Add low-trust review containment (#7530)
## Thinking Path > - Paperclip is a control plane for AI-agent companies, so execution policy and trust boundaries are part of the product's safety contract. > - Low-trust review work needs narrower authority than normal same-company agents because hostile PRs, comments, attachments, and generated output can carry prompt-injection payloads. > - The current V1 shape gives trusted workers broad company context, which is useful for normal execution but too permissive for a reviewer assigned to hostile content. > - This branch adds a `low_trust_review` preset, source-trust tagging, route-level containment, and quarantine handling so low-trust output does not automatically flow into higher-trust wake context. > - The branch has been rebased onto current `origin/master`, and the low-trust migration was renumbered to `0097_low_trust_source_trust.sql` to avoid collisions with existing `0091` through `0096` migrations. > - Greptile feedback was addressed by tightening low-trust detection, preserving project-level trust policy checks, fixing issue-kind promotion lookup, removing duplicate post-lease isolation assertion, documenting fail-closed source-trust behavior, bounding ancestry checks, enforcing runtime issue context for CEOs, awaiting accepted-plan monitor authorization, and making low-trust issue source-trust tagging atomic. > - The benefit is a first production slice of deny-by-default review containment with regression coverage for the main control-plane pivot surfaces. Fixes #7531. ## What Changed - Added shared trust-policy types and validators, plus database/source-trust fields for issues, comments, documents, and work products. - Implemented server enforcement for low-trust issue scope, agent self-view redaction, secret/plugin/runtime denial paths, promotion checks, and quarantined continuation/wake context. - Added focused low-trust regression tests for resolver behavior, source trust, route authorization, heartbeat preflight ordering, runtime containment, and quarantine redaction. - Added board UI affordances for selecting/reviewing the low-trust preset and surfacing source-trust badges in relevant issue views. - Added `doc/LOW-TRUST-PRESETS.md`, updated `doc/SPEC-implementation.md`, and committed the low-trust review contract plan under `doc/plans/`. - Rebasing note: the original `0097_low_trust_source_trust.sql` migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered migration are not broken by the renumbered migration. ## Verification - Rebased branch onto current `origin/master` and force-pushed with lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`. - Confirmed the PR diff does not include `pnpm-lock.yaml` or `.github/workflows` changes. - Resolved upstream UI/comment conflicts by preserving deleted-comment tombstone behavior and low-trust source-trust badges/metadata. - Renumbered the low-trust source-trust migration to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied an old-numbered copy are not broken. - `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts` - `pnpm exec vitest run server/src/__tests__/source-trust.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts ui/src/lib/trust-policy-ui.test.ts ui/src/components/TrustPresetSection.test.tsx` - `pnpm run typecheck:build-gaps` - `git diff --check` - GitHub checks pass on head `2719f31e3`: build, typecheck/release registry, general tests, serialized server suites, e2e, canary, verify, policy/review, Socket, and Snyk. - Greptile Review passes with Confidence Score 5/5 and zero unresolved Greptile review threads. - No design screenshots/images were added because the task explicitly says not to add them unless they are specifically part of the work. ## Risks - Medium risk: this touches shared trust-policy contracts, server authorization paths, heartbeat context generation, migration metadata, and UI preset controls. - Low-trust containment is intentionally deny-by-default; legitimate future review workflows may need explicit allowlisted exceptions. - Plugin/runtime/security surfaces are broad, so regression tests cover the current known routes but future integrations must route through the same containment layer. - The PR is ready for review; GitHub checks are green and Greptile is 5/5. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI workflow. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] UI changes are covered by focused tests; no screenshots were added per task instruction not to add design images unless specifically required - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta
@@ -15,6 +15,7 @@ import { ApiError } from "../api/client";
|
||||
import { ChartCard, RunActivityChart, PriorityChart, IssueStatusChart, SuccessRateChart } from "../components/ActivityCharts";
|
||||
import { activityApi } from "../api/activity";
|
||||
import { issuesApi } from "../api/issues";
|
||||
import { projectsApi } from "../api/projects";
|
||||
import { usePanel } from "../context/PanelContext";
|
||||
import { useSidebar } from "../context/SidebarContext";
|
||||
import { useCompany } from "../context/CompanyContext";
|
||||
@@ -41,6 +42,7 @@ import { Identity } from "../components/Identity";
|
||||
import { PageSkeleton } from "../components/PageSkeleton";
|
||||
import { RunButton, PauseResumeButton } from "../components/AgentActionButtons";
|
||||
import { BudgetPolicyCard } from "../components/BudgetPolicyCard";
|
||||
import { TrustPresetSection } from "../components/TrustPresetSection";
|
||||
import { FileTree, buildFileTree } from "../components/FileTree";
|
||||
import { ScrollToBottom } from "../components/ScrollToBottom";
|
||||
import { SourceResolvedFoldCallout } from "../components/SourceResolvedFoldCallout";
|
||||
@@ -101,6 +103,7 @@ import {
|
||||
type LiveEvent,
|
||||
type WorkspaceOperation,
|
||||
} from "@paperclipai/shared";
|
||||
import { buildPermissionsForTrustPreset, getTrustPreset } from "../lib/trust-policy-ui";
|
||||
import { redactHomePathUserSegments, redactHomePathUserSegmentsInValue } from "@paperclipai/adapter-utils";
|
||||
import { agentRouteRef } from "../lib/utils";
|
||||
import {
|
||||
@@ -1729,6 +1732,22 @@ function ConfigurationTab({
|
||||
enabled: Boolean(companyId),
|
||||
});
|
||||
|
||||
const lowTrustSelected = getTrustPreset(agent.permissions) === "low_trust_review";
|
||||
|
||||
const { data: boundaryProjects, isLoading: boundaryProjectsLoading } = useQuery({
|
||||
queryKey: companyId ? queryKeys.projects.list(companyId) : ["projects", "__low-trust-disabled"],
|
||||
queryFn: () => projectsApi.list(companyId!),
|
||||
enabled: Boolean(companyId && lowTrustSelected),
|
||||
});
|
||||
|
||||
const { data: boundaryIssues, isLoading: boundaryIssuesLoading } = useQuery({
|
||||
queryKey: companyId
|
||||
? [...queryKeys.issues.list(companyId), "low-trust-boundary-candidates"]
|
||||
: ["issues", "__low-trust-disabled"],
|
||||
queryFn: () => issuesApi.list(companyId!, { limit: 100, sortField: "updated", sortDir: "desc" }),
|
||||
enabled: Boolean(companyId && lowTrustSelected),
|
||||
});
|
||||
|
||||
const updateAgent = useMutation({
|
||||
mutationFn: (data: Record<string, unknown>) => agentsApi.update(agent.id, data, companyId),
|
||||
onMutate: () => {
|
||||
@@ -1796,6 +1815,28 @@ function ConfigurationTab({
|
||||
sectionLayout="cards"
|
||||
/>
|
||||
|
||||
<TrustPresetSection
|
||||
permissions={agent.permissions}
|
||||
disabled={updatePermissions.isPending}
|
||||
companyId={companyId}
|
||||
projectCandidates={(boundaryProjects ?? []).map((project) => ({
|
||||
id: project.id,
|
||||
label: project.name,
|
||||
}))}
|
||||
issueCandidates={(boundaryIssues ?? []).map((issue) => ({
|
||||
id: issue.id,
|
||||
label: `${issue.identifier ?? issue.id.slice(0, 8)} · ${issue.title}`,
|
||||
}))}
|
||||
candidatesLoading={boundaryProjectsLoading || boundaryIssuesLoading}
|
||||
onChange={(nextPermissions) =>
|
||||
updatePermissions.mutate({
|
||||
canCreateAgents,
|
||||
canAssignTasks,
|
||||
...buildPermissionsForTrustPreset(nextPermissions, nextPermissions.trustPreset === "low_trust_review" ? "low_trust_review" : "standard"),
|
||||
})
|
||||
}
|
||||
/>
|
||||
|
||||
<div>
|
||||
<h3 className="text-sm font-medium mb-3">Permissions</h3>
|
||||
<div className="border border-border rounded-lg p-4 space-y-4">
|
||||
|
||||
@@ -5,8 +5,10 @@ import { useCompany } from "../context/CompanyContext";
|
||||
import { useBreadcrumbs } from "../context/BreadcrumbContext";
|
||||
import { agentsApi } from "../api/agents";
|
||||
import { companySkillsApi } from "../api/companySkills";
|
||||
import { issuesApi } from "../api/issues";
|
||||
import { projectsApi } from "../api/projects";
|
||||
import { queryKeys } from "../lib/queryKeys";
|
||||
import { AGENT_ROLES, type AdapterEnvironmentTestResult } from "@paperclipai/shared";
|
||||
import { AGENT_ROLES, type AdapterEnvironmentTestResult, type AgentPermissions } from "@paperclipai/shared";
|
||||
import { Button } from "@/components/ui/button";
|
||||
import { Checkbox } from "@/components/ui/checkbox";
|
||||
import {
|
||||
@@ -28,6 +30,8 @@ import { useDisabledAdaptersSync } from "../adapters/use-disabled-adapters";
|
||||
import { isValidAdapterType } from "../adapters/metadata";
|
||||
import { ReportsToPicker } from "../components/ReportsToPicker";
|
||||
import { buildNewAgentHirePayload } from "../lib/new-agent-hire-payload";
|
||||
import { TrustPresetSection } from "../components/TrustPresetSection";
|
||||
import { buildPermissionsForTrustPreset, getTrustPreset } from "../lib/trust-policy-ui";
|
||||
import {
|
||||
DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX,
|
||||
DEFAULT_CODEX_LOCAL_MODEL,
|
||||
@@ -68,6 +72,9 @@ export function NewAgent() {
|
||||
const [role, setRole] = useState("general");
|
||||
const [reportsTo, setReportsTo] = useState<string | null>(null);
|
||||
const [configValues, setConfigValues] = useState<CreateConfigValues>(defaultCreateValues);
|
||||
const [permissions, setPermissions] = useState<Partial<AgentPermissions>>(
|
||||
buildPermissionsForTrustPreset(null, "standard"),
|
||||
);
|
||||
const [selectedSkillKeys, setSelectedSkillKeys] = useState<string[]>([]);
|
||||
const [roleOpen, setRoleOpen] = useState(false);
|
||||
const [formError, setFormError] = useState<string | null>(null);
|
||||
@@ -93,6 +100,22 @@ export function NewAgent() {
|
||||
enabled: Boolean(selectedCompanyId),
|
||||
});
|
||||
|
||||
const lowTrustSelected = getTrustPreset(permissions) === "low_trust_review";
|
||||
|
||||
const { data: boundaryProjects, isLoading: boundaryProjectsLoading } = useQuery({
|
||||
queryKey: selectedCompanyId ? queryKeys.projects.list(selectedCompanyId) : ["projects", "__low-trust-disabled"],
|
||||
queryFn: () => projectsApi.list(selectedCompanyId!),
|
||||
enabled: Boolean(selectedCompanyId && lowTrustSelected),
|
||||
});
|
||||
|
||||
const { data: boundaryIssues, isLoading: boundaryIssuesLoading } = useQuery({
|
||||
queryKey: selectedCompanyId
|
||||
? [...queryKeys.issues.list(selectedCompanyId), "low-trust-boundary-candidates"]
|
||||
: ["issues", "__low-trust-disabled"],
|
||||
queryFn: () => issuesApi.list(selectedCompanyId!, { limit: 100, sortField: "updated", sortDir: "desc" }),
|
||||
enabled: Boolean(selectedCompanyId && lowTrustSelected),
|
||||
});
|
||||
|
||||
const isFirstAgent = !agents || agents.length === 0;
|
||||
const effectiveRole = isFirstAgent ? "ceo" : role;
|
||||
|
||||
@@ -156,6 +179,7 @@ export function NewAgent() {
|
||||
selectedSkillKeys,
|
||||
configValues,
|
||||
adapterConfig: buildAdapterConfig(),
|
||||
permissions,
|
||||
}),
|
||||
);
|
||||
}
|
||||
@@ -256,6 +280,24 @@ export function NewAgent() {
|
||||
/>
|
||||
</div>
|
||||
|
||||
<div className="border-t border-border px-4 py-4">
|
||||
<TrustPresetSection
|
||||
permissions={permissions}
|
||||
onChange={setPermissions}
|
||||
disabled={createAgent.isPending}
|
||||
companyId={selectedCompanyId}
|
||||
projectCandidates={(boundaryProjects ?? []).map((project) => ({
|
||||
id: project.id,
|
||||
label: project.name,
|
||||
}))}
|
||||
issueCandidates={(boundaryIssues ?? []).map((issue) => ({
|
||||
id: issue.id,
|
||||
label: `${issue.identifier ?? issue.id.slice(0, 8)} · ${issue.title}`,
|
||||
}))}
|
||||
candidatesLoading={boundaryProjectsLoading || boundaryIssuesLoading}
|
||||
/>
|
||||
</div>
|
||||
|
||||
{/* Shared config form */}
|
||||
<AgentConfigForm
|
||||
mode="create"
|
||||
|
||||
Reference in New Issue
Block a user