mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 02:00:52 +01:00
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
34 lines
931 B
TypeScript
34 lines
931 B
TypeScript
import { spawn } from "node:child_process";
|
|
import { createRequire } from "node:module";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { resolveServerDevWatchIgnorePaths } from "../src/dev-watch-ignore.ts";
|
|
|
|
const require = createRequire(import.meta.url);
|
|
const tsxCliPath = require.resolve("tsx/cli");
|
|
const serverRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
|
|
const ignoreArgs = resolveServerDevWatchIgnorePaths(serverRoot).flatMap((ignorePath) => ["--exclude", ignorePath]);
|
|
|
|
const child = spawn(
|
|
process.execPath,
|
|
[tsxCliPath, "watch", ...ignoreArgs, "src/index.ts"],
|
|
{
|
|
cwd: serverRoot,
|
|
env: process.env,
|
|
stdio: "inherit",
|
|
},
|
|
);
|
|
|
|
child.on("exit", (code, signal) => {
|
|
if (signal) {
|
|
process.kill(process.pid, signal);
|
|
return;
|
|
}
|
|
process.exit(code ?? 0);
|
|
});
|
|
|
|
child.on("error", (error) => {
|
|
console.error(error);
|
|
process.exit(1);
|
|
});
|