forked from farhoodlabs/paperclip
778e775c35
## Thinking Path > - Paperclip orchestrates AI-agent companies and needs secrets handling to work across local development, hosted operators, and governed agent execution. > - The affected subsystem is the company-scoped secrets control plane: database schema, server services/routes, CLI workflows, and the Secrets settings UI. > - The gap was that secrets were local-only and operators could not manage provider vaults or import existing remote references without exposing plaintext. > - This branch adds provider vault configuration plus an AWS Secrets Manager remote-import path while preserving company boundaries, binding context, and audit trails. > - I kept the PR to a single branch PR, removed unrelated lockfile/package drift, rebased the full branch onto the current `public-gh/master`, and addressed fresh Greptile findings. > - The benefit is a reviewable implementation of provider-backed secrets with focused tests covering provider selection, import conflicts, deleted secret reuse, rotation guards, and AWS signing behavior. ## What Changed - Added provider vault support for company secrets, including provider config storage, default vault handling, health checks, binding usage, access events, and remote import preview/commit. - Added an AWS Secrets Manager provider using SigV4 request signing, bounded request timeouts, namespace guardrails, cached runtime credential resolution, and external-reference linking without plaintext reads. - Added Secrets UI surfaces for vault management and remote import, plus CLI/API documentation for setup and operations. - Stabilized routine webhook secret binding paths and SSH environment-driver fixture bindings discovered during verification. - Addressed Greptile and CI findings: no lockfile/package drift, monotonic migration metadata, disabled-vault default races, soft-deleted secret hiding/recreate behavior, remove behavior with disabled vaults, soft-deleted external-reference re-import, non-active rotation guards, managed-secret soft deletion through PATCH, and per-call AWS SDK credential client churn. - Rebased this branch onto `public-gh/master` at `0e1a5828` and force-pushed with lease to keep this as the single PR for the branch. ## Verification - `git fetch public-gh master` - `git rebase public-gh/master` - `git diff --name-only public-gh/master...HEAD | grep '^pnpm-lock\.yaml$' || true` confirmed `pnpm-lock.yaml` is not in the PR diff. - Confirmed migration ordering: master ends at `0081_optimal_dormammu`; this PR adds `0082_dry_vision` and `0083_company_secret_provider_configs`. - Inspected migrations for repeat safety: new tables/indexes use `IF NOT EXISTS`; foreign keys are guarded by `DO $$ ... IF NOT EXISTS`; column additions use `ADD COLUMN IF NOT EXISTS`. - `pnpm -r typecheck` passed before the Greptile follow-up commits. - `pnpm test:run` ran the full stable Vitest path before the Greptile follow-up commits; it completed with 3 timing-related failures under parallel load: `codex-local-execute.test.ts`, `cursor-local-execute.test.ts`, and `environment-service.test.ts`. - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/codex-local-execute.test.ts src/__tests__/cursor-local-execute.test.ts src/__tests__/environment-service.test.ts` passed on targeted rerun (`24/24`). - `pnpm build` passed before the Greptile follow-up commits. Vite reported existing chunk-size/dynamic-import warnings. - After Greptile follow-up commits: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/secrets-service.test.ts` passed (`26/26`). - After Greptile follow-up commits: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/aws-secrets-manager-provider.test.ts src/__tests__/secrets-service.test.ts` passed (`39/39`). - After Greptile follow-up commits: `pnpm --filter @paperclipai/server typecheck` passed. - Captured Storybook screenshots from `ui/storybook-static` for visual review. - Latest PR checks on `5ca3a5cf`: `policy`, serialized server suites 1/4-4/4, `Canary Dry Run`, `e2e`, `security/snyk`, and `Greptile Review` pass; aggregate `verify` is still registering the completed child checks. - Greptile review loop continued through the latest requested pass; all Greptile review threads are resolved and the latest `Greptile Review` check on `5ca3a5cf` passed with 0 comments added. ## Screenshots Before: the provider-vault and remote-import surfaces did not exist on `master`; these are after-state screenshots from the Storybook fixtures.    ## Risks - Migration risk: this adds new secret provider tables and extends existing secret rows. The migrations were checked for monotonic ordering and idempotent guards, but reviewers should still inspect upgrade behavior carefully. - Provider risk: AWS support uses direct SigV4 requests. Automated tests cover signing, request timeouts, vault-config selection, namespace guardrails, pending-version archival, sanitized provider errors, and service-level cleanup paths. A real-vault AWS smoke test remains deployment validation for an operator with AWS credentials rather than an unverified merge blocker in this local branch. - UI risk: the Secrets page and import dialog are large new surfaces; screenshots are included above for reviewer inspection. - Verification risk: the full local stable test command hit parallel-load timing failures, although the exact failed files passed when rerun directly. - Operational risk: remote import intentionally avoids plaintext reads; operators must understand that imported external references resolve at runtime and may fail if AWS permissions change. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent with local shell/tool use in the Paperclip worktree. Exact context-window size was not exposed by the runtime. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [ ] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
327 lines
16 KiB
TypeScript
327 lines
16 KiB
TypeScript
import { Navigate, Outlet, Route, Routes, useLocation, useParams } from "@/lib/router";
|
|
import { Button } from "@/components/ui/button";
|
|
import { Layout } from "./components/Layout";
|
|
import { OnboardingWizard } from "./components/OnboardingWizard";
|
|
import { CloudAccessGate } from "./components/CloudAccessGate";
|
|
import { Dashboard } from "./pages/Dashboard";
|
|
import { DashboardLive } from "./pages/DashboardLive";
|
|
import { Companies } from "./pages/Companies";
|
|
import { Agents } from "./pages/Agents";
|
|
import { AgentDetail } from "./pages/AgentDetail";
|
|
import { Projects } from "./pages/Projects";
|
|
import { ProjectDetail } from "./pages/ProjectDetail";
|
|
import { ProjectWorkspaceDetail } from "./pages/ProjectWorkspaceDetail";
|
|
import { Workspaces } from "./pages/Workspaces";
|
|
import { Issues } from "./pages/Issues";
|
|
import { Search } from "./pages/Search";
|
|
import { IssueDetail } from "./pages/IssueDetail";
|
|
import { IssueChatLongThreadPerf } from "./pages/IssueChatLongThreadPerf";
|
|
import { Routines } from "./pages/Routines";
|
|
import { RoutineDetail } from "./pages/RoutineDetail";
|
|
import { UserProfile } from "./pages/UserProfile";
|
|
import { ExecutionWorkspaceDetail } from "./pages/ExecutionWorkspaceDetail";
|
|
import { Goals } from "./pages/Goals";
|
|
import { GoalDetail } from "./pages/GoalDetail";
|
|
import { Approvals } from "./pages/Approvals";
|
|
import { ApprovalDetail } from "./pages/ApprovalDetail";
|
|
import { Costs } from "./pages/Costs";
|
|
import { Activity } from "./pages/Activity";
|
|
import { Inbox } from "./pages/Inbox";
|
|
import { CompanySettings } from "./pages/CompanySettings";
|
|
import { CompanyEnvironments } from "./pages/CompanyEnvironments";
|
|
import { CompanyAccess } from "./pages/CompanyAccess";
|
|
import { CompanyInvites } from "./pages/CompanyInvites";
|
|
import { CompanySkills } from "./pages/CompanySkills";
|
|
import { Secrets } from "./pages/Secrets";
|
|
import { CompanyExport } from "./pages/CompanyExport";
|
|
import { CompanyImport } from "./pages/CompanyImport";
|
|
import { DesignGuide } from "./pages/DesignGuide";
|
|
import { InstanceGeneralSettings } from "./pages/InstanceGeneralSettings";
|
|
import { InstanceAccess } from "./pages/InstanceAccess";
|
|
import { InstanceSettings } from "./pages/InstanceSettings";
|
|
import { InstanceExperimentalSettings } from "./pages/InstanceExperimentalSettings";
|
|
import { ProfileSettings } from "./pages/ProfileSettings";
|
|
import { PluginManager } from "./pages/PluginManager";
|
|
import { PluginSettings } from "./pages/PluginSettings";
|
|
import { AdapterManager } from "./pages/AdapterManager";
|
|
import { PluginPage } from "./pages/PluginPage";
|
|
import { OrgChart } from "./pages/OrgChart";
|
|
import { NewAgent } from "./pages/NewAgent";
|
|
import { AuthPage } from "./pages/Auth";
|
|
import { BoardClaimPage } from "./pages/BoardClaim";
|
|
import { CliAuthPage } from "./pages/CliAuth";
|
|
import { InviteLandingPage } from "./pages/InviteLanding";
|
|
import { JoinRequestQueue } from "./pages/JoinRequestQueue";
|
|
import { NotFoundPage } from "./pages/NotFound";
|
|
import { useCompany } from "./context/CompanyContext";
|
|
import { useDialogActions } from "./context/DialogContext";
|
|
import { loadLastInboxTab } from "./lib/inbox";
|
|
import { shouldRedirectCompanylessRouteToOnboarding } from "./lib/onboarding-route";
|
|
|
|
function boardRoutes() {
|
|
return (
|
|
<>
|
|
<Route index element={<Navigate to="dashboard" replace />} />
|
|
<Route path="dashboard" element={<Dashboard />} />
|
|
<Route path="dashboard/live" element={<DashboardLive />} />
|
|
<Route path="onboarding" element={<OnboardingRoutePage />} />
|
|
<Route path="companies" element={<Companies />} />
|
|
<Route path="company/settings" element={<CompanySettings />} />
|
|
<Route path="company/settings/environments" element={<CompanyEnvironments />} />
|
|
<Route path="company/settings/access" element={<CompanyAccess />} />
|
|
<Route path="company/settings/invites" element={<CompanyInvites />} />
|
|
<Route path="company/export/*" element={<CompanyExport />} />
|
|
<Route path="company/import" element={<CompanyImport />} />
|
|
<Route path="company/settings/secrets" element={<Secrets />} />
|
|
<Route path="skills/*" element={<CompanySkills />} />
|
|
<Route path="settings" element={<LegacySettingsRedirect />} />
|
|
<Route path="settings/*" element={<LegacySettingsRedirect />} />
|
|
<Route path="plugins/:pluginId" element={<PluginPage />} />
|
|
<Route path="org" element={<OrgChart />} />
|
|
<Route path="agents" element={<Navigate to="/agents/all" replace />} />
|
|
<Route path="agents/all" element={<Agents />} />
|
|
<Route path="agents/active" element={<Agents />} />
|
|
<Route path="agents/paused" element={<Agents />} />
|
|
<Route path="agents/error" element={<Agents />} />
|
|
<Route path="agents/new" element={<NewAgent />} />
|
|
<Route path="agents/:agentId" element={<AgentDetail />} />
|
|
<Route path="agents/:agentId/:tab" element={<AgentDetail />} />
|
|
<Route path="agents/:agentId/runs/:runId" element={<AgentDetail />} />
|
|
<Route path="projects" element={<Projects />} />
|
|
<Route path="projects/:projectId" element={<ProjectDetail />} />
|
|
<Route path="projects/:projectId/overview" element={<ProjectDetail />} />
|
|
<Route path="projects/:projectId/issues" element={<ProjectDetail />} />
|
|
<Route path="projects/:projectId/issues/:filter" element={<ProjectDetail />} />
|
|
<Route path="projects/:projectId/workspaces/:workspaceId" element={<ProjectWorkspaceDetail />} />
|
|
<Route path="projects/:projectId/workspaces" element={<ProjectDetail />} />
|
|
<Route path="projects/:projectId/configuration" element={<ProjectDetail />} />
|
|
<Route path="projects/:projectId/budget" element={<ProjectDetail />} />
|
|
<Route path="workspaces" element={<Workspaces />} />
|
|
<Route path="issues" element={<Issues />} />
|
|
<Route path="search" element={<Search />} />
|
|
<Route path="issues/all" element={<Navigate to="/issues" replace />} />
|
|
<Route path="issues/active" element={<Navigate to="/issues" replace />} />
|
|
<Route path="issues/backlog" element={<Navigate to="/issues" replace />} />
|
|
<Route path="issues/done" element={<Navigate to="/issues" replace />} />
|
|
<Route path="issues/recent" element={<Navigate to="/issues" replace />} />
|
|
<Route path="issues/:issueId" element={<IssueDetail />} />
|
|
{import.meta.env.DEV ? (
|
|
<Route path="tests/perf/long-thread" element={<IssueChatLongThreadPerf />} />
|
|
) : null}
|
|
<Route path="routines" element={<Routines />} />
|
|
<Route path="routines/:routineId" element={<RoutineDetail />} />
|
|
<Route path="execution-workspaces/:workspaceId" element={<ExecutionWorkspaceDetail />} />
|
|
<Route path="execution-workspaces/:workspaceId/services" element={<ExecutionWorkspaceDetail />} />
|
|
<Route path="execution-workspaces/:workspaceId/configuration" element={<ExecutionWorkspaceDetail />} />
|
|
<Route path="execution-workspaces/:workspaceId/runtime-logs" element={<ExecutionWorkspaceDetail />} />
|
|
<Route path="execution-workspaces/:workspaceId/issues" element={<ExecutionWorkspaceDetail />} />
|
|
<Route path="execution-workspaces/:workspaceId/routines" element={<ExecutionWorkspaceDetail />} />
|
|
<Route path="goals" element={<Goals />} />
|
|
<Route path="goals/:goalId" element={<GoalDetail />} />
|
|
<Route path="approvals" element={<Navigate to="/approvals/pending" replace />} />
|
|
<Route path="approvals/pending" element={<Approvals />} />
|
|
<Route path="approvals/all" element={<Approvals />} />
|
|
<Route path="approvals/:approvalId" element={<ApprovalDetail />} />
|
|
<Route path="costs" element={<Costs />} />
|
|
<Route path="activity" element={<Activity />} />
|
|
<Route path="inbox" element={<InboxRootRedirect />} />
|
|
<Route path="inbox/mine" element={<Inbox />} />
|
|
<Route path="inbox/recent" element={<Inbox />} />
|
|
<Route path="inbox/unread" element={<Inbox />} />
|
|
<Route path="inbox/all" element={<Inbox />} />
|
|
<Route path="inbox/requests" element={<JoinRequestQueue />} />
|
|
<Route path="inbox/new" element={<Navigate to="/inbox/mine" replace />} />
|
|
<Route path="u/:userSlug" element={<UserProfile />} />
|
|
<Route path="design-guide" element={<DesignGuide />} />
|
|
<Route path="instance/settings/adapters" element={<AdapterManager />} />
|
|
<Route path=":pluginRoutePath/*" element={<PluginPage />} />
|
|
<Route path="*" element={<NotFoundPage scope="board" />} />
|
|
</>
|
|
);
|
|
}
|
|
|
|
function InboxRootRedirect() {
|
|
return <Navigate to={`/inbox/${loadLastInboxTab()}`} replace />;
|
|
}
|
|
|
|
function LegacySettingsRedirect() {
|
|
const location = useLocation();
|
|
return <Navigate to={`/instance/settings/general${location.search}${location.hash}`} replace />;
|
|
}
|
|
|
|
function OnboardingRoutePage() {
|
|
const { companies } = useCompany();
|
|
const { openOnboarding } = useDialogActions();
|
|
const { companyPrefix } = useParams<{ companyPrefix?: string }>();
|
|
const matchedCompany = companyPrefix
|
|
? companies.find((company) => company.issuePrefix.toUpperCase() === companyPrefix.toUpperCase()) ?? null
|
|
: null;
|
|
|
|
const title = matchedCompany
|
|
? `Add another agent to ${matchedCompany.name}`
|
|
: companies.length > 0
|
|
? "Create another company"
|
|
: "Create your first company";
|
|
const description = matchedCompany
|
|
? "Run onboarding again to add an agent and a starter task for this company."
|
|
: companies.length > 0
|
|
? "Run onboarding again to create another company and seed its first agent."
|
|
: "Get started by creating a company and your first agent.";
|
|
|
|
return (
|
|
<div className="mx-auto max-w-xl py-10">
|
|
<div className="rounded-lg border border-border bg-card p-6">
|
|
<h1 className="text-xl font-semibold">{title}</h1>
|
|
<p className="mt-2 text-sm text-muted-foreground">{description}</p>
|
|
<div className="mt-4">
|
|
<Button
|
|
onClick={() =>
|
|
matchedCompany
|
|
? openOnboarding({ initialStep: 2, companyId: matchedCompany.id })
|
|
: openOnboarding()
|
|
}
|
|
>
|
|
{matchedCompany ? "Add Agent" : "Start Onboarding"}
|
|
</Button>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
function CompanyRootRedirect() {
|
|
const { companies, selectedCompany, loading } = useCompany();
|
|
const location = useLocation();
|
|
|
|
if (loading) {
|
|
return <div className="mx-auto max-w-xl py-10 text-sm text-muted-foreground">Loading...</div>;
|
|
}
|
|
|
|
const targetCompany = selectedCompany ?? companies[0] ?? null;
|
|
if (!targetCompany) {
|
|
if (
|
|
shouldRedirectCompanylessRouteToOnboarding({
|
|
pathname: location.pathname,
|
|
hasCompanies: false,
|
|
})
|
|
) {
|
|
return <Navigate to="/onboarding" replace />;
|
|
}
|
|
return <NoCompaniesStartPage />;
|
|
}
|
|
|
|
return <Navigate to={`/${targetCompany.issuePrefix}/dashboard`} replace />;
|
|
}
|
|
|
|
function UnprefixedBoardRedirect() {
|
|
const location = useLocation();
|
|
const { companies, selectedCompany, loading } = useCompany();
|
|
|
|
if (loading) {
|
|
return <div className="mx-auto max-w-xl py-10 text-sm text-muted-foreground">Loading...</div>;
|
|
}
|
|
|
|
const targetCompany = selectedCompany ?? companies[0] ?? null;
|
|
if (!targetCompany) {
|
|
if (
|
|
shouldRedirectCompanylessRouteToOnboarding({
|
|
pathname: location.pathname,
|
|
hasCompanies: false,
|
|
})
|
|
) {
|
|
return <Navigate to="/onboarding" replace />;
|
|
}
|
|
return <NoCompaniesStartPage />;
|
|
}
|
|
|
|
return (
|
|
<Navigate
|
|
to={`/${targetCompany.issuePrefix}${location.pathname}${location.search}${location.hash}`}
|
|
replace
|
|
/>
|
|
);
|
|
}
|
|
|
|
function NoCompaniesStartPage() {
|
|
const { openOnboarding } = useDialogActions();
|
|
|
|
return (
|
|
<div className="mx-auto max-w-xl py-10">
|
|
<div className="rounded-lg border border-border bg-card p-6">
|
|
<h1 className="text-xl font-semibold">Create your first company</h1>
|
|
<p className="mt-2 text-sm text-muted-foreground">
|
|
Get started by creating a company.
|
|
</p>
|
|
<div className="mt-4">
|
|
<Button onClick={() => openOnboarding()}>New Company</Button>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
export function App() {
|
|
return (
|
|
<>
|
|
<Routes>
|
|
<Route path="auth" element={<AuthPage />} />
|
|
<Route path="board-claim/:token" element={<BoardClaimPage />} />
|
|
<Route path="cli-auth/:id" element={<CliAuthPage />} />
|
|
<Route path="invite/:token" element={<InviteLandingPage />} />
|
|
<Route path="tests/perf/long-thread" element={<IssueChatLongThreadPerf />} />
|
|
|
|
<Route element={<CloudAccessGate />}>
|
|
<Route index element={<CompanyRootRedirect />} />
|
|
<Route path="onboarding" element={<OnboardingRoutePage />} />
|
|
<Route path="instance" element={<Navigate to="/instance/settings/general" replace />} />
|
|
<Route path="instance/settings" element={<Layout />}>
|
|
<Route index element={<Navigate to="general" replace />} />
|
|
<Route path="profile" element={<ProfileSettings />} />
|
|
<Route path="general" element={<InstanceGeneralSettings />} />
|
|
<Route path="access" element={<InstanceAccess />} />
|
|
<Route path="heartbeats" element={<InstanceSettings />} />
|
|
<Route path="experimental" element={<InstanceExperimentalSettings />} />
|
|
<Route path="plugins" element={<PluginManager />} />
|
|
<Route path="plugins/:pluginId" element={<PluginSettings />} />
|
|
<Route path="adapters" element={<AdapterManager />} />
|
|
</Route>
|
|
<Route path="companies" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="issues" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="issues/:issueId" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="routines" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="routines/:routineId" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="u/:userSlug" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="skills/*" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="settings" element={<LegacySettingsRedirect />} />
|
|
<Route path="settings/*" element={<LegacySettingsRedirect />} />
|
|
<Route path="agents" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="agents/new" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="agents/:agentId" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="agents/:agentId/:tab" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="agents/:agentId/runs/:runId" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects/:projectId" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects/:projectId/overview" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects/:projectId/issues" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects/:projectId/issues/:filter" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects/:projectId/workspaces" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects/:projectId/workspaces/:workspaceId" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="projects/:projectId/configuration" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="workspaces" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="execution-workspaces/:workspaceId" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="execution-workspaces/:workspaceId/services" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="execution-workspaces/:workspaceId/configuration" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="execution-workspaces/:workspaceId/runtime-logs" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="execution-workspaces/:workspaceId/issues" element={<UnprefixedBoardRedirect />} />
|
|
<Route path="execution-workspaces/:workspaceId/routines" element={<UnprefixedBoardRedirect />} />
|
|
<Route path=":companyPrefix" element={<Layout />}>
|
|
{boardRoutes()}
|
|
</Route>
|
|
<Route path="*" element={<NotFoundPage scope="global" />} />
|
|
</Route>
|
|
</Routes>
|
|
<OnboardingWizard />
|
|
</>
|
|
);
|
|
}
|