issue details
|
|
npx paperclipai issue get <issue-id-or-identifier>
|
|
|
|
# Create issue
|
|
npx paperclipai issue create --title "..." [--description "..."] [--status todo] [--priority high]
|
|
|
|
# Update issue
|
|
npx paperclipai issue update <issue-id> [--status in_progress] [--comment "..."]
|
|
|
|
# Add comment
|
|
npx paperclipai issue comment <issue-id> --body "..." [--reopen]
|
|
|
|
# Checkout task
|
|
npx paperclipai issue checkout <issue-id> --agent-id <agent-id>
|
|
|
|
# Release task
|
|
npx paperclipai issue release <issue-id>
|
|
```
|
|
|
|
## Company Commands
|
|
|
|
```sh
|
|
npx paperclipai company list
|
|
npx paperclipai company get <company-id>
|
|
npx paperclipai company current [--company-id <company-id>]
|
|
|
|
# Export to portable folder package (writes manifest + markdown files)
|
|
npx paperclipai company export <company-id> --out ./exports/acme --include company,agents
|
|
|
|
# Preview import (no writes)
|
|
npx paperclipai company import \
|
|
<owner>/<repo>/<path> \
|
|
--target existing \
|
|
--company-id <company-id> \
|
|
--ref main \
|
|
--collision rename \
|
|
--dry-run
|
|
|
|
# Apply import
|
|
npx paperclipai company import \
|
|
./exports/acme \
|
|
--target new \
|
|
--new-company-name "Acme Imported" \
|
|
--include company,agents
|
|
```
|
|
|
|
With agent authentication, use `company list` or `company current` to resolve
|
|
the scoped company. `company list` first tries the board-wide list; if that is
|
|
forbidden, it falls back to `--company-id`, `PAPERCLIP_COMPANY_ID`, context, or
|
|
`/api/agents/me` and returns only that scoped company. `company create` requires
|
|
board/instance-admin authentication because it is an instance-wide setup
|
|
command.
|
|
|
|
## Agent Commands
|
|
|
|
```sh
|
|
npx paperclipai agent list
|
|
npx paperclipai agent get <agent-id>
|
|
```
|
|
|
|
## Skills Commands
|
|
|
|
```sh
|
|
# Browse app-shipped catalog skills without changing company state
|
|
npx paperclipai skills browse [--kind bundled|optional] [--category software-development] [--query github]
|
|
npx paperclipai skills search "pull request" [--json]
|
|
|
|
# Inspect catalog metadata and file inventory before install
|
|
npx paperclipai skills inspect github-pr-workflow
|
|
|
|
# Install a catalog skill into the company skill library
|
|
# This does not attach the skill to any agent.
|
|
npx paperclipai skills install github-pr-workflow --company-id <company-id>
|
|
npx paperclipai skills install github-pr-workflow --as pr-flow --force --company-id <company-id>
|
|
|
|
# External sources still use import instead of catalog install
|
|
npx paperclipai skills import ./skills/my-skill --company-id <company-id>
|
|
npx paperclipai skills import owner/repo/path/to/skill --company-id <company-id>
|
|
|
|
# Attach desired company skills to an agent after install/import
|
|
npx paperclipai skills agent sync <agent-id> --skill github-pr-workflow --mode add --company-id <company-id>
|
|
```
|
|
|
|
## Approval Commands
|
|
|
|
```sh
|
|
# List approvals
|
|
npx paperclipai approval list [--status pending]
|
|
|
|
# Get approval
|
|
npx paperclipai approval get <approval-id>
|
|
|
|
# Create approval
|
|
npx paperclipai approval create --type hire_agent --payload '{"name":"..."}' [--issue-ids <id1,id2>]
|
|
|
|
# Approve
|
|
npx paperclipai approval approve <approval-id> [--decision-note "..."]
|
|
|
|
# Reject
|
|
npx paperclipai approval reject <approval-id> [--decision-note "..."]
|
|
|
|
# Request revision
|
|
npx paperclipai approval request-revision <approval-id> [--decision-note "..."]
|
|
|
|
# Resubmit
|
|
npx paperclipai approval resubmit <approval-id> [--payload '{"..."}']
|
|
|
|
# Comment
|
|
npx paperclipai approval comment <approval-id> --body "..."
|
|
```
|
|
|
|
## Activity Commands
|
|
|
|
```sh
|
|
npx paperclipai activity list [--agent-id <id>] [--entity-type issue] [--entity-id <id>]
|
|
```
|
|
|
|
## Dashboard
|
|
|
|
```sh
|
|
npx paperclipai dashboard get
|
|
```
|
|
|
|
## Instance Settings
|
|
|
|
```sh
|
|
npx paperclipai instance settings:general
|
|
npx paperclipai instance settings:general:update --payload-json '{...}'
|
|
npx paperclipai instance settings:experimental
|
|
npx paperclipai instance settings:experimental:update --payload-json '{...}'
|
|
```
|
|
|
|
Experimental features are opt-in and are provided without compatibility guarantees. They may break, change, or be removed at any time. Use them at your own risk.
|
|
|
|
## Heartbeat
|
|
|
|
```sh
|
|
npx paperclipai heartbeat run --agent-id <agent-id> [--api-base http://localhost:3100]
|
|
```
|