dbebf30c89
## Thinking Path > - Paperclip is a control plane for AI-agent companies, so execution policy and trust boundaries are part of the product's safety contract. > - Low-trust review work needs narrower authority than normal same-company agents because hostile PRs, comments, attachments, and generated output can carry prompt-injection payloads. > - The current V1 shape gives trusted workers broad company context, which is useful for normal execution but too permissive for a reviewer assigned to hostile content. > - This branch adds a `low_trust_review` preset, source-trust tagging, route-level containment, and quarantine handling so low-trust output does not automatically flow into higher-trust wake context. > - The branch has been rebased onto current `origin/master`, and the low-trust migration was renumbered to `0097_low_trust_source_trust.sql` to avoid collisions with existing `0091` through `0096` migrations. > - Greptile feedback was addressed by tightening low-trust detection, preserving project-level trust policy checks, fixing issue-kind promotion lookup, removing duplicate post-lease isolation assertion, documenting fail-closed source-trust behavior, bounding ancestry checks, enforcing runtime issue context for CEOs, awaiting accepted-plan monitor authorization, and making low-trust issue source-trust tagging atomic. > - The benefit is a first production slice of deny-by-default review containment with regression coverage for the main control-plane pivot surfaces. Fixes #7531. ## What Changed - Added shared trust-policy types and validators, plus database/source-trust fields for issues, comments, documents, and work products. - Implemented server enforcement for low-trust issue scope, agent self-view redaction, secret/plugin/runtime denial paths, promotion checks, and quarantined continuation/wake context. - Added focused low-trust regression tests for resolver behavior, source trust, route authorization, heartbeat preflight ordering, runtime containment, and quarantine redaction. - Added board UI affordances for selecting/reviewing the low-trust preset and surfacing source-trust badges in relevant issue views. - Added `doc/LOW-TRUST-PRESETS.md`, updated `doc/SPEC-implementation.md`, and committed the low-trust review contract plan under `doc/plans/`. - Rebasing note: the original `0097_low_trust_source_trust.sql` migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered migration are not broken by the renumbered migration. ## Verification - Rebased branch onto current `origin/master` and force-pushed with lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`. - Confirmed the PR diff does not include `pnpm-lock.yaml` or `.github/workflows` changes. - Resolved upstream UI/comment conflicts by preserving deleted-comment tombstone behavior and low-trust source-trust badges/metadata. - Renumbered the low-trust source-trust migration to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied an old-numbered copy are not broken. - `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts` - `pnpm exec vitest run server/src/__tests__/source-trust.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts ui/src/lib/trust-policy-ui.test.ts ui/src/components/TrustPresetSection.test.tsx` - `pnpm run typecheck:build-gaps` - `git diff --check` - GitHub checks pass on head `2719f31e3`: build, typecheck/release registry, general tests, serialized server suites, e2e, canary, verify, policy/review, Socket, and Snyk. - Greptile Review passes with Confidence Score 5/5 and zero unresolved Greptile review threads. - No design screenshots/images were added because the task explicitly says not to add them unless they are specifically part of the work. ## Risks - Medium risk: this touches shared trust-policy contracts, server authorization paths, heartbeat context generation, migration metadata, and UI preset controls. - Low-trust containment is intentionally deny-by-default; legitimate future review workflows may need explicit allowlisted exceptions. - Plugin/runtime/security surfaces are broad, so regression tests cover the current known routes but future integrations must route through the same containment layer. - The PR is ready for review; GitHub checks are green and Greptile is 5/5. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI workflow. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] UI changes are covered by focused tests; no screenshots were added per task instruction not to add design images unless specifically required - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
285 lines
9.9 KiB
TypeScript
285 lines
9.9 KiB
TypeScript
import { and, eq } from "drizzle-orm";
|
|
import type { Db } from "@paperclipai/db";
|
|
import { documents, issueDocuments, issues } from "@paperclipai/db";
|
|
import { ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, type SourceTrustMetadata } from "@paperclipai/shared";
|
|
import { documentService } from "./documents.js";
|
|
|
|
export { ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY };
|
|
export const ISSUE_CONTINUATION_SUMMARY_TITLE = "Continuation Summary";
|
|
export const ISSUE_CONTINUATION_SUMMARY_MAX_BODY_CHARS = 8_000;
|
|
const SUMMARY_SECTION_MAX_CHARS = 1_200;
|
|
const PATH_CANDIDATE_RE = /(?:^|[\s`"'(])((?:server|ui|packages|doc|scripts|\.github)\/[A-Za-z0-9._/-]+)/g;
|
|
const WAITING_FOR_REVIEW_OR_APPROVAL_RE =
|
|
/\bwait(?:ing)? for\b.{0,160}\b(?:review(?:er)?(?: feedback)?|approval|board|human|user|operator)\b/i;
|
|
|
|
type IssueSummaryInput = {
|
|
id: string;
|
|
identifier: string | null;
|
|
title: string;
|
|
description: string | null;
|
|
status: string;
|
|
priority: string;
|
|
};
|
|
|
|
type RunSummaryInput = {
|
|
id: string;
|
|
status: string;
|
|
error: string | null;
|
|
errorCode?: string | null;
|
|
resultJson?: Record<string, unknown> | null;
|
|
stdoutExcerpt?: string | null;
|
|
stderrExcerpt?: string | null;
|
|
finishedAt?: Date | null;
|
|
};
|
|
|
|
type AgentSummaryInput = {
|
|
id: string;
|
|
name: string;
|
|
adapterType: string | null;
|
|
};
|
|
|
|
export type IssueContinuationSummaryDocument = {
|
|
key: typeof ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY;
|
|
title: string | null;
|
|
body: string;
|
|
latestRevisionId: string | null;
|
|
latestRevisionNumber: number;
|
|
sourceTrust: SourceTrustMetadata | null;
|
|
updatedAt: Date;
|
|
};
|
|
|
|
function truncateText(value: string, maxChars: number) {
|
|
const trimmed = value.trim();
|
|
if (trimmed.length <= maxChars) return trimmed;
|
|
return `${trimmed.slice(0, Math.max(0, maxChars - 20)).trimEnd()}\n[truncated]`;
|
|
}
|
|
|
|
function asNonEmptyString(value: unknown) {
|
|
return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
|
|
}
|
|
|
|
function readResultSummary(resultJson: Record<string, unknown> | null | undefined) {
|
|
if (!resultJson || typeof resultJson !== "object" || Array.isArray(resultJson)) return null;
|
|
return (
|
|
asNonEmptyString(resultJson.summary) ??
|
|
asNonEmptyString(resultJson.result) ??
|
|
asNonEmptyString(resultJson.message) ??
|
|
asNonEmptyString(resultJson.error) ??
|
|
null
|
|
);
|
|
}
|
|
|
|
function extractMarkdownSection(markdown: string | null | undefined, heading: string) {
|
|
if (!markdown) return null;
|
|
const escaped = heading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
|
const re = new RegExp(`^##\\s+${escaped}\\s*$([\\s\\S]*?)(?=^##\\s+|(?![\\s\\S]))`, "im");
|
|
const match = re.exec(markdown);
|
|
const section = match?.[1]?.trim();
|
|
return section ? truncateText(section, SUMMARY_SECTION_MAX_CHARS) : null;
|
|
}
|
|
|
|
function extractPathCandidates(...texts: Array<string | null | undefined>) {
|
|
const seen = new Set<string>();
|
|
for (const text of texts) {
|
|
if (!text) continue;
|
|
for (const match of text.matchAll(PATH_CANDIDATE_RE)) {
|
|
const path = match[1]?.replace(/[),.;:]+$/, "");
|
|
if (path) seen.add(path);
|
|
if (seen.size >= 12) break;
|
|
}
|
|
if (seen.size >= 12) break;
|
|
}
|
|
return [...seen];
|
|
}
|
|
|
|
function inferMode(issue: IssueSummaryInput, run: RunSummaryInput) {
|
|
if (issue.status === "done" || issue.status === "in_review") return "review";
|
|
if (run.status === "failed" || run.status === "timed_out" || run.status === "cancelled") return "implementation";
|
|
if (issue.status === "backlog" || issue.status === "todo") return "plan";
|
|
return "implementation";
|
|
}
|
|
|
|
function inferNextAction(issue: IssueSummaryInput, run: RunSummaryInput, previousNextAction: string | null) {
|
|
if (issue.status === "done") return "Review the completed issue output and close any remaining follow-up comments.";
|
|
if (issue.status === "in_review") return "Wait for reviewer feedback or approval before continuing executor work.";
|
|
if (run.status === "failed" || run.status === "timed_out") {
|
|
return "Inspect the failed run, fix the cause, and resume from the most recent concrete action above.";
|
|
}
|
|
if (run.status === "cancelled") return "Confirm the cancellation reason before starting another run.";
|
|
return previousNextAction ?? "Resume implementation from the acceptance criteria, latest comments, and this summary.";
|
|
}
|
|
|
|
function bulletList(items: string[], empty: string) {
|
|
if (items.length === 0) return `- ${empty}`;
|
|
return items.map((item) => `- ${item}`).join("\n");
|
|
}
|
|
|
|
function extractPreviousNextAction(previousBody: string | null | undefined) {
|
|
const section = extractMarkdownSection(previousBody, "Next Action");
|
|
if (!section) return null;
|
|
return section
|
|
.split(/\r?\n/)
|
|
.map((line) => line.replace(/^[-*]\s+/, "").trim())
|
|
.find(Boolean) ?? null;
|
|
}
|
|
|
|
export function extractContinuationSummaryNextAction(body: string | null | undefined) {
|
|
return extractPreviousNextAction(body);
|
|
}
|
|
|
|
export function continuationSummaryParksExecutor(body: string | null | undefined) {
|
|
const nextAction = extractContinuationSummaryNextAction(body);
|
|
if (!nextAction) return false;
|
|
return WAITING_FOR_REVIEW_OR_APPROVAL_RE.test(nextAction);
|
|
}
|
|
|
|
export function buildContinuationSummaryMarkdown(input: {
|
|
issue: IssueSummaryInput;
|
|
run: RunSummaryInput;
|
|
agent: AgentSummaryInput;
|
|
previousSummaryBody?: string | null;
|
|
}) {
|
|
const { issue, run, agent } = input;
|
|
const resultSummary = readResultSummary(run.resultJson);
|
|
const recentActions = [
|
|
`Run \`${run.id}\` finished with status \`${run.status}\`${run.finishedAt ? ` at ${run.finishedAt.toISOString()}` : ""}.`,
|
|
resultSummary ? truncateText(resultSummary, SUMMARY_SECTION_MAX_CHARS) : "No adapter-provided result summary was captured for this run.",
|
|
];
|
|
if (run.error) {
|
|
recentActions.push(`Latest run error${run.errorCode ? ` (${run.errorCode})` : ""}: ${truncateText(run.error, 500)}`);
|
|
}
|
|
|
|
const paths = extractPathCandidates(resultSummary, run.stdoutExcerpt, run.stderrExcerpt, input.previousSummaryBody);
|
|
const objective = extractMarkdownSection(issue.description, "Objective") ?? issue.description?.trim() ?? "No objective captured.";
|
|
const acceptanceCriteria = extractMarkdownSection(issue.description, "Acceptance Criteria") ?? "No explicit acceptance criteria captured.";
|
|
const mode = inferMode(issue, run);
|
|
const nextAction = inferNextAction(issue, run, extractPreviousNextAction(input.previousSummaryBody));
|
|
|
|
const body = [
|
|
"# Continuation Summary",
|
|
"",
|
|
`- Issue: ${issue.identifier ?? issue.id} — ${issue.title}`,
|
|
`- Status: ${issue.status}`,
|
|
`- Priority: ${issue.priority}`,
|
|
`- Current mode: ${mode}`,
|
|
`- Last updated by run: ${run.id}`,
|
|
`- Agent: ${agent.name} (${agent.adapterType ?? "unknown"})`,
|
|
"",
|
|
"## Objective",
|
|
"",
|
|
truncateText(objective, SUMMARY_SECTION_MAX_CHARS),
|
|
"",
|
|
"## Acceptance Criteria",
|
|
"",
|
|
acceptanceCriteria,
|
|
"",
|
|
"## Recent Concrete Actions",
|
|
"",
|
|
bulletList(recentActions, "No recent actions captured."),
|
|
"",
|
|
"## Files / Routes Touched",
|
|
"",
|
|
bulletList(paths.map((path) => `\`${path}\``), "No file or route paths were detected in the captured run summary."),
|
|
"",
|
|
"## Commands Run",
|
|
"",
|
|
bulletList(
|
|
[
|
|
`Heartbeat run \`${run.id}\` invoked adapter \`${agent.adapterType ?? "unknown"}\`.`,
|
|
"Detailed shell/tool commands remain in the run log and transcript.",
|
|
],
|
|
"No command metadata captured.",
|
|
),
|
|
"",
|
|
"## Blockers / Decisions",
|
|
"",
|
|
bulletList(
|
|
run.error
|
|
? [`Latest run ended with \`${run.status}\`; inspect the error before continuing.`]
|
|
: ["No new blocker was recorded by the latest run."],
|
|
"No blockers or decisions captured.",
|
|
),
|
|
"",
|
|
"## Next Action",
|
|
"",
|
|
`- ${nextAction}`,
|
|
].join("\n");
|
|
|
|
return truncateText(body, ISSUE_CONTINUATION_SUMMARY_MAX_BODY_CHARS);
|
|
}
|
|
|
|
export async function getIssueContinuationSummaryDocument(
|
|
db: Db,
|
|
issueId: string,
|
|
): Promise<IssueContinuationSummaryDocument | null> {
|
|
const row = await db
|
|
.select({
|
|
key: issueDocuments.key,
|
|
title: documents.title,
|
|
body: documents.latestBody,
|
|
latestRevisionId: documents.latestRevisionId,
|
|
latestRevisionNumber: documents.latestRevisionNumber,
|
|
sourceTrust: documents.sourceTrust,
|
|
updatedAt: documents.updatedAt,
|
|
})
|
|
.from(issueDocuments)
|
|
.innerJoin(documents, eq(issueDocuments.documentId, documents.id))
|
|
.where(and(eq(issueDocuments.issueId, issueId), eq(issueDocuments.key, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY)))
|
|
.then((rows) => rows[0] ?? null);
|
|
|
|
if (!row) return null;
|
|
return {
|
|
key: ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY,
|
|
title: row.title,
|
|
body: row.body,
|
|
latestRevisionId: row.latestRevisionId,
|
|
latestRevisionNumber: row.latestRevisionNumber,
|
|
sourceTrust: row.sourceTrust ?? null,
|
|
updatedAt: row.updatedAt,
|
|
};
|
|
}
|
|
|
|
export async function refreshIssueContinuationSummary(input: {
|
|
db: Db;
|
|
issueId: string;
|
|
run: RunSummaryInput;
|
|
agent: AgentSummaryInput;
|
|
}) {
|
|
const { db, issueId, run, agent } = input;
|
|
const [issue, existing] = await Promise.all([
|
|
db
|
|
.select({
|
|
id: issues.id,
|
|
identifier: issues.identifier,
|
|
title: issues.title,
|
|
description: issues.description,
|
|
status: issues.status,
|
|
priority: issues.priority,
|
|
})
|
|
.from(issues)
|
|
.where(eq(issues.id, issueId))
|
|
.then((rows) => rows[0] ?? null),
|
|
getIssueContinuationSummaryDocument(db, issueId),
|
|
]);
|
|
|
|
if (!issue) return null;
|
|
const body = buildContinuationSummaryMarkdown({
|
|
issue,
|
|
run,
|
|
agent,
|
|
previousSummaryBody: existing?.body ?? null,
|
|
});
|
|
const result = await documentService(db).upsertIssueDocument({
|
|
issueId,
|
|
key: ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY,
|
|
title: ISSUE_CONTINUATION_SUMMARY_TITLE,
|
|
format: "markdown",
|
|
body,
|
|
baseRevisionId: existing?.latestRevisionId ?? null,
|
|
changeSummary: `Refresh continuation summary after run ${run.id}`,
|
|
createdByAgentId: agent.id,
|
|
createdByRunId: run.id,
|
|
});
|
|
return result.document;
|
|
}
|