Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-25 02:26:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(grok): keep company credential discovery controller-owned

Browse Source
This commit is contained in:
Dotta committed 2026-09-22 16:44:21 -05:00
1 parent 7d95022f34
commit 817c431df2
4 files changed
+12 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/src/services/native-runtime/grok-runner-credentials.test.ts
+2 -1
View File
@@ -19,7 +19,8 @@ describe("Grok runner company credentials", () => {
companyHome.mockReturnValue(join(root, "company-without-login"));
const host = join(root, "host"); await mkdir(host, { mode: 0o700 });
await writeFile(join(host, "auth.json"), "host-secret", { mode: 0o600 });
await expect(prepareGrokRunnerCredentials({ companyId: "test-company", remote: true, environment: { GROK_HOME: host } })).rejects.toThrow("subscription login is unavailable");
await expect(prepareGrokRunnerCredentials({ companyId: "test-company", remote: true, environment: { GROK_HOME: host, PAPERCLIP_HOME: host, PAPERCLIP_INSTANCE_ID: "other" } })).rejects.toThrow("subscription login is unavailable");
expect(companyHome).toHaveBeenCalledWith(process.env, "test-company");
});
it("uses only an explicitly selected API key and strips subscription payloads and homes", async () => {
expect(await prepareGrokRunnerCredentials({ companyId: "test-company", remote: true, environment: { XAI_API_KEY: "selected", GROK_HOME: "/host", PAPERCLIP_ACPX_GROK_AUTH_JSON_SECRET: "stale" } })).toEqual({ environment: { XAI_API_KEY: "selected" }, home: null });
server/src/services/native-runtime/grok-runner-credentials.ts
+3 -1
View File
@@ -18,7 +18,9 @@ export async function prepareGrokRunnerCredentials(input: {
delete environment.GROK_HOME;
if (environment.XAI_API_KEY?.trim()) return { environment, home: null };
delete environment.XAI_API_KEY;
const companyHome = resolveManagedGrokHomeDir(input.environment, input.companyId);
// Credential discovery belongs to the controller instance. Agent-supplied
// PAPERCLIP_HOME/INSTANCE_ID values must not redirect company login reads.
const companyHome = resolveManagedGrokHomeDir(process.env, input.companyId);
const home = configuredHome ?? (await grokHomeHasUsableAuth(companyHome)
? companyHome : input.remote ? companyHome : join(homedir(), ".grok"));
try {
tests/runner-e2e/harness-env.ts
+1 -1
View File
@@ -25,7 +25,7 @@ const AMBIENT_EXTERNAL_STATE_KEYS = [
"PAPERCLIP_STORAGE_S3_PREFIX",
"PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE",
] as const;
const PROVIDER_SECRET_KEY = /^(?:OPENAI|ANTHROPIC|OPENROUTER|DAYTONA)(?:_|$)/;
const PROVIDER_SECRET_KEY = /^(?:OPENAI|ANTHROPIC|OPENROUTER|DAYTONA|XAI|GROK)(?:_|$)/;
export function runnerE2EServerControlPaths(temporaryRoot: string) {
const controlDirectory = path.join(temporaryRoot, "control");
tests/runner-e2e/support.test.ts
+6
View File
@@ -824,6 +824,9 @@ describe("runner E2E server isolation", () => {
ANTHROPIC_API_KEY: "anthropic",
OPENROUTER_API_KEY: "openrouter",
DAYTONA_API_KEY: "daytona",
XAI_API_KEY: "xai",
XAI_ORG_ID: "xai-sensitive",
GROK_HOME: "/outside/grok",
OPENAI_ORG_ID: "also-provider-sensitive",
PAPERCLIP_API_KEY: "ambient-board-key",
PAPERCLIP_AGENT_API_KEY: "ambient-agent-key",
@@ -847,6 +850,9 @@ describe("runner E2E server isolation", () => {
expect(env.DATABASE_URL).toBeUndefined();
expect(env.OPENAI_API_KEY).toBeUndefined();
expect(env.OPENAI_ORG_ID).toBeUndefined();
expect(env.XAI_API_KEY).toBeUndefined();
expect(env.XAI_ORG_ID).toBeUndefined();
expect(env.GROK_HOME).toBeUndefined();
expect(env.PAPERCLIP_API_KEY).toBeUndefined();
expect(env.PAPERCLIP_AGENT_API_KEY).toBeUndefined();
expect(env.XDG_CACHE_HOME).toBe("/tmp/cell/xdg-cache");