forked from farhoodlabs/paperclip
5bd0f578fd
## Thinking Path > - Paperclip is a control plane, so optional execution providers should sit at the plugin edge instead of hardcoding provider-specific behavior into core shared/server/ui layers. > - Sandbox environments are already first-class, and the fake provider proves the built-in path; the remaining gap was that real providers still leaked provider-specific config and runtime assumptions into core. > - That coupling showed up in config normalization, secret persistence, capabilities reporting, lease reconstruction, and the board UI form fields. > - As long as core knew about those provider-shaped details, shipping a provider as a pure third-party plugin meant every new provider would still require host changes. > - This pull request generalizes the sandbox provider seam around schema-driven plugin metadata and generic secret-ref handling. > - The runtime and UI now consume provider metadata generically, so core only special-cases the built-in fake provider while third-party providers can live entirely in plugins. ## What Changed - Added generic sandbox-provider capability metadata so plugin-backed providers can expose `configSchema` through shared environment support and the environments capabilities API. - Reworked sandbox config normalization/persistence/runtime resolution to handle schema-declared secret-ref fields generically, storing them as Paperclip secrets and resolving them for probe/execute/release flows. - Generalized plugin sandbox runtime handling so provider validation, reusable-lease matching, lease reconstruction, and plugin worker calls all operate on provider-agnostic config instead of provider-shaped branches. - Replaced hardcoded sandbox provider form fields in Company Settings with schema-driven rendering and blocked agent environment selection from the built-in fake provider. - Added regression coverage for the generic seam across shared support helpers plus environment config, probe, routes, runtime, and sandbox-provider runtime tests. ## Verification - `pnpm vitest --run packages/shared/src/environment-support.test.ts server/src/__tests__/environment-config.test.ts server/src/__tests__/environment-probe.test.ts server/src/__tests__/environment-routes.test.ts server/src/__tests__/environment-runtime.test.ts server/src/__tests__/sandbox-provider-runtime.test.ts` - `pnpm -r typecheck` ## Risks - Plugin sandbox providers now depend more heavily on accurate `configSchema` declarations; incorrect schemas can misclassify secret-bearing fields or omit required config. - Reusable lease matching is now metadata-driven for plugin-backed providers, so providers that fail to persist stable metadata may reprovision instead of resuming an existing lease. - The UI form is now fully schema-driven for plugin-backed sandbox providers; provider manifests without good defaults or descriptions may produce a rougher operator experience. ## Model Used - OpenAI Codex via `codex_local` - Model ID: `gpt-5.4` - Reasoning effort: `high` - Context window observed in runtime session metadata: `258400` tokens - Capabilities used: terminal tool execution, git, and local code/test inspection ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [ ] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge
249 lines
7.2 KiB
TypeScript
249 lines
7.2 KiB
TypeScript
import { beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
const mockEnsureSshWorkspaceReady = vi.hoisted(() => vi.fn());
|
|
const mockProbePluginEnvironmentDriver = vi.hoisted(() => vi.fn());
|
|
const mockProbePluginSandboxProviderDriver = vi.hoisted(() => vi.fn());
|
|
const mockResolvePluginSandboxProviderDriverByKey = vi.hoisted(() => vi.fn());
|
|
|
|
vi.mock("@paperclipai/adapter-utils/ssh", () => ({
|
|
ensureSshWorkspaceReady: mockEnsureSshWorkspaceReady,
|
|
}));
|
|
|
|
vi.mock("../services/plugin-environment-driver.js", () => ({
|
|
probePluginEnvironmentDriver: mockProbePluginEnvironmentDriver,
|
|
probePluginSandboxProviderDriver: mockProbePluginSandboxProviderDriver,
|
|
resolvePluginSandboxProviderDriverByKey: mockResolvePluginSandboxProviderDriverByKey,
|
|
}));
|
|
|
|
import { probeEnvironment } from "../services/environment-probe.ts";
|
|
|
|
describe("probeEnvironment", () => {
|
|
beforeEach(() => {
|
|
mockEnsureSshWorkspaceReady.mockReset();
|
|
mockProbePluginEnvironmentDriver.mockReset();
|
|
mockProbePluginSandboxProviderDriver.mockReset();
|
|
mockResolvePluginSandboxProviderDriverByKey.mockReset();
|
|
mockResolvePluginSandboxProviderDriverByKey.mockResolvedValue(null);
|
|
});
|
|
|
|
it("reports local environments as immediately available", async () => {
|
|
const result = await probeEnvironment({} as any, {
|
|
id: "env-1",
|
|
companyId: "company-1",
|
|
name: "Local",
|
|
description: null,
|
|
driver: "local",
|
|
status: "active",
|
|
config: {},
|
|
metadata: null,
|
|
createdAt: new Date(),
|
|
updatedAt: new Date(),
|
|
});
|
|
|
|
expect(result.ok).toBe(true);
|
|
expect(result.driver).toBe("local");
|
|
expect(result.summary).toContain("Local environment");
|
|
expect(mockEnsureSshWorkspaceReady).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("runs an SSH probe and returns the verified remote cwd", async () => {
|
|
mockEnsureSshWorkspaceReady.mockResolvedValue({
|
|
remoteCwd: "/srv/paperclip/workspace",
|
|
});
|
|
|
|
const result = await probeEnvironment({} as any, {
|
|
id: "env-ssh",
|
|
companyId: "company-1",
|
|
name: "SSH Fixture",
|
|
description: null,
|
|
driver: "ssh",
|
|
status: "active",
|
|
config: {
|
|
host: "ssh.example.test",
|
|
port: 2222,
|
|
username: "ssh-user",
|
|
remoteWorkspacePath: "/srv/paperclip/workspace",
|
|
privateKey: null,
|
|
privateKeySecretRef: null,
|
|
knownHosts: null,
|
|
strictHostKeyChecking: true,
|
|
},
|
|
metadata: null,
|
|
createdAt: new Date(),
|
|
updatedAt: new Date(),
|
|
});
|
|
|
|
expect(result).toEqual({
|
|
ok: true,
|
|
driver: "ssh",
|
|
summary: "Connected to ssh-user@ssh.example.test and verified the remote workspace path.",
|
|
details: {
|
|
host: "ssh.example.test",
|
|
port: 2222,
|
|
username: "ssh-user",
|
|
remoteWorkspacePath: "/srv/paperclip/workspace",
|
|
remoteCwd: "/srv/paperclip/workspace",
|
|
},
|
|
});
|
|
expect(mockEnsureSshWorkspaceReady).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
it("reports fake sandbox environments as ready without external calls", async () => {
|
|
const result = await probeEnvironment({} as any, {
|
|
id: "env-sandbox",
|
|
companyId: "company-1",
|
|
name: "Fake Sandbox",
|
|
description: null,
|
|
driver: "sandbox",
|
|
status: "active",
|
|
config: {
|
|
provider: "fake",
|
|
image: "ubuntu:24.04",
|
|
reuseLease: true,
|
|
},
|
|
metadata: null,
|
|
createdAt: new Date(),
|
|
updatedAt: new Date(),
|
|
});
|
|
|
|
expect(result).toEqual({
|
|
ok: true,
|
|
driver: "sandbox",
|
|
summary: "Fake sandbox provider is ready for image ubuntu:24.04.",
|
|
details: {
|
|
provider: "fake",
|
|
image: "ubuntu:24.04",
|
|
reuseLease: true,
|
|
},
|
|
});
|
|
expect(mockEnsureSshWorkspaceReady).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("routes plugin-backed sandbox provider probes through plugin workers", async () => {
|
|
mockProbePluginSandboxProviderDriver.mockResolvedValue({
|
|
ok: true,
|
|
driver: "sandbox",
|
|
summary: "Fake plugin probe passed.",
|
|
details: {
|
|
provider: "fake-plugin",
|
|
metadata: { ready: true },
|
|
},
|
|
});
|
|
const workerManager = {} as any;
|
|
|
|
const result = await probeEnvironment({} as any, {
|
|
id: "env-sandbox-plugin",
|
|
companyId: "company-1",
|
|
name: "Fake Plugin Sandbox",
|
|
description: null,
|
|
driver: "sandbox",
|
|
status: "active",
|
|
config: {
|
|
provider: "fake-plugin",
|
|
image: "fake:test",
|
|
reuseLease: false,
|
|
},
|
|
metadata: null,
|
|
createdAt: new Date(),
|
|
updatedAt: new Date(),
|
|
}, { pluginWorkerManager: workerManager });
|
|
|
|
expect(result.ok).toBe(true);
|
|
expect(mockProbePluginSandboxProviderDriver).toHaveBeenCalledWith({
|
|
db: expect.anything(),
|
|
workerManager,
|
|
companyId: "company-1",
|
|
environmentId: "env-sandbox-plugin",
|
|
provider: "fake-plugin",
|
|
config: {
|
|
provider: "fake-plugin",
|
|
image: "fake:test",
|
|
reuseLease: false,
|
|
},
|
|
});
|
|
});
|
|
|
|
it("routes plugin environment probes through the plugin worker host", async () => {
|
|
mockProbePluginEnvironmentDriver.mockResolvedValue({
|
|
ok: true,
|
|
driver: "plugin",
|
|
summary: "Plugin probe passed.",
|
|
details: {
|
|
metadata: { ready: true },
|
|
},
|
|
});
|
|
const workerManager = {} as any;
|
|
|
|
const result = await probeEnvironment({} as any, {
|
|
id: "env-plugin",
|
|
companyId: "company-1",
|
|
name: "Plugin Sandbox",
|
|
description: null,
|
|
driver: "plugin",
|
|
status: "active",
|
|
config: {
|
|
pluginKey: "acme.environments",
|
|
driverKey: "sandbox",
|
|
driverConfig: { template: "base" },
|
|
},
|
|
metadata: null,
|
|
createdAt: new Date(),
|
|
updatedAt: new Date(),
|
|
}, { pluginWorkerManager: workerManager });
|
|
|
|
expect(result.ok).toBe(true);
|
|
expect(mockProbePluginEnvironmentDriver).toHaveBeenCalledWith({
|
|
db: expect.anything(),
|
|
workerManager,
|
|
companyId: "company-1",
|
|
environmentId: "env-plugin",
|
|
config: {
|
|
pluginKey: "acme.environments",
|
|
driverKey: "sandbox",
|
|
driverConfig: { template: "base" },
|
|
},
|
|
});
|
|
});
|
|
|
|
it("captures SSH probe failures without throwing", async () => {
|
|
mockEnsureSshWorkspaceReady.mockRejectedValue(
|
|
Object.assign(new Error("Permission denied"), {
|
|
code: 255,
|
|
stdout: "",
|
|
stderr: "Permission denied (publickey).",
|
|
}),
|
|
);
|
|
|
|
const result = await probeEnvironment({} as any, {
|
|
id: "env-ssh",
|
|
companyId: "company-1",
|
|
name: "SSH Fixture",
|
|
description: null,
|
|
driver: "ssh",
|
|
status: "active",
|
|
config: {
|
|
host: "ssh.example.test",
|
|
port: 22,
|
|
username: "ssh-user",
|
|
remoteWorkspacePath: "/srv/paperclip/workspace",
|
|
privateKey: null,
|
|
privateKeySecretRef: null,
|
|
knownHosts: null,
|
|
strictHostKeyChecking: true,
|
|
},
|
|
metadata: null,
|
|
createdAt: new Date(),
|
|
updatedAt: new Date(),
|
|
});
|
|
|
|
expect(result.ok).toBe(false);
|
|
expect(result.summary).toContain("SSH probe failed");
|
|
expect(result.details).toEqual(
|
|
expect.objectContaining({
|
|
error: "Permission denied (publickey).",
|
|
code: 255,
|
|
}),
|
|
);
|
|
});
|
|
});
|