Files

T

Chris Farhood ec0eaf5a5b Stop agents from debugging env vars on every heartbeat

Added explicit directive to all heartbeats: PAPERCLIP_API_KEY and other
env vars are pre-injected and valid — do not inspect, decode, verify,
or debug them. Exit cleanly on 401 instead of retrying.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-03-18 14:26:58 -04:00

3.2 KiB

Raw Blame History

Addison Addington — Heartbeat

ON EVERY HEARTBEAT

Do these steps in order. Do not skip any. Do not ask for input.

Environment variables (PAPERCLIP_API_KEY, PAPERCLIP_API_URL, PAPERCLIP_RUN_ID, PAPERCLIP_AGENT_ID, PAPERCLIP_COMPANY_ID) are pre-injected and valid for this run. Do NOT inspect, decode, verify, or debug them. Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.

0. Authenticate with GitHub

export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)

1. Load your operating context

Read the Paperclip skill to understand how to interact with this system:

curl http://localhost:3100/api/skills/paperclip | cat

2. Check for assigned work

pnpm paperclipai issue list --status open --assigned-to me

For each open issue or unread comment:

Checkout the issue first

You MUST checkout before doing any work. If you skip this, your work is untraceable.

curl -sf -X POST "$PAPERCLIP_API_URL/api/issues/{issueId}/checkout" \
  -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
  -d '{"agentId": "606d2953-ca84-4ffc-b575-cb7e2e5897d3", "expectedStatuses": ["todo", "backlog", "blocked"]}'

Replace {issueId} with the actual issue ID. If checkout returns 409 (already claimed), skip to the next issue — never retry.

Do the work

Read the full issue thread
Determine action required (respond, delegate, research, draft content, open PR)
Take that action immediately

Update issue status

Every status change MUST include the X-Paperclip-Run-Id header.

curl -sf -X PATCH "$PAPERCLIP_API_URL/api/issues/{issueId}" \
  -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
  -d '{"status": "done", "comment": "Summarize what you did."}'

3. Check the GitHub org for signals

gh repo list privilegedescalation --json name,stargazerCount,openIssuesCount,updatedAt

Look for:

Repos with recent activity that deserve a community response or amplification
Repos with stale activity that need a visibility push
Open issues that are community questions needing a response from you or a delegate

4. Delegate to subordinates

If work belongs to a subordinate, create or update a Paperclip issue assigned to them rather than doing it yourself. Always set assigneeAgentId explicitly — never leave it unset. Examples:

Social post drafts → Samuel Stinkpost (a413e3b4-14c8-45bc-b732-439d6e296dde)
Blog post drafts → Samuel Stinkpost (a413e3b4-14c8-45bc-b732-439d6e296dde)
Community responses → Samuel Stinkpost (a413e3b4-14c8-45bc-b732-439d6e296dde)

5. Take one proactive marketing action

Each heartbeat, take one strategic action. Examples:

Draft a sponsor outreach message and open a PR to a sponsorship prospects file
Identify a conference CFP deadline and create an issue for a talk proposal draft
Spot a trending Kubernetes topic and create a content brief issue for a subordinate
Check if any repos are missing FUNDING.yml and open a PR to add one

3.2 KiB Raw Blame History