Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-11-10 12:37:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(grok): keep company credential discovery controller-owned

Browse Source
This commit is contained in:
Dotta committed 2026-09-22 16:44:21 -05:00
1 parent 7d95022f34
commit 817c431df2
4 files changed
+12 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/src/services/native-runtime/grok-runner-credentials.test.ts
+2 -1
View File
@@ -19,7 +19,8 @@ describe("Grok runner company credentials", () => {
companyHome.mockReturnValue(join(root, "company-without-login"));
const host = join(root, "host"); await mkdir(host, { mode: 0o700 });
await writeFile(join(host, "auth.json"), "host-secret", { mode: 0o600 });
await expect(prepareGrokRunnerCredentials({ companyId: "test-company", remote: true, environment: { GROK_HOME: host } })).rejects.toThrow("subscription login is unavailable");
await expect(prepareGrokRunnerCredentials({ companyId: "test-company", remote: true, environment: { GROK_HOME: host, PAPERCLIP_HOME: host, PAPERCLIP_INSTANCE_ID: "other" } })).rejects.toThrow("subscription login is unavailable");
expect(companyHome).toHaveBeenCalledWith(process.env, "test-company");
});
it("uses only an explicitly selected API key and strips subscription payloads and homes", async () => {
expect(await prepareGrokRunnerCredentials({ companyId: "test-company", remote: true, environment: { XAI_API_KEY: "selected", GROK_HOME: "/host", PAPERCLIP_ACPX_GROK_AUTH_JSON_SECRET: "stale" } })).toEqual({ environment: { XAI_API_KEY: "selected" }, home: null });
server/src/services/native-runtime/grok-runner-credentials.ts
+3 -1
View File
@@ -18,7 +18,9 @@ export async function prepareGrokRunnerCredentials(input: {
delete environment.GROK_HOME;
if (environment.XAI_API_KEY?.trim()) return { environment, home: null };
delete environment.XAI_API_KEY;
const companyHome = resolveManagedGrokHomeDir(input.environment, input.companyId);
// Credential discovery belongs to the controller instance. Agent-supplied
// PAPERCLIP_HOME/INSTANCE_ID values must not redirect company login reads.
const companyHome = resolveManagedGrokHomeDir(process.env, input.companyId);
const home = configuredHome ?? (await grokHomeHasUsableAuth(companyHome)
? companyHome : input.remote ? companyHome : join(homedir(), ".grok"));
try {