paperclip/server/src/services
Dotta f0ddd24d61
[codex] Show bundled plugins in plugin manager (#6734)
## Thinking Path

> - Paperclip orchestrates AI agents for zero-human companies.
> - The plugin system is how Paperclip exposes optional capabilities and
integrations without bloating the control plane.
> - Operators need the Instance Settings plugin manager to show both
installed external plugins and bundled built-in plugins.
> - Bundled plugins were available in the server/UI surface but were not
represented consistently in the plugin manager list.
> - Workspace runtime reuse also needed to stay pinned to the current
branch/base so the plugin manager can be validated from the intended
checkout.
> - This pull request shows bundled plugins in the manager, marks
experimental bundled plugins clearly, and tightens runtime/worktree
reuse guards.
> - The benefit is that operators can discover bundled plugins from the
same management screen as installed plugins without stale workspace
sessions hiding the latest branch state.

## What Changed

- Lists bundled monorepo plugin packages through the plugin routes API,
including plugin status and install metadata needed by the UI.
- Updates the plugin manager UI/API client to render bundled plugins and
display experimental badges based on installed plugin records.
- Adds server authorization coverage around plugin routes so board and
agent access stay company-scoped.
- Guards execution workspace/runtime reuse against stale base refs and
defaults new worktrees to the fetched target base.
- Expands workspace runtime tests for service reuse, stale workspace
prevention, and controlled runtime stops.
- Addressed Greptile feedback by respecting `origin/HEAD`, using async
cached bundled-plugin discovery, and avoiding duplicated UI experimental
plugin lists.

## Verification

- `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/workspace-runtime.test.ts
server/src/__tests__/heartbeat-workspace-session.test.ts`
- `pnpm --filter @paperclipai/ui typecheck`
- `pnpm --filter @paperclipai/plugin-sdk build && pnpm --filter
@paperclipai/server typecheck`
- `pnpm --filter @paperclipai/server typecheck`
- `gh pr checks 6734 --repo paperclipai/paperclip` reports all checks
passing on `10e1ba9e0f505637cd913713fb28c2c99ae92011`.
- Greptile Review reports 5/5 on
`10e1ba9e0f505637cd913713fb28c2c99ae92011`.
- Confirmed the branch is rebased onto `public-gh/master` and the PR
diff does not include `pnpm-lock.yaml` or `.github/workflows` changes.
- UI screenshots were not captured in this PR-creation pass because the
available local board runtime is authenticated; the visible UI path is
covered by the plugin manager code changes and server/API tests above.

## Risks

- Medium risk: this touches shared plugin listing behavior and workspace
runtime reuse, so regressions could affect plugin manager visibility or
service reuse across execution workspaces.
- No database migrations.
- No lockfile or GitHub workflow changes.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

- OpenAI GPT-5 Codex, coding-agent workflow with shell/tool use in a
local Paperclip worktree. Context window not surfaced by the runtime;
reasoning mode not externally reported.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-05-26 07:32:45 -06:00
..
recovery Guard cheap recovery model usage (#6371) 2026-05-19 13:46:02 -05:00
access.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
activity-log.ts [codex] Add plugin orchestration host APIs (#4114) 2026-04-20 08:52:51 -05:00
activity.ts Add sandbox environment support (#4415) 2026-04-24 12:15:53 -07:00
adapter-plugin-store.ts [codex] Add runtime lifecycle recovery and live issue visibility (#4419) 2026-04-24 15:50:32 -05:00
agent-instructions.ts chore: mark bootstrapPromptTemplate as deprecated 2026-03-26 11:12:25 -05:00
agent-permissions.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
agent-start-lock.ts [codex] Add runtime lifecycle recovery and live issue visibility (#4419) 2026-04-24 15:50:32 -05:00
agents.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
approvals.ts Add username log censor setting 2026-03-20 08:50:00 -05:00
assets.ts refactor: rename packages to @paperclipai and CLI binary to paperclipai 2026-03-03 08:45:26 -06:00
authorization.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
board-auth.ts feat: implement multi-user access and invite flows (#3784) 2026-04-17 09:44:19 -05:00
budgets.ts Sync/master post pap1497 followups 2026 04 15 (#3779) 2026-04-15 21:13:56 -05:00
cloud-upstreams.ts [codex] Bundle local branch fixes from PAP-10032 (#6604) 2026-05-25 07:25:26 -05:00
companies.ts Fix wrapped company issue prefix conflicts (#6423) 2026-05-22 15:27:54 -05:00
company-export-readme.ts fix: link Agent Company to agentcompanies.io in export README 2026-03-20 08:06:04 -05:00
company-member-roles.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
company-portability.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
company-search-rate-limit.ts Add full company search page (#5293) 2026-05-06 06:32:37 -05:00
company-search.ts Add full company search page (#5293) 2026-05-06 06:32:37 -05:00
company-skills.ts [codex] Reject stale company skill refreshes (#4601) 2026-04-27 13:19:38 -05:00
costs.ts Improve operator workflow QoL (#5291) 2026-05-06 06:30:44 -05:00
cron.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
dashboard.ts [codex] Harden heartbeat scheduling and runtime controls (#4223) 2026-04-21 12:24:11 -05:00
default-agent-instructions.ts Add default agent instructions bundle 2026-03-20 07:42:36 -05:00
documents.ts [codex] Add issue document locking (#6009) 2026-05-15 08:54:55 -05:00
environment-config.ts Add secrets provider vaults and remote import (#5429) 2026-05-09 18:22:17 -05:00
environment-execution-target.ts Fix exe.dev sandbox installs for gemini/opencode local adapters (#5737) 2026-05-11 14:28:22 -07:00
environment-probe.ts Add sandbox environment support (#4415) 2026-04-24 12:15:53 -07:00
environment-run-orchestrator.ts Add sandbox callback bridge for remote environment API access (#4801) 2026-04-29 16:37:34 -07:00
environment-runtime.ts Add Cloudflare sandbox provider plugin (#5687) 2026-05-11 07:33:13 -07:00
environments.ts Add sandbox environment support (#4415) 2026-04-24 12:15:53 -07:00
execution-workspace-policy.ts Add SSH environment support (#4358) 2026-04-23 19:15:22 -07:00
execution-workspaces.ts [codex] Bundle local branch fixes from PAP-10032 (#6604) 2026-05-25 07:25:26 -05:00
feedback-redaction.ts Add feedback voting and thumbs capture flow 2026-04-02 09:11:49 -05:00
feedback-share-client.ts Restore feedback trace export fixes 2026-04-03 15:59:42 -05:00
feedback.ts Add recovery handoff system notices (#5289) 2026-05-06 06:05:58 -05:00
finance.ts Sync/master post pap1497 followups 2026 04 15 (#3779) 2026-04-15 21:13:56 -05:00
github-fetch.ts fix: harden GHE URL detection and extract shared GitHub helpers 2026-04-01 21:05:48 +00:00
goals.ts Improve onboarding defaults and issue goal fallback 2026-03-12 08:50:31 -05:00
heartbeat-run-summary.ts [codex] Add run liveness continuations (#4083) 2026-04-20 06:01:49 -05:00
heartbeat-stop-metadata.test.ts [codex] Retry max-turn exhausted heartbeats (#5096) 2026-05-03 11:30:48 -05:00
heartbeat-stop-metadata.ts [codex] Retry max-turn exhausted heartbeats (#5096) 2026-05-03 11:30:48 -05:00
heartbeat.ts [codex] Show bundled plugins in plugin manager (#6734) 2026-05-26 07:32:45 -06:00
hire-hook.ts fix(adapters): honor paused overrides and isolate UI parser state 2026-04-04 14:04:33 -05:00
inbox-dismissals.ts Persist non-issue inbox dismissals 2026-04-09 06:16:05 -05:00
index.ts [codex] Add resource membership controls (#6677) 2026-05-25 13:12:41 -05:00
instance-settings.ts [codex] Add local Cloud Upstream sync (#6548) 2026-05-22 09:56:22 -05:00
invite-grants.ts feat: implement multi-user access and invite flows (#3784) 2026-04-17 09:44:19 -05:00
issue-approvals.ts refactor: rename packages to @paperclipai and CLI binary to paperclipai 2026-03-03 08:45:26 -06:00
issue-assignment-wakeup.ts fix: close remaining routine merge blockers 2026-03-20 16:40:27 -05:00
issue-continuation-summary.ts fix: harden release registry verification against npm lag (#4816) 2026-05-09 22:18:12 -07:00
issue-execution-policy.ts [codex] Add issue monitor liveness controls (#4988) 2026-05-03 08:58:53 -05:00
issue-goal-fallback.ts Seed onboarding project and issue goal context 2026-03-24 11:48:59 -05:00
issue-liveness.ts [codex] Add runtime lifecycle recovery and live issue visibility (#4419) 2026-04-24 15:50:32 -05:00
issue-recovery-actions.ts [codex] Add source-scoped recovery actions (#5599) 2026-05-12 09:37:15 -05:00
issue-references.ts Add first-class issue references (#4214) 2026-04-21 10:02:52 -05:00
issue-thread-interactions.test.ts [codex] Add structured issue-thread interactions (#4244) 2026-04-21 20:15:11 -05:00
issue-thread-interactions.ts [codex] Runtime control-plane fixes (#6380) 2026-05-20 10:37:11 -05:00
issue-tree-control.ts [codex] Split backend control-plane QoL slice (#4700) 2026-04-28 16:46:45 -05:00
issues.ts [codex] Harden plugin runtime invocation scope (#6547) 2026-05-22 09:16:24 -05:00
json-schema-secret-refs.ts Generalize sandbox provider core for plugin-only providers (#4449) 2026-04-24 18:03:41 -07:00
live-events.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
local-service-supervisor.ts fix: harden heartbeat and adapter runtime workflows 2026-04-10 22:26:21 -05:00
plugin-capability-validator.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
plugin-config-validator.ts Refactor secret-ref format registration to use a UI hint for Paperclip secret UUIDs 2026-03-14 15:43:56 -07:00
plugin-database.ts Fix LLM Wiki package and migration validation (#6010) 2026-05-15 10:20:02 -05:00
plugin-dev-watcher.ts [codex] Improve local plugin development workflow (#5821) 2026-05-12 17:38:24 -05:00
plugin-environment-driver.ts fix(plugin): raise environmentProbe RPC timeout to 120s for cold-start sandboxes (#6289) 2026-05-18 09:32:12 -07:00
plugin-event-bus.ts Simplify plugin runtime and cleanup lifecycle 2026-03-13 16:58:29 -05:00
plugin-host-service-cleanup.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-host-services.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
plugin-job-coordinator.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-job-scheduler.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-job-store.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-lifecycle.ts [codex] Runtime control-plane fixes (#6380) 2026-05-20 10:37:11 -05:00
plugin-loader.ts fix(remote-sandbox): harden host workspace resumes (#5922) 2026-05-13 16:23:04 -05:00
plugin-local-folders.ts [codex] Roll up May 17 branch changes (#6210) 2026-05-17 17:15:06 -05:00
plugin-log-retention.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-managed-agents.ts [codex] Add LLM Wiki plugin host support (#5597) 2026-05-10 07:34:12 -05:00
plugin-managed-routines.ts Expand plugin host surface (#5205) 2026-05-05 07:42:57 -05:00
plugin-managed-skills.ts [codex] Add LLM Wiki plugin host support (#5597) 2026-05-10 07:34:12 -05:00
plugin-manifest-validator.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-registry.ts Expand plugin host surface (#5205) 2026-05-05 07:42:57 -05:00
plugin-runtime-sandbox.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-secrets-handler.ts Add secrets provider vaults and remote import (#5429) 2026-05-09 18:22:17 -05:00
plugin-state-store.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-stream-bus.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-tool-dispatcher.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-tool-registry.ts Add plugin framework and settings UI 2026-03-13 16:22:34 -05:00
plugin-worker-manager.ts [codex] Bundle local branch fixes from PAP-10032 (#6604) 2026-05-25 07:25:26 -05:00
principal-access-compatibility.ts [codex] Add agent permissions and controls plan (#6386) 2026-05-22 08:12:52 -05:00
productivity-review.ts Guard cheap recovery model usage (#6371) 2026-05-19 13:46:02 -05:00
project-workspace-runtime-config.ts [codex] Respect manual workspace runtime controls (#4125) 2026-04-20 10:39:37 -05:00
projects.ts Expand plugin host surface (#5205) 2026-05-05 07:42:57 -05:00
quota-windows.ts feat(costs): add billing, quota, and budget control plane 2026-03-16 15:11:01 -05:00
resource-memberships.ts [codex] Add resource membership controls (#6677) 2026-05-25 13:12:41 -05:00
routines.ts [codex] Add routine env secrets support (#6212) 2026-05-17 16:30:34 -05:00
run-continuations.ts [codex] Add runtime lifecycle recovery and live issue visibility (#4419) 2026-04-24 15:50:32 -05:00
run-liveness.ts [codex] Add runtime lifecycle recovery and live issue visibility (#4419) 2026-04-24 15:50:32 -05:00
run-log-store.ts [codex] Add runtime lifecycle recovery and live issue visibility (#4419) 2026-04-24 15:50:32 -05:00
sandbox-provider-runtime.ts Generalize sandbox provider core for plugin-only providers (#4449) 2026-04-24 18:03:41 -07:00
secrets.ts [codex] Provider vault secrets UX (#6381) 2026-05-19 15:50:23 -05:00
session-workspace-cwd.test.ts fix(remote-sandbox): harden host workspace resumes (#5922) 2026-05-13 16:23:04 -05:00
session-workspace-cwd.ts fix(remote-sandbox): harden host workspace resumes (#5922) 2026-05-13 16:23:04 -05:00
sidebar-badges.ts Persist non-issue inbox dismissals 2026-04-09 06:16:05 -05:00
sidebar-preferences.ts [codex] Improve workspace runtime and navigation ergonomics (#3680) 2026-04-14 12:57:11 -05:00
work-products.ts Address remaining Greptile workspace review 2026-03-17 10:12:44 -05:00
workspace-operation-log-store.ts Add workspace operation tracking and fix project properties JSX 2026-03-17 09:36:35 -05:00
workspace-operations.ts [codex] Improve agent runtime recovery and governance (#4086) 2026-04-20 06:19:48 -05:00
workspace-realization.ts Add sandbox environment support (#4415) 2026-04-24 12:15:53 -07:00
workspace-runtime-read-model.ts Fix workspace runtime state reconciliation 2026-04-04 17:48:54 -05:00
workspace-runtime.ts [codex] Show bundled plugins in plugin manager (#6734) 2026-05-26 07:32:45 -06:00