mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-06 14:02:36 +01:00
feat: default new Codex agents to the qualified Paperclip Runner
Resolve creation intent across onboarding, hires, imports, and the UI. Preserve existing execution and qualify automatic defaults for shipped Linux x64 artifacts. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed
1 parent
835a022936
commit
aa879604ae
91 files changed
+2718
-884
No files matched your search
@@ -12624,12 +12624,12 @@ describe("runnerd provider runtime wiring", () => {
|
||||
|
||||
it.each([
|
||||
...["current", "preinstalled-exact", "preinstalled-mismatch", "preinstalled-error", "preinstalled-timeout", "stale", "missing", "retained", "retained-mismatch", "retained-error", "retained-timeout", "retained-explicit"]
|
||||
.map((image) => ({ image, version: "0.160.0", compatible: true })),
|
||||
.map((image) => ({ image, version: "0.160.0" })),
|
||||
...["0.149.0", "0.149.1", "0.153.4", "0.156.0", "0.160.1"]
|
||||
.map((version) => ({ image: "current", version, compatible: true })),
|
||||
.map((version) => ({ image: "current", version })),
|
||||
...["0.148.9", "0.161.0", "1.0.0", "0.160.0-alpha.1", "unknown"]
|
||||
.map((version) => ({ image: "current", version, compatible: false })),
|
||||
])("uses shared Codex and the server-owned replacement artifact (image=$image, Codex=$version)", async ({ image, version, compatible }) => {
|
||||
.map((version) => ({ image: "current", version })),
|
||||
])("uses shared Codex and the server-owned replacement artifact (image=$image, Codex=$version)", async ({ image, version }) => {
|
||||
const retained = image.startsWith("retained");
|
||||
const exactRetained = image === "retained" || image === "retained-explicit";
|
||||
const needsReplacement = image !== "current" && image !== "preinstalled-exact" && !exactRetained;
|
||||
@@ -12721,16 +12721,10 @@ describe("runnerd provider runtime wiring", () => {
|
||||
controlPlaneRegistration: (authority: unknown) => Promise<unknown>;
|
||||
};
|
||||
await expect(transport.controlPlaneRegistration({})).rejects.toThrow(
|
||||
compatible ? "reached-preinstalled-codex-verification" : "runner_remote_provider_artifact_incompatible: supported Codex versions >=0.149.0 <0.161.0",
|
||||
"reached-preinstalled-codex-verification",
|
||||
);
|
||||
if (!compatible) {
|
||||
expect(syncIn).not.toHaveBeenCalled();
|
||||
expect(remoteExecute.mock.calls.some(([call]) => call.command === "npm" || call.args?.[1]?.includes("paperclip_codex_launcher_tmp"))).toBe(false);
|
||||
expect(onLog).not.toHaveBeenCalledWith("stderr", expect.stringContaining("using compatible Codex"));
|
||||
return;
|
||||
}
|
||||
if (version !== "0.160.0") {
|
||||
expect(onLog).toHaveBeenCalledWith("stderr", expect.stringContaining(`using compatible Codex ${version}`));
|
||||
expect(onLog).toHaveBeenCalledWith("stderr", expect.stringContaining(`using installed Codex ${version === "unknown" || version.includes("alpha") ? "unrecognized version" : version}`));
|
||||
}
|
||||
if (needsReplacement) {
|
||||
expect(transport.runnerBinary).toBe(controllerArtifact);
|
||||
@@ -12776,12 +12770,9 @@ describe("runnerd provider runtime wiring", () => {
|
||||
].map((scenario) => ({ ...scenario, recover: false })),
|
||||
{ version: "0.156.0", model: "gpt-6.1-sol", floor: null, recover: true },
|
||||
{ version: "0.158.0", model: "gpt-6.1-sol", floor: null, recover: true },
|
||||
])("verifies sandbox Codex $version against the prepared $model selection (floor=$floor, recover=$recover)", async ({ version, model, floor, recover }) => {
|
||||
// A preinstalled Codex inside the compatibility window can still be too
|
||||
// old for the configured model: the ChatGPT backend rejects every turn
|
||||
// with "not supported when using Codex with a ChatGPT account". The
|
||||
// verifier names the stale image instead of letting the run fail as an
|
||||
// account problem.
|
||||
])("lets sandbox Codex $version reach actual model verification ($model, recover=$recover)", async ({ version, model, recover }) => {
|
||||
// Version metadata is diagnostic. A working app-server reaches the model
|
||||
// turn instead of being rejected or replaced by a static CLI version floor.
|
||||
const preparedModel = recover ? resolvePaperclipRunnerNativeProviderInput({
|
||||
backend: "codex_app_server", adapterConfig: { provider: "codex", model }, codexCliVersion: version,
|
||||
}).model : model;
|
||||
@@ -12851,16 +12842,10 @@ describe("runnerd provider runtime wiring", () => {
|
||||
);
|
||||
}
|
||||
await expect(transport.controlPlaneRegistration({})).rejects.toThrow(
|
||||
floor
|
||||
? `runner_remote_provider_artifact_incompatible: ${model} requires Codex ${floor} or newer with ChatGPT sign-in, received ${version} from the sandbox image; promote a sandbox image with Codex 0.160.0 or configure PAPERCLIP_RUNNER_REMOTE_CODEX_NPM_SPEC=@openai/codex@0.160.0`
|
||||
: "reached-preinstalled-codex-verification",
|
||||
"reached-preinstalled-codex-verification",
|
||||
);
|
||||
if (floor) {
|
||||
// No npm spec is configured, so there is no fallback install; the run
|
||||
// fails before launch instead of running against the stale CLI.
|
||||
expect(remoteExecute.mock.calls.some(([call]) => call.command === "npm")).toBe(false);
|
||||
expect(remoteExecute.mock.calls.some(([call]) => call.args?.[1]?.includes("paperclip_codex_launcher_tmp"))).toBe(false);
|
||||
}
|
||||
expect(remoteExecute.mock.calls.some(([call]) => call.command === "npm")).toBe(false);
|
||||
|
||||
});
|
||||
|
||||
it("binds a remote launch to the configured controller-owned runner artifact", async () => {
|
||||
|
||||
@@ -16,11 +16,7 @@ import { copyBackGrokAuth } from "@paperclipai/adapter-grok-local/server";
|
||||
|
||||
import { inferOpenAiCompatibleBiller, type AdapterUsageCheckpoint } from "@paperclipai/adapter-utils";
|
||||
import { createAgentIdentityRedactor } from "../agent-identity-redaction.js";
|
||||
import {
|
||||
isSupportedRemoteCodexVersion,
|
||||
parseCodexCliVersion,
|
||||
REMOTE_CODEX_SUPPORTED_RANGE,
|
||||
} from "./codex-runtime-compatibility.js";
|
||||
import { parseCodexCliVersion } from "./codex-runtime-compatibility.js";
|
||||
import { createNativeToolTrace, type NativeToolTrace } from "./native-tool-trace.js";
|
||||
import { createNativeProviderFailureObservation } from "./native-provider-failure.js";
|
||||
import { createNativeGitHubAccess, type NativeGitHubAccess } from "./native-github-access.js";
|
||||
@@ -29,11 +25,6 @@ import { bindManagedNativeCredentialTurn, completeManagedNativeCredentialTurn }
|
||||
import { createLocalNativeQuestionBridge } from "./local-native-question-bridge.js";
|
||||
import { readVerifiedRemoteWorkspaceFile } from "./remote-deliverable-file.js";
|
||||
import { copyBackCodexAuth } from "@paperclipai/adapter-codex-local/server";
|
||||
import {
|
||||
codexCliVersionAtLeast,
|
||||
minimumCodexCliVersionForModel,
|
||||
normalizeCodexModel,
|
||||
} from "@paperclipai/adapter-codex-local";
|
||||
import { nativeCompletionFeedback } from "./native-completion-feedback.js";
|
||||
import { hasAcknowledgedNativeReassignmentStopIntent, hasAcknowledgedNativeStopIntent } from "../acknowledged-native-stop.js";
|
||||
import { stoppedCodexTurnIsTextOnly } from "./stopped-codex-turn.js";
|
||||
@@ -10174,7 +10165,7 @@ export function assertRemoteRunnerBuildMetadata(
|
||||
}
|
||||
}
|
||||
|
||||
async function stageRemoteRunnerFile(input: {
|
||||
export async function stageRemoteRunnerFile(input: {
|
||||
target: Extract<AdapterExecutionTarget, { kind: "remote" }>;
|
||||
runner: CommandManagedRuntimeRunner;
|
||||
sourcePath: string;
|
||||
@@ -10566,7 +10557,7 @@ export async function syncRemoteRunnerDirectoryOut(input: {
|
||||
}
|
||||
}
|
||||
|
||||
async function readRemoteRunnerState(input: {
|
||||
export async function readRemoteRunnerState(input: {
|
||||
runner: CommandManagedRuntimeRunner;
|
||||
stateDirectory: string;
|
||||
}): Promise<Record<string, unknown>> {
|
||||
@@ -11498,76 +11489,6 @@ async function createRunnerdBackendWithinSessionClaim(
|
||||
})
|
||||
: Promise.resolve();
|
||||
|
||||
const verifyRemoteRunner = async (
|
||||
requiredMode: "dial_wss" | "listen_ws",
|
||||
executable = remoteBinary,
|
||||
) => {
|
||||
if (!remoteTarget || !remoteCommandRunner || !executable) return;
|
||||
const metadataResult = await remoteCommandRunner.execute({
|
||||
command: executable,
|
||||
args: ["--build-metadata"],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 30_000,
|
||||
});
|
||||
if (metadataResult.exitCode !== 0 || metadataResult.timedOut) {
|
||||
throw new Error("runner_remote_artifact_verification_failed");
|
||||
}
|
||||
let metadata: Record<string, unknown>;
|
||||
try {
|
||||
metadata = JSON.parse(metadataResult.stdout) as Record<string, unknown>;
|
||||
} catch (error) {
|
||||
throw new Error("runner_remote_artifact_metadata_invalid", {
|
||||
cause: error,
|
||||
});
|
||||
}
|
||||
assertRemoteRunnerBuildMetadata(metadata, requiredMode);
|
||||
};
|
||||
|
||||
const reportedCodexVersions = new Set<string>();
|
||||
const verifyRemoteCodex = async (executable = remoteCodexBinary) => {
|
||||
if (!remoteTarget || !remoteCommandRunner || !executable) return;
|
||||
const versionResult = await remoteCommandRunner.execute({
|
||||
command: executable,
|
||||
args: ["--version"],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 30_000,
|
||||
});
|
||||
if (versionResult.exitCode !== 0 || versionResult.timedOut) {
|
||||
throw new Error("runner_remote_codex_artifact_verification_failed");
|
||||
}
|
||||
const versionOutput = `${versionResult.stdout}\n${versionResult.stderr}`;
|
||||
const version = parseCodexCliVersion(versionOutput);
|
||||
if (!version || !isSupportedRemoteCodexVersion(version)) {
|
||||
throw new Error(
|
||||
`runner_remote_provider_artifact_incompatible: supported Codex versions ${REMOTE_CODEX_SUPPORTED_RANGE}, received ${version ?? "an unrecognized or prerelease version"}; install a supported stable Codex release or configure PAPERCLIP_RUNNER_REMOTE_CODEX_NPM_SPEC=@openai/codex@${REMOTE_PROVIDER_PACK_PINS.codex}`,
|
||||
);
|
||||
}
|
||||
// A Codex inside the compatibility window can still be too old for the
|
||||
// configured model: the ChatGPT backend rejects a model from clients
|
||||
// below the model's floor on every turn. Fail before launch with the
|
||||
// exact gap, so a stale sandbox image is not reported as an account
|
||||
// problem. When a preinstalled Codex fails here and an npm spec is
|
||||
// configured, the caller falls back to installing the pinned release.
|
||||
const configuredModel = input.execution.provider.kind === "codex"
|
||||
? input.execution.provider.model
|
||||
: null;
|
||||
const modelMinimum = minimumCodexCliVersionForModel(configuredModel);
|
||||
if (modelMinimum && !codexCliVersionAtLeast(version, modelMinimum)) {
|
||||
throw new Error(
|
||||
`runner_remote_provider_artifact_incompatible: ${normalizeCodexModel(configuredModel)} requires Codex ${modelMinimum} or newer with ChatGPT sign-in, received ${version} from the sandbox image; promote a sandbox image with Codex ${REMOTE_PROVIDER_PACK_PINS.codex} or configure PAPERCLIP_RUNNER_REMOTE_CODEX_NPM_SPEC=@openai/codex@${REMOTE_PROVIDER_PACK_PINS.codex}`,
|
||||
);
|
||||
}
|
||||
if (version !== REMOTE_PROVIDER_PACK_PINS.codex && !reportedCodexVersions.has(version)) {
|
||||
reportedCodexVersions.add(version);
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
`[paperclip-runner] using compatible Codex ${version} (supported ${REMOTE_CODEX_SUPPORTED_RANGE}; install pin ${REMOTE_PROVIDER_PACK_PINS.codex})\n`,
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
const verifyRemoteProviderPack = async (packRoot: string) => {
|
||||
if (!remoteTarget || !remoteCommandRunner || !expectedProviderPackManifest)
|
||||
return;
|
||||
@@ -11652,41 +11573,20 @@ async function createRunnerdBackendWithinSessionClaim(
|
||||
return parseRemoteExecutableCandidate(result.stdout);
|
||||
};
|
||||
|
||||
// Image policy: keep one latest stable CLI installation shared by native and
|
||||
// local adapters. Preferred bin entries must point to that same installation;
|
||||
// never bake an older global CLI alongside a private runner-only version.
|
||||
const discoverPreinstalledExecutable = async (
|
||||
name: "paperclip-runnerd" | "codex",
|
||||
) => {
|
||||
if (!remoteTarget || !remoteCommandRunner) return null;
|
||||
return discoverRemoteExecutable(remoteCommandRunner, remoteTarget.remoteCwd, name);
|
||||
};
|
||||
|
||||
const linkPreinstalledExecutable = async (
|
||||
sourcePath: string,
|
||||
targetPath: string,
|
||||
) => {
|
||||
if (!remoteTarget || !remoteCommandRunner) return;
|
||||
const escapedSource = sourcePath.replaceAll("'", "'\\''");
|
||||
const escapedTarget = targetPath.replaceAll("'", "'\\''");
|
||||
const escapedDirectory = posix.dirname(targetPath).replaceAll("'", "'\\''");
|
||||
const result = await remoteCommandRunner.execute({
|
||||
command: "sh",
|
||||
args: [
|
||||
"-c",
|
||||
targetPath === remoteCodexBinary
|
||||
? buildRemoteCodexLauncherCommand(sourcePath, targetPath)
|
||||
: `umask 077; mkdir -p '${escapedDirectory}' && ` +
|
||||
`ln -sfn '${escapedSource}' '${escapedTarget}'`,
|
||||
],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 10_000,
|
||||
});
|
||||
if (result.exitCode !== 0 || result.timedOut) {
|
||||
throw new Error("runner_remote_preinstalled_link_failed");
|
||||
}
|
||||
const remoteNativeArtifacts = remoteTarget && remoteCommandRunner && remoteBinary && remoteRuntimeRoot
|
||||
? createRemoteNativeArtifactPreparation({
|
||||
target: remoteTarget, runner: remoteCommandRunner, remoteBinary, controllerRunnerBinary,
|
||||
remoteRuntimeRoot, remoteCodexBinary, runnerRemoteBinaryPath: input.runnerRemoteBinaryPath,
|
||||
runnerRemoteCodexPath: input.runnerRemoteCodexPath, runnerRemoteCodexNpmSpec: input.runnerRemoteCodexNpmSpec,
|
||||
model: input.execution.provider.kind === "codex" ? input.execution.provider.model : null,
|
||||
reuseRetainedRunner: sandboxLeaseAcquisition?.outcome === "resumed", targetPlatformArtifactVerified: remotePiCompanion !== null,
|
||||
trace: input.trace, onLog: input.onLog,
|
||||
})
|
||||
: null;
|
||||
const verifyRemoteRunner = async (mode: "dial_wss" | "listen_ws", executable?: string | null) => {
|
||||
if (remoteNativeArtifacts) await remoteNativeArtifacts.verifyRemoteRunner(mode, executable ?? undefined);
|
||||
};
|
||||
const verifyRemoteCodex = async () => { await remoteNativeArtifacts?.verifyRemoteCodex(); };
|
||||
|
||||
const prepareRemoteRunner = async (
|
||||
requiredMode: "dial_wss" | "listen_ws",
|
||||
@@ -11708,234 +11608,7 @@ async function createRunnerdBackendWithinSessionClaim(
|
||||
remotePrepared = true;
|
||||
return;
|
||||
}
|
||||
// Compatibility metadata does not prove artifact identity. Reuse only the
|
||||
// exact controller-owned bytes when the controller artifact is available.
|
||||
const matchesControllerRunnerArtifact = async (executable: string): Promise<boolean> => {
|
||||
const expected = createHash("sha256")
|
||||
.update(readFileSync(controllerRunnerBinary))
|
||||
.digest("hex");
|
||||
try {
|
||||
const probe = await remoteCommandRunner.execute({
|
||||
command: "sh",
|
||||
args: [
|
||||
"-c",
|
||||
'test -x "$1" || exit 1; if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1"; else shasum -a 256 "$1"; fi',
|
||||
"paperclip-runner-artifact",
|
||||
executable,
|
||||
],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 10_000,
|
||||
});
|
||||
return probe.exitCode === 0 && !probe.timedOut &&
|
||||
/^[a-f0-9]{64}\s/.test(probe.stdout) &&
|
||||
probe.stdout.trim().split(/\s+/)[0] === expected;
|
||||
} catch {
|
||||
// An unavailable checksum uses the verified staging path.
|
||||
return false;
|
||||
}
|
||||
};
|
||||
let runnerArtifactPrepared = false;
|
||||
if (
|
||||
sandboxLeaseAcquisition?.outcome === "resumed" &&
|
||||
existsSync(controllerRunnerBinary)
|
||||
) {
|
||||
runnerArtifactPrepared = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.verify_retained",
|
||||
() => matchesControllerRunnerArtifact(remoteBinary),
|
||||
);
|
||||
}
|
||||
const explicitRemoteBinary = input.runnerRemoteBinaryPath?.trim() || null;
|
||||
if (!runnerArtifactPrepared && mayUsePreinstalledRunnerArtifact(explicitRemoteBinary)) {
|
||||
const preinstalledRunner = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.discover",
|
||||
() => discoverPreinstalledExecutable("paperclip-runnerd"),
|
||||
);
|
||||
if (preinstalledRunner) {
|
||||
try {
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.verify_preinstalled",
|
||||
() => verifyRemoteRunner(requiredMode, preinstalledRunner),
|
||||
);
|
||||
if (existsSync(controllerRunnerBinary) &&
|
||||
!await matchesControllerRunnerArtifact(preinstalledRunner)) {
|
||||
throw new Error("runner_remote_preinstalled_artifact_mismatch");
|
||||
}
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.link",
|
||||
() => linkPreinstalledExecutable(preinstalledRunner, remoteBinary),
|
||||
);
|
||||
runnerArtifactPrepared = true;
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
"[paperclip-runner] using preinstalled runnerd from the sandbox image\n",
|
||||
);
|
||||
} catch {
|
||||
runnerArtifactPrepared = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (!runnerArtifactPrepared) {
|
||||
// Upload the same artifact used for the controller identity. The server
|
||||
// vendors the runner under vendor/paperclip-runner/bin, so the package
|
||||
// development fallback cannot locate it in a deployed server.
|
||||
const sourceBinary = controllerRunnerBinary;
|
||||
if (!existsSync(sourceBinary)) {
|
||||
throw new Error("runner_remote_artifact_unavailable");
|
||||
}
|
||||
if (!explicitRemoteBinary && !remotePiCompanion) {
|
||||
const platform = await remoteCommandRunner.execute({
|
||||
command: "sh",
|
||||
args: ["-c", "uname -s; uname -m"],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 10_000,
|
||||
});
|
||||
const [remoteOs = "", remoteArch = ""] = platform.stdout
|
||||
.trim()
|
||||
.split(/\r?\n/);
|
||||
const localOs =
|
||||
process.platform === "darwin"
|
||||
? "Darwin"
|
||||
: process.platform === "linux"
|
||||
? "Linux"
|
||||
: process.platform;
|
||||
const localArch =
|
||||
process.arch === "x64"
|
||||
? "x86_64"
|
||||
: process.arch === "arm64"
|
||||
? "aarch64"
|
||||
: process.arch;
|
||||
const archMatches =
|
||||
remoteArch === localArch ||
|
||||
(localArch === "aarch64" && remoteArch === "arm64");
|
||||
if (
|
||||
platform.exitCode !== 0 ||
|
||||
platform.timedOut ||
|
||||
remoteOs !== localOs ||
|
||||
!archMatches
|
||||
) {
|
||||
throw new Error(
|
||||
"runner_remote_artifact_platform_mismatch: configure PAPERCLIP_RUNNER_REMOTE_BINARY_PATH for the remote OS and architecture",
|
||||
);
|
||||
}
|
||||
}
|
||||
await stageRemoteRunnerFile({
|
||||
target: remoteTarget,
|
||||
runner: remoteCommandRunner,
|
||||
sourcePath: sourceBinary,
|
||||
targetPath: remoteBinary,
|
||||
mode: 0o700,
|
||||
});
|
||||
}
|
||||
await measureNativeRunnerSpan(input.trace, "runner.artifact.verify", () =>
|
||||
verifyRemoteRunner(requiredMode),
|
||||
);
|
||||
if (remoteCodexBinary && explicitRemoteCodex) {
|
||||
if (!existsSync(explicitRemoteCodex)) {
|
||||
throw new Error("runner_remote_codex_artifact_unavailable");
|
||||
}
|
||||
await stageRemoteRunnerFile({
|
||||
target: remoteTarget,
|
||||
runner: remoteCommandRunner,
|
||||
sourcePath: explicitRemoteCodex,
|
||||
targetPath: remoteCodexBinary,
|
||||
mode: 0o700,
|
||||
});
|
||||
await verifyRemoteCodex();
|
||||
}
|
||||
if (remoteCodexBinary && remoteCodexNpmSpec) {
|
||||
let usedPreinstalledCodex = false;
|
||||
const preinstalledCodex = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.discover",
|
||||
() => discoverPreinstalledExecutable("codex"),
|
||||
);
|
||||
if (preinstalledCodex) {
|
||||
try {
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify_preinstalled",
|
||||
() => verifyRemoteCodex(preinstalledCodex),
|
||||
);
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.link",
|
||||
() =>
|
||||
linkPreinstalledExecutable(preinstalledCodex, remoteCodexBinary),
|
||||
);
|
||||
usedPreinstalledCodex = true;
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
"[paperclip-runner] using preinstalled Codex from the sandbox image\n",
|
||||
);
|
||||
} catch {
|
||||
usedPreinstalledCodex = false;
|
||||
}
|
||||
}
|
||||
if (!usedPreinstalledCodex) {
|
||||
const installRoot = posix.join(
|
||||
remoteRuntimeRoot!,
|
||||
"harnesses",
|
||||
"codex",
|
||||
);
|
||||
const installResult = await remoteCommandRunner.execute({
|
||||
command: "npm",
|
||||
args: [
|
||||
"install",
|
||||
"--prefix",
|
||||
installRoot,
|
||||
"--no-audit",
|
||||
"--no-fund",
|
||||
remoteCodexNpmSpec,
|
||||
],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 180_000,
|
||||
});
|
||||
if (installResult.exitCode !== 0 || installResult.timedOut) {
|
||||
throw new Error("runner_remote_codex_install_failed");
|
||||
}
|
||||
}
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify",
|
||||
() => verifyRemoteCodex(),
|
||||
);
|
||||
}
|
||||
if (remoteCodexBinary && !explicitRemoteCodex && !remoteCodexNpmSpec) {
|
||||
const preinstalledCodex = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.discover",
|
||||
() => discoverPreinstalledExecutable("codex"),
|
||||
);
|
||||
if (!preinstalledCodex) {
|
||||
throw new Error(
|
||||
"runner_remote_codex_artifact_unavailable: install codex in the sandbox image or configure PAPERCLIP_RUNNER_REMOTE_CODEX_NPM_SPEC",
|
||||
);
|
||||
}
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify_preinstalled",
|
||||
() => verifyRemoteCodex(preinstalledCodex),
|
||||
);
|
||||
await measureNativeRunnerSpan(input.trace, "harness.artifact.link", () =>
|
||||
linkPreinstalledExecutable(preinstalledCodex, remoteCodexBinary),
|
||||
);
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify",
|
||||
() => verifyRemoteCodex(),
|
||||
);
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
"[paperclip-runner] using preinstalled Codex from the sandbox image\n",
|
||||
);
|
||||
}
|
||||
await remoteNativeArtifacts?.prepare(requiredMode);
|
||||
if (
|
||||
requiresRemoteProviderPack &&
|
||||
expectedProviderPackManifest &&
|
||||
@@ -13559,3 +13232,350 @@ async function createRunnerdBackendWithinSessionClaim(
|
||||
},
|
||||
} satisfies NativeSessionBackend & { bindManagedSession(session: NativeSession): NativeSession };
|
||||
}
|
||||
|
||||
/** Shared task/setup preparation; setup exercises the same remote artifact contract. */
|
||||
export function createRemoteNativeArtifactPreparation(input: {
|
||||
target: Extract<AdapterExecutionTarget, { kind: "remote" }>;
|
||||
runner: CommandManagedRuntimeRunner;
|
||||
remoteBinary: string;
|
||||
controllerRunnerBinary: string;
|
||||
remoteRuntimeRoot: string;
|
||||
remoteCodexBinary?: string | null;
|
||||
runnerRemoteBinaryPath?: string | null;
|
||||
runnerRemoteCodexPath?: string | null;
|
||||
runnerRemoteCodexNpmSpec?: string | null;
|
||||
model?: string | null;
|
||||
reuseRetainedRunner?: boolean;
|
||||
/** Existing operator-imported Pi companion already verifies its target-platform artifact. */
|
||||
targetPlatformArtifactVerified?: boolean;
|
||||
trace?: NativeRunTrace;
|
||||
onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
|
||||
}) {
|
||||
const remoteTarget = input.target;
|
||||
const remoteCommandRunner = input.runner;
|
||||
const { remoteBinary, controllerRunnerBinary, remoteRuntimeRoot } = input;
|
||||
const remoteCodexBinary = input.remoteCodexBinary ?? null;
|
||||
const explicitRemoteCodex = input.runnerRemoteCodexPath?.trim() || null;
|
||||
const remoteCodexNpmSpec = input.runnerRemoteCodexNpmSpec?.trim() || null;
|
||||
if (explicitRemoteCodex && remoteCodexNpmSpec) throw new Error("runner_remote_codex_source_conflict");
|
||||
const verifyRemoteRunner = async (
|
||||
requiredMode: "dial_wss" | "listen_ws",
|
||||
executable = remoteBinary,
|
||||
) => {
|
||||
if (!remoteTarget || !remoteCommandRunner || !executable) return;
|
||||
const metadataResult = await remoteCommandRunner.execute({
|
||||
command: executable,
|
||||
args: ["--build-metadata"],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 30_000,
|
||||
});
|
||||
if (metadataResult.exitCode !== 0 || metadataResult.timedOut) {
|
||||
throw new Error("runner_remote_artifact_verification_failed");
|
||||
}
|
||||
let metadata: Record<string, unknown>;
|
||||
try {
|
||||
metadata = JSON.parse(metadataResult.stdout) as Record<string, unknown>;
|
||||
} catch (error) {
|
||||
throw new Error("runner_remote_artifact_metadata_invalid", {
|
||||
cause: error,
|
||||
});
|
||||
}
|
||||
assertRemoteRunnerBuildMetadata(metadata, requiredMode);
|
||||
};
|
||||
|
||||
const reportedCodexVersions = new Set<string | null>();
|
||||
const verifyRemoteCodex = async (executable = remoteCodexBinary) => {
|
||||
if (!remoteTarget || !remoteCommandRunner || !executable) return;
|
||||
const versionResult = await remoteCommandRunner.execute({
|
||||
command: executable,
|
||||
args: ["--version"],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 30_000,
|
||||
});
|
||||
if (versionResult.exitCode !== 0 || versionResult.timedOut) {
|
||||
throw new Error("runner_remote_codex_artifact_verification_failed");
|
||||
}
|
||||
const versionOutput = `${versionResult.stdout}\n${versionResult.stderr}`;
|
||||
const version = parseCodexCliVersion(versionOutput);
|
||||
// The install pin describes our tested image, not a CLI admission rule.
|
||||
// Ordinary installations reach the real app-server/model probe; a version
|
||||
// difference alone must neither fail setup nor replace a working CLI.
|
||||
if (version !== REMOTE_PROVIDER_PACK_PINS.codex && !reportedCodexVersions.has(version)) {
|
||||
reportedCodexVersions.add(version);
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
`[paperclip-runner] using installed Codex ${version ?? "unrecognized version"} (image install pin ${REMOTE_PROVIDER_PACK_PINS.codex}); compatibility is checked by the native app-server\n`,
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
// Image policy: keep one latest stable CLI installation shared by native and
|
||||
// local adapters. Preferred bin entries must point to that same installation;
|
||||
// never bake an older global CLI alongside a private runner-only version.
|
||||
const discoverPreinstalledExecutable = async (
|
||||
name: "paperclip-runnerd" | "codex",
|
||||
) => {
|
||||
if (!remoteTarget || !remoteCommandRunner) return null;
|
||||
return discoverRemoteExecutable(remoteCommandRunner, remoteTarget.remoteCwd, name);
|
||||
};
|
||||
|
||||
const linkPreinstalledExecutable = async (
|
||||
sourcePath: string,
|
||||
targetPath: string,
|
||||
) => {
|
||||
if (!remoteTarget || !remoteCommandRunner) return;
|
||||
const escapedSource = sourcePath.replaceAll("'", "'\\''");
|
||||
const escapedTarget = targetPath.replaceAll("'", "'\\''");
|
||||
const escapedDirectory = posix.dirname(targetPath).replaceAll("'", "'\\''");
|
||||
const result = await remoteCommandRunner.execute({
|
||||
command: "sh",
|
||||
args: [
|
||||
"-c",
|
||||
targetPath === remoteCodexBinary
|
||||
? buildRemoteCodexLauncherCommand(sourcePath, targetPath)
|
||||
: `umask 077; mkdir -p '${escapedDirectory}' && ` +
|
||||
`ln -sfn '${escapedSource}' '${escapedTarget}'`,
|
||||
],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 10_000,
|
||||
});
|
||||
if (result.exitCode !== 0 || result.timedOut) {
|
||||
throw new Error("runner_remote_preinstalled_link_failed");
|
||||
}
|
||||
};
|
||||
|
||||
const prepare = async (requiredMode: "dial_wss" | "listen_ws") => {
|
||||
// Compatibility metadata does not prove artifact identity. Reuse only the
|
||||
// exact controller-owned bytes when the controller artifact is available.
|
||||
const matchesControllerRunnerArtifact = async (executable: string): Promise<boolean> => {
|
||||
const expected = createHash("sha256")
|
||||
.update(readFileSync(controllerRunnerBinary))
|
||||
.digest("hex");
|
||||
try {
|
||||
const probe = await remoteCommandRunner.execute({
|
||||
command: "sh",
|
||||
args: [
|
||||
"-c",
|
||||
'test -x "$1" || exit 1; if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1"; else shasum -a 256 "$1"; fi',
|
||||
"paperclip-runner-artifact",
|
||||
executable,
|
||||
],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 10_000,
|
||||
});
|
||||
return probe.exitCode === 0 && !probe.timedOut &&
|
||||
/^[a-f0-9]{64}\s/.test(probe.stdout) &&
|
||||
probe.stdout.trim().split(/\s+/)[0] === expected;
|
||||
} catch {
|
||||
// An unavailable checksum uses the verified staging path.
|
||||
return false;
|
||||
}
|
||||
};
|
||||
let runnerArtifactPrepared = false;
|
||||
if (
|
||||
input.reuseRetainedRunner === true &&
|
||||
existsSync(controllerRunnerBinary)
|
||||
) {
|
||||
runnerArtifactPrepared = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.verify_retained",
|
||||
() => matchesControllerRunnerArtifact(remoteBinary),
|
||||
);
|
||||
}
|
||||
const explicitRemoteBinary = input.runnerRemoteBinaryPath?.trim() || null;
|
||||
if (!runnerArtifactPrepared && mayUsePreinstalledRunnerArtifact(explicitRemoteBinary)) {
|
||||
const preinstalledRunner = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.discover",
|
||||
() => discoverPreinstalledExecutable("paperclip-runnerd"),
|
||||
);
|
||||
if (preinstalledRunner) {
|
||||
try {
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.verify_preinstalled",
|
||||
() => verifyRemoteRunner(requiredMode, preinstalledRunner),
|
||||
);
|
||||
if (existsSync(controllerRunnerBinary) &&
|
||||
!await matchesControllerRunnerArtifact(preinstalledRunner)) {
|
||||
throw new Error("runner_remote_preinstalled_artifact_mismatch");
|
||||
}
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"runner.artifact.link",
|
||||
() => linkPreinstalledExecutable(preinstalledRunner, remoteBinary),
|
||||
);
|
||||
runnerArtifactPrepared = true;
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
"[paperclip-runner] using preinstalled runnerd from the sandbox image\n",
|
||||
);
|
||||
} catch {
|
||||
runnerArtifactPrepared = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (!runnerArtifactPrepared) {
|
||||
// Upload the same artifact used for the controller identity. The server
|
||||
// vendors the runner under vendor/paperclip-runner/bin, so the package
|
||||
// development fallback cannot locate it in a deployed server.
|
||||
const sourceBinary = controllerRunnerBinary;
|
||||
if (!existsSync(sourceBinary)) {
|
||||
throw new Error("runner_remote_artifact_unavailable");
|
||||
}
|
||||
if (!explicitRemoteBinary && !input.targetPlatformArtifactVerified) {
|
||||
const platform = await remoteCommandRunner.execute({
|
||||
command: "sh",
|
||||
args: ["-c", "uname -s; uname -m"],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 10_000,
|
||||
});
|
||||
const [remoteOs = "", remoteArch = ""] = platform.stdout
|
||||
.trim()
|
||||
.split(/\r?\n/);
|
||||
const localOs =
|
||||
process.platform === "darwin"
|
||||
? "Darwin"
|
||||
: process.platform === "linux"
|
||||
? "Linux"
|
||||
: process.platform;
|
||||
const localArch =
|
||||
process.arch === "x64"
|
||||
? "x86_64"
|
||||
: process.arch === "arm64"
|
||||
? "aarch64"
|
||||
: process.arch;
|
||||
const archMatches =
|
||||
remoteArch === localArch ||
|
||||
(localArch === "aarch64" && remoteArch === "arm64");
|
||||
if (
|
||||
platform.exitCode !== 0 ||
|
||||
platform.timedOut ||
|
||||
remoteOs !== localOs ||
|
||||
!archMatches
|
||||
) {
|
||||
throw new Error(
|
||||
"runner_remote_artifact_platform_mismatch: configure PAPERCLIP_RUNNER_REMOTE_BINARY_PATH for the remote OS and architecture",
|
||||
);
|
||||
}
|
||||
}
|
||||
await stageRemoteRunnerFile({
|
||||
target: remoteTarget,
|
||||
runner: remoteCommandRunner,
|
||||
sourcePath: sourceBinary,
|
||||
targetPath: remoteBinary,
|
||||
mode: 0o700,
|
||||
});
|
||||
}
|
||||
await measureNativeRunnerSpan(input.trace, "runner.artifact.verify", () =>
|
||||
verifyRemoteRunner(requiredMode),
|
||||
);
|
||||
if (remoteCodexBinary && explicitRemoteCodex) {
|
||||
if (!existsSync(explicitRemoteCodex)) {
|
||||
throw new Error("runner_remote_codex_artifact_unavailable");
|
||||
}
|
||||
await stageRemoteRunnerFile({
|
||||
target: remoteTarget,
|
||||
runner: remoteCommandRunner,
|
||||
sourcePath: explicitRemoteCodex,
|
||||
targetPath: remoteCodexBinary,
|
||||
mode: 0o700,
|
||||
});
|
||||
await verifyRemoteCodex();
|
||||
}
|
||||
if (remoteCodexBinary && remoteCodexNpmSpec) {
|
||||
let usedPreinstalledCodex = false;
|
||||
const preinstalledCodex = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.discover",
|
||||
() => discoverPreinstalledExecutable("codex"),
|
||||
);
|
||||
if (preinstalledCodex) {
|
||||
try {
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify_preinstalled",
|
||||
() => verifyRemoteCodex(preinstalledCodex),
|
||||
);
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.link",
|
||||
() =>
|
||||
linkPreinstalledExecutable(preinstalledCodex, remoteCodexBinary),
|
||||
);
|
||||
usedPreinstalledCodex = true;
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
"[paperclip-runner] using preinstalled Codex from the sandbox image\n",
|
||||
);
|
||||
} catch {
|
||||
usedPreinstalledCodex = false;
|
||||
}
|
||||
}
|
||||
if (!usedPreinstalledCodex) {
|
||||
const installRoot = posix.join(
|
||||
remoteRuntimeRoot!,
|
||||
"harnesses",
|
||||
"codex",
|
||||
);
|
||||
const installResult = await remoteCommandRunner.execute({
|
||||
command: "npm",
|
||||
args: [
|
||||
"install",
|
||||
"--prefix",
|
||||
installRoot,
|
||||
"--no-audit",
|
||||
"--no-fund",
|
||||
remoteCodexNpmSpec,
|
||||
],
|
||||
cwd: remoteTarget.remoteCwd,
|
||||
bypassSession: true,
|
||||
timeoutMs: 180_000,
|
||||
});
|
||||
if (installResult.exitCode !== 0 || installResult.timedOut) {
|
||||
throw new Error("runner_remote_codex_install_failed");
|
||||
}
|
||||
}
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify",
|
||||
() => verifyRemoteCodex(),
|
||||
);
|
||||
}
|
||||
if (remoteCodexBinary && !explicitRemoteCodex && !remoteCodexNpmSpec) {
|
||||
const preinstalledCodex = await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.discover",
|
||||
() => discoverPreinstalledExecutable("codex"),
|
||||
);
|
||||
if (!preinstalledCodex) {
|
||||
throw new Error(
|
||||
"runner_remote_codex_artifact_unavailable: install codex in the sandbox image or configure PAPERCLIP_RUNNER_REMOTE_CODEX_NPM_SPEC",
|
||||
);
|
||||
}
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify_preinstalled",
|
||||
() => verifyRemoteCodex(preinstalledCodex),
|
||||
);
|
||||
await measureNativeRunnerSpan(input.trace, "harness.artifact.link", () =>
|
||||
linkPreinstalledExecutable(preinstalledCodex, remoteCodexBinary),
|
||||
);
|
||||
await measureNativeRunnerSpan(
|
||||
input.trace,
|
||||
"harness.artifact.verify",
|
||||
() => verifyRemoteCodex(),
|
||||
);
|
||||
await input.onLog?.(
|
||||
"stderr",
|
||||
"[paperclip-runner] using preinstalled Codex from the sandbox image\n",
|
||||
);
|
||||
}
|
||||
};
|
||||
return { prepare, verifyRemoteRunner, verifyRemoteCodex };
|
||||
}
|
||||
@@ -43,10 +43,18 @@ describe("resolveNativeRuntimeMode", () => {
|
||||
}
|
||||
});
|
||||
|
||||
it("rejects a fresh Paperclip Runner start while the rollout flag is disabled", () => {
|
||||
it("admits fresh native Codex when the experimental rollout is disabled", () => {
|
||||
expect(resolveNativeRuntimeMode({
|
||||
...eligible,
|
||||
enabled: false,
|
||||
})).toMatchObject({ kind: "native", profile: { backend: "codex_app_server" } });
|
||||
});
|
||||
|
||||
it("still rejects experimental providers while the rollout flag is disabled", () => {
|
||||
expect(() => resolveNativeRuntimeMode({
|
||||
...eligible,
|
||||
enabled: false,
|
||||
adapterConfig: { provider: "opencode", model: "openrouter/deepseek/deepseek-v4-flash-0731" },
|
||||
})).toThrow(expect.objectContaining({
|
||||
code: "paperclip_runner_rollout_disabled",
|
||||
}));
|
||||
@@ -187,14 +195,17 @@ describe("resolveNativeRuntimeMode", () => {
|
||||
}));
|
||||
});
|
||||
|
||||
it("keeps a persisted active run native while the global flag rejects a fresh runner start", () => {
|
||||
const disabled = { ...eligible, enabled: false };
|
||||
it("keeps a persisted experimental run native while the flag rejects a fresh start", () => {
|
||||
const disabled = { ...eligible, enabled: false,
|
||||
adapterConfig: { provider: "opencode", model: "openrouter/deepseek/deepseek-v4-flash-0731" },
|
||||
};
|
||||
expect(resolveHeartbeatNativeRuntimeMode({
|
||||
...disabled,
|
||||
persisted: {
|
||||
runtimeMode: "native",
|
||||
runtimeModeReason: "eligible_opt_in",
|
||||
runtimeModeResolvedAt: new Date(),
|
||||
driverKind: "opencode_server",
|
||||
},
|
||||
})).toEqual(expect.objectContaining({
|
||||
kind: "native",
|
||||
@@ -458,6 +469,7 @@ describe("resolveHeartbeatRuntimeMode compatibility", () => {
|
||||
...compatibilityInput,
|
||||
enabled: false,
|
||||
adapterType: "paperclip_runner",
|
||||
adapterConfig: { provider: "opencode", model: "opencode/gpt-5" },
|
||||
})).toThrow(NativeRunnerSelectionError);
|
||||
});
|
||||
});
|
||||
@@ -126,10 +126,11 @@ export function resolveNativeRuntimeMode(input: {
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
// Dot has its own rollout; enabling it does not opt in other Runner providers.
|
||||
// Native Codex is a supported default. Other providers retain their rollout;
|
||||
// enabling Dot does not opt in any of those providers.
|
||||
if (runnerProfile.provider === "openai_dot") {
|
||||
if (input.dotEnabled !== true) throw ineligible("paperclip_runner_dot_disabled", "Enable OpenAI Dot and Assistant connections (MCP) in experimental settings before assigning new work.");
|
||||
} else if (!input.enabled) {
|
||||
} else if (runnerProfile.provider !== "codex" && !input.enabled) {
|
||||
throw ineligible(
|
||||
"paperclip_runner_rollout_disabled",
|
||||
"Paperclip Runner is experimental and disabled on this instance.",
|
||||
|
||||
@@ -0,0 +1,219 @@
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, posix } from "node:path";
|
||||
const { execute, nativeProbe, selectedRunner, sshExecute, sshRunner, nativeArtifacts, remoteLauncher, registerPrp, ingressConnect } = vi.hoisted(() => ({ execute: vi.fn(), nativeProbe: vi.fn(), selectedRunner: vi.fn(), sshExecute: vi.fn(), sshRunner: vi.fn(), nativeArtifacts: vi.fn(), remoteLauncher: vi.fn(), registerPrp: vi.fn(), ingressConnect: vi.fn() }));
|
||||
vi.mock("@paperclipai/adapter-utils/execution-target", () => ({ runAdapterExecutionTargetShellCommand: execute }));
|
||||
vi.mock("./native-ssh-command-runner.js", () => ({ createNativeSshCommandRunner: sshRunner }));
|
||||
vi.mock("../../realtime/runner-prp-ws.js", () => ({ registerRunnerPrpAuthority: registerPrp }));
|
||||
vi.mock("../../realtime/runner-prp-outbound.js", () => ({ connectRunnerPrpIngress: ingressConnect }));
|
||||
vi.mock("./native-codex-runner.js", () => ({ resolvePaperclipRunnerBinary: selectedRunner }));
|
||||
vi.mock("../../vendor/paperclip-runner/index.js", async original => ({ ...await original<typeof import("../../vendor/paperclip-runner/index.js")>(), probeNativeRunnerEnvironment: nativeProbe }));
|
||||
vi.mock("./native-session-executor.js", async original => ({ ...await original<typeof import("./native-session-executor.js")>(), createRemoteNativeArtifactPreparation: nativeArtifacts, createRemoteRunnerProcessLauncher: remoteLauncher }));
|
||||
import { testNativeRunnerAuthentication } from "./setup-readiness.js";
|
||||
const context = {
|
||||
companyId: "company", adapterType: "paperclip_runner", config: {},
|
||||
executionTarget: { kind: "remote" as const, transport: "sandbox" as const, providerKey: "test", remoteCwd: "/workspace", runner: { execute: vi.fn() } },
|
||||
};
|
||||
describe("Codex selected native account verification", () => {
|
||||
const receipt = (provider: "codex", model: string | null) => ({ provider, effectiveModel: model, providerDriver: "codex_app_server", helloProbePassed: true, cleanupConfirmed: true });
|
||||
beforeEach(() => {
|
||||
execute.mockReset(); nativeProbe.mockReset();
|
||||
sshExecute.mockReset().mockResolvedValue({ exitCode: 0, timedOut: false, stdout: "", stderr: "" });
|
||||
sshRunner.mockReset().mockReturnValue({ execute: sshExecute });
|
||||
nativeArtifacts.mockReset().mockReturnValue({ prepare: vi.fn().mockResolvedValue(undefined) });
|
||||
remoteLauncher.mockReset().mockReturnValue(vi.fn());
|
||||
registerPrp.mockReset().mockImplementation(async () => ({ release: vi.fn() }));
|
||||
vi.stubEnv("PAPERCLIP_RUNNER_PUBLIC_URL", "wss://paperclip.example.test");
|
||||
vi.stubEnv("PAPERCLIP_RUNNER_CA_BUNDLE_PATH", "");
|
||||
vi.stubEnv("PAPERCLIP_RUNNER_REMOTE_CODEX_PATH", "");
|
||||
vi.stubEnv("PAPERCLIP_RUNNER_REMOTE_CODEX_NPM_SPEC", "");
|
||||
selectedRunner.mockReset().mockReturnValue("/fixture/bin/paperclip-runnerd");
|
||||
vi.stubEnv("PAPERCLIP_RUNNER_REMOTE_PROVIDER_PACK_PATH", "");
|
||||
vi.stubEnv("PAPERCLIP_RUNNER_REMOTE_BINARY_PATH", "");
|
||||
});
|
||||
afterEach(async () => {
|
||||
vi.unstubAllEnvs();
|
||||
for (const [input] of nativeProbe.mock.calls) if (input.runtimeDirectory) await rm(input.runtimeDirectory, { recursive: true, force: true });
|
||||
});
|
||||
it.each([["codex", "gpt-6.1-sol", "OPENAI_API_KEY"]] as const)("requires the native %s host and only the selected credential", async (provider, model, key) => {
|
||||
vi.stubEnv(key, "ambient-account");
|
||||
vi.stubEnv("ANTHROPIC_API_KEY", "ambient-anthropic");
|
||||
nativeProbe.mockImplementation(async input => { await input.onCleanupConfirmed(); return receipt(provider, model); });
|
||||
const result = await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config: { env: { [key]: "bound-account" }, modelReasoningEffort: "low" } }, provider, model);
|
||||
expect(result.status).toBe("pass");
|
||||
const input = nativeProbe.mock.calls[0][0];
|
||||
expect(input).toMatchObject({ provider, model, timeoutMs: 45_000, environment: { [key]: "bound-account" } });
|
||||
expect(input.transportOptions.runnerBinary).toBe("/fixture/bin/paperclip-runnerd");
|
||||
expect(selectedRunner).toHaveBeenCalledOnce();
|
||||
expect(input.environment.ANTHROPIC_API_KEY).toBeUndefined();
|
||||
if (provider === "codex") expect(input.reasoningEffort).toBe("low");
|
||||
else expect(input.reasoningEffort).toBeUndefined();
|
||||
await expect(stat(input.runtimeDirectory)).rejects.toThrow();
|
||||
expect(execute).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each(["host-home", "host-codex-home", "configured-home", "managed-home"] as const)("reuses the task's authorized local Codex home before isolation (%s)", async mode => {
|
||||
vi.stubEnv("HOME", "/host-home");
|
||||
vi.stubEnv("CODEX_HOME", mode === "host-home" ? "" : "/host-codex");
|
||||
vi.stubEnv("OPENAI_API_KEY", "ambient-key-is-not-authorized");
|
||||
nativeProbe.mockResolvedValue(receipt("codex", "observed-model"));
|
||||
const config = mode === "configured-home" || mode === "managed-home" ? { env: { CODEX_HOME: "/configured-codex" } } : {};
|
||||
expect((await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config,
|
||||
...(mode === "managed-home" ? { managedAiCredentialHome: "/managed-codex" } : {}) }, "codex", null)).status).toBe("pass");
|
||||
const input = nativeProbe.mock.calls[0][0];
|
||||
expect(input.transportOptions.sourceCodexHome).toBe({ "host-home": "/host-home/.codex", "host-codex-home": "/host-codex", "configured-home": "/configured-codex", "managed-home": "/managed-codex" }[mode]);
|
||||
expect(input.environment.OPENAI_API_KEY).toBeUndefined();
|
||||
expect(input.environment.HOME).toBeUndefined();
|
||||
expect(input.runtimeDirectory).not.toContain("host-home");
|
||||
});
|
||||
const sshContext = { companyId: "company", adapterType: "paperclip_runner", config: {}, executionTarget: {
|
||||
kind: "remote" as const, transport: "ssh" as const, remoteCwd: "/qa-workspace", spec: { host: "qa-host", username: "qa-user", port: 22, remoteCwd: "/qa-workspace", remoteWorkspacePath: "/qa-workspace", privateKey: null, knownHosts: null, strictHostKeyChecking: true },
|
||||
} };
|
||||
it("uses task staging and the company-scoped native SSH transport without a provider pack", async () => {
|
||||
let released = false;
|
||||
registerPrp.mockResolvedValue({ release: async () => { released = true; } });
|
||||
nativeProbe.mockImplementation(async input => {
|
||||
const registration = await input.transportOptions.controlPlaneRegistration({ marker: "native-authority" });
|
||||
expect(registration.connection).toMatchObject({ mode: "connect", connectUrl: expect.stringMatching(/^wss:\/\/paperclip\.example\.test\/api\/runner\/v1\/connect\//) });
|
||||
await registration.release();
|
||||
await input.onCleanupConfirmed();
|
||||
return receipt("codex", "gpt-6.1-sol");
|
||||
});
|
||||
expect((await testNativeRunnerAuthentication({ ...sshContext, config: { env: { OPENAI_API_KEY: "company-account" }, modelReasoningEffort: "low" } }, "codex", "gpt-6.1-sol")).status).toBe("pass");
|
||||
const input = nativeProbe.mock.calls[0][0];
|
||||
expect(input).toMatchObject({ reasoningEffort: "low", environment: { OPENAI_API_KEY: "company-account" }, workingDirectory: expect.stringMatching(/^\/qa-workspace\/.paperclip-runtime\/paperclip-native-setup-.*\/filesystem\/workspace$/) });
|
||||
expect(input.transportOptions).toMatchObject({ runnerBinary: "/fixture/bin/paperclip-runnerd", codexCommand: expect.stringMatching(/\/bin\/codex$/), runnerFilesystemRoot: expect.stringMatching(/\/filesystem$/) });
|
||||
expect(nativeArtifacts).toHaveBeenCalledWith(expect.objectContaining({ controllerRunnerBinary: "/fixture/bin/paperclip-runnerd", model: "gpt-6.1-sol" }));
|
||||
expect(nativeArtifacts.mock.results[0]!.value.prepare).toHaveBeenCalledWith("dial_wss");
|
||||
expect(registerPrp).toHaveBeenCalledWith({ companyId: "company", runId: input.transportOptions.prpIdentity.runId, authority: { marker: "native-authority" } });
|
||||
expect(remoteLauncher).toHaveBeenCalledWith(expect.objectContaining({ runnerInstanceId: input.transportOptions.prpIdentity.runnerInstanceId }));
|
||||
expect(released).toBe(true);
|
||||
expect(sshExecute.mock.calls.at(-1)![0]).toMatchObject({ command: "rm", args: ["-rf", "--", expect.stringContaining("paperclip-native-setup-")] });
|
||||
expect(sshExecute.mock.calls.some(([value]) => JSON.stringify(value).includes("company-account"))).toBe(false);
|
||||
expect(execute).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each(["runtime missing", "authentication failed: selected-key", "no native completion", "model mismatch"])("fails SSH native setup without a legacy fallback (%s)", async message => {
|
||||
nativeProbe.mockRejectedValue(new Error(message));
|
||||
const result = await testNativeRunnerAuthentication({ ...sshContext, config: { env: { OPENAI_API_KEY: "selected-key" } } }, "codex", "gpt-6.1-sol");
|
||||
expect(result.status).toBe("fail"); expect(JSON.stringify(result)).not.toContain("selected-key");
|
||||
expect(nativeProbe).toHaveBeenCalledOnce(); expect(execute).not.toHaveBeenCalled();
|
||||
expect(sshExecute.mock.calls.some(([value]) => value.command === "rm")).toBe(false);
|
||||
expect((await stat(nativeProbe.mock.calls[0][0].runtimeDirectory)).isDirectory()).toBe(true);
|
||||
});
|
||||
it("fails SSH transport eligibility before staging or opening the native provider", async () => {
|
||||
vi.stubEnv("PAPERCLIP_RUNNER_PUBLIC_URL", "");
|
||||
expect((await testNativeRunnerAuthentication(sshContext, "codex", null)).status).toBe("fail");
|
||||
expect(sshExecute).not.toHaveBeenCalled(); expect(nativeArtifacts).not.toHaveBeenCalled(); expect(nativeProbe).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each([true, false])("removes SSH probe state only after confirmed teardown (%s)", async confirmed => {
|
||||
nativeProbe.mockImplementation(async input => {
|
||||
const registration = await input.transportOptions.controlPlaneRegistration({});
|
||||
await registration.release();
|
||||
if (confirmed) await input.onCleanupConfirmed();
|
||||
throw new Error("authentication failed");
|
||||
});
|
||||
expect((await testNativeRunnerAuthentication(sshContext, "codex", null)).status).toBe("fail");
|
||||
expect(sshExecute.mock.calls.some(([value]) => value.command === "rm")).toBe(confirmed);
|
||||
const root = nativeProbe.mock.calls[0][0].runtimeDirectory;
|
||||
if (confirmed) await expect(stat(root)).rejects.toThrow(); else expect((await stat(root)).isDirectory()).toBe(true);
|
||||
});
|
||||
it.each(["same-account", "another-account", "read-failure", "uncertain-close"] as const)("preserves managed SSH account refresh and confirmed cleanup (%s)", async mode => {
|
||||
const home = await mkdtemp(join(tmpdir(), "native-ssh-managed-account-"));
|
||||
const auth = (account: string, marker: string, age: number) => JSON.stringify({ tokens: { account_id: account, id_token: `id-${marker}`, access_token: `access-${marker}`, refresh_token: `refresh-${marker}` }, last_refresh: new Date(Date.now() - age).toISOString() });
|
||||
try {
|
||||
await writeFile(join(home, "auth.json"), auth("qa-account", "old", 120_000), { mode: 0o600 });
|
||||
const refreshed = auth(mode === "another-account" ? "different-account" : "qa-account", "new", 60_000);
|
||||
sshExecute.mockImplementation(async input => ({ exitCode: input.args?.[2] === "paperclip-native-refresh" && mode === "read-failure" ? 1 : 0, timedOut: false,
|
||||
stdout: input.args?.[2] === "paperclip-native-refresh" ? Buffer.from(refreshed).toString("base64") : "", stderr: "" }));
|
||||
nativeProbe.mockImplementation(async input => {
|
||||
const registration = await input.transportOptions.controlPlaneRegistration({});
|
||||
await registration.release();
|
||||
const original = new Error("authentication failed in native SSH" + (mode === "uncertain-close" ? "; daemon teardown was not confirmed" : ""));
|
||||
try { await input.onCodexCredentialRefresh(posix.join(input.transportOptions.runnerFilesystemRoot, "codex-home", "auth.json")); }
|
||||
catch (error) { throw new AggregateError([original, error], original.message + "; " + (error as Error).message, { cause: original }); }
|
||||
if (mode !== "uncertain-close") await input.onCleanupConfirmed();
|
||||
throw original;
|
||||
});
|
||||
const result = await testNativeRunnerAuthentication({ ...sshContext, managedAiCredentialHome: home }, "codex", "gpt-6.1-sol");
|
||||
expect(result.status).toBe("fail"); expect(result.checks[0].message).toContain("authentication failed in native SSH");
|
||||
expect(JSON.parse(await readFile(join(home, "auth.json"), "utf8")).tokens.access_token).toBe(mode === "same-account" || mode === "uncertain-close" ? "access-new" : "access-old");
|
||||
expect(sshExecute.mock.calls.some(([input]) => input.command === "rm")).toBe(mode === "same-account" || mode === "another-account");
|
||||
expect(JSON.stringify(result)).not.toContain("access-new");
|
||||
const read = sshExecute.mock.calls.find(([input]) => input.args?.[2] === "paperclip-native-refresh")![0];
|
||||
expect(read.command).toBe("sh"); expect(read.args[1]).toContain("head -c 65537"); expect(read.args[1]).toContain("test ! -L");
|
||||
expect(nativeProbe.mock.calls[0][0].transportOptions.sourceCodexHome).toBe(home);
|
||||
if (mode === "read-failure") expect(result.checks[0].message).toContain("refresh handoff unavailable");
|
||||
if (mode === "uncertain-close") expect(result.checks[0].message).toContain("teardown was not confirmed");
|
||||
} finally { await rm(home, { recursive: true, force: true }); }
|
||||
});
|
||||
it.each([
|
||||
["authentication failed: bound-account", "auth_required"], ["Native provider hello probe timed out.", "timeout"],
|
||||
["Model is unavailable", "failed"], ["native executable is missing", "failed"], ["native provider returned no response", "failed"],
|
||||
])("fails closed and redacts native failures (%s)", async (message, code) => {
|
||||
nativeProbe.mockRejectedValue(new Error(message));
|
||||
const result = await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config: { env: { OPENAI_API_KEY: "bound-account" } } }, "codex", "gpt-6.1-sol");
|
||||
expect(result).toMatchObject({ status: "fail", checks: [{ code: `codex_hello_probe_${code}`, level: "error" }] });
|
||||
expect(JSON.stringify(result)).not.toContain("bound-account");
|
||||
expect(nativeProbe).toHaveBeenCalledOnce();
|
||||
expect(execute).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each([
|
||||
{ helloProbePassed: undefined }, { effectiveModel: "another-model" }, { effectiveModel: null }, { effectiveModel: "" }, { provider: "opencode" }, { providerDriver: "codex_cli" },
|
||||
])("rejects installation-only, legacy, or mismatched receipts", async override => {
|
||||
nativeProbe.mockResolvedValue({ ...receipt("codex", "gpt-6.1-sol"), ...override });
|
||||
expect((await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config: {} }, "codex", "gpt-6.1-sol")).status).toBe("fail");
|
||||
});
|
||||
it("accepts an automatic Codex model only when the native provider observed a nonempty model", async () => {
|
||||
nativeProbe.mockResolvedValue(receipt("codex", "gpt-6.1-sol"));
|
||||
expect((await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config: {} }, "codex", null)).status).toBe("pass");
|
||||
expect(nativeProbe.mock.calls[0][0].model).toBeNull();
|
||||
nativeProbe.mockResolvedValue(receipt("codex", null));
|
||||
expect((await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config: {} }, "codex", null)).status).toBe("fail");
|
||||
nativeProbe.mockResolvedValue(receipt("codex", "unknown"));
|
||||
expect((await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config: {} }, "codex", null)).status).toBe("fail");
|
||||
});
|
||||
it.each([true, false])("removes failed local probe state only after confirmed teardown (%s)", async confirmed => {
|
||||
nativeProbe.mockImplementation(async input => {
|
||||
if (confirmed) await input.onCleanupConfirmed();
|
||||
throw new Error("authentication failed");
|
||||
});
|
||||
expect((await testNativeRunnerAuthentication({ companyId: "company", adapterType: "paperclip_runner", config: {} }, "codex", null)).status).toBe("fail");
|
||||
const root = nativeProbe.mock.calls[0][0].runtimeDirectory;
|
||||
if (confirmed) await expect(stat(root)).rejects.toThrow();
|
||||
else expect((await stat(root)).isDirectory()).toBe(true);
|
||||
});
|
||||
it("uses the same preparation and controller PRP for a sandbox, without a guest provider pack", async () => {
|
||||
nativeProbe.mockImplementation(async input => {
|
||||
const registration = await input.transportOptions.controlPlaneRegistration({});
|
||||
expect(registration.connection.mode).toBe("connect");
|
||||
await registration.release(); await input.onCleanupConfirmed();
|
||||
return receipt("codex", "gpt-6.1-sol");
|
||||
});
|
||||
const target = { ...context.executionTarget, runner: { execute: sshExecute } };
|
||||
expect((await testNativeRunnerAuthentication({ ...context, executionTarget: target }, "codex", "gpt-6.1-sol")).status).toBe("pass");
|
||||
expect(sshRunner).not.toHaveBeenCalled();
|
||||
expect(nativeArtifacts).toHaveBeenCalledWith(expect.objectContaining({ target, runner: target.runner }));
|
||||
expect(nativeArtifacts.mock.results[0].value.prepare).toHaveBeenCalledWith("dial_wss");
|
||||
expect(execute).not.toHaveBeenCalled();
|
||||
});
|
||||
it("prepares listener artifacts before acquiring sandbox ingress and owns its release", async () => {
|
||||
const order: string[] = [];
|
||||
const close = vi.fn();
|
||||
const endpoint = { kind: "authenticated_websocket" as const, websocketUrl: "wss://ingress.test", secretHeaders: [], generation: "generation", refresh: vi.fn(), close };
|
||||
const getRunnerIngressEndpoint = vi.fn(async () => { order.push("ingress"); return endpoint; });
|
||||
nativeArtifacts.mockReturnValue({ prepare: vi.fn(async mode => { expect(mode).toBe("listen_ws"); order.push("artifacts"); }) });
|
||||
const connectionClose = vi.fn();
|
||||
ingressConnect.mockImplementation(() => { order.push("connect"); return { ready: Promise.resolve(), close: connectionClose }; });
|
||||
nativeProbe.mockImplementation(async input => {
|
||||
const registration = await input.transportOptions.controlPlaneRegistration({});
|
||||
expect(registration.connection.mode).toBe("listen");
|
||||
remoteLauncher.mock.calls[0][0].onRunnerProcessSpawned();
|
||||
await registration.activate(); await registration.ready(); await registration.release();
|
||||
await input.onCleanupConfirmed(); return receipt("codex", "gpt-6.1-sol");
|
||||
});
|
||||
const target = { ...context.executionTarget, providerKey: "daytona", runner: { execute: sshExecute }, leaseId: "lease", effectiveCapabilities: { reusableLeases: false, nativeSyncIn: false, nativeSyncOut: false, persistentProcessSessions: false, independentControlCommands: true, incrementalSessionOutput: false, concurrentSyncOperations: false, duplexCommandStream: false, runnerWebSocketIngress: true }, getRunnerIngressEndpoint };
|
||||
expect((await testNativeRunnerAuthentication({ ...context, executionTarget: target }, "codex", "gpt-6.1-sol")).status).toBe("pass");
|
||||
expect(order).toEqual(["artifacts", "ingress", "connect"]);
|
||||
expect(connectionClose).toHaveBeenCalledOnce(); expect(registerPrp).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,198 @@
|
||||
import { mkdtemp, rm, stat } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, posix } from "node:path";
|
||||
import { copyBackCodexAuth } from "@paperclipai/adapter-codex-local/server";
|
||||
import type { AdapterEnvironmentTestContext, AdapterEnvironmentTestResult } from "@paperclipai/adapter-utils";
|
||||
import { probeNativeRunnerEnvironment, resolveSourceCodexHome } from "../../vendor/paperclip-runner/index.js";
|
||||
import { resolvePaperclipRunnerBinary } from "./native-codex-runner.js";
|
||||
import { readLocalAiCredentialFile } from "../local-ai-credential-file.js";
|
||||
import { createNativeSshCommandRunner } from "./native-ssh-command-runner.js";
|
||||
import { resolvePaperclipRunnerTransport } from "@paperclipai/adapter-utils/runner-connectivity";
|
||||
import { registerRunnerPrpAuthority } from "../../realtime/runner-prp-ws.js";
|
||||
import { connectRunnerPrpIngress } from "../../realtime/runner-prp-outbound.js";
|
||||
|
||||
|
||||
const PROBE_TRANSPORT_ENV_KEYS = ["PATH", "LANG", "LANGUAGE", "TZ", "TMPDIR", "TEMP", "TMP", "SSL_CERT_FILE", "SSL_CERT_DIR", "NODE_EXTRA_CA_CERTS", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "no_proxy", "all_proxy"];
|
||||
|
||||
function redactNativeProbeMessage(message: string, environment: Record<string, string>): string {
|
||||
const redact = (value: unknown): void => {
|
||||
if (typeof value === "string" && value) message = message.replaceAll(value, "[REDACTED]");
|
||||
else if (value && typeof value === "object") for (const item of Object.values(value)) redact(item);
|
||||
};
|
||||
for (const [name, value] of Object.entries(environment)) {
|
||||
if (!/key|token|secret|password/i.test(name) || !value) continue;
|
||||
redact(value);
|
||||
try { redact(JSON.parse(value)); } catch { /* Most credentials are plain strings. */ }
|
||||
}
|
||||
return message.slice(0, 2000);
|
||||
}
|
||||
|
||||
/** Remote setup shares task artifacts, PRP, isolated launch home, and process ownership. */
|
||||
async function probeRemoteNativeCodex(options: {
|
||||
context: AdapterEnvironmentTestContext;
|
||||
model: string | null;
|
||||
reasoningEffort?: string;
|
||||
environment: Record<string, string>;
|
||||
sourceCodexHome: string;
|
||||
timeoutMs: number;
|
||||
}) {
|
||||
const target = options.context.executionTarget;
|
||||
if (target?.kind !== "remote") throw new Error("Native setup requires the selected remote execution target.");
|
||||
const { createRemoteNativeArtifactPreparation, createRemoteRunnerProcessLauncher, stageRemoteRunnerFile, readRemoteRunnerState } = await import("./native-session-executor.js");
|
||||
const runner = target.transport === "ssh" ? createNativeSshCommandRunner({ spec: target.spec, defaultCwd: target.remoteCwd }) : target.runner;
|
||||
if (!runner) throw new Error("runner_transport_ineligible: remote process runner is unavailable");
|
||||
const id = crypto.randomUUID();
|
||||
const runnerInstanceId = `setup-${id}`;
|
||||
// Eligibility is checked before writing to the selected host, using the
|
||||
// same server-owned public URL and CA configuration as ordinary tasks.
|
||||
const ingress = target.transport === "sandbox" && target.effectiveCapabilities?.runnerWebSocketIngress === true;
|
||||
// Outbound eligibility is read-only; acquire provider ingress only after the
|
||||
// exact daemon has been prepared and its listener capability verified.
|
||||
const outbound = !ingress ? await resolvePaperclipRunnerTransport({ target, runId: id, localConnectUrl: "ws://127.0.0.1/unused",
|
||||
runnerPublicUrl: process.env.PAPERCLIP_RUNNER_PUBLIC_URL?.trim() || null,
|
||||
runnerCaBundlePath: process.env.PAPERCLIP_RUNNER_CA_BUNDLE_PATH?.trim() || null, runnerIngressAuthorized: true }) : null;
|
||||
if (outbound && outbound.mode !== "direct_outbound") throw new Error("runner_transport_ineligible: expected outbound native transport");
|
||||
if (outbound?.mode === "direct_outbound" && outbound.caBundlePath) await stat(outbound.caBundlePath).catch(() => { throw new Error("runner_direct_wss_failed: configured runner CA bundle is unavailable"); });
|
||||
const remoteRoot = posix.join(target.remoteCwd, ".paperclip-runtime", `paperclip-native-setup-${id}`);
|
||||
const remoteBinary = posix.join(remoteRoot, "bin", "paperclip-runnerd");
|
||||
const remoteStateDirectory = posix.join(remoteRoot, "runner");
|
||||
const remoteFilesystemRoot = posix.join(remoteRoot, "filesystem");
|
||||
const remoteWorkspace = posix.join(remoteFilesystemRoot, "workspace");
|
||||
const remoteCodexNpmSpec = process.env.PAPERCLIP_RUNNER_REMOTE_CODEX_NPM_SPEC?.trim() || null;
|
||||
const remoteCodexBinary = remoteCodexNpmSpec ? posix.join(remoteRoot, "harnesses", "codex", "node_modules", ".bin", "codex") : posix.join(remoteRoot, "bin", "codex");
|
||||
const explicitRunner = process.env.PAPERCLIP_RUNNER_REMOTE_BINARY_PATH?.trim() || null;
|
||||
const controllerRunnerBinary = explicitRunner || resolvePaperclipRunnerBinary();
|
||||
const artifacts = createRemoteNativeArtifactPreparation({ target, runner, remoteBinary, controllerRunnerBinary, remoteRuntimeRoot: remoteRoot, remoteCodexBinary,
|
||||
runnerRemoteBinaryPath: explicitRunner, runnerRemoteCodexPath: process.env.PAPERCLIP_RUNNER_REMOTE_CODEX_PATH?.trim(), runnerRemoteCodexNpmSpec: remoteCodexNpmSpec, model: options.model });
|
||||
const requireSuccess = (result: { timedOut: boolean; exitCode: number | null }, message: string) => {
|
||||
if (result.timedOut || result.exitCode !== 0) throw new Error(message);
|
||||
};
|
||||
const runtimeDirectory = await mkdtemp(join(tmpdir(), "paperclip-native-setup-"));
|
||||
let remoteDirectoryCreated = false;
|
||||
let remoteCaBundlePath: string | undefined;
|
||||
let signalSpawned!: () => void;
|
||||
const spawned = new Promise<void>(resolve => { signalSpawned = resolve; });
|
||||
return probeNativeRunnerEnvironment({ runtimeDirectory: runtimeDirectory, provider: "codex", model: options.model, reasoningEffort: options.reasoningEffort,
|
||||
workingDirectory: remoteWorkspace, environment: options.environment, timeoutMs: options.timeoutMs,
|
||||
transportOptions: {
|
||||
runnerBinary: controllerRunnerBinary, codexCommand: remoteCodexBinary, sourceCodexHome: options.sourceCodexHome,
|
||||
runnerFilesystemRoot: remoteFilesystemRoot, runnerStateDirectory: remoteStateDirectory,
|
||||
prpIdentity: { runnerInstanceId, runId: id, environmentLeaseId: `setup-${id}`, normalizedSessionId: `setup-${id}`, turnId: `turn-${id}`, itemId: `item-${id}` },
|
||||
readRunnerState: () => readRemoteRunnerState({ runner, stateDirectory: remoteStateDirectory }),
|
||||
controlPlaneRegistration: async authority => {
|
||||
// Claim a private per-probe root. Never merge credentials or state into
|
||||
// another session's directory on the remote host.
|
||||
const created = await runner.execute({ command: "sh", args: ["-c", 'set -eu; umask 077; mkdir -p -- "$1"; test -d "$1" && test ! -L "$1"; mkdir -- "$2"; install -d -m 0700 "$3" "$4" "$5"',
|
||||
"paperclip-native-setup", posix.dirname(remoteRoot), remoteRoot, remoteFilesystemRoot, remoteWorkspace, posix.join(remoteFilesystemRoot, "probe-home")], cwd: target.remoteCwd, bypassSession: true, timeoutMs: 10_000 });
|
||||
requireSuccess(created, "Native setup could not claim a private runtime directory.");
|
||||
remoteDirectoryCreated = true;
|
||||
await artifacts.prepare(ingress ? "listen_ws" : "dial_wss");
|
||||
if (outbound?.mode === "direct_outbound" && outbound.caBundlePath) {
|
||||
remoteCaBundlePath = posix.join(remoteRoot, "bin", "runner-ca-bundle.pem");
|
||||
await stageRemoteRunnerFile({ target, runner, sourcePath: outbound.caBundlePath, targetPath: remoteCaBundlePath, mode: 0o600 });
|
||||
}
|
||||
if (outbound?.mode === "direct_outbound") {
|
||||
const registration = await registerRunnerPrpAuthority({ companyId: options.context.companyId, runId: id, authority });
|
||||
return { connection: { mode: "connect" as const, connectUrl: outbound.connectUrl, ...(remoteCaBundlePath ? { caBundlePath: remoteCaBundlePath } : {}) },
|
||||
startupFailureCode: "runner_direct_wss_failed" as const, release: registration.release };
|
||||
}
|
||||
const transport = await resolvePaperclipRunnerTransport({ target, runId: id, localConnectUrl: "ws://127.0.0.1/unused", runnerIngressAuthorized: true });
|
||||
if (transport.mode !== "provider_ingress") throw new Error("runner_transport_ineligible: expected provider ingress");
|
||||
let connection: ReturnType<typeof connectRunnerPrpIngress> | undefined;
|
||||
let activation: Promise<void> | undefined;
|
||||
return {
|
||||
connection: { mode: "listen" as const, listenAddress: transport.listenAddress, listenPort: transport.listenPort, listenPath: transport.listenPath },
|
||||
activate: () => {
|
||||
activation = spawned.then(() => { connection = connectRunnerPrpIngress({ authority, endpoint: transport.ingress }); });
|
||||
void activation.catch(() => undefined);
|
||||
},
|
||||
ready: async () => { await activation; if (!connection) throw new Error("runner_ingress_unavailable"); await connection.ready; },
|
||||
get failure() { return connection?.failure; },
|
||||
startupFailureCode: "runner_ingress_unavailable" as const,
|
||||
release: async () => { if (connection) await connection.close(); else await transport.ingress.close(); },
|
||||
};
|
||||
},
|
||||
runnerProcessLauncher: createRemoteRunnerProcessLauncher({ target, runner, remoteBinary, stateDirectory: remoteStateDirectory,
|
||||
onRunnerProcessSpawned: signalSpawned, processIdentityPath: posix.join(remoteStateDirectory, "runner-process.identity"), diagnosticsDirectory: posix.join(remoteRoot, "diagnostics"), runnerInstanceId,
|
||||
ensureArtifact: async () => {
|
||||
// The normal transport has already materialized the bound account and
|
||||
// its managed config locally. Publish only those two fresh files.
|
||||
for (const name of ["auth.json", "config.toml"] as const) {
|
||||
const sourcePath = join(runtimeDirectory, "codex-home", name);
|
||||
try { await stat(sourcePath); } catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") continue; throw error; }
|
||||
await stageRemoteRunnerFile({ target, runner, sourcePath, targetPath: posix.join(remoteFilesystemRoot, "codex-home", name), mode: 0o600 });
|
||||
}
|
||||
} }),
|
||||
},
|
||||
...(options.context.managedAiCredentialHome ? { onCodexCredentialRefresh: async (filename: string) => {
|
||||
if (filename !== posix.join(remoteFilesystemRoot, "codex-home", "auth.json")) throw new Error("The native Codex credential refresh handoff is invalid.");
|
||||
await copyBackCodexAuth({ hostAuthPath: join(options.context.managedAiCredentialHome!, "auth.json"), log: () => {}, readSandboxAuth: async () => {
|
||||
// Reuse the task's shell/base64 handoff without requiring a guest JS
|
||||
// runtime. Bound and validate the private owner-only credential file.
|
||||
const read = await runner.execute({ command: "sh", args: ["-c", 'set -eu; file=$1; test -f "$file" || exit 66; test ! -L "$file"; parent=$(dirname -- "$file"); while test "$parent" != /; do test -d "$parent" && test ! -L "$parent"; parent=$(dirname -- "$parent"); done; metadata=$(stat -c "%u %a %s" "$file" 2>/dev/null || stat -f "%u %Lp %z" "$file"); set -- $metadata; test "$1" = "$(id -u)" && test "$2" = 600 && test "$3" -le 65536; head -c 65537 -- "$file" | base64', "paperclip-native-refresh", filename], bypassSession: true, timeoutMs: 10_000 });
|
||||
if (read.timedOut || read.exitCode !== 0) throw Object.assign(new Error("Native Codex credential refresh handoff unavailable."), { code: read.exitCode === 66 ? "ENOENT" : "INVALID_CREDENTIAL" });
|
||||
const body = Buffer.from(read.stdout, "base64");
|
||||
if (body.length > 65_536) throw new Error("Native Codex credential refresh handoff exceeds the credential size limit.");
|
||||
return body;
|
||||
} });
|
||||
} } : {}),
|
||||
onCleanupConfirmed: async () => {
|
||||
if (remoteDirectoryCreated) {
|
||||
const cleaned = await runner.execute({ command: "rm", args: ["-rf", "--", remoteRoot], bypassSession: true, timeoutMs: 10_000 });
|
||||
requireSuccess(cleaned, "Native setup cleanup is incomplete; private recovery state was retained.");
|
||||
}
|
||||
await rm(runtimeDirectory, { recursive: true, force: true });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
/** Codex readiness uses the same daemon, bound credentials and cleanup as task execution. */
|
||||
export async function testNativeRunnerAuthentication(context: AdapterEnvironmentTestContext, provider: "codex", model: string | null): Promise<AdapterEnvironmentTestResult> {
|
||||
const remote = context.executionTarget?.kind === "remote";
|
||||
const configured = context.config.env;
|
||||
const environment: Record<string, string> = Object.fromEntries([
|
||||
...(remote ? [] : PROBE_TRANSPORT_ENV_KEYS.flatMap(key => typeof process.env[key] === "string" ? [[key, process.env[key]!]] : [])),
|
||||
...Object.entries(configured && typeof configured === "object" && !Array.isArray(configured) ? configured : {})
|
||||
.filter((entry): entry is [string, string] => typeof entry[1] === "string"),
|
||||
]);
|
||||
const authKey = "_PAPERCLIP_NATIVE_SETUP_CODEX_AUTH_JSON_SECRET";
|
||||
const configKey = "_PAPERCLIP_NATIVE_SETUP_CODEX_CONFIG_TOML_SECRET";
|
||||
delete environment[authKey];
|
||||
delete environment[configKey];
|
||||
let sourceCodexHome: string | null | undefined;
|
||||
const effort = context.config.modelReasoningEffort ?? context.config.reasoningEffort ?? context.config.effort;
|
||||
const timeoutMs = remote ? 90_000 : 45_000;
|
||||
let runtimeDirectory: string | undefined;
|
||||
try {
|
||||
// Match task execution's closed host projection before the probe replaces
|
||||
// HOME. API keys never enter this projection from the ambient process.
|
||||
if (provider === "codex") {
|
||||
const { buildNativeProviderEnvironment } = await import("./native-session-executor.js");
|
||||
sourceCodexHome = context.managedAiCredentialHome ?? resolveSourceCodexHome(buildNativeProviderEnvironment(environment));
|
||||
}
|
||||
let receipt: Awaited<ReturnType<typeof probeNativeRunnerEnvironment>>;
|
||||
if (context.executionTarget?.kind === "remote") {
|
||||
receipt = await probeRemoteNativeCodex({ context, model, environment, sourceCodexHome: sourceCodexHome ?? "", timeoutMs,
|
||||
...(typeof effort === "string" && effort ? { reasoningEffort: effort } : {}) });
|
||||
} else {
|
||||
runtimeDirectory = await mkdtemp(join(tmpdir(), "paperclip-native-setup-"));
|
||||
receipt = await probeNativeRunnerEnvironment({ runtimeDirectory, provider, model, environment, timeoutMs,
|
||||
...(provider === "codex" && typeof effort === "string" && effort ? { reasoningEffort: effort } : {}),
|
||||
onCleanupConfirmed: async () => { await rm(runtimeDirectory!, { recursive: true, force: true }); },
|
||||
transportOptions: { runnerBinary: resolvePaperclipRunnerBinary(), sourceCodexHome: sourceCodexHome ?? "" },
|
||||
...(context.managedAiCredentialHome && provider === "codex" ? { onCodexCredentialRefresh: async (filename: string) => {
|
||||
await copyBackCodexAuth({ hostAuthPath: join(context.managedAiCredentialHome!, "auth.json"), log: () => {}, readSandboxAuth: async () => Buffer.from(await readLocalAiCredentialFile(filename)) });
|
||||
} } : {}),
|
||||
});
|
||||
}
|
||||
if (receipt.helloProbePassed !== true || receipt.provider !== provider || typeof receipt.effectiveModel !== "string" || !receipt.effectiveModel.trim() || receipt.effectiveModel === "unknown" || (model !== null && receipt.effectiveModel !== model)
|
||||
|| receipt.providerDriver !== "codex_app_server") throw new Error("The selected native runtime returned an incompatible account or model verification receipt.");
|
||||
return { adapterType: "paperclip_runner", status: "pass", testedAt: new Date().toISOString(), checks: [{ code: `${provider}_hello_probe_passed`, level: "info",
|
||||
message: `The native ${provider} runtime verified the selected account and model in ${remote ? "the selected environment" : "the Paperclip host"}.` }] };
|
||||
} catch (error) {
|
||||
const message = redactNativeProbeMessage(error instanceof Error ? error.message : "The selected native runtime could not verify this account.", environment);
|
||||
const authentication = /(?:invalid (?:api[- ]?key|auth(?:entication)? token)|authentication (?:failed|required)|unauthenticated|unauthorized|not authenticated|please (?:log|sign) in|not logged in|\b(?:401|403)\b)/i.test(message);
|
||||
return { adapterType: "paperclip_runner", status: "fail", testedAt: new Date().toISOString(), checks: [{ code: `${provider}_hello_probe_${authentication ? "auth_required" : /timed out/i.test(message) ? "timeout" : "failed"}`, level: "error", message,
|
||||
hint: "Check the selected account, model access, and native runtime prerequisites, then retry. Legacy runner is available explicitly in Advanced." }] };
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user