Skip to content

fix: run paperclip from cloned repo via pnpm dev:once - #1352

Merged
shunkakinoki merged 3 commits into
mainfrom
fix/paperclip-run-from-repo
Apr 5, 2026
Merged

fix: run paperclip from cloned repo via pnpm dev:once#1352
shunkakinoki merged 3 commits into
mainfrom
fix/paperclip-run-from-repo

Conversation

@shunkakinoki

@shunkakinoki shunkakinoki commented Apr 4, 2026

Copy link
Copy Markdown
Owner

Summary

Run paperclip from ~/ghq/github.com/paperclipai/paperclip using pnpm dev:once instead of the global bun install.

Root cause

The global bun install -g paperclipai flattens pino@10 and pino-http@10.5 together, but pino-http@10.5 requires pino@9. The repo's lockfile correctly nests pino@9.14.0 inside pino-http, avoiding the crash.

Changes

  • ExecStart: pnpm dev:once (runs from the cloned repo)
  • WorkingDirectory: ~/ghq/github.com/paperclipai/paperclip
  • EnvironmentFile: loads both ~/dotfiles/.env (DATABASE_URL) and instance .env (secrets)
  • Env vars: HOST=0.0.0.0, PAPERCLIP_DEPLOYMENT_MODE=authenticated, PAPERCLIP_ALLOWED_HOSTNAMES

Tested

10/10 sequential requests returned 200 with pnpm dev:once — no crashes.


Summary by cubic

Run Paperclip using the local paperclipai binary and pin pino@9.14.0 to fix crashes from a pino/pino-http version mismatch. The systemd service now uses the local binary, loads env files, and sets required env vars.

  • Bug Fixes

    • ExecStart: ${HOME}/dotfiles/node_modules/.bin/paperclipai run --no-repair; WorkingDirectory=${HOME}/.paperclip.
    • Loads ~/dotfiles/.env and the instance .env; sets HOST=0.0.0.0, PAPERCLIP_DEPLOYMENT_MODE=authenticated, PAPERCLIP_ALLOWED_HOSTNAMES.
  • Dependencies

    • Override pino to 9.14.0 (remove pino-http override); lock now resolves pino-http@10.5.0.
    • bun.lock updated accordingly (introduces @pinojs/redact, replaces old fast-redact).

Written for commit 33995be. Summary will update on new commits.

The global bun install flattens pino@10 + pino-http@10.5 together,
but pino-http needs pino@9. The repo lockfile resolves this correctly
with nested dependencies. Running from the repo avoids the crash.
@mesa-dot-dev

mesa-dot-dev Bot commented Apr 4, 2026

Copy link
Copy Markdown

You do not have enough credits to review this pull request. Please purchase more credits to continue.

Copilot AI review requested due to automatic review settings April 4, 2026 14:34
@coderabbitai

coderabbitai Bot commented Apr 4, 2026

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a26c6605-341a-4ff2-82ea-2a80173b1a41

📥 Commits

Reviewing files that changed from the base of the PR and between a896b44 and 33995be.

⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (2)
  • home-manager/modules/paperclip/default.nix
  • package.json

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.


📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Paperclip service now launches from a local install to support development without a globally preinstalled runtime.
    • Service startup and working directory adjusted to run the repository server entrypoint; additional environment variables and multiple env files are now sourced for flexible instance-specific configuration.
    • Dependency overrides updated: pino pinned to a newer patch release; pino-http override removed.

Walkthrough

Systemd user service for Paperclip now runs the repository-local binary at ${homeDir}/dotfiles/node_modules/.bin/paperclipai, sources two EnvironmentFile locations, and exposes HOST, PAPERCLIP_DEPLOYMENT_MODE, and PAPERCLIP_ALLOWED_HOSTNAMES as environment variables; PATH, HOME, WorkingDirectory, and logging remain configured.

Changes

Cohort / File(s) Summary
Paperclip Systemd Service Configuration
home-manager/modules/paperclip/default.nix
Changed ExecStart to ${homeDir}/dotfiles/node_modules/.bin/paperclipai; added Environment entries for HOST, PAPERCLIP_DEPLOYMENT_MODE, PAPERCLIP_ALLOWED_HOSTNAMES; added EnvironmentFile sources ${homeDir}/dotfiles/.env and ${homeDir}/.paperclip/instances/default/.env. Kept Type, Restart, PATH, HOME, WorkingDirectory and log redirection.
Package dependency overrides
package.json
Bumped pino override from 9.6.0 to 9.14.0; removed the pino-http override entry.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Systemd as Systemd.user (paperclip)
  participant Env as EnvFiles (dotfiles/.env, .paperclip/.../.env)
  participant FS as Filesystem (dotfiles/node_modules)
  participant Binary as LocalPaperclip (paperclipai)

  rect rgba(200,200,255,0.5)
    Systemd->>Env: source EnvironmentFile(s)
    Env-->>Systemd: exported env vars (HOST, MODE, ALLOWED_HOSTNAMES)
  end

  rect rgba(200,255,200,0.5)
    Systemd->>FS: set WorkingDirectory / locate `dotfiles/node_modules/.bin/paperclipai`
    FS-->>Systemd: binary path resolved
  end

  rect rgba(255,200,200,0.5)
    Systemd->>Binary: ExecStart with env (PATH, HOME, sourced envs)
    Binary-->>Systemd: process started (stdout/stderr -> journal)
  end
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Poem

🐇 I hopped into dotfiles at break of day,
A local bin now runs the play.
Env files whisper configs neat,
HOST and MODE set the beat.
Paperclip hums — the rabbit's on its way!

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Title check ⚠️ Warning Title mentions 'pnpm dev:once' but the actual implementation uses 'bun run server/src/index.ts' according to the AI-generated summary. Update the title to reflect the actual implementation: 'fix: run paperclip from cloned repo via bun run' or update implementation to match the title.
Description check ❓ Inconclusive Description mentions 'pnpm dev:once' but the AI-generated summary and cubic's auto-generated description indicate 'bun run server/src/index.ts' is the actual implementation. Clarify which approach is actually implemented and ensure the description accurately reflects the final code changes.
✅ Passed checks (1 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/paperclip-run-from-repo

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@mesa-dot-dev

mesa-dot-dev Bot commented Apr 4, 2026

Copy link
Copy Markdown

Mesa Description

TL;DR

Run Paperclip from the cloned repository via pnpm dev:once instead of a global Bun install to resolve a pino/pino-http version conflict.

What changed?

  • home-manager/modules/paperclip/default.nix:
    • ExecStart: changed to pnpm dev:once to run from the cloned repository.
    • WorkingDirectory: set to ~/ghq/github.com/paperclipai/paperclip.
    • EnvironmentFile: loads ~/dotfiles/.env and the instance-specific .env file.
    • New environment variables set: HOST=0.0.0.0, PAPERCLIP_DEPLOYMENT_MODE=authenticated, PAPERCLIP_ALLOWED_HOSTNAMES.

Description generated by Mesa. Update settings

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the Paperclip systemd service to run from a cloned repository using pnpm dev:once instead of a global bun installation, addressing dependency version mismatches. It also adds several environment variables and configures EnvironmentFile paths. A review comment suggests prefixing these environment file paths with a hyphen to prevent the service from failing if the files are missing.

Comment on lines +43 to +46
EnvironmentFile = [
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"
];

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The EnvironmentFile directive in systemd will cause the service to fail to start if any of the specified files do not exist. Since these files (such as ~/dotfiles/.env or the instance-specific .env) might be missing on a fresh installation or before manual configuration, it is more robust to prefix the paths with -. This tells systemd to ignore the file if it is missing, allowing the service to attempt to start and let the application handle missing environment variables (consistent with the logic in hydrate.sh).

      EnvironmentFile = [
        "-${homeDir}/dotfiles/.env"
        "-${homeDir}/.paperclip/instances/default/.env"
      ];

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
home-manager/modules/paperclip/default.nix (2)

10-10: Repository clone is assumed but not validated.

The service depends on the repo being cloned at ~/ghq/github.com/paperclipai/paperclip with dependencies installed. Consider adding an assertion or extending the paperclipSetup activation to verify the repo exists, or document this as a manual prerequisite.

Also applies to: 47-47

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@home-manager/modules/paperclip/default.nix` at line 10, Add an explicit
existence check for the repository path referenced by repoDir (repoDir =
"${homeDir}/ghq/github.com/paperclipai/paperclip") and fail fast or log a clear
error if it is missing; update the paperclipSetup activation (paperclipSetup) to
assert the directory exists (or run a clone step) and verify dependencies are
installed, or alternatively add a clear README/activation note documenting the
manual prerequisite that the repo must be cloned to that path with dependencies
installed. Ensure the check uses the same repoDir symbol so it stays correct if
the path changes.

40-40: Hardcoded Docker bridge IP may not be portable.

172.17.0.1 is Docker's default bridge gateway, but this can change if Docker is configured with custom networks or if docker0 bridge settings are modified. Consider deriving this dynamically or documenting the assumption.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@home-manager/modules/paperclip/default.nix` at line 40, The allowed-hostnames
string currently hardcodes the Docker bridge IP
("PAPERCLIP_ALLOWED_HOSTNAMES=paperclip.shunkakinoki.com,172.17.0.1"), which is
not portable; update the configuration so the second entry is derived or
configurable: replace the hardcoded 172.17.0.1 with a computed value (e.g.,
resolve the docker0 gateway at activation/runtime or use a nixOS module
option/environment variable that can be set per-host) or explicitly document the
assumption and expose an option like paperclip.allowedHostnames to append the
host IP; ensure you modify the literal
"PAPERCLIP_ALLOWED_HOSTNAMES=paperclip.shunkakinoki.com,172.17.0.1" to use the
chosen dynamic/configurable value.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@home-manager/modules/paperclip/default.nix`:
- Around line 43-46: The EnvironmentFile entries under EnvironmentFile will
cause service failure if the files are missing; update the EnvironmentFile array
to mark the entries optional by prefixing each path with "-" (e.g.
"-${homeDir}/dotfiles/.env") so systemd won't fail when a file is absent, or
alternatively add an assertion or an activation script that creates/validates
the files before the service starts; locate the EnvironmentFile attribute in the
Nix service declaration and apply one of these fixes to ensure the service
doesn't fail on missing files.

---

Nitpick comments:
In `@home-manager/modules/paperclip/default.nix`:
- Line 10: Add an explicit existence check for the repository path referenced by
repoDir (repoDir = "${homeDir}/ghq/github.com/paperclipai/paperclip") and fail
fast or log a clear error if it is missing; update the paperclipSetup activation
(paperclipSetup) to assert the directory exists (or run a clone step) and verify
dependencies are installed, or alternatively add a clear README/activation note
documenting the manual prerequisite that the repo must be cloned to that path
with dependencies installed. Ensure the check uses the same repoDir symbol so it
stays correct if the path changes.
- Line 40: The allowed-hostnames string currently hardcodes the Docker bridge IP
("PAPERCLIP_ALLOWED_HOSTNAMES=paperclip.shunkakinoki.com,172.17.0.1"), which is
not portable; update the configuration so the second entry is derived or
configurable: replace the hardcoded 172.17.0.1 with a computed value (e.g.,
resolve the docker0 gateway at activation/runtime or use a nixOS module
option/environment variable that can be set per-host) or explicitly document the
assumption and expose an option like paperclip.allowedHostnames to append the
host IP; ensure you modify the literal
"PAPERCLIP_ALLOWED_HOSTNAMES=paperclip.shunkakinoki.com,172.17.0.1" to use the
chosen dynamic/configurable value.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ab480ad7-89ab-4c62-8bd5-1fee82c61d4f

📥 Commits

Reviewing files that changed from the base of the PR and between 34dacb6 and 9a8a7bd.

📒 Files selected for processing (1)
  • home-manager/modules/paperclip/default.nix

Comment on lines +43 to +46
EnvironmentFile = [
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"
];

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

EnvironmentFile entries will cause service failure if files are missing.

Systemd's EnvironmentFile directive will fail service startup if the specified file doesn't exist. Consider prefixing with - to make them optional if that's acceptable, or ensure the files are created before service start.

       EnvironmentFile = [
-        "${homeDir}/dotfiles/.env"
-        "${homeDir}/.paperclip/instances/default/.env"
+        "-${homeDir}/dotfiles/.env"
+        "-${homeDir}/.paperclip/instances/default/.env"
       ];

Alternatively, if these files are strictly required, add assertions or activation scripts to validate their existence.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
EnvironmentFile = [
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"
];
EnvironmentFile = [
"-${homeDir}/dotfiles/.env"
"-${homeDir}/.paperclip/instances/default/.env"
];
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@home-manager/modules/paperclip/default.nix` around lines 43 - 46, The
EnvironmentFile entries under EnvironmentFile will cause service failure if the
files are missing; update the EnvironmentFile array to mark the entries optional
by prefixing each path with "-" (e.g. "-${homeDir}/dotfiles/.env") so systemd
won't fail when a file is absent, or alternatively add an assertion or an
activation script that creates/validates the files before the service starts;
locate the EnvironmentFile attribute in the Nix service declaration and apply
one of these fixes to ensure the service doesn't fail on missing files.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Home Manager systemd user service for Paperclip to run from a cloned repository via pnpm dev:once, avoiding dependency resolution issues seen with a global bun install.

Changes:

  • Switch ExecStart to ~/.bun/bin/pnpm dev:once and set WorkingDirectory to the cloned Paperclip repo path.
  • Add EnvironmentFile entries to load shared (~/dotfiles/.env) and instance (~/.paperclip/instances/default/.env) environment variables.
  • Set additional runtime env vars (HOST, PAPERCLIP_DEPLOYMENT_MODE, PAPERCLIP_ALLOWED_HOSTNAMES).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +44 to +45
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"

Copilot AI Apr 4, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

EnvironmentFile entries are required by systemd; if either ${homeDir}/dotfiles/.env or ${homeDir}/.paperclip/instances/default/.env is missing, the unit will fail to start. Either ensure these files (and the instances/default directory) are created with appropriate permissions during activation, or prefix the paths with - to make them optional and handle missing values another way.

Suggested change
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"
"-${homeDir}/dotfiles/.env"
"-${homeDir}/.paperclip/instances/default/.env"

Copilot uses AI. Check for mistakes.
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"
];
WorkingDirectory = "${repoDir}";

Copilot AI Apr 4, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The service now WorkingDirectorys into ${repoDir}, but this module doesn't ensure the repo exists. If the directory is missing (fresh machine, different ghq root, etc.), systemd will fail with a CHDIR error and keep restarting. Consider adding a ConditionPathIsDirectory= / AssertPathIsDirectory= in the unit, or an ExecStartPre check that exits with a clear log message when the repo isn't present.

Copilot uses AI. Check for mistakes.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="home-manager/modules/paperclip/default.nix">

<violation number="1" location="home-manager/modules/paperclip/default.nix:44">
P1: Systemd's `EnvironmentFile` directive treats unprefixed paths as required — the service will refuse to start if either file is missing (e.g. fresh machine, before manual setup). Prefix with `-` to make them optional:
```nix
EnvironmentFile = [
  "-${homeDir}/dotfiles/.env"
  "-${homeDir}/.paperclip/instances/default/.env"
];
```</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.

Comment on lines +44 to +45
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"

@cubic-dev-ai cubic-dev-ai Bot Apr 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Systemd's EnvironmentFile directive treats unprefixed paths as required — the service will refuse to start if either file is missing (e.g. fresh machine, before manual setup). Prefix with - to make them optional:

EnvironmentFile = [
  "-${homeDir}/dotfiles/.env"
  "-${homeDir}/.paperclip/instances/default/.env"
];
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/modules/paperclip/default.nix, line 44:

<comment>Systemd's `EnvironmentFile` directive treats unprefixed paths as required — the service will refuse to start if either file is missing (e.g. fresh machine, before manual setup). Prefix with `-` to make them optional:
```nix
EnvironmentFile = [
  "-${homeDir}/dotfiles/.env"
  "-${homeDir}/.paperclip/instances/default/.env"
];
```</comment>

<file context>
@@ -27,14 +30,21 @@ lib.mkIf host.isKyber {
       ];
-      WorkingDirectory = "${homeDir}/.paperclip";
+      EnvironmentFile = [
+        "${homeDir}/dotfiles/.env"
+        "${homeDir}/.paperclip/instances/default/.env"
+      ];
</file context>
Suggested change
"${homeDir}/dotfiles/.env"
"${homeDir}/.paperclip/instances/default/.env"
"-${homeDir}/dotfiles/.env"
"-${homeDir}/.paperclip/instances/default/.env"
Fix with Cubic

…ules

The bun flat hoisting was resolving pino@10 which is incompatible
with pino-http@10.5. Pinning pino to 9.14.0 via overrides matches
the paperclip repo's lockfile resolution and fixes the crash.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (1)
home-manager/modules/paperclip/default.nix (1)

43-46: ⚠️ Potential issue | 🟠 Major

EnvironmentFile entries can still fail startup when files are absent.

Line 43-46 should be optional (- prefix) unless you strictly guarantee file creation before this unit starts. The second file is especially risky given current hydration behavior.

Suggested fix
       EnvironmentFile = [
-        "${homeDir}/dotfiles/.env"
-        "${homeDir}/.paperclip/instances/default/.env"
+        "-${homeDir}/dotfiles/.env"
+        "-${homeDir}/.paperclip/instances/default/.env"
       ];
#!/bin/bash
set -euo pipefail

echo "EnvironmentFile references:"
rg -n --type nix 'EnvironmentFile|\\.paperclip/instances/default/\\.env|dotfiles/\\.env'

echo
echo "Search for creation of the default instance .env:"
rg -n --type sh --type nix 'instances/default/.+\\.env|touch.+\\.env|cat.+>.+\\.env|writeText.*\\.env'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@home-manager/modules/paperclip/default.nix` around lines 43 - 46, The
EnvironmentFile entries in the systemd unit (EnvironmentFile = [...]) can cause
unit startup failures if the files don't exist; change the two entries
referencing "${homeDir}/dotfiles/.env" and
"${homeDir}/.paperclip/instances/default/.env" to optional by prefixing each
path with a "-" so systemd ignores missing files, or alternatively ensure
creation of the default instance .env before unit activation (e.g., via a
setup/hydration step that writes
"${homeDir}/.paperclip/instances/default/.env"); update the EnvironmentFile
array in default.nix accordingly and keep the variable name homeDir and the
exact path strings to locate the change.
🧹 Nitpick comments (1)
home-manager/modules/paperclip/default.nix (1)

38-40: Consider deriving runtime env values from one source to avoid drift.

These values are now hardcoded here while related host/deployment values are also templated in Paperclip hydration config. Centralizing them (Nix attr/let binding reused by both) will reduce config skew.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@home-manager/modules/paperclip/default.nix` around lines 38 - 40, The three
hardcoded runtime env values "HOST", "PAPERCLIP_DEPLOYMENT_MODE", and
"PAPERCLIP_ALLOWED_HOSTNAMES" in home-manager/modules/paperclip/default.nix
should be derived from a single Nix attribute/let binding (e.g., paperclip.host,
paperclip.deploymentMode, paperclip.allowedHostnames) and referenced wherever
Paperclip hydration templating is generated; update default.nix to introduce
those attributes in the module options/let and replace the literal strings with
references to those attributes so both the runtime env block and the hydration
config/template reuse the same values to avoid drift.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@home-manager/modules/paperclip/default.nix`:
- Line 10: The systemd unit can hard-fail if the repo directory (repoDir =
"${homeDir}/ghq/github.com/paperclipai/paperclip") is missing because
paperclipSetup only creates directories; add a ConditionPathExists check to the
generated unit so systemd will skip/explicitly fail when the repo is absent.
Modify the code that emits the unit (look for the unit section referencing
WorkingDirectory and ExecStart in the paperclipSetup/unit or service generation
logic) to include ConditionPathExists=<path> using the same repoDir symbol,
ensuring the path guard is added alongside the existing WorkingDirectory and
ExecStart entries.

---

Duplicate comments:
In `@home-manager/modules/paperclip/default.nix`:
- Around line 43-46: The EnvironmentFile entries in the systemd unit
(EnvironmentFile = [...]) can cause unit startup failures if the files don't
exist; change the two entries referencing "${homeDir}/dotfiles/.env" and
"${homeDir}/.paperclip/instances/default/.env" to optional by prefixing each
path with a "-" so systemd ignores missing files, or alternatively ensure
creation of the default instance .env before unit activation (e.g., via a
setup/hydration step that writes
"${homeDir}/.paperclip/instances/default/.env"); update the EnvironmentFile
array in default.nix accordingly and keep the variable name homeDir and the
exact path strings to locate the change.

---

Nitpick comments:
In `@home-manager/modules/paperclip/default.nix`:
- Around line 38-40: The three hardcoded runtime env values "HOST",
"PAPERCLIP_DEPLOYMENT_MODE", and "PAPERCLIP_ALLOWED_HOSTNAMES" in
home-manager/modules/paperclip/default.nix should be derived from a single Nix
attribute/let binding (e.g., paperclip.host, paperclip.deploymentMode,
paperclip.allowedHostnames) and referenced wherever Paperclip hydration
templating is generated; update default.nix to introduce those attributes in the
module options/let and replace the literal strings with references to those
attributes so both the runtime env block and the hydration config/template reuse
the same values to avoid drift.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a60b45b7-0b1a-4b70-804d-c3c68337c83b

📥 Commits

Reviewing files that changed from the base of the PR and between 9a8a7bd and a896b44.

📒 Files selected for processing (1)
  • home-manager/modules/paperclip/default.nix

let
inherit (inputs) host;
homeDir = config.home.homeDirectory;
repoDir = "${homeDir}/ghq/github.com/paperclipai/paperclip";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify whether repo provisioning exists anywhere in Home Manager/Nix code.
rg -n --type nix --type sh 'paperclipai/paperclip|ghq/github.com/paperclipai/paperclip|ConditionPathExists'

Repository: shunkakinoki/dotfiles

Length of output: 173


🏁 Script executed:

#!/bin/bash
# View the full paperclip service configuration
cat -n home-manager/modules/paperclip/default.nix

Repository: shunkakinoki/dotfiles

Length of output: 2337


🏁 Script executed:

#!/bin/bash
# Search for ghq initialization, git clone, or Home Manager activation scripts
rg -n 'ghq|git clone|activation' --type nix --type sh -A 3 -B 3

Repository: shunkakinoki/dotfiles

Length of output: 37004


Add a guard for missing repo directory before service start.

The paperclipSetup activation script (lines 15-18) only creates directories—it does not clone the repository. If ${repoDir} doesn't exist at service start, WorkingDirectory (line 47) and ExecStart (line 33) will cause systemd to hard-fail the unit. Add ConditionPathExists to make the failure explicit rather than flaky.

Suggested hardening
   systemd.user.services.paperclip = {
     Unit = {
       Description = "Paperclip AI agent orchestration platform";
       After = [ "network-online.target" ];
       Wants = [ "network-online.target" ];
+      ConditionPathExists = "${repoDir}/server/src/index.ts";
     };
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@home-manager/modules/paperclip/default.nix` at line 10, The systemd unit can
hard-fail if the repo directory (repoDir =
"${homeDir}/ghq/github.com/paperclipai/paperclip") is missing because
paperclipSetup only creates directories; add a ConditionPathExists check to the
generated unit so systemd will skip/explicitly fail when the repo is absent.
Modify the code that emits the unit (look for the unit section referencing
WorkingDirectory and ExecStart in the paperclipSetup/unit or service generation
logic) to include ConditionPathExists=<path> using the same repoDir symbol,
ensuring the path guard is added alongside the existing WorkingDirectory and
ExecStart entries.

@shunkakinoki
shunkakinoki merged commit f358ab0 into main Apr 5, 2026
30 of 31 checks passed
@shunkakinoki
shunkakinoki deleted the fix/paperclip-run-from-repo branch April 5, 2026 00:38
shunkakinoki added a commit that referenced this pull request Apr 5, 2026
* feat: add paperclip service (#1342)

* feat: add paperclip service

- Systemd service on kyber: runs `paperclipai run` via bun, depends on docker-postgres
- Config via builtins.toJSON: external postgres on kyber, embedded on macOS
- Setup script creates paperclip database on docker-postgres
- Makefile target: `make systemctl-paperclip`

* fix: add shellcheck disable and shell test coverage for paperclip

* fix: correct shellcheck disable directive syntax

* refactor: use config.template.json pattern for paperclip

* refactor: rename setup.sh to hydrate.sh for paperclip

* test: add auto-switch hook tests and update coverage spec

* fix: remove EnvironmentFile from paperclip service (#1344)

* fix: paperclip authenticated mode and required config fields (#1345)

* fix: remove EnvironmentFile from paperclip service

* fix: use authenticated mode on kyber, add required meta/logging fields

* fix: add allowedHostnames for paperclip.shunkakinoki.com

* fix: format config template json

* fix: use trust auth for docker-postgres (#1346)

POSTGRES_HOST_AUTH_METHOD=trust removes password auth for all
connections. The password kept going out of sync after crash recovery,
causing paperclip and other services to fail with 'password
authentication failed'. Safe since postgres is only reachable from
the host.

* fix: use k8s postgres via DATABASE_URL, remove docker-postgres dep, add authenticated mode (#1347)

* fix: use bun runtime for paperclip (pino-http node crash), k8s postgres via DATABASE_URL (#1348)

* fix: use nix-profile bun path for paperclip service (#1350)

* fix: add caret prefix to paperclipai dependency (#1349)

* fix: use extra-substituters to avoid untrusted user warnings (#1351)

* fix: run paperclip from cloned repo via pnpm dev:once (#1352)

* fix: run paperclip from cloned repo via pnpm dev:once

The global bun install flattens pino@10 + pino-http@10.5 together,
but pino-http needs pino@9. The repo lockfile resolves this correctly
with nested dependencies. Running from the repo avoids the crash.

* fix: use bun run server/src/index.ts instead of pnpm dev:once

* fix: pin pino@9.14.0 override, run paperclipai from dotfiles node_modules

The bun flat hoisting was resolving pino@10 which is incompatible
with pino-http@10.5. Pinning pino to 9.14.0 via overrides matches
the paperclip repo's lockfile resolution and fixes the crash.

* fix: use global bun paperclipai with pino override (#1353)

* fix: use global ~/.bun/bin/paperclipai with pino override

Propagate overrides from dotfiles package.json to ~/.bun/install/global/
so the global binary resolves pino@9.14.0 correctly.

* test: add tests for npm-globals dependency overrides

* fix: resolve GitHub Actions failures and code review issues

- Fix non-portable \s regex to [[:space:]] in auto-switch.sh (shfmt compat)
- Add jq dependency check alongside cswap
- Use printf instead of echo for safer output
- Fix claude-swap version from >=1.1.5 (non-existent) to >=0.7.1
- Add auto-switch.sh to Nix deployment config (default.nix)
- Sort covered_scripts list alphabetically in coverage_spec.sh

https://claude.ai/code/session_012GyQBesQGF1asTfKebWyLM

---------

Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants