mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 12:04:41 +01:00
## Thinking Path > - Paperclip manages agents and their work. > - Plugins provide optional views and connect to external runtimes. > - A live runtime view needs a binary browser connection. > - The current plugin API supports JSON routes but cannot proxy that connection. > - Agent detail tabs are declared in the plugin contract but are not mounted on agent pages. > - This PR completes those two host capabilities and keeps upstream credentials on the server. ## Linked Issues or Issue Description **Subsystem affected** Plugin scoped API routes and agent detail views. **Problem or motivation** Plugins cannot expose a binary or text stream through a browser session without exposing an upstream credential or adding a separate browser gateway. Agent-scoped detail contributions also have no mount on the agent page. **Proposed solution** Allow declared board GET routes to select a server-only WSS upstream. Run upgrades through the existing HTTP authentication pipeline and trusted Origin check. Add agent company resolution with the existing `agent:read` decision. Mount contributed detail views in agent navigation. **Alternatives considered** A separately hosted viewer needs its own browser credentials and cross-origin policy. JSON or SSE transport adds encoding and buffering to a binary protocol. **Roadmap alignment** This extends the existing plugin API and detail-tab contract. It adds no desktop provider to Core. I checked ROADMAP.md and searched related open PRs; I found no equivalent transport and agent view change. ## What Changed - Add declared WebSocket routes requiring board authentication, GET, and `http.outbound`. Reject body-based company resolution because browser upgrades cannot send a body. - Keep worker-selected upstream URLs and headers out of browser JSON responses. Strip browser cookies and Origin. Preserve binary frames and socket backpressure. - Close both sockets on disconnect or worker shutdown. Reauthorize on reconnect after a five-minute connection lifetime. Preserve HTTP idle-work accounting for the stream lifetime. - Resolve agent scope through `agent:read` and mount generic agent plugin detail views, with current agent/view breadcrumbs and browser titles. ## Verification - Final head `9d8d269040acf9dc7bb65524876406af522dacb5`: CI passes (including Runner Rust, build, and browser E2E); Greptile 5/5; no unresolved review threads; no merge conflicts. Verified 2026-10-21. - Core server TypeScript check: `node node_modules/typescript/bin/tsc -p server/tsconfig.json --noEmit`. - Focused server suites: 17 passing tests (`server/src/__tests__/plugin-scoped-api-routes.test.ts` and `server/src/http/server.test.ts`), including arbitrary build-output and metrics channels with real local text and binary WebSocket round trips, disconnect cleanup, denied actors and origins, credential exclusion, agent-read denial, and cross-company 404 equivalence. The test replaces TLS with local HTTP while retaining the real upgrade and binary stream. - UI suites: 9 passing tests for independent Insights and Notes contributions, removed contributions, built-in route preservation, sidebar links, direct plugin entry and heading updates after tab navigation. These contributions do not require the WebSocket transport. - Shared validator suite: 42 passing tests, including rejecting body-based WebSocket resolution while retaining ordinary HTTP body resolution and accepting query/entity scopes. - UI token gates pass. - UI TypeScript check: `node ../scripts/storybook-catalog.mjs` then `tsc -b`. - Shared and plugin SDK builds pass. - Full Runner build reached its unrelated Rust step and stopped because cargo is unavailable. Runner TypeScript build was run separately. No live remote VM was used. ## Risks - This adds a browser ingress path for trusted installed plugins. The plugin must select its upstream from a trusted binding. HTTP requests cannot retrieve the upstream descriptor. - Membership or binding changes are rechecked on reconnect. Connections last at most five minutes, and worker shutdown is checked every five seconds. - Initial CI caught a missing cross-company 404 guard and an old test that assumed exactly one upgrade listener. Both were corrected. Greptile's body-resolution and stale-heading findings are fixed with regression coverage; latest-head CI passes and Greptile scored 5/5 with no unresolved findings. - No schema migration. Rollback restores the previous Core image; plugins using this transport must be disabled or rolled back first. ## Model Used OpenAI Codex, based on GPT-6, with reasoning and code/tool execution. The exact runtime model ID and context-window size are not exposed in this session. ## Checklist - [x] Thinking path and issue description included - [x] Model described - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] No internal issues, private links, or runtime credentials included - [x] Descriptive branch name - [x] Focused tests and relevant typechecks run - [x] Tests and documentation updated - [x] Risks documented - [x] All CI gates green - [x] Greptile 5/5 with no unresolved findings - [x] I will address review findings before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
74 lines
3.0 KiB
TypeScript
74 lines
3.0 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import { renderToStaticMarkup } from "react-dom/server";
|
|
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
|
|
import { MemoryRouter } from "react-router-dom";
|
|
import { describe, expect, it, vi } from "vitest";
|
|
import { AgentContextualSidebar } from "./AgentContextualSidebar";
|
|
import { queryKeys } from "@/lib/queryKeys";
|
|
|
|
vi.mock("@/context/CompanyContext", () => ({
|
|
useCompany: () => ({ selectedCompanyId: "company-1" }),
|
|
}));
|
|
|
|
vi.mock("./ContextualSidebarFrame", () => ({
|
|
ContextualSidebarFrame: ({
|
|
title,
|
|
showHeader,
|
|
className,
|
|
children,
|
|
}: {
|
|
title: string;
|
|
showHeader?: boolean;
|
|
className?: string;
|
|
children: React.ReactNode;
|
|
}) => (
|
|
<aside data-title={title} data-show-header={String(showHeader)} className={className}>
|
|
{children}
|
|
</aside>
|
|
),
|
|
}));
|
|
|
|
vi.mock("./SidebarNavItem", () => ({
|
|
SidebarNavItem: ({ to, label }: { to: string; label: string }) => <a href={to}>{label}</a>,
|
|
}));
|
|
|
|
vi.mock("@/plugins/slots", () => ({ usePluginSlots: () => ({ slots: [{ pluginKey: "test.plugin", id: "insights", displayName: "Insights" }] }) }));
|
|
|
|
describe("AgentContextualSidebar", () => {
|
|
it.each([false, true])("keeps Channels available for default email regardless of the chat setting (%s)", (enabled) => {
|
|
const client = new QueryClient();
|
|
client.setQueryData(queryKeys.instance.experimentalSettings, { enableChatConnectors: enabled });
|
|
const markup = renderToStaticMarkup(<QueryClientProvider client={client}><MemoryRouter>
|
|
<AgentContextualSidebar agentRef="agent" agentId="agent-1" agentName="Agent" />
|
|
</MemoryRouter></QueryClientProvider>);
|
|
expect(markup).toContain("Insights");
|
|
expect(markup).toContain("plugin%3Atest.plugin%3Ainsights");
|
|
expect(markup.includes('href="/agents/agent/channels"')).toBe(true);
|
|
expect(markup).toContain('href="/agents/agent/tools"');
|
|
client.clear();
|
|
});
|
|
it("renders local definition/runtime/governance links and scoped Audit links", () => {
|
|
const queryClient = new QueryClient();
|
|
const markup = renderToStaticMarkup(
|
|
<QueryClientProvider client={queryClient}>
|
|
<MemoryRouter initialEntries={["/agents/codexcoder/runtime"]}>
|
|
<AgentContextualSidebar agentRef="codexcoder" agentId="agent-1" agentName="Codex Coder" />
|
|
</MemoryRouter>
|
|
</QueryClientProvider>,
|
|
);
|
|
|
|
expect(markup).toContain("Codex Coder");
|
|
expect(markup).toContain('data-show-header="false"');
|
|
expect(markup).toContain("border-r border-border bg-background");
|
|
expect(markup).toContain('data-slot="contextual-sidebar-nav"');
|
|
expect(markup).toContain('href="/agents/codexcoder/overview"');
|
|
expect(markup).toContain('href="/agents/codexcoder/permissions"');
|
|
expect(markup).toContain('href="/agents/codexcoder/api-keys"');
|
|
expect(markup).toContain('href="/activity?mode=agents&agentId=agent-1"');
|
|
expect(markup).toContain('href="/activity/runs?agentId=agent-1"');
|
|
expect(markup).toContain("Harness / Runtime");
|
|
expect(markup).toContain("Permissions / Trust");
|
|
});
|
|
});
|