Files
PaperClipAI/scripts/dev-service-profile.ts
T
Harold KimandPaperclip 98df214917 fix: fail closed on unusable Codex auth during sandbox auth merge
When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-09 10:08:57 +00:00

45 lines
1.1 KiB
TypeScript

import { createHash } from "node:crypto";
import path from "node:path";
import { fileURLToPath } from "node:url";
import { createLocalServiceKey } from "../server/src/services/local-service-supervisor.ts";
export const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
export function createDevServiceIdentity(input: {
mode: "watch" | "dev";
forwardedArgs: string[];
networkProfile: string;
port: number;
}) {
const envFingerprint = createHash("sha256")
.update(
JSON.stringify({
mode: input.mode,
forwardedArgs: input.forwardedArgs,
networkProfile: input.networkProfile,
port: input.port,
}),
)
.digest("hex");
const serviceName = input.mode === "watch" ? "paperclip-dev-watch" : "paperclip-dev-once";
const serviceKey = createLocalServiceKey({
profileKind: "paperclip-dev",
serviceName,
cwd: repoRoot,
command: "dev-runner.ts",
envFingerprint,
port: input.port,
scope: {
repoRoot,
mode: input.mode,
},
});
return {
serviceKey,
serviceName,
envFingerprint,
};
}