364f0f5a8d
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Agents coordinate through issue threads, so issue comments and interactions are part of the task authorization surface. > - Low-trust and boundary-limited agents can receive narrow mention-scoped access, but that must not turn into broad same-company issue-thread reads. > - The comment creation path was narrowed to allow explicit mention replies without granting mutation access. > - The surrounding list/read routes still needed to enforce the same `issue:read` boundary before returning thread data. > - This pull request applies the issue read check to issue comment and interaction listing routes, and locks that behavior with server regressions. > - The benefit is that narrow cross-agent collaboration remains possible without exposing unrelated issue-thread history. ## Linked Issues or Issue Description Bug fix: - What happened: same-company agents outside an issue read boundary could still hit issue-thread listing routes and receive thread data. - Expected behavior: issue comments and issue-thread interactions should only be listed after the actor is allowed to read the issue. - Steps to reproduce: configure a peer agent denied by the issue read boundary, then request `GET /api/issues/:id/comments` or the issue interaction listing route. - Paperclip version/commit: current `master` before this branch. - Deployment mode: applies to server authorization in all modes. Related public context: #7389, #7863, #8024. ## What Changed - Added issue read enforcement before listing issue comments. - Added issue read enforcement before listing issue-thread interactions. - Added server regressions for denied peer-agent issue-thread access while preserving mention-scoped collaboration behavior. - Removed an avoidable per-mentioned-comment issue reload in mention-grant authorization by passing the already-loaded issue assignee through the helper. - Documented cross-agent issue read/comment authorization behavior in the Paperclip API reference. - Added a resilient fallback for pinned external skills when GitHub tree fetches are temporarily unavailable during catalog builds. ## Verification - `pnpm vitest run server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts server/src/__tests__/authorization-service.test.ts` - 2 test files passed - 84 tests passed - Existing mocked recovery revalidation warnings were emitted by the route suite and the command exited 0 - Greptile: 5/5 on commit `b73fc323f192dc44f88374c16865008d4348923b`; no unresolved review threads. - `pnpm vitest run packages/skills-catalog/src/catalog-builder.test.ts` - 1 test file passed - 6 tests passed - CI: all visible PR checks are terminal green on commit `b73fc323f192dc44f88374c16865008d4348923b`. ## Risks Low risk. This tightens read authorization on issue-thread listing routes; any caller that depended on same-company access without `issue:read` will now receive 403 and must use an explicit grant or valid issue read path. ## Model Used OpenAI GPT-5 Codex, Codex coding agent environment, tool use and local command execution enabled, reasoning mode active. Context window not exposed by the runtime. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
425 lines
15 KiB
TypeScript
425 lines
15 KiB
TypeScript
import fs from "node:fs/promises";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
import {
|
|
buildCatalogManifest,
|
|
formatCatalogManifest,
|
|
validateCatalog,
|
|
} from "./catalog-builder.js";
|
|
|
|
const tempDirs: string[] = [];
|
|
|
|
describe("skills catalog manifest", () => {
|
|
afterEach(async () => {
|
|
await Promise.all(tempDirs.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true })));
|
|
vi.unstubAllGlobals();
|
|
});
|
|
|
|
it("builds stable manifest entries from catalog skill directories", async () => {
|
|
const packageDir = await createCatalogPackage();
|
|
await writeSkill(packageDir, "bundled", "software-development", "github-pr-workflow", {
|
|
frontmatter: [
|
|
"name: GitHub PR Workflow",
|
|
"description: Prepare pull requests and verification notes.",
|
|
"key: paperclipai/bundled/software-development/github-pr-workflow",
|
|
"recommendedForRoles:",
|
|
" - engineer",
|
|
"tags:",
|
|
" - github",
|
|
" - pull-requests",
|
|
],
|
|
files: {
|
|
"references/checklist.md": "# Checklist\n",
|
|
},
|
|
});
|
|
|
|
const result = await buildCatalogManifest({
|
|
packageDir,
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
});
|
|
|
|
expect(result.errors).toEqual([]);
|
|
expect(result.manifest.skills).toHaveLength(1);
|
|
expect(result.manifest.skills[0]).toMatchObject({
|
|
id: "paperclipai:bundled:software-development:github-pr-workflow",
|
|
key: "paperclipai/bundled/software-development/github-pr-workflow",
|
|
kind: "bundled",
|
|
category: "software-development",
|
|
slug: "github-pr-workflow",
|
|
name: "GitHub PR Workflow",
|
|
trustLevel: "markdown_only",
|
|
compatibility: "compatible",
|
|
recommendedForRoles: ["engineer"],
|
|
tags: ["github", "pull-requests"],
|
|
});
|
|
expect(result.manifest.skills[0]!.files.map((file) => file.path)).toEqual([
|
|
"SKILL.md",
|
|
"references/checklist.md",
|
|
]);
|
|
expect(result.manifest.skills[0]!.contentHash).toMatch(/^sha256:[a-f0-9]{64}$/);
|
|
});
|
|
|
|
it("builds stable manifest entries from pinned GitHub references", async () => {
|
|
const packageDir = await createCatalogPackage();
|
|
const skillMarkdown = [
|
|
"---",
|
|
"name: Remote Research",
|
|
"description: Research recent discussion from a pinned upstream skill.",
|
|
"---",
|
|
"",
|
|
"Use this skill.",
|
|
"",
|
|
].join("\n");
|
|
const script = "print('hello')\n";
|
|
await writeReference(packageDir, "optional", "research", "remote-research", {
|
|
source: {
|
|
type: "github",
|
|
hostname: "github.com",
|
|
owner: "example",
|
|
repo: "remote-skill",
|
|
ref: "v1.0.0",
|
|
commit: "0123456789abcdef0123456789abcdef01234567",
|
|
path: "skills/remote-research",
|
|
},
|
|
files: ["SKILL.md", "scripts/**"],
|
|
recommendedForRoles: ["researcher"],
|
|
tags: ["research"],
|
|
});
|
|
const fetchMock = vi.fn(async (url: string) => {
|
|
if (url.includes("/git/trees/")) {
|
|
return new Response(JSON.stringify({
|
|
tree: [
|
|
{ path: "skills/remote-research/SKILL.md", type: "blob", size: Buffer.byteLength(skillMarkdown) },
|
|
{ path: "skills/remote-research/scripts/run.py", type: "blob", size: Buffer.byteLength(script) },
|
|
{ path: "README.md", type: "blob", size: 9 },
|
|
],
|
|
}), { status: 200 });
|
|
}
|
|
if (url.endsWith("/skills/remote-research/SKILL.md")) {
|
|
return new Response(skillMarkdown, { status: 200 });
|
|
}
|
|
if (url.endsWith("/skills/remote-research/scripts/run.py")) {
|
|
return new Response(script, { status: 200 });
|
|
}
|
|
return new Response("not found", { status: 404 });
|
|
});
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
|
|
const result = await buildCatalogManifest({
|
|
packageDir,
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
});
|
|
|
|
expect(result.errors).toEqual([]);
|
|
expect(result.manifest.skills[0]).toMatchObject({
|
|
id: "paperclipai:optional:research:remote-research",
|
|
key: "paperclipai/optional/research/remote-research",
|
|
path: "catalog/optional/research/remote-research",
|
|
trustLevel: "scripts_executables",
|
|
recommendedForRoles: ["researcher"],
|
|
tags: ["research"],
|
|
source: {
|
|
type: "github",
|
|
owner: "example",
|
|
repo: "remote-skill",
|
|
ref: "v1.0.0",
|
|
commit: "0123456789abcdef0123456789abcdef01234567",
|
|
path: "skills/remote-research",
|
|
},
|
|
});
|
|
expect(result.manifest.skills[0]!.files.map((file) => file.path)).toEqual([
|
|
"SKILL.md",
|
|
"scripts/run.py",
|
|
]);
|
|
expect(result.manifest.skills[0]!.contentHash).toMatch(/^sha256:[a-f0-9]{64}$/);
|
|
});
|
|
|
|
it("reuses the existing manifest entry when a pinned GitHub reference is temporarily unavailable", async () => {
|
|
const packageDir = await createCatalogPackage();
|
|
await writeReference(packageDir, "optional", "research", "remote-research", {
|
|
source: {
|
|
type: "github",
|
|
hostname: "github.com",
|
|
owner: "example",
|
|
repo: "remote-skill",
|
|
ref: "v1.0.0",
|
|
commit: "0123456789abcdef0123456789abcdef01234567",
|
|
path: "skills/remote-research",
|
|
},
|
|
files: ["SKILL.md", "scripts/**"],
|
|
recommendedForRoles: ["researcher"],
|
|
tags: ["research"],
|
|
});
|
|
await fs.mkdir(path.join(packageDir, "generated"), { recursive: true });
|
|
await fs.writeFile(
|
|
path.join(packageDir, "generated", "catalog.json"),
|
|
formatCatalogManifest({
|
|
schemaVersion: 1,
|
|
packageName: "@paperclipai/skills-catalog",
|
|
packageVersion: "0.3.1",
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
skills: [{
|
|
id: "paperclipai:optional:research:remote-research",
|
|
key: "paperclipai/optional/research/remote-research",
|
|
kind: "optional",
|
|
category: "research",
|
|
slug: "remote-research",
|
|
name: "Remote Research",
|
|
description: "Research recent discussion from a pinned upstream skill.",
|
|
path: "catalog/optional/research/remote-research",
|
|
entrypoint: "SKILL.md",
|
|
trustLevel: "scripts_executables",
|
|
compatibility: "compatible",
|
|
defaultInstall: false,
|
|
recommendedForRoles: ["researcher"],
|
|
requires: [],
|
|
tags: ["research"],
|
|
files: [
|
|
{
|
|
path: "SKILL.md",
|
|
kind: "skill",
|
|
sizeBytes: 128,
|
|
sha256: "a".repeat(64),
|
|
},
|
|
{
|
|
path: "scripts/run.py",
|
|
kind: "script",
|
|
sizeBytes: 14,
|
|
sha256: "b".repeat(64),
|
|
},
|
|
],
|
|
contentHash: `sha256:${"c".repeat(64)}`,
|
|
source: {
|
|
type: "github",
|
|
hostname: "github.com",
|
|
owner: "example",
|
|
repo: "remote-skill",
|
|
ref: "v1.0.0",
|
|
commit: "0123456789abcdef0123456789abcdef01234567",
|
|
path: "skills/remote-research",
|
|
url: "https://github.com/example/remote-skill/tree/v1.0.0/skills/remote-research",
|
|
},
|
|
}],
|
|
}),
|
|
"utf8",
|
|
);
|
|
vi.stubGlobal("fetch", vi.fn(async (url: string) => {
|
|
if (url.includes("/git/trees/")) {
|
|
return new Response("forbidden", { status: 403 });
|
|
}
|
|
return new Response("not found", { status: 404 });
|
|
}));
|
|
|
|
const result = await buildCatalogManifest({
|
|
packageDir,
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
});
|
|
|
|
expect(result.errors).toEqual([]);
|
|
expect(result.manifest.skills).toHaveLength(1);
|
|
expect(result.manifest.skills[0]?.name).toBe("Remote Research");
|
|
expect(result.manifest.skills[0]?.files.map((file) => file.path)).toEqual(["SKILL.md", "scripts/run.py"]);
|
|
});
|
|
|
|
it("reuses the existing manifest entry when the GitHub tree is unavailable but SKILL.md can be fetched", async () => {
|
|
const packageDir = await createCatalogPackage();
|
|
await writeReference(packageDir, "optional", "research", "remote-research", {
|
|
source: {
|
|
type: "github",
|
|
hostname: "github.com",
|
|
owner: "example",
|
|
repo: "remote-skill",
|
|
ref: "v1.0.0",
|
|
commit: "0123456789abcdef0123456789abcdef01234567",
|
|
path: "skills/remote-research",
|
|
},
|
|
files: ["SKILL.md", "scripts/**"],
|
|
recommendedForRoles: ["researcher"],
|
|
tags: ["research"],
|
|
});
|
|
await fs.mkdir(path.join(packageDir, "generated"), { recursive: true });
|
|
await fs.writeFile(
|
|
path.join(packageDir, "generated", "catalog.json"),
|
|
formatCatalogManifest({
|
|
schemaVersion: 1,
|
|
packageName: "@paperclipai/skills-catalog",
|
|
packageVersion: "0.3.1",
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
skills: [{
|
|
id: "paperclipai:optional:research:remote-research",
|
|
key: "paperclipai/optional/research/remote-research",
|
|
kind: "optional",
|
|
category: "research",
|
|
slug: "remote-research",
|
|
name: "Remote Research",
|
|
description: "Research recent discussion from a pinned upstream skill.",
|
|
path: "catalog/optional/research/remote-research",
|
|
entrypoint: "SKILL.md",
|
|
trustLevel: "scripts_executables",
|
|
compatibility: "compatible",
|
|
defaultInstall: false,
|
|
recommendedForRoles: ["researcher"],
|
|
requires: [],
|
|
tags: ["research"],
|
|
files: [
|
|
{
|
|
path: "SKILL.md",
|
|
kind: "skill",
|
|
sizeBytes: 128,
|
|
sha256: "a".repeat(64),
|
|
},
|
|
],
|
|
contentHash: `sha256:${"c".repeat(64)}`,
|
|
source: {
|
|
type: "github",
|
|
hostname: "github.com",
|
|
owner: "example",
|
|
repo: "remote-skill",
|
|
ref: "v1.0.0",
|
|
commit: "0123456789abcdef0123456789abcdef01234567",
|
|
path: "skills/remote-research",
|
|
url: "https://github.com/example/remote-skill/tree/v1.0.0/skills/remote-research",
|
|
},
|
|
}],
|
|
}),
|
|
"utf8",
|
|
);
|
|
vi.stubGlobal("fetch", vi.fn(async (url: string) => {
|
|
if (url.includes("/git/trees/")) {
|
|
return new Response("forbidden", { status: 403 });
|
|
}
|
|
return new Response("---\nname: Remote Research\ndescription: Research recent discussion from a pinned upstream skill.\n---\n");
|
|
}));
|
|
|
|
const result = await buildCatalogManifest({
|
|
packageDir,
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
});
|
|
|
|
expect(result.errors).toEqual([]);
|
|
expect(result.manifest.skills).toHaveLength(1);
|
|
expect(result.manifest.skills[0]?.files.map((file) => file.path)).toEqual(["SKILL.md"]);
|
|
});
|
|
|
|
it("reports frontmatter, directory, uniqueness, and inventory errors together", async () => {
|
|
const packageDir = await createCatalogPackage();
|
|
await writeSkill(packageDir, "bundled", "Bad_Category", "duplicate", {
|
|
frontmatter: [
|
|
"name: Duplicate",
|
|
"key: paperclipai/bundled/software-development/other",
|
|
"recommendedForRoles: engineer",
|
|
],
|
|
});
|
|
await writeSkill(packageDir, "optional", "software-development", "duplicate", {
|
|
frontmatter: [
|
|
"name: Duplicate Optional",
|
|
"description: Optional duplicate slug.",
|
|
],
|
|
});
|
|
await fs.mkdir(path.join(packageDir, "catalog", "bundled", "software-development", "missing-skill"), {
|
|
recursive: true,
|
|
});
|
|
await fs.mkdir(path.join(packageDir, "catalog", "misc"), { recursive: true });
|
|
await fs.writeFile(path.join(packageDir, "catalog", "misc", "SKILL.md"), "# Misplaced\n", "utf8");
|
|
|
|
const result = await buildCatalogManifest({
|
|
packageDir,
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
});
|
|
|
|
expect(result.errors).toEqual(
|
|
expect.arrayContaining([
|
|
expect.stringContaining("catalog/misc/SKILL.md is not under catalog/<bundled|optional>/<category>/<slug>/{SKILL.md,catalog-ref.json}"),
|
|
expect.stringContaining("catalog/bundled/software-development/missing-skill is missing SKILL.md or catalog-ref.json"),
|
|
expect.stringContaining("has invalid category"),
|
|
expect.stringContaining("frontmatter must include description"),
|
|
expect.stringContaining("key must be paperclipai/bundled/Bad_Category/duplicate"),
|
|
expect.stringContaining("field recommendedForRoles must be an array of strings"),
|
|
expect.stringContaining("Duplicate catalog slug \"duplicate\""),
|
|
]),
|
|
);
|
|
});
|
|
|
|
it("detects stale generated manifests", async () => {
|
|
const packageDir = await createCatalogPackage();
|
|
await writeSkill(packageDir, "bundled", "software-development", "review", {
|
|
frontmatter: [
|
|
"name: Review",
|
|
"description: Review implementation work.",
|
|
],
|
|
});
|
|
await fs.mkdir(path.join(packageDir, "generated"), { recursive: true });
|
|
await fs.writeFile(
|
|
path.join(packageDir, "generated", "catalog.json"),
|
|
formatCatalogManifest({
|
|
schemaVersion: 1,
|
|
packageName: "@paperclipai/skills-catalog",
|
|
packageVersion: "0.3.1",
|
|
generatedAt: "2026-05-26T00:00:00.000Z",
|
|
skills: [],
|
|
}),
|
|
"utf8",
|
|
);
|
|
|
|
const result = await validateCatalog(packageDir);
|
|
|
|
expect(result.errors).toContain(
|
|
"generated/catalog.json is stale. Run pnpm --filter @paperclipai/skills-catalog build:manifest.",
|
|
);
|
|
});
|
|
});
|
|
|
|
async function createCatalogPackage() {
|
|
const packageDir = await fs.mkdtemp(path.join(os.tmpdir(), "skills-catalog-"));
|
|
tempDirs.push(packageDir);
|
|
await fs.mkdir(path.join(packageDir, "catalog", "bundled"), { recursive: true });
|
|
await fs.mkdir(path.join(packageDir, "catalog", "optional"), { recursive: true });
|
|
await fs.writeFile(
|
|
path.join(packageDir, "package.json"),
|
|
JSON.stringify({ version: "0.3.1" }),
|
|
"utf8",
|
|
);
|
|
return packageDir;
|
|
}
|
|
|
|
async function writeSkill(
|
|
packageDir: string,
|
|
kind: "bundled" | "optional",
|
|
category: string,
|
|
slug: string,
|
|
options: {
|
|
frontmatter: string[];
|
|
files?: Record<string, string>;
|
|
},
|
|
) {
|
|
const skillDir = path.join(packageDir, "catalog", kind, category, slug);
|
|
await fs.mkdir(skillDir, { recursive: true });
|
|
await fs.writeFile(
|
|
path.join(skillDir, "SKILL.md"),
|
|
`---\n${options.frontmatter.join("\n")}\n---\n\nUse this skill.\n`,
|
|
"utf8",
|
|
);
|
|
for (const [relativePath, content] of Object.entries(options.files ?? {})) {
|
|
const filePath = path.join(skillDir, relativePath);
|
|
await fs.mkdir(path.dirname(filePath), { recursive: true });
|
|
await fs.writeFile(filePath, content, "utf8");
|
|
}
|
|
}
|
|
|
|
async function writeReference(
|
|
packageDir: string,
|
|
kind: "bundled" | "optional",
|
|
category: string,
|
|
slug: string,
|
|
descriptor: Record<string, unknown>,
|
|
) {
|
|
const skillDir = path.join(packageDir, "catalog", kind, category, slug);
|
|
await fs.mkdir(skillDir, { recursive: true });
|
|
await fs.writeFile(
|
|
path.join(skillDir, "catalog-ref.json"),
|
|
`${JSON.stringify(descriptor, null, 2)}\n`,
|
|
"utf8",
|
|
);
|
|
}
|