mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-14 18:10:39 +09:00
## Thinking Path > - Paperclip is a control plane, so optional execution providers should sit at the plugin edge instead of hardcoding provider-specific behavior into core shared/server/ui layers. > - Sandbox environments are already first-class, and the fake provider proves the built-in path; the remaining gap was that real providers still leaked provider-specific config and runtime assumptions into core. > - That coupling showed up in config normalization, secret persistence, capabilities reporting, lease reconstruction, and the board UI form fields. > - As long as core knew about those provider-shaped details, shipping a provider as a pure third-party plugin meant every new provider would still require host changes. > - This pull request generalizes the sandbox provider seam around schema-driven plugin metadata and generic secret-ref handling. > - The runtime and UI now consume provider metadata generically, so core only special-cases the built-in fake provider while third-party providers can live entirely in plugins. ## What Changed - Added generic sandbox-provider capability metadata so plugin-backed providers can expose `configSchema` through shared environment support and the environments capabilities API. - Reworked sandbox config normalization/persistence/runtime resolution to handle schema-declared secret-ref fields generically, storing them as Paperclip secrets and resolving them for probe/execute/release flows. - Generalized plugin sandbox runtime handling so provider validation, reusable-lease matching, lease reconstruction, and plugin worker calls all operate on provider-agnostic config instead of provider-shaped branches. - Replaced hardcoded sandbox provider form fields in Company Settings with schema-driven rendering and blocked agent environment selection from the built-in fake provider. - Added regression coverage for the generic seam across shared support helpers plus environment config, probe, routes, runtime, and sandbox-provider runtime tests. ## Verification - `pnpm vitest --run packages/shared/src/environment-support.test.ts server/src/__tests__/environment-config.test.ts server/src/__tests__/environment-probe.test.ts server/src/__tests__/environment-routes.test.ts server/src/__tests__/environment-runtime.test.ts server/src/__tests__/sandbox-provider-runtime.test.ts` - `pnpm -r typecheck` ## Risks - Plugin sandbox providers now depend more heavily on accurate `configSchema` declarations; incorrect schemas can misclassify secret-bearing fields or omit required config. - Reusable lease matching is now metadata-driven for plugin-backed providers, so providers that fail to persist stable metadata may reprovision instead of resuming an existing lease. - The UI form is now fully schema-driven for plugin-backed sandbox providers; provider manifests without good defaults or descriptions may produce a rougher operator experience. ## Model Used - OpenAI Codex via `codex_local` - Model ID: `gpt-5.4` - Reasoning effort: `high` - Context window observed in runtime session metadata: `258400` tokens - Capabilities used: terminal tool execution, git, and local code/test inspection ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [ ] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge
79 lines
2.4 KiB
TypeScript
79 lines
2.4 KiB
TypeScript
const UUID_RE =
|
|
/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
|
|
|
|
export function isUuidSecretRef(value: string): boolean {
|
|
return UUID_RE.test(value);
|
|
}
|
|
|
|
export function collectSecretRefPaths(
|
|
schema: Record<string, unknown> | null | undefined,
|
|
): Set<string> {
|
|
const paths = new Set<string>();
|
|
if (!schema || typeof schema !== "object") return paths;
|
|
|
|
function walk(node: Record<string, unknown>, prefix: string): void {
|
|
for (const keyword of ["allOf", "anyOf", "oneOf"] as const) {
|
|
const branches = node[keyword];
|
|
if (!Array.isArray(branches)) continue;
|
|
for (const branch of branches) {
|
|
if (!branch || typeof branch !== "object" || Array.isArray(branch)) continue;
|
|
walk(branch as Record<string, unknown>, prefix);
|
|
}
|
|
}
|
|
|
|
const properties = node.properties as Record<string, Record<string, unknown>> | undefined;
|
|
if (!properties || typeof properties !== "object") return;
|
|
for (const [key, propertySchema] of Object.entries(properties)) {
|
|
if (!propertySchema || typeof propertySchema !== "object") continue;
|
|
const path = prefix ? `${prefix}.${key}` : key;
|
|
if (propertySchema.format === "secret-ref") {
|
|
paths.add(path);
|
|
}
|
|
walk(propertySchema, path);
|
|
}
|
|
}
|
|
|
|
walk(schema, "");
|
|
return paths;
|
|
}
|
|
|
|
export function readConfigValueAtPath(
|
|
config: Record<string, unknown>,
|
|
dotPath: string,
|
|
): unknown {
|
|
let current: unknown = config;
|
|
for (const key of dotPath.split(".")) {
|
|
if (!current || typeof current !== "object" || Array.isArray(current)) {
|
|
return undefined;
|
|
}
|
|
current = (current as Record<string, unknown>)[key];
|
|
}
|
|
return current;
|
|
}
|
|
|
|
export function writeConfigValueAtPath(
|
|
config: Record<string, unknown>,
|
|
dotPath: string,
|
|
value: unknown,
|
|
): Record<string, unknown> {
|
|
const result = structuredClone(config) as Record<string, unknown>;
|
|
const keys = dotPath.split(".");
|
|
let cursor: Record<string, unknown> = result;
|
|
|
|
for (let index = 0; index < keys.length - 1; index += 1) {
|
|
const key = keys[index]!;
|
|
const next = cursor[key];
|
|
if (!next || typeof next !== "object" || Array.isArray(next)) {
|
|
cursor[key] = {};
|
|
}
|
|
cursor = cursor[key] as Record<string, unknown>;
|
|
}
|
|
|
|
const leafKey = keys[keys.length - 1]!;
|
|
if (value === undefined) {
|
|
delete cursor[leafKey];
|
|
} else {
|
|
cursor[leafKey] = value;
|
|
}
|
|
return result;
|
|
}
|