2026-03-05 06:31:22 -06:00
import fs from "node:fs/promises" ;
2026-03-05 08:28:12 -06:00
import os from "node:os" ;
2026-03-05 06:31:22 -06:00
import path from "node:path" ;
2026-03-05 08:28:12 -06:00
import { fileURLToPath } from "node:url" ;
2026-03-14 22:00:12 -05:00
import { inferOpenAiCompatibleBiller , type AdapterExecutionContext , type AdapterExecutionResult } from "@paperclipai/adapter-utils" ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
import {
adapterExecutionTargetIsRemote ,
adapterExecutionTargetPaperclipApiUrl ,
adapterExecutionTargetRemoteCwd ,
adapterExecutionTargetSessionIdentity ,
adapterExecutionTargetSessionMatches ,
adapterExecutionTargetUsesManagedHome ,
describeAdapterExecutionTarget ,
ensureAdapterExecutionTargetCommandResolvable ,
prepareAdapterExecutionTargetRuntime ,
readAdapterExecutionTarget ,
readAdapterExecutionTargetHomeDir ,
resolveAdapterExecutionTargetCommandForLogs ,
runAdapterExecutionTargetProcess ,
runAdapterExecutionTargetShellCommand ,
} from "@paperclipai/adapter-utils/execution-target" ;
2026-03-05 06:31:22 -06:00
import {
asString ,
asNumber ,
asStringArray ,
parseObject ,
Fix CEO AGENT_HOME paths and centralize workspace env propagation (#4551)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The local adapter layer is responsible for turning Paperclip runtime
context into the environment seen by the child agent process.
> - The CEO onboarding bundle tells the agent where to read and write
its persistent memory and fact files.
> - That bundle was using `./memory/...` and `./life/...`, which only
works when the process cwd happens to equal the agent home directory.
> - At the same time, six local adapters each duplicated the same
workspace-env propagation logic, including `AGENT_HOME`, which makes
this contract easy to drift.
> - This pull request fixes the CEO instructions to use
`$AGENT_HOME/...` and centralizes workspace-env propagation in one
shared helper with shared tests.
> - The benefit is a real bug fix for agent memory paths plus a single
tested contract that makes future built-in adapter work less likely to
forget `AGENT_HOME`.
## What Changed
- Updated `server/src/onboarding-assets/ceo/HEARTBEAT.md` to use
`$AGENT_HOME/memory/...` and `$AGENT_HOME/life/...` instead of
cwd-relative `./memory/...` and `./life/...`.
- Added `applyPaperclipWorkspaceEnv(...)` in
`packages/adapter-utils/src/server-utils.ts` to centralize
`PAPERCLIP_WORKSPACE_*` and `AGENT_HOME` propagation.
- Added shared helper coverage in
`packages/adapter-utils/src/server-utils.test.ts` for both populated and
skip-empty cases.
- Switched the built-in local adapters (`claude_local`, `codex_local`,
`cursor_local`, `gemini_local`, `opencode_local`, `pi_local`) over to
the shared helper instead of inline env assignment blocks.
## Verification
- `pnpm install`
- `pnpm exec vitest run packages/adapter-utils/src/server-utils.test.ts
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/codex-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- Result: 7 test files passed, 31 tests passed, 0 failures.
## Risks
- Low risk.
- The only behavioral surface is the shared env propagation refactor
across six adapters; if the helper diverged from prior semantics, an
adapter could miss a workspace env var.
- The shared helper test plus the affected adapter execute tests reduce
that risk, and the helper preserves the prior "set only non-empty
strings" behavior.
## Model Used
- OpenAI Codex via Paperclip `codex_local` agent runtime; tool-assisted
coding workflow with shell execution, file patching, git operations, and
API interaction. The exact backend model identifier and context window
are not surfaced by this local runtime.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-26 13:57:35 -07:00
applyPaperclipWorkspaceEnv ,
2026-03-05 06:31:22 -06:00
buildPaperclipEnv ,
2026-03-28 15:42:14 -05:00
buildInvocationEnvForLogs ,
2026-03-05 06:31:22 -06:00
ensureAbsoluteDirectory ,
2026-03-12 15:44:44 -05:00
ensurePaperclipSkillSymlink ,
2026-03-05 06:31:22 -06:00
ensurePathInEnv ,
2026-03-15 07:05:01 -05:00
readPaperclipRuntimeSkillEntries ,
resolvePaperclipDesiredSkillNames ,
2026-03-12 15:57:37 -05:00
removeMaintainerOnlySkillSymlinks ,
2026-03-05 06:31:22 -06:00
renderTemplate ,
2026-03-28 09:55:41 -05:00
renderPaperclipWakePrompt ,
stringifyPaperclipWakePayload ,
[codex] Add run liveness continuations (#4083)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - Heartbeat runs are the control-plane record of each agent execution
window.
> - Long-running local agents can exhaust context or stop while still
holding useful next-step state.
> - Operators need that stop reason, next action, and continuation path
to be durable and visible.
> - This pull request adds run liveness metadata, continuation
summaries, and UI surfaces for issue run ledgers.
> - The benefit is that interrupted or long-running work can resume with
clearer context instead of losing the agent's last useful handoff.
## What Changed
- Added heartbeat-run liveness fields, continuation attempt tracking,
and an idempotent `0058` migration.
- Added server services and tests for run liveness, continuation
summaries, stop metadata, and activity backfill.
- Wired local and HTTP adapters to surface continuation/liveness context
through shared adapter utilities.
- Added shared constants, validators, and heartbeat types for liveness
continuation state.
- Added issue-detail UI surfaces for continuation handoffs and the run
ledger, with component tests.
- Updated agent runtime docs, heartbeat protocol docs, prompt guidance,
onboarding assets, and skills instructions to explain continuation
behavior.
- Addressed Greptile feedback by scoping document evidence by run,
excluding system continuation-summary documents from liveness evidence,
importing shared liveness types, surfacing hidden ledger run counts,
documenting bounded retry behavior, and moving run-ledger liveness
backfill off the request path.
## Verification
- `pnpm exec vitest run packages/adapter-utils/src/server-utils.test.ts
server/src/__tests__/run-continuations.test.ts
server/src/__tests__/run-liveness.test.ts
server/src/__tests__/activity-service.test.ts
server/src/__tests__/documents-service.test.ts
server/src/__tests__/issue-continuation-summary.test.ts
server/src/services/heartbeat-stop-metadata.test.ts
ui/src/components/IssueRunLedger.test.tsx
ui/src/components/IssueContinuationHandoff.test.tsx
ui/src/components/IssueDocumentsSection.test.tsx`
- `pnpm --filter @paperclipai/db build`
- `pnpm exec vitest run server/src/__tests__/activity-service.test.ts
ui/src/components/IssueRunLedger.test.tsx`
- `pnpm --filter @paperclipai/ui typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- `pnpm exec vitest run server/src/__tests__/activity-service.test.ts
server/src/__tests__/run-continuations.test.ts
ui/src/components/IssueRunLedger.test.tsx`
- `pnpm exec vitest run
server/src/__tests__/heartbeat-process-recovery.test.ts -t "treats a
plan document update"`
- `pnpm exec vitest run server/src/__tests__/activity-service.test.ts
server/src/__tests__/heartbeat-process-recovery.test.ts -t "activity
service|treats a plan document update"`
- Remote PR checks on head `e53b1a1d`: `verify`, `e2e`, `policy`, and
Snyk all passed.
- Confirmed `public-gh/master` is an ancestor of this branch after
fetching `public-gh master`.
- Confirmed `pnpm-lock.yaml` is not included in the branch diff.
- Confirmed migration `0058_wealthy_starbolt.sql` is ordered after
`0057` and uses `IF NOT EXISTS` guards for repeat application.
- Greptile inline review threads are resolved.
## Risks
- Medium risk: this touches heartbeat execution, liveness recovery,
activity rendering, issue routes, shared contracts, docs, and UI.
- Migration risk is mitigated by additive columns/indexes and idempotent
guards.
- Run-ledger liveness backfill is now asynchronous, so the first ledger
response can briefly show historical missing liveness until the
background backfill completes.
- UI screenshot coverage is not included in this packaging pass;
validation is currently through focused component tests.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
## Model Used
- OpenAI Codex, GPT-5.4, local tool-use coding agent with terminal, git,
GitHub connector, GitHub CLI, and Paperclip API access.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
Screenshot note: no before/after screenshots were captured in this PR
packaging pass; the UI changes are covered by focused component tests
listed above.
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 06:01:49 -05:00
DEFAULT_PAPERCLIP_AGENT_PROMPT_TEMPLATE ,
2026-03-13 08:49:11 -05:00
joinPromptSections ,
2026-03-05 06:31:22 -06:00
} from "@paperclipai/adapter-utils/server-utils" ;
import { DEFAULT_CURSOR_LOCAL_MODEL } from "../index.js" ;
import { parseCursorJsonl , isCursorUnknownSessionError } from "./parse.js" ;
2026-03-05 08:07:20 -06:00
import { normalizeCursorStreamLine } from "../shared/stream.js" ;
2026-03-05 08:28:12 -06:00
import { hasCursorTrustBypassArg } from "../shared/trust.js" ;
const __moduleDir = path . dirname ( fileURLToPath ( import . meta . url ) ) ;
2026-03-05 06:31:22 -06:00
function firstNonEmptyLine ( text : string ) : string {
return (
text
. split ( /\r?\n/ )
. map ( ( line ) = > line . trim ( ) )
. find ( Boolean ) ? ? ""
) ;
}
function hasNonEmptyEnvValue ( env : Record < string , string > , key : string ) : boolean {
const raw = env [ key ] ;
return typeof raw === "string" && raw . trim ( ) . length > 0 ;
}
function resolveCursorBillingType ( env : Record < string , string > ) : "api" | "subscription" {
return hasNonEmptyEnvValue ( env , "CURSOR_API_KEY" ) || hasNonEmptyEnvValue ( env , "OPENAI_API_KEY" )
? "api"
: "subscription" ;
}
2026-03-14 22:00:12 -05:00
function resolveCursorBiller (
env : Record < string , string > ,
billingType : "api" | "subscription" ,
provider : string | null ,
) : string {
const openAiCompatibleBiller = inferOpenAiCompatibleBiller ( env , null ) ;
if ( openAiCompatibleBiller === "openrouter" ) return "openrouter" ;
if ( billingType === "subscription" ) return "cursor" ;
return provider ? ? "cursor" ;
}
2026-03-05 06:31:22 -06:00
function resolveProviderFromModel ( model : string ) : string | null {
const trimmed = model . trim ( ) . toLowerCase ( ) ;
if ( ! trimmed ) return null ;
const slash = trimmed . indexOf ( "/" ) ;
if ( slash > 0 ) return trimmed . slice ( 0 , slash ) ;
if ( trimmed . includes ( "sonnet" ) || trimmed . includes ( "claude" ) ) return "anthropic" ;
if ( trimmed . startsWith ( "gpt" ) || trimmed . startsWith ( "o" ) ) return "openai" ;
return null ;
}
function normalizeMode ( rawMode : string ) : "plan" | "ask" | null {
const mode = rawMode . trim ( ) . toLowerCase ( ) ;
if ( mode === "plan" || mode === "ask" ) return mode ;
return null ;
}
2026-03-05 09:12:13 -06:00
function renderPaperclipEnvNote ( env : Record < string , string > ) : string {
const paperclipKeys = Object . keys ( env )
. filter ( ( key ) = > key . startsWith ( "PAPERCLIP_" ) )
. sort ( ) ;
if ( paperclipKeys . length === 0 ) return "" ;
return [
"Paperclip runtime note:" ,
` The following PAPERCLIP_* environment variables are available in this run: ${ paperclipKeys . join ( ", " ) } ` ,
"Do not assume these variables are missing without checking your shell environment." ,
"" ,
"" ,
] . join ( "\n" ) ;
}
2026-03-05 08:28:12 -06:00
function cursorSkillsHome ( ) : string {
return path . join ( os . homedir ( ) , ".cursor" , "skills" ) ;
}
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
async function buildCursorSkillsDir ( config : Record < string , unknown > ) : Promise < string > {
const tmp = await fs . mkdtemp ( path . join ( os . tmpdir ( ) , "paperclip-cursor-skills-" ) ) ;
const target = path . join ( tmp , "skills" ) ;
await fs . mkdir ( target , { recursive : true } ) ;
const availableEntries = await readPaperclipRuntimeSkillEntries ( config , __moduleDir ) ;
const desiredNames = new Set ( resolvePaperclipDesiredSkillNames ( config , availableEntries ) ) ;
for ( const entry of availableEntries ) {
if ( ! desiredNames . has ( entry . key ) ) continue ;
await fs . symlink ( entry . source , path . join ( target , entry . runtimeName ) ) ;
}
return target ;
}
2026-03-05 08:28:12 -06:00
type EnsureCursorSkillsInjectedOptions = {
skillsDir? : string | null ;
2026-03-16 18:27:20 -05:00
skillsEntries? : Array < { key : string ; runtimeName : string ; source : string } > ;
2026-03-05 08:28:12 -06:00
skillsHome? : string ;
linkSkill ? : ( source : string , target : string ) = > Promise < void > ;
} ;
export async function ensureCursorSkillsInjected (
onLog : AdapterExecutionContext [ "onLog" ] ,
options : EnsureCursorSkillsInjectedOptions = { } ,
) {
2026-03-12 15:44:44 -05:00
const skillsEntries = options . skillsEntries
? ? ( options . skillsDir
? ( await fs . readdir ( options . skillsDir , { withFileTypes : true } ) )
. filter ( ( entry ) = > entry . isDirectory ( ) )
2026-03-16 18:27:20 -05:00
. map ( ( entry ) = > ( {
key : entry.name ,
runtimeName : entry.name ,
source : path.join ( options . skillsDir ! , entry . name ) ,
} ) )
2026-03-15 07:05:01 -05:00
: await readPaperclipRuntimeSkillEntries ( { } , __moduleDir ) ) ;
2026-03-12 15:44:44 -05:00
if ( skillsEntries . length === 0 ) return ;
2026-03-05 08:28:12 -06:00
const skillsHome = options . skillsHome ? ? cursorSkillsHome ( ) ;
try {
await fs . mkdir ( skillsHome , { recursive : true } ) ;
} catch ( err ) {
await onLog (
"stderr" ,
` [paperclip] Failed to prepare Cursor skills directory ${ skillsHome } : ${ err instanceof Error ? err.message : String ( err ) } \ n ` ,
) ;
return ;
}
2026-03-12 15:57:37 -05:00
const removedSkills = await removeMaintainerOnlySkillSymlinks (
skillsHome ,
2026-03-16 18:27:20 -05:00
skillsEntries . map ( ( entry ) = > entry . runtimeName ) ,
2026-03-12 15:57:37 -05:00
) ;
for ( const skillName of removedSkills ) {
await onLog (
"stderr" ,
` [paperclip] Removed maintainer-only Cursor skill " ${ skillName } " from ${ skillsHome } \ n ` ,
) ;
}
2026-03-05 08:28:12 -06:00
const linkSkill = options . linkSkill ? ? ( ( source : string , target : string ) = > fs . symlink ( source , target ) ) ;
2026-03-12 15:44:44 -05:00
for ( const entry of skillsEntries ) {
2026-03-16 18:27:20 -05:00
const target = path . join ( skillsHome , entry . runtimeName ) ;
2026-03-05 08:28:12 -06:00
try {
2026-03-12 15:44:44 -05:00
const result = await ensurePaperclipSkillSymlink ( entry . source , target , linkSkill ) ;
if ( result === "skipped" ) continue ;
2026-03-05 08:28:12 -06:00
await onLog (
"stderr" ,
2026-03-16 18:27:20 -05:00
` [paperclip] ${ result === "repaired" ? "Repaired" : "Injected" } Cursor skill " ${ entry . key } " into ${ skillsHome } \ n ` ,
2026-03-05 08:28:12 -06:00
) ;
} catch ( err ) {
await onLog (
"stderr" ,
2026-03-16 18:27:20 -05:00
` [paperclip] Failed to inject Cursor skill " ${ entry . key } " into ${ skillsHome } : ${ err instanceof Error ? err.message : String ( err ) } \ n ` ,
2026-03-05 08:28:12 -06:00
) ;
}
}
}
2026-03-05 06:31:22 -06:00
export async function execute ( ctx : AdapterExecutionContext ) : Promise < AdapterExecutionResult > {
2026-03-19 11:20:36 -05:00
const { runId , agent , runtime , config , context , onLog , onMeta , onSpawn , authToken } = ctx ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
const executionTarget = readAdapterExecutionTarget ( {
executionTarget : ctx.executionTarget ,
legacyRemoteExecution : ctx.executionTransport?.remoteExecution ,
} ) ;
const executionTargetIsRemote = adapterExecutionTargetIsRemote ( executionTarget ) ;
2026-03-05 06:31:22 -06:00
const promptTemplate = asString (
config . promptTemplate ,
[codex] Add run liveness continuations (#4083)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - Heartbeat runs are the control-plane record of each agent execution
window.
> - Long-running local agents can exhaust context or stop while still
holding useful next-step state.
> - Operators need that stop reason, next action, and continuation path
to be durable and visible.
> - This pull request adds run liveness metadata, continuation
summaries, and UI surfaces for issue run ledgers.
> - The benefit is that interrupted or long-running work can resume with
clearer context instead of losing the agent's last useful handoff.
## What Changed
- Added heartbeat-run liveness fields, continuation attempt tracking,
and an idempotent `0058` migration.
- Added server services and tests for run liveness, continuation
summaries, stop metadata, and activity backfill.
- Wired local and HTTP adapters to surface continuation/liveness context
through shared adapter utilities.
- Added shared constants, validators, and heartbeat types for liveness
continuation state.
- Added issue-detail UI surfaces for continuation handoffs and the run
ledger, with component tests.
- Updated agent runtime docs, heartbeat protocol docs, prompt guidance,
onboarding assets, and skills instructions to explain continuation
behavior.
- Addressed Greptile feedback by scoping document evidence by run,
excluding system continuation-summary documents from liveness evidence,
importing shared liveness types, surfacing hidden ledger run counts,
documenting bounded retry behavior, and moving run-ledger liveness
backfill off the request path.
## Verification
- `pnpm exec vitest run packages/adapter-utils/src/server-utils.test.ts
server/src/__tests__/run-continuations.test.ts
server/src/__tests__/run-liveness.test.ts
server/src/__tests__/activity-service.test.ts
server/src/__tests__/documents-service.test.ts
server/src/__tests__/issue-continuation-summary.test.ts
server/src/services/heartbeat-stop-metadata.test.ts
ui/src/components/IssueRunLedger.test.tsx
ui/src/components/IssueContinuationHandoff.test.tsx
ui/src/components/IssueDocumentsSection.test.tsx`
- `pnpm --filter @paperclipai/db build`
- `pnpm exec vitest run server/src/__tests__/activity-service.test.ts
ui/src/components/IssueRunLedger.test.tsx`
- `pnpm --filter @paperclipai/ui typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- `pnpm exec vitest run server/src/__tests__/activity-service.test.ts
server/src/__tests__/run-continuations.test.ts
ui/src/components/IssueRunLedger.test.tsx`
- `pnpm exec vitest run
server/src/__tests__/heartbeat-process-recovery.test.ts -t "treats a
plan document update"`
- `pnpm exec vitest run server/src/__tests__/activity-service.test.ts
server/src/__tests__/heartbeat-process-recovery.test.ts -t "activity
service|treats a plan document update"`
- Remote PR checks on head `e53b1a1d`: `verify`, `e2e`, `policy`, and
Snyk all passed.
- Confirmed `public-gh/master` is an ancestor of this branch after
fetching `public-gh master`.
- Confirmed `pnpm-lock.yaml` is not included in the branch diff.
- Confirmed migration `0058_wealthy_starbolt.sql` is ordered after
`0057` and uses `IF NOT EXISTS` guards for repeat application.
- Greptile inline review threads are resolved.
## Risks
- Medium risk: this touches heartbeat execution, liveness recovery,
activity rendering, issue routes, shared contracts, docs, and UI.
- Migration risk is mitigated by additive columns/indexes and idempotent
guards.
- Run-ledger liveness backfill is now asynchronous, so the first ledger
response can briefly show historical missing liveness until the
background backfill completes.
- UI screenshot coverage is not included in this packaging pass;
validation is currently through focused component tests.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
## Model Used
- OpenAI Codex, GPT-5.4, local tool-use coding agent with terminal, git,
GitHub connector, GitHub CLI, and Paperclip API access.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
Screenshot note: no before/after screenshots were captured in this PR
packaging pass; the UI changes are covered by focused component tests
listed above.
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-20 06:01:49 -05:00
DEFAULT_PAPERCLIP_AGENT_PROMPT_TEMPLATE ,
2026-03-05 06:31:22 -06:00
) ;
const command = asString ( config . command , "agent" ) ;
const model = asString ( config . model , DEFAULT_CURSOR_LOCAL_MODEL ) . trim ( ) ;
2026-03-05 09:27:20 -06:00
const mode = normalizeMode ( asString ( config . mode , "" ) ) ;
2026-03-05 06:31:22 -06:00
const workspaceContext = parseObject ( context . paperclipWorkspace ) ;
const workspaceCwd = asString ( workspaceContext . cwd , "" ) ;
const workspaceSource = asString ( workspaceContext . source , "" ) ;
const workspaceId = asString ( workspaceContext . workspaceId , "" ) ;
const workspaceRepoUrl = asString ( workspaceContext . repoUrl , "" ) ;
const workspaceRepoRef = asString ( workspaceContext . repoRef , "" ) ;
2026-03-14 00:36:53 -07:00
const agentHome = asString ( workspaceContext . agentHome , "" ) ;
2026-03-05 06:31:22 -06:00
const workspaceHints = Array . isArray ( context . paperclipWorkspaces )
? context . paperclipWorkspaces . filter (
( value ) : value is Record < string , unknown > = > typeof value === "object" && value !== null ,
)
: [ ] ;
const configuredCwd = asString ( config . cwd , "" ) ;
const useConfiguredInsteadOfAgentHome = workspaceSource === "agent_home" && configuredCwd . length > 0 ;
const effectiveWorkspaceCwd = useConfiguredInsteadOfAgentHome ? "" : workspaceCwd ;
const cwd = effectiveWorkspaceCwd || configuredCwd || process . cwd ( ) ;
await ensureAbsoluteDirectory ( cwd , { createIfMissing : true } ) ;
2026-03-15 07:05:01 -05:00
const cursorSkillEntries = await readPaperclipRuntimeSkillEntries ( config , __moduleDir ) ;
const desiredCursorSkillNames = resolvePaperclipDesiredSkillNames ( config , cursorSkillEntries ) ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
if ( ! executionTargetIsRemote ) {
await ensureCursorSkillsInjected ( onLog , {
skillsEntries : cursorSkillEntries.filter ( ( entry ) = > desiredCursorSkillNames . includes ( entry . key ) ) ,
} ) ;
}
2026-03-05 06:31:22 -06:00
const envConfig = parseObject ( config . env ) ;
const hasExplicitApiKey =
typeof envConfig . PAPERCLIP_API_KEY === "string" && envConfig . PAPERCLIP_API_KEY . trim ( ) . length > 0 ;
const env : Record < string , string > = { . . . buildPaperclipEnv ( agent ) } ;
env . PAPERCLIP_RUN_ID = runId ;
const wakeTaskId =
( typeof context . taskId === "string" && context . taskId . trim ( ) . length > 0 && context . taskId . trim ( ) ) ||
( typeof context . issueId === "string" && context . issueId . trim ( ) . length > 0 && context . issueId . trim ( ) ) ||
null ;
const wakeReason =
typeof context . wakeReason === "string" && context . wakeReason . trim ( ) . length > 0
? context . wakeReason . trim ( )
: null ;
const wakeCommentId =
( typeof context . wakeCommentId === "string" && context . wakeCommentId . trim ( ) . length > 0 && context . wakeCommentId . trim ( ) ) ||
( typeof context . commentId === "string" && context . commentId . trim ( ) . length > 0 && context . commentId . trim ( ) ) ||
null ;
const approvalId =
typeof context . approvalId === "string" && context . approvalId . trim ( ) . length > 0
? context . approvalId . trim ( )
: null ;
const approvalStatus =
typeof context . approvalStatus === "string" && context . approvalStatus . trim ( ) . length > 0
? context . approvalStatus . trim ( )
: null ;
const linkedIssueIds = Array . isArray ( context . issueIds )
? context . issueIds . filter ( ( value ) : value is string = > typeof value === "string" && value . trim ( ) . length > 0 )
: [ ] ;
2026-03-28 09:55:41 -05:00
const wakePayloadJson = stringifyPaperclipWakePayload ( context . paperclipWake ) ;
2026-03-05 06:31:22 -06:00
if ( wakeTaskId ) {
env . PAPERCLIP_TASK_ID = wakeTaskId ;
}
if ( wakeReason ) {
env . PAPERCLIP_WAKE_REASON = wakeReason ;
}
if ( wakeCommentId ) {
env . PAPERCLIP_WAKE_COMMENT_ID = wakeCommentId ;
}
if ( approvalId ) {
env . PAPERCLIP_APPROVAL_ID = approvalId ;
}
if ( approvalStatus ) {
env . PAPERCLIP_APPROVAL_STATUS = approvalStatus ;
}
if ( linkedIssueIds . length > 0 ) {
env . PAPERCLIP_LINKED_ISSUE_IDS = linkedIssueIds . join ( "," ) ;
}
2026-03-28 09:55:41 -05:00
if ( wakePayloadJson ) {
env . PAPERCLIP_WAKE_PAYLOAD_JSON = wakePayloadJson ;
}
Fix CEO AGENT_HOME paths and centralize workspace env propagation (#4551)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies.
> - The local adapter layer is responsible for turning Paperclip runtime
context into the environment seen by the child agent process.
> - The CEO onboarding bundle tells the agent where to read and write
its persistent memory and fact files.
> - That bundle was using `./memory/...` and `./life/...`, which only
works when the process cwd happens to equal the agent home directory.
> - At the same time, six local adapters each duplicated the same
workspace-env propagation logic, including `AGENT_HOME`, which makes
this contract easy to drift.
> - This pull request fixes the CEO instructions to use
`$AGENT_HOME/...` and centralizes workspace-env propagation in one
shared helper with shared tests.
> - The benefit is a real bug fix for agent memory paths plus a single
tested contract that makes future built-in adapter work less likely to
forget `AGENT_HOME`.
## What Changed
- Updated `server/src/onboarding-assets/ceo/HEARTBEAT.md` to use
`$AGENT_HOME/memory/...` and `$AGENT_HOME/life/...` instead of
cwd-relative `./memory/...` and `./life/...`.
- Added `applyPaperclipWorkspaceEnv(...)` in
`packages/adapter-utils/src/server-utils.ts` to centralize
`PAPERCLIP_WORKSPACE_*` and `AGENT_HOME` propagation.
- Added shared helper coverage in
`packages/adapter-utils/src/server-utils.test.ts` for both populated and
skip-empty cases.
- Switched the built-in local adapters (`claude_local`, `codex_local`,
`cursor_local`, `gemini_local`, `opencode_local`, `pi_local`) over to
the shared helper instead of inline env assignment blocks.
## Verification
- `pnpm install`
- `pnpm exec vitest run packages/adapter-utils/src/server-utils.test.ts
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/codex-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- Result: 7 test files passed, 31 tests passed, 0 failures.
## Risks
- Low risk.
- The only behavioral surface is the shared env propagation refactor
across six adapters; if the helper diverged from prior semantics, an
adapter could miss a workspace env var.
- The shared helper test plus the affected adapter execute tests reduce
that risk, and the helper preserves the prior "set only non-empty
strings" behavior.
## Model Used
- OpenAI Codex via Paperclip `codex_local` agent runtime; tool-assisted
coding workflow with shell execution, file patching, git operations, and
API interaction. The exact backend model identifier and context window
are not surfaced by this local runtime.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-26 13:57:35 -07:00
applyPaperclipWorkspaceEnv ( env , {
workspaceCwd : effectiveWorkspaceCwd ,
workspaceSource ,
workspaceId ,
workspaceRepoUrl ,
workspaceRepoRef ,
agentHome ,
} ) ;
2026-03-05 06:31:22 -06:00
if ( workspaceHints . length > 0 ) {
env . PAPERCLIP_WORKSPACES_JSON = JSON . stringify ( workspaceHints ) ;
}
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
const targetPaperclipApiUrl = adapterExecutionTargetPaperclipApiUrl ( executionTarget ) ;
if ( targetPaperclipApiUrl ) {
env . PAPERCLIP_API_URL = targetPaperclipApiUrl ;
}
2026-03-05 06:31:22 -06:00
for ( const [ k , v ] of Object . entries ( envConfig ) ) {
if ( typeof v === "string" ) env [ k ] = v ;
}
if ( ! hasExplicitApiKey && authToken ) {
env . PAPERCLIP_API_KEY = authToken ;
}
2026-03-14 22:00:12 -05:00
const effectiveEnv = Object . fromEntries (
Object . entries ( { . . . process . env , . . . env } ) . filter (
( entry ) : entry is [ string , string ] = > typeof entry [ 1 ] === "string" ,
) ,
) ;
const billingType = resolveCursorBillingType ( effectiveEnv ) ;
const runtimeEnv = ensurePathInEnv ( effectiveEnv ) ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
await ensureAdapterExecutionTargetCommandResolvable ( command , executionTarget , cwd , runtimeEnv ) ;
const resolvedCommand = await resolveAdapterExecutionTargetCommandForLogs ( command , executionTarget , cwd , runtimeEnv ) ;
2026-03-28 15:42:14 -05:00
const loggedEnv = buildInvocationEnvForLogs ( env , {
runtimeEnv ,
includeRuntimeKeys : [ "HOME" ] ,
resolvedCommand ,
} ) ;
2026-03-05 06:31:22 -06:00
const timeoutSec = asNumber ( config . timeoutSec , 0 ) ;
const graceSec = asNumber ( config . graceSec , 20 ) ;
const extraArgs = ( ( ) = > {
const fromExtraArgs = asStringArray ( config . extraArgs ) ;
if ( fromExtraArgs . length > 0 ) return fromExtraArgs ;
return asStringArray ( config . args ) ;
} ) ( ) ;
2026-03-05 08:28:12 -06:00
const autoTrustEnabled = ! hasCursorTrustBypassArg ( extraArgs ) ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
const effectiveExecutionCwd = adapterExecutionTargetRemoteCwd ( executionTarget , cwd ) ;
let restoreRemoteWorkspace : ( ( ) = > Promise < void > ) | null = null ;
let localSkillsDir : string | null = null ;
if ( executionTargetIsRemote ) {
try {
localSkillsDir = await buildCursorSkillsDir ( config ) ;
await onLog (
"stdout" ,
` [paperclip] Syncing workspace and Cursor runtime assets to ${ describeAdapterExecutionTarget ( executionTarget ) } . \ n ` ,
) ;
const preparedExecutionTargetRuntime = await prepareAdapterExecutionTargetRuntime ( {
target : executionTarget ,
adapterKey : "cursor" ,
workspaceLocalDir : cwd ,
assets : [ {
key : "skills" ,
localDir : localSkillsDir ,
followSymlinks : true ,
} ] ,
} ) ;
restoreRemoteWorkspace = ( ) = > preparedExecutionTargetRuntime . restoreWorkspace ( ) ;
const managedHome = adapterExecutionTargetUsesManagedHome ( executionTarget ) ;
if ( managedHome && preparedExecutionTargetRuntime . runtimeRootDir ) {
env . HOME = preparedExecutionTargetRuntime . runtimeRootDir ;
}
const remoteHomeDir = managedHome && preparedExecutionTargetRuntime . runtimeRootDir
? preparedExecutionTargetRuntime . runtimeRootDir
: await readAdapterExecutionTargetHomeDir ( runId , executionTarget , {
cwd ,
env ,
timeoutSec ,
graceSec ,
onLog ,
} ) ;
if ( remoteHomeDir && preparedExecutionTargetRuntime . assetDirs . skills ) {
const remoteSkillsDir = path . posix . join ( remoteHomeDir , ".cursor" , "skills" ) ;
await runAdapterExecutionTargetShellCommand (
runId ,
executionTarget ,
` mkdir -p ${ JSON . stringify ( path . posix . dirname ( remoteSkillsDir ) ) } && rm -rf ${ JSON . stringify ( remoteSkillsDir ) } && cp -a ${ JSON . stringify ( preparedExecutionTargetRuntime . assetDirs . skills ) } ${ JSON . stringify ( remoteSkillsDir ) } ` ,
{ cwd , env , timeoutSec , graceSec , onLog } ,
) ;
}
} catch ( error ) {
await Promise . allSettled ( [
restoreRemoteWorkspace ? . ( ) ,
localSkillsDir ? fs . rm ( localSkillsDir , { recursive : true , force : true } ) . catch ( ( ) = > undefined ) : Promise . resolve ( ) ,
] ) ;
throw error ;
}
}
2026-03-05 06:31:22 -06:00
const runtimeSessionParams = parseObject ( runtime . sessionParams ) ;
const runtimeSessionId = asString ( runtimeSessionParams . sessionId , runtime . sessionId ? ? "" ) ;
const runtimeSessionCwd = asString ( runtimeSessionParams . cwd , "" ) ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
const runtimeRemoteExecution = parseObject ( runtimeSessionParams . remoteExecution ) ;
2026-03-05 06:31:22 -06:00
const canResumeSession =
runtimeSessionId . length > 0 &&
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
( runtimeSessionCwd . length === 0 || path . resolve ( runtimeSessionCwd ) === path . resolve ( effectiveExecutionCwd ) ) &&
adapterExecutionTargetSessionMatches ( runtimeRemoteExecution , executionTarget ) ;
2026-03-05 06:31:22 -06:00
const sessionId = canResumeSession ? runtimeSessionId : null ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
if ( executionTargetIsRemote && runtimeSessionId && ! canResumeSession ) {
2026-03-05 06:31:22 -06:00
await onLog (
2026-03-18 21:16:37 -05:00
"stdout" ,
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
` [paperclip] Cursor session " ${ runtimeSessionId } " does not match the current remote execution identity and will not be resumed in " ${ effectiveExecutionCwd } ". Starting a fresh remote session. \ n ` ,
) ;
} else if ( runtimeSessionId && ! canResumeSession ) {
await onLog (
"stdout" ,
` [paperclip] Cursor session " ${ runtimeSessionId } " was saved for cwd " ${ runtimeSessionCwd } " and will not be resumed in " ${ effectiveExecutionCwd } ". \ n ` ,
2026-03-05 06:31:22 -06:00
) ;
}
const instructionsFilePath = asString ( config . instructionsFilePath , "" ) . trim ( ) ;
const instructionsDir = instructionsFilePath ? ` ${ path . dirname ( instructionsFilePath ) } / ` : "" ;
let instructionsPrefix = "" ;
2026-03-13 08:49:11 -05:00
let instructionsChars = 0 ;
2026-03-05 06:31:22 -06:00
if ( instructionsFilePath ) {
try {
const instructionsContents = await fs . readFile ( instructionsFilePath , "utf8" ) ;
instructionsPrefix =
` ${ instructionsContents } \ n \ n ` +
` The above agent instructions were loaded from ${ instructionsFilePath } . ` +
` Resolve any relative file references from ${ instructionsDir } . \ n \ n ` ;
2026-03-13 08:49:11 -05:00
instructionsChars = instructionsPrefix . length ;
2026-03-05 06:31:22 -06:00
} catch ( err ) {
const reason = err instanceof Error ? err.message : String ( err ) ;
await onLog (
2026-03-18 21:16:37 -05:00
"stdout" ,
2026-03-05 06:31:22 -06:00
` [paperclip] Warning: could not read agent instructions file " ${ instructionsFilePath } ": ${ reason } \ n ` ,
) ;
}
}
const commandNotes = ( ( ) = > {
2026-03-05 08:28:12 -06:00
const notes : string [ ] = [ ] ;
if ( autoTrustEnabled ) {
2026-03-05 10:00:22 -06:00
notes . push ( "Auto-added --yolo to bypass interactive prompts." ) ;
2026-03-05 08:28:12 -06:00
}
2026-03-05 09:35:43 -06:00
notes . push ( "Prompt is piped to Cursor via stdin." ) ;
2026-03-05 08:28:12 -06:00
if ( ! instructionsFilePath ) return notes ;
2026-03-05 06:31:22 -06:00
if ( instructionsPrefix . length > 0 ) {
2026-03-05 08:28:12 -06:00
notes . push (
2026-03-05 06:31:22 -06:00
` Loaded agent instructions from ${ instructionsFilePath } ` ,
` Prepended instructions + path directive to prompt (relative references from ${ instructionsDir } ). ` ,
2026-03-05 08:28:12 -06:00
) ;
return notes ;
2026-03-05 06:31:22 -06:00
}
2026-03-05 08:28:12 -06:00
notes . push (
2026-03-05 06:31:22 -06:00
` Configured instructionsFilePath ${ instructionsFilePath } , but file could not be read; continuing without injected instructions. ` ,
2026-03-05 08:28:12 -06:00
) ;
return notes ;
2026-03-05 06:31:22 -06:00
} ) ( ) ;
2026-03-13 08:49:11 -05:00
const bootstrapPromptTemplate = asString ( config . bootstrapPromptTemplate , "" ) ;
const templateData = {
2026-03-05 06:31:22 -06:00
agentId : agent.id ,
companyId : agent.companyId ,
runId ,
company : { id : agent.companyId } ,
agent ,
run : { id : runId , source : "on_demand" } ,
context ,
2026-03-13 08:49:11 -05:00
} ;
const renderedBootstrapPrompt =
! sessionId && bootstrapPromptTemplate . trim ( ) . length > 0
? renderTemplate ( bootstrapPromptTemplate , templateData ) . trim ( )
: "" ;
2026-03-28 10:33:40 -05:00
const wakePrompt = renderPaperclipWakePrompt ( context . paperclipWake , { resumedSession : Boolean ( sessionId ) } ) ;
const shouldUseResumeDeltaPrompt = Boolean ( sessionId ) && wakePrompt . length > 0 ;
const renderedPrompt = shouldUseResumeDeltaPrompt ? "" : renderTemplate ( promptTemplate , templateData ) ;
2026-03-13 08:49:11 -05:00
const sessionHandoffNote = asString ( context . paperclipSessionHandoffMarkdown , "" ) . trim ( ) ;
2026-03-05 09:12:13 -06:00
const paperclipEnvNote = renderPaperclipEnvNote ( env ) ;
2026-03-13 08:49:11 -05:00
const prompt = joinPromptSections ( [
instructionsPrefix ,
renderedBootstrapPrompt ,
2026-03-28 09:55:41 -05:00
wakePrompt ,
2026-03-13 08:49:11 -05:00
sessionHandoffNote ,
paperclipEnvNote ,
renderedPrompt ,
] ) ;
const promptMetrics = {
promptChars : prompt.length ,
instructionsChars ,
bootstrapPromptChars : renderedBootstrapPrompt.length ,
2026-03-28 09:55:41 -05:00
wakePromptChars : wakePrompt.length ,
2026-03-13 08:49:11 -05:00
sessionHandoffChars : sessionHandoffNote.length ,
runtimeNoteChars : paperclipEnvNote.length ,
heartbeatPromptChars : renderedPrompt.length ,
} ;
2026-03-05 06:31:22 -06:00
const buildArgs = ( resumeSessionId : string | null ) = > {
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
const args = [ "-p" , "--output-format" , "stream-json" , "--workspace" , effectiveExecutionCwd ] ;
2026-03-05 06:31:22 -06:00
if ( resumeSessionId ) args . push ( "--resume" , resumeSessionId ) ;
if ( model ) args . push ( "--model" , model ) ;
if ( mode ) args . push ( "--mode" , mode ) ;
2026-03-05 10:00:22 -06:00
if ( autoTrustEnabled ) args . push ( "--yolo" ) ;
2026-03-05 06:31:22 -06:00
if ( extraArgs . length > 0 ) args . push ( . . . extraArgs ) ;
return args ;
} ;
const runAttempt = async ( resumeSessionId : string | null ) = > {
const args = buildArgs ( resumeSessionId ) ;
if ( onMeta ) {
await onMeta ( {
adapterType : "cursor" ,
2026-03-28 15:42:14 -05:00
command : resolvedCommand ,
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
cwd : effectiveExecutionCwd ,
2026-03-05 06:31:22 -06:00
commandNotes ,
2026-03-05 09:35:43 -06:00
commandArgs : args ,
2026-03-28 15:42:14 -05:00
env : loggedEnv ,
2026-03-05 06:31:22 -06:00
prompt ,
2026-03-13 08:49:11 -05:00
promptMetrics ,
2026-03-05 06:31:22 -06:00
context ,
} ) ;
}
2026-03-05 08:07:20 -06:00
let stdoutLineBuffer = "" ;
const emitNormalizedStdoutLine = async ( rawLine : string ) = > {
const normalized = normalizeCursorStreamLine ( rawLine ) ;
if ( ! normalized . line ) return ;
await onLog ( normalized . stream ? ? "stdout" , ` ${ normalized . line } \ n ` ) ;
} ;
const flushStdoutChunk = async ( chunk : string , finalize = false ) = > {
const combined = ` ${ stdoutLineBuffer } ${ chunk } ` ;
const lines = combined . split ( /\r?\n/ ) ;
stdoutLineBuffer = lines . pop ( ) ? ? "" ;
for ( const line of lines ) {
await emitNormalizedStdoutLine ( line ) ;
}
if ( finalize ) {
const trailing = stdoutLineBuffer . trim ( ) ;
stdoutLineBuffer = "" ;
if ( trailing ) {
await emitNormalizedStdoutLine ( trailing ) ;
}
}
} ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
const proc = await runAdapterExecutionTargetProcess ( runId , executionTarget , command , args , {
2026-03-05 06:31:22 -06:00
cwd ,
env ,
timeoutSec ,
graceSec ,
2026-03-05 09:35:43 -06:00
stdin : prompt ,
2026-03-19 11:20:36 -05:00
onSpawn ,
2026-03-05 08:07:20 -06:00
onLog : async ( stream , chunk ) = > {
if ( stream !== "stdout" ) {
await onLog ( stream , chunk ) ;
return ;
}
await flushStdoutChunk ( chunk ) ;
} ,
2026-03-05 06:31:22 -06:00
} ) ;
2026-03-05 08:07:20 -06:00
await flushStdoutChunk ( "" , true ) ;
2026-03-05 06:31:22 -06:00
return {
proc ,
parsed : parseCursorJsonl ( proc . stdout ) ,
} ;
} ;
const providerFromModel = resolveProviderFromModel ( model ) ;
const toResult = (
attempt : {
proc : {
exitCode : number | null ;
signal : string | null ;
timedOut : boolean ;
stdout : string ;
stderr : string ;
} ;
parsed : ReturnType < typeof parseCursorJsonl > ;
} ,
clearSessionOnMissingSession = false ,
) : AdapterExecutionResult = > {
if ( attempt . proc . timedOut ) {
return {
exitCode : attempt.proc.exitCode ,
signal : attempt.proc.signal ,
timedOut : true ,
errorMessage : ` Timed out after ${ timeoutSec } s ` ,
clearSession : clearSessionOnMissingSession ,
} ;
}
const resolvedSessionId = attempt . parsed . sessionId ? ? runtimeSessionId ? ? runtime . sessionId ? ? null ;
const resolvedSessionParams = resolvedSessionId
? ( {
sessionId : resolvedSessionId ,
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
cwd : effectiveExecutionCwd ,
2026-03-05 06:31:22 -06:00
. . . ( workspaceId ? { workspaceId } : { } ) ,
. . . ( workspaceRepoUrl ? { repoUrl : workspaceRepoUrl } : { } ) ,
. . . ( workspaceRepoRef ? { repoRef : workspaceRepoRef } : { } ) ,
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
. . . ( executionTargetIsRemote
? {
remoteExecution : adapterExecutionTargetSessionIdentity ( executionTarget ) ,
}
: { } ) ,
2026-03-05 06:31:22 -06:00
} as Record < string , unknown > )
: null ;
const parsedError = typeof attempt . parsed . errorMessage === "string" ? attempt . parsed . errorMessage . trim ( ) : "" ;
const stderrLine = firstNonEmptyLine ( attempt . proc . stderr ) ;
const fallbackErrorMessage =
parsedError ||
stderrLine ||
` Cursor exited with code ${ attempt . proc . exitCode ? ? - 1 } ` ;
return {
exitCode : attempt.proc.exitCode ,
signal : attempt.proc.signal ,
timedOut : false ,
errorMessage :
( attempt . proc . exitCode ? ? 0 ) === 0
? null
: fallbackErrorMessage ,
usage : attempt.parsed.usage ,
sessionId : resolvedSessionId ,
sessionParams : resolvedSessionParams ,
sessionDisplayId : resolvedSessionId ,
provider : providerFromModel ,
2026-03-14 22:00:12 -05:00
biller : resolveCursorBiller ( effectiveEnv , billingType , providerFromModel ) ,
2026-03-05 06:31:22 -06:00
model ,
billingType ,
costUsd : attempt.parsed.costUsd ,
resultJson : {
stdout : attempt.proc.stdout ,
stderr : attempt.proc.stderr ,
} ,
summary : attempt.parsed.summary ,
clearSession : Boolean ( clearSessionOnMissingSession && ! resolvedSessionId ) ,
} ;
} ;
Add SSH environment support (#4358)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The environments subsystem already models execution environments,
but before this branch there was no end-to-end SSH-backed runtime path
for agents to actually run work against a remote box
> - That meant agents could be configured around environment concepts
without a reliable way to execute adapter sessions remotely, sync
workspace state, and preserve run context across supported adapters
> - We also need environment selection to participate in normal
Paperclip control-plane behavior: agent defaults, project/issue
selection, route validation, and environment probing
> - Because this capability is still experimental, the UI surface should
be easy to hide and easy to remove later without undoing the underlying
implementation
> - This pull request adds SSH environment execution support across the
runtime, adapters, routes, schema, and tests, then puts the visible
environment-management UI behind an experimental flag
> - The benefit is that we can validate real SSH-backed agent execution
now while keeping the user-facing controls safely gated until the
feature is ready to come out of experimentation
## What Changed
- Added SSH-backed execution target support in the shared adapter
runtime, including remote workspace preparation, skill/runtime asset
sync, remote session handling, and workspace restore behavior after
runs.
- Added SSH execution coverage for supported local adapters, plus remote
execution tests across Claude, Codex, Cursor, Gemini, OpenCode, and Pi.
- Added environment selection and environment-management backend support
needed for SSH execution, including route/service work, validation,
probing, and agent default environment persistence.
- Added CLI support for SSH environment lab verification and updated
related docs/tests.
- Added the `enableEnvironments` experimental flag and gated the
environment UI behind it on company settings, agent configuration, and
project configuration surfaces.
## Verification
- `pnpm exec vitest run
packages/adapters/claude-local/src/server/execute.remote.test.ts
packages/adapters/cursor-local/src/server/execute.remote.test.ts
packages/adapters/gemini-local/src/server/execute.remote.test.ts
packages/adapters/opencode-local/src/server/execute.remote.test.ts
packages/adapters/pi-local/src/server/execute.remote.test.ts`
- `pnpm exec vitest run server/src/__tests__/environment-routes.test.ts`
- `pnpm exec vitest run
server/src/__tests__/instance-settings-routes.test.ts`
- `pnpm exec vitest run ui/src/lib/new-agent-hire-payload.test.ts
ui/src/lib/new-agent-runtime-config.test.ts`
- `pnpm -r typecheck`
- `pnpm build`
- Manual verification on a branch-local dev server:
- enabled the experimental flag
- created an SSH environment
- created a Linux Claude agent using that environment
- confirmed a run executed on the Linux box and synced workspace changes
back
## Risks
- Medium: this touches runtime execution flow across multiple adapters,
so regressions would likely show up in remote session setup, workspace
sync, or environment selection precedence.
- The UI flag reduces exposure, but the underlying runtime and route
changes are still substantial and rely on migration correctness.
- The change set is broad across adapters, control-plane services,
migrations, and UI gating, so review should pay close attention to
environment-selection precedence and remote workspace lifecycle
behavior.
## Model Used
- OpenAI Codex via Paperclip's local Codex adapter, GPT-5-class coding
model with tool use and code execution in the local repo workspace. The
local adapter does not surface a more specific public model version
string in this branch workflow.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-23 19:15:22 -07:00
try {
const initial = await runAttempt ( sessionId ) ;
if (
sessionId &&
! initial . proc . timedOut &&
( initial . proc . exitCode ? ? 0 ) !== 0 &&
isCursorUnknownSessionError ( initial . proc . stdout , initial . proc . stderr )
) {
await onLog (
"stdout" ,
` [paperclip] Cursor resume session " ${ sessionId } " is unavailable; retrying with a fresh session. \ n ` ,
) ;
const retry = await runAttempt ( null ) ;
return toResult ( retry , true ) ;
}
return toResult ( initial ) ;
} finally {
if ( restoreRemoteWorkspace ) {
await onLog (
"stdout" ,
` [paperclip] Restoring workspace changes from ${ describeAdapterExecutionTarget ( executionTarget ) } . \ n ` ,
) ;
await restoreRemoteWorkspace ( ) ;
}
if ( localSkillsDir ) {
await fs . rm ( localSkillsDir , { recursive : true , force : true } ) . catch ( ( ) = > undefined ) ;
}
2026-03-05 06:31:22 -06:00
}
}