From 170c1e5adb30ae6a10271190aa03a013cdec9348 Mon Sep 17 00:00:00 2001 From: Dotta <34892728+cryppadotta@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:23:09 -0500 Subject: [PATCH] fix(claude-local): trust Paperclip URLs in allowlist sandbox (#10438) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Local adapters can confine agent processes with filesystem and network sandbox policies > - Allowlist confinement must still let an agent reach Paperclip's own control plane and managed MCP servers > - The Codex local adapter already marks those runtime-owned endpoints as trusted, but the Claude local adapter did not > - As a result, allowlisted Claude runs could not call their own Paperclip API unless operators duplicated runtime URLs manually > - This pull request mirrors the trusted-URL wiring in the Claude local adapter and adds a regression test at the process-execution boundary > - The benefit is that confined Claude agents retain their required control-plane access without broadening the operator-managed network allowlist ## Linked Issues or Issue Description Refs #447 No exact public issue was found. The underlying bug is: - **Observed:** with `claude_local` configured for local-process `networkScope: "allowlist"`, the sandbox options omitted the runtime-owned Paperclip API and MCP server URLs. Requests to those endpoints could therefore be denied by confinement. - **Expected:** Paperclip's own API URL and managed MCP server URLs are passed as trusted sandbox targets, matching `codex_local` behavior. - **Steps to reproduce:** configure a local Claude agent with allowlist network confinement, omit the runtime Paperclip API URL from the operator allowlist, and have the agent call its injected `PAPERCLIP_API_URL`. - **Version:** `ca92f727c5` (`origin/master` at branch creation). - **Deployment mode:** local-process sandbox confinement in a local deployment. ## What Changed - Added the injected Paperclip API URL and runtime MCP server URLs to `claude_local` sandbox `networkTrustedUrls`, filtering empty values. - Added a unit test proving allowlist sandbox construction trusts `PAPERCLIP_API_URL`. ## Verification - `pnpm exec vitest run packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts` - `pnpm --filter @paperclipai/adapter-claude-local typecheck` ## Risks - Low risk. The change only affects confined local Claude processes and trusts runtime-owned endpoints already injected by Paperclip. - Operator-configured `networkAllowlist` behavior is unchanged; the added URLs use the sandbox's separate trusted-target path. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex based on GPT-5 (exact serving snapshot and context-window size are not exposed), with reasoning, repository inspection, shell tool use, code editing, and test execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes (not applicable: behavior parity fix with no user-facing configuration change) - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip --- .../src/server/execute.acp-fallback.test.ts | 28 ++++++++++++++++++- .../claude-local/src/server/execute.ts | 4 +++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts b/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts index a096d91372..bf7baafcbe 100644 --- a/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts +++ b/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts @@ -1,4 +1,4 @@ -import { beforeEach, describe, expect, it, vi } from "vitest"; +import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; const { ensureAdapterExecutionTargetCommandResolvable, @@ -89,6 +89,10 @@ describe("claude_local ACP startup fallback", () => { vi.clearAllMocks(); }); + afterEach(() => { + vi.unstubAllEnvs(); + }); + it("falls back to Claude CLI when auto-selected ACP fails before execution starts", async () => { const ctx = buildContext(); @@ -107,6 +111,28 @@ describe("claude_local ACP startup fallback", () => { ); }); + it("trusts the Paperclip API URL when network access is allowlisted", async () => { + const paperclipApiUrl = "http://127.0.0.1:4310"; + vi.stubEnv("PAPERCLIP_RUNTIME_API_URL", paperclipApiUrl); + const ctx = buildContext({ networkScope: "allowlist" }); + + await execute(ctx as never); + + expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1); + expect(runAdapterExecutionTargetProcess).toHaveBeenCalledWith( + expect.any(String), + null, + expect.any(String), + expect.any(Array), + expect.objectContaining({ + localProcessSandbox: expect.objectContaining({ + networkScope: "allowlist", + networkTrustedUrls: [paperclipApiUrl], + }), + }), + ); + }); + it("keeps explicit ACP strict when startup fails", async () => { const ctx = buildContext({ engine: "acp" }); diff --git a/packages/adapters/claude-local/src/server/execute.ts b/packages/adapters/claude-local/src/server/execute.ts index 0b5cf697f7..72fdde9545 100644 --- a/packages/adapters/claude-local/src/server/execute.ts +++ b/packages/adapters/claude-local/src/server/execute.ts @@ -543,6 +543,10 @@ export async function execute(ctx: AdapterExecutionContext): Promise server.url), + ].filter((value): value is string => typeof value === "string" && value.length > 0), command: asString(config.filesystemSandboxCommand, "bwrap"), } : null;