mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 18:31:34 +01:00
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
45 lines
1.1 KiB
TypeScript
45 lines
1.1 KiB
TypeScript
import { createHash } from "node:crypto";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { createLocalServiceKey } from "../server/src/services/local-service-supervisor.ts";
|
|
|
|
export const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
|
|
|
|
export function createDevServiceIdentity(input: {
|
|
mode: "watch" | "dev";
|
|
forwardedArgs: string[];
|
|
networkProfile: string;
|
|
port: number;
|
|
}) {
|
|
const envFingerprint = createHash("sha256")
|
|
.update(
|
|
JSON.stringify({
|
|
mode: input.mode,
|
|
forwardedArgs: input.forwardedArgs,
|
|
networkProfile: input.networkProfile,
|
|
port: input.port,
|
|
}),
|
|
)
|
|
.digest("hex");
|
|
|
|
const serviceName = input.mode === "watch" ? "paperclip-dev-watch" : "paperclip-dev-once";
|
|
const serviceKey = createLocalServiceKey({
|
|
profileKind: "paperclip-dev",
|
|
serviceName,
|
|
cwd: repoRoot,
|
|
command: "dev-runner.ts",
|
|
envFingerprint,
|
|
port: input.port,
|
|
scope: {
|
|
repoRoot,
|
|
mode: input.mode,
|
|
},
|
|
});
|
|
|
|
return {
|
|
serviceKey,
|
|
serviceName,
|
|
envFingerprint,
|
|
};
|
|
}
|