0 Fork 0

mirror of https://github.com/paperclipai/paperclip.git synced 2026-11-10 12:37:55 +01:00

Files

T

Harold KimandPaperclip 98df214917 fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-07-09 10:08:57 +00:00

bridge-template

fix: fail closed on unusable Codex auth during sandbox auth merge

2026-07-09 10:08:57 +00:00

src

fix: fail closed on unusable Codex auth during sandbox auth merge

2026-07-09 10:08:57 +00:00

package.json

fix: fail closed on unusable Codex auth during sandbox auth merge

2026-07-09 10:08:57 +00:00

README.md

fix: fail closed on unusable Codex auth during sandbox auth merge

2026-07-09 10:08:57 +00:00

tsconfig.json

fix: fail closed on unusable Codex auth during sandbox auth merge

2026-07-09 10:08:57 +00:00

vitest.config.ts

fix: fail closed on unusable Codex auth during sandbox auth merge

2026-07-09 10:08:57 +00:00

README.md

`@paperclipai/plugin-cloudflare-sandbox`

Published Cloudflare sandbox provider plugin for Paperclip.

This package lives in the Paperclip monorepo, but it is intentionally excluded from the root pnpm workspace and shaped to publish and install like a standalone npm package. Operators can install it from the Plugins page by package name, and the host will fetch its dependencies at install time without adding lockfile churn to the Paperclip repo.

Install

From a Paperclip instance, install:

@paperclipai/plugin-cloudflare-sandbox

Configure Cloudflare from Instance Settings -> Environments, not from the plugin's plugin page.

Configuration

The environment uses core driver: "sandbox" with provider: "cloudflare".

Required fields:

bridgeBaseUrl
bridgeAuthToken

Important validation rules:

reuseLease: true requires keepAlive: true
non-local bridgeBaseUrl values must be https://
sessionId is required when sessionStrategy is named

Pasted auth tokens are stored by Paperclip as company secrets because the manifest marks bridgeAuthToken as a secret-ref field.

Bridge template

The package includes an operator-facing Cloudflare Worker scaffold under bridge-template. That template uses @cloudflare/sandbox, a Sandbox Durable Object binding, and a small JSON HTTP surface under /api/paperclip-sandbox/v1.

Local development

cd packages/plugins/sandbox-providers/cloudflare
pnpm install --ignore-workspace --no-lockfile
pnpm build
pnpm test
pnpm typecheck

These commands assume the repo root has already been installed once so the local @paperclipai/plugin-sdk workspace package is available to the compiler during development.