5bd0f578fd
## Thinking Path > - Paperclip is a control plane, so optional execution providers should sit at the plugin edge instead of hardcoding provider-specific behavior into core shared/server/ui layers. > - Sandbox environments are already first-class, and the fake provider proves the built-in path; the remaining gap was that real providers still leaked provider-specific config and runtime assumptions into core. > - That coupling showed up in config normalization, secret persistence, capabilities reporting, lease reconstruction, and the board UI form fields. > - As long as core knew about those provider-shaped details, shipping a provider as a pure third-party plugin meant every new provider would still require host changes. > - This pull request generalizes the sandbox provider seam around schema-driven plugin metadata and generic secret-ref handling. > - The runtime and UI now consume provider metadata generically, so core only special-cases the built-in fake provider while third-party providers can live entirely in plugins. ## What Changed - Added generic sandbox-provider capability metadata so plugin-backed providers can expose `configSchema` through shared environment support and the environments capabilities API. - Reworked sandbox config normalization/persistence/runtime resolution to handle schema-declared secret-ref fields generically, storing them as Paperclip secrets and resolving them for probe/execute/release flows. - Generalized plugin sandbox runtime handling so provider validation, reusable-lease matching, lease reconstruction, and plugin worker calls all operate on provider-agnostic config instead of provider-shaped branches. - Replaced hardcoded sandbox provider form fields in Company Settings with schema-driven rendering and blocked agent environment selection from the built-in fake provider. - Added regression coverage for the generic seam across shared support helpers plus environment config, probe, routes, runtime, and sandbox-provider runtime tests. ## Verification - `pnpm vitest --run packages/shared/src/environment-support.test.ts server/src/__tests__/environment-config.test.ts server/src/__tests__/environment-probe.test.ts server/src/__tests__/environment-routes.test.ts server/src/__tests__/environment-runtime.test.ts server/src/__tests__/sandbox-provider-runtime.test.ts` - `pnpm -r typecheck` ## Risks - Plugin sandbox providers now depend more heavily on accurate `configSchema` declarations; incorrect schemas can misclassify secret-bearing fields or omit required config. - Reusable lease matching is now metadata-driven for plugin-backed providers, so providers that fail to persist stable metadata may reprovision instead of resuming an existing lease. - The UI form is now fully schema-driven for plugin-backed sandbox providers; provider manifests without good defaults or descriptions may produce a rougher operator experience. ## Model Used - OpenAI Codex via `codex_local` - Model ID: `gpt-5.4` - Reasoning effort: `high` - Context window observed in runtime session metadata: `258400` tokens - Capabilities used: terminal tool execution, git, and local code/test inspection ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [ ] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge
149 lines
5.1 KiB
TypeScript
149 lines
5.1 KiB
TypeScript
import type { AgentAdapterType, EnvironmentDriver } from "./constants.js";
|
|
import type { SandboxEnvironmentProvider } from "./types/environment.js";
|
|
import type { JsonSchema } from "./types/plugin.js";
|
|
|
|
export type EnvironmentSupportStatus = "supported" | "unsupported";
|
|
|
|
export interface AdapterEnvironmentSupport {
|
|
adapterType: AgentAdapterType;
|
|
drivers: Record<EnvironmentDriver, EnvironmentSupportStatus>;
|
|
sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentSupportStatus>;
|
|
}
|
|
|
|
export interface EnvironmentProviderCapability {
|
|
status: EnvironmentSupportStatus;
|
|
supportsSavedProbe: boolean;
|
|
supportsUnsavedProbe: boolean;
|
|
supportsRunExecution: boolean;
|
|
supportsReusableLeases: boolean;
|
|
displayName?: string;
|
|
description?: string;
|
|
source?: "builtin" | "plugin";
|
|
pluginKey?: string;
|
|
pluginId?: string;
|
|
configSchema?: JsonSchema;
|
|
}
|
|
|
|
export interface EnvironmentCapabilities {
|
|
adapters: AdapterEnvironmentSupport[];
|
|
drivers: Record<EnvironmentDriver, EnvironmentSupportStatus>;
|
|
sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentProviderCapability>;
|
|
}
|
|
|
|
const REMOTE_MANAGED_ADAPTERS = new Set<AgentAdapterType>([
|
|
"claude_local",
|
|
"codex_local",
|
|
"cursor",
|
|
"gemini_local",
|
|
"opencode_local",
|
|
"pi_local",
|
|
]);
|
|
|
|
export function adapterSupportsRemoteManagedEnvironments(adapterType: string): boolean {
|
|
return REMOTE_MANAGED_ADAPTERS.has(adapterType as AgentAdapterType);
|
|
}
|
|
|
|
export function supportedEnvironmentDriversForAdapter(adapterType: string): EnvironmentDriver[] {
|
|
return adapterSupportsRemoteManagedEnvironments(adapterType)
|
|
? ["local", "ssh", "sandbox"]
|
|
: ["local"];
|
|
}
|
|
|
|
export function supportedSandboxProvidersForAdapter(
|
|
adapterType: string,
|
|
additionalProviders: readonly string[] = [],
|
|
): SandboxEnvironmentProvider[] {
|
|
return adapterSupportsRemoteManagedEnvironments(adapterType)
|
|
? Array.from(new Set(additionalProviders)) as SandboxEnvironmentProvider[]
|
|
: [];
|
|
}
|
|
|
|
export function isEnvironmentDriverSupportedForAdapter(
|
|
adapterType: string,
|
|
driver: string,
|
|
): boolean {
|
|
return supportedEnvironmentDriversForAdapter(adapterType).includes(driver as EnvironmentDriver);
|
|
}
|
|
|
|
export function isSandboxProviderSupportedForAdapter(
|
|
adapterType: string,
|
|
provider: string | null | undefined,
|
|
additionalProviders: readonly string[] = [],
|
|
): boolean {
|
|
if (!provider) return false;
|
|
return supportedSandboxProvidersForAdapter(adapterType, additionalProviders).includes(
|
|
provider as SandboxEnvironmentProvider,
|
|
);
|
|
}
|
|
|
|
export function getAdapterEnvironmentSupport(
|
|
adapterType: AgentAdapterType,
|
|
additionalSandboxProviders: readonly string[] = [],
|
|
): AdapterEnvironmentSupport {
|
|
const supportedDrivers = new Set(supportedEnvironmentDriversForAdapter(adapterType));
|
|
const supportedProviders = new Set(supportedSandboxProvidersForAdapter(adapterType, additionalSandboxProviders));
|
|
const sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentSupportStatus> = {
|
|
fake: "unsupported",
|
|
};
|
|
for (const provider of additionalSandboxProviders) {
|
|
sandboxProviders[provider as SandboxEnvironmentProvider] = supportedProviders.has(provider as SandboxEnvironmentProvider)
|
|
? "supported"
|
|
: "unsupported";
|
|
}
|
|
return {
|
|
adapterType,
|
|
drivers: {
|
|
local: supportedDrivers.has("local") ? "supported" : "unsupported",
|
|
ssh: supportedDrivers.has("ssh") ? "supported" : "unsupported",
|
|
sandbox: supportedDrivers.has("sandbox") ? "supported" : "unsupported",
|
|
plugin: supportedDrivers.has("plugin") ? "supported" : "unsupported",
|
|
},
|
|
sandboxProviders,
|
|
};
|
|
}
|
|
|
|
export function getEnvironmentCapabilities(
|
|
adapterTypes: readonly AgentAdapterType[],
|
|
options: {
|
|
sandboxProviders?: Record<string, Partial<EnvironmentProviderCapability>>;
|
|
} = {},
|
|
): EnvironmentCapabilities {
|
|
const pluginProviderKeys = Object.keys(options.sandboxProviders ?? {});
|
|
const sandboxProviders: Record<SandboxEnvironmentProvider, EnvironmentProviderCapability> = {
|
|
fake: {
|
|
status: "unsupported",
|
|
supportsSavedProbe: true,
|
|
supportsUnsavedProbe: true,
|
|
supportsRunExecution: false,
|
|
supportsReusableLeases: true,
|
|
displayName: "Fake",
|
|
source: "builtin",
|
|
},
|
|
};
|
|
for (const [provider, capability] of Object.entries(options.sandboxProviders ?? {})) {
|
|
sandboxProviders[provider as SandboxEnvironmentProvider] = {
|
|
status: capability.status ?? "supported",
|
|
supportsSavedProbe: capability.supportsSavedProbe ?? true,
|
|
supportsUnsavedProbe: capability.supportsUnsavedProbe ?? true,
|
|
supportsRunExecution: capability.supportsRunExecution ?? true,
|
|
supportsReusableLeases: capability.supportsReusableLeases ?? true,
|
|
displayName: capability.displayName,
|
|
description: capability.description,
|
|
source: capability.source ?? "plugin",
|
|
pluginKey: capability.pluginKey,
|
|
pluginId: capability.pluginId,
|
|
configSchema: capability.configSchema,
|
|
};
|
|
}
|
|
return {
|
|
adapters: adapterTypes.map((adapterType) => getAdapterEnvironmentSupport(adapterType, pluginProviderKeys)),
|
|
drivers: {
|
|
local: "supported",
|
|
ssh: "supported",
|
|
sandbox: "supported",
|
|
plugin: "unsupported",
|
|
},
|
|
sandboxProviders,
|
|
};
|
|
}
|