0 Fork 0

mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-25 09:41:04 +01:00

Files

T

History

Felix NovakandPaperclip e3c0e3d430 feat(codex): refresh-failure classification + credential telemetry (PAP-1887)

- Classify Codex auth/refresh failures into three distinguishable classes:
  refresh_token_reused, refresh_token_expired, refresh_token_invalidated
- Emit codex.credential_health telemetry event with company/agent/adapter
  dimensions (AC1: queryable per company/agent/adapter confirmed)
- Track seed source (configured_key/host_file/snapshot_file), last_refresh
  age bucket (lt_1h/lt_8d/gte_8d/missing), and rotations_detected
- Define codex.sync_back_outcome event shape; emission point marked
  TODO(PAP-1872) pending Phase 1.1 landing
- Enforce I5 (no token material in telemetry) via unit test that asserts
  refresh/access/id tokens, openai key, account_id, and email never appear
  in emitted payloads
- fix(codex): read remote credential telemetry snapshot from remote CODEX_HOME
- test(codex): isolate refresh telemetry fixture
- Rebased onto master after PAP-1911 security review and PAP-1978 conflict resolution

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-07-09 05:51:00 +00:00

src

feat(codex): refresh-failure classification + credential telemetry (PAP-1887)

2026-07-09 05:51:00 +00:00

CHANGELOG.md

chore: release v0.3.1

2026-03-12 13:09:22 -05:00

package.json

Make ACP the default engine for local adapters (#9238 )

2026-07-08 19:05:03 -07:00

README.md

PAPA-430: workspace finalize gates + no-remote-git enforcement (#6969 )

2026-05-29 08:25:29 -07:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

README.md

@paperclipai/adapter-utils

Shared utilities for Paperclip adapters: process spawning, environment injection, sandbox/SSH transport, workspace sync, and the round-trip helpers that move code between the local execution-workspace cwd and wherever the agent actually runs.

For the adapter-author guide see docs/adapters/creating-an-adapter.md and the in-repo notes at packages/adapters/AUTHORING.md.

No-remote-git contract

The local execution-workspace cwd is the only persistence boundary across runs. No adapter may depend on a git remote for cross-run state.

Adapters that run the agent on a different host should use the SSH round-trip helpers in src/ssh.ts:

prepareWorkspaceForSshExecution({ spec, localDir, remoteDir }) — bundles the local cwd (tracked files, dirty edits, untracked additions, and the git history needed to reconstruct it) to remoteDir before the run starts. Runs with no git remote configured.
restoreWorkspaceFromSshExecution({ spec, localDir, remoteDir, ... }) — syncs the remote cwd back into localDir after the run, including any new commits the agent created. Also runs with no git remote configured.

prepareRemoteManagedRuntime in src/remote-managed-runtime.ts wraps both calls for adapters that want a per-run remote workspace and an automatic restoreWorkspace() finally hook.

The invariant is pinned by the no-remote-git contract case in src/ssh-fixture.test.ts, which asserts that a remote-only commit propagates to the local worktree through the prepare → restore round-trip with no git remote configured at any point. Do not regress that test.