mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-18 19:50:38 +09:00
705c1b8d81
## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies. > - Scheduled routines are the control-plane path for recurring agent work. > - Routines already had dispatch/history, but their runtime environment did not carry routine-owned secret bindings through execution. > - Operators need routine-specific secrets that can override project/agent env without exposing secret values in history, logs, or access events. > - This pull request adds the routine env runtime contract, wires it into execution, and makes the routine UI/history surfaces show safe secret metadata. > - The benefit is that routine executions can use scoped secret refs predictably while preserving company boundaries and auditability. ## What Changed - Added routine env persistence/runtime support, including `routines.env`, `routine_runs.routine_revision_id`, revision snapshots, and idempotent migration `0086_routine_env_runtime_contract`. - Resolved routine env during heartbeat adapter config assembly with precedence `agent < project < routine` and secret access events recorded against the routine consumer. - Added secret binding synchronization for routine create/update/restore flows and guarded cross-company, missing, disabled, and deleted secret cases. - Added a Secrets tab to routine detail, env/secret history diff rendering, and Storybook coverage for the new UI states. - Added server/UI regression tests, including an embedded-Postgres QA path for routine secret execution and restore behavior. - Updated implementation/database docs for routine env and secret-binding behavior. ## Verification - `pnpm install --frozen-lockfile` after rebasing onto `public-gh/master` to refresh workspace links for the newly-added upstream Grok adapter package. - `pnpm exec vitest run server/src/__tests__/heartbeat-project-env.test.ts server/src/__tests__/routines-service.test.ts server/src/__tests__/secrets-service.test.ts server/src/__tests__/qa-routine-secrets-e2e.test.ts ui/src/components/RoutineHistoryTab.test.tsx` passed: 5 files, 92 tests. - `pnpm -r typecheck` passed across the workspace. - `pnpm build` passed. Vite emitted the existing large-chunk/dynamic-import warnings. - UI screenshots were captured locally during QA in `artifacts/pap-9521/` and `artifacts/pap-9522/`; generated screenshots are not committed to avoid adding binary artifacts to the repo. ## Risks - Migration risk is limited by `IF NOT EXISTS` guards for the new columns, FK, and index, and the migration is ordered as `0086` immediately after upstream `0085`. - Runtime behavior changes env precedence for routine executions by adding routine env as the highest-precedence layer; tests cover agent/project/routine precedence. - Secret handling is security-sensitive; tests cover value-free manifests/events/errors, disabled/missing/deleted secrets, and cross-company rejection. - UI history now renders routine env/secret diffs; tests and Storybook stories cover the main rendering paths. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex coding agent based on GPT-5, with shell/tool use and medium reasoning effort. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|---|---|---|
| .. | ||
| activity_log.ts | ||
| agent_api_keys.ts | ||
| agent_config_revisions.ts | ||
| agent_runtime_state.ts | ||
| agent_task_sessions.ts | ||
| agent_wakeup_requests.ts | ||
| agents.ts | ||
| approval_comments.ts | ||
| approvals.ts | ||
| assets.ts | ||
| auth.ts | ||
| board_api_keys.ts | ||
| budget_incidents.ts | ||
| budget_policies.ts | ||
| cli_auth_challenges.ts | ||
| companies.ts | ||
| company_logos.ts | ||
| company_memberships.ts | ||
| company_secret_bindings.ts | ||
| company_secret_provider_configs.ts | ||
| company_secret_versions.ts | ||
| company_secrets.ts | ||
| company_skills.ts | ||
| company_user_sidebar_preferences.ts | ||
| cost_events.ts | ||
| document_revisions.ts | ||
| documents.ts | ||
| environment_leases.ts | ||
| environments.ts | ||
| execution_workspaces.ts | ||
| feedback_exports.ts | ||
| feedback_votes.ts | ||
| finance_events.ts | ||
| goals.ts | ||
| heartbeat_run_events.ts | ||
| heartbeat_run_watchdog_decisions.ts | ||
| heartbeat_runs.ts | ||
| inbox_dismissals.ts | ||
| index.ts | ||
| instance_settings.ts | ||
| instance_user_roles.ts | ||
| invites.ts | ||
| issue_approvals.ts | ||
| issue_attachments.ts | ||
| issue_comments.ts | ||
| issue_documents.ts | ||
| issue_execution_decisions.ts | ||
| issue_inbox_archives.ts | ||
| issue_labels.ts | ||
| issue_read_states.ts | ||
| issue_recovery_actions.ts | ||
| issue_reference_mentions.ts | ||
| issue_relations.ts | ||
| issue_thread_interactions.ts | ||
| issue_tree_hold_members.ts | ||
| issue_tree_holds.ts | ||
| issue_work_products.ts | ||
| issues.ts | ||
| join_requests.ts | ||
| labels.ts | ||
| plugin_company_settings.ts | ||
| plugin_config.ts | ||
| plugin_database.ts | ||
| plugin_entities.ts | ||
| plugin_jobs.ts | ||
| plugin_logs.ts | ||
| plugin_managed_resources.ts | ||
| plugin_state.ts | ||
| plugin_webhooks.ts | ||
| plugins.ts | ||
| principal_permission_grants.ts | ||
| project_goals.ts | ||
| project_workspaces.ts | ||
| projects.ts | ||
| routines.ts | ||
| secret_access_events.ts | ||
| user_sidebar_preferences.ts | ||
| workspace_operations.ts | ||
| workspace_runtime_services.ts | ||