From 742ffb0a712cabb2a89fe0d499697cfcfa905cbe Mon Sep 17 00:00:00 2001 From: Dotta Date: Sun, 8 Nov 2026 05:47:12 -0600 Subject: [PATCH] fix(api): tell agents not to hunt for the instance URL in CLI login guidance A rerun with the guidance answered correctly but spent four minutes looking for the instance address. The person already knows it from their browser. Co-Authored-By: Claude Opus 5.5 (cherry picked from commit 8c7e7d36d7772b8198fe8defda03a106a23543d4) --- server/src/__tests__/cli-auth-terminal-guidance.test.ts | 1 + server/src/routes/openapi.ts | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/server/src/__tests__/cli-auth-terminal-guidance.test.ts b/server/src/__tests__/cli-auth-terminal-guidance.test.ts index f9963bd4210..e9e28151590 100644 --- a/server/src/__tests__/cli-auth-terminal-guidance.test.ts +++ b/server/src/__tests__/cli-auth-terminal-guidance.test.ts @@ -15,6 +15,7 @@ describe("CLI terminal login guidance in the agent API catalog", () => { expect(challenge, query).toBeDefined(); expect(challenge!.description).toContain("`npx paperclipai auth login --api-base `"); expect(challenge!.description).toContain("never by an agent on their behalf"); + expect(challenge!.description).toContain("leave it as that placeholder instead of looking it up"); expect(challenge!.description).toMatch(/never hand out an agent key, create or approve a challenge yourself, or ask for the person's password/); }); diff --git a/server/src/routes/openapi.ts b/server/src/routes/openapi.ts index 2adc7420fbd..db56d065bba 100644 --- a/server/src/routes/openapi.ts +++ b/server/src/routes/openapi.ts @@ -7422,7 +7422,7 @@ registry.registerPath({ path: "/api/cli-auth/challenges", tags: ["access"], summary: "Connect a person's terminal to Paperclip: create a CLI auth challenge for terminal login", - description: "Called by the Paperclip CLI in a person's own terminal, never by an agent on their behalf. To connect someone's terminal to Paperclip as themselves, tell them to run `npx paperclipai auth login --api-base ` in that terminal (add `--company-id ` to name the company). The CLI prints an approval link; they open it in a browser where they are signed in, review the requesting command, company and Board access, and approve. Only that CLI receives the resulting Board credential. `npx paperclipai auth whoami` confirms who it is signed in as and `npx paperclipai auth logout` revokes it. Agent API keys are a separate identity: never hand out an agent key, create or approve a challenge yourself, or ask for the person's password in chat.", + description: "Called by the Paperclip CLI in a person's own terminal, never by an agent on their behalf. To connect someone's terminal to Paperclip as themselves, tell them to run `npx paperclipai auth login --api-base ` in that terminal (add `--company-id ` to name the company). The URL is the address the person already opens Paperclip at in their browser; leave it as that placeholder instead of looking it up, because addresses an agent can see (such as a runner-local API URL) may not be reachable from the person's machine. The CLI prints an approval link; they open it in a browser where they are signed in, review the requesting command, company and Board access, and approve. Only that CLI receives the resulting Board credential. `npx paperclipai auth whoami` confirms who it is signed in as and `npx paperclipai auth logout` revokes it. Agent API keys are a separate identity: never hand out an agent key, create or approve a challenge yourself, or ask for the person's password in chat.", request: { body: jsonBody(createCliAuthChallengeSchema) }, responses: { 200: r.ok(), 400: r.badRequest }, });