mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-14 01:50:39 +09:00
778e775c35
## Thinking Path
> - Paperclip orchestrates AI-agent companies and needs secrets handling
to work across local development, hosted operators, and governed agent
execution.
> - The affected subsystem is the company-scoped secrets control plane:
database schema, server services/routes, CLI workflows, and the Secrets
settings UI.
> - The gap was that secrets were local-only and operators could not
manage provider vaults or import existing remote references without
exposing plaintext.
> - This branch adds provider vault configuration plus an AWS Secrets
Manager remote-import path while preserving company boundaries, binding
context, and audit trails.
> - I kept the PR to a single branch PR, removed unrelated
lockfile/package drift, rebased the full branch onto the current
`public-gh/master`, and addressed fresh Greptile findings.
> - The benefit is a reviewable implementation of provider-backed
secrets with focused tests covering provider selection, import
conflicts, deleted secret reuse, rotation guards, and AWS signing
behavior.
## What Changed
- Added provider vault support for company secrets, including provider
config storage, default vault handling, health checks, binding usage,
access events, and remote import preview/commit.
- Added an AWS Secrets Manager provider using SigV4 request signing,
bounded request timeouts, namespace guardrails, cached runtime
credential resolution, and external-reference linking without plaintext
reads.
- Added Secrets UI surfaces for vault management and remote import, plus
CLI/API documentation for setup and operations.
- Stabilized routine webhook secret binding paths and SSH
environment-driver fixture bindings discovered during verification.
- Addressed Greptile and CI findings: no lockfile/package drift,
monotonic migration metadata, disabled-vault default races, soft-deleted
secret hiding/recreate behavior, remove behavior with disabled vaults,
soft-deleted external-reference re-import, non-active rotation guards,
managed-secret soft deletion through PATCH, and per-call AWS SDK
credential client churn.
- Rebased this branch onto `public-gh/master` at `
|
||
|---|---|---|
| .. | ||
| smoke | ||
| backfill-issue-reference-mentions.ts | ||
| backup-db.sh | ||
| bootstrap-npm-package.mjs | ||
| bootstrap-npm-package.test.mjs | ||
| build-npm.sh | ||
| build-standalone-public-packages.mjs | ||
| capture-acpx-skills-screenshots.mjs | ||
| capture-pap-2351-binding-picker.mjs | ||
| check-docker-deps-stage.mjs | ||
| check-forbidden-tokens.mjs | ||
| check-release-package-bootstrap.mjs | ||
| check-release-package-bootstrap.test.mjs | ||
| clean-onboard-git.sh | ||
| clean-onboard-npm.sh | ||
| clean-onboard-ref.sh | ||
| create-github-release.sh | ||
| dev-runner-output.mjs | ||
| dev-runner-output.ts | ||
| dev-runner-paths.mjs | ||
| dev-runner.mjs | ||
| dev-runner.ts | ||
| dev-service-profile.ts | ||
| dev-service.ts | ||
| discord-daily-digest.sh | ||
| docker-build-test.sh | ||
| docker-entrypoint.sh | ||
| docker-onboard-smoke.sh | ||
| ensure-plugin-build-deps.mjs | ||
| ensure-workspace-package-links.ts | ||
| generate-company-assets.ts | ||
| generate-npm-package-json.mjs | ||
| generate-org-chart-images.ts | ||
| generate-org-chart-satori-comparison.ts | ||
| generate-plugin-package-json.mjs | ||
| generate-ui-package-json.mjs | ||
| kill-agent-browsers.sh | ||
| kill-dev.sh | ||
| kill-vitest.sh | ||
| link-plugin-dev-sdk.mjs | ||
| measure-issue-chat-long-thread.mjs | ||
| migrate-inline-env-secrets.ts | ||
| paperclip-commit-metrics.ts | ||
| paperclip-issue-update.sh | ||
| prepare-server-ui-dist.sh | ||
| provision-worktree.sh | ||
| release-lib.sh | ||
| release-package-manifest.json | ||
| release-package-map.mjs | ||
| release-package-map.test.mjs | ||
| release.sh | ||
| rollback-latest.sh | ||
| run-typecheck-build-gaps.mjs | ||
| run-vitest-stable.mjs | ||
| screenshot-pap2373.mjs | ||
| screenshot-subissues.mjs | ||
| screenshot.cjs | ||
| verify-release-registry-state.mjs | ||
| verify-release-registry-state.test.mjs | ||
