mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
Harold KimandPaperclip
98df214917
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
22 lines
1019 B
Gemtext
22 lines
1019 B
Gemtext
# syntax=docker/dockerfile:1.6
|
|
ARG BASE_TAG=dev
|
|
FROM paperclipai/agent-runtime-base:${BASE_TAG}
|
|
|
|
USER root
|
|
RUN npm install -g @google/gemini-cli@latest \
|
|
&& { chown -R 1000:1000 /usr/lib/node_modules || true; }
|
|
|
|
USER 1000:1000
|
|
|
|
# Verify the CLI is on PATH for the shim's exec.LookPath
|
|
RUN command -v gemini >/dev/null 2>&1 || (echo "gemini not on PATH"; exit 1)
|
|
|
|
# Pre-select the gemini-api-key auth mode: gemini-cli refuses headless runs with
|
|
# "Invalid auth method selected." unless settings.json picks an auth type (the
|
|
# GEMINI_DEFAULT_AUTH_TYPE env alone does NOT work, proven empirically). Both
|
|
# schema generations are written (selectedAuthType = legacy, security.auth
|
|
# .selectedType = current). Correct for managed-gateway AND BYOK api-key modes;
|
|
# OAuth flows are interactive and out of scope for sandbox pods.
|
|
RUN mkdir -p /home/paperclip/.gemini \
|
|
&& printf '%s\n' '{"selectedAuthType":"gemini-api-key","security":{"auth":{"selectedType":"gemini-api-key"}}}' > /home/paperclip/.gemini/settings.json
|