forked from farhoodlabs/paperclip
Devin Foley
1f70fd9a22
## Thinking Path > - Paperclip orchestrates AI agents across isolated execution workspaces; the local cwd is the only persistence boundary between runs. > - Workspace lifecycle (worktree_prepare → execute → workspace_finalize) and the wake/accept flow are what guarantee that dependent issues see a consistent worktree. > - PAPA-380 / PAPA-431 / PAPA-432 / PAPA-440 surfaced three holes in that contract: silent env reuse across assignees, dependent wakes firing before finalize, and `issue.interaction.accept` advancing before finalize landed. > - PAPA-441 / PAPA-442 then needed to document the "no remote git" contract and prevent future adapter/runtime code from quietly reintroducing `git push` as a backdoor sync. > - This pull request lands those server fixes, the static `check-no-git-push` enforcement, the AUTHORING.md cross-link, and the Cody-review follow-ups on the PAPA-430 thread. > - The benefit is that finalize is a real barrier — board accepts, dependent wakes, and operator-set env all respect it — and adapter code can't bypass it via raw `git push`. ## What Changed - **server (PAPA-380, PAPA-431):** `execution-workspace-policy` refuses silent env reuse when the assignee's resolved env disagrees with the workspace it would inherit. The inheritance protection is now scoped to the actual inheritance signal — explicit issue-level `environmentId` is honored even when the agent's default env is `null`. - **server (PAPA-432):** `heartbeat.ts` gates dependent wakes on `listUnfinalizedExecutionWorkspaceIds`, and writes a `workspace_finalize` row on the succeeded path. Write failures now surface instead of being swallowed so dependents aren't silently stranded behind a missing row. - **server (PAPA-440):** `issue-thread-interactions.acceptInteraction` adds a workspace_finalize precondition for `request_confirmation` (not `suggest_tasks`). Accept returns 409 if finalize hasn't succeeded for the latest workspace operation. - **ci (PAPA-442):** new `scripts/check-no-git-push.mjs` static check scans `packages/adapters/`, `packages/adapter-utils/`, `server/src/`, and `cli/src/` for any `git push` invocation (string or args-array). Wired into the `policy` PR job and `test:release-registry`. Operators can opt in per-call with `// paperclip:allow-git-push: <reason>`. Release scripts are out of scope by design. - **docs (PAPA-441):** `AUTHORING.md` documents the no-remote-git contract and cross-links the static check so adapter authors learn the rule and the enforcement together. - **review follow-up (PAPA-430, Cody):** three fixes — env resolver bug, accept-gate scope (request_confirmation only), and finalize record write on the succeeded path. ## Verification - `pnpm exec vitest run server/src/__tests__/execution-workspace-policy.test.ts server/src/__tests__/issue-thread-interactions-service.test.ts` → 33/33 pass - `node scripts/check-no-git-push.test.mjs` → check covers string form, args-array form, comment exclusions, and per-line allow-comment. - Manual: server compiles; the policy job runs the check in <1s before heavier jobs. ## Risks - **Behavioral shift in accept:** boards accepting `request_confirmation` while finalize is in-flight now get 409s. This is intentional — they can retry — but it changes timing on a hot path. `suggest_tasks` is unaffected. - **Workspace policy:** the env-reuse refusal is a new error path. Issues that previously silently reused an env from a different-assignee workspace will now fail-loud; the resolver still honors explicit issue-level `executionWorkspaceSettings.environmentId`. - **CI rule:** any future legitimate `git push` in scoped dirs must be marked with the allow-comment, which is the intended ergonomic. ## Model Used - Claude Opus 4.7 (`claude-opus-4-7`, extended thinking), via Claude Code in the Paperclip executor adapter. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [ ] If this change affects the UI, I have included before/after screenshots (N/A — server/CI/docs only) - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge Closes related issues: PAPA-430, PAPA-380, PAPA-431, PAPA-432, PAPA-440, PAPA-441, PAPA-442 --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
86 lines
3.1 KiB
Markdown
86 lines
3.1 KiB
Markdown
# OpenClaw Gateway Adapter
|
|
|
|
This document describes how `@paperclipai/adapter-openclaw-gateway` invokes OpenClaw over the Gateway protocol.
|
|
|
|
## Transport
|
|
|
|
This adapter always uses WebSocket gateway transport.
|
|
|
|
- URL must be `ws://` or `wss://`
|
|
- Connect flow follows gateway protocol:
|
|
1. receive `connect.challenge`
|
|
2. send `req connect` (protocol/client/auth/device payload)
|
|
3. send `req agent`
|
|
4. wait for completion via `req agent.wait`
|
|
5. stream `event agent` frames into Paperclip logs/transcript parsing
|
|
|
|
## Auth Modes
|
|
|
|
Gateway credentials can be provided in any of these ways:
|
|
|
|
- `authToken` / `token` in adapter config
|
|
- `headers.x-openclaw-token`
|
|
- `headers.x-openclaw-auth` (legacy)
|
|
- `password` (shared password mode)
|
|
|
|
When a token is present and `authorization` header is missing, the adapter derives `Authorization: Bearer <token>`.
|
|
|
|
## Device Auth
|
|
|
|
By default the adapter sends a signed `device` payload in `connect` params.
|
|
|
|
- set `disableDeviceAuth=true` to omit device signing
|
|
- set `devicePrivateKeyPem` to pin a stable signing key
|
|
- without `devicePrivateKeyPem`, the adapter generates an ephemeral Ed25519 keypair per run
|
|
- when `autoPairOnFirstConnect` is enabled (default), the adapter handles one initial `pairing required` by calling `device.pair.list` + `device.pair.approve` over shared auth, then retries once.
|
|
|
|
## Session Strategy
|
|
|
|
The adapter supports the same session routing model as HTTP OpenClaw mode:
|
|
|
|
- `sessionKeyStrategy=issue|fixed|run`
|
|
- `sessionKey` is used when strategy is `fixed`
|
|
|
|
Resolved session key is sent as `agent.sessionKey`.
|
|
|
|
## Payload Mapping
|
|
|
|
The agent request is built as:
|
|
|
|
- required fields:
|
|
- `message` (wake text plus optional `payloadTemplate.message`/`payloadTemplate.text` prefix)
|
|
- `idempotencyKey` (Paperclip `runId`)
|
|
- `sessionKey` (resolved strategy)
|
|
- optional additions:
|
|
- all `payloadTemplate` fields merged in
|
|
- `agentId` from config if set and not already in template
|
|
|
|
## Timeouts
|
|
|
|
- `timeoutSec` controls adapter-level request budget
|
|
- `waitTimeoutMs` controls `agent.wait.timeoutMs`
|
|
|
|
If `agent.wait` returns `timeout`, adapter returns `openclaw_gateway_wait_timeout`.
|
|
|
|
## Log Format
|
|
|
|
Structured gateway event logs use:
|
|
|
|
- `[openclaw-gateway] ...` for lifecycle/system logs
|
|
- `[openclaw-gateway:event] run=<id> stream=<stream> data=<json>` for `event agent` frames
|
|
|
|
UI/CLI parsers consume these lines to render transcript updates.
|
|
|
|
## No-remote-git contract
|
|
|
|
Like every Paperclip adapter, this one must treat the local execution-workspace
|
|
cwd as the only persistence boundary across runs — no `git push` from runtime
|
|
code, no assuming a `git remote` exists. The gateway transport here doesn't
|
|
touch the workspace directly, but if you extend the adapter to ship code to
|
|
the OpenClaw side, use the round-trip helpers in `@paperclipai/adapter-utils`
|
|
(`prepareWorkspaceForSshExecution` → `restoreWorkspaceFromSshExecution`)
|
|
rather than reaching for a git remote. See
|
|
[`packages/adapters/AUTHORING.md`](../AUTHORING.md#no-remote-git-contract-cross-run-persistence)
|
|
for the full contract and the pinning test at
|
|
[`packages/adapter-utils/src/ssh-fixture.test.ts`](../../adapter-utils/src/ssh-fixture.test.ts).
|