mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 02:00:52 +01:00
Harold KimandPaperclip
98df214917
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
18 lines
714 B
Docker
18 lines
714 B
Docker
# syntax=docker/dockerfile:1.6
|
|
ARG BASE_TAG=dev
|
|
FROM paperclipai/agent-runtime-base:${BASE_TAG}
|
|
|
|
# hermes_local is in the legacy sessioned-adapter set but has no upstream
|
|
# npm package wired into Paperclip locally yet (see
|
|
# packages/adapter-utils/src/session-compaction.ts vs the absent
|
|
# packages/adapters/hermes-local/). This stub image preserves a cloud
|
|
# runtime slot for hermes_local; whoever ports the hermes binary to
|
|
# Paperclip locally adds the `npm install -g <pkg>` and the PATH check
|
|
# to this Dockerfile.
|
|
#
|
|
# Until then, runs targeting hermes_local on the cloud adapter will boot
|
|
# the container but `agent-shim` will fail with "hermes not on PATH" when
|
|
# it tries to invoke the CLI.
|
|
|
|
USER 1000:1000
|