feat: add paperclip service - #1342
Conversation
- Systemd service on kyber: runs `paperclipai run` via bun, depends on docker-postgres - Config via builtins.toJSON: external postgres on kyber, embedded on macOS - Setup script creates paperclip database on docker-postgres - Makefile target: `make systemctl-paperclip`
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
📝 WalkthroughWalkthroughAdds Paperclip integration: new Nix and Home Manager modules, a setup script that writes per-user config and optionally provisions a Docker Postgres DB on Kyber hosts, a systemd user service unit, package dependency, tests, and a Makefile systemctl target to restart the user service. Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRAdds Paperclip (AI agent orchestration platform) as a systemd user service on What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the Paperclip AI agent orchestration platform, including its configuration, a setup script for database initialization, and a systemd user service specifically for the 'kyber' host. Feedback focuses on improving the reliability of the systemd service by avoiding volatile log directories in /tmp, making the environment file optional to prevent startup failures, and using more robust SQL queries instead of shell utilities like cut for database existence checks.
| lib.mkIf host.isKyber { | ||
| # Ensure Paperclip directories exist with correct permissions | ||
| home.activation.paperclipSetup = config.lib.dag.entryAfter [ "writeBoundary" ] '' | ||
| mkdir -p /tmp/paperclip |
There was a problem hiding this comment.
Creating a log directory in /tmp during activation is unreliable because /tmp is cleared on reboot, but activation scripts do not typically run on every boot. This can lead to the service failing to start after a reboot if it expects the directory to exist. It is better to let the service manage its own logs via the journal or use a persistent path.
| # Create paperclip database on docker-postgres if needed | ||
| if [ "@is_kyber@" = "true" ]; then | ||
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then | ||
| if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then |
There was a problem hiding this comment.
The general rules recommend avoiding cut for parsing command output. For checking PostgreSQL database existence, a direct query is more robust and avoids potential issues with space-containing fields or unexpected output formatting.
| if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then | |
| if ! docker exec postgres psql -U postgres -tAc "SELECT 1 FROM pg_database WHERE datname='paperclip'" | grep -q 1; then |
References
- To robustly parse command output in shell scripts, use a unique delimiter (e.g., tab) in the format string and read with a matching IFS. This is safer than splitting by spaces with cut, especially when data fields might contain spaces.
| "HOME=${homeDir}" | ||
| "PATH=${homeDir}/.local/bin:${homeDir}/.bun/bin:${homeDir}/.nix-profile/bin:${homeDir}/.local/share/pnpm:${homeDir}/.local/share/fnm/current/bin:${homeDir}/.npm-global/bin:/usr/local/bin:/usr/bin:/bin" | ||
| ]; | ||
| EnvironmentFile = "${instanceDir}/.env"; |
There was a problem hiding this comment.
If the .env file does not exist, systemd will fail to start the service. If this file is optional or manually created, you should prefix the path with - to allow the service to start without it.
EnvironmentFile = "-${instanceDir}/.env";
| WorkingDirectory = "${homeDir}/.paperclip"; | ||
| StandardOutput = "append:/tmp/paperclip/paperclip.log"; | ||
| StandardError = "append:/tmp/paperclip/paperclip.log"; |
There was a problem hiding this comment.
Logging to /tmp is volatile and can cause the service to fail if the directory is missing after a reboot. It is recommended to use the systemd journal (the default) or a persistent path. Removing these lines will default logging to the journal, which is generally preferred for systemd services.
WorkingDirectory = "${homeDir}/.paperclip";
There was a problem hiding this comment.
Pull request overview
Adds Paperclip (AI agent orchestration platform) to the dotfiles/home-manager setup, including config generation and a kyber-only systemd user service.
Changes:
- Add
paperclipaito Bun dependencies (and lockfile) - Introduce Nix activation logic to generate Paperclip config + run a DB bootstrap script
- Add a kyber-only Home Manager systemd user service and a
make systemctl-papercliphelper target
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Adds paperclipai dependency and marks it as trusted for Bun installs |
| bun.lock | Locks paperclipai and newly introduced transitive dependencies |
| Makefile | Adds systemctl-paperclip target and includes it in the systemctl meta-target |
| home-manager/modules/paperclip/default.nix | Defines Paperclip systemd user service (kyber-only) and activation directory setup |
| home-manager/modules/default.nix | Registers the new paperclip Home Manager module |
| config/paperclip/default.nix | Generates Paperclip config.json via Nix and runs setup script on activation |
| config/paperclip/setup.sh | Copies config into instance dir and creates paperclip DB in docker-postgres when needed |
| config/default.nix | Registers the new Paperclip config module |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "HOME=${homeDir}" | ||
| "PATH=${homeDir}/.local/bin:${homeDir}/.bun/bin:${homeDir}/.nix-profile/bin:${homeDir}/.local/share/pnpm:${homeDir}/.local/share/fnm/current/bin:${homeDir}/.npm-global/bin:/usr/local/bin:/usr/bin:/bin" | ||
| ]; | ||
| EnvironmentFile = "${instanceDir}/.env"; |
There was a problem hiding this comment.
EnvironmentFile will cause the service to fail to start if ${instanceDir}/.env does not exist (systemd treats missing EnvironmentFile as an error unless it’s prefixed with -). Consider either creating an empty .env during activation (with restrictive permissions) or using EnvironmentFile = "-${instanceDir}/.env"; so the service can start with defaults.
| EnvironmentFile = "${instanceDir}/.env"; | |
| EnvironmentFile = "-${instanceDir}/.env"; |
| home.activation.paperclipSetup = config.lib.dag.entryAfter [ "writeBoundary" ] '' | ||
| mkdir -p /tmp/paperclip | ||
| mkdir -p ${homeDir}/.paperclip | ||
| chmod 700 ${homeDir}/.paperclip |
There was a problem hiding this comment.
The service logs to /tmp/paperclip/paperclip.log, but /tmp is typically cleared on reboot; since the directory is only created via Home Manager activation, the service can fail to start on the next login/boot when /tmp/paperclip is missing. Prefer a systemd-managed directory (e.g., RuntimeDirectory= / StateDirectory= / LogsDirectory=) or an ExecStartPre that ensures the log directory exists at service start (and set restrictive permissions).
|
|
||
| configJson = builtins.toJSON { | ||
| database = | ||
| if host.isKyber then | ||
| { | ||
| mode = "postgres"; | ||
| connectionString = "postgres://postgres:postgres@localhost:5432/paperclip"; | ||
| } | ||
| else | ||
| { | ||
| mode = "embedded-postgres"; | ||
| }; | ||
| server = { | ||
| host = if host.isKyber then "0.0.0.0" else "127.0.0.1"; | ||
| port = 3100; | ||
| }; | ||
| }; | ||
|
|
||
| configFile = pkgs.writeText "paperclip-config.json" configJson; | ||
|
|
||
| setupScript = pkgs.replaceVars ./setup.sh { | ||
| instance_dir = instanceDir; | ||
| config_file = "${configFile}"; | ||
| cp = "${pkgs.coreutils}/bin/cp"; | ||
| is_kyber = if host.isKyber then "true" else "false"; | ||
| }; | ||
| in | ||
| { | ||
| home.activation.paperclipConfig = config.lib.dag.entryAfter [ "writeBoundary" ] '' |
There was a problem hiding this comment.
connectionString (including username/password) is being written via pkgs.writeText, which places the full JSON (credentials included) in the Nix store where it is generally world-readable. If these credentials are meant to be secret (or even just to avoid baking defaults into the store), move them to an out-of-store secret (e.g., ${instanceDir}/.env/age/sops) and have the config reference env vars or omit the password for local trust/auth.
| configJson = builtins.toJSON { | |
| database = | |
| if host.isKyber then | |
| { | |
| mode = "postgres"; | |
| connectionString = "postgres://postgres:postgres@localhost:5432/paperclip"; | |
| } | |
| else | |
| { | |
| mode = "embedded-postgres"; | |
| }; | |
| server = { | |
| host = if host.isKyber then "0.0.0.0" else "127.0.0.1"; | |
| port = 3100; | |
| }; | |
| }; | |
| configFile = pkgs.writeText "paperclip-config.json" configJson; | |
| setupScript = pkgs.replaceVars ./setup.sh { | |
| instance_dir = instanceDir; | |
| config_file = "${configFile}"; | |
| cp = "${pkgs.coreutils}/bin/cp"; | |
| is_kyber = if host.isKyber then "true" else "false"; | |
| }; | |
| in | |
| { | |
| home.activation.paperclipConfig = config.lib.dag.entryAfter [ "writeBoundary" ] '' | |
| configFile = "${instanceDir}/config.json"; | |
| setupScript = pkgs.replaceVars ./setup.sh { | |
| instance_dir = instanceDir; | |
| config_file = configFile; | |
| cp = "${pkgs.coreutils}/bin/cp"; | |
| is_kyber = if host.isKyber then "true" else "false"; | |
| }; | |
| in | |
| { | |
| home.activation.paperclipConfig = config.lib.dag.entryAfter [ "writeBoundary" ] '' | |
| ${pkgs.coreutils}/bin/mkdir -p "${instanceDir}" | |
| ${ | |
| if host.isKyber then | |
| '' | |
| if [ -z "''${PAPERCLIP_DATABASE_URL:-}" ]; then | |
| echo "paperclip: PAPERCLIP_DATABASE_URL must be set to create ${configFile}" >&2 | |
| exit 1 | |
| fi | |
| cat > "${configFile}" <<EOF | |
| { | |
| "database": { | |
| "mode": "postgres", | |
| "connectionString": "''${PAPERCLIP_DATABASE_URL}" | |
| }, | |
| "server": { | |
| "host": "0.0.0.0", | |
| "port": 3100 | |
| } | |
| } | |
| EOF | |
| '' | |
| else | |
| '' | |
| cat > "${configFile}" <<EOF | |
| { | |
| "database": { | |
| "mode": "embedded-postgres" | |
| }, | |
| "server": { | |
| "host": "127.0.0.1", | |
| "port": 3100 | |
| } | |
| } | |
| EOF | |
| '' | |
| } |
| mode = "embedded-postgres"; | ||
| }; | ||
| server = { | ||
| host = if host.isKyber then "0.0.0.0" else "127.0.0.1"; |
There was a problem hiding this comment.
On kyber this binds Paperclip to 0.0.0.0, which makes it reachable from any network interface. If the intent is to serve only behind a local reverse proxy (or only via SSH tunnel), consider binding to 127.0.0.1 and letting the proxy handle external exposure; otherwise ensure host firewall / auth is enforced by default.
| host = if host.isKyber then "0.0.0.0" else "127.0.0.1"; | |
| host = "127.0.0.1"; |
|
|
||
| # Create paperclip database on docker-postgres if needed | ||
| if [ "@is_kyber@" = "true" ]; then | ||
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then |
There was a problem hiding this comment.
docker container inspect postgres succeeds even if the container exists but is stopped, so the subsequent docker exec ... will fail and the DB won’t be created. Consider checking that the container is running (e.g., inspect .State.Running or docker ps) before executing psql/createdb, or start the container explicitly.
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then | |
| if command -v docker >/dev/null 2>&1 && [ "$(docker container inspect -f '{{.State.Running}}' postgres 2>/dev/null)" = "true" ]; then |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (4)
config/default.nix (1)
28-28: Module list ordering is inconsistent.The
./paperclipentry is placed between./ompand./opencode, but alphabetically./opencodeshould come before./paperclip.🔧 Suggested reordering
./omp - ./paperclip ./opencode + ./paperclip ./pi🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@config/default.nix` at line 28, The module list in default.nix is out of alphabetical order: the entry "./paperclip" is placed between "./omp" and "./opencode"; move "./paperclip" so the list reads "./opencode" then "./paperclip" (or otherwise ensure all module paths are sorted alphabetically) to maintain consistent ordering — locate the module list containing the entries "./omp", "./paperclip", and "./opencode" and reorder them accordingly.config/paperclip/default.nix (1)
17-17: Hardcoded database password in connection string.The connection string contains a hardcoded password
postgres:postgres. While this may be acceptable for local development, consider using environment variables or secrets management for better security hygiene.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@config/paperclip/default.nix` at line 17, The connectionString currently embeds a hardcoded password ("postgres://postgres:postgres@localhost:5432/paperclip"); change it to read credentials from environment/secret instead: replace the literal value assigned to connectionString with a construction that pulls the username, password and host/port/db from environment variables or a secret store (e.g., POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DB) so secrets are not checked into source control; update any documentation or examples referencing connectionString to show the new env var names.package.json (1)
116-116: Same alphabetical ordering issue in trustedDependencies.For consistency,
paperclipaishould be placed afteroxlintin thetrustedDependenciesarray.🔧 Suggested fix
"openclaw", - "paperclipai", "oxfmt", "oxlint", + "paperclipai", "portless",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 116, The trustedDependencies array in package.json is out of alphabetical order: move the "paperclipai" entry so it comes immediately after "oxlint" to maintain consistent sorting; update the trustedDependencies array (look for the "trustedDependencies" key and the entries "oxlint" and "paperclipai") and ensure the list remains alphabetically ordered after the change.home-manager/modules/paperclip/default.nix (1)
15-18: Consider using RuntimeDirectory for temporary files.Instead of manually creating
/tmp/paperclipand managing it across activations, systemd'sRuntimeDirectoryprovides automatic lifecycle management.♻️ Suggested improvement
Service = { Type = "simple"; ExecStart = "${homeDir}/.bun/bin/paperclipai run"; Restart = "always"; RestartSec = "5s"; + RuntimeDirectory = "paperclip"; Environment = [ "HOME=${homeDir}" "PATH=${homeDir}/.local/bin:${homeDir}/.bun/bin:${homeDir}/.nix-profile/bin:${homeDir}/.local/share/pnpm:${homeDir}/.local/share/fnm/current/bin:${homeDir}/.npm-global/bin:/usr/local/bin:/usr/bin:/bin" ]; EnvironmentFile = "${instanceDir}/.env"; WorkingDirectory = "${homeDir}/.paperclip"; - StandardOutput = "append:/tmp/paperclip/paperclip.log"; - StandardError = "append:/tmp/paperclip/paperclip.log"; + StandardOutput = "append:%t/paperclip/paperclip.log"; + StandardError = "append:%t/paperclip/paperclip.log"; };Then the activation can be simplified to only create the persistent directory:
home.activation.paperclipSetup = config.lib.dag.entryAfter [ "writeBoundary" ] '' - mkdir -p /tmp/paperclip mkdir -p ${homeDir}/.paperclip chmod 700 ${homeDir}/.paperclip '';🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@home-manager/modules/paperclip/default.nix` around lines 15 - 18, The activation currently creates /tmp/paperclip manually in home.activation.paperclipSetup; instead remove the mkdir for /tmp/paperclip and rely on systemd's RuntimeDirectory to manage /run (tmp) lifecycle by adding a RuntimeDirectory entry for your service (e.g., systemd.services.<your-service>.serviceConfig.RuntimeDirectory = "paperclip") or equivalent systemd.unit/serviceConfig block in the module, while leaving the persistent ${homeDir}/.paperclip creation and chmod 700 logic in home.activation.paperclipSetup.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@config/paperclip/default.nix`:
- Around line 39-41: The activation script currently silences all failures by
appending "|| true" to the setup invocation in home.activation.paperclipConfig;
remove that suffix so the setupScript errors propagate (or replace it with
explicit error handling that logs the failure and exits non‑zero), ensuring the
${pkgs.bash}/bin/bash ${setupScript} invocation returns a failing exit code on
error and writes diagnostic output (stderr/stdout) to logs before exiting so
issues like DB creation or permission errors are visible.
In `@config/paperclip/setup.sh`:
- Around line 1-10: The startup fails because the systemd unit expects
EnvironmentFile = "${instanceDir}/.env" but setup.sh only creates CONFIG; update
the script to also create a .env in INSTANCE_DIR (e.g., "${INSTANCE_DIR}/.env")
when missing, ensuring correct ownership/permissions (e.g., 600) and leaving it
empty or populating required vars; modify the section around INSTANCE_DIR,
CONFIG and the `@cp`@ "@config_file@" "$CONFIG" step to create or touch the .env
file so the systemd service can read it at startup.
- Around line 12-19: The current block uses docker exec postgres createdb
directly but doesn't wait for PostgreSQL to be ready; add a readiness check and
retry loop before calling docker exec postgres createdb. Specifically, after
verifying docker and the postgres container exist (the command -v docker and
docker container inspect postgres checks) call docker exec postgres pg_isready
(or docker exec postgres psql -U postgres -c '\l') in a loop with a small
sleep/backoff and a max retry count; only run docker exec postgres createdb -U
postgres paperclip and echo "Created paperclip database" >&2 once pg_isready
reports ready; if retries time out, log an error and skip/fail gracefully so
createdb isn't attempted against a not-ready server. Ensure the new logic
surrounds the existing docker exec postgres createdb invocation and preserves
existing checks for the postgres container.
In `@Makefile`:
- Around line 876-885: The success message is printed unconditionally in the
systemctl-paperclip Makefile target; change the logic so the final echo "✅
paperclip restarted" only runs when the restart branch executes. Modify the
target (systemctl-paperclip) to move or duplicate the success echo inside the if
branch that runs when DETECTED_HOST or HOST equals "kyber", or add a conditional
check around the final echo that tests "$(DETECTED_HOST)" or "$(HOST)" ==
"kyber" so the success message is only emitted when the service restart actually
occurred.
In `@package.json`:
- Line 59: The dependencies and trustedDependencies entries are out of
alphabetical order: move "paperclipai" so that "oxfmt" appears before
"paperclipai" in the dependencies object and apply the same ordering change
inside the trustedDependencies array; update the entries referencing "openclaw",
"oxfmt", and "paperclipai" to preserve alphabetical order in both the
dependencies and trustedDependencies sections.
---
Nitpick comments:
In `@config/default.nix`:
- Line 28: The module list in default.nix is out of alphabetical order: the
entry "./paperclip" is placed between "./omp" and "./opencode"; move
"./paperclip" so the list reads "./opencode" then "./paperclip" (or otherwise
ensure all module paths are sorted alphabetically) to maintain consistent
ordering — locate the module list containing the entries "./omp", "./paperclip",
and "./opencode" and reorder them accordingly.
In `@config/paperclip/default.nix`:
- Line 17: The connectionString currently embeds a hardcoded password
("postgres://postgres:postgres@localhost:5432/paperclip"); change it to read
credentials from environment/secret instead: replace the literal value assigned
to connectionString with a construction that pulls the username, password and
host/port/db from environment variables or a secret store (e.g., POSTGRES_USER,
POSTGRES_PASSWORD, POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DB) so secrets are not
checked into source control; update any documentation or examples referencing
connectionString to show the new env var names.
In `@home-manager/modules/paperclip/default.nix`:
- Around line 15-18: The activation currently creates /tmp/paperclip manually in
home.activation.paperclipSetup; instead remove the mkdir for /tmp/paperclip and
rely on systemd's RuntimeDirectory to manage /run (tmp) lifecycle by adding a
RuntimeDirectory entry for your service (e.g.,
systemd.services.<your-service>.serviceConfig.RuntimeDirectory = "paperclip") or
equivalent systemd.unit/serviceConfig block in the module, while leaving the
persistent ${homeDir}/.paperclip creation and chmod 700 logic in
home.activation.paperclipSetup.
In `@package.json`:
- Line 116: The trustedDependencies array in package.json is out of alphabetical
order: move the "paperclipai" entry so it comes immediately after "oxlint" to
maintain consistent sorting; update the trustedDependencies array (look for the
"trustedDependencies" key and the entries "oxlint" and "paperclipai") and ensure
the list remains alphabetically ordered after the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 14e46d0b-f5ce-4566-b18f-a098fa35d1f5
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (7)
Makefileconfig/default.nixconfig/paperclip/default.nixconfig/paperclip/setup.shhome-manager/modules/default.nixhome-manager/modules/paperclip/default.nixpackage.json
| home.activation.paperclipConfig = config.lib.dag.entryAfter [ "writeBoundary" ] '' | ||
| ${pkgs.bash}/bin/bash ${setupScript} || true | ||
| ''; |
There was a problem hiding this comment.
Silent failure suppression may hide critical setup errors.
The || true suffix causes all errors from the setup script to be silently ignored. This could mask failures like:
- Database creation errors
- Permission issues
- Missing config file
Consider removing || true or adding explicit error handling with logging.
🔧 Suggested fix with error logging
home.activation.paperclipConfig = config.lib.dag.entryAfter [ "writeBoundary" ] ''
- ${pkgs.bash}/bin/bash ${setupScript} || true
+ ${pkgs.bash}/bin/bash ${setupScript} || echo "Warning: Paperclip setup encountered an error" >&2
'';📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| home.activation.paperclipConfig = config.lib.dag.entryAfter [ "writeBoundary" ] '' | |
| ${pkgs.bash}/bin/bash ${setupScript} || true | |
| ''; | |
| home.activation.paperclipConfig = config.lib.dag.entryAfter [ "writeBoundary" ] '' | |
| ${pkgs.bash}/bin/bash ${setupScript} || echo "Warning: Paperclip setup encountered an error" >&2 | |
| ''; |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@config/paperclip/default.nix` around lines 39 - 41, The activation script
currently silences all failures by appending "|| true" to the setup invocation
in home.activation.paperclipConfig; remove that suffix so the setupScript errors
propagate (or replace it with explicit error handling that logs the failure and
exits non‑zero), ensuring the ${pkgs.bash}/bin/bash ${setupScript} invocation
returns a failing exit code on error and writes diagnostic output
(stderr/stdout) to logs before exiting so issues like DB creation or permission
errors are visible.
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| INSTANCE_DIR="@instance_dir@" | ||
| CONFIG="${INSTANCE_DIR}/config.json" | ||
|
|
||
| mkdir -p "${INSTANCE_DIR}" | ||
|
|
||
| @cp@ "@config_file@" "$CONFIG" | ||
| chmod 600 "$CONFIG" |
There was a problem hiding this comment.
Missing .env file creation causes systemd service startup failure.
The systemd service in home-manager/modules/paperclip/default.nix specifies EnvironmentFile = "${instanceDir}/.env" (line 41), but this setup script only creates config.json. Without the .env file, systemd will fail to start the paperclip service.
Either:
- Create an empty
.envfile in this script, or - Remove the
EnvironmentFiledirective from the service if no environment variables are needed, or - Add logic to generate the required environment variables
🔧 Suggested fix (create empty .env if not exists)
`@cp`@ "@config_file@" "$CONFIG"
chmod 600 "$CONFIG"
+
+# Create empty .env file if it doesn't exist (required by systemd service)
+ENV_FILE="${INSTANCE_DIR}/.env"
+if [ ! -f "$ENV_FILE" ]; then
+ touch "$ENV_FILE"
+ chmod 600 "$ENV_FILE"
+fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| INSTANCE_DIR="@instance_dir@" | |
| CONFIG="${INSTANCE_DIR}/config.json" | |
| mkdir -p "${INSTANCE_DIR}" | |
| @cp@ "@config_file@" "$CONFIG" | |
| chmod 600 "$CONFIG" | |
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| INSTANCE_DIR="@instance_dir@" | |
| CONFIG="${INSTANCE_DIR}/config.json" | |
| mkdir -p "${INSTANCE_DIR}" | |
| `@cp`@ "@config_file@" "$CONFIG" | |
| chmod 600 "$CONFIG" | |
| # Create empty .env file if it doesn't exist (required by systemd service) | |
| ENV_FILE="${INSTANCE_DIR}/.env" | |
| if [ ! -f "$ENV_FILE" ]; then | |
| touch "$ENV_FILE" | |
| chmod 600 "$ENV_FILE" | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@config/paperclip/setup.sh` around lines 1 - 10, The startup fails because the
systemd unit expects EnvironmentFile = "${instanceDir}/.env" but setup.sh only
creates CONFIG; update the script to also create a .env in INSTANCE_DIR (e.g.,
"${INSTANCE_DIR}/.env") when missing, ensuring correct ownership/permissions
(e.g., 600) and leaving it empty or populating required vars; modify the section
around INSTANCE_DIR, CONFIG and the `@cp`@ "@config_file@" "$CONFIG" step to
create or touch the .env file so the systemd service can read it at startup.
| # Create paperclip database on docker-postgres if needed | ||
| if [ "@is_kyber@" = "true" ]; then | ||
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then | ||
| if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then | ||
| docker exec postgres createdb -U postgres paperclip | ||
| echo "Created paperclip database" >&2 | ||
| fi | ||
| fi |
There was a problem hiding this comment.
Database creation may fail if postgres container is not ready.
The script checks if the postgres container exists but doesn't verify that PostgreSQL is ready to accept connections. This can cause createdb to fail during initial setup when docker-postgres is starting.
🔧 Suggested fix with retry logic
# Create paperclip database on docker-postgres if needed
if [ "@is_kyber@" = "true" ]; then
if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then
+ # Wait for postgres to be ready (max 30 seconds)
+ for i in $(seq 1 30); do
+ if docker exec postgres pg_isready -U postgres >/dev/null 2>&1; then
+ break
+ fi
+ sleep 1
+ done
if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then
docker exec postgres createdb -U postgres paperclip
echo "Created paperclip database" >&2
fi
fi
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Create paperclip database on docker-postgres if needed | |
| if [ "@is_kyber@" = "true" ]; then | |
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then | |
| if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then | |
| docker exec postgres createdb -U postgres paperclip | |
| echo "Created paperclip database" >&2 | |
| fi | |
| fi | |
| # Create paperclip database on docker-postgres if needed | |
| if [ "@is_kyber@" = "true" ]; then | |
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then | |
| # Wait for postgres to be ready (max 30 seconds) | |
| for i in $(seq 1 30); do | |
| if docker exec postgres pg_isready -U postgres >/dev/null 2>&1; then | |
| break | |
| fi | |
| sleep 1 | |
| done | |
| if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then | |
| docker exec postgres createdb -U postgres paperclip | |
| echo "Created paperclip database" >&2 | |
| fi | |
| fi | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@config/paperclip/setup.sh` around lines 12 - 19, The current block uses
docker exec postgres createdb directly but doesn't wait for PostgreSQL to be
ready; add a readiness check and retry loop before calling docker exec postgres
createdb. Specifically, after verifying docker and the postgres container exist
(the command -v docker and docker container inspect postgres checks) call docker
exec postgres pg_isready (or docker exec postgres psql -U postgres -c '\l') in a
loop with a small sleep/backoff and a max retry count; only run docker exec
postgres createdb -U postgres paperclip and echo "Created paperclip database"
>&2 once pg_isready reports ready; if retries time out, log an error and
skip/fail gracefully so createdb isn't attempted against a not-ready server.
Ensure the new logic surrounds the existing docker exec postgres createdb
invocation and preserves existing checks for the postgres container.
| .PHONY: systemctl-paperclip | ||
| systemctl-paperclip: ## Restart Paperclip systemd user service. | ||
| @echo "🔄 Restarting paperclip..." | ||
| @if [ "$(DETECTED_HOST)" = "kyber" ] || [ "$(HOST)" = "kyber" ]; then \ | ||
| systemctl --user daemon-reload; \ | ||
| systemctl --user restart paperclip.service; \ | ||
| else \ | ||
| echo "Skipping paperclip.service (host not kyber)"; \ | ||
| fi | ||
| @echo "✅ paperclip restarted" |
There was a problem hiding this comment.
Success message is printed even when the service restart is skipped.
The echo "✅ paperclip restarted" on line 885 executes unconditionally, even when the host is not kyber and the restart was skipped. This could be misleading.
🔧 Suggested fix
.PHONY: systemctl-paperclip
systemctl-paperclip: ## Restart Paperclip systemd user service.
`@echo` "🔄 Restarting paperclip..."
`@if` [ "$(DETECTED_HOST)" = "kyber" ] || [ "$(HOST)" = "kyber" ]; then \
systemctl --user daemon-reload; \
- systemctl --user restart paperclip.service; \
+ systemctl --user restart paperclip.service; \
+ echo "✅ paperclip restarted"; \
else \
echo "Skipping paperclip.service (host not kyber)"; \
fi
- `@echo` "✅ paperclip restarted"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| .PHONY: systemctl-paperclip | |
| systemctl-paperclip: ## Restart Paperclip systemd user service. | |
| @echo "🔄 Restarting paperclip..." | |
| @if [ "$(DETECTED_HOST)" = "kyber" ] || [ "$(HOST)" = "kyber" ]; then \ | |
| systemctl --user daemon-reload; \ | |
| systemctl --user restart paperclip.service; \ | |
| else \ | |
| echo "Skipping paperclip.service (host not kyber)"; \ | |
| fi | |
| @echo "✅ paperclip restarted" | |
| .PHONY: systemctl-paperclip | |
| systemctl-paperclip: ## Restart Paperclip systemd user service. | |
| `@echo` "🔄 Restarting paperclip..." | |
| `@if` [ "$(DETECTED_HOST)" = "kyber" ] || [ "$(HOST)" = "kyber" ]; then \ | |
| systemctl --user daemon-reload; \ | |
| systemctl --user restart paperclip.service; \ | |
| echo "✅ paperclip restarted"; \ | |
| else \ | |
| echo "Skipping paperclip.service (host not kyber)"; \ | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Makefile` around lines 876 - 885, The success message is printed
unconditionally in the systemctl-paperclip Makefile target; change the logic so
the final echo "✅ paperclip restarted" only runs when the restart branch
executes. Modify the target (systemctl-paperclip) to move or duplicate the
success echo inside the if branch that runs when DETECTED_HOST or HOST equals
"kyber", or add a conditional check around the final echo that tests
"$(DETECTED_HOST)" or "$(HOST)" == "kyber" so the success message is only
emitted when the service restart actually occurred.
| "mcporter": "^0.8.1", | ||
| "open-composer": "^0.8.23", | ||
| "openclaw": "^2026.3.28", | ||
| "paperclipai": "^2026.325.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the paperclipai package exists and check its latest version
curl -s "https://registry.npmjs.org/paperclipai" | jq -r '.["dist-tags"].latest // "Package not found"'Repository: shunkakinoki/dotfiles
Length of output: 75
🏁 Script executed:
cat package.json | sed -n '50,120p'Repository: shunkakinoki/dotfiles
Length of output: 1763
Dependencies and trustedDependencies are not in alphabetical order.
paperclipai is placed between openclaw and oxfmt, breaking alphabetical order. Alphabetically, oxfmt should come before paperclipai in both the dependencies section and trustedDependencies array.
🔧 Suggested fix
"openclaw": "^2026.3.28",
- "paperclipai": "^2026.325.0",
"oxfmt": "^0.42.0",
"oxlint": "^1.57.0",
+ "paperclipai": "^2026.325.0",
"portless": "^0.7.2",Also reorder in trustedDependencies array:
"openclaw",
- "paperclipai",
"oxfmt",
"oxlint",
+ "paperclipai",
"portless",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 59, The dependencies and trustedDependencies entries
are out of alphabetical order: move "paperclipai" so that "oxfmt" appears before
"paperclipai" in the dependencies object and apply the same ordering change
inside the trustedDependencies array; update the entries referencing "openclaw",
"oxfmt", and "paperclipai" to preserve alphabetical order in both the
dependencies and trustedDependencies sections.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
4 issues found across 8 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="config/paperclip/setup.sh">
<violation number="1" location="config/paperclip/setup.sh:14">
P2: `docker container inspect postgres` succeeds even when the container is stopped, so the subsequent `docker exec` calls will fail. Check that the container is actually running.</violation>
<violation number="2" location="config/paperclip/setup.sh:15">
P1: This check treats any `psql` failure as 'database missing'. If the container exists but Postgres is still starting, the script will try `createdb` anyway and can fail activation on a startup race.</violation>
</file>
<file name="home-manager/modules/paperclip/default.nix">
<violation number="1" location="home-manager/modules/paperclip/default.nix:41">
P1: This service requires `${instanceDir}/.env`, but this PR only provisions `config.json`. On a fresh setup, `paperclip.service` will fail before exec unless that env file already exists.</violation>
<violation number="2" location="home-manager/modules/paperclip/default.nix:43">
P1: Logging to `/tmp/paperclip/paperclip.log` is unreliable — `/tmp` is cleared on reboot and the activation script that creates the directory doesn't run on every boot. The service will fail to start after reboot. Either use the systemd journal (remove these lines) or use `LogsDirectory=paperclip` to let systemd manage the directory lifecycle.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| # Create paperclip database on docker-postgres if needed | ||
| if [ "@is_kyber@" = "true" ]; then | ||
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then | ||
| if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then |
There was a problem hiding this comment.
P1: This check treats any psql failure as 'database missing'. If the container exists but Postgres is still starting, the script will try createdb anyway and can fail activation on a startup race.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At config/paperclip/setup.sh, line 15:
<comment>This check treats any `psql` failure as 'database missing'. If the container exists but Postgres is still starting, the script will try `createdb` anyway and can fail activation on a startup race.</comment>
<file context>
@@ -0,0 +1,20 @@
+# Create paperclip database on docker-postgres if needed
+if [ "@is_kyber@" = "true" ]; then
+ if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then
+ if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then
+ docker exec postgres createdb -U postgres paperclip
+ echo "Created paperclip database" >&2
</file context>
| "HOME=${homeDir}" | ||
| "PATH=${homeDir}/.local/bin:${homeDir}/.bun/bin:${homeDir}/.nix-profile/bin:${homeDir}/.local/share/pnpm:${homeDir}/.local/share/fnm/current/bin:${homeDir}/.npm-global/bin:/usr/local/bin:/usr/bin:/bin" | ||
| ]; | ||
| EnvironmentFile = "${instanceDir}/.env"; |
There was a problem hiding this comment.
P1: This service requires ${instanceDir}/.env, but this PR only provisions config.json. On a fresh setup, paperclip.service will fail before exec unless that env file already exists.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/modules/paperclip/default.nix, line 41:
<comment>This service requires `${instanceDir}/.env`, but this PR only provisions `config.json`. On a fresh setup, `paperclip.service` will fail before exec unless that env file already exists.</comment>
<file context>
@@ -0,0 +1,50 @@
+ "HOME=${homeDir}"
+ "PATH=${homeDir}/.local/bin:${homeDir}/.bun/bin:${homeDir}/.nix-profile/bin:${homeDir}/.local/share/pnpm:${homeDir}/.local/share/fnm/current/bin:${homeDir}/.npm-global/bin:/usr/local/bin:/usr/bin:/bin"
+ ];
+ EnvironmentFile = "${instanceDir}/.env";
+ WorkingDirectory = "${homeDir}/.paperclip";
+ StandardOutput = "append:/tmp/paperclip/paperclip.log";
</file context>
| ]; | ||
| EnvironmentFile = "${instanceDir}/.env"; | ||
| WorkingDirectory = "${homeDir}/.paperclip"; | ||
| StandardOutput = "append:/tmp/paperclip/paperclip.log"; |
There was a problem hiding this comment.
P1: Logging to /tmp/paperclip/paperclip.log is unreliable — /tmp is cleared on reboot and the activation script that creates the directory doesn't run on every boot. The service will fail to start after reboot. Either use the systemd journal (remove these lines) or use LogsDirectory=paperclip to let systemd manage the directory lifecycle.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/modules/paperclip/default.nix, line 43:
<comment>Logging to `/tmp/paperclip/paperclip.log` is unreliable — `/tmp` is cleared on reboot and the activation script that creates the directory doesn't run on every boot. The service will fail to start after reboot. Either use the systemd journal (remove these lines) or use `LogsDirectory=paperclip` to let systemd manage the directory lifecycle.</comment>
<file context>
@@ -0,0 +1,50 @@
+ ];
+ EnvironmentFile = "${instanceDir}/.env";
+ WorkingDirectory = "${homeDir}/.paperclip";
+ StandardOutput = "append:/tmp/paperclip/paperclip.log";
+ StandardError = "append:/tmp/paperclip/paperclip.log";
+ };
</file context>
|
|
||
| # Create paperclip database on docker-postgres if needed | ||
| if [ "@is_kyber@" = "true" ]; then | ||
| if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then |
There was a problem hiding this comment.
P2: docker container inspect postgres succeeds even when the container is stopped, so the subsequent docker exec calls will fail. Check that the container is actually running.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At config/paperclip/setup.sh, line 14:
<comment>`docker container inspect postgres` succeeds even when the container is stopped, so the subsequent `docker exec` calls will fail. Check that the container is actually running.</comment>
<file context>
@@ -0,0 +1,20 @@
+
+# Create paperclip database on docker-postgres if needed
+if [ "@is_kyber@" = "true" ]; then
+ if command -v docker >/dev/null 2>&1 && docker container inspect postgres >/dev/null 2>&1; then
+ if ! docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -qw paperclip; then
+ docker exec postgres createdb -U postgres paperclip
</file context>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
spec/paperclip_setup_spec.sh (1)
25-28: Tighten the copy assertion to validate the full templated command.Current checks can pass even if
@cp@andconfig_fileappear in unrelated contexts. Validate the exact command shape instead.Suggested spec tightening
It 'copies config file to instance directory' -When run bash -c "grep '@cp@' '$SCRIPT'" -The output should include 'config_file' +When run bash -c "grep -F '@cp@ \"@config_file@\" \"\$CONFIG\"' '$SCRIPT'" +The status should be success End🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@spec/paperclip_setup_spec.sh` around lines 25 - 28, The test "It 'copies config file to instance directory'" currently only checks presence of '@cp@' and 'config_file' separately; tighten it to assert the exact templated copy command by matching the full command shape produced in the script (use the SCRIPT output and assert it contains the exact sequence combining '@cp@', the source 'config_file', and the target path using INSTANCE_DIR or the instance directory variable). Update the expectation in spec/paperclip_setup_spec.sh to look for the contiguous string that represents "@cp@ config_file <instance_dir_path>" (including quotes or path concatenation used in the script) so the test fails unless the precise templated cp invocation is present.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@spec/paperclip_setup_spec.sh`:
- Around line 47-50: The test "It 'only runs on kyber'" currently only greps for
the token is_kyber; update the assertion to check the actual conditional
expression enforcing the guard (e.g., grep for the if-test that compares the
variable to true such as if [ "$is_kyber" = "true" ] or the equivalent
conditional used in the script) so the spec verifies the guard is true rather
than just the variable name.
---
Nitpick comments:
In `@spec/paperclip_setup_spec.sh`:
- Around line 25-28: The test "It 'copies config file to instance directory'"
currently only checks presence of '@cp@' and 'config_file' separately; tighten
it to assert the exact templated copy command by matching the full command shape
produced in the script (use the SCRIPT output and assert it contains the exact
sequence combining '@cp@', the source 'config_file', and the target path using
INSTANCE_DIR or the instance directory variable). Update the expectation in
spec/paperclip_setup_spec.sh to look for the contiguous string that represents
"@cp@ config_file <instance_dir_path>" (including quotes or path concatenation
used in the script) so the test fails unless the precise templated cp invocation
is present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 40a84056-bec3-4ab7-a264-5bfdd9bc2d1f
📒 Files selected for processing (3)
config/paperclip/setup.shspec/coverage_spec.shspec/paperclip_setup_spec.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- config/paperclip/setup.sh
| It 'only runs on kyber' | ||
| When run bash -c "grep 'is_kyber' '$SCRIPT'" | ||
| The output should include 'is_kyber' | ||
| End |
There was a problem hiding this comment.
Kyber gating test is too weak for the stated intent.
Line 48 currently checks only for the token is_kyber; that does not prove the true guard is enforced. Assert the actual conditional expression.
Suggested assertion fix
It 'only runs on kyber'
-When run bash -c "grep 'is_kyber' '$SCRIPT'"
-The output should include 'is_kyber'
+When run bash -c "grep -F 'if [ \"@is_kyber@\" = \"true\" ]; then' '$SCRIPT'"
+The status should be success
End📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| It 'only runs on kyber' | |
| When run bash -c "grep 'is_kyber' '$SCRIPT'" | |
| The output should include 'is_kyber' | |
| End | |
| It 'only runs on kyber' | |
| When run bash -c "grep -F 'if [ \"@is_kyber@\" = \"true\" ]; then' '$SCRIPT'" | |
| The status should be success | |
| End |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@spec/paperclip_setup_spec.sh` around lines 47 - 50, The test "It 'only runs
on kyber'" currently only greps for the token is_kyber; update the assertion to
check the actual conditional expression enforcing the guard (e.g., grep for the
if-test that compares the variable to true such as if [ "$is_kyber" = "true" ]
or the equivalent conditional used in the script) so the spec verifies the guard
is true rather than just the variable name.
There was a problem hiding this comment.
1 issue found across 3 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="spec/paperclip_setup_spec.sh">
<violation number="1" location="spec/paperclip_setup_spec.sh:48">
P2: This test can pass without the kyber guard, because `grep 'is_kyber'` also matches the shellcheck comment above the real condition.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| End | ||
|
|
||
| It 'only runs on kyber' | ||
| When run bash -c "grep 'is_kyber' '$SCRIPT'" |
There was a problem hiding this comment.
P2: This test can pass without the kyber guard, because grep 'is_kyber' also matches the shellcheck comment above the real condition.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At spec/paperclip_setup_spec.sh, line 48:
<comment>This test can pass without the kyber guard, because `grep 'is_kyber'` also matches the shellcheck comment above the real condition.</comment>
<file context>
@@ -0,0 +1,53 @@
+End
+
+It 'only runs on kyber'
+When run bash -c "grep 'is_kyber' '$SCRIPT'"
+The output should include 'is_kyber'
+End
</file context>
* feat: add paperclip service (#1342) * feat: add paperclip service - Systemd service on kyber: runs `paperclipai run` via bun, depends on docker-postgres - Config via builtins.toJSON: external postgres on kyber, embedded on macOS - Setup script creates paperclip database on docker-postgres - Makefile target: `make systemctl-paperclip` * fix: add shellcheck disable and shell test coverage for paperclip * fix: correct shellcheck disable directive syntax * refactor: use config.template.json pattern for paperclip * refactor: rename setup.sh to hydrate.sh for paperclip * test: add auto-switch hook tests and update coverage spec * fix: remove EnvironmentFile from paperclip service (#1344) * fix: paperclip authenticated mode and required config fields (#1345) * fix: remove EnvironmentFile from paperclip service * fix: use authenticated mode on kyber, add required meta/logging fields * fix: add allowedHostnames for paperclip.shunkakinoki.com * fix: format config template json * fix: use trust auth for docker-postgres (#1346) POSTGRES_HOST_AUTH_METHOD=trust removes password auth for all connections. The password kept going out of sync after crash recovery, causing paperclip and other services to fail with 'password authentication failed'. Safe since postgres is only reachable from the host. * fix: use k8s postgres via DATABASE_URL, remove docker-postgres dep, add authenticated mode (#1347) * fix: use bun runtime for paperclip (pino-http node crash), k8s postgres via DATABASE_URL (#1348) * fix: use nix-profile bun path for paperclip service (#1350) * fix: add caret prefix to paperclipai dependency (#1349) * fix: use extra-substituters to avoid untrusted user warnings (#1351) * fix: run paperclip from cloned repo via pnpm dev:once (#1352) * fix: run paperclip from cloned repo via pnpm dev:once The global bun install flattens pino@10 + pino-http@10.5 together, but pino-http needs pino@9. The repo lockfile resolves this correctly with nested dependencies. Running from the repo avoids the crash. * fix: use bun run server/src/index.ts instead of pnpm dev:once * fix: pin pino@9.14.0 override, run paperclipai from dotfiles node_modules The bun flat hoisting was resolving pino@10 which is incompatible with pino-http@10.5. Pinning pino to 9.14.0 via overrides matches the paperclip repo's lockfile resolution and fixes the crash. * fix: use global bun paperclipai with pino override (#1353) * fix: use global ~/.bun/bin/paperclipai with pino override Propagate overrides from dotfiles package.json to ~/.bun/install/global/ so the global binary resolves pino@9.14.0 correctly. * test: add tests for npm-globals dependency overrides * fix: resolve GitHub Actions failures and code review issues - Fix non-portable \s regex to [[:space:]] in auto-switch.sh (shfmt compat) - Add jq dependency check alongside cswap - Use printf instead of echo for safer output - Fix claude-swap version from >=1.1.5 (non-existent) to >=0.7.1 - Add auto-switch.sh to Nix deployment config (default.nix) - Sort covered_scripts list alphabetically in coverage_spec.sh https://claude.ai/code/session_012GyQBesQGF1asTfKebWyLM --------- Co-authored-by: Claude <noreply@anthropic.com>
Summary
builtins.toJSON— uses external docker-postgres on kyber, embedded-postgres on macOSpaperclipdatabase on kyber's docker-postgresmake systemctl-paperclipfor service managementFiles
config/paperclip/— Nix config activation + setup scripthome-manager/modules/paperclip/— systemd service (kyber-only, depends on docker-postgres)Makefile—systemctl-papercliptargetpackage.json—paperclipaibun dependencyTest plan
make formatpassesmake switchon kyber generates~/.paperclip/instances/default/config.jsonmake systemctl-paperclipstarts the servicepaperclip.shunkakinoki.comaccessible behind basic auth (requires devops PR merged + Cloudflare DNS deployed)Summary by cubic
Adds Paperclip as a systemd user service on kyber with Nix-managed config and automatic Postgres provisioning. Switches to a template-based config generator and renames the setup script to
hydrate.sh.New Features
docker-postgres; runspaperclipai run.~/.paperclip/instances/default/config.json; kyber uses Postgres, others use embedded.paperclipDB on thepostgresDocker container.make systemctl-paperclipadded and included inmake systemctl.Refactors
config.template.jsonviasedsubstitution; renamesetup.shtohydrate.sh.spec/paperclip_hydrate_spec.shand fix shellcheck directives.Written for commit 4979bba. Summary will update on new commits.