DottaandPaperclip
4460785534
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Agents use skills imported from project repositories.
> - Large repositories fall back to isolated skill folders.
> - That fallback drops shared files and turns advisory links into
import failures.
> - This pull request retains bounded referenced files and keeps missing
references advisory.
> - Users can import valid skills such as test-audit without editing the
source repository.
## Linked Issues or Issue Description
Refs #16066. Refs #16256. Refs #16288. Related draft #15730 adds
optional reference selection to individual skill packages. This fix
applies automatic repository fallback and does not add that selection
UI.
**What happened?**
A project source showed 86 warnings. It rejected 23 skills solely
because references were absent from the isolated package. It also
treated web routes and inline Markdown examples as files. For
test-audit, repository scripts were resolved inside the skill folder.
**Expected behavior**
Retain referenced files that fit the package limits. Missing references
must not block an otherwise valid selected skill. Preserve content
validation and installed shared files.
**Steps to reproduce**
Import paperclipai/paperclip at commit
09a2f0b7b0 as a repository source. Select
test-audit. Inspect its references and saved files. Repeat with a skill
whose optional reference is missing.
## What Changed
- Add a bounded fallback that keeps skill folders and transitive
Markdown references with their original repository paths.
- Resolve existing repository-root resource paths. Ignore site-relative
web links and inline Markdown examples.
- Keep missing references advisory, including explicit imports and
automatic project imports.
- Share fallback with file previews. Reinspect cached dependency
failures at an unchanged upstream commit.
- Retain existing versions when fallback cannot preserve installed
shared files. Keep file limits, content audits, authorization and work
budgets.
- Update product contracts and Skills maps. No schema or public API
changes.
## Verification
- Red/green: three original regression cases failed before the fix and
passed afterward. Two review controls also reproduced omitted directory
siblings and duplicate blob reads before their fixes.
- Focused scanner, repository package, persistence, project
synchronization and GitHub access tests: 126 cases passed across local
and isolated Linux runs.
- Full recursive typecheck and `pnpm build` passed locally on
`555bd3fc90314dbf23ed0ffe7034429946c1a471`. The [full Paperclip CI
workflow](https://github.com/paperclipai/paperclip/actions/runs/38596749890)
passed on that head, including all general, serialized, Runner and eight
browser test shards. The duplicate local `pnpm test:run` was stopped
after CI completed (exit 143); it is not claimed as a completed local
full-suite pass.
- Real GitHub scan at the pinned public commit: 77 skills, 454 retained
files, 9,117,635 bytes. test-audit has no missing references. The full
source reports 23 warnings, including remaining file validation and
genuine missing-reference notices.
- Local browser: scanned the public repository, selected test-audit and
create-issue-interaction-ui, and imported both. The second skill
retained an advisory missing-reference warning. Both remained installed
after reload. The saved package exposes `scripts/run-vitest-stable.mjs`
(25,813 bytes) and `scripts/general-server-shard.mjs` (2,813 bytes). No
GitHub responses were mocked. No model execution was needed for this
import fix.
- Map checks and Git whitespace checks passed. Greptile is 5/5 on the
current head with both review findings resolved. The external Superagent
security scan concluded neutral/inconclusive after its agent exceeded
the prompt deadline. A check-run retry request returned HTTP 404. All
Paperclip CI gates passed, but merge is held pending a conclusive
security scan; this is not an all-checks-green claim.
## Risks
- Dependency detection covers explicit Markdown links and resource
paths. It does not infer all script imports or runtime dependencies.
- Referenced content can exceed package limits. The existing bounds
still apply, and warnings disclose omissions.
- Content validation still rejects invalid entrypoints and omits
rejected support files. This change does not make every upstream skill
importable.
- No migration is required. Existing sources with the old dependency
error are inspected again on refresh.
## Model Used
OpenAI Codex, GPT-6 family. The runtime did not expose the exact serving
model ID or context window. Used reasoning, code editing, terminal
execution and browser tools. No subagents were used.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
6.6 KiB
navigation
| navigation | ||||||
|---|---|---|---|---|---|---|
|
Skills and Skill Studio
Operators discover or import skills, author and test them in Skill Studio, manage source versions, and decide which agents may use them.
Implementation: skill library, studio, sources, agent skills.
Agent access: companion.
Sub-features
discovery: browse installed/discover views and import a skill or source.authoring: create/edit a writable skill or fork a read-only source.versions: inspect revisions, source updates, diffs, and selected releases.policy: apply agent enablement and skill usage policy independently from installation.testing: run a bounded Studio test and inspect its result and interactions.
How to get to it (user POV)
library-sources
Open /skills, Discover, or /skills/sources; project import is available through the library’s import flow.
studio
Use New skill or /skills/studio/:skillId; writable copies and source-backed originals differ.
Direct authoring starts at /skills/studio/new: fill Name and Slug, then
Create skill. Authoring/save/reload requires no model credential; running a
Studio test is separate.
agent-enablement
Use skill policy/agent selection in the library or an agent’s Skills tab.
Driving it with Playwright and the Paperclip CLI
Preconditions: follow the baseline. Use a harmless skill fixture and test agent with skill support. Record whether the source is local, bundled, project, or remote.
library-sources
Automated: library UI and source service cover their respective layers.
Manual: Install a fixture, locate it in Installed, inspect its source and files, and reload. Import a source update and compare versions before accepting it. Check a source requiring unavailable repository access and verify the failure is explicit.
studio
Automated: Studio covers UI behavior; model-driven skill testing remains a separate manual result.
Manual: Create or fork a disposable skill, edit instructions, save, and reload. Run a bounded test, respond to any question, and inspect the output. Verify the saved version matches what was tested and failed saves retain the draft.
agent-enablement
Automated: policy service and agent skills state cover policy/state contracts.
Manual: Enable the skill for one test agent and leave another without access. Run a small task on each, inspect the available skill context, then change the release/policy and verify the next eligible run uses the intended version.
Gotchas
-
The release picker requires
enableBetaSkills. Do not invent an Instructions accessibility label for the Studio body editor; inspect its current handles. -
Installed does not mean enabled for every agent.
-
Read-only GitHub/bundled skills may require a writable copy rather than an in-place edit.
-
Studio interaction coverage is in questions and approvals; a passing mock is not a live harness test.
Project repository source behavior
New GitHub project repositories import skills automatically. Skills → Sources lists accessible legacy repositories with Import skills, shows each saved repository once with its access scope but without project names, and groups matching repository/ref workspaces. Additional legacy imports for an existing source live in its More menu. Import progress appears in the source metadata; Refresh and Automatic updates are also available. Verify future additions, retained exclusions, error recovery and reload persistence. Private-only sources must be absent for unrelated people/agents; access through either originating project is sufficient.
For an oversized repository, preview and import a skill that links to shared files outside its folder. Its saved version should include those files under the original repository paths. Missing references remain visible warnings and must not disable an otherwise valid skill's selection. Verify an existing source with cached dependency errors recovers on refresh without requiring a new upstream commit. A refresh that cannot preserve installed shared files retains the prior version.
Storybook/browser coverage uses scoped fixtures. Live GitHub-to-routine execution must be verified separately; inspect resolved version IDs across an upstream update.
Connection repair during an update
A missing tracked branch is a branch repair, not a credential failure. On an independent source, choose a new branch from the searchable list or enter its name. The repository's default branch is marked and included even outside the first 100 listed branches. Loading or a failed list request does not prevent manual entry; saving validates the requested ref. Installed identities, selections and version pins remain. Project-tracked branches are changed in project settings. A saved connection is validated against both the repository and tracked revision before repair succeeds.
Open Choose connection while a source is being refreshed. Select an authorized account and save. If the source changes, the dialog must retain that selection, load the current revision, and allow a second save without reopening. The project repository browser suite covers this recovery with simulated upstream data.
Storybook verification
testing
Scope: ui Storybook: Studio test inputs/configuration, running, question/approval, result and failed test states. Production: Run bounded test of actual saved version with correct selected account/environment; inspect persisted test detail and eligible interaction response. Sources: Source: SkillStudio.tsx, companySkills.ts. Tests: SkillStudio.test.tsx, company-skill-test-runs-service.test.ts
Documentation scope: Skills, Skill Studio, and teams
Main library/Studio/source/policy and CLI team-install paths are mapped. Full source-provider conflicts, harness sync, and remote package variants remain; catalog UI is not a current top-level route.