mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 10:26:26 +01:00
Harold KimandPaperclip
98df214917
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
56 lines
1.4 KiB
Markdown
56 lines
1.4 KiB
Markdown
---
|
|
title: Deployment Overview
|
|
summary: Deployment modes at a glance
|
|
---
|
|
|
|
Paperclip supports three deployment configurations, from zero-friction local to internet-facing production.
|
|
|
|
## Deployment Modes
|
|
|
|
| Mode | Auth | Best For |
|
|
|------|------|----------|
|
|
| `local_trusted` | No login required | Single-operator local machine |
|
|
| `authenticated` + `private` | Login required | Private network (Tailscale, VPN, LAN) |
|
|
| `authenticated` + `public` | Login required | Internet-facing cloud deployment |
|
|
|
|
## Quick Comparison
|
|
|
|
### Local Trusted (Default)
|
|
|
|
- Loopback-only host binding (localhost)
|
|
- No human login flow
|
|
- Fastest local startup
|
|
- Best for: solo development and experimentation
|
|
|
|
### Authenticated + Private
|
|
|
|
- Login required via Better Auth
|
|
- Binds to all interfaces for network access
|
|
- Auto base URL mode (lower friction)
|
|
- Best for: team access over Tailscale or local network
|
|
|
|
### Authenticated + Public
|
|
|
|
- Login required
|
|
- Explicit public URL required
|
|
- Stricter security checks
|
|
- Best for: cloud hosting, internet-facing deployment
|
|
|
|
## Choosing a Mode
|
|
|
|
- **Just trying Paperclip?** Use `local_trusted` (the default)
|
|
- **Sharing with a team on private network?** Use `authenticated` + `private`
|
|
- **Deploying to the cloud?** Use `authenticated` + `public` — see [AWS ECS Fargate guide](aws-ecs.md)
|
|
|
|
Set the mode during onboarding:
|
|
|
|
```sh
|
|
pnpm paperclipai onboard
|
|
```
|
|
|
|
Or update it later:
|
|
|
|
```sh
|
|
pnpm paperclipai configure --section server
|
|
```
|