corporateai 0.0.1

package/server/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@corporateai/server",
+  "version": "0.3.1",
+  "license": "MIT",
+  "homepage": "https://github.com/EvanGribar/corporate",
+  "bugs": {
+    "url": "https://github.com/EvanGribar/corporate/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/EvanGribar/corporate",
+    "directory": "server"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "publishConfig": {
+    "access": "public",
+    "exports": {
+      ".": {
+        "types": "./dist/index.d.ts",
+        "import": "./dist/index.js"
+      }
+    },
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts"
+  },
+  "files": [
+    "dist",
+    "ui-dist",
+    "skills"
+  ],
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "dev:watch": "cross-env PAPERCLIP_MIGRATION_PROMPT=never PAPERCLIP_MIGRATION_AUTO_APPLY=true tsx ./scripts/dev-watch.ts",
+    "prepare:ui-dist": "bash ../scripts/prepare-server-ui-dist.sh",
+    "build": "tsc && node ./scripts/copy-onboarding-assets.mjs",
+    "prepack": "pnpm run prepare:ui-dist",
+    "postpack": "rm -rf ui-dist",
+    "clean": "rm -rf dist",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.888.0",
+    "@corporateai/adapter-claude-local": "npm:@paperclipai/adapter-claude-local@2026.325.0",
+    "@corporateai/adapter-codex-local": "npm:@paperclipai/adapter-codex-local@2026.325.0",
+    "@corporateai/adapter-cursor-local": "npm:@paperclipai/adapter-cursor-local@2026.325.0",
+    "@corporateai/adapter-gemini-local": "npm:@paperclipai/adapter-gemini-local@2026.325.0",
+    "@corporateai/adapter-openclaw-gateway": "npm:@paperclipai/adapter-openclaw-gateway@2026.325.0",
+    "@corporateai/adapter-opencode-local": "npm:@paperclipai/adapter-opencode-local@2026.325.0",
+    "@corporateai/adapter-pi-local": "npm:@paperclipai/adapter-pi-local@2026.325.0",
+    "@corporateai/adapter-utils": "npm:@paperclipai/adapter-utils@2026.325.0",
+    "@corporateai/db": "npm:@paperclipai/db@2026.325.0",
+    "@corporateai/plugin-sdk": "npm:@paperclipai/plugin-sdk@2026.325.0",
+    "@corporateai/shared": "npm:@paperclipai/shared@2026.325.0",
+    "ajv": "^8.18.0",
+    "ajv-formats": "^3.0.1",
+    "better-auth": "1.4.18",
+    "chokidar": "^4.0.3",
+    "detect-port": "^2.1.0",
+    "dompurify": "^3.3.2",
+    "dotenv": "^17.0.1",
+    "drizzle-orm": "^0.38.4",
+    "embedded-postgres": "^18.1.0-beta.16",
+    "express": "^5.1.0",
+    "hermes-paperclip-adapter": "0.1.1",
+    "jsdom": "^28.1.0",
+    "multer": "^2.0.2",
+    "open": "^11.0.0",
+    "pino": "^9.6.0",
+    "pino-http": "^10.4.0",
+    "pino-pretty": "^13.1.3",
+    "sharp": "^0.34.5",
+    "ws": "^8.19.0",
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/express-serve-static-core": "^5.0.0",
+    "@types/jsdom": "^28.0.0",
+    "@types/multer": "^2.0.0",
+    "@types/node": "^24.6.0",
+    "@types/sharp": "^0.32.0",
+    "@types/supertest": "^6.0.2",
+    "@types/ws": "^8.18.1",
+    "cross-env": "^10.1.0",
+    "supertest": "^7.0.0",
+    "tsx": "4.19.2",
+    "typescript": "^5.7.3",
+    "vite": "^6.1.0",
+    "vitest": "^3.0.5"
+  }
+}
+

package/server/scripts/copy-onboarding-assets.mjs

@@ -0,0 +1,10 @@
+import { cpSync, existsSync, mkdirSync } from "node:fs";
+
+const sourceDir = "src/onboarding-assets";
+const targetDir = "dist/onboarding-assets";
+
+mkdirSync(targetDir, { recursive: true });
+
+if (existsSync(sourceDir)) {
+  cpSync(sourceDir, targetDir, { recursive: true });
+}

package/server/scripts/dev-watch.ts

@@ -0,0 +1,33 @@
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveServerDevWatchIgnorePaths } from "../src/dev-watch-ignore.ts";
+
+const require = createRequire(import.meta.url);
+const tsxCliPath = require.resolve("tsx/dist/cli.mjs");
+const serverRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const ignoreArgs = resolveServerDevWatchIgnorePaths(serverRoot).flatMap((ignorePath) => ["--exclude", ignorePath]);
+
+const child = spawn(
+  process.execPath,
+  [tsxCliPath, "watch", ...ignoreArgs, "src/index.ts"],
+  {
+    cwd: serverRoot,
+    env: process.env,
+    stdio: "inherit",
+  },
+);
+
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+  process.exit(code ?? 0);
+});
+
+child.on("error", (error) => {
+  console.error(error);
+  process.exit(1);
+});

package/server/src/__tests__/activity-routes.test.ts

@@ -0,0 +1,70 @@
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { errorHandler } from "../middleware/index.js";
+import { activityRoutes } from "../routes/activity.js";
+
+const mockActivityService = vi.hoisted(() => ({
+  list: vi.fn(),
+  forIssue: vi.fn(),
+  runsForIssue: vi.fn(),
+  issuesForRun: vi.fn(),
+  create: vi.fn(),
+}));
+
+const mockIssueService = vi.hoisted(() => ({
+  getById: vi.fn(),
+  getByIdentifier: vi.fn(),
+}));
+
+vi.mock("../services/activity.js", () => ({
+  activityService: () => mockActivityService,
+}));
+
+vi.mock("../services/index.js", () => ({
+  issueService: () => mockIssueService,
+}));
+
+function createApp() {
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    (req as any).actor = {
+      type: "board",
+      userId: "user-1",
+      companyIds: ["company-1"],
+      source: "session",
+      isInstanceAdmin: false,
+    };
+    next();
+  });
+  app.use("/api", activityRoutes({} as any));
+  app.use(errorHandler);
+  return app;
+}
+
+describe("activity routes", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("resolves issue identifiers before loading runs", async () => {
+    mockIssueService.getByIdentifier.mockResolvedValue({
+      id: "issue-uuid-1",
+      companyId: "company-1",
+    });
+    mockActivityService.runsForIssue.mockResolvedValue([
+      {
+        runId: "run-1",
+      },
+    ]);
+
+    const res = await request(createApp()).get("/api/issues/PAP-475/runs");
+
+    expect(res.status).toBe(200);
+    expect(mockIssueService.getByIdentifier).toHaveBeenCalledWith("PAP-475");
+    expect(mockIssueService.getById).not.toHaveBeenCalled();
+    expect(mockActivityService.runsForIssue).toHaveBeenCalledWith("company-1", "issue-uuid-1");
+    expect(res.body).toEqual([{ runId: "run-1" }]);
+  });
+});

package/server/src/__tests__/adapter-models.test.ts

@@ -0,0 +1,105 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { models as codexFallbackModels } from "@corporateai/adapter-codex-local";
+import { models as cursorFallbackModels } from "@corporateai/adapter-cursor-local";
+import { resetOpenCodeModelsCacheForTests } from "@corporateai/adapter-opencode-local/server";
+import { listAdapterModels } from "../adapters/index.js";
+import { resetCodexModelsCacheForTests } from "../adapters/codex-models.js";
+import { resetCursorModelsCacheForTests, setCursorModelsRunnerForTests } from "../adapters/cursor-models.js";
+
+describe("adapter model listing", () => {
+  beforeEach(() => {
+    delete process.env.OPENAI_API_KEY;
+    delete process.env.PAPERCLIP_OPENCODE_COMMAND;
+    resetCodexModelsCacheForTests();
+    resetCursorModelsCacheForTests();
+    setCursorModelsRunnerForTests(null);
+    resetOpenCodeModelsCacheForTests();
+    vi.restoreAllMocks();
+  });
+
+  it("returns an empty list for unknown adapters", async () => {
+    const models = await listAdapterModels("unknown_adapter");
+    expect(models).toEqual([]);
+  });
+
+  it("returns codex fallback models when no OpenAI key is available", async () => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    const models = await listAdapterModels("codex_local");
+
+    expect(models).toEqual(codexFallbackModels);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("loads codex models dynamically and merges fallback options", async () => {
+    process.env.OPENAI_API_KEY = "sk-test";
+    const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        data: [
+          { id: "gpt-5-pro" },
+          { id: "gpt-5" },
+        ],
+      }),
+    } as Response);
+
+    const first = await listAdapterModels("codex_local");
+    const second = await listAdapterModels("codex_local");
+
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    expect(first).toEqual(second);
+    expect(first.some((model) => model.id === "gpt-5-pro")).toBe(true);
+    expect(first.some((model) => model.id === "codex-mini-latest")).toBe(true);
+  });
+
+  it("falls back to static codex models when OpenAI model discovery fails", async () => {
+    process.env.OPENAI_API_KEY = "sk-test";
+    vi.spyOn(globalThis, "fetch").mockResolvedValue({
+      ok: false,
+      status: 401,
+      json: async () => ({}),
+    } as Response);
+
+    const models = await listAdapterModels("codex_local");
+    expect(models).toEqual(codexFallbackModels);
+  });
+
+
+  it("returns cursor fallback models when CLI discovery is unavailable", async () => {
+    setCursorModelsRunnerForTests(() => ({
+      status: null,
+      stdout: "",
+      stderr: "",
+      hasError: true,
+    }));
+
+    const models = await listAdapterModels("cursor");
+    expect(models).toEqual(cursorFallbackModels);
+  });
+
+  it("loads cursor models dynamically and caches them", async () => {
+    const runner = vi.fn(() => ({
+      status: 0,
+      stdout: "Available models: auto, composer-1.5, gpt-5.3-codex-high, sonnet-4.6",
+      stderr: "",
+      hasError: false,
+    }));
+    setCursorModelsRunnerForTests(runner);
+
+    const first = await listAdapterModels("cursor");
+    const second = await listAdapterModels("cursor");
+
+    expect(runner).toHaveBeenCalledTimes(1);
+    expect(first).toEqual(second);
+    expect(first.some((model) => model.id === "auto")).toBe(true);
+    expect(first.some((model) => model.id === "gpt-5.3-codex-high")).toBe(true);
+    expect(first.some((model) => model.id === "composer-1")).toBe(true);
+  });
+
+  it("returns no opencode models when opencode command is unavailable", async () => {
+    process.env.PAPERCLIP_OPENCODE_COMMAND = "__paperclip_missing_opencode_command__";
+
+    const models = await listAdapterModels("opencode_local");
+    expect(models).toEqual([]);
+  });
+});
+

package/server/src/__tests__/adapter-session-codecs.test.ts

@@ -0,0 +1,194 @@
+import { describe, expect, it } from "vitest";
+import { sessionCodec as claudeSessionCodec } from "@corporateai/adapter-claude-local/server";
+import { sessionCodec as codexSessionCodec, isCodexUnknownSessionError } from "@corporateai/adapter-codex-local/server";
+import {
+  sessionCodec as cursorSessionCodec,
+  isCursorUnknownSessionError,
+} from "@corporateai/adapter-cursor-local/server";
+import {
+  sessionCodec as geminiSessionCodec,
+  isGeminiUnknownSessionError,
+} from "@corporateai/adapter-gemini-local/server";
+import {
+  sessionCodec as opencodeSessionCodec,
+  isOpenCodeUnknownSessionError,
+} from "@corporateai/adapter-opencode-local/server";
+
+describe("adapter session codecs", () => {
+  it("normalizes claude session params with cwd", () => {
+    const parsed = claudeSessionCodec.deserialize({
+      session_id: "claude-session-1",
+      folder: "/tmp/workspace",
+    });
+    expect(parsed).toEqual({
+      sessionId: "claude-session-1",
+      cwd: "/tmp/workspace",
+    });
+
+    const serialized = claudeSessionCodec.serialize(parsed);
+    expect(serialized).toEqual({
+      sessionId: "claude-session-1",
+      cwd: "/tmp/workspace",
+    });
+    expect(claudeSessionCodec.getDisplayId?.(serialized ?? null)).toBe("claude-session-1");
+  });
+
+  it("normalizes codex session params with cwd", () => {
+    const parsed = codexSessionCodec.deserialize({
+      sessionId: "codex-session-1",
+      cwd: "/tmp/codex",
+    });
+    expect(parsed).toEqual({
+      sessionId: "codex-session-1",
+      cwd: "/tmp/codex",
+    });
+
+    const serialized = codexSessionCodec.serialize(parsed);
+    expect(serialized).toEqual({
+      sessionId: "codex-session-1",
+      cwd: "/tmp/codex",
+    });
+    expect(codexSessionCodec.getDisplayId?.(serialized ?? null)).toBe("codex-session-1");
+  });
+
+  it("normalizes opencode session params with cwd", () => {
+    const parsed = opencodeSessionCodec.deserialize({
+      sessionID: "opencode-session-1",
+      cwd: "/tmp/opencode",
+    });
+    expect(parsed).toEqual({
+      sessionId: "opencode-session-1",
+      cwd: "/tmp/opencode",
+    });
+
+    const serialized = opencodeSessionCodec.serialize(parsed);
+    expect(serialized).toEqual({
+      sessionId: "opencode-session-1",
+      cwd: "/tmp/opencode",
+    });
+    expect(opencodeSessionCodec.getDisplayId?.(serialized ?? null)).toBe("opencode-session-1");
+  });
+
+  it("normalizes cursor session params with cwd", () => {
+    const parsed = cursorSessionCodec.deserialize({
+      session_id: "cursor-session-1",
+      cwd: "/tmp/cursor",
+    });
+    expect(parsed).toEqual({
+      sessionId: "cursor-session-1",
+      cwd: "/tmp/cursor",
+    });
+
+    const serialized = cursorSessionCodec.serialize(parsed);
+    expect(serialized).toEqual({
+      sessionId: "cursor-session-1",
+      cwd: "/tmp/cursor",
+    });
+    expect(cursorSessionCodec.getDisplayId?.(serialized ?? null)).toBe("cursor-session-1");
+  });
+
+  it("normalizes gemini session params with cwd", () => {
+    const parsed = geminiSessionCodec.deserialize({
+      session_id: "gemini-session-1",
+      cwd: "/tmp/gemini",
+    });
+    expect(parsed).toEqual({
+      sessionId: "gemini-session-1",
+      cwd: "/tmp/gemini",
+    });
+
+    const serialized = geminiSessionCodec.serialize(parsed);
+    expect(serialized).toEqual({
+      sessionId: "gemini-session-1",
+      cwd: "/tmp/gemini",
+    });
+    expect(geminiSessionCodec.getDisplayId?.(serialized ?? null)).toBe("gemini-session-1");
+  });
+});
+
+describe("codex resume recovery detection", () => {
+  it("detects unknown session errors from codex output", () => {
+    expect(
+      isCodexUnknownSessionError(
+        '{"type":"error","message":"Unknown session id abc"}',
+        "",
+      ),
+    ).toBe(true);
+    expect(
+      isCodexUnknownSessionError(
+        "",
+        "thread 123 not found",
+      ),
+    ).toBe(true);
+    expect(
+      isCodexUnknownSessionError(
+        '{"type":"result","ok":true}',
+        "",
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("opencode resume recovery detection", () => {
+  it("detects unknown session errors from opencode output", () => {
+    expect(
+      isOpenCodeUnknownSessionError(
+        "",
+        "NotFoundError: Resource not found: /Users/test/.local/share/opencode/storage/session/proj/ses_missing.json",
+      ),
+    ).toBe(true);
+    expect(
+      isOpenCodeUnknownSessionError(
+        "{\"type\":\"step_finish\",\"part\":{\"reason\":\"stop\"}}",
+        "",
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("cursor resume recovery detection", () => {
+  it("detects unknown session errors from cursor output", () => {
+    expect(
+      isCursorUnknownSessionError(
+        "",
+        "Error: unknown session id abc",
+      ),
+    ).toBe(true);
+    expect(
+      isCursorUnknownSessionError(
+        "",
+        "chat abc not found",
+      ),
+    ).toBe(true);
+    expect(
+      isCursorUnknownSessionError(
+        "{\"type\":\"result\",\"subtype\":\"success\"}",
+        "",
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("gemini resume recovery detection", () => {
+  it("detects unknown session errors from gemini output", () => {
+    expect(
+      isGeminiUnknownSessionError(
+        "",
+        "unknown session id abc",
+      ),
+    ).toBe(true);
+    expect(
+      isGeminiUnknownSessionError(
+        "",
+        "checkpoint latest not found",
+      ),
+    ).toBe(true);
+    expect(
+      isGeminiUnknownSessionError(
+        "{\"type\":\"result\",\"subtype\":\"success\"}",
+        "",
+      ),
+    ).toBe(false);
+  });
+});
+

package/server/src/__tests__/agent-auth-jwt.test.ts

@@ -0,0 +1,79 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createLocalAgentJwt, verifyLocalAgentJwt } from "../agent-auth-jwt.js";
+
+describe("agent local JWT", () => {
+  const secretEnv = "PAPERCLIP_AGENT_JWT_SECRET";
+  const ttlEnv = "PAPERCLIP_AGENT_JWT_TTL_SECONDS";
+  const issuerEnv = "PAPERCLIP_AGENT_JWT_ISSUER";
+  const audienceEnv = "PAPERCLIP_AGENT_JWT_AUDIENCE";
+
+  const originalEnv = {
+    secret: process.env[secretEnv],
+    ttl: process.env[ttlEnv],
+    issuer: process.env[issuerEnv],
+    audience: process.env[audienceEnv],
+  };
+
+  beforeEach(() => {
+    process.env[secretEnv] = "test-secret";
+    process.env[ttlEnv] = "3600";
+    delete process.env[issuerEnv];
+    delete process.env[audienceEnv];
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    if (originalEnv.secret === undefined) delete process.env[secretEnv];
+    else process.env[secretEnv] = originalEnv.secret;
+    if (originalEnv.ttl === undefined) delete process.env[ttlEnv];
+    else process.env[ttlEnv] = originalEnv.ttl;
+    if (originalEnv.issuer === undefined) delete process.env[issuerEnv];
+    else process.env[issuerEnv] = originalEnv.issuer;
+    if (originalEnv.audience === undefined) delete process.env[audienceEnv];
+    else process.env[audienceEnv] = originalEnv.audience;
+  });
+
+  it("creates and verifies a token", () => {
+    vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    const token = createLocalAgentJwt("agent-1", "company-1", "claude_local", "run-1");
+    expect(typeof token).toBe("string");
+
+    const claims = verifyLocalAgentJwt(token!);
+    expect(claims).toMatchObject({
+      sub: "agent-1",
+      company_id: "company-1",
+      adapter_type: "claude_local",
+      run_id: "run-1",
+      iss: "paperclip",
+      aud: "paperclip-api",
+    });
+  });
+
+  it("returns null when secret is missing", () => {
+    process.env[secretEnv] = "";
+    const token = createLocalAgentJwt("agent-1", "company-1", "claude_local", "run-1");
+    expect(token).toBeNull();
+    expect(verifyLocalAgentJwt("abc.def.ghi")).toBeNull();
+  });
+
+  it("rejects expired tokens", () => {
+    process.env[ttlEnv] = "1";
+    vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    const token = createLocalAgentJwt("agent-1", "company-1", "claude_local", "run-1");
+
+    vi.setSystemTime(new Date("2026-01-01T00:00:05.000Z"));
+    expect(verifyLocalAgentJwt(token!)).toBeNull();
+  });
+
+  it("rejects issuer/audience mismatch", () => {
+    process.env[issuerEnv] = "custom-issuer";
+    process.env[audienceEnv] = "custom-audience";
+    vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    const token = createLocalAgentJwt("agent-1", "company-1", "codex_local", "run-1");
+
+    process.env[issuerEnv] = "paperclip";
+    process.env[audienceEnv] = "paperclip-api";
+    expect(verifyLocalAgentJwt(token!)).toBeNull();
+  });
+});