mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-12 08:19:54 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - An instance can turn on the `enableManagedSandboxOnly` feature, which hides the local environment and runs every agent in the platform-managed environment > - That feature already gated the environment pickers, the onboarding wizard, and the server-side run selection, but many other screens still showed absolute paths on the execution host and still let the user pick an execution engine > - On such an instance those controls name a filesystem the user cannot reach; a path written there is stored and then ignored, which reads as a broken control > - This pull request hides the remaining host-path and execution-engine surfaces behind the same feature, adds a server rule that refuses a project-workspace path write while the feature is on, and closes a related route gap in the isolated-workspace pages > - The benefit is that a managed instance shows no host path and no folder picker anywhere, and a write that carries a path now fails with a clear message instead of being silently discarded ## Linked Issues or Issue Description No public issue exists. The description below follows `.github/ISSUE_TEMPLATE/enhancement.yml`. **What existing behavior does this improve?** The `enableManagedSandboxOnly` instance feature, and the UI surfaces that show a host filesystem path: project properties, the new-project dialog, the project workspace and execution workspace detail pages, the workspace and task cards, plugin local folders, and the agent configuration form with its per-adapter fields. It also improves route gating for `enableIsolatedWorkspaces`. **Subsystem affected** Cross-cutting (`ui/` and `server/`). **Current behavior** When `enableManagedSandboxOnly` is on, the local environment disappears from the environment pickers and the server refuses to run an agent on the local host. Everything else stays visible. A user still sees: - the project "Local folder" row, its absolute path, and the Set/Change/Clear buttons - the "Local folder" field and its "Choose" folder picker in the new-project dialog - the "Local path" field and fact row on a project workspace - the "Paths" and "Lifecycle commands" groups on an execution workspace - the working directory on workspace cards, task properties, and runtime service rows - the plugin "Local folders" section - "Working directory (deprecated)", "Command", "Execution engine", "ACP server command", "ACP state directory", and "Agent instructions file" in the agent configuration form A path typed into any of these names a filesystem no agent on the instance uses. The project workspace API also accepts a `cwd` write and stores it. Separately, `/workspaces`, `/execution-workspaces/*`, and `/projects/:projectId/workspaces/:workspaceId` render for anyone who types or bookmarks the URL, even with `enableIsolatedWorkspaces` off. Only the sidebar entry reads that flag. **Proposed behavior** With `enableManagedSandboxOnly` on, none of those surfaces render. A project whose codebase came from a managed checkout keeps its one-line "Paperclip-managed folder." label and shows no path. The non-path controls stay: repo URL, branch, service URL, port, command output, ACP session mode, ACP non-interactive permissions, Codex fast mode, and the sandbox toggles. The project-workspace create and patch routes, and the nested workspace on project create, answer `422` with "This instance runs agents only in the platform-managed environment; local folders are not configurable." when the payload carries a non-null `cwd`. A `cwd: null` write still passes, so an instance that just turned the feature on can clear a stale path. With `enableIsolatedWorkspaces` off, the three workspace route groups redirect to the dashboard. **Reason and benefit** A control that cannot do anything is worse than a missing control: the user fills it in, saves, and gets no error and no effect. The server rule turns that silent no-op into a clear refusal. The route gate stops a feature that an instance has turned off from staying reachable by URL, which is the same standard the Cases, Pipelines, and hidden-settings pages already meet. **Breaking changes** None for a default instance: both flags are off by default for self-hosted and managed instances, so nothing changes unless an operator turns them on. Stored `adapterConfig` values are never cleared, so turning the feature off restores every previous value. ## What Changed - Add `ui/src/hooks/useManagedSandboxOnly.ts`, modelled on `useAppsEnabled`, for components that do not already read the experimental settings. It exposes `hideHostPaths`, which fails closed while the settings query is in flight, so a cold cache never flashes a host path before the policy resolves. Components that keep their own settings read compute the same gate from `isFetched`. - Add `managedSandboxOnly` to `AdapterConfigFieldsProps` and populate it where `AgentConfigForm` builds the adapter field props. Resolve the effective instructions-file gate once as `hideInstructionsFile || hideHostPaths`, so every adapter hides that path field with no per-adapter edit. - Hide under the flag: the project "Local folder" block and its absolute-path edit panel (a managed checkout keeps its label, without the path); the new-project "Local folder" field; the project-workspace "Local path" field and fact row; the execution-workspace "Paths" and "Lifecycle commands" groups; the working directory on the workspace summary card, the task workspace card, the task properties "Folder" row, and the runtime service rows; the plugin "Local folders" section; "Working directory (deprecated)" and "Command" in the agent form; and the per-adapter "Execution engine", "ACP server command", and "ACP state directory" for `claude_local`, `codex_local`, and `gemini_local`. - Drop two working-directory fallbacks that had no gate to read: the close-workspace dialog now falls back to "No additional details", and the reuse-existing workspace label and picker subtitle fall back to a neutral phrase. - Refuse a non-null `cwd` with `422` on `POST /projects/:id/workspaces`, `PATCH /projects/:id/workspaces/:workspaceId`, and the nested workspace on `POST /companies/:companyId/projects`, following the `assertNoAgentHostWorkspaceCommandMutation` precedent on those routes. - Add `IsolatedWorkspacesRouteGate` and wrap the `/workspaces`, `/execution-workspaces/*`, and `/projects/:projectId/workspaces/:workspaceId` routes with it. - Leave the SSH "Remote workspace path" and the workspace file browser alone, with a comment explaining why. ## Verification Automated: - `pnpm --filter @paperclipai/ui exec vitest run` — 479 of 480 files pass (4455 of 4456 tests). The one failure is `OnboardingWizard.test.tsx > renders instead of throwing when the browser denies storage access`, which also fails on `origin/master` and is unrelated to this change. - `pnpm --filter @paperclipai/server exec vitest run project workspace instance-settings` — 45 of 50 files pass. Four files fail on macOS for reasons unrelated to this change: `workspace-instance-cleanup`, `workspace-runtime`, `execution-workspace-runtime-control-conflict`, and `workspace-runtime-exposure` compare `/var/...` against the resolved `/private/var/...` or bind real ports. The same files fail on a clean `master` checkout on the same machine. - `pnpm --filter @paperclipai/ui typecheck` - `tsc --noEmit` in `server/` (after `pnpm --filter @paperclipai/plugin-sdk ensure-build-deps`). The package `typecheck` script also builds the Rust runner, which needs `cargo`; it is not installed on the machine that ran this. New and extended tests: - `ui/src/adapters/managed-sandbox-only-config-fields.test.tsx` — the three adapters drop the execution engine, the ACP paths, the instructions-file path, and every "Choose" button when the flag is on, and keep the non-path controls. - `ui/src/components/AgentConfigForm.render.test.tsx` — flag-on and flag-off renders for the working directory, the command, the engine, the ACP paths, and the resolved adapter field props. - `ui/src/components/ProjectProperties.managed-sandbox.test.tsx`, `ui/src/components/NewProjectDialog.managed-sandbox.test.tsx`, `ui/src/pages/ProjectWorkspaceDetail.test.tsx`, `ui/src/components/ProjectWorkspaceSummaryCard.test.tsx`, `ui/src/components/WorkspaceRuntimeControls.test.tsx`. - `ui/src/components/IsolatedWorkspacesRouteGate.test.tsx` — redirect when off, render when on, and render nothing while the flag query is in flight. - "Still loading" cases for the project properties, the new-project dialog, the workspace summary card, the runtime service rows, and the agent configuration form, each asserting that no host path renders before the policy resolves. - `server/src/__tests__/project-workspace-managed-sandbox-routes.test.ts` — the `422` on all three write paths, the `cwd: null` pass-through, and the flag-off pass-through. Manual check to reproduce: turn on Managed Environment Only in instance experimental settings, then open a project, the new-project dialog, an agent's configuration, and a workspace page. No path, folder icon, or "Choose" button appears. Turn the setting off and each control returns with its stored value. No documentation change was needed. The operator-facing text for both settings lives in the feature catalog entry, which already states the contract this pull request now enforces across the UI. ## Risks - Low. Both flags default to off, so a default instance is unchanged. - The hidden fields are presentation only. No stored `adapterConfig` value is cleared, because an import carries adapter configuration written on another instance and clearing it would break that flow. Turning the setting off shows every previous value again. - The `422` is the one behavior change for an API caller, and only while the setting is on. `cwd: null` still passes so a stale path can be cleared. - The route gate renders nothing until the flag query settles, so an instance with isolated workspaces on never flashes a redirect. An instance with the feature off now redirects a bookmarked workspace URL to the dashboard. - Every host-path guard fails closed while the settings query is in flight, so a default instance shows those controls a moment later than before on a cold load. That is the safe direction: the alternative flashes a path a managed instance must never show. - Two path surfaces stay on purpose, each with a comment: the SSH "Remote workspace path" is a path on the user's own remote host, and the workspace file browser shows workspace-relative paths. The instance Adapters page also keeps its "Local path" install option, since that page is an instance-admin surface the hosting operator can already hide through the hidden-settings mechanism. ## Model Used Claude (Anthropic), Claude Opus, 1M context window, extended thinking, agentic tool use through Claude Code. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge
272 lines
11 KiB
TypeScript
272 lines
11 KiB
TypeScript
import { Link } from "@/lib/router";
|
|
import type { ExecutionWorkspace } from "@paperclipai/shared";
|
|
import { Button } from "@/components/ui/button";
|
|
import { CopyText } from "./CopyText";
|
|
import { IssuesQuicklook } from "./IssuesQuicklook";
|
|
import type { ProjectWorkspaceLinkedIssue, ProjectWorkspaceSummary } from "../lib/project-workspaces-tab";
|
|
import { useManagedSandboxOnly } from "../hooks/useManagedSandboxOnly";
|
|
import { cn, projectWorkspaceUrl } from "../lib/utils";
|
|
import { timeAgo } from "../lib/timeAgo";
|
|
import { Copy, ExternalLink, FolderOpen, GitBranch, Loader2, Play, Square } from "lucide-react";
|
|
import { Badge } from "@/components/ui/badge";
|
|
|
|
function workspaceKindLabel(kind: ProjectWorkspaceSummary["kind"]) {
|
|
return kind === "execution_workspace" ? "Execution workspace" : "Project workspace";
|
|
}
|
|
|
|
function truncatePath(path: string) {
|
|
const parts = path.split("/").filter(Boolean);
|
|
if (parts.length <= 3) return path;
|
|
return `…/${parts.slice(-3).join("/")}`;
|
|
}
|
|
|
|
interface ProjectWorkspaceSummaryCardProps {
|
|
projectRef: string;
|
|
summary: ProjectWorkspaceSummary;
|
|
runtimeActionKey: string | null;
|
|
runtimeActionPending: boolean;
|
|
onRuntimeAction: (input: {
|
|
key: string;
|
|
kind: "project_workspace" | "execution_workspace";
|
|
workspaceId: string;
|
|
action: "start" | "stop" | "restart";
|
|
}) => void;
|
|
onCloseWorkspace: (input: {
|
|
id: string;
|
|
name: string;
|
|
status: ExecutionWorkspace["status"];
|
|
}) => void;
|
|
}
|
|
|
|
export function ProjectWorkspaceSummaryCard({
|
|
projectRef,
|
|
summary,
|
|
runtimeActionKey,
|
|
runtimeActionPending,
|
|
onRuntimeAction,
|
|
onCloseWorkspace,
|
|
}: ProjectWorkspaceSummaryCardProps) {
|
|
const { hideHostPaths } = useManagedSandboxOnly();
|
|
const visibleIssues = summary.issues.slice(0, 4);
|
|
const hiddenIssueCount = Math.max(summary.linkedIssueCount - visibleIssues.length, 0);
|
|
const workspaceHref =
|
|
summary.kind === "project_workspace"
|
|
? projectWorkspaceUrl({ id: projectRef, urlKey: projectRef }, summary.workspaceId)
|
|
: `/execution-workspaces/${summary.workspaceId}`;
|
|
const hasRunningServices = summary.runningServiceCount > 0;
|
|
const actionKey = `${summary.key}:${hasRunningServices ? "stop" : "start"}`;
|
|
|
|
return (
|
|
<div className="rounded-lg border border-border bg-background p-4 shadow-sm sm:p-5">
|
|
<div className="flex flex-col gap-4">
|
|
<div className="flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between">
|
|
<div className="min-w-0 space-y-2">
|
|
<div className="flex flex-wrap items-center gap-2">
|
|
<Badge variant="outline" className="border-border bg-background px-2.5 py-1 text-(length:--text-micro) uppercase tracking-(--tracking-eyebrow) text-muted-foreground">
|
|
{workspaceKindLabel(summary.kind)}
|
|
</Badge>
|
|
<Badge variant="outline" className="border-border/70 bg-background px-2.5 py-1 text-muted-foreground">
|
|
Updated {timeAgo(summary.lastUpdatedAt)}
|
|
</Badge>
|
|
{summary.serviceCount > 0 ? (
|
|
<Badge variant="outline"
|
|
className={cn(
|
|
"gap-1.5 px-2.5 py-1",
|
|
hasRunningServices
|
|
? "border-emerald-500/30 bg-emerald-500/10 text-emerald-700 dark:text-emerald-300"
|
|
: "border-border/70 bg-background text-muted-foreground",
|
|
)}
|
|
>
|
|
<span
|
|
className={cn(
|
|
"h-1.5 w-1.5 rounded-full",
|
|
hasRunningServices ? "bg-emerald-500" : "bg-muted-foreground/40",
|
|
)}
|
|
/>
|
|
{summary.runningServiceCount}/{summary.serviceCount} services
|
|
</Badge>
|
|
) : null}
|
|
{summary.executionWorkspaceStatus ? (
|
|
<Badge variant="outline" className="border-border/70 bg-background px-2.5 py-1 text-muted-foreground">
|
|
{summary.executionWorkspaceStatus.replace(/_/g, " ")}
|
|
</Badge>
|
|
) : null}
|
|
</div>
|
|
<Link
|
|
to={workspaceHref}
|
|
className="block break-words text-base font-semibold leading-6 text-foreground hover:underline"
|
|
>
|
|
{summary.workspaceName}
|
|
</Link>
|
|
</div>
|
|
|
|
<div
|
|
className="flex flex-col gap-2 min-[420px]:flex-row lg:w-auto lg:justify-end"
|
|
data-testid="workspace-summary-actions"
|
|
>
|
|
{summary.hasRuntimeConfig ? (
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
className="h-9 justify-center px-3 text-xs"
|
|
disabled={runtimeActionPending}
|
|
onClick={() =>
|
|
onRuntimeAction({
|
|
key: summary.key,
|
|
kind: summary.kind,
|
|
workspaceId: summary.workspaceId,
|
|
action: hasRunningServices ? "stop" : "start",
|
|
})
|
|
}
|
|
>
|
|
{runtimeActionKey === actionKey ? (
|
|
<Loader2 className="mr-2 h-3.5 w-3.5 animate-spin" />
|
|
) : hasRunningServices ? (
|
|
<Square className="mr-2 h-3.5 w-3.5" />
|
|
) : (
|
|
<Play className="mr-2 h-3.5 w-3.5" />
|
|
)}
|
|
{hasRunningServices ? "Stop services" : "Start services"}
|
|
</Button>
|
|
) : null}
|
|
{summary.kind === "execution_workspace" && summary.executionWorkspaceId && summary.executionWorkspaceStatus ? (
|
|
<Button
|
|
variant="ghost"
|
|
size="sm"
|
|
className="h-9 px-3 text-xs text-muted-foreground"
|
|
onClick={() => onCloseWorkspace({
|
|
id: summary.executionWorkspaceId!,
|
|
name: summary.workspaceName,
|
|
status: summary.executionWorkspaceStatus!,
|
|
})}
|
|
>
|
|
{summary.executionWorkspaceStatus === "cleanup_failed" ? "Retry close" : "Close workspace"}
|
|
</Button>
|
|
) : null}
|
|
</div>
|
|
</div>
|
|
|
|
<div className="rounded-lg border border-border/70 bg-background px-3 py-3">
|
|
<div className="space-y-2 text-sm">
|
|
{summary.branchName ? (
|
|
<div className="flex items-start gap-2">
|
|
<GitBranch className="mt-0.5 h-3.5 w-3.5 shrink-0 text-muted-foreground" />
|
|
<div className="min-w-0 flex-1">
|
|
<div className="text-(length:--text-micro) uppercase tracking-(--tracking-eyebrow) text-muted-foreground">Branch</div>
|
|
<div className="flex items-start gap-2">
|
|
<CopyText
|
|
text={summary.branchName}
|
|
containerClassName="min-w-0"
|
|
className="min-w-0 break-all text-left font-mono text-xs text-foreground"
|
|
copiedLabel="Branch copied"
|
|
>
|
|
{summary.branchName}
|
|
</CopyText>
|
|
<CopyText
|
|
text={summary.branchName}
|
|
ariaLabel="Copy branch"
|
|
className="mt-0.5 shrink-0 text-muted-foreground hover:text-foreground"
|
|
copiedLabel="Branch copied"
|
|
>
|
|
<Copy className="h-3.5 w-3.5" />
|
|
</CopyText>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
) : null}
|
|
|
|
{/*
|
|
The path is a host filesystem path, so it disappears under the
|
|
managed-sandbox-only policy, and stays hidden until that policy is
|
|
known. Branch, service, and issue rows stay.
|
|
*/}
|
|
{summary.cwd && !hideHostPaths ? (
|
|
<div className="flex items-start gap-2">
|
|
<FolderOpen className="mt-0.5 h-3.5 w-3.5 shrink-0 text-muted-foreground" />
|
|
<div className="min-w-0 flex-1">
|
|
<div className="text-(length:--text-micro) uppercase tracking-(--tracking-eyebrow) text-muted-foreground">Path</div>
|
|
<div className="flex items-start gap-2">
|
|
<CopyText
|
|
text={summary.cwd}
|
|
title={summary.cwd}
|
|
containerClassName="min-w-0"
|
|
className="min-w-0 break-all text-left font-mono text-xs text-foreground"
|
|
copiedLabel="Path copied"
|
|
>
|
|
{truncatePath(summary.cwd)}
|
|
</CopyText>
|
|
<CopyText
|
|
text={summary.cwd}
|
|
ariaLabel="Copy path"
|
|
className="mt-0.5 shrink-0 text-muted-foreground hover:text-foreground"
|
|
copiedLabel="Path copied"
|
|
>
|
|
<Copy className="h-3.5 w-3.5" />
|
|
</CopyText>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
) : null}
|
|
|
|
{summary.primaryServiceUrl ? (
|
|
<div className="flex items-start gap-2">
|
|
<ExternalLink className="mt-0.5 h-3.5 w-3.5 shrink-0 text-muted-foreground" />
|
|
<div className="min-w-0">
|
|
<div className="text-(length:--text-micro) uppercase tracking-(--tracking-eyebrow) text-muted-foreground">Service</div>
|
|
<a
|
|
href={summary.primaryServiceUrl}
|
|
target="_blank"
|
|
rel="noreferrer"
|
|
className={cn(
|
|
"break-all font-mono text-xs hover:underline",
|
|
summary.primaryServiceUrlRunning
|
|
? "text-emerald-700 hover:text-emerald-800 dark:text-emerald-300 dark:hover:text-emerald-200"
|
|
: "text-foreground",
|
|
)}
|
|
>
|
|
{summary.primaryServiceUrl}
|
|
</a>
|
|
</div>
|
|
</div>
|
|
) : null}
|
|
</div>
|
|
</div>
|
|
|
|
{summary.issues.length > 0 ? (
|
|
<div className="space-y-2">
|
|
<div className="text-(length:--text-micro) font-medium uppercase tracking-(--tracking-eyebrow) text-muted-foreground">
|
|
Linked tasks
|
|
</div>
|
|
<div className="flex flex-wrap gap-2">
|
|
{visibleIssues.map((issue) => (
|
|
<IssuePill key={issue.id} issue={issue} />
|
|
))}
|
|
{hiddenIssueCount > 0 ? (
|
|
<Link
|
|
to={workspaceHref}
|
|
className="inline-flex items-center rounded-full border border-border bg-background px-2.5 py-1 text-xs text-muted-foreground hover:text-foreground hover:underline"
|
|
>
|
|
+{hiddenIssueCount} more
|
|
</Link>
|
|
) : null}
|
|
</div>
|
|
</div>
|
|
) : null}
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
function IssuePill({ issue }: { issue: ProjectWorkspaceLinkedIssue }) {
|
|
return (
|
|
<IssuesQuicklook issue={issue}>
|
|
<Link
|
|
to={`/issues/${issue.identifier ?? issue.id}`}
|
|
className="inline-flex items-center rounded-full border border-border bg-background px-2.5 py-1 font-mono text-xs text-foreground transition-colors hover:border-foreground/30 hover:text-foreground hover:underline"
|
|
>
|
|
{issue.identifier ?? issue.id.slice(0, 8)}
|
|
</Link>
|
|
</IssuesQuicklook>
|
|
);
|
|
}
|