chore: promote dev to master — CLI agent management & permission bootstrap#23
Conversation
Adds `paperclipai agent create` subcommand that calls POST /agent-hires with full config options: --name, --role, --title, --reports-to, --adapter-type, --adapter-config, --runtime-config, --budget, and convenience shortcuts --cwd, --model, --instructions-file. Supports --json output and detects pending_approval status when company requires board approval for new agents.
- Add Origin header (matching apiBase) to all CLI HTTP client requests, fixing 403 "Board mutation requires trusted browser origin" errors when running `auth login` in authenticated deployment mode. - Add `--claim <token>` flag to `auth bootstrap-ceo` command. When provided with authentication (--api-key or session), calls POST /api/invites/:token/accept to promote user to instance admin without requiring a browser. - Add tests verifying Origin header is sent on POST, rawPost, and GET requests, and that trailing slashes are stripped from apiBase.
…d `agent import` When `agent local-cli` encounters a 404 (agent not found), it now offers to create the agent instead of failing: - `--create` flag: auto-creates with --name defaulting to agentRef - Interactive mode: prompts "Agent not found. Create it?" via @clack/prompts - Non-interactive without --create: clear error message with hint - Accepts --role, --model, --cwd flags to pre-fill creation config - After creation, continues with normal local-cli flow (key + skills) Also adds `agent import <path>` command that reads AGENTS.md/SOUL.md frontmatter from a local folder and creates the agent via the hire API. Supports --dry-run, --setup-keys, and CLI overrides for all config fields.
…gement docs Add PAT auth subsection, Bootstrap Flow guide, CLI Quick Reference table, agent-must-exist warning for local-cli, hiring line CLI alternatives, and CLI equivalents column to api-reference.md Full API Reference tables. Co-Authored-By: Paperclip <noreply@paperclip.ing>
…nd --help examples - Add `member list` and `member set-role` CLI commands for company member and permission management - Add membership warning to `auth create-key`: checks my-permissions and warns when user has no company membership (best-effort, uses context companyId) - Add --help examples to all new commands: agent create, agent import, agent local-cli, member list, member set-role, auth create-key - Audit confirms all new commands support --json flag consistently
…-missing feat: CLI-first agent management & permission bootstrap
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
namastex888 has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis PR introduces origin header validation in HTTP requests, adds a new bootstrap invite claiming command, expands agent creation and import workflows with frontmatter parsing, introduces member management commands, and enriches documentation with governance-aware CLI guidance and command references. Changes span HTTP client middleware, multiple new CLI command modules, and authentication enhancements. Changes
Sequence Diagram(s)sequenceDiagram
participant User as User (CLI)
participant Validate as Token Validator
participant Context as Context Resolver
participant Auth as Auth Checker
participant Client as HTTP Client
participant API as Backend API
User->>Validate: claimBootstrapInvite(claim token)
Validate->>Validate: Validate token format
alt Token Invalid
Validate->>User: Exit with error
end
Validate->>Context: Resolve context/profile
Context->>Context: Load apiBase, apiKey
Context->>Auth: Check authentication
alt No Auth Available
Auth->>User: Exit - auth required
end
Auth->>Client: Instantiate PaperclipApiClient
Client->>API: POST /api/invites/{token}/accept<br/>(requestType: human)
API->>Client: Return userId, status
alt json flag set
Client->>User: Output JSON response
else
Client->>User: Print success message<br/>+ userId + verification hint
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly expands the CLI's capabilities, shifting towards a CLI-first approach for managing agents and company permissions. It introduces commands for creating and importing agents, streamlines the local agent setup, and provides robust tools for member role assignment. Additionally, it refines the initial instance bootstrap process and enhances API key creation with clearer permission feedback, making the CLI a more powerful and self-sufficient tool for system administration. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request successfully promotes the dev branch to master, incorporating significant new CLI functionalities for agent management and permission bootstrapping. The changes introduce paperclipai agent create, paperclipai agent import, and enhancements to paperclipai agent local-cli, alongside new paperclipai member list and member set-role commands. The auth bootstrap-ceo command is also extended to allow claiming invites directly from the CLI. Additionally, the PaperclipApiClient now correctly sends the Origin header, and the documentation (SKILL.md and api-reference.md) has been updated to reflect these new features. Overall, the new commands provide a more comprehensive CLI-first experience for managing agents and permissions. My primary feedback is a high-severity correctness issue regarding the adapterType when creating agents via local-cli --create.
| .option("--model <model>", "Adapter model when creating (e.g. opus, sonnet)") | ||
| .option("--cwd <path>", "Adapter working directory when creating") |
There was a problem hiding this comment.
The agent local-cli --create command currently hardcodes the adapterType to "process" when creating a new agent. This is inconsistent with the agent create command, which allows specifying the adapter type. If a user provides --model without explicitly setting --adapter-type, the agent might be created with an adapterType that doesn't correctly utilize the provided model (e.g., a process adapter typically doesn't handle LLM models directly). To ensure consistency and correct agent configuration, the --adapter-type option should be available for local-cli --create.
| .option("--model <model>", "Adapter model when creating (e.g. opus, sonnet)") | |
| .option("--cwd <path>", "Adapter working directory when creating") | |
| .option("--adapter-type <type>", "Adapter type when creating (claude_local, codex_local, process, etc.)", "process") | |
| .option("--model <model>", "Adapter model when creating (e.g. opus, sonnet)") |
| const createBody: Record<string, unknown> = { | ||
| name: agentRef, | ||
| role: opts.role ?? "general", | ||
| adapterType: "process", |
There was a problem hiding this comment.
Following the previous comment, the adapterType should be derived from the provided options, defaulting to "process" if not specified, to align with the agent create command's behavior and allow for more flexible agent creation.
| adapterType: "process", | |
| adapterType: opts.adapterType ?? "process", |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df76fddbe9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| agentRow = await ctx.api.get<Agent>( | ||
| `/api/agents/${encodeURIComponent(agentRef)}?${query.toString()}`, | ||
| ); |
There was a problem hiding this comment.
This local-cli lookup treats any 404 from GET /api/agents/:id as “missing” and immediately enters the create-if-missing path, but the server endpoint resolves by exact agents.id (not url-key/shortname). As a result, passing a documented shortname/url-key will always 404, and the command will prompt to create (or auto-create with --create) even when the agent already exists, leading to spurious hire attempts and shortname-collision failures.
Useful? React with 👍 / 👎.
| const match = | ||
| members.find((m) => m.id === identifier) ?? | ||
| members.find((m) => m.principalId === identifier); |
There was a problem hiding this comment.
Role assignment only matches identifier against membership id and principalId; it never resolves human emails. In this same change set, user-facing docs/examples direct operators to run paperclipai member set-role <email> ..., so following the documented flow sends the raw email as memberId and results in Member not found. This breaks the advertised bootstrap/permission workflow unless users already know internal UUIDs.
Useful? React with 👍 / 👎.
2 participants
Summary
Promotes dev to master after merging PR #22: CLI-first agent management & permission bootstrap.
Included changes:
paperclipai agent create— create agents from CLIpaperclipai agent import <path>— import from local folderpaperclipai agent local-cli --create— create-if-missing flowpaperclipai member list/member set-role— permission managementpaperclipai auth loginOrigin header fixpaperclipai auth bootstrap-ceo --claim— CLI bootstrap claimauth create-keymembership warningSource PR
Test plan
paperclipai agent create --name test --role engineer -C <cid>workspaperclipai agent import <folder> -C <cid>workspaperclipai member list -C <cid>shows memberspaperclipai auth loginworks in authenticated modeSummary by CodeRabbit
Release Notes
New Features
Documentation