PaperClipAI/docs/deploy/overview.md at 98df214917bc8f8a70b63b58105a1deea7cd73b0

0 Fork 0

mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-25 17:45:53 +01:00

Files

T

Harold KimandPaperclip 98df214917 fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-07-09 10:08:57 +00:00

1.4 KiB

Raw Blame History

title, summary

title	summary
Deployment Overview	Deployment modes at a glance

Paperclip supports three deployment configurations, from zero-friction local to internet-facing production.

Deployment Modes

Mode	Auth	Best For
`local_trusted`	No login required	Single-operator local machine
`authenticated` + `private`	Login required	Private network (Tailscale, VPN, LAN)
`authenticated` + `public`	Login required	Internet-facing cloud deployment

Quick Comparison

Local Trusted (Default)

Loopback-only host binding (localhost)
No human login flow
Fastest local startup
Best for: solo development and experimentation

Authenticated + Private

Login required via Better Auth
Binds to all interfaces for network access
Auto base URL mode (lower friction)
Best for: team access over Tailscale or local network

Authenticated + Public

Login required
Explicit public URL required
Stricter security checks
Best for: cloud hosting, internet-facing deployment

Choosing a Mode

Just trying Paperclip? Use local_trusted (the default)
Sharing with a team on private network? Use authenticated + private
Deploying to the cloud? Use authenticated + public — see AWS ECS Fargate guide

Set the mode during onboarding:

pnpm paperclipai onboard

Or update it later:

pnpm paperclipai configure --section server

1.4 KiB Raw Blame History