Files
paperclip/packages/shared/src/environment-support.ts
T
Devin Foley 5bd0f578fd Generalize sandbox provider core for plugin-only providers (#4449)
## Thinking Path

> - Paperclip is a control plane, so optional execution providers should
sit at the plugin edge instead of hardcoding provider-specific behavior
into core shared/server/ui layers.
> - Sandbox environments are already first-class, and the fake provider
proves the built-in path; the remaining gap was that real providers
still leaked provider-specific config and runtime assumptions into core.
> - That coupling showed up in config normalization, secret persistence,
capabilities reporting, lease reconstruction, and the board UI form
fields.
> - As long as core knew about those provider-shaped details, shipping a
provider as a pure third-party plugin meant every new provider would
still require host changes.
> - This pull request generalizes the sandbox provider seam around
schema-driven plugin metadata and generic secret-ref handling.
> - The runtime and UI now consume provider metadata generically, so
core only special-cases the built-in fake provider while third-party
providers can live entirely in plugins.

## What Changed

- Added generic sandbox-provider capability metadata so plugin-backed
providers can expose `configSchema` through shared environment support
and the environments capabilities API.
- Reworked sandbox config normalization/persistence/runtime resolution
to handle schema-declared secret-ref fields generically, storing them as
Paperclip secrets and resolving them for probe/execute/release flows.
- Generalized plugin sandbox runtime handling so provider validation,
reusable-lease matching, lease reconstruction, and plugin worker calls
all operate on provider-agnostic config instead of provider-shaped
branches.
- Replaced hardcoded sandbox provider form fields in Company Settings
with schema-driven rendering and blocked agent environment selection
from the built-in fake provider.
- Added regression coverage for the generic seam across shared support
helpers plus environment config, probe, routes, runtime, and
sandbox-provider runtime tests.

## Verification

- `pnpm vitest --run packages/shared/src/environment-support.test.ts
server/src/__tests__/environment-config.test.ts
server/src/__tests__/environment-probe.test.ts
server/src/__tests__/environment-routes.test.ts
server/src/__tests__/environment-runtime.test.ts
server/src/__tests__/sandbox-provider-runtime.test.ts`
- `pnpm -r typecheck`

## Risks

- Plugin sandbox providers now depend more heavily on accurate
`configSchema` declarations; incorrect schemas can misclassify
secret-bearing fields or omit required config.
- Reusable lease matching is now metadata-driven for plugin-backed
providers, so providers that fail to persist stable metadata may
reprovision instead of resuming an existing lease.
- The UI form is now fully schema-driven for plugin-backed sandbox
providers; provider manifests without good defaults or descriptions may
produce a rougher operator experience.

## Model Used

- OpenAI Codex via `codex_local`
- Model ID: `gpt-5.4`
- Reasoning effort: `high`
- Context window observed in runtime session metadata: `258400` tokens
- Capabilities used: terminal tool execution, git, and local code/test
inspection

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-04-24 18:03:41 -07:00

149 lines
5.1 KiB
TypeScript

import type { AgentAdapterType, EnvironmentDriver } from "./constants.js";
import type { SandboxEnvironmentProvider } from "./types/environment.js";
import type { JsonSchema } from "./types/plugin.js";
export type EnvironmentSupportStatus = "supported" | "unsupported";
export interface AdapterEnvironmentSupport {
adapterType: AgentAdapterType;
drivers: Record<EnvironmentDriver, EnvironmentSupportStatus>;
sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentSupportStatus>;
}
export interface EnvironmentProviderCapability {
status: EnvironmentSupportStatus;
supportsSavedProbe: boolean;
supportsUnsavedProbe: boolean;
supportsRunExecution: boolean;
supportsReusableLeases: boolean;
displayName?: string;
description?: string;
source?: "builtin" | "plugin";
pluginKey?: string;
pluginId?: string;
configSchema?: JsonSchema;
}
export interface EnvironmentCapabilities {
adapters: AdapterEnvironmentSupport[];
drivers: Record<EnvironmentDriver, EnvironmentSupportStatus>;
sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentProviderCapability>;
}
const REMOTE_MANAGED_ADAPTERS = new Set<AgentAdapterType>([
"claude_local",
"codex_local",
"cursor",
"gemini_local",
"opencode_local",
"pi_local",
]);
export function adapterSupportsRemoteManagedEnvironments(adapterType: string): boolean {
return REMOTE_MANAGED_ADAPTERS.has(adapterType as AgentAdapterType);
}
export function supportedEnvironmentDriversForAdapter(adapterType: string): EnvironmentDriver[] {
return adapterSupportsRemoteManagedEnvironments(adapterType)
? ["local", "ssh", "sandbox"]
: ["local"];
}
export function supportedSandboxProvidersForAdapter(
adapterType: string,
additionalProviders: readonly string[] = [],
): SandboxEnvironmentProvider[] {
return adapterSupportsRemoteManagedEnvironments(adapterType)
? Array.from(new Set(additionalProviders)) as SandboxEnvironmentProvider[]
: [];
}
export function isEnvironmentDriverSupportedForAdapter(
adapterType: string,
driver: string,
): boolean {
return supportedEnvironmentDriversForAdapter(adapterType).includes(driver as EnvironmentDriver);
}
export function isSandboxProviderSupportedForAdapter(
adapterType: string,
provider: string | null | undefined,
additionalProviders: readonly string[] = [],
): boolean {
if (!provider) return false;
return supportedSandboxProvidersForAdapter(adapterType, additionalProviders).includes(
provider as SandboxEnvironmentProvider,
);
}
export function getAdapterEnvironmentSupport(
adapterType: AgentAdapterType,
additionalSandboxProviders: readonly string[] = [],
): AdapterEnvironmentSupport {
const supportedDrivers = new Set(supportedEnvironmentDriversForAdapter(adapterType));
const supportedProviders = new Set(supportedSandboxProvidersForAdapter(adapterType, additionalSandboxProviders));
const sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentSupportStatus> = {
fake: "unsupported",
};
for (const provider of additionalSandboxProviders) {
sandboxProviders[provider as SandboxEnvironmentProvider] = supportedProviders.has(provider as SandboxEnvironmentProvider)
? "supported"
: "unsupported";
}
return {
adapterType,
drivers: {
local: supportedDrivers.has("local") ? "supported" : "unsupported",
ssh: supportedDrivers.has("ssh") ? "supported" : "unsupported",
sandbox: supportedDrivers.has("sandbox") ? "supported" : "unsupported",
plugin: supportedDrivers.has("plugin") ? "supported" : "unsupported",
},
sandboxProviders,
};
}
export function getEnvironmentCapabilities(
adapterTypes: readonly AgentAdapterType[],
options: {
sandboxProviders?: Record<string, Partial<EnvironmentProviderCapability>>;
} = {},
): EnvironmentCapabilities {
const pluginProviderKeys = Object.keys(options.sandboxProviders ?? {});
const sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentProviderCapability> = {
fake: {
status: "unsupported",
supportsSavedProbe: true,
supportsUnsavedProbe: true,
supportsRunExecution: false,
supportsReusableLeases: true,
displayName: "Fake",
source: "builtin",
},
};
for (const [provider, capability] of Object.entries(options.sandboxProviders ?? {})) {
sandboxProviders[provider as SandboxEnvironmentProvider] = {
status: capability.status ?? "supported",
supportsSavedProbe: capability.supportsSavedProbe ?? true,
supportsUnsavedProbe: capability.supportsUnsavedProbe ?? true,
supportsRunExecution: capability.supportsRunExecution ?? true,
supportsReusableLeases: capability.supportsReusableLeases ?? true,
displayName: capability.displayName,
description: capability.description,
source: capability.source ?? "plugin",
pluginKey: capability.pluginKey,
pluginId: capability.pluginId,
configSchema: capability.configSchema,
};
}
return {
adapters: adapterTypes.map((adapterType) => getAdapterEnvironmentSupport(adapterType, pluginProviderKeys)),
drivers: {
local: "supported",
ssh: "supported",
sandbox: "supported",
plugin: "unsupported",
},
sandboxProviders,
};
}