2026-03-13 16:22:34 -05:00
|
|
|
/**
|
|
|
|
|
* `@paperclipai/plugin-sdk` — Paperclip plugin worker-side SDK.
|
|
|
|
|
*
|
|
|
|
|
* This is the main entrypoint for plugin worker code. For plugin UI bundles,
|
|
|
|
|
* import from `@paperclipai/plugin-sdk/ui` instead.
|
|
|
|
|
*
|
|
|
|
|
* @example
|
|
|
|
|
* ```ts
|
|
|
|
|
* // Plugin worker entrypoint (dist/worker.ts)
|
|
|
|
|
* import { definePlugin, runWorker, z } from "@paperclipai/plugin-sdk";
|
|
|
|
|
*
|
|
|
|
|
* const plugin = definePlugin({
|
|
|
|
|
* async setup(ctx) {
|
|
|
|
|
* ctx.logger.info("Plugin starting up");
|
|
|
|
|
*
|
|
|
|
|
* ctx.events.on("issue.created", async (event) => {
|
|
|
|
|
* ctx.logger.info("Issue created", { issueId: event.entityId });
|
|
|
|
|
* });
|
|
|
|
|
*
|
|
|
|
|
* ctx.jobs.register("full-sync", async (job) => {
|
|
|
|
|
* ctx.logger.info("Starting full sync", { runId: job.runId });
|
|
|
|
|
* // ... sync implementation
|
|
|
|
|
* });
|
|
|
|
|
*
|
|
|
|
|
* ctx.data.register("sync-health", async ({ companyId }) => {
|
|
|
|
|
* const state = await ctx.state.get({
|
|
|
|
|
* scopeKind: "company",
|
|
|
|
|
* scopeId: String(companyId),
|
|
|
|
|
* stateKey: "last-sync-at",
|
|
|
|
|
* });
|
|
|
|
|
* return { lastSync: state };
|
|
|
|
|
* });
|
|
|
|
|
* },
|
|
|
|
|
*
|
|
|
|
|
* async onHealth() {
|
|
|
|
|
* return { status: "ok" };
|
|
|
|
|
* },
|
|
|
|
|
* });
|
|
|
|
|
*
|
|
|
|
|
* export default plugin;
|
|
|
|
|
* runWorker(plugin, import.meta.url);
|
|
|
|
|
* ```
|
|
|
|
|
*
|
|
|
|
|
* @see PLUGIN_SPEC.md §14 — SDK Surface
|
|
|
|
|
* @see PLUGIN_SPEC.md §29.2 — SDK Versioning
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
// Main factory
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
export { definePlugin } from "./define-plugin.js";
|
|
|
|
|
export { createTestHarness } from "./testing.js";
|
|
|
|
|
export { createPluginBundlerPresets } from "./bundlers.js";
|
|
|
|
|
export { startPluginDevServer, getUiBuildSnapshot } from "./dev-server.js";
|
|
|
|
|
export { startWorkerRpcHost, runWorker } from "./worker-rpc-host.js";
|
|
|
|
|
export {
|
|
|
|
|
createHostClientHandlers,
|
|
|
|
|
getRequiredCapability,
|
|
|
|
|
CapabilityDeniedError,
|
|
|
|
|
} from "./host-client-factory.js";
|
|
|
|
|
|
|
|
|
|
// JSON-RPC protocol helpers and constants
|
|
|
|
|
export {
|
|
|
|
|
JSONRPC_VERSION,
|
|
|
|
|
JSONRPC_ERROR_CODES,
|
|
|
|
|
PLUGIN_RPC_ERROR_CODES,
|
|
|
|
|
HOST_TO_WORKER_REQUIRED_METHODS,
|
|
|
|
|
HOST_TO_WORKER_OPTIONAL_METHODS,
|
|
|
|
|
MESSAGE_DELIMITER,
|
|
|
|
|
createRequest,
|
|
|
|
|
createSuccessResponse,
|
|
|
|
|
createErrorResponse,
|
|
|
|
|
createNotification,
|
|
|
|
|
isJsonRpcRequest,
|
|
|
|
|
isJsonRpcNotification,
|
|
|
|
|
isJsonRpcResponse,
|
|
|
|
|
isJsonRpcSuccessResponse,
|
|
|
|
|
isJsonRpcErrorResponse,
|
|
|
|
|
serializeMessage,
|
|
|
|
|
parseMessage,
|
|
|
|
|
JsonRpcParseError,
|
|
|
|
|
JsonRpcCallError,
|
|
|
|
|
_resetIdCounter,
|
|
|
|
|
} from "./protocol.js";
|
|
|
|
|
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
// Type exports
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
// Plugin definition and lifecycle types
|
|
|
|
|
export type {
|
|
|
|
|
PluginDefinition,
|
|
|
|
|
PaperclipPlugin,
|
|
|
|
|
PluginHealthDiagnostics,
|
|
|
|
|
PluginConfigValidationResult,
|
|
|
|
|
PluginWebhookInput,
|
[codex] Add plugin orchestration host APIs (#4114)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is the extension path for optional capabilities
that should not require core product changes for every integration.
> - Plugins need scoped host APIs for issue orchestration, documents,
wakeups, summaries, activity attribution, and isolated database state.
> - Without those host APIs, richer plugins either cannot coordinate
Paperclip work safely or need privileged core-side special cases.
> - This pull request adds the plugin orchestration host surface, scoped
route dispatch, a database namespace layer, and a smoke plugin that
exercises the contract.
> - The benefit is a broader plugin API that remains company-scoped,
auditable, and covered by tests.
## What Changed
- Added plugin orchestration host APIs for issue creation, document
access, wakeups, summaries, plugin-origin activity, and scoped API route
dispatch.
- Added plugin database namespace tables, schema exports, migration
checks, and idempotent replay coverage under migration
`0059_plugin_database_namespaces`.
- Added shared plugin route/API types and validators used by server and
SDK boundaries.
- Expanded plugin SDK types, protocol helpers, worker RPC host behavior,
and testing utilities for orchestration flows.
- Added the `plugin-orchestration-smoke-example` package to exercise
scoped routes, restricted database namespaces, issue orchestration,
documents, wakeups, summaries, and UI status surfaces.
- Kept the new orchestration smoke fixture out of the root pnpm
workspace importer so this PR preserves the repository policy of not
committing `pnpm-lock.yaml`.
- Updated plugin docs and database docs for the new orchestration and
database namespace surfaces.
- Rebased the branch onto `public-gh/master`, resolved conflicts, and
removed `pnpm-lock.yaml` from the final PR diff.
## Verification
- `pnpm install --frozen-lockfile`
- `pnpm --filter @paperclipai/db typecheck`
- `pnpm exec vitest run packages/db/src/client.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-database.test.ts
server/src/__tests__/plugin-orchestration-apis.test.ts
server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/plugin-scoped-api-routes.test.ts
server/src/__tests__/plugin-sdk-orchestration-contract.test.ts`
- From `packages/plugins/examples/plugin-orchestration-smoke-example`:
`pnpm exec vitest run --config ./vitest.config.ts`
- `pnpm --dir
packages/plugins/examples/plugin-orchestration-smoke-example run
typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- PR CI on latest head `293fc67c`: `policy`, `verify`, `e2e`, and
`security/snyk` all passed.
## Risks
- Medium risk: this expands plugin host authority, so route auth,
company scoping, and plugin-origin activity attribution need careful
review.
- Medium risk: database namespace migration behavior must remain
idempotent for environments that may have seen earlier branch versions.
- Medium risk: the orchestration smoke fixture is intentionally excluded
from the root workspace importer to avoid a `pnpm-lock.yaml` PR diff;
direct fixture verification remains listed above.
- Low operational risk from the PR setup itself: the branch is rebased
onto current `master`, the migration is ordered after upstream
`0057`/`0058`, and `pnpm-lock.yaml` is not in the final diff.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
Roadmap checked: this work aligns with the completed Plugin system
milestone and extends the plugin surface rather than duplicating an
unrelated planned core feature.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in a tool-enabled CLI
environment. Exact hosted model build and context-window size are not
exposed by the runtime; reasoning/tool use were enabled for repository
inspection, editing, testing, git operations, and PR creation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no core UI screen change; example plugin UI contract
is covered by tests)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 08:52:51 -05:00
|
|
|
PluginApiRequestInput,
|
|
|
|
|
PluginApiResponse,
|
2026-03-13 16:22:34 -05:00
|
|
|
} from "./define-plugin.js";
|
|
|
|
|
export type {
|
|
|
|
|
TestHarness,
|
|
|
|
|
TestHarnessOptions,
|
|
|
|
|
TestHarnessLogEntry,
|
|
|
|
|
} from "./testing.js";
|
|
|
|
|
export type {
|
|
|
|
|
PluginBundlerPresetInput,
|
|
|
|
|
PluginBundlerPresets,
|
|
|
|
|
EsbuildLikeOptions,
|
|
|
|
|
RollupLikeConfig,
|
|
|
|
|
} from "./bundlers.js";
|
|
|
|
|
export type { PluginDevServer, PluginDevServerOptions } from "./dev-server.js";
|
|
|
|
|
export type {
|
|
|
|
|
WorkerRpcHostOptions,
|
|
|
|
|
WorkerRpcHost,
|
|
|
|
|
RunWorkerOptions,
|
|
|
|
|
} from "./worker-rpc-host.js";
|
|
|
|
|
export type {
|
|
|
|
|
HostServices,
|
|
|
|
|
HostClientFactoryOptions,
|
|
|
|
|
HostClientHandlers,
|
|
|
|
|
} from "./host-client-factory.js";
|
|
|
|
|
|
|
|
|
|
// JSON-RPC protocol types
|
|
|
|
|
export type {
|
|
|
|
|
JsonRpcId,
|
|
|
|
|
JsonRpcRequest,
|
|
|
|
|
JsonRpcSuccessResponse,
|
|
|
|
|
JsonRpcError,
|
|
|
|
|
JsonRpcErrorResponse,
|
|
|
|
|
JsonRpcResponse,
|
|
|
|
|
JsonRpcNotification,
|
|
|
|
|
JsonRpcMessage,
|
|
|
|
|
JsonRpcErrorCode,
|
|
|
|
|
PluginRpcErrorCode,
|
|
|
|
|
InitializeParams,
|
|
|
|
|
InitializeResult,
|
|
|
|
|
ConfigChangedParams,
|
|
|
|
|
ValidateConfigParams,
|
|
|
|
|
OnEventParams,
|
|
|
|
|
RunJobParams,
|
|
|
|
|
GetDataParams,
|
|
|
|
|
PerformActionParams,
|
|
|
|
|
ExecuteToolParams,
|
|
|
|
|
PluginModalBoundsRequest,
|
|
|
|
|
PluginRenderCloseEvent,
|
|
|
|
|
PluginLauncherRenderContextSnapshot,
|
|
|
|
|
HostToWorkerMethods,
|
|
|
|
|
HostToWorkerMethodName,
|
|
|
|
|
WorkerToHostMethods,
|
|
|
|
|
WorkerToHostMethodName,
|
|
|
|
|
HostToWorkerRequest,
|
|
|
|
|
HostToWorkerResponse,
|
|
|
|
|
WorkerToHostRequest,
|
|
|
|
|
WorkerToHostResponse,
|
|
|
|
|
WorkerToHostNotifications,
|
|
|
|
|
WorkerToHostNotificationName,
|
|
|
|
|
} from "./protocol.js";
|
|
|
|
|
|
|
|
|
|
// Plugin context and all client interfaces
|
|
|
|
|
export type {
|
|
|
|
|
PluginContext,
|
|
|
|
|
PluginConfigClient,
|
|
|
|
|
PluginEventsClient,
|
|
|
|
|
PluginJobsClient,
|
|
|
|
|
PluginLaunchersClient,
|
|
|
|
|
PluginHttpClient,
|
|
|
|
|
PluginSecretsClient,
|
|
|
|
|
PluginActivityClient,
|
|
|
|
|
PluginActivityLogEntry,
|
|
|
|
|
PluginStateClient,
|
|
|
|
|
PluginEntitiesClient,
|
|
|
|
|
PluginProjectsClient,
|
|
|
|
|
PluginCompaniesClient,
|
|
|
|
|
PluginIssuesClient,
|
[codex] Add plugin orchestration host APIs (#4114)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is the extension path for optional capabilities
that should not require core product changes for every integration.
> - Plugins need scoped host APIs for issue orchestration, documents,
wakeups, summaries, activity attribution, and isolated database state.
> - Without those host APIs, richer plugins either cannot coordinate
Paperclip work safely or need privileged core-side special cases.
> - This pull request adds the plugin orchestration host surface, scoped
route dispatch, a database namespace layer, and a smoke plugin that
exercises the contract.
> - The benefit is a broader plugin API that remains company-scoped,
auditable, and covered by tests.
## What Changed
- Added plugin orchestration host APIs for issue creation, document
access, wakeups, summaries, plugin-origin activity, and scoped API route
dispatch.
- Added plugin database namespace tables, schema exports, migration
checks, and idempotent replay coverage under migration
`0059_plugin_database_namespaces`.
- Added shared plugin route/API types and validators used by server and
SDK boundaries.
- Expanded plugin SDK types, protocol helpers, worker RPC host behavior,
and testing utilities for orchestration flows.
- Added the `plugin-orchestration-smoke-example` package to exercise
scoped routes, restricted database namespaces, issue orchestration,
documents, wakeups, summaries, and UI status surfaces.
- Kept the new orchestration smoke fixture out of the root pnpm
workspace importer so this PR preserves the repository policy of not
committing `pnpm-lock.yaml`.
- Updated plugin docs and database docs for the new orchestration and
database namespace surfaces.
- Rebased the branch onto `public-gh/master`, resolved conflicts, and
removed `pnpm-lock.yaml` from the final PR diff.
## Verification
- `pnpm install --frozen-lockfile`
- `pnpm --filter @paperclipai/db typecheck`
- `pnpm exec vitest run packages/db/src/client.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-database.test.ts
server/src/__tests__/plugin-orchestration-apis.test.ts
server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/plugin-scoped-api-routes.test.ts
server/src/__tests__/plugin-sdk-orchestration-contract.test.ts`
- From `packages/plugins/examples/plugin-orchestration-smoke-example`:
`pnpm exec vitest run --config ./vitest.config.ts`
- `pnpm --dir
packages/plugins/examples/plugin-orchestration-smoke-example run
typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- PR CI on latest head `293fc67c`: `policy`, `verify`, `e2e`, and
`security/snyk` all passed.
## Risks
- Medium risk: this expands plugin host authority, so route auth,
company scoping, and plugin-origin activity attribution need careful
review.
- Medium risk: database namespace migration behavior must remain
idempotent for environments that may have seen earlier branch versions.
- Medium risk: the orchestration smoke fixture is intentionally excluded
from the root workspace importer to avoid a `pnpm-lock.yaml` PR diff;
direct fixture verification remains listed above.
- Low operational risk from the PR setup itself: the branch is rebased
onto current `master`, the migration is ordered after upstream
`0057`/`0058`, and `pnpm-lock.yaml` is not in the final diff.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
Roadmap checked: this work aligns with the completed Plugin system
milestone and extends the plugin surface rather than duplicating an
unrelated planned core feature.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in a tool-enabled CLI
environment. Exact hosted model build and context-window size are not
exposed by the runtime; reasoning/tool use were enabled for repository
inspection, editing, testing, git operations, and PR creation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no core UI screen change; example plugin UI contract
is covered by tests)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 08:52:51 -05:00
|
|
|
PluginIssueMutationActor,
|
|
|
|
|
PluginIssueRelationsClient,
|
|
|
|
|
PluginIssueRelationSummary,
|
|
|
|
|
PluginIssueCheckoutOwnership,
|
|
|
|
|
PluginIssueWakeupResult,
|
|
|
|
|
PluginIssueWakeupBatchResult,
|
|
|
|
|
PluginIssueRunSummary,
|
|
|
|
|
PluginIssueApprovalSummary,
|
|
|
|
|
PluginIssueCostSummary,
|
|
|
|
|
PluginBudgetIncidentSummary,
|
|
|
|
|
PluginIssueInvocationBlockSummary,
|
|
|
|
|
PluginIssueOrchestrationSummary,
|
|
|
|
|
PluginIssueSubtreeOptions,
|
|
|
|
|
PluginIssueAssigneeSummary,
|
|
|
|
|
PluginIssueSubtree,
|
|
|
|
|
PluginIssueSummariesClient,
|
2026-03-13 16:22:34 -05:00
|
|
|
PluginAgentsClient,
|
|
|
|
|
PluginAgentSessionsClient,
|
|
|
|
|
AgentSession,
|
|
|
|
|
AgentSessionEvent,
|
|
|
|
|
AgentSessionSendResult,
|
|
|
|
|
PluginGoalsClient,
|
|
|
|
|
PluginDataClient,
|
|
|
|
|
PluginActionsClient,
|
|
|
|
|
PluginStreamsClient,
|
|
|
|
|
PluginToolsClient,
|
|
|
|
|
PluginMetricsClient,
|
2026-03-31 13:18:50 -05:00
|
|
|
PluginTelemetryClient,
|
2026-03-13 16:22:34 -05:00
|
|
|
PluginLogger,
|
|
|
|
|
} from "./types.js";
|
|
|
|
|
|
|
|
|
|
// Supporting types for context clients
|
|
|
|
|
export type {
|
|
|
|
|
ScopeKey,
|
|
|
|
|
EventFilter,
|
|
|
|
|
PluginEvent,
|
|
|
|
|
PluginJobContext,
|
|
|
|
|
PluginLauncherRegistration,
|
|
|
|
|
ToolRunContext,
|
|
|
|
|
ToolResult,
|
|
|
|
|
PluginEntityUpsert,
|
|
|
|
|
PluginEntityRecord,
|
|
|
|
|
PluginEntityQuery,
|
|
|
|
|
PluginWorkspace,
|
|
|
|
|
Company,
|
|
|
|
|
Project,
|
|
|
|
|
Issue,
|
|
|
|
|
IssueComment,
|
[codex] Add plugin orchestration host APIs (#4114)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is the extension path for optional capabilities
that should not require core product changes for every integration.
> - Plugins need scoped host APIs for issue orchestration, documents,
wakeups, summaries, activity attribution, and isolated database state.
> - Without those host APIs, richer plugins either cannot coordinate
Paperclip work safely or need privileged core-side special cases.
> - This pull request adds the plugin orchestration host surface, scoped
route dispatch, a database namespace layer, and a smoke plugin that
exercises the contract.
> - The benefit is a broader plugin API that remains company-scoped,
auditable, and covered by tests.
## What Changed
- Added plugin orchestration host APIs for issue creation, document
access, wakeups, summaries, plugin-origin activity, and scoped API route
dispatch.
- Added plugin database namespace tables, schema exports, migration
checks, and idempotent replay coverage under migration
`0059_plugin_database_namespaces`.
- Added shared plugin route/API types and validators used by server and
SDK boundaries.
- Expanded plugin SDK types, protocol helpers, worker RPC host behavior,
and testing utilities for orchestration flows.
- Added the `plugin-orchestration-smoke-example` package to exercise
scoped routes, restricted database namespaces, issue orchestration,
documents, wakeups, summaries, and UI status surfaces.
- Kept the new orchestration smoke fixture out of the root pnpm
workspace importer so this PR preserves the repository policy of not
committing `pnpm-lock.yaml`.
- Updated plugin docs and database docs for the new orchestration and
database namespace surfaces.
- Rebased the branch onto `public-gh/master`, resolved conflicts, and
removed `pnpm-lock.yaml` from the final PR diff.
## Verification
- `pnpm install --frozen-lockfile`
- `pnpm --filter @paperclipai/db typecheck`
- `pnpm exec vitest run packages/db/src/client.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-database.test.ts
server/src/__tests__/plugin-orchestration-apis.test.ts
server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/plugin-scoped-api-routes.test.ts
server/src/__tests__/plugin-sdk-orchestration-contract.test.ts`
- From `packages/plugins/examples/plugin-orchestration-smoke-example`:
`pnpm exec vitest run --config ./vitest.config.ts`
- `pnpm --dir
packages/plugins/examples/plugin-orchestration-smoke-example run
typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- PR CI on latest head `293fc67c`: `policy`, `verify`, `e2e`, and
`security/snyk` all passed.
## Risks
- Medium risk: this expands plugin host authority, so route auth,
company scoping, and plugin-origin activity attribution need careful
review.
- Medium risk: database namespace migration behavior must remain
idempotent for environments that may have seen earlier branch versions.
- Medium risk: the orchestration smoke fixture is intentionally excluded
from the root workspace importer to avoid a `pnpm-lock.yaml` PR diff;
direct fixture verification remains listed above.
- Low operational risk from the PR setup itself: the branch is rebased
onto current `master`, the migration is ordered after upstream
`0057`/`0058`, and `pnpm-lock.yaml` is not in the final diff.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
Roadmap checked: this work aligns with the completed Plugin system
milestone and extends the plugin surface rather than duplicating an
unrelated planned core feature.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in a tool-enabled CLI
environment. Exact hosted model build and context-window size are not
exposed by the runtime; reasoning/tool use were enabled for repository
inspection, editing, testing, git operations, and PR creation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no core UI screen change; example plugin UI contract
is covered by tests)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 08:52:51 -05:00
|
|
|
IssueDocumentSummary,
|
2026-03-13 16:22:34 -05:00
|
|
|
Agent,
|
|
|
|
|
Goal,
|
[codex] Add plugin orchestration host APIs (#4114)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is the extension path for optional capabilities
that should not require core product changes for every integration.
> - Plugins need scoped host APIs for issue orchestration, documents,
wakeups, summaries, activity attribution, and isolated database state.
> - Without those host APIs, richer plugins either cannot coordinate
Paperclip work safely or need privileged core-side special cases.
> - This pull request adds the plugin orchestration host surface, scoped
route dispatch, a database namespace layer, and a smoke plugin that
exercises the contract.
> - The benefit is a broader plugin API that remains company-scoped,
auditable, and covered by tests.
## What Changed
- Added plugin orchestration host APIs for issue creation, document
access, wakeups, summaries, plugin-origin activity, and scoped API route
dispatch.
- Added plugin database namespace tables, schema exports, migration
checks, and idempotent replay coverage under migration
`0059_plugin_database_namespaces`.
- Added shared plugin route/API types and validators used by server and
SDK boundaries.
- Expanded plugin SDK types, protocol helpers, worker RPC host behavior,
and testing utilities for orchestration flows.
- Added the `plugin-orchestration-smoke-example` package to exercise
scoped routes, restricted database namespaces, issue orchestration,
documents, wakeups, summaries, and UI status surfaces.
- Kept the new orchestration smoke fixture out of the root pnpm
workspace importer so this PR preserves the repository policy of not
committing `pnpm-lock.yaml`.
- Updated plugin docs and database docs for the new orchestration and
database namespace surfaces.
- Rebased the branch onto `public-gh/master`, resolved conflicts, and
removed `pnpm-lock.yaml` from the final PR diff.
## Verification
- `pnpm install --frozen-lockfile`
- `pnpm --filter @paperclipai/db typecheck`
- `pnpm exec vitest run packages/db/src/client.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-database.test.ts
server/src/__tests__/plugin-orchestration-apis.test.ts
server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/plugin-scoped-api-routes.test.ts
server/src/__tests__/plugin-sdk-orchestration-contract.test.ts`
- From `packages/plugins/examples/plugin-orchestration-smoke-example`:
`pnpm exec vitest run --config ./vitest.config.ts`
- `pnpm --dir
packages/plugins/examples/plugin-orchestration-smoke-example run
typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- PR CI on latest head `293fc67c`: `policy`, `verify`, `e2e`, and
`security/snyk` all passed.
## Risks
- Medium risk: this expands plugin host authority, so route auth,
company scoping, and plugin-origin activity attribution need careful
review.
- Medium risk: database namespace migration behavior must remain
idempotent for environments that may have seen earlier branch versions.
- Medium risk: the orchestration smoke fixture is intentionally excluded
from the root workspace importer to avoid a `pnpm-lock.yaml` PR diff;
direct fixture verification remains listed above.
- Low operational risk from the PR setup itself: the branch is rebased
onto current `master`, the migration is ordered after upstream
`0057`/`0058`, and `pnpm-lock.yaml` is not in the final diff.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
Roadmap checked: this work aligns with the completed Plugin system
milestone and extends the plugin surface rather than duplicating an
unrelated planned core feature.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in a tool-enabled CLI
environment. Exact hosted model build and context-window size are not
exposed by the runtime; reasoning/tool use were enabled for repository
inspection, editing, testing, git operations, and PR creation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no core UI screen change; example plugin UI contract
is covered by tests)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 08:52:51 -05:00
|
|
|
PluginDatabaseClient,
|
2026-03-13 16:22:34 -05:00
|
|
|
} from "./types.js";
|
|
|
|
|
|
|
|
|
|
// Manifest and constant types re-exported from @paperclipai/shared
|
|
|
|
|
// Plugin authors import manifest types from here so they have a single
|
|
|
|
|
// dependency (@paperclipai/plugin-sdk) for all plugin authoring needs.
|
|
|
|
|
export type {
|
|
|
|
|
PaperclipPluginManifestV1,
|
|
|
|
|
PluginJobDeclaration,
|
|
|
|
|
PluginWebhookDeclaration,
|
|
|
|
|
PluginToolDeclaration,
|
|
|
|
|
PluginUiSlotDeclaration,
|
|
|
|
|
PluginUiDeclaration,
|
|
|
|
|
PluginLauncherActionDeclaration,
|
|
|
|
|
PluginLauncherRenderDeclaration,
|
|
|
|
|
PluginLauncherDeclaration,
|
|
|
|
|
PluginMinimumHostVersion,
|
[codex] Add plugin orchestration host APIs (#4114)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is the extension path for optional capabilities
that should not require core product changes for every integration.
> - Plugins need scoped host APIs for issue orchestration, documents,
wakeups, summaries, activity attribution, and isolated database state.
> - Without those host APIs, richer plugins either cannot coordinate
Paperclip work safely or need privileged core-side special cases.
> - This pull request adds the plugin orchestration host surface, scoped
route dispatch, a database namespace layer, and a smoke plugin that
exercises the contract.
> - The benefit is a broader plugin API that remains company-scoped,
auditable, and covered by tests.
## What Changed
- Added plugin orchestration host APIs for issue creation, document
access, wakeups, summaries, plugin-origin activity, and scoped API route
dispatch.
- Added plugin database namespace tables, schema exports, migration
checks, and idempotent replay coverage under migration
`0059_plugin_database_namespaces`.
- Added shared plugin route/API types and validators used by server and
SDK boundaries.
- Expanded plugin SDK types, protocol helpers, worker RPC host behavior,
and testing utilities for orchestration flows.
- Added the `plugin-orchestration-smoke-example` package to exercise
scoped routes, restricted database namespaces, issue orchestration,
documents, wakeups, summaries, and UI status surfaces.
- Kept the new orchestration smoke fixture out of the root pnpm
workspace importer so this PR preserves the repository policy of not
committing `pnpm-lock.yaml`.
- Updated plugin docs and database docs for the new orchestration and
database namespace surfaces.
- Rebased the branch onto `public-gh/master`, resolved conflicts, and
removed `pnpm-lock.yaml` from the final PR diff.
## Verification
- `pnpm install --frozen-lockfile`
- `pnpm --filter @paperclipai/db typecheck`
- `pnpm exec vitest run packages/db/src/client.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-database.test.ts
server/src/__tests__/plugin-orchestration-apis.test.ts
server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/plugin-scoped-api-routes.test.ts
server/src/__tests__/plugin-sdk-orchestration-contract.test.ts`
- From `packages/plugins/examples/plugin-orchestration-smoke-example`:
`pnpm exec vitest run --config ./vitest.config.ts`
- `pnpm --dir
packages/plugins/examples/plugin-orchestration-smoke-example run
typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- PR CI on latest head `293fc67c`: `policy`, `verify`, `e2e`, and
`security/snyk` all passed.
## Risks
- Medium risk: this expands plugin host authority, so route auth,
company scoping, and plugin-origin activity attribution need careful
review.
- Medium risk: database namespace migration behavior must remain
idempotent for environments that may have seen earlier branch versions.
- Medium risk: the orchestration smoke fixture is intentionally excluded
from the root workspace importer to avoid a `pnpm-lock.yaml` PR diff;
direct fixture verification remains listed above.
- Low operational risk from the PR setup itself: the branch is rebased
onto current `master`, the migration is ordered after upstream
`0057`/`0058`, and `pnpm-lock.yaml` is not in the final diff.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
Roadmap checked: this work aligns with the completed Plugin system
milestone and extends the plugin surface rather than duplicating an
unrelated planned core feature.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in a tool-enabled CLI
environment. Exact hosted model build and context-window size are not
exposed by the runtime; reasoning/tool use were enabled for repository
inspection, editing, testing, git operations, and PR creation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no core UI screen change; example plugin UI contract
is covered by tests)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 08:52:51 -05:00
|
|
|
PluginDatabaseDeclaration,
|
|
|
|
|
PluginApiRouteCompanyResolution,
|
|
|
|
|
PluginApiRouteDeclaration,
|
2026-03-13 16:22:34 -05:00
|
|
|
PluginRecord,
|
[codex] Add plugin orchestration host APIs (#4114)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is the extension path for optional capabilities
that should not require core product changes for every integration.
> - Plugins need scoped host APIs for issue orchestration, documents,
wakeups, summaries, activity attribution, and isolated database state.
> - Without those host APIs, richer plugins either cannot coordinate
Paperclip work safely or need privileged core-side special cases.
> - This pull request adds the plugin orchestration host surface, scoped
route dispatch, a database namespace layer, and a smoke plugin that
exercises the contract.
> - The benefit is a broader plugin API that remains company-scoped,
auditable, and covered by tests.
## What Changed
- Added plugin orchestration host APIs for issue creation, document
access, wakeups, summaries, plugin-origin activity, and scoped API route
dispatch.
- Added plugin database namespace tables, schema exports, migration
checks, and idempotent replay coverage under migration
`0059_plugin_database_namespaces`.
- Added shared plugin route/API types and validators used by server and
SDK boundaries.
- Expanded plugin SDK types, protocol helpers, worker RPC host behavior,
and testing utilities for orchestration flows.
- Added the `plugin-orchestration-smoke-example` package to exercise
scoped routes, restricted database namespaces, issue orchestration,
documents, wakeups, summaries, and UI status surfaces.
- Kept the new orchestration smoke fixture out of the root pnpm
workspace importer so this PR preserves the repository policy of not
committing `pnpm-lock.yaml`.
- Updated plugin docs and database docs for the new orchestration and
database namespace surfaces.
- Rebased the branch onto `public-gh/master`, resolved conflicts, and
removed `pnpm-lock.yaml` from the final PR diff.
## Verification
- `pnpm install --frozen-lockfile`
- `pnpm --filter @paperclipai/db typecheck`
- `pnpm exec vitest run packages/db/src/client.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-database.test.ts
server/src/__tests__/plugin-orchestration-apis.test.ts
server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/plugin-scoped-api-routes.test.ts
server/src/__tests__/plugin-sdk-orchestration-contract.test.ts`
- From `packages/plugins/examples/plugin-orchestration-smoke-example`:
`pnpm exec vitest run --config ./vitest.config.ts`
- `pnpm --dir
packages/plugins/examples/plugin-orchestration-smoke-example run
typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- PR CI on latest head `293fc67c`: `policy`, `verify`, `e2e`, and
`security/snyk` all passed.
## Risks
- Medium risk: this expands plugin host authority, so route auth,
company scoping, and plugin-origin activity attribution need careful
review.
- Medium risk: database namespace migration behavior must remain
idempotent for environments that may have seen earlier branch versions.
- Medium risk: the orchestration smoke fixture is intentionally excluded
from the root workspace importer to avoid a `pnpm-lock.yaml` PR diff;
direct fixture verification remains listed above.
- Low operational risk from the PR setup itself: the branch is rebased
onto current `master`, the migration is ordered after upstream
`0057`/`0058`, and `pnpm-lock.yaml` is not in the final diff.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
Roadmap checked: this work aligns with the completed Plugin system
milestone and extends the plugin surface rather than duplicating an
unrelated planned core feature.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in a tool-enabled CLI
environment. Exact hosted model build and context-window size are not
exposed by the runtime; reasoning/tool use were enabled for repository
inspection, editing, testing, git operations, and PR creation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no core UI screen change; example plugin UI contract
is covered by tests)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 08:52:51 -05:00
|
|
|
PluginDatabaseNamespaceRecord,
|
|
|
|
|
PluginMigrationRecord,
|
2026-03-13 16:22:34 -05:00
|
|
|
PluginConfig,
|
|
|
|
|
JsonSchema,
|
|
|
|
|
PluginStatus,
|
|
|
|
|
PluginCategory,
|
|
|
|
|
PluginCapability,
|
|
|
|
|
PluginUiSlotType,
|
|
|
|
|
PluginUiSlotEntityType,
|
|
|
|
|
PluginLauncherPlacementZone,
|
|
|
|
|
PluginLauncherAction,
|
|
|
|
|
PluginLauncherBounds,
|
|
|
|
|
PluginLauncherRenderEnvironment,
|
|
|
|
|
PluginStateScopeKind,
|
|
|
|
|
PluginJobStatus,
|
|
|
|
|
PluginJobRunStatus,
|
|
|
|
|
PluginJobRunTrigger,
|
|
|
|
|
PluginWebhookDeliveryStatus,
|
[codex] Add plugin orchestration host APIs (#4114)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is the extension path for optional capabilities
that should not require core product changes for every integration.
> - Plugins need scoped host APIs for issue orchestration, documents,
wakeups, summaries, activity attribution, and isolated database state.
> - Without those host APIs, richer plugins either cannot coordinate
Paperclip work safely or need privileged core-side special cases.
> - This pull request adds the plugin orchestration host surface, scoped
route dispatch, a database namespace layer, and a smoke plugin that
exercises the contract.
> - The benefit is a broader plugin API that remains company-scoped,
auditable, and covered by tests.
## What Changed
- Added plugin orchestration host APIs for issue creation, document
access, wakeups, summaries, plugin-origin activity, and scoped API route
dispatch.
- Added plugin database namespace tables, schema exports, migration
checks, and idempotent replay coverage under migration
`0059_plugin_database_namespaces`.
- Added shared plugin route/API types and validators used by server and
SDK boundaries.
- Expanded plugin SDK types, protocol helpers, worker RPC host behavior,
and testing utilities for orchestration flows.
- Added the `plugin-orchestration-smoke-example` package to exercise
scoped routes, restricted database namespaces, issue orchestration,
documents, wakeups, summaries, and UI status surfaces.
- Kept the new orchestration smoke fixture out of the root pnpm
workspace importer so this PR preserves the repository policy of not
committing `pnpm-lock.yaml`.
- Updated plugin docs and database docs for the new orchestration and
database namespace surfaces.
- Rebased the branch onto `public-gh/master`, resolved conflicts, and
removed `pnpm-lock.yaml` from the final PR diff.
## Verification
- `pnpm install --frozen-lockfile`
- `pnpm --filter @paperclipai/db typecheck`
- `pnpm exec vitest run packages/db/src/client.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-database.test.ts
server/src/__tests__/plugin-orchestration-apis.test.ts
server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/plugin-scoped-api-routes.test.ts
server/src/__tests__/plugin-sdk-orchestration-contract.test.ts`
- From `packages/plugins/examples/plugin-orchestration-smoke-example`:
`pnpm exec vitest run --config ./vitest.config.ts`
- `pnpm --dir
packages/plugins/examples/plugin-orchestration-smoke-example run
typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- PR CI on latest head `293fc67c`: `policy`, `verify`, `e2e`, and
`security/snyk` all passed.
## Risks
- Medium risk: this expands plugin host authority, so route auth,
company scoping, and plugin-origin activity attribution need careful
review.
- Medium risk: database namespace migration behavior must remain
idempotent for environments that may have seen earlier branch versions.
- Medium risk: the orchestration smoke fixture is intentionally excluded
from the root workspace importer to avoid a `pnpm-lock.yaml` PR diff;
direct fixture verification remains listed above.
- Low operational risk from the PR setup itself: the branch is rebased
onto current `master`, the migration is ordered after upstream
`0057`/`0058`, and `pnpm-lock.yaml` is not in the final diff.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
Roadmap checked: this work aligns with the completed Plugin system
milestone and extends the plugin surface rather than duplicating an
unrelated planned core feature.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in a tool-enabled CLI
environment. Exact hosted model build and context-window size are not
exposed by the runtime; reasoning/tool use were enabled for repository
inspection, editing, testing, git operations, and PR creation.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots (N/A: no core UI screen change; example plugin UI contract
is covered by tests)
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 08:52:51 -05:00
|
|
|
PluginDatabaseCoreReadTable,
|
|
|
|
|
PluginDatabaseMigrationStatus,
|
|
|
|
|
PluginDatabaseNamespaceMode,
|
|
|
|
|
PluginDatabaseNamespaceStatus,
|
|
|
|
|
PluginApiRouteAuthMode,
|
|
|
|
|
PluginApiRouteCheckoutPolicy,
|
|
|
|
|
PluginApiRouteMethod,
|
2026-03-13 16:22:34 -05:00
|
|
|
PluginEventType,
|
|
|
|
|
PluginBridgeErrorCode,
|
|
|
|
|
} from "./types.js";
|
|
|
|
|
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
// Zod re-export
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Zod is re-exported for plugin authors to use when defining their
|
|
|
|
|
* `instanceConfigSchema` and tool `parametersSchema`.
|
|
|
|
|
*
|
|
|
|
|
* Plugin authors do not need to add a separate `zod` dependency.
|
|
|
|
|
*
|
|
|
|
|
* @see PLUGIN_SPEC.md §14.1 — Example SDK Shape
|
|
|
|
|
*
|
|
|
|
|
* @example
|
|
|
|
|
* ```ts
|
|
|
|
|
* import { z } from "@paperclipai/plugin-sdk";
|
|
|
|
|
*
|
|
|
|
|
* const configSchema = z.object({
|
|
|
|
|
* apiKey: z.string().describe("Your API key"),
|
|
|
|
|
* workspace: z.string().optional(),
|
|
|
|
|
* });
|
|
|
|
|
* ```
|
|
|
|
|
*/
|
|
|
|
|
export { z } from "zod";
|
|
|
|
|
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
// Constants re-exports (for plugin code that needs to check values at runtime)
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
export {
|
|
|
|
|
PLUGIN_API_VERSION,
|
|
|
|
|
PLUGIN_STATUSES,
|
|
|
|
|
PLUGIN_CATEGORIES,
|
|
|
|
|
PLUGIN_CAPABILITIES,
|
|
|
|
|
PLUGIN_UI_SLOT_TYPES,
|
|
|
|
|
PLUGIN_UI_SLOT_ENTITY_TYPES,
|
|
|
|
|
PLUGIN_STATE_SCOPE_KINDS,
|
|
|
|
|
PLUGIN_JOB_STATUSES,
|
|
|
|
|
PLUGIN_JOB_RUN_STATUSES,
|
|
|
|
|
PLUGIN_JOB_RUN_TRIGGERS,
|
|
|
|
|
PLUGIN_WEBHOOK_DELIVERY_STATUSES,
|
|
|
|
|
PLUGIN_EVENT_TYPES,
|
|
|
|
|
PLUGIN_BRIDGE_ERROR_CODES,
|
|
|
|
|
} from "@paperclipai/shared";
|