feat: implement multi-user access and invite flows (#3784)

## Thinking Path

> - Paperclip is the control plane for autonomous AI companies.
> - V1 needs to stay local-first while also supporting shared,
authenticated deployments.
> - Human operators need real identities, company membership, invite
flows, profile surfaces, and company-scoped access controls.
> - Agents and operators also need the existing issue, inbox, workspace,
approval, and plugin flows to keep working under those authenticated
boundaries.
> - This branch accumulated the multi-user implementation, follow-up QA
fixes, workspace/runtime refinements, invite UX improvements,
release-branch conflict resolution, and review hardening.
> - This pull request consolidates that branch onto the current `master`
branch as a single reviewable PR.
> - The benefit is a complete multi-user implementation path with tests
and docs carried forward without dropping existing branch work.

## What Changed

- Added authenticated human-user access surfaces: auth/session routes,
company user directory, profile settings, company access/member
management, join requests, and invite management.
- Added invite creation, invite landing, onboarding, logo/branding,
invite grants, deduped join requests, and authenticated multi-user E2E
coverage.
- Tightened company-scoped and instance-admin authorization across
board, plugin, adapter, access, issue, and workspace routes.
- Added profile-image URL validation hardening, avatar preservation on
name-only profile updates, and join-request uniqueness migration cleanup
for pending human requests.
- Added an atomic member role/status/grants update path so Company
Access saves no longer leave partially updated permissions.
- Improved issue chat, inbox, assignee identity rendering,
sidebar/account/company navigation, workspace routing, and execution
workspace reuse behavior for multi-user operation.
- Added and updated server/UI tests covering auth, invites, membership,
issue workspace inheritance, plugin authz, inbox/chat behavior, and
multi-user flows.
- Merged current `public-gh/master` into this branch, resolved all
conflicts, and verified no `pnpm-lock.yaml` change is included in this
PR diff.

## Verification

- `pnpm exec vitest run server/src/__tests__/issues-service.test.ts
ui/src/components/IssueChatThread.test.tsx ui/src/pages/Inbox.test.tsx`
- `pnpm run preflight:workspace-links && pnpm exec vitest run
server/src/__tests__/plugin-routes-authz.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/workspace-runtime-service-authz.test.ts
server/src/__tests__/access-validators.test.ts`
- `pnpm exec vitest run
server/src/__tests__/authz-company-access.test.ts
server/src/__tests__/routines-routes.test.ts
server/src/__tests__/sidebar-preferences-routes.test.ts
server/src/__tests__/approval-routes-idempotency.test.ts
server/src/__tests__/openclaw-invite-prompt-route.test.ts
server/src/__tests__/agent-cross-tenant-authz-routes.test.ts
server/src/__tests__/routines-e2e.test.ts`
- `pnpm exec vitest run server/src/__tests__/auth-routes.test.ts
ui/src/pages/CompanyAccess.test.tsx`
- `pnpm --filter @paperclipai/shared typecheck && pnpm --filter
@paperclipai/db typecheck && pnpm --filter @paperclipai/server
typecheck`
- `pnpm --filter @paperclipai/shared typecheck && pnpm --filter
@paperclipai/server typecheck`
- `pnpm --filter @paperclipai/ui typecheck`
- `pnpm db:generate`
- `npx playwright test --config tests/e2e/playwright.config.ts --list`
- Confirmed branch has no uncommitted changes and is `0` commits behind
`public-gh/master` before PR creation.
- Confirmed no `pnpm-lock.yaml` change is staged or present in the PR
diff.

## Risks

- High review surface area: this PR contains the accumulated multi-user
branch plus follow-up fixes, so reviewers should focus especially on
company-boundary enforcement and authenticated-vs-local deployment
behavior.
- UI behavior changed across invites, inbox, issue chat, access
settings, and sidebar navigation; no browser screenshots are included in
this branch-consolidation PR.
- Plugin install, upgrade, and lifecycle/config mutations now require
instance-admin access, which is intentional but may change expectations
for non-admin board users.
- A join-request dedupe migration rejects duplicate pending human
requests before creating unique indexes; deployments with unusual
historical duplicates should review the migration behavior.
- Company member role/status/grant saves now use a new combined
endpoint; older separate endpoints remain for compatibility.
- Full production build was not run locally in this heartbeat; CI should
cover the full matrix.

## Model Used

- OpenAI Codex coding agent, GPT-5-based model, CLI/tool-use
environment. Exact deployed model identifier and context window were not
exposed by the runtime.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

Note on screenshots: this is a branch-consolidation PR for an
already-developed multi-user branch, and no browser screenshots were
captured during this heartbeat.

---------

Co-authored-by: dotta <dotta@example.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dotta 2026-04-17 09:44:19 -05:00 committed by GitHub
parent e93e418cbf
commit b9a80dcf22
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
150 changed files with 26872 additions and 1289 deletions

View file

@ -1,4 +1,5 @@
import type { Agent } from "@paperclipai/shared";
import type { CompanyUserProfile } from "./company-members";
type ActivityDetails = Record<string, unknown> | null | undefined;
@ -16,6 +17,7 @@ type ActivityIssueReference = {
interface ActivityFormatOptions {
agentMap?: Map<string, Agent>;
userProfileMap?: Map<string, CompanyUserProfile>;
currentUserId?: string | null;
}
@ -118,9 +120,11 @@ function readIssueReferences(details: ActivityDetails, key: string): ActivityIss
return value.filter(isActivityIssueReference);
}
function formatUserLabel(userId: string | null | undefined, currentUserId?: string | null): string {
function formatUserLabel(userId: string | null | undefined, options: ActivityFormatOptions = {}): string {
if (!userId || userId === "local-board") return "Board";
if (currentUserId && userId === currentUserId) return "You";
if (options.currentUserId && userId === options.currentUserId) return "You";
const profile = options.userProfileMap?.get(userId);
if (profile) return profile.label;
return `user ${userId.slice(0, 5)}`;
}
@ -129,7 +133,7 @@ function formatParticipantLabel(participant: ActivityParticipant, options: Activ
const agentId = participant.agentId ?? "";
return options.agentMap?.get(agentId)?.name ?? "agent";
}
return formatUserLabel(participant.userId, options.currentUserId);
return formatUserLabel(participant.userId, options);
}
function formatIssueReferenceLabel(reference: ActivityIssueReference): string {
@ -167,7 +171,20 @@ function formatIssueUpdatedVerb(details: ActivityDetails): string | null {
return null;
}
function formatIssueUpdatedAction(details: ActivityDetails): string | null {
function formatAssigneeName(details: ActivityDetails, options: ActivityFormatOptions): string | null {
if (!details) return null;
const agentId = details.assigneeAgentId;
const userId = details.assigneeUserId;
if (typeof agentId === "string" && agentId) {
return options.agentMap?.get(agentId)?.name ?? "agent";
}
if (typeof userId === "string" && userId) {
return formatUserLabel(userId, options);
}
return null;
}
function formatIssueUpdatedAction(details: ActivityDetails, options: ActivityFormatOptions = {}): string | null {
if (!details) return null;
const previous = asRecord(details._previous) ?? {};
const parts: string[] = [];
@ -189,7 +206,8 @@ function formatIssueUpdatedAction(details: ActivityDetails): string | null {
);
}
if (details.assigneeAgentId !== undefined || details.assigneeUserId !== undefined) {
parts.push(details.assigneeAgentId || details.assigneeUserId ? "assigned the issue" : "unassigned the issue");
const assigneeName = formatAssigneeName(details, options);
parts.push(assigneeName ? `assigned the issue to ${assigneeName}` : "unassigned the issue");
}
if (details.title !== undefined) parts.push("updated the title");
if (details.description !== undefined) parts.push("updated the description");
@ -266,7 +284,7 @@ export function formatIssueActivityAction(
options: ActivityFormatOptions = {},
): string {
if (action === "issue.updated") {
const issueUpdatedAction = formatIssueUpdatedAction(details);
const issueUpdatedAction = formatIssueUpdatedAction(details, options);
if (issueUpdatedAction) return issueUpdatedAction;
}

View file

@ -74,9 +74,16 @@ export function currentUserAssigneeOption(currentUserId: string | null | undefin
export function formatAssigneeUserLabel(
userId: string | null | undefined,
currentUserId: string | null | undefined,
userLabels?: ReadonlyMap<string, string> | Record<string, string> | null,
): string | null {
if (!userId) return null;
if (currentUserId && userId === currentUserId) return "You";
if (userLabels) {
const label = userLabels instanceof Map
? userLabels.get(userId)
: (userLabels as Record<string, string>)[userId];
if (typeof label === "string" && label.trim()) return label;
}
if (userId === "local-board") return "Board";
return userId.slice(0, 5);
}

View file

@ -0,0 +1,105 @@
import { describe, expect, it } from "vitest";
import type { CompanyMember, CompanyUserDirectoryEntry } from "@/api/access";
import {
buildCompanyUserInlineOptions,
buildCompanyUserLabelMap,
buildCompanyUserProfileMap,
buildMarkdownMentionOptions,
} from "./company-members";
const activeMember = (overrides: Partial<CompanyMember>): CompanyMember => ({
id: overrides.id ?? "member-1",
companyId: overrides.companyId ?? "company-1",
principalType: "user",
principalId: overrides.principalId ?? "user-1",
status: overrides.status ?? "active",
membershipRole: overrides.membershipRole ?? "operator",
createdAt: overrides.createdAt ?? "2026-01-01T00:00:00.000Z",
updatedAt: overrides.updatedAt ?? "2026-01-01T00:00:00.000Z",
user: overrides.user === undefined
? { id: overrides.principalId ?? "user-1", name: "Taylor", email: "taylor@example.com", image: null }
: overrides.user,
grants: overrides.grants ?? [],
});
describe("company-members helpers", () => {
it("builds labels from company member profiles", () => {
const labels = buildCompanyUserLabelMap([
activeMember({ principalId: "user-1", user: { id: "user-1", name: "Taylor", email: "taylor@example.com", image: null } }),
activeMember({ id: "member-2", principalId: "local-board", user: null }),
]);
expect(labels.get("user-1")).toBe("Taylor");
expect(labels.get("local-board")).toBe("Board");
});
it("builds user profiles with labels and avatars", () => {
const profiles = buildCompanyUserProfileMap([
activeMember({
principalId: "user-1",
user: { id: "user-1", name: "Taylor", email: "taylor@example.com", image: "https://example.com/taylor.png" },
}),
activeMember({ id: "member-2", principalId: "local-board", user: null }),
]);
expect(profiles.get("user-1")).toEqual({
label: "Taylor",
image: "https://example.com/taylor.png",
});
expect(profiles.get("local-board")).toEqual({
label: "Board",
image: null,
});
});
it("builds inline options for active users and excludes requested ids", () => {
const options = buildCompanyUserInlineOptions([
activeMember({ principalId: "user-1", user: { id: "user-1", name: "Taylor", email: "taylor@example.com", image: null } }),
activeMember({ id: "member-2", principalId: "user-2", user: { id: "user-2", name: "Jordan", email: "jordan@example.com", image: null } }),
activeMember({ id: "member-3", principalId: "user-3", status: "suspended" }),
], { excludeUserIds: ["user-1"] });
expect(options).toEqual([
{
id: "user:user-2",
label: "Jordan",
searchText: "Jordan jordan@example.com user-2",
},
]);
});
it("includes human users in markdown mention options", () => {
const options = buildMarkdownMentionOptions({
members: [activeMember({ principalId: "user-1", user: { id: "user-1", name: "Taylor", email: "taylor@example.com", image: null } })],
agents: [{ id: "agent-1", name: "CodexCoder", status: "active", icon: "code" }],
projects: [{ id: "project-1", name: "Paperclip App", color: "#336699" }],
});
expect(options).toEqual([
{ id: "user:user-1", name: "Taylor", kind: "user", userId: "user-1" },
{ id: "agent:agent-1", name: "CodexCoder", kind: "agent", agentId: "agent-1", agentIcon: "code" },
{ id: "project:project-1", name: "Paperclip App", kind: "project", projectId: "project-1", projectColor: "#336699" },
]);
});
it("accepts read-only directory entries for assignee and mention helpers", () => {
const users: CompanyUserDirectoryEntry[] = [
{
principalId: "user-1",
status: "active",
user: { id: "user-1", name: "Taylor", email: "taylor@example.com", image: null },
},
];
expect(buildCompanyUserInlineOptions(users)).toEqual([
{
id: "user:user-1",
label: "Taylor",
searchText: "Taylor taylor@example.com user-1",
},
]);
expect(buildMarkdownMentionOptions({ members: users })).toEqual([
{ id: "user:user-1", name: "Taylor", kind: "user", userId: "user-1" },
]);
});
});

View file

@ -0,0 +1,116 @@
import type { CompanyMember, CompanyUserDirectoryEntry } from "@/api/access";
import type { InlineEntityOption } from "@/components/InlineEntitySelector";
import type { MentionOption } from "@/components/MarkdownEditor";
import type { Agent, Project } from "@paperclipai/shared";
export interface CompanyUserProfile {
label: string;
image: string | null;
}
type CompanyUserRecord = Pick<CompanyMember, "principalId" | "status" | "user">
| CompanyUserDirectoryEntry;
function fallbackUserLabel(userId: string): string {
if (userId === "local-board") return "Board";
return userId.slice(0, 5);
}
function baseMemberLabel(member: Pick<CompanyUserRecord, "principalId" | "user">): string {
const name = member.user?.name?.trim();
if (name) return name;
const email = member.user?.email?.trim();
if (email) return email;
return fallbackUserLabel(member.principalId);
}
function activeUniqueMembers(members: CompanyUserRecord[] | null | undefined) {
const byId = new Map<string, CompanyUserRecord>();
for (const member of members ?? []) {
if (member.status !== "active") continue;
if (!byId.has(member.principalId)) {
byId.set(member.principalId, member);
}
}
return [...byId.values()].sort((left, right) => baseMemberLabel(left).localeCompare(baseMemberLabel(right)));
}
export function buildCompanyUserLabelMap(members: CompanyUserRecord[] | null | undefined): Map<string, string> {
const labels = new Map<string, string>();
for (const member of members ?? []) {
labels.set(member.principalId, baseMemberLabel(member));
}
return labels;
}
export function buildCompanyUserProfileMap(
members: CompanyUserRecord[] | null | undefined,
): Map<string, CompanyUserProfile> {
const profiles = new Map<string, CompanyUserProfile>();
for (const member of members ?? []) {
profiles.set(member.principalId, {
label: baseMemberLabel(member),
image: member.user?.image ?? null,
});
}
return profiles;
}
export function buildCompanyUserInlineOptions(
members: CompanyUserRecord[] | null | undefined,
options?: { excludeUserIds?: Iterable<string | null | undefined> },
): InlineEntityOption[] {
const exclude = new Set(
[...(options?.excludeUserIds ?? [])].filter((value): value is string => Boolean(value)),
);
return activeUniqueMembers(members)
.filter((member) => !exclude.has(member.principalId))
.map((member) => ({
id: `user:${member.principalId}`,
label: baseMemberLabel(member),
searchText: [member.user?.name, member.user?.email, member.principalId].filter(Boolean).join(" "),
}));
}
export function buildCompanyUserMentionOptions(
members: CompanyUserRecord[] | null | undefined,
): MentionOption[] {
return activeUniqueMembers(members).map((member) => ({
id: `user:${member.principalId}`,
name: baseMemberLabel(member),
kind: "user",
userId: member.principalId,
}));
}
export function buildMarkdownMentionOptions(args: {
agents?: Array<Pick<Agent, "id" | "name" | "status" | "icon">> | null | undefined;
projects?: Array<Pick<Project, "id" | "name" | "color">> | null | undefined;
members?: CompanyUserRecord[] | null | undefined;
}): MentionOption[] {
const options: MentionOption[] = [
...buildCompanyUserMentionOptions(args.members),
...[...(args.agents ?? [])]
.filter((agent) => agent.status !== "terminated")
.sort((left, right) => left.name.localeCompare(right.name))
.map((agent) => ({
id: `agent:${agent.id}`,
name: agent.name,
kind: "agent" as const,
agentId: agent.id,
agentIcon: agent.icon,
})),
...[...(args.projects ?? [])]
.sort((left, right) => left.name.localeCompare(right.name))
.map((project) => ({
id: `project:${project.id}`,
name: project.name,
kind: "project" as const,
projectId: project.id,
projectColor: project.color,
})),
];
return options;
}

View file

@ -9,47 +9,15 @@ import {
describe("company routes", () => {
it("treats execution workspace paths as board routes that need a company prefix", () => {
expect(isBoardPathWithoutPrefix("/execution-workspaces/workspace-123")).toBe(true);
expect(isBoardPathWithoutPrefix("/execution-workspaces/workspace-123/issues")).toBe(true);
expect(extractCompanyPrefixFromPath("/execution-workspaces/workspace-123")).toBeNull();
expect(applyCompanyPrefix("/execution-workspaces/workspace-123", "PAP")).toBe(
"/PAP/execution-workspaces/workspace-123",
);
expect(applyCompanyPrefix("/execution-workspaces/workspace-123/issues", "PAP")).toBe(
"/PAP/execution-workspaces/workspace-123/issues",
);
});
it("normalizes prefixed execution workspace paths back to company-relative paths", () => {
expect(toCompanyRelativePath("/PAP/execution-workspaces/workspace-123")).toBe(
"/execution-workspaces/workspace-123",
);
expect(toCompanyRelativePath("/PAP/execution-workspaces/workspace-123/configuration")).toBe(
"/execution-workspaces/workspace-123/configuration",
);
});
/**
* Regression tests for https://github.com/paperclipai/paperclip/issues/2910
*
* The Export and Import links on the Company Settings page used plain
* `<a href="/company/export">` anchors which bypass the router's Link
* wrapper. Without the wrapper, the company prefix is never applied and
* the links resolve to `/company/export` instead of `/:prefix/company/export`,
* producing a "Company not found" error.
*
* The fix replaces the `<a>` elements with the prefix-aware `<Link>` from
* `@/lib/router`. These tests assert that the underlying `applyCompanyPrefix`
* utility (used by that Link) correctly rewrites the export/import paths.
*/
it("applies company prefix to /company/export", () => {
expect(applyCompanyPrefix("/company/export", "PAP")).toBe("/PAP/company/export");
});
it("applies company prefix to /company/import", () => {
expect(applyCompanyPrefix("/company/import", "PAP")).toBe("/PAP/company/import");
});
it("does not double-apply the prefix if already present", () => {
expect(applyCompanyPrefix("/PAP/company/export", "PAP")).toBe("/PAP/company/export");
});
});

View file

@ -46,6 +46,7 @@ import {
saveInboxIssueColumns,
saveInboxWorkItemGroupBy,
saveLastInboxTab,
shouldShowCompanyAlerts,
shouldResetInboxWorkspaceGrouping,
shouldShowInboxSection,
type InboxWorkItem,
@ -298,7 +299,10 @@ describe("inbox helpers", () => {
it("counts the same inbox sources the badge uses", () => {
const result = computeInboxBadgeData({
approvals: [makeApproval("pending"), makeApproval("approved")],
approvals: [
{ ...makeApproval("pending"), requestedByUserId: "user-1" },
{ ...makeApproval("approved"), requestedByUserId: "user-2" },
],
joinRequests: [makeJoinRequest("join-1")],
dashboard,
heartbeatRuns: [
@ -309,10 +313,11 @@ describe("inbox helpers", () => {
mineIssues: [makeIssue("1", true)],
dismissedAlerts: new Set<string>(),
dismissedAtByKey: new Map<string, number>(),
currentUserId: "user-1",
});
expect(result).toEqual({
inbox: 6,
inbox: 5,
approvals: 1,
failedRuns: 2,
joinRequests: 1,
@ -330,6 +335,7 @@ describe("inbox helpers", () => {
mineIssues: [],
dismissedAlerts: new Set<string>(["alert:budget", "alert:agent-errors"]),
dismissedAtByKey: new Map<string, number>([["run:run-1", new Date("2026-03-11T00:00:00.000Z").getTime()]]),
currentUserId: "user-1",
});
expect(result).toEqual({
@ -351,10 +357,12 @@ describe("inbox helpers", () => {
mineIssues: [makeIssue("1", false), makeIssue("2", false), makeIssue("3", true)],
dismissedAlerts: new Set<string>(),
dismissedAtByKey: new Map(),
currentUserId: "user-1",
});
expect(result.mineIssues).toBe(1);
expect(result.inbox).toBe(3);
expect(result.inbox).toBe(1);
expect(result.alerts).toBe(2);
});
it("resurfaces non-issue items when they change after dismissal", () => {
@ -393,21 +401,25 @@ describe("inbox helpers", () => {
expect(issues).toHaveLength(2);
});
it("shows recent approvals in updated order and unread approvals as actionable only", () => {
it("shows only my approvals on mine, while recent and unread stay company-wide", () => {
const approvals = [
makeApprovalWithTimestamps("approval-approved", "approved", "2026-03-11T02:00:00.000Z"),
makeApprovalWithTimestamps("approval-pending", "pending", "2026-03-11T01:00:00.000Z"),
makeApprovalWithTimestamps(
"approval-revision",
"revision_requested",
"2026-03-11T03:00:00.000Z",
),
{
...makeApprovalWithTimestamps("approval-approved", "approved", "2026-03-11T02:00:00.000Z"),
requestedByUserId: "user-1",
},
{
...makeApprovalWithTimestamps("approval-pending", "pending", "2026-03-11T01:00:00.000Z"),
requestedByUserId: "user-2",
},
{
...makeApprovalWithTimestamps("approval-revision", "revision_requested", "2026-03-11T03:00:00.000Z"),
decidedByUserId: "user-1",
},
];
expect(getApprovalsForTab(approvals, "mine", "all").map((approval) => approval.id)).toEqual([
expect(getApprovalsForTab(approvals, "mine", "all", "user-1").map((approval) => approval.id)).toEqual([
"approval-revision",
"approval-approved",
"approval-pending",
]);
expect(getApprovalsForTab(approvals, "recent", "all").map((approval) => approval.id)).toEqual([
"approval-revision",
@ -423,6 +435,44 @@ describe("inbox helpers", () => {
]);
});
it("keeps unrelated approvals out of a new user's badge and mine tab", () => {
const approvals = [
{ ...makeApproval("pending"), requestedByUserId: "user-2" },
{ ...makeApproval("revision_requested"), decidedByUserId: "user-3" },
];
expect(getApprovalsForTab(approvals, "mine", "all", "user-1")).toEqual([]);
const result = computeInboxBadgeData({
approvals,
joinRequests: [],
dashboard,
heartbeatRuns: [],
mineIssues: [],
dismissedAlerts: new Set<string>(),
dismissedAtByKey: new Map(),
currentUserId: "user-1",
});
expect(result.approvals).toBe(0);
});
it("does not count company-wide alerts in the personal inbox badge", () => {
const result = computeInboxBadgeData({
approvals: [],
joinRequests: [],
dashboard,
heartbeatRuns: [],
mineIssues: [],
dismissedAlerts: new Set<string>(),
dismissedAtByKey: new Map(),
currentUserId: "user-1",
});
expect(result.alerts).toBe(2);
expect(result.inbox).toBe(0);
});
it("mixes approvals into the inbox feed by most recent activity", () => {
const newerIssue = makeIssue("1", true);
newerIssue.lastActivityAt = new Date("2026-03-11T04:00:00.000Z");
@ -614,6 +664,13 @@ describe("inbox helpers", () => {
).toBe(false);
});
it("shows company alerts only on the all tab", () => {
expect(shouldShowCompanyAlerts("mine")).toBe(false);
expect(shouldShowCompanyAlerts("recent")).toBe(false);
expect(shouldShowCompanyAlerts("unread")).toBe(false);
expect(shouldShowCompanyAlerts("all")).toBe(true);
});
it("limits recent touched issues before unread badge counting", () => {
const issues = Array.from({ length: RECENT_ISSUES_LIMIT + 5 }, (_, index) => {
const issue = makeIssue(String(index + 1), index < 3);

View file

@ -625,6 +625,10 @@ export function isMineInboxTab(tab: InboxTab): boolean {
return tab === "mine";
}
export function shouldShowCompanyAlerts(tab: InboxTab): boolean {
return tab === "all";
}
export function resolveInboxSelectionIndex(
previousIndex: number,
itemCount: number,
@ -695,12 +699,20 @@ export function getApprovalsForTab(
approvals: Approval[],
tab: InboxTab,
filter: InboxApprovalFilter,
currentUserId?: string | null,
): Approval[] {
const sortedApprovals = [...approvals].sort(
(a, b) => normalizeTimestamp(b.updatedAt) - normalizeTimestamp(a.updatedAt),
);
if (tab === "mine" || tab === "recent") return sortedApprovals;
if (tab === "mine") {
if (!currentUserId) return [];
return sortedApprovals.filter(
(approval) =>
approval.requestedByUserId === currentUserId || approval.decidedByUserId === currentUserId,
);
}
if (tab === "recent") return sortedApprovals;
if (tab === "unread") {
return sortedApprovals.filter((approval) => ACTIONABLE_APPROVAL_STATUSES.has(approval.status));
}
@ -1005,6 +1017,7 @@ export function computeInboxBadgeData({
mineIssues,
dismissedAlerts,
dismissedAtByKey,
currentUserId,
}: {
approvals: Approval[];
joinRequests: JoinRequest[];
@ -1013,9 +1026,12 @@ export function computeInboxBadgeData({
mineIssues: Issue[];
dismissedAlerts: Set<string>;
dismissedAtByKey: ReadonlyMap<string, number>;
currentUserId?: string | null;
}): InboxBadgeData {
const actionableApprovals = approvals.filter(
(approval) =>
!!currentUserId &&
(approval.requestedByUserId === currentUserId || approval.decidedByUserId === currentUserId) &&
ACTIONABLE_APPROVAL_STATUSES.has(approval.status) &&
!isInboxEntityDismissed(dismissedAtByKey, `approval:${approval.id}`, approval.updatedAt),
).length;
@ -1040,7 +1056,8 @@ export function computeInboxBadgeData({
const alerts = Number(showAggregateAgentError) + Number(showBudgetAlert);
return {
inbox: actionableApprovals + visibleJoinRequests + failedRuns + visibleMineIssues + alerts,
// The inbox badge reflects personal/actionable work, not company-wide health alerts.
inbox: actionableApprovals + visibleJoinRequests + failedRuns + visibleMineIssues,
approvals: actionableApprovals,
failedRuns,
joinRequests: visibleJoinRequests,

View file

@ -0,0 +1,36 @@
const PENDING_INVITE_STORAGE_KEY = "paperclip:pending-invite-token";
function canUseStorage() {
return typeof window !== "undefined" && typeof window.localStorage !== "undefined";
}
export function rememberPendingInviteToken(token: string) {
const normalized = token.trim();
if (!normalized || !canUseStorage()) return;
try {
window.localStorage.setItem(PENDING_INVITE_STORAGE_KEY, normalized);
} catch {
// Ignore storage failures and keep the invite flow usable.
}
}
export function clearPendingInviteToken(expectedToken?: string) {
if (!canUseStorage()) return;
try {
const current = window.localStorage.getItem(PENDING_INVITE_STORAGE_KEY);
if (expectedToken && current !== expectedToken.trim()) return;
window.localStorage.removeItem(PENDING_INVITE_STORAGE_KEY);
} catch {
// Ignore storage failures.
}
}
export function getRememberedInvitePath() {
if (!canUseStorage()) return null;
try {
const token = window.localStorage.getItem(PENDING_INVITE_STORAGE_KEY)?.trim();
return token ? `/invite/${token}` : null;
} catch {
return null;
}
}

View file

@ -234,6 +234,27 @@ describe("buildAssistantPartsFromTranscript", () => {
});
describe("buildIssueChatMessages", () => {
it("uses the company user label for current-user comments instead of collapsing to You", () => {
const messages = buildIssueChatMessages({
comments: [createComment({ authorUserId: "user-1" })],
timelineEvents: [],
linkedRuns: [],
liveRuns: [],
currentUserId: "user-1",
userLabelMap: new Map([["user-1", "Dotta"]]),
});
expect(messages[0]).toMatchObject({
role: "user",
metadata: {
custom: {
authorName: "Dotta",
authorUserId: "user-1",
},
},
});
});
it("orders events before comments and appends active live runs as running assistant messages", () => {
const agentMap = new Map<string, Agent>([["agent-1", createAgent("agent-1", "CodexCoder")]]);
const comments = [

View file

@ -270,11 +270,16 @@ function authorNameForComment(
comment: IssueChatComment,
agentMap?: Map<string, Agent>,
currentUserId?: string | null,
userLabelMap?: ReadonlyMap<string, string> | null,
) {
if (comment.authorAgentId) {
return agentMap?.get(comment.authorAgentId)?.name ?? comment.authorAgentId.slice(0, 8);
}
return formatAssigneeUserLabel(comment.authorUserId ?? null, currentUserId) ?? "You";
const authorUserId = comment.authorUserId ?? null;
if (!authorUserId) return "You";
const userLabel = userLabelMap?.get(authorUserId)?.trim();
if (userLabel) return userLabel;
return formatAssigneeUserLabel(authorUserId, currentUserId, userLabelMap) ?? "You";
}
function formatStatusLabel(status: string) {
@ -285,12 +290,13 @@ function createCommentMessage(args: {
comment: IssueChatComment;
agentMap?: Map<string, Agent>;
currentUserId?: string | null;
userLabelMap?: ReadonlyMap<string, string> | null;
companyId?: string | null;
projectId?: string | null;
}): ThreadMessage {
const { comment, agentMap, currentUserId, companyId, projectId } = args;
const { comment, agentMap, currentUserId, userLabelMap, companyId, projectId } = args;
const createdAt = toDate(comment.createdAt);
const authorName = authorNameForComment(comment, agentMap, currentUserId);
const authorName = authorNameForComment(comment, agentMap, currentUserId, userLabelMap);
const custom = {
kind: "comment",
commentId: comment.id,
@ -335,13 +341,14 @@ function createTimelineEventMessage(args: {
event: IssueTimelineEvent;
agentMap?: Map<string, Agent>;
currentUserId?: string | null;
userLabelMap?: ReadonlyMap<string, string> | null;
}) {
const { event, agentMap, currentUserId } = args;
const { event, agentMap, currentUserId, userLabelMap } = args;
const actorName = event.actorType === "agent"
? (agentMap?.get(event.actorId)?.name ?? event.actorId.slice(0, 8))
: event.actorType === "system"
? "System"
: (formatAssigneeUserLabel(event.actorId, currentUserId) ?? "Board");
: (formatAssigneeUserLabel(event.actorId, currentUserId, userLabelMap) ?? "Board");
const lines: string[] = [`${actorName} updated this issue`];
if (event.statusChange) {
@ -352,10 +359,10 @@ function createTimelineEventMessage(args: {
if (event.assigneeChange) {
const from = event.assigneeChange.from.agentId
? (agentMap?.get(event.assigneeChange.from.agentId)?.name ?? event.assigneeChange.from.agentId.slice(0, 8))
: (formatAssigneeUserLabel(event.assigneeChange.from.userId, currentUserId) ?? "Unassigned");
: (formatAssigneeUserLabel(event.assigneeChange.from.userId, currentUserId, userLabelMap) ?? "Unassigned");
const to = event.assigneeChange.to.agentId
? (agentMap?.get(event.assigneeChange.to.agentId)?.name ?? event.assigneeChange.to.agentId.slice(0, 8))
: (formatAssigneeUserLabel(event.assigneeChange.to.userId, currentUserId) ?? "Unassigned");
: (formatAssigneeUserLabel(event.assigneeChange.to.userId, currentUserId, userLabelMap) ?? "Unassigned");
lines.push(`Assignee: ${from} -> ${to}`);
}
@ -743,6 +750,7 @@ export function buildIssueChatMessages(args: {
projectId?: string | null;
agentMap?: Map<string, Agent>;
currentUserId?: string | null;
userLabelMap?: ReadonlyMap<string, string> | null;
}) {
const {
comments,
@ -758,6 +766,7 @@ export function buildIssueChatMessages(args: {
projectId,
agentMap,
currentUserId,
userLabelMap,
} = args;
const orderedMessages: MessageWithOrder[] = [];
@ -766,7 +775,7 @@ export function buildIssueChatMessages(args: {
orderedMessages.push({
createdAtMs: toTimestamp(comment.createdAt),
order: 1,
message: createCommentMessage({ comment, agentMap, currentUserId, companyId, projectId }),
message: createCommentMessage({ comment, agentMap, currentUserId, userLabelMap, companyId, projectId }),
});
}
@ -774,7 +783,7 @@ export function buildIssueChatMessages(args: {
orderedMessages.push({
createdAtMs: toTimestamp(event.createdAt),
order: 0,
message: createTimelineEventMessage({ event, agentMap, currentUserId }),
message: createTimelineEventMessage({ event, agentMap, currentUserId, userLabelMap }),
});
}

View file

@ -1,5 +1,5 @@
import type { CSSProperties } from "react";
import { parseAgentMentionHref, parseProjectMentionHref, parseSkillMentionHref } from "@paperclipai/shared";
import { parseAgentMentionHref, parseProjectMentionHref, parseSkillMentionHref, parseUserMentionHref } from "@paperclipai/shared";
import { getAgentIcon } from "./agent-icons";
import { hexToRgb, pickTextColorForPillBg } from "./color-contrast";
@ -14,6 +14,10 @@ export type ParsedMentionChip =
projectId: string;
color: string | null;
}
| {
kind: "user";
userId: string;
}
| {
kind: "skill";
skillId: string;
@ -41,6 +45,14 @@ export function parseMentionChipHref(href: string): ParsedMentionChip | null {
};
}
const user = parseUserMentionHref(href);
if (user) {
return {
kind: "user",
userId: user.userId,
};
}
const skill = parseSkillMentionHref(href);
if (skill) {
return {
@ -100,6 +112,7 @@ export function clearMentionChipDecoration(element: HTMLElement) {
"paperclip-mention-chip",
"paperclip-mention-chip--agent",
"paperclip-mention-chip--project",
"paperclip-mention-chip--user",
"paperclip-mention-chip--skill",
"paperclip-project-mention-chip",
);

View file

@ -78,37 +78,35 @@ export function buildProjectWorkspaceSummaries(input: {
})) continue;
const existing = summaries.get(`execution:${executionWorkspace.id}`);
const nextIssues = existing?.issues ?? [];
nextIssues.push(issue);
const nextIssues = [...(existing?.issues ?? []), issue].sort(
(a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime(),
);
if (!existing) {
summaries.set(`execution:${executionWorkspace.id}`, {
key: `execution:${executionWorkspace.id}`,
kind: "execution_workspace",
workspaceId: executionWorkspace.id,
workspaceName: executionWorkspace.name,
cwd: executionWorkspace.cwd ?? null,
branchName: executionWorkspace.branchName ?? executionWorkspace.baseRef ?? null,
lastUpdatedAt: maxDate(
executionWorkspace.lastUsedAt,
executionWorkspace.updatedAt,
issue.updatedAt,
),
projectWorkspaceId: executionWorkspace.projectWorkspaceId ?? issue.projectWorkspaceId ?? null,
executionWorkspaceId: executionWorkspace.id,
executionWorkspaceStatus: executionWorkspace.status,
serviceCount: executionWorkspace.runtimeServices?.length ?? 0,
runningServiceCount: executionWorkspace.runtimeServices?.filter((service) => service.status === "running").length ?? 0,
primaryServiceUrl: executionWorkspace.runtimeServices?.find((service) => service.url)?.url ?? null,
hasRuntimeConfig: Boolean(
executionWorkspace.config?.workspaceRuntime
?? projectWorkspacesById.get(executionWorkspace.projectWorkspaceId ?? issue.projectWorkspaceId ?? "")?.runtimeConfig?.workspaceRuntime,
),
issues: nextIssues,
});
} else {
existing.lastUpdatedAt = maxDate(existing.lastUpdatedAt, issue.updatedAt);
}
summaries.set(`execution:${executionWorkspace.id}`, {
key: `execution:${executionWorkspace.id}`,
kind: "execution_workspace",
workspaceId: executionWorkspace.id,
workspaceName: executionWorkspace.name,
cwd: executionWorkspace.cwd ?? null,
branchName: executionWorkspace.branchName ?? executionWorkspace.baseRef ?? null,
lastUpdatedAt: maxDate(
existing?.lastUpdatedAt,
executionWorkspace.lastUsedAt,
executionWorkspace.updatedAt,
issue.updatedAt,
),
projectWorkspaceId: executionWorkspace.projectWorkspaceId ?? issue.projectWorkspaceId ?? null,
executionWorkspaceId: executionWorkspace.id,
executionWorkspaceStatus: executionWorkspace.status,
serviceCount: executionWorkspace.runtimeServices?.length ?? 0,
runningServiceCount: executionWorkspace.runtimeServices?.filter((service) => service.status === "running").length ?? 0,
primaryServiceUrl: executionWorkspace.runtimeServices?.find((service) => service.url)?.url ?? null,
hasRuntimeConfig: Boolean(
executionWorkspace.config?.workspaceRuntime
?? projectWorkspacesById.get(executionWorkspace.projectWorkspaceId ?? issue.projectWorkspaceId ?? "")?.runtimeConfig?.workspaceRuntime,
),
issues: nextIssues,
});
continue;
}
@ -117,30 +115,27 @@ export function buildProjectWorkspaceSummaries(input: {
if (!projectWorkspace) continue;
const existing = summaries.get(`project:${projectWorkspace.id}`);
const nextIssues = existing?.issues ?? [];
nextIssues.push(issue);
const nextIssues = [...(existing?.issues ?? []), issue].sort(
(a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime(),
);
if (!existing) {
summaries.set(`project:${projectWorkspace.id}`, {
key: `project:${projectWorkspace.id}`,
kind: "project_workspace",
workspaceId: projectWorkspace.id,
workspaceName: projectWorkspace.name,
cwd: projectWorkspace.cwd ?? null,
branchName: projectWorkspace.repoRef ?? projectWorkspace.defaultRef ?? null,
lastUpdatedAt: maxDate(projectWorkspace.updatedAt, issue.updatedAt),
projectWorkspaceId: projectWorkspace.id,
executionWorkspaceId: null,
executionWorkspaceStatus: null,
serviceCount: projectWorkspace.runtimeServices?.length ?? 0,
runningServiceCount: projectWorkspace.runtimeServices?.filter((service) => service.status === "running").length ?? 0,
primaryServiceUrl: projectWorkspace.runtimeServices?.find((service) => service.url)?.url ?? null,
hasRuntimeConfig: Boolean(projectWorkspace.runtimeConfig?.workspaceRuntime),
issues: nextIssues,
});
} else {
existing.lastUpdatedAt = maxDate(existing.lastUpdatedAt, issue.updatedAt);
}
summaries.set(`project:${projectWorkspace.id}`, {
key: `project:${projectWorkspace.id}`,
kind: "project_workspace",
workspaceId: projectWorkspace.id,
workspaceName: projectWorkspace.name,
cwd: projectWorkspace.cwd ?? null,
branchName: projectWorkspace.repoRef ?? projectWorkspace.defaultRef ?? null,
lastUpdatedAt: maxDate(existing?.lastUpdatedAt, projectWorkspace.updatedAt, issue.updatedAt),
projectWorkspaceId: projectWorkspace.id,
executionWorkspaceId: null,
executionWorkspaceStatus: null,
serviceCount: projectWorkspace.runtimeServices?.length ?? 0,
runningServiceCount: projectWorkspace.runtimeServices?.filter((service) => service.status === "running").length ?? 0,
primaryServiceUrl: projectWorkspace.runtimeServices?.find((service) => service.url)?.url ?? null,
hasRuntimeConfig: Boolean(projectWorkspace.runtimeConfig?.workspaceRuntime),
issues: nextIssues,
});
}
for (const projectWorkspace of input.project.workspaces) {
@ -170,17 +165,8 @@ export function buildProjectWorkspaceSummaries(input: {
});
}
const result = [...summaries.values()];
// Sort issues within each summary once (instead of on every insertion)
const issueTime = (issue: Issue) => new Date(issue.updatedAt).getTime();
for (const summary of result) {
if (summary.issues.length > 1) {
summary.issues.sort((a, b) => issueTime(b) - issueTime(a));
}
}
result.sort((a, b) => {
return [...summaries.values()].sort((a, b) => {
const diff = b.lastUpdatedAt.getTime() - a.lastUpdatedAt.getTime();
return diff !== 0 ? diff : a.workspaceName.localeCompare(b.workspaceName);
});
return result;
}

View file

@ -90,9 +90,16 @@ export const queryKeys = {
issues: (approvalId: string) => ["approvals", "issues", approvalId] as const,
},
access: {
invites: (companyId: string, state: string = "all", limit: number = 20) =>
["access", "invites", "paginated-v1", companyId, state, limit] as const,
joinRequests: (companyId: string, status: string = "pending_approval") =>
["access", "join-requests", companyId, status] as const,
companyMembers: (companyId: string) => ["access", "company-members", companyId] as const,
companyUserDirectory: (companyId: string) => ["access", "company-user-directory", companyId] as const,
adminUsers: (query: string) => ["access", "admin-users", query] as const,
userCompanyAccess: (userId: string) => ["access", "user-company-access", userId] as const,
invite: (token: string) => ["access", "invite", token] as const,
currentBoardAccess: ["access", "current-board-access"] as const,
},
auth: {
session: ["auth", "session"] as const,